From 8365e1ab263ca7711b17da1434f360f9c864c64b Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 13:49:09 +0900 Subject: [PATCH 001/235] docs(ddd): define TEPP bounded-context ownership --- docs/architecture/domain-context-map.md | 105 ++++++++++++++++++++++++ 1 file changed, 105 insertions(+) create mode 100644 docs/architecture/domain-context-map.md diff --git a/docs/architecture/domain-context-map.md b/docs/architecture/domain-context-map.md new file mode 100644 index 000000000..16f45f848 --- /dev/null +++ b/docs/architecture/domain-context-map.md @@ -0,0 +1,105 @@ +# TEPP Domain Context Map + +Status: delivery refactoring authority for the 2026-09-01 queue-consolidation cycle. + +This document applies Domain-Driven Design to the protected-main product. Cargo crates are implementation units; they are not automatically bounded contexts. A crate, ADR number, refusal helper, transport operation, clock type, or equation earns a separate boundary only when it has an independently meaningful domain lifecycle, ubiquitous language, invariants, and reuse boundary. + +## Strategic design + +### Core subdomains + +| Bounded context | Product responsibility | Aggregate / authority | Current implementation nucleus | +| --- | --- | --- | --- | +| Evidence & Semantic Measurement | Preserve source evidence and derive span-grounded semantic/concept observations without replacing source truth | `EvidenceCorpus`, `SemanticUnitSet`, `ConceptDictionaryRevision` | `evidence_core`, `semantic_core` | +| Temporal Event Knowledge | Represent six clocks, event identity, interval relations, typed provenance/transition edges, and time-varying memberships | `EventEpisode`, `TemporalRelationSet`, `MembershipAssignmentSet` | `temporal_core`, `event_core`, `relation_graph`, `membership_core` | +| Topic Measurement | Estimate shared-latent temporal topic coordinates and uncertainty; preserve topic identity through activity/dormancy/reactivation | `TopicModelRun`, `TopicLineage` | `topic_measurement`, `topic_lineage`, `model_selection`, `network_analysis` | +| Longitudinal Psychometrics | Estimate longitudinal/multilevel psychometric quantities and model-comparison evidence | `PsychometricStudy`, `LongitudinalModelRun` | `psychometric_core`, `longitudinal_core`, `psychometric_fit` | +| Analysis Run | Orchestrate cutoff-safe accepted work into durable execution and typed terminal artifacts without owning scientific formulas | `AnalysisRun` | `analysis_engine` | +| Scientific Validation & Claim Promotion | Produce method-specific validation evidence, then decide whether a claim may be promoted under a preregistered evidence contract | `ValidationStudy`, `ClaimPromotionDecision` | `validation_core`, `tepp_simulation`; claim-promotion policy remains incomplete | + +### Supporting subdomains + +| Bounded context | Responsibility | Implementation nucleus | +| --- | --- | --- | +| Interpretation | Evidence-grounded interpretation and independent verification; never numerical authority | `interpretation_gateway` plus contextual-orchestrator ACL | +| Persistence & Recovery | Durable run/artifact storage, restart/recovery, outbox/checkpoint semantics | `persistence_postgres`, `checkpoint_authority` | +| Runtime Security & Operations | authenticated intake, TLS, operational audit, provider receipts, encrypted mappings | `intake_authorization`, `service_tls`, `operational_log`, `provider_receipt`, `encrypted_mapping` | + +### Generic subdomains + +`compute_backend`, `mlx_native_receipt`, serialization, hashing, and transport framing are generic infrastructure. They may serve several bounded contexts but may not define domain truth. + +## Context map + +```mermaid +flowchart LR + ES[Evidence & Semantic Measurement] --> TE[Temporal Event Knowledge] + ES --> TM[Topic Measurement] + TE --> TM + TE --> LP[Longitudinal Psychometrics] + TM --> AR[Analysis Run] + LP --> AR + AR --> SV[Scientific Validation & Claim Promotion] + SV --> IN[Interpretation] + AR --> PR[Persistence & Recovery] + AR --> RO[Runtime Security & Operations] + IN --> RO + CB[Compute Backend] -. generic service .-> TM + CB -. generic service .-> LP + CB -. generic service .-> SV +``` + +Dependency direction follows the arrows. Transport, persistence, UI, and provider adapters may depend on domain/application contracts; domain code must not depend on HTTP, PostgreSQL, CLI, or provider-specific representations. + +## Anti-corruption layers + +- `tepp_api` is an HTTP/CLI adapter around Analysis Run and published read models. It must not own scientific acceptance, estimator formulas, event semantics, or persistence truth. +- `orchestrator_live` is an adapter for contextual-orchestrator. Provider vocabulary is translated into TEPP interpretation/application contracts before crossing the boundary. +- `persistence_postgres` implements repositories owned by domain/application contexts. Other contexts must not query its tables directly. +- `compute_backend` and `mlx_native_receipt` expose execution receipts; a backend receipt is not a scientific result. +- Naruon and LineageWeave contracts are external contexts. Their identifiers and transport vocabulary must remain behind explicit adapters rather than leaking into core aggregates. + +## Ubiquitous language and invariants + +- **Evidence** is immutable source-backed observation, not an inferred fact. +- **Semantic unit** is a span-grounded measured unit tied to source offsets and a versioned concept dictionary. +- **Event time** is when an event occurs; **available time** is when evidence becomes usable; **knowledge cutoff** is an analysis eligibility boundary. They are never aliases. +- **Transition edge** is forward-only state/process change; citation, summary, retrospective report, and support are provenance/evidence relations and never become transitions by coercion. +- **Membership assignment** may be cross-classified or multiple-membership and must not collapse language, template, department, project, location, or role into one entity identity. +- **Analysis run** owns lifecycle, idempotency, execution identity, and terminal artifact binding; it does not redefine estimators. +- **Validation evidence** records method-specific recovery/coverage/parity/invariance/convergence evidence. It is not itself a global scientific acceptance decision. +- **Claim promotion decision** may be made only from a preregistered, versioned evidence contract whose required dimensions are complete. LLM output cannot satisfy a numerical evidence requirement. + +## Crate-boundary repair register + +The following protected-main crates look like rule fragments rather than independent bounded contexts. They are retained temporarily to preserve remote-head compatibility, but new work must treat them as modules/value objects/invariants of the owning context and fold them when the corresponding product-vertical landing vehicle is replayed onto current main. + +| Current crate fragments | Owning bounded context | +| --- | --- | +| `system_clock`, `event_clock`, `assertion_clock`, `cutoff_clock`, `available_clock`, `document_clocks`, `revision_order` | Temporal Event Knowledge | +| `summarizes_edge`, `retrospective_edge`, `support_edge`, `citation_edge`, `outcome_order`, `subevent_containment`, `prediction_contradiction`, `relation_absence`, `role_contradiction` | Temporal Event Knowledge | +| `location_membership`, `episode_membership`, `membership_target` | Temporal Event Knowledge | +| `prompt_source`, `style_source`, `modality_source`, `copied_text`, `copy_identity`, `corpus_background`, `stopword_deletion`, `payload_bound`, `derived_sensitivity` | Evidence & Semantic Measurement | +| `psychometric_fit` | Longitudinal Psychometrics | + +A fold is permitted only after comparing the exact remote head and preserving unique tests, doctoring, research citations, and public compatibility. Public compatibility, when required, is provided by explicit adapters/re-exports with a removal plan; legacy paths do not remain canonical merely to avoid a refactor. + +## Analysis Run directory rule + +New `analysis_engine` profiles must be organized by the owning domain capability, not as an indefinitely growing flat list of one-file refusals. When the queue is replayed, use domain modules such as: + +```text +analysis_engine/src/ + runs/ # lifecycle, identity, idempotency + evidence_measurement/ # source/method-effect admission profiles + topic_measurement/ # topic/model-selection/lineage run composition + psychometrics/ # longitudinal/measurement run composition + event_intelligence/ # TDT/CHRONOS composition + validation/ # validation evidence production only +``` + +Transport-only features stay in `tepp_api`; scientific claim promotion remains a separate application/domain policy boundary instead of being hidden inside one validation-run helper. + +## Migration rule + +Do not perform a repository-wide path rename while more than one hundred remote PR heads are open. That would create avoidable conflicts and discard concurrent-agent intent. Apply path repairs incrementally inside the selected landing vehicle for each bounded context, then close or retarget superseded micro-PRs with exact-head replacement mappings. The target architecture is mandatory; the migration is deliberately staged. \ No newline at end of file From 5529b5f1a23a45dab44ad6b2b3fbd217d96ccd0c Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 13:49:38 +0900 Subject: [PATCH 002/235] docs(delivery): restore live PR queue authority --- .../delivery/pr-queue-authority-2026-09-01.md | 86 +++++++++++++++++++ 1 file changed, 86 insertions(+) create mode 100644 docs/delivery/pr-queue-authority-2026-09-01.md diff --git a/docs/delivery/pr-queue-authority-2026-09-01.md b/docs/delivery/pr-queue-authority-2026-09-01.md new file mode 100644 index 000000000..5125a07e8 --- /dev/null +++ b/docs/delivery/pr-queue-authority-2026-09-01.md @@ -0,0 +1,86 @@ +# PR Queue Delivery Authority — 2026-09-01 + +This is a live-recovery record for delivery issue #175. GitHub state supersedes this document whenever a head, review, check, or ruleset changes. + +## Snapshot + +- Protected default branch: `main` +- Protected-main SHA observed: `1bc02f580cf48e1d39da239f0e818453437c31c3` +- Open pull requests: **141** +- Draft pull requests: **99** +- Non-draft pull requests: **42** +- Effective required-workflow ruleset: `18156473`, `CWL Central required workflows` +- `docs/product-technical-gap-baseline.md` is stale at this snapshot because it still records the previous queue-consolidation completion and older protected-main states. + +These counts are delivery evidence, not a completion claim. A queued, skipped, cancelled, predecessor-head, or stale check is not passing evidence. + +## Queue authority classes + +Every open PR must be classified before merge or closure as one of: + +- `landing_vehicle`: the single current-main vehicle for a buyer-visible bounded-context outcome; +- `stacked_dependency`: unique work that must follow a named landing vehicle; +- `fold_into_landing_vehicle`: unique implementation/test/research evidence that belongs inside another bounded-context vehicle rather than remaining an independent product slice; +- `superseded`: no unique behavior remains after an exact-head replacement comparison; +- `duplicate`: same outcome and implementation authority as another PR, with unique evidence explicitly preserved or shown absent; +- `research_lineage_only`: useful scientific provenance that is not intended to ship as a separate runtime boundary; +- `blocked_external`: otherwise-valid work whose current blocker is external to TEPP and is recorded with an owning issue/PR. + +A PR title, ADR number, local green test, or separate crate does not establish an independent product boundary. + +## Landing order + +The active queue must be reduced in this order: + +1. **Delivery authority and DDD context ownership** — issue #175, this document, and `docs/architecture/domain-context-map.md`. +2. **Analysis Run / scientific evidence vertical** — durable lifecycle, current-head validation evidence, persistence/recovery, terminal results, and operator retrieval. Scientific evidence production must be separated from claim-promotion authority. +3. **Evidence & Semantic Measurement vertical** — span-grounded semantic/concept input, method/source distinctions, immutable source offsets, concept dictionary versioning. +4. **Topic Measurement vertical** — real Rust CPU `f64` shared-latent estimator, uncertainty, true-parameter recovery, candidate-K fitting, topic lineage. +5. **Longitudinal Psychometrics vertical** — coherent ESEM/DSEM/multilevel measurement boundary rather than scalar-equation PR proliferation. +6. **Event Intelligence vertical** — TDT/CHRONOS composition and event-time evidence under Temporal Event Knowledge. +7. **Commercial runtime vertical** — tenancy, durable jobs, observability, backup/restore, release provenance, support. + +New unrelated micro-PRs are release-excluded while this queue exceeds the active-queue target in issue #175. + +## First classification findings + +### PR #356 — validation-run scientific evidence + +Classification: `landing_vehicle_candidate`, pending correction before it may become `landing_vehicle`. + +Reason: it is direct from current protected main and binds cutoff-safe evidence to a validation run, but current review found a scientific-authority defect. The current acceptance rule compares RMSE with a standard error derived from the same residual vector using a caller-selected preregistered multiplier. This can accept arbitrarily large recovery error for pathological residual shapes. The current observation also accepts caller-supplied truth/recovered vectors and an `authored_by_llm` boolean rather than an estimator-owned, digest-bound provenance artifact. Graph recovery, invariance, convergence, and active-backend CPU/GPU parity applicability are not complete in the claimed scientific-acceptance artifact. + +DDD correction: the run should produce **Validation Evidence**. A distinct **Claim Promotion Decision** aggregate, governed by ADR 0014 and a method-specific preregistered evidence contract, decides whether a scientific claim is promotable. No generic “three-SE”, maximum-k, or other rule-of-thumb threshold may substitute for a research- or model-derived acceptance design. + +Until corrected, #356 and downstream wire/HTTP slices must not be treated as a shippable scientific-acceptance vertical. + +### PRs #352 and #355 — same Driver/ctsem TIPREDEFFECT rewrite + +Classification: both `fold_into_landing_vehicle` candidates under Longitudinal Psychometrics; neither is selected as authority yet. + +Both implement the scalar `-a * B` rewrite from the same current-main base. They differ in public naming, refusal guards, tests, doctoring, and documentation edits. Closing either solely because the title and core equation match would discard unique evidence. The consolidation vehicle must retain the stronger named-quantity refusal coverage and realistic published-example tests while avoiding unrelated architecture mega-row edits. + +### Analysis-run transport slices + +PRs for one GET/POST/CLI/status/cancel/retry/export/project-history operation are not separate bounded contexts. Classify them under the Analysis Run application context and `tepp_api` adapter. Parent/child stacks remain documented until a current-main landing vehicle preserves their unique contract tests and consumer compatibility. + +### Evidence/method refusal slices + +PRs binding prompt/style/modality/copied-text/corpus-background/template-copy/location/membership/citation refusals to separate analysis profiles are not automatically independent products. Classify the invariant under Evidence & Semantic Measurement or Temporal Event Knowledge, then fold compatible profiles into one coherent admission/method-effect landing vehicle where the runtime contract does not require an independently versioned lifecycle. + +## Merge evidence required per landing vehicle + +Before merge: + +- re-read exact head/base and effective ruleset; +- compare current remote diff against all PRs marked fold/supersede/duplicate; +- preserve unique tests, public compatibility contracts, citations, and doctoring; +- resolve valid non-outdated review threads; +- obtain the approvals required by the effective ruleset and any stronger non-stale PR-specific bar; +- require all exact-head required workflows to succeed; +- update `docs/product-technical-gap-baseline.md`, architecture/ADR/traceability/changelog when protected-main truth changes; +- do not use force push or protection bypass to simplify consolidation. + +## DDD delivery constraint + +Directory and crate moves are part of the owning product-vertical replay. Do not preserve a technical-layer or one-rule path as canonical if it obscures the domain responsibility. Conversely, do not rename all 58 crates in one sweeping PR while 141 remote heads are active. The target bounded contexts are fixed in `docs/architecture/domain-context-map.md`; migration proceeds through safe, reviewable landing vehicles with explicit anti-corruption adapters and replacement mappings. \ No newline at end of file From 0f8cc55f04177f07d31592245c1dd7781eca6970 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 13:57:09 +0900 Subject: [PATCH 003/235] docs(gaps): replace stale zero-queue snapshot with live recovery baseline --- docs/product-technical-gap-baseline.md | 579 +++++++++---------------- 1 file changed, 204 insertions(+), 375 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 5ea0c95bf..9befa4019 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,397 +1,226 @@ # Product and Technical Gap Baseline -## 2026-08-27 Driver p.16 standardised-map recovery queue (three landed) - -- Five Driver p.16 `std`-family estimator restorations remain individually - reviewable open PRs against protected `c7cf34b8`: `asymDIFFUSIONstd` (#267), - `TRAITVARstd` (#268), `MANIFESTTRAITVARstd` (#270), `MANIFESTVARstd` (#271), - and `TIPREDVARstd` (#272). Each is a small slice and lands only after - exact-head checks and independent review. -- The TDT/CHRONOS composition (#269) folds the two event-intelligence bounded - gates into one versioned workflow. It remains an active-PR slice: queued or - passing Checks do not promote it to implemented-main. -- This register refresh (PR #273) is itself open; snapshot facts were fetched - live at 2026-08-27T07:35:00Z against protected main `c7cf34b8`. - -## 2026-08-26 Pair criterion and Project Journey posterior slice - -- Active branch publishes strict Rust artifacts for - `tepp.lineage_pair_criterion_posterior.v2` and - `tepp.project_journey_posterior.v1`. -- The contracts preserve continuous criterion/event-time draws, distinct - record time, multiple predecessors, branches, transitions, exact ties, - TDT/CHRONOS provenance, unique anchor alignment, and method-derived CPU/MLX - parity receipts. They reject fixed starts, nearest-date substitution, - unsupported certainty, and consumer repair. -- Remaining release gap: no protected-main scientific estimator with - CHRONOS event-time draw generation and real macOS-native MLX Metal parity - produces these artifacts yet. The Rust CPU independent binary TDT-link - criterion posterior now has deterministic synthetic parameter-recovery tests, - and Rust qualitative relation draws have exact-recovery tests, but those - bounded estimators are not evidence that calibrated Project Journey or - channel-weight results are available. -- ADR 0025 is the normative Apple Silicon boundary: Rust-owned native MLX - Metal behind authenticated local transport, exact backend receipts, Linux - `rust_cpu`/`mlx_cpu`/`mlx_cuda`/`rust_opencl` portability, and fail-closed - parity. The native service and hardware E2E remain a release gap. -- `mlx_native_receipt` provides a macOS-only, Rust-owned MLX CPU execution - probe. Its receipt proves only the stated matrix objective and cannot be - reused as an Event Lineage estimator or Metal receipt. -- `event_core` now materializes producer-identified discrete event-time mass - into canonical complete draws and recovers synthetic mass exactly. Inferring - the event-time atoms/mass from admitted evidence and binding the estimator's - own MLX receipt remain open; record time and nearest-date substitution stay - prohibited. -- `analysis_engine` now executes exhaustive actual `D \ {i}` fitter calls and - retains full/deleted seed-domain and corpus identities. The remaining gap is - the scientific temporal topic fitter plus unique anchor alignment, incident - relation/membership deletion, artifact assembly, and estimator-bound backend - parity; the runner alone does not publish case-deletion influence. - -## 2026-08-25 Event Lineage anchor contract slice - -- Exact base: protected `main` `cf0e0ad74d23c5d2e0e33d389bb0bb4d37067c31`. -- This branch publishes TEPP's strict request identity and - `tepp.lineage_criterion_anchor.v1` accepted/rejected artifact contract. -- The buyer-visible integrity gain is fail-closed: LineageWeave cannot promote - fast-mlsirm's internal response structure into calibrated Event Lineage - weights without an exact TEPP-authored criterion result. -- Remaining product gap: the registered TEPP criterion estimator and terminal - artifact delivery are not implemented by this contract slice. Until they - exist and pass scientific recovery/validity gates, production activation - remains unavailable; the consumer must not invent a substitute. -- Acceptance evidence for this slice: complete `tepp_api` tests, warning-free - clippy, strict unknown-field/provenance rejection, schema and ADR/API - traceability, followed by exact-head protected checks and independent review. - -**Status:** Live delivery baseline +**Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-08-27T14:40:00Z -**Protected-main evidence:** `9cd1b263926c456e8c56424c43679d3611310ddb` (merge of [PR #269](https://github.com/ContextualWisdomLab/TEPP/pull/269) TDT/CHRONOS composition at 2026-08-27T14:35Z, on top of #268 TRAITVARstd) -**Workspace version on protected main:** `0.2.0` -**Canonical gap-baseline authority:** [PR #164](https://github.com/ContextualWisdomLab/TEPP/pull/164). [PR #164](https://github.com/ContextualWisdomLab/TEPP/pull/164) merged; this file is now maintained by follow-up refresh PRs against protected main. +**Snapshot:** 2026-09-01 13:50 KST +**Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` +**Workspace version:** `0.2.0` +**Delivery authority:** issue [#175](https://github.com/ContextualWisdomLab/TEPP/issues/175), this register, and [`docs/delivery/pr-queue-authority-2026-09-01.md`](delivery/pr-queue-authority-2026-09-01.md) +**DDD authority:** [`docs/architecture/domain-context-map.md`](architecture/domain-context-map.md) ## Purpose -This document is the executable operator-gap register for TEPP. It separates: - -- capabilities an operator can use from protected `main`; -- bounded work that exists only on open pull requests; -- product-completion issues with measurable acceptance evidence; and -- release claims that remain prohibited. - -A planning document, local test, queued check, predecessor-head result, LLM -judgment, or mergeable branch does not make a capability shipped. Re-read live -GitHub state before any customer, release, certification, or valuation claim. - -## Snapshot facts - -| Signal | Snapshot evidence | Delivery implication | -|---|---:|---| -| Protected-main SHA | `c7cf34b84d087904bdcb4604479dda2ed8cfcf77` (2026-08-26T12:40Z, merge of [#266](https://github.com/ContextualWisdomLab/TEPP/pull/266)) | All as-built claims are bounded to this commit. | -| Workspace members | 58 unique Rust crates | The repository is modular, but the approved target still lacks complete semantic, compute, psychometric-engine, event-intelligence, interpretation, artifact, and visual product boundaries. | -| Workspace version | `0.2.0` (aligned across every crate manifest) | A version number alone does not establish a supported product release; no signed artifact or support policy exists yet. | -| Open pull requests | **3** | Active queue: #270 MANIFESTTRAITVARstd, #271 MANIFESTVARstd, #272 TIPREDVARstd. | -| Draft pull requests | **0** | No drafts are open at this snapshot; the previously referenced repair and life-cycle orchestration drafts are closed. | -| Open product issues | **9** | Issues #166–#167 and #169–#174 plus #176 remain open. Result-contract issue #156, semantic-units issue #168, queue-consolidation issue #175, and lineage-consumer issue #155 are all CLOSED. | -| Current package version | `0.2.0` | No supported product release is established by the repository version alone; the tagged cut remains queued. | - -The pull-request counts come from the live GitHub search at this snapshot. The -full exact-head classification lives in this register; re-read live GitHub -state immediately before every mutation. Passing or queued Checks on an open PR never -promote that PR to implemented-main. - -### Post-#239/#266 state note - -[#239](https://github.com/ContextualWisdomLab/TEPP/pull/239) (`c482ccea`) and -[#266](https://github.com/ContextualWisdomLab/TEPP/pull/266) (`c7cf34b8`) merged -as squash and landed things operators must know: - -1. **network_analysis estimator repairs and provider-owned analysis-run status - HTTP exchange:** exact two-sided Fisher z-transform p-values replace - pseudo-p-values; fail-closed guard ordering for non-finite correlations and - short samples; negative-effect edges excluded from the whole consensus - perturbation pipeline; explicit validated `edge_drop_probability`; - bounds-safe admission helpers; and the provider-owned status/read HTTP - exchange for caller-scoped analysis-run probes. This advances GAP-009's - estimator core beyond the #230 merge (`a69eb3e2`) it builds on. -2. **Workspace version alignment 0.1.0 → 0.2.0** across every crate manifest, - matching the CHANGELOG `[0.2.0] - 2026-08-25` entry. The version bump is not - itself a release: no tag, signed artifact, SBOM/provenance bundle, or support - policy exists yet ([GAP-011](#operator-gap-register)). -3. **Driver p.16 `std`-family restorations continue on protected main:** the - Driver et al. (2017) SDE discrete-time recovery suite drained through - #231/#232 was extended by `T0MEANSstd` (#262) and `T0VARstd` (#265); the - remaining `std`-family restorations stay open as #267/#268/#270/#271/#272. - -### Queue-consolidation progress (GAP-012) — COMPLETE (issue #175 closed) - -The main non-draft pull-request queue reached **zero** at 2026-08-25T02:30Z and -issue [#175](https://github.com/ContextualWisdomLab/TEPP/issues/175) is CLOSED. -All previously queued slices landed on protected main through: - -1. the hourly scheduler (independent merges of ~40 PRs); -2. batch integration vehicle [#215](https://github.com/ContextualWisdomLab/TEPP/pull/215) (31 folded green slices with per-slice merge-commit provenance); and -3. individual rebase-and-admin-merge passes for the remainder, including the - psychometric recovery stack drained through vehicles - [#231](https://github.com/ContextualWisdomLab/TEPP/pull/231)/[#232](https://github.com/ContextualWisdomLab/TEPP/pull/232), - coverage repair [#219](https://github.com/ContextualWisdomLab/TEPP/pull/219) - (merged 2026-08-25T03:17Z), terminal-result contract - [#157](https://github.com/ContextualWisdomLab/TEPP/pull/157) (merged - 2026-08-25T02:53Z), posterior network estimator - [#230](https://github.com/ContextualWisdomLab/TEPP/pull/230) (merged - 2026-08-25T06:24Z), and network-repair/version-alignment - [#239](https://github.com/ContextualWisdomLab/TEPP/pull/239). - -The residual open PRs are new forward work (register refresh #273, release cut, -API anchor contract, coverage completion, event-intelligence fold, and the -`std`-family psychometric restorations #267/#268/#270/#271/#272), not backlog. - -## Snapshot open pull-request evidence - -The following exact-head register was fetched live from GitHub at -2026-08-27T07:35:00Z against protected main `c7cf34b8`. Review decisions, -required Checks, and mergeability remain volatile; the live GitHub API -supersedes this snapshot. `draft=false` is not approval, mergeability, or a -passing-check claim. Re-read the full SHA, current review decision, required -Checks, and branch rules immediately before every mutation. - -| PR | Exact current head | Draft | Base | Title | -| #272 | `eff029c809d2e3227c8fb31e42348464268ce511` | false | main | feat(psychometric): restore Driver p.16 TIPREDVARstd v/v=1 on main | -| #271 | `6033582cb060f3ad7b32a4f9ece16d642727393e` | false | main | feat(psychometric): restore Driver p.16 MANIFESTVARstd θ/θ=1 on main | -| #270 | `b4b51f135eb653b4b39241da4a64b89dd7abfc73` | false | main | feat(psychometric): restore Driver p.16 MANIFESTTRAITVARstd ψ/ψ=1 on main | -|---:|---|:---:|---|---| - - - - - - - -Note on #241: the #239 squash-merge landed through its pre-fix head, so #241 -cherry-picks the final coverage-and-semantics commit (dead singleton-guard -removal in `network_analysis::consensus`, unreachable let-else replacement in -`evidence_core::image_unit`) onto current main. Until #241 merges, protected -main carries those two dead-branch semantics points; they are test debt, not a -weakened 100% gate. - -Review decisions, required Checks, and mergeability remain volatile; re-read -them immediately before every mutation. This snapshot is not merge authorization -and does not treat queued or passing Checks as shipped protected-main behavior. - -## Authority and derivation - -| Concern | Canonical authority | Constraint | -|---|---|---| -| Product outcomes | [`docs/product/prd-v0.4-approved.md`](product/prd-v0.4-approved.md) | Defines the release product, users, visual surfaces, scientific claims, and eight delivery phases. | -| Technical/runtime requirements | [`docs/TRD.md`](TRD.md) | Requires independently usable Rust boundaries, CPU `f64` authority, temporal eligibility, realistic validation, and warning-free release evidence. | -| Architecture and service boundaries | [`ARCHITECTURE.md`](../ARCHITECTURE.md), [`docs/UML.md`](UML.md), [`docs/API_CONTRACT.md`](API_CONTRACT.md) | Separates evidence, measurement, compute, psychometrics, event intelligence, interpretation, artifacts, and visual analytics. | -| Data authority | [`docs/ERD.md`](ERD.md), [`docs/TRACEABILITY.md`](TRACEABILITY.md), [`docs/adr/0013-bitemporal-persistence-reproducibility-and-split-authority.md`](adr/0013-bitemporal-persistence-reproducibility-and-split-authority.md) | Requires normalized persistence, six-clock eligibility, relation-aware splits, immutable provenance, and reproducible artifacts. | -| Scientific claim promotion | [`docs/adr/0014-scientific-claim-promotion-and-release-evidence.md`](adr/0014-scientific-claim-promotion-and-release-evidence.md), [`docs/TEST_STRATEGY.md`](TEST_STRATEGY.md) | Requires production-code recovery, uncertainty, parity, exact-head checks, and independent review before promotion. | -| LLM authority | [`docs/adr/0010-adaptive-llm-orchestration.md`](adr/0010-adaptive-llm-orchestration.md), [`docs/LLM_ORCHESTRATION.md`](LLM_ORCHESTRATION.md) | LLMs may propose and verify interpretations; deterministic/statistical gates remain authoritative. | -| Privacy/security/assurance | [`docs/PRIVACY_DATA_GOVERNANCE.md`](PRIVACY_DATA_GOVERNANCE.md), [`SECURITY.md`](../SECURITY.md), [`docs/THREAT_MODEL.md`](THREAT_MODEL.md), [`docs/COMPLIANCE_READINESS.md`](COMPLIANCE_READINESS.md) | Preserves legitimate PII utility through purpose-bound access while prohibiting credential/source leakage and unsupported certification claims. | -| Research | [`docs/research/standards-and-literature.md`](research/standards-and-literature.md) | Method and standards claims require current authoritative sources and APA 7 traceability. | -| Live delivery | [open PRs](https://github.com/ContextualWisdomLab/TEPP/pulls?q=is%3Apr+is%3Aopen), [open issues](https://github.com/ContextualWisdomLab/TEPP/issues?q=is%3Aissue+is%3Aopen) | Live GitHub state supersedes this time-stamped queue snapshot. | - -## Protected-main as-built baseline - -Protected `main` contains 58 unique Rust crate boundaries in the current -workspace manifest (as of `c7cf34b8`). The `members` and `default-members` -arrays enumerate the same crate set for distinct Cargo commands; the -unique-crate count is the authoritative modularity measure. -The core boundaries include: +This document is the current operator-facing authority for product and technical gaps. Historical queue snapshots remain available in Git history; they are not copied forward when their facts are no longer true. + +A planning document, local test, queued or skipped check, predecessor-head result, mergeable branch, separate crate, ADR number, or LLM judgment does not make a capability shipped. Re-read live GitHub state before every merge, customer claim, release claim, certification claim, or closure decision. + +## Live snapshot + +| Signal | Current evidence | Delivery implication | +| --- | --- | --- | +| Protected `main` | `1bc02f580cf48e1d39da239f0e818453437c31c3` | All protected-main capability claims are bounded to this commit until `main` changes. | +| Workspace | 58 Rust crates | Cargo modularity is implementation structure, not proof of 58 bounded contexts. Several crates are one-clock/one-edge/one-rule fragments that belong inside larger domain boundaries. | +| Workspace version | `0.2.0` | Version metadata is not a supported release. | +| Open pull requests | **142** | The delivery queue is again a release blocker. This count includes the queue-recovery PR created from this snapshot. | +| Draft pull requests | **100** | Draft state is not a substitute for classification; every remote head still needs an owning bounded context and a replacement/landing decision. | +| Non-draft pull requests | **42** | A non-draft PR is not merge-ready without exact-head ruleset evidence and resolved scientific/product blockers. | +| Open issues | **13** | Product-completion and newly discovered equation/recovery work coexist; issue count alone does not define product priority. | +| Required ruleset | `18156473` — `CWL Central required workflows` | Organization ruleset is the effective merge authority: one approving review, stale-approval dismissal, resolved conversations, unattributed-change approval, and central required workflows. | + +The classic branch-protection payload reports no status-check contexts, but that is not the effective policy source. The active organization ruleset applies to the default branch and supplies the review/workflow gates. Do not bypass it merely because repository-level classic protection looks empty. + +## Strategic Domain-Driven Design baseline + +Cargo crates are not automatically bounded contexts. The current product responsibilities are: + +### Core subdomains + +| Bounded context | Aggregate authority | Primary implementation nucleus | +| --- | --- | --- | +| Evidence & Semantic Measurement | `EvidenceCorpus`, `SemanticUnitSet`, `ConceptDictionaryRevision` | `evidence_core`, `semantic_core` | +| Temporal Event Knowledge | `EventEpisode`, `TemporalRelationSet`, `MembershipAssignmentSet` | `temporal_core`, `event_core`, `relation_graph`, `membership_core` | +| Topic Measurement | `TopicModelRun`, `TopicLineage` | `topic_measurement`, `topic_lineage`, `model_selection`, `network_analysis` | +| Longitudinal Psychometrics | `PsychometricStudy`, `LongitudinalModelRun` | `psychometric_core`, `longitudinal_core`, `psychometric_fit` | +| Analysis Run | `AnalysisRun` | `analysis_engine` | +| Scientific Validation & Claim Promotion | `ValidationStudy`, `ClaimPromotionDecision` | `validation_core`, `tepp_simulation`; claim-promotion policy remains incomplete | + +### Supporting subdomains + +- Interpretation +- Persistence & Recovery +- Runtime Security & Operations + +### Generic subdomains + +- compute backend execution +- MLX/native execution receipts +- serialization, hashing, transport framing + +Detailed context relationships, ubiquitous language, anti-corruption layers, and staged path repairs are normative in [`domain-context-map.md`](architecture/domain-context-map.md). + +### Dependency invariants + +- Transport/UI/persistence adapters depend on domain/application contracts; domain code does not depend on HTTP, PostgreSQL, CLI, or provider DTOs. +- `tepp_api` is an adapter around Analysis Run and published read models. It does not own estimator mathematics, scientific acceptance, temporal truth, or persistence truth. +- `persistence_postgres` implements repositories; other bounded contexts do not read its tables directly. +- contextual-orchestrator, Naruon, and LineageWeave remain external contexts behind anti-corruption layers. +- A compute/backend receipt proves execution of the named backend operation, not scientific validity. +- LLM output can propose or verify interpretation; it cannot satisfy numerical evidence or promote a scientific claim. + +## Active delivery gaps + +| ID | Gap | Current maturity | Delivery authority | Required closure evidence | +| --- | --- | --- | --- | --- | +| GAP-001 | PR authority is fragmented across 142 open heads and the former zero-queue baseline became stale. | `release-blocking` | [#175](https://github.com/ContextualWisdomLab/TEPP/issues/175), [#435](https://github.com/ContextualWisdomLab/TEPP/pull/435) | Every open PR classified by exact head and bounded-context ownership; coherent landing vehicles selected; duplicates/superseded slices closed only after unique evidence is preserved; queue reduced without protection bypass. | +| GAP-002 | Real multilingual evidence is only partially transformed into validated span-grounded semantic/concept observations with complete language/profile/invariance evidence. | `partial` | Evidence & Semantic Measurement vertical; historical #168 first slice is closed | Immutable offsets, Unicode/layout-aware segmentation, versioned concept dictionary, shared-concept/native-lexical channels, unknown-concept review, language-profile calibration/invariance, prompt-injection and image-position evidence. | +| GAP-003 | Shared-latent temporal topic measurement is not yet a complete production scientific estimator. | `partial` | [#167](https://github.com/ContextualWisdomLab/TEPP/issues/167) | Rust CPU `f64` estimator over admitted evidence; explicit likelihood/estimands; uncertainty; time/relation/multiple-membership effects; deterministic reduction; multiple seeds/initialisations; known-truth RMSE/bias/coverage/convergence; real candidate-`K` fits. | +| GAP-004 | Analysis Run is not yet one durable buyer workflow from immutable evidence through scientifically promotable result artifacts and restart/recovery. | `partial` | [#166](https://github.com/ContextualWisdomLab/TEPP/issues/166) | Idempotent lifecycle, persistence/recovery, terminal artifacts, estimator-bound provenance, complete validation evidence, separate claim-promotion decision, Compose E2E, hot-partition evidence. | +| GAP-005 | Longitudinal/multilevel psychometrics remains fragmented across scalar recovery slices rather than one composed ESEM/DSEM product boundary. | `partial` | [#169](https://github.com/ContextualWisdomLab/TEPP/issues/169) | Coherent Rust longitudinal model, plausible-value uncertainty, irregular time, multiple membership, invariance, known-truth recovery, bounded CPU/GPU parity, and one public product contract. | +| GAP-006 | TDT/CHRONOS event intelligence remains bounded components rather than one calibrated temporal-event workflow. | `partial` | [#170](https://github.com/ContextualWisdomLab/TEPP/issues/170) | Span-grounded event evidence, calibrated TDT tasks, CHRONOS schema/forecast state, interval consistency, known-truth recovery, durable artifacts and exports. | +| GAP-007 | Real accelerator support and memory control are incomplete. | `accepted-target` | [#171](https://github.com/ContextualWisdomLab/TEPP/issues/171) | Real hardware execution, CPU `f64` parity, streamed/bounded memory, OOM/fallback evidence, no skipped-hardware claim. | +| GAP-008 | Posterior network/cluster workflow is incomplete as a buyer-visible stable product vertical. | `partial` | [#172](https://github.com/ContextualWisdomLab/TEPP/issues/172) | Known-truth network recovery, uncertainty/stability, repeated Leiden consensus, accessible exact-value exports and reproducible run binding. | +| GAP-009 | Evidence-grounded interpretation is not yet a validated production interpreter/verifier workflow. | `partial` | [#176](https://github.com/ContextualWisdomLab/TEPP/issues/176) | contextual-orchestrator execution, citations, independent verifier, comparable-budget ablations, fallback/abstention, no numerical-authority escalation. | +| GAP-010 | Coordinated buyer UI and exact-value accessible visual analytics are incomplete. | `accepted-target` | [#173](https://github.com/ContextualWisdomLab/TEPP/issues/173) | Real Figma file ID, Storybook inventory, design tokens, keyboard/touch/accessibility states, exact-value tables, print/PDF/JSON/SVG provenance. | +| GAP-011 | TEPP is not yet an operable supported multi-tenant release. | `accepted-target` | [#174](https://github.com/ContextualWisdomLab/TEPP/issues/174) | OIDC/RLS/purpose controls, durable queue/storage, OpenTelemetry/SLOs, backup/restore, load/recovery, migrations, signed release/SBOM/provenance, support policy. | +| GAP-012 | Directory/crate structure contains technical fragments that obscure bounded-context ownership. | `active-refactor` | [#435](https://github.com/ContextualWisdomLab/TEPP/pull/435) and each subsequent landing vehicle | Incremental path/crate folds by domain responsibility, explicit compatibility adapters where required, no cross-context direct DB access, no cyclic dependency or Shared-Kernel expansion. | + +## Delivery sequence + +The current priority is dependency-driven rather than PR-number-driven: + +1. Restore queue and bounded-context authority (#175 / #435). +2. Consolidate Evidence & Semantic Measurement so real multilingual source evidence has one admission/measurement boundary. +3. Complete the real Rust CPU `f64` shared-latent topic estimator (#167). +4. Complete the durable end-to-end Analysis Run and scientific evidence/promotion boundary (#166). +5. Compose Longitudinal Psychometrics (#169) and Event Intelligence (#170) instead of continuing one-equation product slices. +6. Add real accelerator parity only after the CPU scientific authority is complete (#171). +7. Complete posterior network/cluster, interpretation, and buyer visual workflows (#172/#176/#173). +8. Productionize tenancy, durability, observability, recovery, release, and support (#174). + +A small dependency repair may land ahead of this list when it directly unblocks a selected landing vehicle. It does not create a new product priority. + +## Queue consolidation rules + +Every open PR receives one classification: + +- `landing_vehicle` +- `stacked_dependency` +- `fold_into_landing_vehicle` +- `superseded` +- `duplicate` +- `research_lineage_only` +- `blocked_external` + +No PR is closed because its title looks similar to another. Before `superseded`, `duplicate`, or `fold_into_landing_vehicle` is applied, compare the exact current remote head and preserve unique production behavior, tests, public compatibility, research citations, doctoring, and provenance. + +One-rule crates and one-operation PRs are not independent product boundaries by default. New work must map to the owning bounded context first. + +### Current classifications established in this recovery slice + +#### PR #356 — Analysis Run validation evidence + +Current head: `df33bfa3e61ae4de3dbfae16df0deac12d2f4003`. + +Classification: `landing_vehicle` **candidate only; scientifically blocked**. + +The useful run-binding work should be preserved, but the current branch must not establish global scientific acceptance because: + +- its RMSE acceptance uses a caller-selected `k × SE(RMSE)` threshold where the SE is derived from the same residual vector; this does not bound absolute recovery error and is not an evidence-derived scientific threshold; +- recovery truth/recovered vectors are caller-provided rather than bound to known-truth and estimator-owned Rust CPU `f64` artifacts by identity/digest; +- a boolean stating that input was not LLM-authored is not provenance; +- graph recovery, invariance, convergence, and active-backend CPU/GPU parity applicability are incomplete for a global claim-promotion artifact. + +DDD correction: this branch may produce **Validation Evidence**. A separate **Scientific Claim Promotion Decision** aggregate governed by ADR 0014 decides promotability from a preregistered, method-specific complete evidence contract. `analysis_engine` does not own psychometric acceptance mathematics. + +Exact-head Product workflow evidence is also not green: coverage-diagnostic jobs failed on the current head. A mergeable GitHub state therefore does not make #356 merge-ready. + +#### PRs #352 and #355 — Driver/ctsem TIPREDEFFECT rewrite + +Classification: both are `fold_into_landing_vehicle` candidates under Longitudinal Psychometrics; neither is superseded yet. + +They share the same core scalar rewrite but differ in public naming, refusal guards, tests, doctoring, and documentation. The eventual landing vehicle must preserve the stronger domain guards and published-example/recovery evidence before either source PR is closed. + +#### Analysis-run transport slices + +Per-operation GET/POST/CLI/status/cancel/retry/export/history slices belong to the Analysis Run application context and `tepp_api` adapter. They remain traceable as stacked dependencies until a current-main landing vehicle preserves each unique contract test and consumer behavior. + +#### Evidence/method refusal slices + +Prompt/style/modality/copied-text/corpus-background/template-copy/location/membership/citation refusal helpers belong under Evidence & Semantic Measurement or Temporal Event Knowledge. A separate crate/PR is retained only when an independently versioned public reuse boundary exists. + +## Directory and crate repair register + +These protected-main paths are staged fold targets; current remote PR compatibility is preserved until the owning landing vehicle is ready: + +| Current fragments | Owning bounded context | +| --- | --- | +| `system_clock`, `event_clock`, `assertion_clock`, `cutoff_clock`, `available_clock`, `document_clocks`, `revision_order` | Temporal Event Knowledge | +| `summarizes_edge`, `retrospective_edge`, `support_edge`, `citation_edge`, `outcome_order`, `subevent_containment`, `prediction_contradiction`, `relation_absence`, `role_contradiction` | Temporal Event Knowledge | +| `location_membership`, `episode_membership`, `membership_target` | Temporal Event Knowledge | +| `prompt_source`, `style_source`, `modality_source`, `copied_text`, `copy_identity`, `corpus_background`, `stopword_deletion`, `payload_bound`, `derived_sensitivity` | Evidence & Semantic Measurement | +| `psychometric_fit` | Longitudinal Psychometrics | + +Do not perform one repository-wide rename while more than one hundred remote heads are active. The target DDD architecture is mandatory, but migration is staged through bounded-context landing vehicles to avoid destroying concurrent-agent intent. + +For `analysis_engine`, new/replayed profiles should converge toward domain-owned modules rather than an indefinitely flat one-file-refusal directory: ```text -evidence_core -temporal_core -event_core -relation_graph -membership_core -persistence_postgres -corpus_split -tepp_simulation -validation_core -tepp_api -topic_measurement -network_analysis -psychometric_core -analysis_engine -interpretation_gateway -compute_backend -mlx_native_receipt +analysis_engine/src/ + runs/ + evidence_measurement/ + topic_measurement/ + psychometrics/ + event_intelligence/ + validation/ ``` -The traceability ledger records meaningful protected-main implementation in -immutable evidence, six clocks and interval reasoning, forward transitions, -event mention/instance separation, weighted multiple membership, cutoff-safe -splits, validation metrics, simulations, PostgreSQL slices, versioned API/export -contracts, orchestration routing, privacy authorization, release-evidence -generation, the CPU topic-measurement reference estimator, the repaired -posterior network estimator (#230 + #239), the Driver et al. (2017) SDE -recovery suite (#231/#232) and its `T0MEANSstd`/`T0VARstd` restorations -(#262/#265), the deterministic analysis-run execution engine, the loopback -interpretation gateway, the provider-owned analysis-run status/read HTTP -exchange (#266), the macOS-native MLX CPU receipt probe -(`mlx_native_receipt`), and VRAM-policy compute types. - -Protected `main` does **not** yet establish the complete approved product. In -particular, it does not contain the full multilingual semantic pipeline beyond -the first span slice, full Bayesian candidate-`K` topic fitting, a composed -longitudinal ESEM/DSEM estimation engine, a calibrated TDT/CHRONOS workflow, -repeated Leiden consensus clustering with buyer-facing exports, real accelerator -kernels with hardware parity, an executed contextual-orchestrator interpreter, -the coordinated visual workspace, or a supported multi-tenant release. - -## Operator-gap register - -| ID | Operator-visible gap | Maturity | Delivery status | Protected-main authority | Current delivery authority | Current head SHA | Closure evidence | -|---|---|---|---|---|---|---|---| -| GAP-001 | Submission produces a durable accepted receipt, and the deterministic terminal-result lifecycle is now implemented-main. | `implemented-main` | closed on protected main | `340087494b0a` lineage merged through [PR #157](https://github.com/ContextualWisdomLab/TEPP/pull/157) (merged 2026-08-25T02:53Z); [#156](https://github.com/ContextualWisdomLab/TEPP/issues/156) CLOSED | — | — | Exact request/result/snapshot/cutoff/model/profile binding, typed terminal failures, deterministic retrieval, and cutoff-safe execution are protected-main behavior as of the #157 merge. | -| GAP-002 | LineageWeave and other modular consumers can rely on the complete protected-main HTTP evidence/result boundary. | `partial` | consumer hardening remains | Terminal-result lifecycle implemented-main via #157; versioned API contract intact | [#156](https://github.com/ContextualWisdomLab/TEPP/issues/156) (closed) / [PR #155](https://github.com/ContextualWisdomLab/TEPP/pull/155) (merged) | — | Remaining work is consumer-side adoption evidence and any versioned-contract drift discovered during integration; core boundary is no longer the gap it was. | -| GAP-003A | Immutable evidence cannot yet be submitted to a durable validation run that produces operator-usable scientific acceptance evidence. | `accepted-target` | product-completion | `e65cd66` (validation metrics are library-level only) | [#166](https://github.com/ContextualWisdomLab/TEPP/issues/166) | `—` (issue program; no current implementation PR) | Compose/CLI/API execution must bind immutable evidence, cutoffs, model configuration, validation metrics, and reproducibility manifests to one idempotent run. | -| GAP-003B | Scientific result artifacts cannot yet be persisted, restarted, and recovered as one supported operator workflow. | `accepted-target` | product-completion | `e65cd66` (persistence contracts lack E2E recovery) | [#166](https://github.com/ContextualWisdomLab/TEPP/issues/166) | `—` (issue program; no current implementation PR) | Durable storage, migration/rollback, restart/recovery, artifact digest verification, and terminal retrieval must pass against a real Compose deployment. | -| GAP-003C | The persistence slice classifies concurrent-write SQLSTATEs, but has no measured hot-partition detection, routing, or mitigation for tenant/result workloads. | `accepted-target` | product-completion | `e65cd66` (conflict classification only; no measured partition control) | [#166](https://github.com/ContextualWisdomLab/TEPP/issues/166) | `—` (issue program; no current implementation PR) | A real Compose/PostgreSQL workload identifies hot keys and partition skew, applies bounded tenant/time or result routing without weakening 3NF or temporal authority, and proves conflict rate, latency, recovery, and migration/rollback behavior under load. | -| GAP-004 | The central shared-latent temporal/relational topic estimator is absent. | `partial` | product vertical | CPU `f64` TRSL-TM reference estimator with ALR/ILR coordinates and refusal gates is implemented-main (v0.2.0 `topic_measurement`); fitted candidate-`K` scoring present | [#167](https://github.com/ContextualWisdomLab/TEPP/issues/167) | — | GPU, method effects, full Bayesian sampling, and topic birth/split/merge remain. This is not full #167 closure. | -| GAP-005 | Real multilingual documents are not yet transformed into validated exact-span semantic units and versioned shared concepts. | `partial` | product vertical | `e65cd66` lineage (semantic_core exact-span units and language-profile validation are implemented-main as the first slice from [PR #201](https://github.com/ContextualWisdomLab/TEPP/pull/201)) | [#168](https://github.com/ContextualWisdomLab/TEPP/issues/168) CLOSED COMPLETED 2026-08-24; residual evidence tracked under product completion (#166/#169) | `—` | Remaining evidence beyond the closed first slice: concept alignment, Unicode/layout/language-tailored processing, unknown-concept review, multilingual calibration/invariance, image-position evidence, and prompt-injection tests. | -| GAP-006 | Posterior topic measurements cannot yet be fitted through a complete cross-classified longitudinal ESEM/DSEM engine. | `partial` | product vertical | Psychometric recovery stack drained onto protected main through integration vehicles [#231](https://github.com/ContextualWisdomLab/TEPP/pull/231)/[#232](https://github.com/ContextualWisdomLab/TEPP/pull/232) (both merged 2026-08-25T06:2xZ): Driver et al. (2017) SDE discrete-time recovery suite with standardised-parameter families and true-parameter RMSE tests is implemented-main (`psychometric_core`) | [#169](https://github.com/ContextualWisdomLab/TEPP/issues/169) | — | Remaining: joint plausible-value uncertainty wiring, full invariance evidence, irregular event-time fitting at production scale, multiple-membership integration with posterior coordinates, and end-to-end composition under #166/#167. Recovery primitives alone are not the ESEM/DSEM engine. | -| GAP-007 | TDT detection/tracking and CHRONOS schema/forecast/temporal reasoning remain isolated bounded gates rather than one calibrated product workflow. | `accepted-target` | product vertical | `e65cd66` (event/time primitives only) | [#170](https://github.com/ContextualWisdomLab/TEPP/issues/170) / [PR #70](https://github.com/ContextualWisdomLab/TEPP/pull/70) | `7a1f33aa68c1` | Span-grounded mentions, calibrated TDT metrics, schema/forecast hypothesis states, interval consistency, known-truth recovery, persistence, and exports. | -| GAP-008 | GPU support is policy-only; no production estimator kernel has real hardware parity or declared VRAM evidence. | `accepted-target` | product vertical | `e65cd66` (VRAM policy only) | [#171](https://github.com/ContextualWisdomLab/TEPP/issues/171) / [PR #51](https://github.com/ContextualWisdomLab/TEPP/pull/51) | `1801501c4d7c` | Real CUDA/portable backend execution, CPU parity, streamed memory, bounded OOM/fallback, hardware profiles, telemetry, and no skipped-support claim. | -| GAP-009 | Topic association and cluster outputs lacked posterior-valid estimation, uncertainty, edge stability, and consensus communities. | `partial` (estimator core + repairs landed; Leiden consensus + buyer workflow remain) | product vertical | `a69eb3e2` (posterior log-ratio edge estimator merged from [PR #230](https://github.com/ContextualWisdomLab/TEPP/pull/230)) advanced by [#239](https://github.com/ContextualWisdomLab/TEPP/pull/239) (`c482ccea`): exact two-sided Fisher z-transform p-values driving Benjamini–Hochberg admission (Benjamini & Hochberg, 1995), percentile-bootstrap credible intervals and selection fractions (Efron, 1979), fail-closed guard ordering for non-finite correlations and short samples, negative-effect edges excluded from the whole consensus perturbation pipeline, explicit validated `edge_drop_probability`, bounds-safe admission helpers | [#172](https://github.com/ContextualWisdomLab/TEPP/issues/172) | — (#241 carries two dead-guard removals) | Remaining closure evidence: repeated Leiden consensus replacing the union-find stand-in (Traag et al., 2019), known-truth network/cluster recovery at production scale, and reproducible exports wired into the end-to-end run (#166). | -| GAP-010 | Operators lack coordinated accessible visual analytics and exact-value export workflows. | `accepted-target` | product vertical | `e65cd66` (no visual workspace) | [#173](https://github.com/ContextualWisdomLab/TEPP/issues/173) | `—` (Figma work not started) | Real Figma File ID in ADR, Storybook/design tokens, ten PRD views, exact-value tables, accessible interaction/print/PDF states, provenance, and source-consistent exports. | -| GAP-011 | TEPP is not yet an operable multi-tenant service or supported release. | `accepted-target` | product vertical | `e65cd66` (library contracts only) | [#174](https://github.com/ContextualWisdomLab/TEPP/issues/174) | `—` (issue program; no current implementation PR) | Durable queue/storage, OIDC/RLS/purpose controls, OpenTelemetry/SLOs, load/recovery, migrations, signed release/SBOM/provenance, assurance evidence, and support policy. | -| GAP-012 | The 71-PR queue obscured authority, repeatedly staled exact-head evidence, and fragmented product boundaries. | `implemented-main` (consolidation complete) | closed | `c7cf34b8` (#239 merged 2026-08-25T09:23Z; #266 merged 2026-08-26T12:40Z); [#175](https://github.com/ContextualWisdomLab/TEPP/issues/175) CLOSED; queue drained from 58 through #215, the hourly scheduler, vehicles #231/#232, and individual passes | — | — | Residual open queue is forward work (register refresh #273, event-intelligence fold #269, `std`-family psychometric restorations #267/#268/#270/#271/#272); no backlog remains. Exact-head discipline stays enforced by this register's refresh rule. | -| GAP-013 | Evidence-grounded LLM interpretation is routed but not executed and validated as a production interpreter/verifier port. | `partial` | active integration | `e65cd66` lineage (routing and refusal contracts implemented-main; loopback interpretation POSTs landed via #92/#107) | [#176](https://github.com/ContextualWisdomLab/TEPP/issues/176), [PR #69](https://github.com/ContextualWisdomLab/TEPP/pull/69), [PR #165](https://github.com/ContextualWisdomLab/TEPP/pull/165) | `8e4a3ca9cc80` / `34083c3f5d66` | Contextual-orchestrator execution, evidence citations, verifier refusals, comparable-budget ablations, provider eligibility/fallback, abstention, live/offline contract tests, and no numerical-authority escalation. | -| GAP-014 | README/TRD and some PR descriptions lag protected-main and live queue reality. | `partial` | documentation drift | Documentation synchronized to `c7cf34b8` through register refreshes including this file (#273) | [#175](https://github.com/ContextualWisdomLab/TEPP/issues/175) (closed) | — | Remaining: reconcile README/TRD crate counts to 58, retire CHANGELOG `[Unreleased]` bullets superseded by the v0.2.0 entry, and keep ADR maturity current. | -| GAP-015 | There was no canonical live product/operator-gap register tied to documentation validation. | `implemented-main` (register + validator); this refresh is the live maintenance slice | register refresh | `c7cf34b8` (register and validator are implemented-main; this snapshot refresh keeps the volatile queue current) | [PR #164](https://github.com/ContextualWisdomLab/TEPP/pull/164) is the merged authority; this refresh is [#273](https://github.com/ContextualWisdomLab/TEPP/pull/273) | `7f6c8a5a4351b4a8d0cfa5b7d2eaadfae71c7a9a` | Land each refresh after exact-head checks and independent review, then regenerate it whenever protected-main or the live queue changes. Only one refresh authority lands per queue state. | -| GAP-016 | Hourly PR maintenance used an older central scheduler revision whose per-repository sweep budgets could amplify the queued review workload. | `active-PR` | operability hardening | `e65cd66` (caller pin before central budget hardening) | [PR #177](https://github.com/ContextualWisdomLab/TEPP/pull/177) | `580d45206536` | The change pins a verified central revision immutably; closure still requires exact-head hosted Checks, resolved threads, and independent review. With the queue near zero the urgency is low but the slice remains unlanded. | -| GAP-017 | Accepted analysis runs have a terminal DTO and cutoff-safe execution on protected main after #157 merged. | `implemented-main` | closed on protected main | [PR #157](https://github.com/ContextualWisdomLab/TEPP/pull/157) merged 2026-08-25T02:53Z carrying the terminal result contract and folded cutoff-safe execution from closed stacked PR #178 | [#156](https://github.com/ContextualWisdomLab/TEPP/issues/156) (closed) / [#166](https://github.com/ContextualWisdomLab/TEPP/issues/166) | — | Exact availability cutoff, snapshot binding, multiple-membership preservation, digest integrity, redacted no-eligible failure, and realistic end-to-end tests are protected-main behavior; remaining E2E composition work belongs to #166. | -| GAP-018 | Coverage debt: the #219 repair landed, and #239 added 27 exact branch cases, leaving two dead-guard semantics points queued on [#241](https://github.com/ContextualWisdomLab/TEPP/pull/241). | `active-PR` | coverage completion | `5c8599442e85` lineage + #219 (merged 2026-08-25T03:17Z) + #239 (`c482ccea`): gates enforce 100% unique production arms; remaining items are dead-branch removals in `network_analysis::consensus` and `evidence_core::image_unit` | [PR #241](https://github.com/ContextualWisdomLab/TEPP/pull/241) | `a12e48c1e61b` | Merge #241 after exact-head Checks plus independent review so protected main carries the final semantics cleanup; two provably-dead singleton guards and an unreachable let-else are the last known items. | - -## Product-completion issue register - -| Issue | Product vertical | Depends on / constrains | -|---:|---|---| -| [#156](https://github.com/ContextualWisdomLab/TEPP/issues/156) **CLOSED** | Completed analysis-run result contract | Landed on protected main through PR #157 (merged 2026-08-25T02:53Z). | -| [#166](https://github.com/ContextualWisdomLab/TEPP/issues/166) | Executable end-to-end analysis run, recovery, and hot-partition readiness | Integrates all scientific/service verticals; cannot substitute placeholders or hide write skew behind an unmeasured queue. | -| [#167](https://github.com/ContextualWisdomLab/TEPP/issues/167) | Shared-latent temporal topic CPU estimator | Numerical foundation for K selection, networks, psychometrics, interpretation, and product E2E; CPU reference landed, full estimator remains. | -| [#168](https://github.com/ContextualWisdomLab/TEPP/issues/168) **CLOSED** | Multilingual semantic units and concept dictionary | Closed COMPLETED 2026-08-24; first-slice span units are implemented-main, remaining invariance/calibration evidence tracks product completion elsewhere. | -| [#169](https://github.com/ContextualWisdomLab/TEPP/issues/169) | Multilevel longitudinal ESEM/DSEM | Consumes posterior topic coordinates and membership/time contracts; recovery stack landed via #231/#232, engine composition remains. | -| [#170](https://github.com/ContextualWisdomLab/TEPP/issues/170) | TDT/CHRONOS event intelligence | Consumes evidence/time/event contracts and supplies calibrated event artifacts; span-grounding fold queued as draft #233. | -| [#171](https://github.com/ContextualWisdomLab/TEPP/issues/171) | Real GPU compute and parity | Accelerates production estimators only after CPU authority is stable. | -| [#172](https://github.com/ContextualWisdomLab/TEPP/issues/172) | Posterior network and consensus clustering | Estimator core plus #239 repairs landed; Leiden consensus and buyer workflow remain. | -| [#173](https://github.com/ContextualWisdomLab/TEPP/issues/173) | Accessible visual analytics and exports | Starts after stable API/artifact contracts; requires Figma and Storybook evidence. | -| [#174](https://github.com/ContextualWisdomLab/TEPP/issues/174) | Commercial deployment/release/support | Wraps a scientifically complete product without weakening gates; v0.2.0 version alignment (#239) is a prerequisite slice, not closure. | -| [#175](https://github.com/ContextualWisdomLab/TEPP/issues/175) **CLOSED** | PR queue and delivery consolidation | Queue consolidation completed at near-zero; issue closed after the residual queue drained through #239. | -| [#176](https://github.com/ContextualWisdomLab/TEPP/issues/176) | Contextual-orchestrator interpreter/verifier | Consumes validated artifacts and cannot promote scientific truth. | - -## Priority pull-request queue - -This table lists every open pull request at snapshot time. The pull request's -live page is authoritative because its head can change after this file is -committed. - -| PR | Current delivery role | Required next action | -|---:|---|---| -| [#273](https://github.com/ContextualWisdomLab/TEPP/pull/273) | Live gap-baseline refresh to protected `c7cf34b8` (GAP-015 maintenance slice) | Exact-head Required Checks must pass on the current head plus independent review before merge; re-dispatch superseded exact-head evidence. | -| [#272](https://github.com/ContextualWisdomLab/TEPP/pull/272) | Driver p.16 `TIPREDVARstd` restore (GAP-006 recovery family) | Exact-head Required Checks must pass on the current head plus independent review before merge; re-dispatch superseded exact-head evidence. | -| [#271](https://github.com/ContextualWisdomLab/TEPP/pull/271) | Driver p.16 `MANIFESTVARstd` restore (GAP-006 recovery family) | Exact-head Required Checks must pass on the current head plus independent review before merge; re-dispatch superseded exact-head evidence. | -| [#270](https://github.com/ContextualWisdomLab/TEPP/pull/270) | Driver p.16 `MANIFESTTRAITVARstd` restore (GAP-006 recovery family) | Exact-head Required Checks must pass on the current head plus independent review before merge; re-dispatch superseded exact-head evidence. | -| [#269](https://github.com/ContextualWisdomLab/TEPP/pull/269) | Calibrated workflow composition: fold TDT detection and CHRONOS schema/forecast reasoning into one versioned product workflow (GAP-007) | Exact-head Required Checks must pass on the current head plus independent review before merge; re-dispatch superseded exact-head evidence. | -| [#268](https://github.com/ContextualWisdomLab/TEPP/pull/268) | Driver p.16 `TRAITVARstd` restore (GAP-006 recovery family) | Exact-head Required Checks must pass on the current head plus independent review before merge; re-dispatch superseded exact-head evidence. | -| [#267](https://github.com/ContextualWisdomLab/TEPP/pull/267) | Driver p.16 `asymDIFFUSIONstd` restore (GAP-006 recovery family) | Exact-head Required Checks must pass on the current head plus independent review before merge; re-dispatch superseded exact-head evidence. | -## Delivery sequence +Scientific claim-promotion policy remains a distinct boundary rather than being hidden inside a validation-run transport helper. + +## Scientific and data invariants + +- Production mathematical, statistical, psychometric, vector, linear/matrix algebra, and token-size arithmetic is Rust-owned. +- CPU `f64` is the scientific numerical reference. Parallel reduction is bounded and deterministic for declared reproducibility modes. +- Event, assertion, document, system, availability, and knowledge-cutoff clocks remain distinct. +- `available_time <= knowledge_cutoff` is enforced for cutoff-safe evidence. +- Transition/process edges are forward-only; citation, support, summary, revision, and retrospective report do not become transitions. +- Cross-classified and weighted multiple membership is preserved; entity role, language, template, project, department, and location are not collapsed into one hierarchy. +- Topic proportions are compositional; raw simplex Pearson correlation is not a scientific network estimator. +- Synthetic data may establish known truth in tests; production output never substitutes synthetic evidence for customer/source evidence. +- LLMs may propose semantic units or interpretations only behind deterministic span/schema/security checks and never replace estimation/validation. +- Database objects use descriptive two-or-more-word `snake_case`, normalized authority tables, explicit temporal/provenance/tenant ownership, measured hot-partition evidence, and explicit UPSERT/idempotency contracts. +- External products integrate through versioned API/event/artifact contracts, never direct application-table access. +- Compliance mappings are readiness evidence, not certification. -The dependency-aware product order is (✓ = landed on protected main): +## Merge gate -1. ✓ **Consolidate delivery authority:** #175 closed; PR #164 merged; queue drained through #239. -2. ✓ **Finish live result contracts:** #156/#157 merged; the LineageWeave consumer parent #155 is implemented-main. -3. ✓ **Build validated multilingual evidence (first slice):** #168 closed COMPLETED 2026-08-24 with span units implemented-main from #201; remaining alignment/invariance evidence tracks product completion under #166/#169. -4. **Build the CPU topic estimator:** #167 — reference estimator landed, full Bayesian/candidate-K fitting remains. -5. **Build event intelligence and posterior networks:** #170 and #172 — network estimator core plus #239 repairs landed; Leiden consensus, buyer workflow, and event-intelligence calibration remain; the calibration compositional fold is open (#269). -6. **Build the posterior-aware longitudinal psychometric engine:** #169 — recovery stack landed via #231/#232 plus #262/#265; remaining Driver p.16 `std`-family restorations are open as #267/#268/#270/#271/#272, and engine composition remains. -7. **Accelerate real kernels with parity:** #171. -8. **Complete the durable end-to-end run:** #166 — terminal-result lifecycle and analysis-run execution engine are implemented-main; full E2E validation remains. -9. **Execute and validate interpretation:** #176. -10. **Design and implement the operator workspace:** #173. -11. **Productionize and release:** #174 — v0.2.0 version alignment landed (#239); tagged cut remains pending. +Before any landing vehicle merges: -Stacking is appropriate where public contracts make dependencies explicit. -Stacking is not a reason to leave multiple unexplained implementation authorities -or stale draft predecessors open. +1. Re-read exact head/base, live ruleset, review decision, unresolved threads, and current required workflow results. +2. Resolve valid review findings at the exact head; do not suppress deprecations, coverage gaps, or scientific failures. +3. Re-run the relevant Rust unit/integration/property/fuzz/known-truth tests and exact-head hosted gates. +4. Require 100% production statement coverage, production branch coverage, and public Rust documentation for the shipped scope. +5. Preserve unique evidence from every PR classified for folding or closure. +6. Update PRD/TRD/ADR/architecture/context map/UML/traceability/doctoring/CHANGELOG when the protected product contract changes. +7. Merge through normal policy. Force push and protection bypass are not queue-consolidation tools. ## Definition of product complete -TEPP is not complete until one released version proves all of the following on -the same protected source lineage: - -- a documented user can install, authenticate, ingest, run, inspect, export, and - recover the product without repository-internal intervention; -- immutable source evidence, six clocks, relation/membership structure, cutoff, - splits, model/config, backend, seeds, and artifacts are reproducible; -- the shared-latent topic estimator and longitudinal psychometric model recover - declared known truth with pre-registered RMSE, bias, coverage, convergence, - calibration, and error-rate gates; -- declared language profiles have span/concept/alignment/invariance evidence; -- event intelligence, topic networks, and clusters have known-truth and - uncertainty/stability evidence; -- accelerator claims use real hardware and match the CPU scientific reference; -- LLM interpretation cites allowed evidence, rejects unsupported claims, and - abstains when evidence or policy is insufficient; -- every visual value has an accessible exact-value and provenance path; -- tenant, purpose, identity, retention, security, migration, backup/restore, - observability, capacity, rollback, SBOM, provenance, and support evidence pass; -- production statement coverage, branch coverage, and public documentation are - 100% for shipped TEPP code; -- current-head CI, security, supply-chain, scientific, and independent review - gates pass with no unresolved release blocker; -- version, CHANGELOG, signed artifacts, and release notes match the protected - source and make no unsupported certification, causality, language, GPU, or - valuation claim; -- the release-blocking PR and issue queues are zero. - -A `200억 달러` bar remains a prioritization heuristic. It is not a valuation -result and cannot replace operator adoption, predictive/construct validity, -operational reliability, proprietary advantage, revenue, retention, or -independent diligence evidence. - -## Architecture, data, and assurance constraints - -- Rust owns production mathematical and psychometric arithmetic. -- CPU `f64` is the numerical reference; parallelism is bounded and GPU work must - prove real-hardware parity. -- Event, assertion, document, system, availability, and knowledge-cutoff clocks - remain distinct. -- Cross-classified and weighted multiple membership prevents atomistic - pseudo-replication. -- Topic proportions remain compositional; valid latent/log-ratio coordinates - feed ESEM and network analysis. -- Database objects use descriptive two-or-more-word `snake_case`, third-normal - form where applicable, explicit tenant/temporal/provenance authority. Hot - partition readiness is a separate acceptance gate: measure skew first, then - mitigate it without denormalizing authority tables or changing temporal - semantics. -- Documents, web/search results, connector data, and LLM output are untrusted. -- Purpose-bound access and protected identity mappings preserve PII utility - without broadcasting or blanket masking. -- External products integrate through versioned API/event/artifact contracts, - never direct application-table access. -- CSAP/SOC 2/ISO/NIST alignment is readiness evidence, not certification. -- Every method/standard decision updates APA 7 traceability and source-to-test - traceability in the same reviewed change. +TEPP is not complete until one supported release proves on the same protected source lineage that a documented user can authenticate, ingest real evidence, execute the approved scientific models, inspect uncertainty and provenance, export results, recover from restart/failure, and operate the service without repository-internal intervention. + +The same release must prove real multilingual measurement evidence, true-parameter recovery, temporal/multiple-membership correctness, real hardware parity for claimed accelerators, interpretation abstention/citation behavior, accessible exact-value visual workflows, tenant/purpose/security controls, migrations, backup/restore, SLO/capacity evidence, signed artifacts/SBOM/provenance, support policy, current-head required workflows, independent review, and zero release-blocking PR/issue queue. + +A valuation target is a prioritization bar, not evidence of market value. Product, scientific, operational, security, adoption, revenue, retention, and independent diligence evidence remain required. ## Refresh rule -Refresh this file when any of the following changes materially: +Refresh this baseline whenever any of these materially changes: -- protected-main SHA or package version; +- protected-main SHA or version; - open PR/draft/issue counts; - a priority PR head/base/review/check/merge state; -- an issue or operator-gap acceptance boundary; -- a capability's implementation maturity; -- the dependency/landing order; -- a release, deprecation, replacement, Figma file, or standards/research basis. - -Keep this file operator-oriented. The volatile per-PR classification lives in -this register's snapshot tables (issue #175 is closed; no separate artifact is -required). Never rewrite an active-PR -capability as protected-main before merge and exact-head verification. +- queue classification or replacement mapping; +- bounded-context ownership or a canonical path/module boundary; +- issue acceptance criteria or implementation maturity; +- release sequence, deprecation, Figma file, standard, or primary research basis. + +Live GitHub state always supersedes the snapshot. Historical snapshots stay in Git history rather than being carried forward as contradictory current facts. From 69e617b878a11d66c28c9335ceac53c032312a81 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 13:57:38 +0900 Subject: [PATCH 004/235] docs(delivery): refresh queue counts after recovery PR --- .../delivery/pr-queue-authority-2026-09-01.md | 25 +++++++++++-------- 1 file changed, 14 insertions(+), 11 deletions(-) diff --git a/docs/delivery/pr-queue-authority-2026-09-01.md b/docs/delivery/pr-queue-authority-2026-09-01.md index 5125a07e8..4062dcedc 100644 --- a/docs/delivery/pr-queue-authority-2026-09-01.md +++ b/docs/delivery/pr-queue-authority-2026-09-01.md @@ -6,13 +6,14 @@ This is a live-recovery record for delivery issue #175. GitHub state supersedes - Protected default branch: `main` - Protected-main SHA observed: `1bc02f580cf48e1d39da239f0e818453437c31c3` -- Open pull requests: **141** -- Draft pull requests: **99** +- Open pull requests: **142** +- Draft pull requests: **100** - Non-draft pull requests: **42** +- Open issues: **13** - Effective required-workflow ruleset: `18156473`, `CWL Central required workflows` -- `docs/product-technical-gap-baseline.md` is stale at this snapshot because it still records the previous queue-consolidation completion and older protected-main states. +- `docs/product-technical-gap-baseline.md` was replaced on this recovery branch so it no longer presents the former zero-queue snapshot as current authority. -These counts are delivery evidence, not a completion claim. A queued, skipped, cancelled, predecessor-head, or stale check is not passing evidence. +The one-PR increase and one-draft increase from the initial 141/99 observation is this recovery PR itself. These counts are delivery evidence, not a completion claim. A queued, skipped, cancelled, predecessor-head, or stale check is not passing evidence. ## Queue authority classes @@ -32,10 +33,10 @@ A PR title, ADR number, local green test, or separate crate does not establish a The active queue must be reduced in this order: -1. **Delivery authority and DDD context ownership** — issue #175, this document, and `docs/architecture/domain-context-map.md`. -2. **Analysis Run / scientific evidence vertical** — durable lifecycle, current-head validation evidence, persistence/recovery, terminal results, and operator retrieval. Scientific evidence production must be separated from claim-promotion authority. -3. **Evidence & Semantic Measurement vertical** — span-grounded semantic/concept input, method/source distinctions, immutable source offsets, concept dictionary versioning. -4. **Topic Measurement vertical** — real Rust CPU `f64` shared-latent estimator, uncertainty, true-parameter recovery, candidate-K fitting, topic lineage. +1. **Delivery authority and DDD context ownership** — issue #175, this document, `docs/product-technical-gap-baseline.md`, and `docs/architecture/domain-context-map.md`. +2. **Evidence & Semantic Measurement vertical** — span-grounded semantic/concept input, method/source distinctions, immutable source offsets, concept dictionary versioning. +3. **Topic Measurement vertical** — real Rust CPU `f64` shared-latent estimator, uncertainty, true-parameter recovery, candidate-K fitting, topic lineage. +4. **Analysis Run / scientific evidence vertical** — durable lifecycle, estimator-bound validation evidence, persistence/recovery, terminal results, and operator retrieval. Scientific evidence production is separated from claim-promotion authority. 5. **Longitudinal Psychometrics vertical** — coherent ESEM/DSEM/multilevel measurement boundary rather than scalar-equation PR proliferation. 6. **Event Intelligence vertical** — TDT/CHRONOS composition and event-time evidence under Temporal Event Knowledge. 7. **Commercial runtime vertical** — tenancy, durable jobs, observability, backup/restore, release provenance, support. @@ -50,9 +51,11 @@ Classification: `landing_vehicle_candidate`, pending correction before it may be Reason: it is direct from current protected main and binds cutoff-safe evidence to a validation run, but current review found a scientific-authority defect. The current acceptance rule compares RMSE with a standard error derived from the same residual vector using a caller-selected preregistered multiplier. This can accept arbitrarily large recovery error for pathological residual shapes. The current observation also accepts caller-supplied truth/recovered vectors and an `authored_by_llm` boolean rather than an estimator-owned, digest-bound provenance artifact. Graph recovery, invariance, convergence, and active-backend CPU/GPU parity applicability are not complete in the claimed scientific-acceptance artifact. -DDD correction: the run should produce **Validation Evidence**. A distinct **Claim Promotion Decision** aggregate, governed by ADR 0014 and a method-specific preregistered evidence contract, decides whether a scientific claim is promotable. No generic “three-SE”, maximum-k, or other rule-of-thumb threshold may substitute for a research- or model-derived acceptance design. +DDD correction: the run should produce **Validation Evidence**. A distinct **Claim Promotion Decision** aggregate, governed by ADR 0014 and a method-specific preregistered evidence contract, decides whether a scientific claim is promotable. No generic standard-error multiplier, maximum-k, or other rule-of-thumb threshold may substitute for a research- or model-derived acceptance design. -Until corrected, #356 and downstream wire/HTTP slices must not be treated as a shippable scientific-acceptance vertical. +Exact-head hosted evidence is also not green: the current Product workflow failed its coverage-diagnostic jobs. The branch remains non-draft in GitHub metadata because the connector's draft-conversion mutation is currently broken; that metadata must not be interpreted as merge readiness. + +Until the scientific and exact-head failures are corrected, #356 and downstream wire/HTTP slices must not be treated as a shippable scientific-acceptance vertical. ### PRs #352 and #355 — same Driver/ctsem TIPREDEFFECT rewrite @@ -83,4 +86,4 @@ Before merge: ## DDD delivery constraint -Directory and crate moves are part of the owning product-vertical replay. Do not preserve a technical-layer or one-rule path as canonical if it obscures the domain responsibility. Conversely, do not rename all 58 crates in one sweeping PR while 141 remote heads are active. The target bounded contexts are fixed in `docs/architecture/domain-context-map.md`; migration proceeds through safe, reviewable landing vehicles with explicit anti-corruption adapters and replacement mappings. \ No newline at end of file +Directory and crate moves are part of the owning product-vertical replay. Do not preserve a technical-layer or one-rule path as canonical if it obscures the domain responsibility. Conversely, do not rename all 58 crates in one sweeping PR while 142 remote heads are active. The target bounded contexts are fixed in `docs/architecture/domain-context-map.md`; migration proceeds through safe, reviewable landing vehicles with explicit anti-corruption adapters and replacement mappings. From 323c87112a2db568ad75b33020be27cb149334dc Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 14:48:17 +0900 Subject: [PATCH 005/235] test(docs): separate queue total from priority inventory --- .../test_product_technical_gap_baseline.py | 37 ++++++++++++++++--- 1 file changed, 31 insertions(+), 6 deletions(-) diff --git a/tests/quality/test_product_technical_gap_baseline.py b/tests/quality/test_product_technical_gap_baseline.py index a65421534..2835470f6 100644 --- a/tests/quality/test_product_technical_gap_baseline.py +++ b/tests/quality/test_product_technical_gap_baseline.py @@ -26,7 +26,7 @@ def valid_baseline(*, count: int = 1, extra: str = "") -> str: "| Signal | Snapshot evidence | Delivery implication |\n" "|---|---:|---|\n" f"| Open pull requests | **{count}** | Queue only. |\n\n" - "## Current open pull-request evidence\n\n" + "## Current priority open pull-request evidence\n\n" "| PR | Exact current head | Draft | Base | Title |\n" "|---:|---|:---:|---|---|\n" f"| #164 | `{VALID_HEAD}` | false | main | docs |\n\n" @@ -52,7 +52,7 @@ def test_baseline_is_required_and_mapped(self) -> None: self.assertIn(f"]({BASELINE_PATH})", documentation) def test_live_repository_baseline_is_structurally_valid(self) -> None: - """The committed register carries a dated SHA-bound inventory.""" + """The committed register carries a dated SHA-bound priority inventory.""" docs.validate_required_files(REPOSITORY_ROOT) docs.validate_documentation_map(REPOSITORY_ROOT) @@ -81,7 +81,7 @@ def test_map_without_baseline_link_fails(self) -> None: docs.validate_documentation_map(root) def test_valid_fixture_passes_structure_validator(self) -> None: - """A dated exact-head register with matching count is accepted.""" + """A dated exact-head register with a priority inventory is accepted.""" with tempfile.TemporaryDirectory() as temporary: root = Path(temporary) @@ -107,15 +107,40 @@ def test_missing_snapshot_sha_closure_or_inventory_fails(self) -> None: with self.assertRaisesRegex(AssertionError, "exact-head"): docs.validate_product_technical_gap_baseline(root) - def test_inventory_count_mismatch_fails(self) -> None: - """Declared open-PR count must match exact-head inventory rows.""" + def test_queue_total_may_exceed_priority_inventory(self) -> None: + """A large live queue need not be duplicated row-for-row in the operator register.""" with tempfile.TemporaryDirectory() as temporary: root = Path(temporary) path = root / BASELINE_PATH path.parent.mkdir(parents=True) path.write_text(valid_baseline(count=94), encoding="utf-8") - with self.assertRaisesRegex(AssertionError, "does not match inventory"): + docs.validate_product_technical_gap_baseline(root) + + def test_queue_total_smaller_than_priority_inventory_fails(self) -> None: + """The declared live queue cannot be smaller than its exact-head subset.""" + + with tempfile.TemporaryDirectory() as temporary: + root = Path(temporary) + path = root / BASELINE_PATH + path.parent.mkdir(parents=True) + path.write_text(valid_baseline(count=0), encoding="utf-8") + with self.assertRaisesRegex(AssertionError, "smaller than priority inventory"): + docs.validate_product_technical_gap_baseline(root) + + def test_duplicate_priority_inventory_row_fails(self) -> None: + """A priority PR may appear at most once in the exact-head inventory.""" + + duplicate_row = f"| #164 | `{VALID_HEAD}` | false | main | docs duplicate |\n" + with tempfile.TemporaryDirectory() as temporary: + root = Path(temporary) + path = root / BASELINE_PATH + path.parent.mkdir(parents=True) + path.write_text( + valid_baseline(count=94, extra=f"\n{duplicate_row}"), + encoding="utf-8", + ) + with self.assertRaisesRegex(AssertionError, "duplicate PR rows"): docs.validate_product_technical_gap_baseline(root) def test_queued_checks_as_implemented_main_fails(self) -> None: From 1021c2421a925e96a2f3b70ff79c3398261d0115 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 14:49:07 +0900 Subject: [PATCH 006/235] fix(docs): validate priority inventory independently --- scripts/validate_documentation.py | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/scripts/validate_documentation.py b/scripts/validate_documentation.py index 7b7364c94..20142b2be 100644 --- a/scripts/validate_documentation.py +++ b/scripts/validate_documentation.py @@ -380,7 +380,7 @@ def _promotion_is_denied(text: str, claim: re.Match[str]) -> bool: def validate_product_technical_gap_baseline(root: Path = ROOT) -> None: - """Require a dated live gap register that does not promote queued Checks.""" + """Require a dated live gap register with an honest priority PR inventory.""" path = root / PRODUCT_TECHNICAL_GAP_BASELINE if not path.is_file(): @@ -403,15 +403,18 @@ def validate_product_technical_gap_baseline(root: Path = ROOT) -> None: ): failures.append("gap baseline treats queued Checks as implemented-main") inventory = list(INVENTORY_ROW.finditer(text)) + inventory_numbers = [match.group("number") for match in inventory] if not inventory: failures.append("gap baseline open-PR inventory has no exact-head rows") + elif len(inventory_numbers) != len(set(inventory_numbers)): + failures.append("gap baseline priority inventory contains duplicate PR rows") count_match = OPEN_PR_COUNT.search(text) if count_match is None: failures.append("gap baseline lacks an open pull-request count") - elif count_match.group("count") != str(len(inventory)): + elif int(count_match.group("count")) < len(inventory): failures.append( "gap baseline open-PR count " - f"{count_match.group('count')} does not match inventory " + f"{count_match.group('count')} is smaller than priority inventory " f"{len(inventory)}" ) if failures: From c8c0ca232fb27b0a828caab159c2b0af2c8bebb7 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 14:52:58 +0900 Subject: [PATCH 007/235] docs(ddd): define temporal dependence composition boundary --- .../temporal-dependence-composition.md | 206 ++++++++++++++++++ 1 file changed, 206 insertions(+) create mode 100644 docs/architecture/temporal-dependence-composition.md diff --git a/docs/architecture/temporal-dependence-composition.md b/docs/architecture/temporal-dependence-composition.md new file mode 100644 index 000000000..4990417e7 --- /dev/null +++ b/docs/architecture/temporal-dependence-composition.md @@ -0,0 +1,206 @@ +# Temporal dependence composition boundary + +**Status:** Accepted target; the upstream Published Language is not yet implemented on protected `main`. + +This document defines the anti-corruption boundary between reusable static psychometric model specification in `ContextualWisdomLab/fast-mlsirm` and TEPP-owned temporal/event composition. It does not add a numerical estimator and does not make an upstream research candidate a supported TEPP model. + +## Ownership + +`fast-mlsirm` owns reusable response-family, dimensional, generalized-mixed, and dependence-aware psychometric specification and numerical kernels. Its Published Language is a versioned immutable candidate manifest whose structural identity covers the exact base response formulation, parameter blocks, dimensional structure, generalized-mixed structure, and dependence structure. + +TEPP owns only the temporal/event composition placed around that published candidate: + +- event time, valid time, assertion time, document time, system time, available time, and knowledge cutoff; +- leakage-safe historical eligibility; +- measurement occasion as a method/rater facet distinct from substantive event time; +- irregular observation intervals; +- time-varying covariates, random effects, cross-classification, and multiple membership; +- longitudinal invariance and drift; +- latent-state evolution and transition equations; +- temporal alignment of dependence geometry; +- event ontology and temporal graph constraints; +- temporal known-truth recovery and rolling-origin validation. + +`contextual-orchestrator` owns every LLM provider call, routing decision, verifier/adjudicator workflow, credential, and model-call provenance. TEPP never calls a model provider directly. + +## Published-language intake + +The TEPP ACL consumes a versioned upstream candidate contract rather than branching on model-family names. At minimum the contract must carry: + +```text +candidate_id +contract_version +contract_digest +base_response_family +base_formulation_id +response_scale +base_parameter_blocks +dimensional_formulation +dimension_count +generalized_mixed_formulation +fixed_effect_blocks +random_effect_blocks +membership_formulation +dependence_kind +dependence_formulation_id +dependence_parameter_blocks +capability_status +estimator_evidence_reference +identification_evidence_reference +recovery_evidence_reference +primary_citation_references +``` + +The ACL rejects missing structural identity, unknown contract versions, digest mismatch, and a request that silently substitutes a local-independent candidate for a dependence-aware request. + +TEPP does not duplicate the upstream `ResponseKernel`, `GeneralizedMixedStructure`, LSIRM, MLSIRM, or DLSJM implementation. When reusable static arithmetic currently exists locally in TEPP, its migration path is parity and recovery against the fast-mlsirm owner, followed by replacement with a versioned adapter and removal of the duplicate production source. + +## Generic temporal compiler + +Temporal expansion is a composition over the upstream candidate identity, not a switch over names such as `rasch`, `2plm`, `mirt`, `ggum`, `lsirm`, or `dlsjm`. + +For each upstream candidate admitted by the ACL, TEPP materializes one temporal-candidate specification with an identity derived from the upstream candidate plus the complete temporal contract. New compatible base families therefore inherit temporal composition automatically when fast-mlsirm publishes them; TEPP does not add a family-specific temporal wrapper. + +A temporal candidate records at least: + +```text +temporal_candidate_id +upstream_candidate_id +upstream_contract_version +upstream_contract_digest +temporal_formulation_id +clock_role_contract +event_time_semantics +occasion_facet_semantics +state_equation_id +temporal_identification_rules +alignment_rules +time_varying_covariates +time_varying_random_effects +time_varying_membership_contract +irregular_interval_contract +estimator_owner +estimator_id +temporal_recovery_contract +capability_status +primary_citation_references +extension_citation_references +``` + +The status is exactly one of `supported`, `research_candidate`, or `unsupported`. Auto-expansion is never auto-activation. + +`supported` requires an explicit combined generative/state equation, temporal identification, an implemented estimator owned by the correct repository, candidate-scoped recovery, and exact citations. A structurally representable but novel coupling is `research_candidate`. An incoherent coupling is `unsupported` with a machine-readable reason. Unknown combinations never fall back to a simpler model. + +## Base-family identity is preserved + +Temporal composition preserves exact base-family semantics and parameter meaning. + +- Rasch remains Rasch and is not renamed generic 1PL. +- 2PLM, justified 3PLM, formulation-qualified 4PLM and 5PLM retain their discrimination, asymptote, guessing, slipping, and asymmetry semantics. +- Confirmatory and exploratory MIRT retain their factor/loading contract; exploratory structure remains a hypothesis until confirmatory and recovery evidence supports longitudinal use. +- Ideal-point/GGUM response processes remain distinct from dominance models. Dependence and time are orthogonal operators and do not convert a dominance model to ideal-point response or vice versa. +- Testlet, rater/facet, nested, crossed, cross-classified, and multiple-membership structure remains explicit. A latent-space dependence layer cannot hide a known hierarchy, rater, method, item-family, or omitted covariate. + +## LSIRM and MLSIRM temporal composition + +LSIRM represents residual person-item interaction through person and item positions in an interaction space and a distance-related interaction effect. TEPP temporal composition preserves the base-model parameters plus the upstream person/item interaction positions, distances, and interaction-strength parameters while adding explicitly identified temporal state evolution. + +MLSIRM is the multidimensional-main-effect latent-space extension described by Kang and Jeon (2025). Multilevel, cross-classified, and multiple-membership operators are separate generalized-mixed dimensions of the specification; the acronym is not redefined as “multilevel LSIRM.” + +A temporal LSIRM/MLSIRM candidate must define how interaction geometry evolves and how successive maps are identified. Raw coordinates from two occasions cannot be compared before the declared translation/rotation/reflection alignment. If scale or orientation is not identified across time, the candidate remains `research_candidate` regardless of apparently smooth trajectories. + +## DLSJM temporal composition + +DLSJM follows Jin and Jeon (2019) as the baseline formulation for joint local item dependence and local person dependence. It is not an LSIRM alias. + +The upstream candidate must preserve distinct parameter blocks for the item-dependence space and person-dependence space. TEPP then composes distinct time-indexed state processes over those spaces. Temporal DLSJM must specify, separately for each space: + +- state/evolution equation; +- translation, rotation, and reflection alignment; +- scale/identification constraints; +- cluster-label alignment when clustering is interpreted longitudinally; +- uncertainty for positions, distances, clusters, and transition parameters. + +No result may compare raw item or person maps across occasions without alignment. A novel response-family × generalized-mixed × DLSJM × temporal-state coupling remains an explicitly named extension and a `research_candidate` until its combined likelihood/state equation, identification, estimator, and recovery are established. + +## Generalized mixed, multilevel, cross-classified, and multiple membership + +Generalized-mixed structure composes orthogonally with dependence and time when the full formulation is scientifically coherent. + +One observation may belong simultaneously to multiple organizations, projects, teams, sources, languages, item families, judges, raters, templates, or event episodes. Cross-classification is not multiple membership; both remain explicit in the candidate identity. + +Multiple-membership weights are auditable and time-valid. They are either observed/normalized under the declared design or estimated by an explicit model. TEPP does not invent equal weights as a fallback. Membership changes are state input with valid/event/available-time provenance; future membership cannot enter a historical cutoff. + +## Explanatory and exploratory candidates + +Explanatory covariates preserve their knowledge cutoff and join the combined model rather than being attached in an unvalidated post-hoc regression when joint estimation is required. + +Exploratory factors/loadings and latent-space geometry are hypotheses. Auto-expansion may materialize temporal exploratory LSIRM/MLSIRM/DLSJM candidates, but they cannot become longitudinal production scoring structures without confirmatory identification, invariance, and recovery evidence. + +## Local-dependence diagnostic order + +The diagnostic boundary is explicit: + +1. Model known factors, testlets, item families, raters/methods, hierarchy, cross-classification, multiple membership, and justified covariates first. +2. Residual person-item interaction may motivate LSIRM/MLSIRM. +3. Joint residual local-item and local-person dependence may motivate DLSJM when its relational representation matches the substantive question. +4. Dependence geometry cannot be used to absorb known design structure or omitted explanatory variables. + +LLM item-generation lineage remains evidence from LineageWeave/contextual-orchestrator and is never numerical dependence evidence by itself. + +## Temporal recovery contract + +Every expanded temporal dependence candidate receives a generated recovery specification covering all parameters that exist in its composed identity. As applicable this includes: + +- latent states and trajectories; +- fixed and random effects and covariance; +- time-valid membership weights; +- factors and loadings; +- lower/upper asymptotes and asymmetry parameters; +- ideal-point locations; +- LSIRM/MLSIRM person and item positions, distances, and interaction strength; +- DLSJM item-space and person-space positions/distances/clusters separately; +- temporal transition/dynamic parameters; +- posterior/interval uncertainty and coverage. + +Known-truth simulation separates event time from available time. The suite includes irregular gaps, delayed reports, retrospective documents, missing occasions, changing memberships, and language/source drift. Evaluation uses leakage-safe rolling origins. Monte Carlo uncertainty is reported for simulation summaries; arbitrary pass percentages or rule-of-thumb thresholds are not scientific promotion criteria. + +A recovery artifact is evidence. A separate Scientific Claim Promotion Decision applies the preregistered method-specific acceptance contract from ADR 0014. A transport success, mergeable PR, LLM judgment, or generic RMSE threshold cannot promote a candidate. + +## DDD context map + +```text +fast-mlsirm Model Specification / Numerical Core + Published Language: versioned candidate manifest + | + v + TEPP anti-corruption layer + | + v +TEPP Temporal/Event Composition + Longitudinal Validation + | + +--------------+---------------+ + | | + v v + Analysis Run application Claim Promotion + adapters/persistence separate authority + +contextual-orchestrator --ACL--> Interpretation only +LineageWeave ------------ACL--> Evidence/lineage input only +``` + +Dependency direction is one-way. TEPP may depend on a versioned fast-mlsirm contract. fast-mlsirm must not import TEPP temporal ontology. Neither repository accesses the other repository's database. + +## Current implementation status + +As of the snapshot that introduced this document, `fast-mlsirm` PR #1714 publishes the proposed non-numerical generalized-mixed/dependence candidate compiler, but it is not yet merged into fast-mlsirm protected `main`. Therefore TEPP has no right to claim this Published Language as available production dependency yet. + +Until that contract lands and is versioned, TEPP should develop only the ACL schema/tests and temporal composition semantics that do not duplicate the upstream compiler or numerical kernel. Any local reusable static psychometric implementation discovered during that work is a migration candidate, not a second canonical source. + +## Research basis + +Jin, I. H., & Jeon, M. (2019). A doubly latent space joint model for local item and person dependence in the analysis of item response data. *Psychometrika, 84*(1), 236–260. https://doi.org/10.1007/s11336-018-9630-0 + +Jeon, M., Jin, I. H., Schweinberger, M., & Baugh, S. (2021). Mapping unobserved item–respondent interactions: A latent space item response model with interaction map. *Psychometrika, 86*(2), 378–403. https://doi.org/10.1007/s11336-021-09762-5 + +Kang, I., & Jeon, M. (2025). Multidimensional latent space item response models: A note on the relativity of conditional dependence. *Psychometrika, 90*(2), 799–826. https://doi.org/10.1017/psy.2025.5 From b0afdfdd87941758a5bc049bccda22752ac0810b Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 14:54:50 +0900 Subject: [PATCH 008/235] docs(gaps): refresh live queue and canonical ownership --- docs/product-technical-gap-baseline.md | 306 ++++++++++++------------- 1 file changed, 149 insertions(+), 157 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 9befa4019..58425ef64 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,226 +1,218 @@ # Product and Technical Gap Baseline -**Status:** Active delivery recovery -**Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-01 13:50 KST -**Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` -**Workspace version:** `0.2.0` -**Delivery authority:** issue [#175](https://github.com/ContextualWisdomLab/TEPP/issues/175), this register, and [`docs/delivery/pr-queue-authority-2026-09-01.md`](delivery/pr-queue-authority-2026-09-01.md) -**DDD authority:** [`docs/architecture/domain-context-map.md`](architecture/domain-context-map.md) +**Status:** Active delivery recovery +**Product:** Temporal Event Psychometrics Platform (TEPP) +**Snapshot:** 2026-09-01T05:53:35Z +**Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` +**Workspace version:** `0.2.0` +**Delivery authority:** issue [#175](https://github.com/ContextualWisdomLab/TEPP/issues/175), PR [#435](https://github.com/ContextualWisdomLab/TEPP/pull/435), and [`docs/delivery/pr-queue-authority-2026-09-01.md`](delivery/pr-queue-authority-2026-09-01.md) +**DDD authority:** [`docs/architecture/domain-context-map.md`](architecture/domain-context-map.md) and [`docs/architecture/temporal-dependence-composition.md`](architecture/temporal-dependence-composition.md) ## Purpose -This document is the current operator-facing authority for product and technical gaps. Historical queue snapshots remain available in Git history; they are not copied forward when their facts are no longer true. +This is the operator-facing authority for the current product and technical gaps. Historical queue snapshots remain in Git history; stale counts and branch-local architecture claims are not carried forward as current facts. -A planning document, local test, queued or skipped check, predecessor-head result, mergeable branch, separate crate, ADR number, or LLM judgment does not make a capability shipped. Re-read live GitHub state before every merge, customer claim, release claim, certification claim, or closure decision. +A planning document, mergeable branch, local test, predecessor-head result, queued/skipped check, ADR number, or LLM judgment does not make a capability shipped. Re-read live GitHub state before every merge, release, scientific claim, or customer-facing maturity claim. ## Live snapshot | Signal | Current evidence | Delivery implication | -| --- | --- | --- | -| Protected `main` | `1bc02f580cf48e1d39da239f0e818453437c31c3` | All protected-main capability claims are bounded to this commit until `main` changes. | -| Workspace | 58 Rust crates | Cargo modularity is implementation structure, not proof of 58 bounded contexts. Several crates are one-clock/one-edge/one-rule fragments that belong inside larger domain boundaries. | -| Workspace version | `0.2.0` | Version metadata is not a supported release. | -| Open pull requests | **142** | The delivery queue is again a release blocker. This count includes the queue-recovery PR created from this snapshot. | -| Draft pull requests | **100** | Draft state is not a substitute for classification; every remote head still needs an owning bounded context and a replacement/landing decision. | -| Non-draft pull requests | **42** | A non-draft PR is not merge-ready without exact-head ruleset evidence and resolved scientific/product blockers. | -| Open issues | **13** | Product-completion and newly discovered equation/recovery work coexist; issue count alone does not define product priority. | -| Required ruleset | `18156473` — `CWL Central required workflows` | Organization ruleset is the effective merge authority: one approving review, stale-approval dismissal, resolved conversations, unattributed-change approval, and central required workflows. | - -The classic branch-protection payload reports no status-check contexts, but that is not the effective policy source. The active organization ruleset applies to the default branch and supplies the review/workflow gates. Do not bypass it merely because repository-level classic protection looks empty. +| --- | ---: | --- | +| Protected `main` | `1bc02f580cf48e1d39da239f0e818453437c31c3` | Capability claims remain bounded to this commit until protected main changes. | +| Open pull requests | **143** | The queue is release-blocking and still growing while consolidation is active. | +| Draft pull requests | **100** | Draft state is not classification or ownership. | +| Non-draft pull requests | **43** | Ready metadata is not merge readiness without exact-head evidence. | +| Open issues | **14** | Includes #437 for repository-wide ADR identity normalization. | +| Effective ruleset | `18156473` | Current ruleset, exact-head workflows, resolved conversations, and qualifying review are the merge authority. | -## Strategic Domain-Driven Design baseline +The repository-level classic branch-protection payload is not the sole policy source. Do not infer that protection is absent from an empty classic required-check list and do not bypass the organization ruleset. + +## Current priority open pull-request evidence -Cargo crates are not automatically bounded contexts. The current product responsibilities are: +This table is an exact-head **priority subset**, not a row-for-row copy of the 143-PR queue. The live total and this operator inventory are deliberately different concepts. -### Core subdomains +| PR | Exact current head | Draft | Base | Ownership / disposition | +| ---: | --- | :---: | --- | --- | +| #435 | `c8c0ca232fb27b0a828caab159c2b0af2c8bebb7` | true | main | queue/DDD recovery landing vehicle; this branch | +| #436 | `460503b6e787362b702509faa955c4730f6d8680` | false | #433 head | Analysis Run/contextual-orchestrator CLI stack; `stacked_dependency` | +| #434 | `c0fbaabd8c95e69407c3b9e50f8d1846bd949598` | false | main | membership-target refusal profile; `fold_into_landing_vehicle` candidate | +| #432 | `3e09ff29cc89ef97a859f3ae50e1297846dd2eeb` | false | main | Topic Measurement profile binding; preserve unique contract tests | +| #425 | `c11558313dd1b95d7528eb5fcb89ad296cf879c0` | false | main | Analysis Run/contextual-orchestrator create CLI stack root candidate | +| #389 | `035bfb087d47543fd7dd87cfdbc4edd778f4a6aa` | false | main | irregular event-time composition; Longitudinal Psychometrics fold candidate | +| #356 | `df33bfa3e61ae4de3dbfae16df0deac12d2f4003` | false | main | Validation Evidence candidate; scientifically blocked from global claim promotion | -| Bounded context | Aggregate authority | Primary implementation nucleus | -| --- | --- | --- | -| Evidence & Semantic Measurement | `EvidenceCorpus`, `SemanticUnitSet`, `ConceptDictionaryRevision` | `evidence_core`, `semantic_core` | -| Temporal Event Knowledge | `EventEpisode`, `TemporalRelationSet`, `MembershipAssignmentSet` | `temporal_core`, `event_core`, `relation_graph`, `membership_core` | -| Topic Measurement | `TopicModelRun`, `TopicLineage` | `topic_measurement`, `topic_lineage`, `model_selection`, `network_analysis` | -| Longitudinal Psychometrics | `PsychometricStudy`, `LongitudinalModelRun` | `psychometric_core`, `longitudinal_core`, `psychometric_fit` | -| Analysis Run | `AnalysisRun` | `analysis_engine` | -| Scientific Validation & Claim Promotion | `ValidationStudy`, `ClaimPromotionDecision` | `validation_core`, `tepp_simulation`; claim-promotion policy remains incomplete | +Passing or queued Checks on an open PR never promote that PR to implemented-main. + +## Strategic Domain-Driven Design baseline -### Supporting subdomains +Cargo crates are implementation units, not bounded contexts. Current product responsibility is organized as follows. -- Interpretation -- Persistence & Recovery -- Runtime Security & Operations +| Subdomain | Bounded context | Aggregate authority | Primary implementation nucleus | +| --- | --- | --- | --- | +| Core | Evidence & Semantic Measurement | `EvidenceCorpus`, `SemanticUnitSet`, `ConceptDictionaryRevision` | `evidence_core`, `semantic_core` | +| Core | Temporal Event Knowledge | `EventEpisode`, `TemporalRelationSet`, `MembershipAssignmentSet` | `temporal_core`, `event_core`, `relation_graph`, `membership_core` | +| Core | Topic Measurement | `TopicModelRun`, `TopicLineage` | `topic_measurement`, `topic_lineage`, `model_selection`, `network_analysis` | +| Core | Temporal Psychometric Composition | `TemporalModelSpecification`, `TemporalModelRun` | TEPP temporal composition around versioned fast-mlsirm contracts | +| Core | Analysis Run | `AnalysisRun` | `analysis_engine` application services; transport remains adapter-owned | +| Core | Scientific Validation & Claim Promotion | `ValidationStudy`, `ClaimPromotionDecision` | `validation_core`, `tepp_simulation`; claim promotion is distinct from evidence generation | +| Supporting | Interpretation | evidence-grounded interpretation workflow | contextual-orchestrator ACL only | +| Supporting | Persistence & Recovery | repository implementations and durable receipts | `persistence_postgres` and object-store adapters | +| Supporting | Runtime Security & Operations | authenticated tenancy/operations | runtime adapters | +| Generic | Compute backend | backend execution receipt | CPU/GPU/MLX adapters; receipt is not scientific authority | -### Generic subdomains +### Canonical owner boundaries -- compute backend execution -- MLX/native execution receipts -- serialization, hashing, transport framing +- **fast-mlsirm** owns reusable static/generalized-mixed/dependence-aware psychometric model specification and numerical kernels, including LSIRM/MLSIRM/DLSJM. +- **TEPP** owns temporal/event composition: six-clock semantics, cutoff safety, irregular time, time-varying covariates/random effects/memberships, longitudinal invariance/drift, state evolution, event ontology/graph, temporal alignment and temporal recovery. +- **contextual-orchestrator** owns every LLM provider call, routing/fallback, credential, verifier/adjudicator execution, and model-call provenance. +- **LineageWeave or the consuming product** owns source/item-generation lineage; lineage is evidence, not numerical authority. -Detailed context relationships, ubiquitous language, anti-corruption layers, and staged path repairs are normative in [`domain-context-map.md`](architecture/domain-context-map.md). +At this snapshot, fast-mlsirm PR #1714 at `362a50e104e532684824a35e16f881c7ddb1ebc9` proposes a non-numerical candidate compiler that preserves exact response/dimensional/generalized-mixed identity and materializes typed LSIRM/MLSIRM/DLSJM candidates. It is not yet merged into fast-mlsirm protected main, so TEPP treats it as an upstream contract dependency in progress and does not copy its implementation. ### Dependency invariants -- Transport/UI/persistence adapters depend on domain/application contracts; domain code does not depend on HTTP, PostgreSQL, CLI, or provider DTOs. -- `tepp_api` is an adapter around Analysis Run and published read models. It does not own estimator mathematics, scientific acceptance, temporal truth, or persistence truth. -- `persistence_postgres` implements repositories; other bounded contexts do not read its tables directly. -- contextual-orchestrator, Naruon, and LineageWeave remain external contexts behind anti-corruption layers. -- A compute/backend receipt proves execution of the named backend operation, not scientific validity. -- LLM output can propose or verify interpretation; it cannot satisfy numerical evidence or promote a scientific claim. +- Domain/application code does not depend on HTTP, CLI, PostgreSQL tables, provider SDK DTOs, or UI state. +- `tepp_api` is an adapter around Analysis Run and published read models; it does not own estimator mathematics, temporal truth, or scientific claim promotion. +- Persistence adapters implement repository contracts. Cross-context direct SQL is prohibited. +- External contexts are isolated behind versioned anti-corruption layers. +- A compute receipt proves execution of the named operation, not scientific validity. +- LLM output may propose or verify an interpretation but cannot satisfy a numerical recovery contract or promote a scientific claim. -## Active delivery gaps +## Temporal dependence composition -| ID | Gap | Current maturity | Delivery authority | Required closure evidence | -| --- | --- | --- | --- | --- | -| GAP-001 | PR authority is fragmented across 142 open heads and the former zero-queue baseline became stale. | `release-blocking` | [#175](https://github.com/ContextualWisdomLab/TEPP/issues/175), [#435](https://github.com/ContextualWisdomLab/TEPP/pull/435) | Every open PR classified by exact head and bounded-context ownership; coherent landing vehicles selected; duplicates/superseded slices closed only after unique evidence is preserved; queue reduced without protection bypass. | -| GAP-002 | Real multilingual evidence is only partially transformed into validated span-grounded semantic/concept observations with complete language/profile/invariance evidence. | `partial` | Evidence & Semantic Measurement vertical; historical #168 first slice is closed | Immutable offsets, Unicode/layout-aware segmentation, versioned concept dictionary, shared-concept/native-lexical channels, unknown-concept review, language-profile calibration/invariance, prompt-injection and image-position evidence. | -| GAP-003 | Shared-latent temporal topic measurement is not yet a complete production scientific estimator. | `partial` | [#167](https://github.com/ContextualWisdomLab/TEPP/issues/167) | Rust CPU `f64` estimator over admitted evidence; explicit likelihood/estimands; uncertainty; time/relation/multiple-membership effects; deterministic reduction; multiple seeds/initialisations; known-truth RMSE/bias/coverage/convergence; real candidate-`K` fits. | -| GAP-004 | Analysis Run is not yet one durable buyer workflow from immutable evidence through scientifically promotable result artifacts and restart/recovery. | `partial` | [#166](https://github.com/ContextualWisdomLab/TEPP/issues/166) | Idempotent lifecycle, persistence/recovery, terminal artifacts, estimator-bound provenance, complete validation evidence, separate claim-promotion decision, Compose E2E, hot-partition evidence. | -| GAP-005 | Longitudinal/multilevel psychometrics remains fragmented across scalar recovery slices rather than one composed ESEM/DSEM product boundary. | `partial` | [#169](https://github.com/ContextualWisdomLab/TEPP/issues/169) | Coherent Rust longitudinal model, plausible-value uncertainty, irregular time, multiple membership, invariance, known-truth recovery, bounded CPU/GPU parity, and one public product contract. | -| GAP-006 | TDT/CHRONOS event intelligence remains bounded components rather than one calibrated temporal-event workflow. | `partial` | [#170](https://github.com/ContextualWisdomLab/TEPP/issues/170) | Span-grounded event evidence, calibrated TDT tasks, CHRONOS schema/forecast state, interval consistency, known-truth recovery, durable artifacts and exports. | -| GAP-007 | Real accelerator support and memory control are incomplete. | `accepted-target` | [#171](https://github.com/ContextualWisdomLab/TEPP/issues/171) | Real hardware execution, CPU `f64` parity, streamed/bounded memory, OOM/fallback evidence, no skipped-hardware claim. | -| GAP-008 | Posterior network/cluster workflow is incomplete as a buyer-visible stable product vertical. | `partial` | [#172](https://github.com/ContextualWisdomLab/TEPP/issues/172) | Known-truth network recovery, uncertainty/stability, repeated Leiden consensus, accessible exact-value exports and reproducible run binding. | -| GAP-009 | Evidence-grounded interpretation is not yet a validated production interpreter/verifier workflow. | `partial` | [#176](https://github.com/ContextualWisdomLab/TEPP/issues/176) | contextual-orchestrator execution, citations, independent verifier, comparable-budget ablations, fallback/abstention, no numerical-authority escalation. | -| GAP-010 | Coordinated buyer UI and exact-value accessible visual analytics are incomplete. | `accepted-target` | [#173](https://github.com/ContextualWisdomLab/TEPP/issues/173) | Real Figma file ID, Storybook inventory, design tokens, keyboard/touch/accessibility states, exact-value tables, print/PDF/JSON/SVG provenance. | -| GAP-011 | TEPP is not yet an operable supported multi-tenant release. | `accepted-target` | [#174](https://github.com/ContextualWisdomLab/TEPP/issues/174) | OIDC/RLS/purpose controls, durable queue/storage, OpenTelemetry/SLOs, backup/restore, load/recovery, migrations, signed release/SBOM/provenance, support policy. | -| GAP-012 | Directory/crate structure contains technical fragments that obscure bounded-context ownership. | `active-refactor` | [#435](https://github.com/ContextualWisdomLab/TEPP/pull/435) and each subsequent landing vehicle | Incremental path/crate folds by domain responsibility, explicit compatibility adapters where required, no cross-context direct DB access, no cyclic dependency or Shared-Kernel expansion. | +TEPP composes time over the **full upstream candidate identity**, not over hard-coded family names. A compatible new fast-mlsirm base family therefore inherits temporal-candidate compilation without a TEPP family-specific wrapper. -## Delivery sequence +Every TEPP temporal candidate records the upstream contract version/digest, exact base formulation, generalized-mixed structure, dependence structure, clock roles, event/occasion semantics, state equation, temporal identification/alignment rules, time-varying membership/covariates, estimator owner, recovery contract, citations, and one status: `supported`, `research_candidate`, or `unsupported`. -The current priority is dependency-driven rather than PR-number-driven: +Auto-expansion is not auto-activation. Unknown or novel couplings remain `research_candidate`; incoherent couplings are `unsupported`. TEPP never silently simplifies a dependence-aware temporal request to a static or local-independent model. -1. Restore queue and bounded-context authority (#175 / #435). -2. Consolidate Evidence & Semantic Measurement so real multilingual source evidence has one admission/measurement boundary. -3. Complete the real Rust CPU `f64` shared-latent topic estimator (#167). -4. Complete the durable end-to-end Analysis Run and scientific evidence/promotion boundary (#166). -5. Compose Longitudinal Psychometrics (#169) and Event Intelligence (#170) instead of continuing one-equation product slices. -6. Add real accelerator parity only after the CPU scientific authority is complete (#171). -7. Complete posterior network/cluster, interpretation, and buyer visual workflows (#172/#176/#173). -8. Productionize tenancy, durability, observability, recovery, release, and support (#174). +### LSIRM / MLSIRM -A small dependency repair may land ahead of this list when it directly unblocks a selected landing vehicle. It does not create a new product priority. +LSIRM residual person-item interaction keeps person/item interaction positions, distances and interaction strength separate from known hierarchy, testlets, raters, methods and covariates. MLSIRM is the **multidimensional-main-effect** latent-space extension; multilevel, cross-classified and multiple-membership operators are orthogonal generalized-mixed structure. Temporal maps require declared translation/rotation/reflection identification before coordinates or trajectories are compared across occasions. -## Queue consolidation rules +### DLSJM -Every open PR receives one classification: +DLSJM follows Jin and Jeon (2019) as the baseline joint model for distinct local item-dependence and local person-dependence spaces. TEPP preserves distinct item-space and person-space temporal states, distances, clusters, uncertainty and alignment. Raw maps or raw cluster labels from separate occasions are not longitudinal evidence without alignment. -- `landing_vehicle` -- `stacked_dependency` -- `fold_into_landing_vehicle` -- `superseded` -- `duplicate` -- `research_lineage_only` -- `blocked_external` +### Base families and generalized mixed structure -No PR is closed because its title looks similar to another. Before `superseded`, `duplicate`, or `fold_into_landing_vehicle` is applied, compare the exact current remote head and preserve unique production behavior, tests, public compatibility, research citations, doctoring, and provenance. +Rasch remains distinct from generic 1PL. 2PLM through formulation-qualified 5PLM retain exact parameter meanings. Confirmatory/exploratory MIRT and ideal-point/GGUM response processes remain distinct axes from hierarchy, dependence and time. Testlet, rater/facet, nested, crossed, cross-classified and multiple-membership structures remain explicit and cannot be hidden inside latent-space dependence. -One-rule crates and one-operation PRs are not independent product boundaries by default. New work must map to the owning bounded context first. +Multiple-membership weights are explicit, auditable and time-valid. They are observed/normalized or estimated according to the declared formulation; equal weights are never invented as a fallback. -### Current classifications established in this recovery slice +## Active product and scientific gaps -#### PR #356 — Analysis Run validation evidence +| ID | Gap | Maturity | Authority | Closure evidence | +| --- | --- | --- | --- | --- | +| GAP-001 | PR authority fragmented across 143 heads | `release-blocking` | #175 / #435 | exact-head classification, bounded-context landing vehicles, unique evidence preserved, safe queue reduction | +| GAP-002 | multilingual span-grounded semantic/concept admission incomplete | `partial` | Evidence & Semantic Measurement | immutable offsets/layout, language profiles, concept dictionary, unknown review, invariance/calibration, hostile-input tests | +| GAP-003 | shared-latent temporal topic estimator incomplete | `partial` | #167 | Rust CPU `f64` likelihood/estimands/uncertainty, time/relation/membership effects, multi-seed recovery, real candidate-K fits | +| GAP-004 | durable end-to-end Analysis Run incomplete | `partial` | #166 | idempotent lifecycle, persistence/recovery, estimator-bound artifacts, complete validation evidence, separate claim promotion, Compose E2E | +| GAP-005 | temporal psychometric composition fragmented and partly duplicated | `partial` | #169 + fast-mlsirm owner boundary | versioned upstream model/dependence contract, TEPP temporal ACL, invariance/alignment, irregular time, temporal recovery, duplicate static kernels removed after parity | +| GAP-006 | TDT/CHRONOS event workflow incomplete | `partial` | #170 | calibrated event evidence/detection/tracking/schema/interval consistency with recovery and durable artifacts | +| GAP-007 | real accelerator/memory evidence incomplete | `accepted-target` | #171 | real hardware execution, CPU f64 parity, bounded memory/OOM/fallback evidence | +| GAP-008 | posterior network/cluster buyer workflow incomplete | `partial` | #172 | known-truth network recovery, uncertainty/stability, repeated Leiden consensus, exact-value exports | +| GAP-009 | production interpreter/verifier incomplete | `partial` | #176 | contextual-orchestrator execution, evidence citations, independent verifier, ablations, abstention/fallback | +| GAP-010 | coordinated accessible buyer UI incomplete | `accepted-target` | #173 | Figma/Storybook/design tokens, keyboard/touch/error/empty states, exact-value and print/export provenance | +| GAP-011 | operable multi-tenant supported release incomplete | `accepted-target` | #174 | OIDC/RLS/purpose controls, durable queues/storage, OTel/SLO, restore/load/migration, signed release/SBOM/provenance | +| GAP-012 | directory/crate structure obscures domain ownership | `active-refactor` | #435 and landing vehicles | staged folds, compatibility ACLs, no cycles/cross-context persistence/shared-kernel creep | +| GAP-013 | ADR identity is branch-local/duplicated in parts of the queue | `release-integrity` | #437 | repository-wide unique ADR identity, duplicate detection, normalized index and supersession lineage | -Current head: `df33bfa3e61ae4de3dbfae16df0deac12d2f4003`. +## Delivery sequence -Classification: `landing_vehicle` **candidate only; scientifically blocked**. +1. Restore queue, ADR and bounded-context authority (#175, #435, #437). +2. Consolidate Evidence & Semantic Measurement. +3. Complete the Rust CPU `f64` shared-latent topic estimator (#167). +4. Complete durable end-to-end Analysis Run and evidence/promotion separation (#166). +5. Compose temporal psychometrics through fast-mlsirm contracts (#169) and complete Event Intelligence (#170) instead of producing one-equation product slices. +6. Add real accelerator parity after CPU scientific authority is established (#171). +7. Complete network/cluster, interpretation and buyer visual workflows (#172/#176/#173). +8. Productionize tenancy, durability, observability, recovery, release and support (#174). -The useful run-binding work should be preserved, but the current branch must not establish global scientific acceptance because: +A bounded dependency repair may land ahead of this sequence when it directly unblocks a selected landing vehicle. It does not create a new product priority. -- its RMSE acceptance uses a caller-selected `k × SE(RMSE)` threshold where the SE is derived from the same residual vector; this does not bound absolute recovery error and is not an evidence-derived scientific threshold; -- recovery truth/recovered vectors are caller-provided rather than bound to known-truth and estimator-owned Rust CPU `f64` artifacts by identity/digest; -- a boolean stating that input was not LLM-authored is not provenance; -- graph recovery, invariance, convergence, and active-backend CPU/GPU parity applicability are incomplete for a global claim-promotion artifact. +## Queue consolidation rules -DDD correction: this branch may produce **Validation Evidence**. A separate **Scientific Claim Promotion Decision** aggregate governed by ADR 0014 decides promotability from a preregistered, method-specific complete evidence contract. `analysis_engine` does not own psychometric acceptance mathematics. +Every open PR receives one of: -Exact-head Product workflow evidence is also not green: coverage-diagnostic jobs failed on the current head. A mergeable GitHub state therefore does not make #356 merge-ready. +- `landing_vehicle` +- `stacked_dependency` +- `fold_into_landing_vehicle` +- `superseded` +- `duplicate` +- `research_lineage_only` +- `blocked_external` -#### PRs #352 and #355 — Driver/ctsem TIPREDEFFECT rewrite +Similarity of titles is insufficient for closure. Compare exact current heads and preserve unique production behavior, public compatibility, tests, review findings, primary research, doctoring and provenance before applying `duplicate`, `superseded`, or `fold_into_landing_vehicle`. -Classification: both are `fold_into_landing_vehicle` candidates under Longitudinal Psychometrics; neither is superseded yet. +One-rule crates, one-clock crates and one-operation API/CLI PRs are not independent product boundaries by default. -They share the same core scalar rewrite but differ in public naming, refusal guards, tests, doctoring, and documentation. The eventual landing vehicle must preserve the stronger domain guards and published-example/recovery evidence before either source PR is closed. +### Current classifications -#### Analysis-run transport slices +**#356 — Validation Evidence candidate.** Keep useful run binding, but do not make it global scientific-acceptance authority. Its generic `RMSE <= k * SE(RMSE)` rule does not bound absolute recovery error when RMSE and its SE arise from the same residual vector; caller-provided truth/recovered vectors and an `authored_by_llm` boolean also do not establish estimator-owned provenance. Graph recovery, invariance, convergence and applicable CPU/GPU parity remain incomplete. Scientific Claim Promotion is a separate aggregate governed by ADR 0014. -Per-operation GET/POST/CLI/status/cancel/retry/export/history slices belong to the Analysis Run application context and `tepp_api` adapter. They remain traceable as stacked dependencies until a current-main landing vehicle preserves each unique contract test and consumer behavior. +**#352/#355 — Longitudinal Psychometrics fold candidates.** They share a Driver/ctsem scalar rewrite but retain different public names, refusal guards, tests and research documentation. Preserve the strongest evidence before closing either. -#### Evidence/method refusal slices +**#425/#433/#436 and similar route/CLI stacks — Analysis Run adapter dependencies.** They are transport/application behavior, not bounded contexts and not grounds for branch-local ADR identity. -Prompt/style/modality/copied-text/corpus-background/template-copy/location/membership/citation refusal helpers belong under Evidence & Semantic Measurement or Temporal Event Knowledge. A separate crate/PR is retained only when an independently versioned public reuse boundary exists. +**#434/#430/#427/#426/#422/#421/#419/#418/#416 and similar refusal profiles — owning-context fold candidates.** Evidence/method refusals belong to Evidence & Semantic Measurement; temporal relation/membership rules belong to Temporal Event Knowledge. ## Directory and crate repair register -These protected-main paths are staged fold targets; current remote PR compatibility is preserved until the owning landing vehicle is ready: - -| Current fragments | Owning bounded context | +| Current fragments | Owning context | | --- | --- | | `system_clock`, `event_clock`, `assertion_clock`, `cutoff_clock`, `available_clock`, `document_clocks`, `revision_order` | Temporal Event Knowledge | | `summarizes_edge`, `retrospective_edge`, `support_edge`, `citation_edge`, `outcome_order`, `subevent_containment`, `prediction_contradiction`, `relation_absence`, `role_contradiction` | Temporal Event Knowledge | | `location_membership`, `episode_membership`, `membership_target` | Temporal Event Knowledge | | `prompt_source`, `style_source`, `modality_source`, `copied_text`, `copy_identity`, `corpus_background`, `stopword_deletion`, `payload_bound`, `derived_sensitivity` | Evidence & Semantic Measurement | -| `psychometric_fit` | Longitudinal Psychometrics | - -Do not perform one repository-wide rename while more than one hundred remote heads are active. The target DDD architecture is mandatory, but migration is staged through bounded-context landing vehicles to avoid destroying concurrent-agent intent. - -For `analysis_engine`, new/replayed profiles should converge toward domain-owned modules rather than an indefinitely flat one-file-refusal directory: - -```text -analysis_engine/src/ - runs/ - evidence_measurement/ - topic_measurement/ - psychometrics/ - event_intelligence/ - validation/ -``` +| reusable static/generalized-mixed/dependence psychometric arithmetic in TEPP | migrate to fast-mlsirm after parity/recovery; retain only TEPP temporal/event ACL and policy | +| flat `analysis_engine` one-profile files | fold by owning domain/application module through landing vehicles | -Scientific claim-promotion policy remains a distinct boundary rather than being hidden inside a validation-run transport helper. +Do not run a repository-wide rename across more than one hundred live heads. The target DDD architecture is mandatory, but path migration is staged through landing vehicles so concurrent-agent intent and review evidence survive. ## Scientific and data invariants -- Production mathematical, statistical, psychometric, vector, linear/matrix algebra, and token-size arithmetic is Rust-owned. -- CPU `f64` is the scientific numerical reference. Parallel reduction is bounded and deterministic for declared reproducibility modes. -- Event, assertion, document, system, availability, and knowledge-cutoff clocks remain distinct. -- `available_time <= knowledge_cutoff` is enforced for cutoff-safe evidence. -- Transition/process edges are forward-only; citation, support, summary, revision, and retrospective report do not become transitions. -- Cross-classified and weighted multiple membership is preserved; entity role, language, template, project, department, and location are not collapsed into one hierarchy. -- Topic proportions are compositional; raw simplex Pearson correlation is not a scientific network estimator. -- Synthetic data may establish known truth in tests; production output never substitutes synthetic evidence for customer/source evidence. -- LLMs may propose semantic units or interpretations only behind deterministic span/schema/security checks and never replace estimation/validation. -- Database objects use descriptive two-or-more-word `snake_case`, normalized authority tables, explicit temporal/provenance/tenant ownership, measured hot-partition evidence, and explicit UPSERT/idempotency contracts. -- External products integrate through versioned API/event/artifact contracts, never direct application-table access. -- Compliance mappings are readiness evidence, not certification. +- Production mathematical/statistical/psychometric/vector/matrix arithmetic is Rust-owned; deterministic CPU `f64` is the scientific numerical reference. +- Event, valid, assertion, document, system, available and knowledge-cutoff semantics stay distinct; historical evidence requires availability at or before cutoff. +- Measurement occasion as a rater/method facet is distinct from substantive event time. +- Process/transition edges are forward-only. Citation, support, summary, revision and retrospective report do not become transitions. +- Cross-classification and weighted multiple membership are preserved rather than forced into one parent hierarchy. +- Local dependence is diagnosed after known factors/testlets/item families/raters/methods/hierarchy/membership/covariates are represented. +- Residual person-item interaction may motivate LSIRM/MLSIRM; joint local-item plus local-person dependence may motivate DLSJM only when its relational formulation matches the question. +- Exploratory factors/loadings and dependence geometry remain hypotheses until confirmatory/invariance/recovery evidence permits production use. +- Every temporal dependence candidate generates model-appropriate known-truth recovery for states/trajectories, fixed/random effects, covariance, membership, factors/loadings, response-family-specific parameters, dependence geometry, dynamics and uncertainty. +- Temporal recovery uses event-time/available-time separation, rolling-origin evaluation, irregular gaps, delayed/retrospective records, missing occasions, changing membership and language/source drift. +- Monte Carlo uncertainty is reported; arbitrary pass percentages or rule-of-thumb thresholds are not scientific promotion criteria. +- LLMs never replace estimation/validation and are called only through contextual-orchestrator. +- Database authority is normalized, tenant/time/provenance aware, uses descriptive multiword `snake_case`, explicit idempotency/UPSERT and measured hot-partition evidence. ## Merge gate -Before any landing vehicle merges: +Before a landing vehicle merges: -1. Re-read exact head/base, live ruleset, review decision, unresolved threads, and current required workflow results. -2. Resolve valid review findings at the exact head; do not suppress deprecations, coverage gaps, or scientific failures. -3. Re-run the relevant Rust unit/integration/property/fuzz/known-truth tests and exact-head hosted gates. -4. Require 100% production statement coverage, production branch coverage, and public Rust documentation for the shipped scope. -5. Preserve unique evidence from every PR classified for folding or closure. -6. Update PRD/TRD/ADR/architecture/context map/UML/traceability/doctoring/CHANGELOG when the protected product contract changes. -7. Merge through normal policy. Force push and protection bypass are not queue-consolidation tools. +1. Re-read exact head/base, live ruleset, review state, unresolved threads and current required workflows. +2. Repair valid findings and failures test-first; do not suppress deprecations, coverage or scientific failures. +3. Run relevant Rust unit/integration/property/fuzz/recovery tests on the exact head. +4. Require 100% production statement/branch coverage and public Rust documentation for the shipped scope. +5. Preserve unique evidence from every folded/closed PR. +6. Update PRD/TRD/ADR/context map/UML/traceability/doctoring/CHANGELOG when the protected product contract changes. +7. Use normal merge policy. Force-push and protection bypass are not queue-consolidation tools. -## Definition of product complete +## Operator-gap register -TEPP is not complete until one supported release proves on the same protected source lineage that a documented user can authenticate, ingest real evidence, execute the approved scientific models, inspect uncertainty and provenance, export results, recover from restart/failure, and operate the service without repository-internal intervention. - -The same release must prove real multilingual measurement evidence, true-parameter recovery, temporal/multiple-membership correctness, real hardware parity for claimed accelerators, interpretation abstention/citation behavior, accessible exact-value visual workflows, tenant/purpose/security controls, migrations, backup/restore, SLO/capacity evidence, signed artifacts/SBOM/provenance, support policy, current-head required workflows, independent review, and zero release-blocking PR/issue queue. - -A valuation target is a prioritization bar, not evidence of market value. Product, scientific, operational, security, adoption, revenue, retention, and independent diligence evidence remain required. - -## Refresh rule +| ID | Closure evidence | +| --- | --- | +| GAP-001 | Queue reaches a bounded, classified set of coherent landing vehicles and all superseded/duplicate closures retain replacement mapping. | +| GAP-003 | Real CPU `f64` estimator passes preregistered known-truth recovery and is invoked by the product workflow. | +| GAP-004 | One durable evidence-to-terminal-result run survives restart/restore and separates Validation Evidence from Claim Promotion. | +| GAP-005 | TEPP consumes a versioned fast-mlsirm candidate contract; temporal auto-expansion/recovery is generic; duplicated static kernels are removed after parity. | +| GAP-012 | Architecture fitness tests and landing vehicles demonstrate correct bounded-context paths/dependency direction. | +| GAP-013 | #437 closes with unique repository-wide ADR identities and duplicate-ID validation. | -Refresh this baseline whenever any of these materially changes: +## Research traceability for dependence ownership -- protected-main SHA or version; -- open PR/draft/issue counts; -- a priority PR head/base/review/check/merge state; -- queue classification or replacement mapping; -- bounded-context ownership or a canonical path/module boundary; -- issue acceptance criteria or implementation maturity; -- release sequence, deprecation, Figma file, standard, or primary research basis. +- Jin, I. H., & Jeon, M. (2019). A doubly latent space joint model for local item and person dependence in the analysis of item response data. *Psychometrika, 84*(1), 236–260. https://doi.org/10.1007/s11336-018-9630-0 +- Jeon, M., Jin, I. H., Schweinberger, M., & Baugh, S. (2021). Mapping unobserved item–respondent interactions: A latent space item response model with interaction map. *Psychometrika, 86*(2), 378–403. https://doi.org/10.1007/s11336-021-09762-5 +- Kang, I., & Jeon, M. (2025). Multidimensional latent space item response models: A note on the relativity of conditional dependence. *Psychometrika, 90*(2), 799–826. https://doi.org/10.1017/psy.2025.5 -Live GitHub state always supersedes the snapshot. Historical snapshots stay in Git history rather than being carried forward as contradictory current facts. +The cited dependence families do not establish every novel base-family × generalized-mixed × dependence × temporal coupling. Novel compositions stay `research_candidate` until the exact combined model, identification, estimator and recovery are demonstrated. From 86c4cdd22072b782000b46ca88ba6e496902a0d1 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 14:59:53 +0900 Subject: [PATCH 009/235] docs(gaps): avoid self-referential exact-head inventory --- docs/product-technical-gap-baseline.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 58425ef64..d804477a3 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -31,9 +31,10 @@ The repository-level classic branch-protection payload is not the sole policy so This table is an exact-head **priority subset**, not a row-for-row copy of the 143-PR queue. The live total and this operator inventory are deliberately different concepts. +PR #435 itself is deliberately omitted from the exact-head table. A commit that rewrites this document necessarily advances #435's head, so embedding that same branch's “exact current head” inside the commit would be self-invalidating. The delivery-authority line links #435, while its live head is re-read from GitHub immediately before any readiness or merge decision. + | PR | Exact current head | Draft | Base | Ownership / disposition | | ---: | --- | :---: | --- | --- | -| #435 | `c8c0ca232fb27b0a828caab159c2b0af2c8bebb7` | true | main | queue/DDD recovery landing vehicle; this branch | | #436 | `460503b6e787362b702509faa955c4730f6d8680` | false | #433 head | Analysis Run/contextual-orchestrator CLI stack; `stacked_dependency` | | #434 | `c0fbaabd8c95e69407c3b9e50f8d1846bd949598` | false | main | membership-target refusal profile; `fold_into_landing_vehicle` candidate | | #432 | `3e09ff29cc89ef97a859f3ae50e1297846dd2eeb` | false | main | Topic Measurement profile binding; preserve unique contract tests | From 35c14fc6e1176c7a8e0874c7ce783e562460bed6 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 18:13:37 +0900 Subject: [PATCH 010/235] docs(delivery): refresh queue authority after scientific repair --- .../delivery/pr-queue-authority-2026-09-01.md | 31 +++++++++++++------ 1 file changed, 22 insertions(+), 9 deletions(-) diff --git a/docs/delivery/pr-queue-authority-2026-09-01.md b/docs/delivery/pr-queue-authority-2026-09-01.md index 4062dcedc..bf322c287 100644 --- a/docs/delivery/pr-queue-authority-2026-09-01.md +++ b/docs/delivery/pr-queue-authority-2026-09-01.md @@ -6,14 +6,15 @@ This is a live-recovery record for delivery issue #175. GitHub state supersedes - Protected default branch: `main` - Protected-main SHA observed: `1bc02f580cf48e1d39da239f0e818453437c31c3` -- Open pull requests: **142** +- Open pull requests: **149** - Draft pull requests: **100** -- Non-draft pull requests: **42** -- Open issues: **13** +- Non-draft pull requests: **49** +- Open issues: **14** - Effective required-workflow ruleset: `18156473`, `CWL Central required workflows` -- `docs/product-technical-gap-baseline.md` was replaced on this recovery branch so it no longer presents the former zero-queue snapshot as current authority. +- GitHub releases: **0** +- `docs/product-technical-gap-baseline.md` is maintained on this recovery branch so it no longer presents a former zero-queue snapshot as current authority. -The one-PR increase and one-draft increase from the initial 141/99 observation is this recovery PR itself. These counts are delivery evidence, not a completion claim. A queued, skipped, cancelled, predecessor-head, or stale check is not passing evidence. +The queue has grown from the initial 141/99 observation to 149/100 while this recovery vehicle remains open. That is a delivery regression, not evidence of product progress. A queued, skipped, cancelled, predecessor-head, or stale check is not passing evidence. ## Queue authority classes @@ -37,7 +38,7 @@ The active queue must be reduced in this order: 2. **Evidence & Semantic Measurement vertical** — span-grounded semantic/concept input, method/source distinctions, immutable source offsets, concept dictionary versioning. 3. **Topic Measurement vertical** — real Rust CPU `f64` shared-latent estimator, uncertainty, true-parameter recovery, candidate-K fitting, topic lineage. 4. **Analysis Run / scientific evidence vertical** — durable lifecycle, estimator-bound validation evidence, persistence/recovery, terminal results, and operator retrieval. Scientific evidence production is separated from claim-promotion authority. -5. **Longitudinal Psychometrics vertical** — coherent ESEM/DSEM/multilevel measurement boundary rather than scalar-equation PR proliferation. +5. **Longitudinal Modeling vertical** — coherent ESEM/DSEM/multilevel measurement and event-time composition rather than scalar-equation PR proliferation. 6. **Event Intelligence vertical** — TDT/CHRONOS composition and event-time evidence under Temporal Event Knowledge. 7. **Commercial runtime vertical** — tenancy, durable jobs, observability, backup/restore, release provenance, support. @@ -45,6 +46,16 @@ New unrelated micro-PRs are release-excluded while this queue exceeds the active ## First classification findings +### PR #441 — event-time lagged association repair + +Classification: `landing_vehicle_candidate` under Longitudinal Modeling; scientific root cause repaired on exact head `c1aeed3bc2ca5f801f3baa748a4a3dde9f948338`, but not merge-ready until exact-head workflows and fresh review complete. + +The predecessor head exposed `(trait + e^{aΔt} p + added) / (trait + p + added)` as `expected_autocorrelation`. Review showed that a one-sided covariance/earlier-variance ratio is not a correlation under nonstationary marginals and can exceed one. The repair removes that public claim and its `psychometric_core` changes from the final diff. The replacement belongs to `longitudinal_core` and standardizes a supplied lagged covariance only when both marginal variances are available: + +`Cov(Y_t,Y_t+Δ) / sqrt(Var(Y_t) * Var(Y_t+Δ))`. + +The invalid predecessor commit remains only as RED/scientific-failure lineage. Review threads tied to the removed implementation are resolved as outdated. Hosted exact-head Rust/documentation/security checks were queued at the latest observation, so this PR is not yet a merge authority. + ### PR #356 — validation-run scientific evidence Classification: `landing_vehicle_candidate`, pending correction before it may become `landing_vehicle`. @@ -53,13 +64,13 @@ Reason: it is direct from current protected main and binds cutoff-safe evidence DDD correction: the run should produce **Validation Evidence**. A distinct **Claim Promotion Decision** aggregate, governed by ADR 0014 and a method-specific preregistered evidence contract, decides whether a scientific claim is promotable. No generic standard-error multiplier, maximum-k, or other rule-of-thumb threshold may substitute for a research- or model-derived acceptance design. -Exact-head hosted evidence is also not green: the current Product workflow failed its coverage-diagnostic jobs. The branch remains non-draft in GitHub metadata because the connector's draft-conversion mutation is currently broken; that metadata must not be interpreted as merge readiness. +Exact-head hosted evidence is also not green: the latest observed Product workflow failed its coverage-diagnostic jobs. The branch remains non-draft in GitHub metadata because the connector's draft-conversion mutation is currently broken; that metadata must not be interpreted as merge readiness. Until the scientific and exact-head failures are corrected, #356 and downstream wire/HTTP slices must not be treated as a shippable scientific-acceptance vertical. ### PRs #352 and #355 — same Driver/ctsem TIPREDEFFECT rewrite -Classification: both `fold_into_landing_vehicle` candidates under Longitudinal Psychometrics; neither is selected as authority yet. +Classification: both `fold_into_landing_vehicle` candidates under Longitudinal Modeling; neither is selected as authority yet. Both implement the scalar `-a * B` rewrite from the same current-main base. They differ in public naming, refusal guards, tests, doctoring, and documentation edits. Closing either solely because the title and core equation match would discard unique evidence. The consolidation vehicle must retain the stronger named-quantity refusal coverage and realistic published-example tests while avoiding unrelated architecture mega-row edits. @@ -67,6 +78,8 @@ Both implement the scalar `-a * B` rewrite from the same current-main base. They PRs for one GET/POST/CLI/status/cancel/retry/export/project-history operation are not separate bounded contexts. Classify them under the Analysis Run application context and `tepp_api` adapter. Parent/child stacks remain documented until a current-main landing vehicle preserves their unique contract tests and consumer compatibility. +PR #443 is a current example: it adds one export-collection GET on top of the existing export-retrieval stack. Its unique pagination/auth/refusal tests must be preserved, but the operation is a `fold_into_landing_vehicle` candidate rather than a new product boundary or architecture decision. + ### Evidence/method refusal slices PRs binding prompt/style/modality/copied-text/corpus-background/template-copy/location/membership/citation refusals to separate analysis profiles are not automatically independent products. Classify the invariant under Evidence & Semantic Measurement or Temporal Event Knowledge, then fold compatible profiles into one coherent admission/method-effect landing vehicle where the runtime contract does not require an independently versioned lifecycle. @@ -86,4 +99,4 @@ Before merge: ## DDD delivery constraint -Directory and crate moves are part of the owning product-vertical replay. Do not preserve a technical-layer or one-rule path as canonical if it obscures the domain responsibility. Conversely, do not rename all 58 crates in one sweeping PR while 142 remote heads are active. The target bounded contexts are fixed in `docs/architecture/domain-context-map.md`; migration proceeds through safe, reviewable landing vehicles with explicit anti-corruption adapters and replacement mappings. +Directory and crate moves are part of the owning product-vertical replay. Do not preserve a technical-layer or one-rule path as canonical if it obscures the domain responsibility. Conversely, do not rename all crates in one sweeping PR while 149 remote heads are active. The target bounded contexts are fixed in `docs/architecture/domain-context-map.md`; migration proceeds through safe, reviewable landing vehicles with explicit anti-corruption adapters and replacement mappings. From 4ccb62fa2b99d5cf830ea81cfd7b7ef3d0ff2787 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 18:19:40 +0900 Subject: [PATCH 011/235] docs(product): refresh live gap baseline and repaired longitudinal boundary --- docs/product-technical-gap-baseline.md | 28 +++++++++++++++++--------- 1 file changed, 18 insertions(+), 10 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index d804477a3..964d482d6 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-01T05:53:35Z +**Snapshot:** 2026-09-01T09:14:20Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` **Workspace version:** `0.2.0` **Delivery authority:** issue [#175](https://github.com/ContextualWisdomLab/TEPP/issues/175), PR [#435](https://github.com/ContextualWisdomLab/TEPP/pull/435), and [`docs/delivery/pr-queue-authority-2026-09-01.md`](delivery/pr-queue-authority-2026-09-01.md) @@ -19,27 +19,30 @@ A planning document, mergeable branch, local test, predecessor-head result, queu | Signal | Current evidence | Delivery implication | | --- | ---: | --- | | Protected `main` | `1bc02f580cf48e1d39da239f0e818453437c31c3` | Capability claims remain bounded to this commit until protected main changes. | -| Open pull requests | **143** | The queue is release-blocking and still growing while consolidation is active. | +| Open pull requests | **149** | The queue is release-blocking and grew from the initial 141 while consolidation remained open. | | Draft pull requests | **100** | Draft state is not classification or ownership. | -| Non-draft pull requests | **43** | Ready metadata is not merge readiness without exact-head evidence. | +| Non-draft pull requests | **49** | Ready metadata is not merge readiness without exact-head evidence. | | Open issues | **14** | Includes #437 for repository-wide ADR identity normalization. | +| GitHub releases | **0** | No open PR head or local branch is a released product contract. | | Effective ruleset | `18156473` | Current ruleset, exact-head workflows, resolved conversations, and qualifying review are the merge authority. | The repository-level classic branch-protection payload is not the sole policy source. Do not infer that protection is absent from an empty classic required-check list and do not bypass the organization ruleset. ## Current priority open pull-request evidence -This table is an exact-head **priority subset**, not a row-for-row copy of the 143-PR queue. The live total and this operator inventory are deliberately different concepts. +This table is an exact-head **priority subset**, not a row-for-row copy of the 149-PR queue. The live total and this operator inventory are deliberately different concepts. PR #435 itself is deliberately omitted from the exact-head table. A commit that rewrites this document necessarily advances #435's head, so embedding that same branch's “exact current head” inside the commit would be self-invalidating. The delivery-authority line links #435, while its live head is re-read from GitHub immediately before any readiness or merge decision. | PR | Exact current head | Draft | Base | Ownership / disposition | | ---: | --- | :---: | --- | --- | +| #443 | `504793d88c6b754f5181f48dc7abde073ff9146a` | false | #411/export stack | Analysis Run export collection adapter; `fold_into_landing_vehicle` candidate | +| #441 | `c1aeed3bc2ca5f801f3baa748a4a3dde9f948338` | false | main | Longitudinal Modeling lagged-correlation repair; original invalid ratio removed; exact-head checks pending | | #436 | `460503b6e787362b702509faa955c4730f6d8680` | false | #433 head | Analysis Run/contextual-orchestrator CLI stack; `stacked_dependency` | | #434 | `c0fbaabd8c95e69407c3b9e50f8d1846bd949598` | false | main | membership-target refusal profile; `fold_into_landing_vehicle` candidate | | #432 | `3e09ff29cc89ef97a859f3ae50e1297846dd2eeb` | false | main | Topic Measurement profile binding; preserve unique contract tests | | #425 | `c11558313dd1b95d7528eb5fcb89ad296cf879c0` | false | main | Analysis Run/contextual-orchestrator create CLI stack root candidate | -| #389 | `035bfb087d47543fd7dd87cfdbc4edd778f4a6aa` | false | main | irregular event-time composition; Longitudinal Psychometrics fold candidate | +| #389 | `035bfb087d47543fd7dd87cfdbc4edd778f4a6aa` | false | main | irregular event-time composition; Longitudinal Modeling fold candidate | | #356 | `df33bfa3e61ae4de3dbfae16df0deac12d2f4003` | false | main | Validation Evidence candidate; scientifically blocked from global claim promotion | Passing or queued Checks on an open PR never promote that PR to implemented-main. @@ -53,7 +56,7 @@ Cargo crates are implementation units, not bounded contexts. Current product res | Core | Evidence & Semantic Measurement | `EvidenceCorpus`, `SemanticUnitSet`, `ConceptDictionaryRevision` | `evidence_core`, `semantic_core` | | Core | Temporal Event Knowledge | `EventEpisode`, `TemporalRelationSet`, `MembershipAssignmentSet` | `temporal_core`, `event_core`, `relation_graph`, `membership_core` | | Core | Topic Measurement | `TopicModelRun`, `TopicLineage` | `topic_measurement`, `topic_lineage`, `model_selection`, `network_analysis` | -| Core | Temporal Psychometric Composition | `TemporalModelSpecification`, `TemporalModelRun` | TEPP temporal composition around versioned fast-mlsirm contracts | +| Core | Longitudinal Modeling / Temporal Psychometric Composition | `TemporalModelSpecification`, `TemporalModelRun` | `longitudinal_core` plus TEPP temporal composition around versioned fast-mlsirm contracts | | Core | Analysis Run | `AnalysisRun` | `analysis_engine` application services; transport remains adapter-owned | | Core | Scientific Validation & Claim Promotion | `ValidationStudy`, `ClaimPromotionDecision` | `validation_core`, `tepp_simulation`; claim promotion is distinct from evidence generation | | Supporting | Interpretation | evidence-grounded interpretation workflow | contextual-orchestrator ACL only | @@ -68,7 +71,7 @@ Cargo crates are implementation units, not bounded contexts. Current product res - **contextual-orchestrator** owns every LLM provider call, routing/fallback, credential, verifier/adjudicator execution, and model-call provenance. - **LineageWeave or the consuming product** owns source/item-generation lineage; lineage is evidence, not numerical authority. -At this snapshot, fast-mlsirm PR #1714 at `362a50e104e532684824a35e16f881c7ddb1ebc9` proposes a non-numerical candidate compiler that preserves exact response/dimensional/generalized-mixed identity and materializes typed LSIRM/MLSIRM/DLSJM candidates. It is not yet merged into fast-mlsirm protected main, so TEPP treats it as an upstream contract dependency in progress and does not copy its implementation. +At this snapshot, fast-mlsirm PR #1714 at `cf538931199c4433a2c018c970d3609e17939505` proposes the non-numerical candidate compiler. It preserves full candidate identity and formulation-scoped evidence but remains an unreleased upstream dependency. A TEPP consumer-boundary review also requires an explicit published-manifest schema/version/digest and typed generalized-mixed membership/weight semantics before this can serve as TEPP's versioned Published Language. TEPP does not copy its implementation or bind deployable behavior to the open head. ### Dependency invariants @@ -105,7 +108,7 @@ Multiple-membership weights are explicit, auditable and time-valid. They are obs | ID | Gap | Maturity | Authority | Closure evidence | | --- | --- | --- | --- | --- | -| GAP-001 | PR authority fragmented across 143 heads | `release-blocking` | #175 / #435 | exact-head classification, bounded-context landing vehicles, unique evidence preserved, safe queue reduction | +| GAP-001 | PR authority fragmented across 149 heads | `release-blocking` | #175 / #435 | exact-head classification, bounded-context landing vehicles, unique evidence preserved, safe queue reduction | | GAP-002 | multilingual span-grounded semantic/concept admission incomplete | `partial` | Evidence & Semantic Measurement | immutable offsets/layout, language profiles, concept dictionary, unknown review, invariance/calibration, hostile-input tests | | GAP-003 | shared-latent temporal topic estimator incomplete | `partial` | #167 | Rust CPU `f64` likelihood/estimands/uncertainty, time/relation/membership effects, multi-seed recovery, real candidate-K fits | | GAP-004 | durable end-to-end Analysis Run incomplete | `partial` | #166 | idempotent lifecycle, persistence/recovery, estimator-bound artifacts, complete validation evidence, separate claim promotion, Compose E2E | @@ -150,9 +153,13 @@ One-rule crates, one-clock crates and one-operation API/CLI PRs are not independ ### Current classifications +**#441 — Longitudinal Modeling lagged-correlation repair.** The invalid predecessor API that divided lagged covariance by only the earlier marginal variance was removed from the final diff after review showed it could produce impossible autocorrelations under nonstationary marginals. Exact repair head `c1aeed3bc2ca5f801f3baa748a4a3dde9f948338` instead places event-time association standardization in `longitudinal_core`, requires both marginal variances, enforces the covariance bound, and avoids the avoidable variance-product overflow. The predecessor commit remains RED/scientific-failure lineage. The branch is not merge-ready until exact-head hosted checks and fresh review complete. + +**#443 — Analysis Run export adapter fold candidate.** The export-collection GET is useful operator behavior, but one route is not an independent bounded context. Preserve its pagination, authorization and refusal tests while folding the operation into a coherent Analysis Run/export landing vehicle. + **#356 — Validation Evidence candidate.** Keep useful run binding, but do not make it global scientific-acceptance authority. Its generic `RMSE <= k * SE(RMSE)` rule does not bound absolute recovery error when RMSE and its SE arise from the same residual vector; caller-provided truth/recovered vectors and an `authored_by_llm` boolean also do not establish estimator-owned provenance. Graph recovery, invariance, convergence and applicable CPU/GPU parity remain incomplete. Scientific Claim Promotion is a separate aggregate governed by ADR 0014. -**#352/#355 — Longitudinal Psychometrics fold candidates.** They share a Driver/ctsem scalar rewrite but retain different public names, refusal guards, tests and research documentation. Preserve the strongest evidence before closing either. +**#352/#355 — Longitudinal Modeling fold candidates.** They share a Driver/ctsem scalar rewrite but retain different public names, refusal guards, tests and research documentation. Preserve the strongest evidence before closing either. **#425/#433/#436 and similar route/CLI stacks — Analysis Run adapter dependencies.** They are transport/application behavior, not bounded contexts and not grounds for branch-local ADR identity. @@ -167,6 +174,7 @@ One-rule crates, one-clock crates and one-operation API/CLI PRs are not independ | `location_membership`, `episode_membership`, `membership_target` | Temporal Event Knowledge | | `prompt_source`, `style_source`, `modality_source`, `copied_text`, `copy_identity`, `corpus_background`, `stopword_deletion`, `payload_bound`, `derived_sensitivity` | Evidence & Semantic Measurement | | reusable static/generalized-mixed/dependence psychometric arithmetic in TEPP | migrate to fast-mlsirm after parity/recovery; retain only TEPP temporal/event ACL and policy | +| event-time association standardization | `longitudinal_core`; require both marginals and keep model-specific covariance construction outside this generic standardizer | | flat `analysis_engine` one-profile files | fold by owning domain/application module through landing vehicles | Do not run a repository-wide rename across more than one hundred live heads. The target DDD architecture is mandatory, but path migration is staged through landing vehicles so concurrent-agent intent and review evidence survive. @@ -206,7 +214,7 @@ Before a landing vehicle merges: | GAP-001 | Queue reaches a bounded, classified set of coherent landing vehicles and all superseded/duplicate closures retain replacement mapping. | | GAP-003 | Real CPU `f64` estimator passes preregistered known-truth recovery and is invoked by the product workflow. | | GAP-004 | One durable evidence-to-terminal-result run survives restart/restore and separates Validation Evidence from Claim Promotion. | -| GAP-005 | TEPP consumes a versioned fast-mlsirm candidate contract; temporal auto-expansion/recovery is generic; duplicated static kernels are removed after parity. | +| GAP-005 | TEPP consumes a released/versioned fast-mlsirm candidate contract; temporal auto-expansion/recovery is generic; duplicated static kernels are removed after parity. | | GAP-012 | Architecture fitness tests and landing vehicles demonstrate correct bounded-context paths/dependency direction. | | GAP-013 | #437 closes with unique repository-wide ADR identities and duplicate-ID validation. | From 336e2dc7e99f3e55790475540d74f9079d7472b1 Mon Sep 17 00:00:00 2001 From: seonghobae Date: Tue, 1 Sep 2026 10:21:22 +0000 Subject: [PATCH 012/235] docs(delivery): refresh live queue after #356 close and #441 head Re-read GitHub at 2026-09-01T10:19:29Z: 136 open PRs (91 draft, 45 non-draft) on protected main 1bc02f5. #356 is closed without merge. #441 exact head is 6f48322. #444 is a fold candidate, not a new bounded context. Queued checks remain non-passing. --- CHANGELOG.md | 4 +++ .../delivery/pr-queue-authority-2026-09-01.md | 25 ++++++++++--------- docs/product-technical-gap-baseline.md | 22 ++++++++-------- 3 files changed, 29 insertions(+), 22 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 062a69412..65f7682bb 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -38,6 +38,10 @@ All notable changes to TEPP are documented here. The format follows Keep a Chang ## [Unreleased] +### Changed + +- Delivery-authority recovery vehicle (#435 / #175) now records the live 2026-09-01T10:19:29Z queue as **136** open PRs (91 draft, 45 non-draft) on protected main `1bc02f580cf48e1d39da239f0e818453437c31c3`. Scientifically unsafe #356 is closed without merge. Longitudinal repair #441 advanced to `6f483224b3a03e8237c6f4f098a8b0e85e0a91f5` and is classified as a landing-vehicle candidate, not merge authority. Export-collection CLI #444 is classified `fold_into_landing_vehicle`. Queued checks remain non-passing. + - `event_core` adds bounded Allen interval-consistency classification, atomic path-consistency closure, contradiction/resource refusals, and an explicit dependency-error fallback without claiming unrestricted global satisfiability. - `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, Table 2, p. 12 `MANIFESTTRAITVAR`; §7.1, p. 19; p. 16 `MANIFESTTRAITVARstd`; footnote 4; 2017-era ctsem `summary.ctsemFit.R`; JSS PDF re-opened 2026-08-27T14:20Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar standardised manifest-trait variance on current main after `0ce16e8` dropped the pre-consolidation code while research notes already named the map (register items 83–84). Table 2 names `MANIFESTTRAITVAR` `Ψ_τ` the additional time-invariant variance-covariance on the measurement level and sets it `NULL` when there is no manifest trait. Equation 5 writes `Γ ~ N(τ, Ψ)` and names that covariance the manifest traits. Section 7.1 names manifest traits stable individual differences in indicator levels, distinct from process-level `TRAITVAR` `φ_ξ`. Page 16 prints standardised matrices with the suffix `std` when appropriate. The printed example on p. 16 is `discreteDRIFTstd`, not `MANIFESTTRAITVARstd`. Footnote 4 standardises using only the relevant variance, not the total. The relevant variance for that named indicator-level correlation is `MANIFESTTRAITVAR`, not process-level `TRAITVAR` and not residual `MANIFESTVAR` `θ`. The 2017-era source forms `MANIFESTTRAITVARstd` only when `MANIFESTTRAITVAR != 0`, as `solve(sqrt(diag(MANIFESTTRAITVAR) + ridging)) %&% MANIFESTTRAITVAR` when `verbose = TRUE`. OpenMx `%&%` is `t(A) %*% B %*% A`. Unlike `TRAITVARstd`, that formation adds `diag(c(ridging), n.manifest)`. The default `ridging = FALSE` adds 0, not `0.0001`; that ridge is a numerical hack and is not this exact map. The scalar correlation is `ψ / ψ = 1` after strictly positive `MANIFESTTRAITVAR`. Form strictly positive `ψ` first, then `1 / √ψ`, then `(1 / √ψ) ψ (1 / √ψ)`. Unstandardised `MANIFESTTRAITVAR` is defined for a zero trait; standardised `MANIFESTTRAITVAR` is not. Zero `MANIFESTTRAITVAR` skips forming `MANIFESTTRAITVARstd` in the 2017-era source and fails closed here. Indicator-level trait variance is an event-time structural quantity, so a non-event clock fails closed. `MANIFESTTRAITVAR` does not require stable `a < 0`. Distinct positive `ψ` recover the same 1. `trait / trait = 1` is `TRAITVARstd` and recovers the same number and remains a distinct named quantity. `θ` is `MANIFESTVAR` and is measurement error, not this correlation. Meredith (1993) remains unread (web search 2026-08-27T14:20Z: Springer/Cambridge Core paywalled; Unpaywall historically `is_oa: false`; Springer `content/pdf` is an HTML stub). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread on the same terms (DOI `10.1007/bf02294457`). Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. diff --git a/docs/delivery/pr-queue-authority-2026-09-01.md b/docs/delivery/pr-queue-authority-2026-09-01.md index bf322c287..e1578f3c8 100644 --- a/docs/delivery/pr-queue-authority-2026-09-01.md +++ b/docs/delivery/pr-queue-authority-2026-09-01.md @@ -6,15 +6,16 @@ This is a live-recovery record for delivery issue #175. GitHub state supersedes - Protected default branch: `main` - Protected-main SHA observed: `1bc02f580cf48e1d39da239f0e818453437c31c3` -- Open pull requests: **149** -- Draft pull requests: **100** -- Non-draft pull requests: **49** +- Snapshot stamp: `2026-09-01T10:19:29Z` +- Open pull requests: **136** +- Draft pull requests: **91** +- Non-draft pull requests: **45** - Open issues: **14** - Effective required-workflow ruleset: `18156473`, `CWL Central required workflows` - GitHub releases: **0** - `docs/product-technical-gap-baseline.md` is maintained on this recovery branch so it no longer presents a former zero-queue snapshot as current authority. -The queue has grown from the initial 141/99 observation to 149/100 while this recovery vehicle remains open. That is a delivery regression, not evidence of product progress. A queued, skipped, cancelled, predecessor-head, or stale check is not passing evidence. +The initial observation was 141/99. The queue later peaked at 149/100 while this recovery vehicle was open. The current 136/91/45 inventory is a net reduction after scientifically unsafe #356 closed without merge; it is not evidence that the queue is now a bounded landing set. A queued, skipped, cancelled, predecessor-head, or stale check is not passing evidence. ## Queue authority classes @@ -48,25 +49,25 @@ New unrelated micro-PRs are release-excluded while this queue exceeds the active ### PR #441 — event-time lagged association repair -Classification: `landing_vehicle_candidate` under Longitudinal Modeling; scientific root cause repaired on exact head `c1aeed3bc2ca5f801f3baa748a4a3dde9f948338`, but not merge-ready until exact-head workflows and fresh review complete. +Classification: `landing_vehicle_candidate` under Longitudinal Modeling; scientific root cause repaired on exact head `6f483224b3a03e8237c6f4f098a8b0e85e0a91f5`, but not merge-ready until exact-head workflows succeed and independent non-author APPROVE exists. The predecessor head exposed `(trait + e^{aΔt} p + added) / (trait + p + added)` as `expected_autocorrelation`. Review showed that a one-sided covariance/earlier-variance ratio is not a correlation under nonstationary marginals and can exceed one. The repair removes that public claim and its `psychometric_core` changes from the final diff. The replacement belongs to `longitudinal_core` and standardizes a supplied lagged covariance only when both marginal variances are available: `Cov(Y_t,Y_t+Δ) / sqrt(Var(Y_t) * Var(Y_t+Δ))`. -The invalid predecessor commit remains only as RED/scientific-failure lineage. Review threads tied to the removed implementation are resolved as outdated. Hosted exact-head Rust/documentation/security checks were queued at the latest observation, so this PR is not yet a merge authority. +The invalid predecessor commit remains only as RED/scientific-failure lineage. Review threads tied to the removed implementation are resolved as outdated. Canonical `ARCHITECTURE.md` and `CHANGELOG.md` now record the event-time lagged-correlation standardizer; the one-shot self-modifying capability-record workflow was removed. Hosted exact-head Rust/documentation/security checks were still queued at this snapshot, so this PR is not yet a merge authority. ### PR #356 — validation-run scientific evidence -Classification: `landing_vehicle_candidate`, pending correction before it may become `landing_vehicle`. +Classification: **closed without merge**. Useful cutoff/run-binding/metric evidence is preserved in branch and review history for fold into the Validation landing work tracked by #166. Do not reopen this exact vehicle. -Reason: it is direct from current protected main and binds cutoff-safe evidence to a validation run, but current review found a scientific-authority defect. The current acceptance rule compares RMSE with a standard error derived from the same residual vector using a caller-selected preregistered multiplier. This can accept arbitrarily large recovery error for pathological residual shapes. The current observation also accepts caller-supplied truth/recovered vectors and an `authored_by_llm` boolean rather than an estimator-owned, digest-bound provenance artifact. Graph recovery, invariance, convergence, and active-backend CPU/GPU parity applicability are not complete in the claimed scientific-acceptance artifact. +The closed head `df33bfa3e61ae4de3dbfae16df0deac12d2f4003` bound cutoff-safe evidence to a validation run, but review found a scientific-authority defect: the acceptance rule compared RMSE with a standard error derived from the same residual vector using a caller-selected preregistered multiplier. That gate can accept arbitrarily large recovery error for pathological residual shapes. The closed observation also accepted caller-supplied truth/recovered vectors and an `authored_by_llm` boolean rather than an estimator-owned, digest-bound provenance artifact. -DDD correction: the run should produce **Validation Evidence**. A distinct **Claim Promotion Decision** aggregate, governed by ADR 0014 and a method-specific preregistered evidence contract, decides whether a scientific claim is promotable. No generic standard-error multiplier, maximum-k, or other rule-of-thumb threshold may substitute for a research- or model-derived acceptance design. +DDD correction for the next Validation vehicle: the run should produce **Validation Evidence**. A distinct **Claim Promotion Decision** aggregate, governed by ADR 0014 and a method-specific preregistered evidence contract, decides whether a scientific claim is promotable. No generic standard-error multiplier, maximum-k, or other rule-of-thumb threshold may substitute for a research- or model-derived acceptance design. -Exact-head hosted evidence is also not green: the latest observed Product workflow failed its coverage-diagnostic jobs. The branch remains non-draft in GitHub metadata because the connector's draft-conversion mutation is currently broken; that metadata must not be interpreted as merge readiness. +### PR #444 — export-collection CLI -Until the scientific and exact-head failures are corrected, #356 and downstream wire/HTTP slices must not be treated as a shippable scientific-acceptance vertical. +Classification: `fold_into_landing_vehicle` under Analysis Run/export, stacked on #443. Preserve CLI parsing, fail-closed origin/credential/consumer refusals, and metric-free receipt tests. Opening this slice while this recovery vehicle remains open is evidence that the WIP circuit breaker is not yet enforced. ### PRs #352 and #355 — same Driver/ctsem TIPREDEFFECT rewrite @@ -99,4 +100,4 @@ Before merge: ## DDD delivery constraint -Directory and crate moves are part of the owning product-vertical replay. Do not preserve a technical-layer or one-rule path as canonical if it obscures the domain responsibility. Conversely, do not rename all crates in one sweeping PR while 149 remote heads are active. The target bounded contexts are fixed in `docs/architecture/domain-context-map.md`; migration proceeds through safe, reviewable landing vehicles with explicit anti-corruption adapters and replacement mappings. +Directory and crate moves are part of the owning product-vertical replay. Do not preserve a technical-layer or one-rule path as canonical if it obscures the domain responsibility. Conversely, do not rename all crates in one sweeping PR while 136 remote heads are active. The target bounded contexts are fixed in `docs/architecture/domain-context-map.md`; migration proceeds through safe, reviewable landing vehicles with explicit anti-corruption adapters and replacement mappings. diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 964d482d6..da934e2c3 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-01T09:14:20Z +**Snapshot:** 2026-09-01T10:19:29Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` **Workspace version:** `0.2.0` **Delivery authority:** issue [#175](https://github.com/ContextualWisdomLab/TEPP/issues/175), PR [#435](https://github.com/ContextualWisdomLab/TEPP/pull/435), and [`docs/delivery/pr-queue-authority-2026-09-01.md`](delivery/pr-queue-authority-2026-09-01.md) @@ -19,9 +19,9 @@ A planning document, mergeable branch, local test, predecessor-head result, queu | Signal | Current evidence | Delivery implication | | --- | ---: | --- | | Protected `main` | `1bc02f580cf48e1d39da239f0e818453437c31c3` | Capability claims remain bounded to this commit until protected main changes. | -| Open pull requests | **149** | The queue is release-blocking and grew from the initial 141 while consolidation remained open. | -| Draft pull requests | **100** | Draft state is not classification or ownership. | -| Non-draft pull requests | **49** | Ready metadata is not merge readiness without exact-head evidence. | +| Open pull requests | **136** | The queue remains release-blocking. It shrank from the 149-head snapshot after scientifically unsafe #356 closed without merge, and is still far above the recovery baseline. | +| Draft pull requests | **91** | Draft state is not classification or ownership. | +| Non-draft pull requests | **45** | Ready metadata is not merge readiness without exact-head evidence. | | Open issues | **14** | Includes #437 for repository-wide ADR identity normalization. | | GitHub releases | **0** | No open PR head or local branch is a released product contract. | | Effective ruleset | `18156473` | Current ruleset, exact-head workflows, resolved conversations, and qualifying review are the merge authority. | @@ -30,20 +30,20 @@ The repository-level classic branch-protection payload is not the sole policy so ## Current priority open pull-request evidence -This table is an exact-head **priority subset**, not a row-for-row copy of the 149-PR queue. The live total and this operator inventory are deliberately different concepts. +This table is an exact-head **priority subset**, not a row-for-row copy of the 136-PR queue. The live total and this operator inventory are deliberately different concepts. PR #435 itself is deliberately omitted from the exact-head table. A commit that rewrites this document necessarily advances #435's head, so embedding that same branch's “exact current head” inside the commit would be self-invalidating. The delivery-authority line links #435, while its live head is re-read from GitHub immediately before any readiness or merge decision. | PR | Exact current head | Draft | Base | Ownership / disposition | | ---: | --- | :---: | --- | --- | +| #444 | `95ab519fdb39c66a574d1452e969b0b80b9e4ba9` | false | #443/export stack | Analysis Run export collection CLI; `fold_into_landing_vehicle` candidate | | #443 | `504793d88c6b754f5181f48dc7abde073ff9146a` | false | #411/export stack | Analysis Run export collection adapter; `fold_into_landing_vehicle` candidate | -| #441 | `c1aeed3bc2ca5f801f3baa748a4a3dde9f948338` | false | main | Longitudinal Modeling lagged-correlation repair; original invalid ratio removed; exact-head checks pending | +| #441 | `6f483224b3a03e8237c6f4f098a8b0e85e0a91f5` | false | main | Longitudinal Modeling lagged-correlation repair; original invalid ratio removed; exact-head checks pending | | #436 | `460503b6e787362b702509faa955c4730f6d8680` | false | #433 head | Analysis Run/contextual-orchestrator CLI stack; `stacked_dependency` | | #434 | `c0fbaabd8c95e69407c3b9e50f8d1846bd949598` | false | main | membership-target refusal profile; `fold_into_landing_vehicle` candidate | | #432 | `3e09ff29cc89ef97a859f3ae50e1297846dd2eeb` | false | main | Topic Measurement profile binding; preserve unique contract tests | | #425 | `c11558313dd1b95d7528eb5fcb89ad296cf879c0` | false | main | Analysis Run/contextual-orchestrator create CLI stack root candidate | | #389 | `035bfb087d47543fd7dd87cfdbc4edd778f4a6aa` | false | main | irregular event-time composition; Longitudinal Modeling fold candidate | -| #356 | `df33bfa3e61ae4de3dbfae16df0deac12d2f4003` | false | main | Validation Evidence candidate; scientifically blocked from global claim promotion | Passing or queued Checks on an open PR never promote that PR to implemented-main. @@ -108,7 +108,7 @@ Multiple-membership weights are explicit, auditable and time-valid. They are obs | ID | Gap | Maturity | Authority | Closure evidence | | --- | --- | --- | --- | --- | -| GAP-001 | PR authority fragmented across 149 heads | `release-blocking` | #175 / #435 | exact-head classification, bounded-context landing vehicles, unique evidence preserved, safe queue reduction | +| GAP-001 | PR authority fragmented across 136 heads | `release-blocking` | #175 / #435 | exact-head classification, bounded-context landing vehicles, unique evidence preserved, safe queue reduction | | GAP-002 | multilingual span-grounded semantic/concept admission incomplete | `partial` | Evidence & Semantic Measurement | immutable offsets/layout, language profiles, concept dictionary, unknown review, invariance/calibration, hostile-input tests | | GAP-003 | shared-latent temporal topic estimator incomplete | `partial` | #167 | Rust CPU `f64` likelihood/estimands/uncertainty, time/relation/membership effects, multi-seed recovery, real candidate-K fits | | GAP-004 | durable end-to-end Analysis Run incomplete | `partial` | #166 | idempotent lifecycle, persistence/recovery, estimator-bound artifacts, complete validation evidence, separate claim promotion, Compose E2E | @@ -153,11 +153,13 @@ One-rule crates, one-clock crates and one-operation API/CLI PRs are not independ ### Current classifications -**#441 — Longitudinal Modeling lagged-correlation repair.** The invalid predecessor API that divided lagged covariance by only the earlier marginal variance was removed from the final diff after review showed it could produce impossible autocorrelations under nonstationary marginals. Exact repair head `c1aeed3bc2ca5f801f3baa748a4a3dde9f948338` instead places event-time association standardization in `longitudinal_core`, requires both marginal variances, enforces the covariance bound, and avoids the avoidable variance-product overflow. The predecessor commit remains RED/scientific-failure lineage. The branch is not merge-ready until exact-head hosted checks and fresh review complete. +**#441 — Longitudinal Modeling lagged-correlation repair.** The invalid predecessor API that divided lagged covariance by only the earlier marginal variance was removed from the final diff after review showed it could produce impossible autocorrelations under nonstationary marginals. Exact repair head `6f483224b3a03e8237c6f4f098a8b0e85e0a91f5` places event-time association standardization in `longitudinal_core`, requires both marginal variances, enforces the covariance bound without a rounded product, and records the capability on `ARCHITECTURE.md` and `CHANGELOG.md`. The predecessor commit remains RED/scientific-failure lineage. The one-shot self-deleting workflow is gone. The branch is not merge-ready until exact-head hosted checks and independent non-author APPROVE complete. Queued or predecessor-head checks are not passing evidence. + +**#444 — Analysis Run export CLI fold candidate.** The export-collection CLI is stacked on #443 and is useful operator behavior, but one binary is not an independent bounded context. Preserve its fail-closed origin/credential/consumer tests while folding with #443 into a coherent Analysis Run/export landing vehicle. Opening this slice while #435 remains open is evidence that the WIP circuit breaker is not yet enforced by the delivery system. **#443 — Analysis Run export adapter fold candidate.** The export-collection GET is useful operator behavior, but one route is not an independent bounded context. Preserve its pagination, authorization and refusal tests while folding the operation into a coherent Analysis Run/export landing vehicle. -**#356 — Validation Evidence candidate.** Keep useful run binding, but do not make it global scientific-acceptance authority. Its generic `RMSE <= k * SE(RMSE)` rule does not bound absolute recovery error when RMSE and its SE arise from the same residual vector; caller-provided truth/recovered vectors and an `authored_by_llm` boolean also do not establish estimator-owned provenance. Graph recovery, invariance, convergence and applicable CPU/GPU parity remain incomplete. Scientific Claim Promotion is a separate aggregate governed by ADR 0014. +**#356 — closed without merge.** Useful cutoff/run-binding/metric evidence is preserved in branch and review history for fold into #166. The generic `RMSE <= k * SE(RMSE)` rule, caller-declared recovery provenance, and Validation/Claim-Promotion conflation must not be revived. Scientific Claim Promotion remains a separate aggregate governed by ADR 0014. **#352/#355 — Longitudinal Modeling fold candidates.** They share a Driver/ctsem scalar rewrite but retain different public names, refusal guards, tests and research documentation. Preserve the strongest evidence before closing either. From 67d6fd3e73a9ccd5cb4ff39e1f1fcfd302d552f2 Mon Sep 17 00:00:00 2001 From: seonghobae Date: Tue, 1 Sep 2026 10:23:34 +0000 Subject: [PATCH 013/235] docs(research): re-try Meredith 1993 and Mislevy 1991 OA Unpaywall and OpenAlex re-read 2026-09-01T10:22Z remain closed (is_oa false, 0 OA locations). Full texts stay unread. Mean-gate authority is still Putnick and Bornstein (2016, PMC5145197). Rubin T_m remains the complete-data combining rule, not Mislevy PVs. --- CLAUDE.md | 2 +- docs/research/rubin-total-variance.md | 2 +- docs/research/standards-and-literature.md | 4 ++-- docs/research/strong-invariance-latent-means.md | 2 +- 4 files changed, 5 insertions(+), 5 deletions(-) diff --git a/CLAUDE.md b/CLAUDE.md index 339692cf0..2092da3c6 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -14,7 +14,7 @@ Read and follow `AGENTS.md` before changing this repository. The repository-wide - Do not convert association, temporal precedence, or document links into causal language without identification evidence. - Do not remove repeated report language with global stopword lists or use TF-IDF/BM25 as inferential weights. Model template, section, copied-text, style, modality, and corpus-background sources explicitly. - Do not treat raw topic proportions as ordinary Euclidean indicators. Use logistic-normal coordinates or valid log-ratio coordinates and propagate posterior uncertainty into ESEM/DSEM. -- Do not treat metric/weak invariance as a latent-mean license. Strong (equal loading and intercept) or strict is required; `#84` `metric` licenses shared metric meaning only. Putnick and Bornstein (2016, PMC5145197 opened 2026-08-19T22:15Z) require scalar invariance before latent-mean comparison; residual invariance is not a prerequisite. Two-observation series have no residual degrees of freedom (`ordinary_least_squares_fit` returns residual variance `0`) and cap at strong/scalar; they still license means. This is two-group OLS, not MGCFA. Meredith (1993) names remain unread labels (Unpaywall/OpenAlex 2026-08-25T11:32Z: closed). +- Do not treat metric/weak invariance as a latent-mean license. Strong (equal loading and intercept) or strict is required; `#84` `metric` licenses shared metric meaning only. Putnick and Bornstein (2016, PMC5145197 opened 2026-08-19T22:15Z) require scalar invariance before latent-mean comparison; residual invariance is not a prerequisite. Two-observation series have no residual degrees of freedom (`ordinary_least_squares_fit` returns residual variance `0`) and cap at strong/scalar; they still license means. This is two-group OLS, not MGCFA. Meredith (1993) names remain unread labels (Unpaywall/OpenAlex 2026-09-01T10:22Z: still closed, `is_oa: false`, 0 OA locations). - Do not use the difference quotient as a continuous-time rate. The scalar map is `a = ln(φ) / Δt` on event time. Discrete lags from unequal event intervals are not one coefficient; remap them through that log-rate. Binary64 `exp(a Δt) = 0` is not a discrete lag. A constant predictor's discrete effect is Voelkle et al. (2012, Eq. 12), evaluated as `a_yx (expm1(z) / a_xx)` with `z = a_xx Δt` so a finite result is not lost when `z` overflows to `-∞` or when `a_yx Δt` overflows. When `expm1(z)` overflows at a finite `z`, rewrite in log space; a zero continuous effect is exactly zero; an overflowing `a_yx/a_xx` rewrite term fails closed. The first-order product is the underflow limit of that equation, not the general constant-predictor discrete effect. A time-varying predictor whose sampling interval equals its constancy interval uses Voelkle et al. (2012, Eq. 14): `b* = a_yx Δt`. Unmatched intervals fail closed (Oud & Jansen, 2000, unread). Discrete process noise is Driver et al. (2017, Eq. 3): `Q_Δt = 0.5 q (expm1(z) / a)` with `z = 2 (a Δt)` and `q = G G⊤ ≥ 0`; do not form `2 a` first; `a = 0` and `z → 0` recover `q Δt`; a zero diffusion is exactly zero; an overflowing rewrite scale `0.5 q / a` fails closed; this is not a Kalman filter. `Q_Δt` is `cov(η_t | η_{t-1})`, not `Var(η_t)`. The lagged covariance is `exp(a Δt) p` and the unconditional variance is `exp(2 a Δt) p + Q_Δt` (Driver et al., 2017, Eq. 3–4, pp. 4–5; JSS has no numbered §2.2). A zero diffusion whose `2 (a Δt)` overflows to `+∞` is not a finite `Var(η_t)`. The stationary within-subject variance is the `Δt → ∞` limit of Eq. 4: `-q / (2 a)` for stable `a < 0` (JSS p. 16 `asymDIFFUSION`; §4.3). When `2 a` is finite, form `q / -(2 a)` so `q / a` overflow does not lose a finite result (`q = MAX`, `a = -0.75` → `MAX / 1.5`). When `2 a` overflows, form `(q / a) * -0.5`. Do not form `0.5 q` first (`q = from_bits(1)` underflows). `a ≥ 0` has no finite stationary variance. Finite-interval `Q_Δt` is not that limit. Trait-plus-state variance is `trait + state` and lagged covariance is `trait + exp(a Δt) p` (Driver et al., 2017, §4.3, p. 9). Trait variance is not process noise and not `asymDIFFUSION`. Evolving the summed variance as if it were all state is not that map. This is not RI-CLPM. Observed-indicator variance is `λ² Var(η) + θ` when `MANIFESTTRAITVAR` is zero and `λ² Var(η) + θ + ψ` otherwise (Driver et al., 2017, Eq. 5, p. 5; Table 2, p. 12). Lagged observed covariance is `λ² cov(η_t, η_{t-1}) + ψ`; `MANIFESTVAR` does not enter. Observed-indicator mean is `τ + λ μ` (Driver et al., 2017, Eq. 5; Table 2, p. 12). `MANIFESTMEANS` is `τ`, not `E(y)`. `E(η)` is not `E(y)`. `CINT` is not `MANIFESTMEANS`. `T0MEANS` is not `E(y)`. The discrete latent mean is `μ_t = exp(a Δt) μ_0 + (exp(a Δt) − 1)/a κ` (Driver et al., 2017, Eq. 3, p. 4; Table 2, p. 12). `T0MEANS` is not `μ_t`. `CINT` is not that discrete increment. A zero drift is `κ Δt`. Underflow of `exp(a Δt)` to `+0` drops the carried `T0MEANS` and keeps `−κ / a`. The evolved observed mean is `τ + λ μ_t` (Driver et al., 2017, Eq. 5 of that Eq. 3 map). The first-occasion map `τ + λ μ_0` is not `E(y_t)`. `μ_t` is not `E(y_t)`. The contemporaneous time-dependent predictor impulse is `m x` (Driver et al., 2017, Eq. 3 fourth summand; Table 2 `TDPREDEFFECT` is `M`). Form `μ_t` first, then add `m x`. `TDPREDEFFECT` is not `CINT`. `M x` is not `A^{-1}[e^{A Δt} − I] B z` and is not Voelkle et al. (2012, Eq. 14). The §7.2 level-change form is not that impulse. The observed mean of that contemporaneous impulse is `τ + λ(μ_t + m x)` (Driver et al., 2017, Eq. 5 of the Eq. 3 fourth-summand composition). The evolved map `τ + λ μ_t` is not that observed mean. The carry map `τ + λ(μ_t + e^{a(t−u)} m x)` is not that observed mean when `u ≠ t`. The evolved-plus-impulse latent mean is not `E(y_t)`. The time-independent predictor increment is `A^{-1}[e^{A Δt} − I] B z` (Driver et al., 2017, Eq. 3 second summand; Table 2 `TIPREDEFFECT` is `B`). Form `B z` first, then the discrete intercept map. A zero drift is `B z Δt`. `TIPREDEFFECT` is `B`, not that discrete increment. `A^{-1}[e^{A Δt} − I] B z` is not `CINT`, not `M x`, and not Voelkle et al. (2012, Eq. 14). The observed mean of that increment is `τ + λ(μ_t + A^{-1}[e^{A Δt} − I] B z)` (Driver et al., 2017, Eq. 5 of the Eq. 3 printed addend after the `T0MEANS` carry and the `CINT` increment). The evolved map `τ + λ μ_t` is not that observed mean. The contemporaneous map `τ + λ(μ_t + m x)` is not that observed mean. The carry map `τ + λ(μ_t + e^{a(t−u)} m x)` is not that observed mean when `u ≠ t`. The evolved-plus-increment latent mean is not `E(y_t)`. The within-interval time-dependent impulse carry is `e^{A(t−u)} M x` for `t0 < u < t` (Driver et al., 2017, Eq. 1–2 Green-function integral of Eq. 2; §7.2 dissipation). Form `m x` first, then `e^{a(t−u)} m x`. A zero drift is `m x` with no dissipation. Underflow of `e^{a(t−u)}` to `+0` is vanishing dissipation and is kept. `e^{A(t−u)} M x` is not the contemporaneous Dirac, not `CINT`, not `TIPREDEFFECT`, and not Voelkle et al. (2012, Eq. 14). An impulse at `u = t` is the contemporaneous map. An impulse at `u ≤ t0` is already in `η(t0)`. The observed mean of that carry is `τ + λ(μ_t + e^{a(t−u)} m x)` (Driver et al., 2017, Eq. 5 of the Eq. 1–2 carried latent mean). The evolved map `τ + λ μ_t` is not that observed mean. The contemporaneous map `τ + λ(μ_t + m x)` is not that observed mean when `u ≠ t`. `MANIFESTMEANS` is not `E(y_t)`. The carried latent mean is not `E(y_t)`. The first-occasion time-independent predictor shift is `t0_b z` (Driver et al., 2017, Table 3 `T0TIPREDEFFECT`; Eq. 3 first summand). Form `t0_b z` first, then `e^{a Δt} t0_b z`. Form `μ_t` first, then add that carry. A zero drift is `t0_b z`. Underflow of `e^{a Δt}` to `+0` is a vanishing carry of the first-occasion shift and is kept. `t0_b z` is not `A^{-1}[e^{A Δt} − I] B z`, not `CINT`, and not `M x`. `e^{A Δt} t0_b z` is not `t0_b z`. `T0TIPREDEFFECT` is the coefficient, not the shift. The observed mean of that first-occasion carry is `τ + λ(μ_t + e^{a Δt} t0_b z)` (Driver et al., 2017, Eq. 5 of the Table 3 / Eq. 3 first-summand composition). The evolved map `τ + λ μ_t` is not that observed mean. The process-increment map `τ + λ(μ_t + A^{-1}[e^{A Δt} − I] B z)` is not that observed mean. The contemporaneous map `τ + λ(μ_t + m x)` is not that observed mean. The impulse-carry map `τ + λ(μ_t + e^{a(t−u)} m x)` is not that observed mean when `u ≠ t0`. The evolved-plus-carry latent mean is not `E(y_t)`. The first-occasion time-dependent predictor shift is `t0_m x0` (Driver et al., 2017, Table 3 `T0TDPREDEFFECT`; Eq. 3 first summand; JSS PDF re-opened 2026-08-20T19:10Z). Form `t0_m x0` first, then `e^{a Δt} t0_m x0`. Form `μ_t` first, then add that carry. A zero drift is `t0_m x0`. Underflow of `e^{a Δt}` to `+0` is a vanishing carry of the first-occasion shift and is kept. `t0_m x0` is not `M x`, not `e^{A(t−u)} M x` for `t0 < u < t`, not `t0_b z`, not `A^{-1}[e^{A Δt} − I] B z`, and not `CINT`. `e^{A Δt} t0_m x0` is not `t0_m x0`. `T0TDPREDEFFECT` is the coefficient, not the shift. An impulse at `u ≤ t0` that used `M` is already in `η(t0)` as `TDPREDEFFECT`, not as `T0TDPREDEFFECT`. The observed mean of that first-occasion TD carry is `τ + λ(μ_t + e^{a Δt} t0_m x0)` (Driver et al., 2017, Eq. 5 of the Table 3 / Eq. 3 first-summand TD composition; JSS PDF re-opened 2026-08-20T19:07Z). The evolved map `τ + λ μ_t` is not that observed mean. The process-increment map `τ + λ(μ_t + A^{-1}[e^{A Δt} − I] B z)` is not that observed mean. The contemporaneous map `τ + λ(μ_t + m x)` is not that observed mean. The impulse-carry map `τ + λ(μ_t + e^{a(t−u)} m x)` is not that observed mean when `u ≠ t0`. The first-occasion TI map `τ + λ(μ_t + e^{a Δt} t0_b z)` is not that observed mean. The evolved-plus-carry latent mean is not `E(y_t)`. The lasting level-change `CINT` is `κ = −a m x` (Driver et al., 2017, §7.2, pp. 20–21; JSS PDF re-opened 2026-08-20T19:45Z). Form `m x` first, then multiply by `−a`. Stable `a < 0` is required so `−κ / a = m x` is an equilibrium offset. `a ≥ 0` cannot hold a new process mean. `−a m x` is not the dissipating Dirac `m x`, not a free `CINT`, and not `A^{-1}[e^{A Δt} − I] B z`. The extra near-zero-drift latent process also named in §7.2 is a different specification and is not this `CINT` setting. Equation 3 maps that intercept as `(1 − e^{a Δt}) m x` (JSS PDF re-opened 2026-08-20T19:50Z). Form the level-change `CINT` first, then the discrete intercept map. Underflow of `e^{a Δt}` to `+0` keeps `m x`. `(1 − e^{a Δt}) m x` is not `m x`, not `κ`, and not `A^{-1}[e^{A Δt} − I] B z`. The printed §7.2 lasting level change is an extra near-zero-drift latent process (Driver et al., 2017, §7.2, pp. 22–23; JSS PDF re-opened 2026-08-20T23:10Z). `T0MEANS`, `CINT`, `T0VAR`, `DIFFUSION`, and `TRAITVAR` of that process are fixed to 0; `TDPREDEFFECT` on it is fixed to 1; its `DRIFT` diagonal is very close to 0 (printed example `−0.000001`; precisely 0 causes computational problems); the original process is driven by the `DRIFT` coupling `a_{ηξ}`. After a unit identification impulse the scalar contribution is `a_{ηξ} x (e^{ε Δt} − e^{a Δt}) / (ε − a)` (`ε = a` is `a_{ηξ} x Δt e^{a Δt}`). Form `a_{ηξ} x` first. A zero coupling or zero predictor is exactly zero. `ε ≥ 0` fails closed. That contribution is not `κ = −a m x`, not `(1 − e^{a Δt}) m x`, and not the dissipating Dirac `m x`. The observed mean of that extra-process contribution is `τ + λ(μ_t + a_{ηξ} x (e^{ε Δt} − e^{a Δt}) / (ε − a))` (Driver et al., 2017, Eq. 5 of that §7.2 contribution; JSS PDF re-opened 2026-08-21T06:12Z). The extra process has `LAMBDA` 0 and is not an observed indicator. Original indicators load on the original process after the `DRIFT` coupling. The evolved map `τ + λ μ_t` is not that observed mean. The contemporaneous map `τ + λ(μ_t + m x)` is not that observed mean. The contribution is not `E(y_t)`. The evolved-plus-contribution latent mean is not `E(y_t)`. `T0TDPREDEFFECT` on the extra process begins at `t = 0` and uses `Δt = t − t0` for both the original-process evolution and the extra drive. `TDPREDEFFECT` after `t0` uses `t − u` with `t0 < u < t` for the extra drive while `μ_t` still uses `Δt`. The observed mean of that after-t0 extra-process contribution is `τ + λ(μ_t + a_{ηξ} x (e^{ε(t−u)} − e^{a(t−u)}) / (ε − a))` (Driver et al., 2017, Eq. 5 of that §7.2 after-t0 contribution; JSS PDF re-opened 2026-08-21T06:32Z). The first-occasion extra-process observed mean is not that observed mean when `u ≠ t0`. The impulse-carry map `τ + λ(μ_t + e^{a(t−u)} m x)` is a Dirac on the original process and is not that `DRIFT` drive. An impulse at `u = t0` or `u = t` is not interior. The asymptotic time-independent predictor effect is `-B z / a` (Driver et al., 2017, §7.2, pp. 20–21; JSS PDF opened 2026-08-21T13:08Z). Form `B z` first, then divide by `-a`. Stable `a < 0` is required. `a ≥ 0` cannot hold a finite process-mean change. `-B z / a` is not the coefficient `B`, not `A^{-1}[e^{A Δt} − I] B z`, not `CINT`, and not `M x`. The asymptotic time-independent predictor variance is `(B / a)² v` (Driver et al., 2017, §7.2, pp. 20–21 `addedTIPREDVAR`). Form the unit asymptotic effect first, then square, then multiply by `v`. `(B / a)² v` is not `TRAITVAR`, not `asymDIFFUSION`, and not `-B z / a`. The asymptotic continuous intercept is `-κ / a` (Driver et al., 2017, Table 2, p. 12 `asymCINT`; Eq. 3 as `Δt → ∞`; JSS PDF opened 2026-08-21T16:13Z). Form `κ` first, then divide by `-a`. Stable `a < 0` is required. `-κ / a` is not `κ`, not `A^{-1}[e^{A Δt} − I] κ`, not `T0MEANS`, and not `-B z / a`. The p. 16 stationary `T0MEANS` constraint is `-κ / a + −B z / a`. Form the intercept contribution first, then include the TI extra effect, then add. That constrained first-occasion mean is not free `T0MEANS`, not `asymCINT` alone, not `asymTIPREDEFFECT` alone, and not the finite-interval discrete latent mean. Equation 5 of that constrained mean is `τ + λ(−κ / a + −B z / a)` (Driver et al., 2017, §4.3, pp. 9–10; Eq. 5, p. 5; JSS PDF re-opened 2026-08-21T20:07Z). Form the stationary latent mean first, then `τ + λ` of that mean. `τ + λ μ_0` for free `T0MEANS` is not that composition. `τ + λ(−κ / a)` is not that composition when `B z ≠ 0`. `τ + λ μ_t` is not that composition. `MANIFESTMEANS` is not `E(y_0)`. The constrained latent mean is not `E(y_0)`. The p. 16 constrained first-occasion variance `trait + −q / (2 a) + (B / a)² v` is not free `T0VAR`, not `asymDIFFUSION` alone, not `TRAITVAR` alone, not `addedTIPREDVAR` alone, and not the finite-interval discrete latent variance. Eq. 5 of that constrained variance is `λ²(trait + −q / (2 a) + (B / a)² v) + θ + ψ` (JSS PDF re-opened 2026-08-22T03:20Z; form the stationary latent variance first, then `λ² p + θ + ψ`; `λ² p_0` is not that observed variance; `λ²(−q / (2 a)) + θ` is not that observed variance when `TRAITVAR` or `addedTIPREDVAR` is nonzero; `MANIFESTVAR` is not `Var(y_0)`; the constrained latent variance is not `Var(y_0)`). The lagged covariance of that constrained process is `trait + e^{a Δt}(−q / (2 a)) + (B / a)² v` (Driver et al., 2017, Eq. 3–4 of §4.3 / p. 16 `T0VAR`; JSS PDF re-opened 2026-08-22T19:13Z). Trait and `addedTIPREDVAR` do not decay with `e^{a Δt}`. Contemporaneous `T0VAR` is not that lagged map. Decaying the constrained total as if it were all state is not that lagged map. Equation 5 of that lagged covariance is `λ²(trait + e^{a Δt}(−q / (2 a)) + (B / a)² v) + ψ`. `Θ` does not enter. Contemporaneous `Var(y_0)` is not that lagged observed covariance. The lagged latent covariance is not that observed covariance. The later-occasion variance of that constrained process is `trait + e^{2 a Δt}(−q / (2 a)) + Q_Δt + (B / a)² v` (Driver et al., 2017, Eq. 3–4 of §4.3 / p. 16 `T0VAR`; JSS PDF re-opened 2026-08-22T23:12Z). Trait and `addedTIPREDVAR` do not enter `Q_Δt`. Under stationarity that composition equals contemporaneous `T0VAR`. Evolving the constrained total as if it were all state is not that later map. The lagged covariance omits `Q_Δt` and is not that later map. `Q_Δt` is not that later map. Equation 5 of that later-occasion variance is `λ²(trait + e^{2 a Δt}(−q / (2 a)) + Q_Δt + (B / a)² v) + θ + ψ`. The lagged observed covariance omits `Q_Δt` and `θ`. `MANIFESTVAR` is not `Var(y_t)`. The later-occasion latent variance is not `Var(y_t)`. The later-occasion variance of §4.3 predetermined `T0VAR` is `trait + e^{2 a Δt} p_0 + Q_Δt + (B / a)² v` (Driver et al., 2017, Eq. 3–4 of §4.3 predetermined first occasion; JSS PDF re-opened 2026-08-23T05:12Z). Trait and `addedTIPREDVAR` do not enter `Q_Δt`. Free `T0VAR` `p_0` is not that later map. Setting `p_0 = −q / (2 a)` recovers the stationary later-occasion map. Stationary later variance uses `−q / (2 a)` in place of `p_0` and is not that later map when `p_0` is free. Evolving `trait + p_0 + (B / a)² v` as if it were all state is not that later map. As `Δt → ∞` with stable `a < 0` the composition approaches contemporaneous stationary `T0VAR`. As `Δt → 0+` the composition approaches `trait + p_0 + (B / a)² v`. Nonzero diffusion with `a ≥ 0` is a growing process and is kept. Equation 5 of that predetermined later-occasion variance is `λ²(trait + e^{2 a Δt} p_0 + Q_Δt + (B / a)² v) + θ + ψ`. `MANIFESTVAR` is not `Var(y_t)`. The predetermined later-occasion latent variance is not `Var(y_t)`. Stationary later observed variance is not that observed variance when `p_0` is free. The lagged covariance of §4.3 predetermined `T0VAR` is `trait + e^{a Δt} p_0 + (B / a)² v` (Driver et al., 2017, Eq. 3–4 of §4.3 predetermined first occasion; JSS PDF re-opened 2026-08-23T09:04Z). Trait and `addedTIPREDVAR` do not decay with `e^{a Δt}`. Free `T0VAR` `p_0` is not that lagged map. Setting `p_0 = −q / (2 a)` recovers the stationary lagged map. Stationary lagged covariance uses `−q / (2 a)` in place of `p_0` and is not that lagged map when `p_0` is free. Evolving `trait + p_0 + (B / a)² v` as if it were all state is not that lagged map. Later-occasion variance includes `Q_Δt` and is not that lagged map. As `Δt → ∞` with stable `a < 0` the state term vanishes. As `Δt → 0+` the composition approaches `trait + p_0 + (B / a)² v`. Equation 5 of that predetermined lagged covariance is `λ²(trait + e^{a Δt} p_0 + (B / a)² v) + ψ`. `MANIFESTVAR` does not enter. The predetermined lagged latent covariance is not that observed covariance. Predetermined later observed variance includes `Q_Δt` and `θ` and is not that lagged observed covariance. Stationary lagged observed covariance is not that observed covariance when `p_0` is free. The predetermined first-occasion variance of §4.3 predetermined `T0VAR` is `trait + p_0 + (B / a)² v`. Free `p_0` is not that map. Stationary first-occasion variance uses `−q / (2 a)` in place of `p_0` and is not that map when `p_0` is free. Lagged covariance decays the state and is not that map. Later-occasion variance includes `Q_Δt` and is not that map. Equation 5 of that predetermined first-occasion variance is `λ²(trait + p_0 + (B / a)² v) + θ + ψ`. `MANIFESTVAR` is not that first-occasion observed variance. The predetermined first-occasion latent variance is not that observed variance. Stationary first-occasion observed variance is not that observed variance when `p_0` is free. Predetermined later observed variance includes `Q_Δt` and is not that first-occasion observed variance. Later-start lagged covariance of predetermined `T0VAR` is `trait + e^{a s}(e^{2 a u} p_0 + Q_u) + (B / a)² v` (Driver et al., 2017, §4.3 `startoffset`; Eq. 4; JSS PDF re-opened 2026-08-23T10:27Z). First-occasion lagged omits `e^{a s} Q_u`. Later-occasion variance does not lag. Stationary lagged uses `−q / (2 a)`. Decaying the later total is not that map. Equation 5 of that later-start lagged covariance is `λ²` of it plus `ψ`. Independent `ε_t` does not enter. First-occasion lagged observed omits `e^{a s} Q_u`. Predetermined later observed variance includes `Q_u` and `θ` and is not that later-start lagged observed covariance. Later-start later-occasion variance of predetermined `T0VAR` is `trait + e^{2 a s}(e^{2 a u} p_0 + Q_u) + Q_s + (B / a)² v` (Driver et al., 2017, §4.3 `startoffset`; Eq. 3–4 Chapman–Kolmogorov `Q_{u+s} = e^{2 a s} Q_u + Q_s`; JSS PDF re-opened 2026-08-23T11:05Z). Later-occasion variance at `u` omits `Q_s`. Later-start lagged covariance omits `Q_s`. Stationary later uses `−q / (2 a)`. Evolving the later total as if it were all state is not that map. Ignoring `startoffset` omits `e^{2 a s} Q_u`. Equation 5 of that later-start later-occasion variance is `λ²` of it plus `θ + ψ`. `MANIFESTVAR` is not that observed variance. Page 16 `discreteDRIFTstd` is `e^{a Δt}` after strictly positive `asymDIFFUSION` `-q / (2 a)` (Driver et al., 2017, p. 16; footnote 4; §7.1; JSS PDF re-opened 2026-08-23T11:40Z). Unstandardised `e^{a Δt}` is defined for growing `a ≥ 0` and for zero diffusion and is not `discreteDRIFTstd`. The §7.1 trait-plus-state autocorrelation `(trait + e^{a Δt} p + added) / (trait + p + added)` uses `TRAITVAR` and is not `discreteDRIFTstd`. `TRAITVAR` is not the standardisation variance. Page 16 `discreteDIFFUSIONstd` is `Q_Δt / (−q / (2 a))` after strictly positive `asymDIFFUSION` `-q / (2 a)` (Driver et al., 2017, p. 16; Eq. 4; footnote 4; JSS PDF re-opened 2026-08-23T13:06Z). Unstandardised `Q_Δt` is defined for growing `a ≥ 0` and for zero diffusion and is not `discreteDIFFUSIONstd`. The continuous standardisation `−2 a` is not `discreteDIFFUSIONstd`. `Q_Δt / (trait + p + added)` uses `TRAITVAR` and is not `discreteDIFFUSIONstd`. `TRAITVAR` is not the standardisation variance. Page 16 `DIFFUSIONstd` is `q / (−q / (2 a)) = −2 a` after strictly positive `asymDIFFUSION` `-q / (2 a)` (Driver et al., 2017, p. 16; Eq. 4; footnote 4; JSS PDF re-opened 2026-08-23T13:20Z). Unstandardised `q` is defined for growing `a ≥ 0` and for zero diffusion and is not `DIFFUSIONstd`. The discrete standardisation `Q_Δt / (−q / (2 a))` depends on `Δt` and is not `DIFFUSIONstd`. `q / (trait + p + added)` uses `TRAITVAR` and is not `DIFFUSIONstd`. `TRAITVAR` is not the standardisation variance. Page 16 `DRIFTstd` is the continuous auto-effect after strictly positive `asymDIFFUSION` `-q / (2 a)` (Driver et al., 2017, p. 16; Eq. 1; footnote 4; JSS PDF re-opened 2026-08-23T13:28Z). Unstandardised `a` is defined for growing `a ≥ 0` and for zero diffusion and is not `DRIFTstd`. The discrete standardisation `e^{a Δt}` depends on the event interval and is not `DRIFTstd`. `a p / (trait + p + added)` uses `TRAITVAR` and is not `DRIFTstd`. `TRAITVAR` is not the standardisation variance. Page 16 `asymTIPREDEFFECTstd` is `(-B / a) · √v / √(-q / (2 a))` after strictly positive `asymDIFFUSION` `-q / (2 a)` and strictly positive predictor variance `v` (Driver et al., 2017, p. 16; §7.2; footnote 4; JSS PDF re-opened 2026-08-23T14:25Z). Unstandardised `-B / a` is defined for a zero coefficient and for zero predictor variance and is not `asymTIPREDEFFECTstd`. The finite-interval standardisation `A^{-1}[e^{A Δt} − I] B · √v / √p` depends on the event interval and is not `asymTIPREDEFFECTstd`. `(-B / a) · √v / √(trait + p + added)` uses `TRAITVAR` and is not `asymTIPREDEFFECTstd`. `TRAITVAR` is not the standardisation variance. Page 16 `TIPREDEFFECTstd` is `B · √v / √(-q / (2 a))` after strictly positive `asymDIFFUSION` `-q / (2 a)` and strictly positive predictor variance `v` (Driver et al., 2017, p. 16; §7.2; footnote 4; JSS PDF re-opened 2026-08-23T16:21Z). Unstandardised `B` is defined for a zero coefficient and for zero predictor variance and is not `TIPREDEFFECTstd`. The asymptotic standardisation `(-B / a) · √v / √p` is the total change and is not `TIPREDEFFECTstd`. The finite-interval standardisation `A^{-1}[e^{A Δt} − I] B · √v / √p` depends on the event interval and is not `TIPREDEFFECTstd`. `B · √v / √(trait + p + added)` uses `TRAITVAR` and is not `TIPREDEFFECTstd`. `TRAITVAR` is not the standardisation variance. Page 16 / Table 3 `T0TIPREDEFFECTstd` is `t0_b · √v / √p_0` after strictly positive free `T0VAR` `p_0` and strictly positive predictor variance `v` (Driver et al., 2017, Table 3, p. 13; p. 16; footnote 4; 2017-era ctsem `summary.ctsemFit.R`; JSS PDF re-opened 2026-08-23T17:20Z). The affected variance is free first-occasion `T0VAR`, not `asymDIFFUSION`. Unstandardised `t0_b` is defined for a zero coefficient and for zero predictor variance and is not `T0TIPREDEFFECTstd`. `TIPREDEFFECTstd` `B · √v / √(-q / (2 a))` is the continuous coefficient and is not `T0TIPREDEFFECTstd`. `asymTIPREDEFFECTstd` `(-B / a) · √v / √p` is the total change and is not `T0TIPREDEFFECTstd`. `t0_b · √v / √(trait + p_0 + added)` uses `TRAITVAR` and is not `T0TIPREDEFFECTstd`. `TRAITVAR` is not the standardisation variance. 2017-era `addedT0TIPREDVAR` is `t0_b² v` after a first-occasion time-independent predictor (Driver et al., 2017, Table 3, p. 13; p. 16; §7.2; 2017-era ctsem `summary.ctsemFit.R`; JSS PDF re-opened 2026-08-23T18:20Z). Form `t0_b` first, then square, then multiply by `v`. A zero coefficient or zero predictor variance is exactly zero. Free `T0TIPREDEFFECT` does not require `a < 0`. `(B / a)² v` is `addedTIPREDVAR` and is not this first-occasion map. `t0_b · √v / √p_0` is `T0TIPREDEFFECTstd` and is not this variance. Free `T0VAR` is not this extra TI variance. `TRAITVAR` is not this extra TI variance. Equation 5 of 2017-era `addedT0TIPREDVAR` is `λ² t0_b² v` (Driver et al., 2017, Eq. 5, p. 5; Table 3, p. 13; Table 2, p. 12; 2017-era ctsem `summary.ctsemFit.R`; JSS PDF re-opened 2026-08-23T19:10Z). Form `t0_b² v` first, then `(λ extra) λ` with `θ = 0`. A zero loading or zero extra is exactly zero. `t0_b² v` is the latent extra, not the observed extra. `λ² p_0 + θ` is first-occasion observed variance, not this extra. `λ² (B / a)² v` is Eq. 5 of `addedTIPREDVAR`, not this first-occasion observed extra. `MANIFESTVAR` `θ` is not this extra. Equation 5 of §7.2 `addedTIPREDVAR` is `λ² (B / a)² v` (Driver et al., 2017, Eq. 5, p. 5; Table 2, p. 12; §7.2, pp. 20–21; 2017-era ctsem `summary.ctsemFit.R`; JSS PDF re-opened 2026-08-23T19:23Z). Form `(B / a)² v` first, then `(λ extra) λ` with `θ = 0`. A zero loading or zero extra is exactly zero. Lasting asymptotic extra requires `a < 0`. `(B / a)² v` is the latent extra, not the observed extra. `λ² t0_b² v` is first-occasion extra observed TI variance, not this extra. `λ² p + θ` is stationary observed variance, not this extra. `MANIFESTVAR` `θ` is not this extra. Page 16 `TDPREDEFFECTstd` is `m · √v / √(-q / (2 a))` after strictly positive `asymDIFFUSION` and strictly positive time-dependent predictor variance. Unstandardised `M` is not `TDPREDEFFECTstd`. `TIPREDEFFECTstd` is not `TDPREDEFFECTstd` even when `M = B`. intercept-style `A^{-1}[e^{A Δt} − I] M · √v / √p` is not `TDPREDEFFECTstd`. `m · √v / √(trait + p + added)` uses `TRAITVAR` and is not `TDPREDEFFECTstd`. Table 3 / p. 16 `T0TDPREDEFFECTstd` is `t0_m · √v / √p_0` after strictly positive free `T0VAR` and strictly positive TD predictor variance. Unstandardised `t0_m` is not `T0TDPREDEFFECTstd`. `TDPREDEFFECTstd` uses `asymDIFFUSION` and is not `T0TDPREDEFFECTstd`. `T0TIPREDEFFECTstd` is not `T0TDPREDEFFECTstd` even when `t0_m = t0_b`. `t0_m · √v / √(trait + p_0 + added)` uses `TRAITVAR` and is not `T0TDPREDEFFECTstd`. Free `T0VAR` does not require `a < 0`. Page 16 `T0VARstd` is `p_0 / p_0 = 1` after strictly positive free `T0VAR` (`solve(sqrt(diag(T0VAR))) %&% T0VAR`; OpenMx `%&%` is `t(A) %*% B %*% A`; the default ridge is 0). Unstandardised `T0VAR` is not `T0VARstd`. `T0TDPREDEFFECTstd` is not `T0VARstd`. `addedT0TIPREDVAR` is not `T0VARstd`. Page 16 `TRAITVARstd` is `trait / trait = 1` after strictly positive `TRAITVAR` (`solve(sqrt(diag(TRAITVAR))) %&% TRAITVAR`; OpenMx `%&%` is `t(A) %*% B %*% A`; no ridge addend). Unstandardised `TRAITVAR` is not `TRAITVARstd`. `T0VARstd` is not `TRAITVARstd` even when both equal 1. `addedT0TIPREDVAR` is not `TRAITVARstd`. Page 16 `MANIFESTTRAITVARstd` is `ψ / ψ = 1` after strictly positive `MANIFESTTRAITVAR` (`solve(sqrt(diag(MANIFESTTRAITVAR))) %&% MANIFESTTRAITVAR`; OpenMx `%&%` is `t(A) %*% B %*% A`; 2017-era source adds ridging; default ridge is 0). Unstandardised `MANIFESTTRAITVAR` is not `MANIFESTTRAITVARstd`. `TRAITVARstd` is not `MANIFESTTRAITVARstd` even when both equal 1. `MANIFESTVAR` is not `MANIFESTTRAITVARstd`. Page 16 `MANIFESTVARstd` is `θ / θ = 1` after strictly positive `MANIFESTVAR` (`solve(sqrt(diag(MANIFESTVAR))) %&% MANIFESTVAR`; OpenMx `%&%` is `t(A) %*% B %*% A`; 2017-era source adds ridging; default ridge is 0; 2017-era `dimnames` assignment to `latentNames` is a source bug). Unstandardised `MANIFESTVAR` is not `MANIFESTVARstd`. `MANIFESTTRAITVARstd` is not `MANIFESTVARstd` even when both equal 1. Equation 5 `Var(y)` is not `MANIFESTVARstd`. Page 16 `TIPREDVARstd` is `v / v = 1` after strictly positive `TIPREDVAR` (`solve(sqrt(diag(TIPREDVAR))) %&% TIPREDVAR`; OpenMx `%&%` is `t(A) %*% B %*% A`; 2017-era source adds ridging; default ridge is 0; `dimnames` are `TIpredNames`). Unstandardised `TIPREDVAR` is not `TIPREDVARstd`. `MANIFESTVARstd` is not `TIPREDVARstd` even when both equal 1. Section 7.2 `addedTIPREDVAR` is not `TIPREDVARstd`. Page 16 `asymDIFFUSIONstd` is `p / p = 1` after strictly positive `asymDIFFUSION` (`solve(sqrt(diag(asymDIFFUSION))) %&% asymDIFFUSION`; OpenMx `%&%` is `t(A) %*% B %*% A`; 2017-era source adds ridging; default ridge is 0; `dimnames` are `latentNames`). Unstandardised `asymDIFFUSION` is not `asymDIFFUSIONstd`. `TIPREDVARstd` is not `asymDIFFUSIONstd` even when both equal 1. `DIFFUSIONstd` `−2 a` is not `asymDIFFUSIONstd`. Page 16 `discreteCINTstd` is `A^{-1}[e^{A Δt} − I] κ / √p` after strictly positive `asymDIFFUSION`. Unstandardised `discreteCINT` is not `discreteCINTstd`. `κ / √p` is not `discreteCINTstd`. `(-κ / a) / √p` is not `discreteCINTstd`. `asymCINTstd` is `(-κ / a) / √p` after strictly positive `asymDIFFUSION`. Unstandardised `asymCINT` is not `asymCINTstd`. `κ / √p` is not `asymCINTstd`. `discreteCINTstd` is not `asymCINTstd`. `T0MEANSstd` is `μ_0 / √p_0` after strictly positive free `T0VAR`. Unstandardised `T0MEANS` is not `T0MEANSstd`. `T0VARstd` is not `T0MEANSstd`. `μ_0 / √asymDIFFUSION` is not `T0MEANSstd`. Page 16 `MANIFESTMEANSstd` is `τ / √θ` after strictly positive `MANIFESTVAR`. Unstandardised `MANIFESTMEANS` is not `MANIFESTMEANSstd`. `MANIFESTVARstd` is not `MANIFESTMEANSstd`. `τ / √(λ² Var(η) + θ)` is not `MANIFESTMEANSstd`. Page 16 `CINTstd` is `κ / √p` after strictly positive `asymDIFFUSION`. Unstandardised `CINT` is not `CINTstd`. `asymCINTstd` is not `CINTstd`. `discreteCINTstd` is not `CINTstd`. `κ / √(trait + p + added)` is not `CINTstd`. Evolving from that stationary start with `CINT` and `TIPREDEFFECT` stays at the stationary mean. Equation 1 is the latent SDE, not the measurement model. Form `(λ p) λ` then add `θ`, then add `ψ`. `MANIFESTVAR` is `Θ`, not `Var(y)`. `MANIFESTTRAITVAR` is `Ψ_τ`, not `Θ`. `TRAITVAR` is latent and scaled by `λ²`. `Var(η)` is not `Var(y)`. - Separate cluster means before within-unit lag. CWC plus an event-time lag is not DSEM. Subtracting the person-specific mean from a raw autoregressive series does not isolate the lagged within-person effect (Curran & Bauer, 2011, pp. 607–608); already-centered residuals with irregular event intervals use the exact scalar map. - Do not treat the CWC cluster-mean coefficient as the between-cluster effect. It is the contextual effect `between − within` (Enders & Tofighi, 2007, Table 2, pp. 124–127). diff --git a/docs/research/rubin-total-variance.md b/docs/research/rubin-total-variance.md index aa8ff6749..be70a5584 100644 --- a/docs/research/rubin-total-variance.md +++ b/docs/research/rubin-total-variance.md @@ -6,7 +6,7 @@ Adds Rubin combining for complete-data OLS loadings across posterior indicator d ## Claim boundary -`T_m = \bar U_m + (1+1/m)B_m` is the complete-data combining rule. This slice does **not** implement Mislevy plausible values. The 1991 *Psychometrika* paper was not opened in this cycle (Unpaywall/OpenAlex/Semantic Scholar/archive.org 2026-08-18T03:07Z: closed; ETS landing page is HTML; ERIC ED334221 is Singer & Willett, 1991). Do not cite that paper as having been read. +`T_m = \bar U_m + (1+1/m)B_m` is the complete-data combining rule. This slice does **not** implement Mislevy plausible values. The 1991 *Psychometrika* paper was not opened in this cycle (Unpaywall/OpenAlex 2026-09-01T10:22Z: still closed, `is_oa: false`, 0 OA locations; ETS landing page is HTML; ERIC ED334221 is Singer & Willett, 1991). Do not cite that paper as having been read. ## Authoritative sources diff --git a/docs/research/standards-and-literature.md b/docs/research/standards-and-literature.md index 8ce0ecc77..e2d555306 100644 --- a/docs/research/standards-and-literature.md +++ b/docs/research/standards-and-literature.md @@ -47,9 +47,9 @@ Browne, W. J., Goldstein, H., & Rasbash, J. (2001). Multiple membership multiple Jones, K. (1991). Specifying and estimating multi-level models for geographical research. *Transactions of the Institute of British Geographers, 16*(2), 148–160. https://doi.org/10.2307/622612 -TEPP applies these sources to construct definition, score interpretation, reliability, validity evidence, uncertainty, consequences, longitudinal invariance, ESEM cross-loadings, and DSEM. Topic outputs are treated as fallible indicators or components only after their construct role is evaluated. Reflective, formative, and network classes remain distinct (Bollen & Lennox, 1991). Complete-data OLS loadings across posterior indicator draws are combined with Rubin (1996) \(T_m\); the arithmetic-mean helper remains a point estimate. Mislevy (1991, *Psychometrika, 56*, 177–196, DOI 10.1007/bf02294457) remains unread (Unpaywall/OpenAlex/Semantic Scholar 2026-08-18T03:07Z: closed). The 1988 ETS RR-88-45 / DTIC ADA200179 technical report of the same title was opened 2026-08-17T12:04Z from archive.org; it is not the 1991 journal article and is not used as Mislevy plausible-value authority. Temporal precedence is not causal identification (Holland, 1986). Within/between OLS follows Enders and Tofighi (2007), Curran and Bauer (2011), and Hamaker et al. (2015). Enders and Tofighi (2007, Table 2, pp. 124–127; PDF opened 2026-08-17) show that the CWC cluster-mean coefficient is the contextual effect (`between − within`), not the between-cluster effect. Curran and Bauer (2011, pp. 607–608) reject person-mean subtraction on a raw autoregressive series as the lagged within-person residual; already-centered irregular residuals use the Voelkle et al. (2012, Eq. 7) / Driver et al. (2017, Eq. 3) scalar map. Discrete lags from unequal event intervals are remapped through that log-rate (Voelkle et al., 2012, ZORA accepted manuscript re-opened 2026-08-17T13:13Z) and are not pooled. Driver, Oud, and Voelkle (2017, Eq. 3 and p. 4) write \(A_{\Delta t}=\operatorname{expm}(A\Delta t)\) and restate the discrete intercept as a function of \(A\) and \(\Delta t\). A binary64 underflow of \(\exp(a\Delta t)\) to `+0` is refused because discrete auto-effects are strictly positive. The discrete effect of a constant predictor is Voelkle et al. (2012, Eq. 12; ZORA accepted manuscript re-opened 2026-08-17T14:20Z, Introducing Intercepts, manuscript p. 20), evaluated as \(a_{yx}(\operatorname{expm1}(z)/a_{xx})\) with \(z=a_{xx}\Delta t\) so a finite result is not lost when \(z\) overflows to \(-\infty\) or when \(a_{yx}\Delta t\) overflows, and in log space when `expm1(z)` overflows at a finite \(z\); a zero continuous effect is exactly zero; an overflowing \(a_{yx}/a_{xx}\) rewrite term fails closed; the first-order product is the underflow limit of that equation, not the general constant-predictor discrete effect. The discrete effect of a time-varying predictor with matched sampling and constancy intervals is Voelkle et al. (2012, Eq. 14; manuscript p. 21): \(b^{*}_{y.x}(\Delta t)=a_{yx}\Delta t\). That product is not Eq. 12. Unmatched intervals fail closed (Oud & Jansen, 2000, unread). The exact scalar discrete process noise is Driver, Oud, and Voelkle (2017, Eq. 3; JSS PDF re-opened 2026-08-18T14:04Z, p. 4): \(Q_{\Delta t}=0.5 q(\operatorname{expm1}(z)/a)\) with \(z=2(a\Delta t)\) for \(a\neq 0\) and \(q=GG^{\top}\ge 0\); do not form \(2a\) first; \(a=0\) recovers \(q\Delta t\); an overflowing rewrite scale \(0.5 q/a\) fails closed. This is not a Kalman filter. Driver, Oud, and Voelkle (2017, Eq. 3; JSS PDF re-opened 2026-08-18T14:04Z) write the same discrete intercept as \(A^{-1}[e^{A\Delta t}-I]\xi\). The lagged covariance is \(\mathrm{e}^{a\Delta t}p\) and the unconditional variance is \(\mathrm{e}^{2a\Delta t}p+Q_{\Delta t}\) (Driver et al., 2017, Eq. 3–4, pp. 4–5); a zero diffusion whose \(2(a\Delta t)\) overflows to \(+\infty\) fails closed. The stationary within-subject variance is the \(\Delta t\to\infty\) limit of Eq. 4: \(-q/(2a)\) for stable \(a<0\) (JSS p. 16 `asymDIFFUSION`; §4.3; PDF re-opened 2026-08-18T18:03Z). Finite-interval \(Q_{\Delta t}\) is not that limit. Trait-plus-state variance is \(\mathrm{trait}+\mathrm{state}\) and lagged covariance is \(\mathrm{trait}+\mathrm{e}^{a\Delta t}p\) (Driver et al., 2017, §4.3, p. 9; JSS PDF re-opened 2026-08-18T21:07Z). Trait variance is not process noise and not `asymDIFFUSION`. The first-occasion map `τ + λ μ_0` is not `E(y_t)`. The contemporaneous `TDPREDEFFECT` impulse is `m x` (Driver et al., 2017, Eq. 3 fourth summand; Table 2; §7.2; JSS PDF re-opened 2026-08-20T07:10Z). `TDPREDEFFECT` is not `CINT`. `M x` is not `A^{-1}[e^{A Δt} − I] B z` and is not Voelkle et al. (2012, Eq. 14). Metric/weak invariance does not license latent-mean comparison. Putnick and Bornstein (2016, PMC author manuscript PMC5145197 opened 2026-08-19T22:15Z) require scalar invariance before latent-mean comparison and state that residual invariance is not a prerequisite. Two-observation OLS residual variance is identically `0` and is not strict. Meredith (1993) remains unread (Unpaywall/OpenAlex 2026-08-25T11:32Z: `is_oa: false`; Springer `content/pdf` is a 3038-byte HTML stub; Cambridge Core DOI 10.1007/BF02294825 remains a closed product page). Vandenberg and Lance (2000) remains unread. Mislevy (1991, *Psychometrika, 56*, 177–196, DOI 10.1007/bf02294457) remains unread (Unpaywall/OpenAlex 2026-08-25T11:32Z: `is_oa: false`; Springer `content/pdf` is a 3038-byte HTML stub). ERIC ED334221 is Singer and Willett (1991), not the 1991 journal article. ERIC ED333032 is Mislevy, Sheehan, and Wingersky (1990), ETS RR-90-17-ONR, not the 1991 journal article. Oud and Jansen (2000) remains unread (Unpaywall/OpenAlex 2026-08-18T21:07Z: closed). +TEPP applies these sources to construct definition, score interpretation, reliability, validity evidence, uncertainty, consequences, longitudinal invariance, ESEM cross-loadings, and DSEM. Topic outputs are treated as fallible indicators or components only after their construct role is evaluated. Reflective, formative, and network classes remain distinct (Bollen & Lennox, 1991). Complete-data OLS loadings across posterior indicator draws are combined with Rubin (1996) \(T_m\); the arithmetic-mean helper remains a point estimate. Mislevy (1991, *Psychometrika, 56*, 177–196, DOI 10.1007/bf02294457) remains unread (Unpaywall/OpenAlex/Semantic Scholar 2026-09-01T10:22Z: still closed, `is_oa: false`, 0 OA locations). The 1988 ETS RR-88-45 / DTIC ADA200179 technical report of the same title was opened 2026-08-17T12:04Z from archive.org; it is not the 1991 journal article and is not used as Mislevy plausible-value authority. Temporal precedence is not causal identification (Holland, 1986). Within/between OLS follows Enders and Tofighi (2007), Curran and Bauer (2011), and Hamaker et al. (2015). Enders and Tofighi (2007, Table 2, pp. 124–127; PDF opened 2026-08-17) show that the CWC cluster-mean coefficient is the contextual effect (`between − within`), not the between-cluster effect. Curran and Bauer (2011, pp. 607–608) reject person-mean subtraction on a raw autoregressive series as the lagged within-person residual; already-centered irregular residuals use the Voelkle et al. (2012, Eq. 7) / Driver et al. (2017, Eq. 3) scalar map. Discrete lags from unequal event intervals are remapped through that log-rate (Voelkle et al., 2012, ZORA accepted manuscript re-opened 2026-08-17T13:13Z) and are not pooled. Driver, Oud, and Voelkle (2017, Eq. 3 and p. 4) write \(A_{\Delta t}=\operatorname{expm}(A\Delta t)\) and restate the discrete intercept as a function of \(A\) and \(\Delta t\). A binary64 underflow of \(\exp(a\Delta t)\) to `+0` is refused because discrete auto-effects are strictly positive. The discrete effect of a constant predictor is Voelkle et al. (2012, Eq. 12; ZORA accepted manuscript re-opened 2026-08-17T14:20Z, Introducing Intercepts, manuscript p. 20), evaluated as \(a_{yx}(\operatorname{expm1}(z)/a_{xx})\) with \(z=a_{xx}\Delta t\) so a finite result is not lost when \(z\) overflows to \(-\infty\) or when \(a_{yx}\Delta t\) overflows, and in log space when `expm1(z)` overflows at a finite \(z\); a zero continuous effect is exactly zero; an overflowing \(a_{yx}/a_{xx}\) rewrite term fails closed; the first-order product is the underflow limit of that equation, not the general constant-predictor discrete effect. The discrete effect of a time-varying predictor with matched sampling and constancy intervals is Voelkle et al. (2012, Eq. 14; manuscript p. 21): \(b^{*}_{y.x}(\Delta t)=a_{yx}\Delta t\). That product is not Eq. 12. Unmatched intervals fail closed (Oud & Jansen, 2000, unread). The exact scalar discrete process noise is Driver, Oud, and Voelkle (2017, Eq. 3; JSS PDF re-opened 2026-08-18T14:04Z, p. 4): \(Q_{\Delta t}=0.5 q(\operatorname{expm1}(z)/a)\) with \(z=2(a\Delta t)\) for \(a\neq 0\) and \(q=GG^{\top}\ge 0\); do not form \(2a\) first; \(a=0\) recovers \(q\Delta t\); an overflowing rewrite scale \(0.5 q/a\) fails closed. This is not a Kalman filter. Driver, Oud, and Voelkle (2017, Eq. 3; JSS PDF re-opened 2026-08-18T14:04Z) write the same discrete intercept as \(A^{-1}[e^{A\Delta t}-I]\xi\). The lagged covariance is \(\mathrm{e}^{a\Delta t}p\) and the unconditional variance is \(\mathrm{e}^{2a\Delta t}p+Q_{\Delta t}\) (Driver et al., 2017, Eq. 3–4, pp. 4–5); a zero diffusion whose \(2(a\Delta t)\) overflows to \(+\infty\) fails closed. The stationary within-subject variance is the \(\Delta t\to\infty\) limit of Eq. 4: \(-q/(2a)\) for stable \(a<0\) (JSS p. 16 `asymDIFFUSION`; §4.3; PDF re-opened 2026-08-18T18:03Z). Finite-interval \(Q_{\Delta t}\) is not that limit. Trait-plus-state variance is \(\mathrm{trait}+\mathrm{state}\) and lagged covariance is \(\mathrm{trait}+\mathrm{e}^{a\Delta t}p\) (Driver et al., 2017, §4.3, p. 9; JSS PDF re-opened 2026-08-18T21:07Z). Trait variance is not process noise and not `asymDIFFUSION`. The first-occasion map `τ + λ μ_0` is not `E(y_t)`. The contemporaneous `TDPREDEFFECT` impulse is `m x` (Driver et al., 2017, Eq. 3 fourth summand; Table 2; §7.2; JSS PDF re-opened 2026-08-20T07:10Z). `TDPREDEFFECT` is not `CINT`. `M x` is not `A^{-1}[e^{A Δt} − I] B z` and is not Voelkle et al. (2012, Eq. 14). Metric/weak invariance does not license latent-mean comparison. Putnick and Bornstein (2016, PMC author manuscript PMC5145197 opened 2026-08-19T22:15Z) require scalar invariance before latent-mean comparison and state that residual invariance is not a prerequisite. Two-observation OLS residual variance is identically `0` and is not strict. Meredith (1993) remains unread (Unpaywall/OpenAlex 2026-09-01T10:22Z: `is_oa: false`, 0 OA locations; Springer `content/pdf` historically an HTML stub; Cambridge Core DOI 10.1007/BF02294825 remains a closed product page). Vandenberg and Lance (2000) remains unread. Mislevy (1991, *Psychometrika, 56*, 177–196, DOI 10.1007/bf02294457) remains unread (Unpaywall/OpenAlex 2026-09-01T10:22Z: `is_oa: false`, 0 OA locations; Springer `content/pdf` historically an HTML stub). ERIC ED334221 is Singer and Willett (1991), not the 1991 journal article. ERIC ED333032 is Mislevy, Sheehan, and Wingersky (1990), ETS RR-90-17-ONR, not the 1991 journal article. Oud and Jansen (2000) remains unread (Unpaywall/OpenAlex 2026-08-18T21:07Z: closed). -For Meredith (1993), the Cambridge Core original-paper page and abstract were opened on 2026-08-21; Unpaywall, Springer `content/pdf`, OpenAlex, Semantic Scholar, and Cambridge Core PDF lookup were re-tried 2026-08-25T11:32Z and remain closed. The earlier `remains unread` note means that the full text was not available, not that the authoritative record was unverified. +For Meredith (1993), the Cambridge Core original-paper page and abstract were opened on 2026-08-21; Unpaywall, Springer `content/pdf`, OpenAlex, Semantic Scholar, archive.org, and Cambridge Core PDF lookup were re-tried 2026-09-01T10:22Z and remain closed. The earlier `remains unread` note means that the full text was not available, not that the authoritative record was unverified. ## Numerical precision, memory-aware computation, and causal identification diff --git a/docs/research/strong-invariance-latent-means.md b/docs/research/strong-invariance-latent-means.md index ac8402b82..ff021bf78 100644 --- a/docs/research/strong-invariance-latent-means.md +++ b/docs/research/strong-invariance-latent-means.md @@ -13,7 +13,7 @@ This slice does **not** import the unpublished `measurement_invariance` crate on - Strict (also equal residual variance) also licenses latent means. Residual invariance is **not** required for those means. - Two-observation series have no residual degrees of freedom. OLS residual variance is then identically `0` and is not an estimated residual. Those series cap at strong/scalar and still license means. - This is two-group OLS, not MGCFA, not partial invariance, and not alignment optimization. -- The weak/strong/strict labels remain conventional labels here. Meredith (1993) is the primary source for the hierarchy; its Cambridge Core original-paper page and abstract were opened, but its full-text PDF was not. Unpaywall, OpenAlex, Semantic Scholar, and Springer `content/pdf` were re-tried 2026-08-25T11:32Z and remain closed (`is_oa: false`, 0 locations; Springer returns a 3038-byte HTML stub). Putnick and Bornstein (2016) cite Meredith for residual invariance as part of *full factorial invariance*; that specific claim is not a reading of Meredith's full text. +- The weak/strong/strict labels remain conventional labels here. Meredith (1993) is the primary source for the hierarchy; its Cambridge Core original-paper page and abstract were opened, but its full-text PDF was not. Unpaywall, OpenAlex, Semantic Scholar, archive.org, and Springer `content/pdf` were re-tried 2026-09-01T10:22Z and remain closed (`is_oa: false`, 0 locations; Springer historically returns an HTML stub). Putnick and Bornstein (2016) cite Meredith for residual invariance as part of *full factorial invariance*; that specific claim is not a reading of Meredith's full text. ## Authoritative sources used for the mean gate From ac799a1012019c6565e7f936d410fdb36c8add67 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 20:00:30 +0900 Subject: [PATCH 014/235] docs(delivery): refresh live queue authority --- docs/product-technical-gap-baseline.md | 31 +++++++++++++++++--------- 1 file changed, 21 insertions(+), 10 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index da934e2c3..64708c868 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-01T10:19:29Z +**Snapshot:** 2026-09-01T10:49:02Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` **Workspace version:** `0.2.0` **Delivery authority:** issue [#175](https://github.com/ContextualWisdomLab/TEPP/issues/175), PR [#435](https://github.com/ContextualWisdomLab/TEPP/pull/435), and [`docs/delivery/pr-queue-authority-2026-09-01.md`](delivery/pr-queue-authority-2026-09-01.md) @@ -19,9 +19,9 @@ A planning document, mergeable branch, local test, predecessor-head result, queu | Signal | Current evidence | Delivery implication | | --- | ---: | --- | | Protected `main` | `1bc02f580cf48e1d39da239f0e818453437c31c3` | Capability claims remain bounded to this commit until protected main changes. | -| Open pull requests | **136** | The queue remains release-blocking. It shrank from the 149-head snapshot after scientifically unsafe #356 closed without merge, and is still far above the recovery baseline. | -| Draft pull requests | **91** | Draft state is not classification or ownership. | -| Non-draft pull requests | **45** | Ready metadata is not merge readiness without exact-head evidence. | +| Open pull requests | **139** | The queue remains release-blocking. It fell from the 149-head peak to 136, then rebounded to 139 after new one-operation Analysis Run slices #445–#447 were opened while recovery remained active. | +| Draft pull requests | **90** | Draft state is not classification or ownership. | +| Non-draft pull requests | **49** | Ready metadata is not merge readiness without exact-head evidence. | | Open issues | **14** | Includes #437 for repository-wide ADR identity normalization. | | GitHub releases | **0** | No open PR head or local branch is a released product contract. | | Effective ruleset | `18156473` | Current ruleset, exact-head workflows, resolved conversations, and qualifying review are the merge authority. | @@ -30,15 +30,18 @@ The repository-level classic branch-protection payload is not the sole policy so ## Current priority open pull-request evidence -This table is an exact-head **priority subset**, not a row-for-row copy of the 136-PR queue. The live total and this operator inventory are deliberately different concepts. +This table is an exact-head **priority subset**, not a row-for-row copy of the 139-PR queue. The live total and this operator inventory are deliberately different concepts. PR #435 itself is deliberately omitted from the exact-head table. A commit that rewrites this document necessarily advances #435's head, so embedding that same branch's “exact current head” inside the commit would be self-invalidating. The delivery-authority line links #435, while its live head is re-read from GitHub immediately before any readiness or merge decision. | PR | Exact current head | Draft | Base | Ownership / disposition | | ---: | --- | :---: | --- | --- | +| #447 | `325590cc1664f89bf6de5f43a1b8092560dac6bc` | false | #429/project-history stack | Analysis Run project-history cancel HTTP; `fold_into_landing_vehicle` candidate | +| #446 | `86a2202852595f372013d1f8ee4c604ceadbd616` | false | #445/export stack | Analysis Run export cancel CLI; `fold_into_landing_vehicle` candidate | +| #445 | `e38a1c1d0bd91a97c1b6427ad2617d1837b36360` | false | #443/export stack | Analysis Run export cancel HTTP; `fold_into_landing_vehicle` candidate | | #444 | `95ab519fdb39c66a574d1452e969b0b80b9e4ba9` | false | #443/export stack | Analysis Run export collection CLI; `fold_into_landing_vehicle` candidate | | #443 | `504793d88c6b754f5181f48dc7abde073ff9146a` | false | #411/export stack | Analysis Run export collection adapter; `fold_into_landing_vehicle` candidate | -| #441 | `6f483224b3a03e8237c6f4f098a8b0e85e0a91f5` | false | main | Longitudinal Modeling lagged-correlation repair; original invalid ratio removed; exact-head checks pending | +| #441 | `6f483224b3a03e8237c6f4f098a8b0e85e0a91f5` | false | main | Longitudinal Modeling lagged-correlation repair; invalid ratio retired; review threads resolved; exact-head required workflows still queued | | #436 | `460503b6e787362b702509faa955c4730f6d8680` | false | #433 head | Analysis Run/contextual-orchestrator CLI stack; `stacked_dependency` | | #434 | `c0fbaabd8c95e69407c3b9e50f8d1846bd949598` | false | main | membership-target refusal profile; `fold_into_landing_vehicle` candidate | | #432 | `3e09ff29cc89ef97a859f3ae50e1297846dd2eeb` | false | main | Topic Measurement profile binding; preserve unique contract tests | @@ -108,7 +111,7 @@ Multiple-membership weights are explicit, auditable and time-valid. They are obs | ID | Gap | Maturity | Authority | Closure evidence | | --- | --- | --- | --- | --- | -| GAP-001 | PR authority fragmented across 136 heads | `release-blocking` | #175 / #435 | exact-head classification, bounded-context landing vehicles, unique evidence preserved, safe queue reduction | +| GAP-001 | PR authority fragmented across 139 heads | `release-blocking` | #175 / #435 | exact-head classification, bounded-context landing vehicles, unique evidence preserved, safe queue reduction | | GAP-002 | multilingual span-grounded semantic/concept admission incomplete | `partial` | Evidence & Semantic Measurement | immutable offsets/layout, language profiles, concept dictionary, unknown review, invariance/calibration, hostile-input tests | | GAP-003 | shared-latent temporal topic estimator incomplete | `partial` | #167 | Rust CPU `f64` likelihood/estimands/uncertainty, time/relation/membership effects, multi-seed recovery, real candidate-K fits | | GAP-004 | durable end-to-end Analysis Run incomplete | `partial` | #166 | idempotent lifecycle, persistence/recovery, estimator-bound artifacts, complete validation evidence, separate claim promotion, Compose E2E | @@ -153,12 +156,20 @@ One-rule crates, one-clock crates and one-operation API/CLI PRs are not independ ### Current classifications -**#441 — Longitudinal Modeling lagged-correlation repair.** The invalid predecessor API that divided lagged covariance by only the earlier marginal variance was removed from the final diff after review showed it could produce impossible autocorrelations under nonstationary marginals. Exact repair head `6f483224b3a03e8237c6f4f098a8b0e85e0a91f5` places event-time association standardization in `longitudinal_core`, requires both marginal variances, enforces the covariance bound without a rounded product, and records the capability on `ARCHITECTURE.md` and `CHANGELOG.md`. The predecessor commit remains RED/scientific-failure lineage. The one-shot self-deleting workflow is gone. The branch is not merge-ready until exact-head hosted checks and independent non-author APPROVE complete. Queued or predecessor-head checks are not passing evidence. +**#441 — Longitudinal Modeling lagged-correlation repair.** The invalid predecessor API that divided lagged covariance by only the earlier marginal variance was removed from the final diff after review showed it could produce impossible autocorrelations under nonstationary marginals. Exact repair head `6f483224b3a03e8237c6f4f098a8b0e85e0a91f5` places event-time association standardization in `longitudinal_core`, requires both marginal variances, enforces the covariance bound without a rounded product, and records the capability on `ARCHITECTURE.md` and `CHANGELOG.md`. All currently visible review threads are resolved. The predecessor commit remains RED/scientific-failure lineage. The one-shot self-deleting workflow is gone. The branch is not merge-ready while exact-head hosted workflows remain queued and no qualifying independent non-author APPROVE exists. Queued or predecessor-head checks are not passing evidence. -**#444 — Analysis Run export CLI fold candidate.** The export-collection CLI is stacked on #443 and is useful operator behavior, but one binary is not an independent bounded context. Preserve its fail-closed origin/credential/consumer tests while folding with #443 into a coherent Analysis Run/export landing vehicle. Opening this slice while #435 remains open is evidence that the WIP circuit breaker is not yet enforced by the delivery system. +**#447 — Analysis Run project-history cancel HTTP fold candidate.** This is another one-operation adapter slice stacked on #429. Preserve its empty-body, path/credential refusal, cancellation-removal and metric-free receipt tests, then fold it into the coherent Analysis Run/project-history vehicle rather than treating ADR 0079 as a new bounded-context authority. + +**#446 — Analysis Run export cancel CLI fold candidate.** This one-binary slice is stacked on #445. Preserve its CLI parsing, fail-closed origin/credential/consumer and metric-free receipt evidence, then fold it with the export landing vehicle. + +**#445 — Analysis Run export cancel HTTP fold candidate.** This one-route slice is stacked on #443. Preserve its cancellation-removal, auth/refusal and metric-free receipt tests, then fold it with #443/#444 rather than minting a separate product boundary. + +**#444 — Analysis Run export CLI fold candidate.** The export-collection CLI is stacked on #443 and is useful operator behavior, but one binary is not an independent bounded context. Preserve its fail-closed origin/credential/consumer tests while folding with #443 into a coherent Analysis Run/export landing vehicle. **#443 — Analysis Run export adapter fold candidate.** The export-collection GET is useful operator behavior, but one route is not an independent bounded context. Preserve its pagination, authorization and refusal tests while folding the operation into a coherent Analysis Run/export landing vehicle. +The rebound from 136 to 139 open PRs while #435 remains active is direct evidence that the WIP circuit breaker is not yet enforced by the delivery system. New one-operation slices should be folded into the existing Analysis Run landing vehicles rather than extending the branch-local ADR sequence. + **#356 — closed without merge.** Useful cutoff/run-binding/metric evidence is preserved in branch and review history for fold into #166. The generic `RMSE <= k * SE(RMSE)` rule, caller-declared recovery provenance, and Validation/Claim-Promotion conflation must not be revived. Scientific Claim Promotion remains a separate aggregate governed by ADR 0014. **#352/#355 — Longitudinal Modeling fold candidates.** They share a Driver/ctsem scalar rewrite but retain different public names, refusal guards, tests and research documentation. Preserve the strongest evidence before closing either. @@ -226,4 +237,4 @@ Before a landing vehicle merges: - Jeon, M., Jin, I. H., Schweinberger, M., & Baugh, S. (2021). Mapping unobserved item–respondent interactions: A latent space item response model with interaction map. *Psychometrika, 86*(2), 378–403. https://doi.org/10.1007/s11336-021-09762-5 - Kang, I., & Jeon, M. (2025). Multidimensional latent space item response models: A note on the relativity of conditional dependence. *Psychometrika, 90*(2), 799–826. https://doi.org/10.1017/psy.2025.5 -The cited dependence families do not establish every novel base-family × generalized-mixed × dependence × temporal coupling. Novel compositions stay `research_candidate` until the exact combined model, identification, estimator and recovery are demonstrated. +The cited dependence families do not establish every novel base-family × generalized-mixed × dependence × temporal coupling. Novel compositions stay `research_candidate` until the exact combined model, identification, estimator and recovery are demonstrated. \ No newline at end of file From c0941ec4daaa36495e0c7a76ba1d243777509976 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 20:04:10 +0900 Subject: [PATCH 015/235] test(docs): scope priority inventory duplicate detection --- .../test_product_technical_gap_baseline.py | 34 +++++++++++++++---- 1 file changed, 28 insertions(+), 6 deletions(-) diff --git a/tests/quality/test_product_technical_gap_baseline.py b/tests/quality/test_product_technical_gap_baseline.py index 2835470f6..d27d33403 100644 --- a/tests/quality/test_product_technical_gap_baseline.py +++ b/tests/quality/test_product_technical_gap_baseline.py @@ -128,18 +128,40 @@ def test_queue_total_smaller_than_priority_inventory_fails(self) -> None: with self.assertRaisesRegex(AssertionError, "smaller than priority inventory"): docs.validate_product_technical_gap_baseline(root) - def test_duplicate_priority_inventory_row_fails(self) -> None: - """A priority PR may appear at most once in the exact-head inventory.""" - - duplicate_row = f"| #164 | `{VALID_HEAD}` | false | main | docs duplicate |\n" + def test_same_pr_in_unrelated_exact_head_table_is_allowed(self) -> None: + """Only duplicates inside the priority inventory are classification errors.""" + + supporting_row = ( + "\n## Historical evidence\n\n" + "| PR | Exact current head | Draft | Base | Note |\n" + "|---:|---|:---:|---|---|\n" + f"| #164 | `{VALID_HEAD}` | false | main | historical |\n" + ) with tempfile.TemporaryDirectory() as temporary: root = Path(temporary) path = root / BASELINE_PATH path.parent.mkdir(parents=True) path.write_text( - valid_baseline(count=94, extra=f"\n{duplicate_row}"), + valid_baseline(count=94, extra=supporting_row), encoding="utf-8", ) + docs.validate_product_technical_gap_baseline(root) + + def test_duplicate_priority_inventory_row_fails(self) -> None: + """A priority PR may appear at most once inside the priority inventory.""" + + duplicate_row = f"| #164 | `{VALID_HEAD}` | false | main | docs duplicate |\n" + marker = "\n## Operator-gap register\n" + fixture = valid_baseline(count=94).replace( + marker, + f"{duplicate_row}{marker}", + 1, + ) + with tempfile.TemporaryDirectory() as temporary: + root = Path(temporary) + path = root / BASELINE_PATH + path.parent.mkdir(parents=True) + path.write_text(fixture, encoding="utf-8") with self.assertRaisesRegex(AssertionError, "duplicate PR rows"): docs.validate_product_technical_gap_baseline(root) @@ -259,4 +281,4 @@ def test_adversative_severed_negation_still_fails(self) -> None: if __name__ == "__main__": # pragma: no cover - unittest.main() + unittest.main() \ No newline at end of file From 80cd81340eeb5298670aa5f24367e334bc891463 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 20:05:18 +0900 Subject: [PATCH 016/235] fix(docs): scope priority inventory validation --- scripts/validate_documentation.py | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-) diff --git a/scripts/validate_documentation.py b/scripts/validate_documentation.py index 20142b2be..e25d99083 100644 --- a/scripts/validate_documentation.py +++ b/scripts/validate_documentation.py @@ -77,6 +77,8 @@ r"(?Ptrue|false)\s*\|", re.MULTILINE, ) +PRIORITY_INVENTORY_HEADING = "## Current priority open pull-request evidence" +LEVEL_TWO_HEADING = re.compile(r"^##\s+", re.MULTILINE) OPEN_PR_COUNT = re.compile( r"\|\s*Open pull requests\s*\|\s*\*\*(?P\d+)\*\*" ) @@ -379,6 +381,18 @@ def _promotion_is_denied(text: str, claim: re.Match[str]) -> bool: return False +def _priority_inventory_section(text: str) -> str: + """Return only the canonical priority-inventory section from the gap register.""" + + heading_start = text.find(PRIORITY_INVENTORY_HEADING) + if heading_start < 0: + return "" + section_start = heading_start + len(PRIORITY_INVENTORY_HEADING) + next_heading = LEVEL_TWO_HEADING.search(text, section_start) + section_end = next_heading.start() if next_heading is not None else len(text) + return text[section_start:section_end] + + def validate_product_technical_gap_baseline(root: Path = ROOT) -> None: """Require a dated live gap register with an honest priority PR inventory.""" @@ -402,7 +416,8 @@ def validate_product_technical_gap_baseline(root: Path = ROOT) -> None: for match in QUEUED_CHECKS_AS_SHIPPED.finditer(text) ): failures.append("gap baseline treats queued Checks as implemented-main") - inventory = list(INVENTORY_ROW.finditer(text)) + priority_inventory = _priority_inventory_section(text) + inventory = list(INVENTORY_ROW.finditer(priority_inventory)) inventory_numbers = [match.group("number") for match in inventory] if not inventory: failures.append("gap baseline open-PR inventory has no exact-head rows") @@ -533,4 +548,4 @@ def main() -> None: if __name__ == "__main__": - main() + main() \ No newline at end of file From 681bfed64f51bf7575b55fc3df395215a2b84055 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 20:09:49 +0900 Subject: [PATCH 017/235] docs(adr): clarify psychometric owner boundary --- .../0011-standalone-modular-msa-boundary.md | 53 ++++++++++++------- 1 file changed, 33 insertions(+), 20 deletions(-) diff --git a/docs/adr/0011-standalone-modular-msa-boundary.md b/docs/adr/0011-standalone-modular-msa-boundary.md index 89cdbee80..673ffc342 100644 --- a/docs/adr/0011-standalone-modular-msa-boundary.md +++ b/docs/adr/0011-standalone-modular-msa-boundary.md @@ -1,60 +1,73 @@ # ADR 0011 — Standalone operation and modular CWL MSA boundary -**Decision status:** Accepted -**Implementation maturity:** partial — Rust crates are independently usable; naruon HTTP interchange and loopback live listener (`POST /v1/analysis-runs` and `/v1/exports`, fail-closed table-access, NIM/proxy headers, RFC 3339 cutoff, stream deadline) is implemented-main; `service_tls` production rustls bind gates and orchestrator live-port refusal of loopback plaintext are on this active PR; the loopback consumer listener composition and terminal-result contract are composed on the active product branch; production TLS/`$PORT`, remaining live HTTP listeners, and remaining persistence integrations remain accepted-target The standalone loopback interpretation listener (`orchestrator_live`, `POST /v1/interpretation-runs`) is on this PR. +**Decision status:** Accepted +**Implementation maturity:** partial **Date:** 2026-08-10 -**Date:** 2026-08-10 -**Implementation maturity:** partial — Rust crates are independently usable; naruon HTTP interchange and loopback live listener (`POST /v1/analysis-runs` and `/v1/exports`, fail-closed table-access, NIM/proxy headers, RFC 3339 cutoff, stream deadline) are on the active PR (not implemented-main); production TLS/`$PORT` and remaining persistence integrations remain accepted-target -**Date:** 2026-08-10 -**Supersedes:** The broad cross-service ownership wording in ADR 0001. ADR 0001 remains authoritative for Rust-first numerical architecture. +**Supersedes:** The broad cross-service ownership wording in ADR 0001. ADR 0001 remains authoritative for Rust-first numerical/backend requirements. ## Context -TEPP must be independently deployable while also composing with ContextualWisdomLab services such as `naruon`, `contextual-orchestrator`, and organization control-plane workflows. Hidden database coupling or implicit cross-repository authority would make the product difficult to deploy, audit, version, acquire, or reuse. +TEPP must be independently deployable while also composing with ContextualWisdomLab services such as `naruon`, `contextual-orchestrator`, `fast-mlsirm`, and organization control-plane workflows. Hidden database coupling, copied scientific kernels, or implicit cross-repository authority would make the product difficult to deploy, audit, version, acquire, or reuse. + +The approved PRD defines TEPP's product and measurement target as multilingual temporal relational psychometrics. It does not require TEPP to duplicate reusable static psychometric kernels that have a separate canonical owner. The delivery recovery exposed both duplicated/static psychometric fragments in TEPP and an upstream `fast-mlsirm` model-specification/dependence contract under development. The ownership boundary therefore needs to be explicit without changing the approved measurement target. ## Decision -TEPP owns its evidence-domain contracts, temporal/event/membership state, psychometric/statistical model authority, model/artifact registry, run provenance, and TEPP-owned persistence. Other services integrate only through stable versioned APIs or immutable artifacts. Direct cross-service application-table reads/writes are prohibited. +TEPP owns its evidence-domain contracts, six-clock temporal semantics, event ontology and temporal graph, time-varying multilevel/cross-classified/multiple-membership composition, longitudinal invariance/drift, temporal state evolution, temporal recovery policy, TEPP model/run provenance, and TEPP-owned persistence. + +`fast-mlsirm` owns reusable static/generalized-mixed/dependence-aware psychometric model specification and reusable numerical kernels, including reusable LSIRM, MLSIRM, and DLSJM computation. TEPP consumes only released/versioned `fast-mlsirm` contracts through an anti-corruption layer and composes TEPP-owned temporal/event semantics around the full upstream candidate identity. An open upstream PR or branch is not a production dependency. + +Reusable computation discovered in TEPP that belongs to the `fast-mlsirm` domain is migrated through the canonical-owner path: establish a versioned public contract, prove numerical/recovery parity, switch TEPP to the adapter, then remove the duplicate production source. TEPP does not keep a second canonical implementation merely to avoid cross-repository work. -Standalone deployments may run CPU-only and may select local/private providers. Modular deployments preserve the same scientific and authorization contracts. +Standalone deployments may run CPU-only and may select local/private execution backends. Modular deployments preserve the same scientific, temporal, and authorization contracts. Authority boundaries: +- `fast-mlsirm` owns reusable static/generalized-mixed/dependence model specification and reusable psychometric kernels; it does not own TEPP event ontology, six-clock semantics, knowledge-cutoff policy, temporal graph, or temporal state-composition policy. - `naruon` may submit authorized evidence/analysis work and consume versioned TEPP results; it does not replace TEPP inference with lexical heuristics or directly query TEPP tables. -- `contextual-orchestrator` may execute approved model-routing/orchestration requests but does not own TEPP's source evidence, statistical truth, scientific gates, model registry, or release authority. +- `contextual-orchestrator` owns model-provider execution, routing, fallback, verifier/adjudicator execution, credentials, and model-call provenance; it does not own TEPP source evidence, numerical scientific truth, claim promotion, or release authority. - organization `.github` workflows own CI/review/security/release-control functions only; they are not runtime scientific authority. -- external PostgreSQL/object-storage/model providers remain separately authenticated trust domains. +- external PostgreSQL, object-storage, accelerator, and model-provider systems remain separately authenticated trust domains. ## Alternatives considered 1. **Shared organization database/schema** — rejected because it couples lifecycle, authorization, migrations, recovery, and acquisition boundaries. -2. **Repository-specific bespoke adapters without a common contract** — rejected because semantics drift and become difficult to validate. -3. **Standalone core plus versioned ports/artifacts** — accepted. +2. **Copy reusable psychometric kernels into TEPP** — rejected because duplicated numerical authority drifts and makes parity, recovery, and maintenance ambiguous. +3. **Repository-specific bespoke adapters without a common contract** — rejected because semantics drift and become difficult to validate. +4. **Standalone TEPP temporal/event core plus released versioned owner ports/artifacts** — accepted. ## Consequences -- Public contracts carry version, identity, provenance, error, bounded-resource, and compatibility semantics. +- Public contracts carry version, identity, provenance, error, bounded-resource, compatibility, and owner semantics. - Each service owns its credentials, migrations, retention, and application persistence. - Cross-service workflows use opaque identifiers and explicit authorization rather than implicit shared state. +- TEPP temporal dependence compilation is generic over the complete released upstream candidate identity rather than hard-coded LSIRM/MLSIRM/DLSJM family wrappers. +- Auto-expansion does not imply activation: novel combined static/dependence/temporal formulations remain `research_candidate` until equations, identification, estimator, citations, and recovery evidence are complete. - Breaking contract changes require compatibility/migration notes and an ADR where product/scientific meaning changes. -- Integration tests exercise both standalone and representative modular paths. +- Integration tests exercise standalone and representative modular paths, including contract-version/digest refusal. + +This decision clarifies service authority without changing PRD v0.4's approved product or measurement target, so it does not itself require a PRD version increment under AGENTS contract 14. ## Failure and recovery -If an integration service is unavailable, TEPP either uses an approved local/provider fallback or returns a bounded degraded/deferred state. It never fabricates external state or bypasses TEPP validation. Recovery revalidates artifact identity, authorization, temporal cutoff, and version compatibility before resuming. +If an integration service is unavailable, TEPP either uses an approved local/backend fallback that preserves the same scientific contract or returns a bounded degraded/deferred state. It never fabricates external state, copies an unreleased owner implementation, or bypasses TEPP validation. Recovery revalidates artifact identity, authorization, temporal cutoff, contract version/digest, and owner provenance before resuming. ## Security/privacy -Least-privilege service identities and purpose-bound access apply at every interface. A service receives only the evidence/artifact fields it is authorized to process. No service credential is reused as a model/reviewer/release credential simply because the services share an organization. +Least-privilege service identities and purpose-bound access apply at every interface. A service receives only the evidence/artifact fields it is authorized to process. No service credential is reused as a model/reviewer/release credential simply because the services share an organization. Cross-service SQL is prohibited. ## Compatibility and migration Every public API/artifact contract is versioned. A breaking consumer/provider change requires migration/rollback guidance and dual-version or negotiated compatibility where necessary. Persistence migrations remain TEPP-owned under ADR 0013; consumers never migrate TEPP tables directly. +Static-kernel migration follows: TEPP duplicate -> parity/recovery evidence -> released `fast-mlsirm` contract -> TEPP ACL/adaptor -> duplicate removal. Rollback restores the last released compatible adapter contract; it does not restore a divergent duplicate as canonical authority. + ## Verification -Required tests cover contract version negotiation, unauthorized cross-service access, idempotency, stale artifact/model identities, missing dependencies, standalone CPU operation, contextual-orchestrator optional integration, naruon consumer contracts, and absence of direct cross-service database coupling. +Required tests cover contract version/digest negotiation, unauthorized cross-service access, idempotency, stale artifact/model identities, missing dependencies, standalone CPU operation, contextual-orchestrator integration boundaries, naruon consumer contracts, absence of direct cross-service database coupling, and parity/recovery before any duplicated static kernel is removed. + +Architecture fitness tests must also reject dependency inversion in which `fast-mlsirm` imports TEPP temporal ontology or TEPP deployable behavior binds directly to an unreleased upstream PR head. -## Rollback and supersession +## Rollback -Rollback removes/disables an integration adapter without breaking standalone TEPP or rewriting scientific artifacts. Supersede only through an ADR that establishes a clearer ownership model without reducing standalone deployability, scientific authority separation, migration safety, or auditability. +Rollback removes or disables an integration adapter without breaking standalone TEPP or rewriting scientific artifacts. A failed owner migration returns to the last released compatible contract while retaining parity/recovery evidence and migration provenance. Supersede this ADR only through a repository-wide unique ADR that establishes a clearer ownership model without reducing standalone deployability, scientific authority separation, migration safety, or auditability. \ No newline at end of file From 7bc05c4caf8e60c3e126268f56f2fd0c4679322b Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 20:10:14 +0900 Subject: [PATCH 018/235] docs(research): canonicalize dependence-model evidence --- docs/research/temporal-dependence-models.md | 51 +++++++++++++++++++++ 1 file changed, 51 insertions(+) create mode 100644 docs/research/temporal-dependence-models.md diff --git a/docs/research/temporal-dependence-models.md b/docs/research/temporal-dependence-models.md new file mode 100644 index 000000000..8d9f38758 --- /dev/null +++ b/docs/research/temporal-dependence-models.md @@ -0,0 +1,51 @@ +# Temporal dependence model research authority + +This document is the canonical primary-research register for the LSIRM, MLSIRM, and DLSJM dependence families referenced by TEPP's temporal-composition architecture. It establishes what the cited studies support and, equally importantly, what they do not establish. + +## Scope + +TEPP does not treat a published static dependence family as evidence for every possible response-family × generalized-mixed × dependence × temporal-state combination. The named studies support their stated model families. A novel temporal coupling remains `research_candidate` until the combined generative/state equation, identification and longitudinal alignment, Rust estimator, data-support conditions, and known-truth recovery are explicit and verified. + +The reusable static/generalized-mixed/dependence specification and numerical kernel owner is `ContextualWisdomLab/fast-mlsirm`. TEPP owns temporal/event composition, including event-or-valid time, assertion time, document time, system time, available time, knowledge cutoff, irregular intervals, time-varying membership/covariates, longitudinal alignment, and temporal recovery. + +## LSIRM + +Jeon et al. (2021) introduce a latent-space item response model in which residual person–item interactions are represented through person and item positions and their latent-space relationship. For TEPP this supports the existence and interpretation of a residual person–item interaction geometry. It does not establish that known testlets, raters, item families, hierarchy, cross-classification, multiple membership, or omitted covariates should be absorbed by that geometry. + +A temporal LSIRM extension is therefore not automatically `supported`. Longitudinal use additionally requires an explicit state model for the interaction geometry, identification across occasions, translation/rotation/reflection alignment, uncertainty propagation, and known-truth recovery. + +## MLSIRM + +Kang and Jeon (2025) develop a multidimensional latent-space item-response formulation. In TEPP terminology, MLSIRM refers to that multidimensional-main-effect latent-space extension; the acronym is not redefined to mean “multilevel LSIRM.” Multilevel, cross-classified, and multiple-membership structure is represented separately in the generalized-mixed specification. + +Temporal MLSIRM candidates must preserve the exact base response formulation, multidimensional loading/trait structure, person/item interaction geometry, and the temporal identification required to compare states over time. Exploratory loading or geometry hypotheses do not become production longitudinal scoring structure without confirmatory/invariance and recovery evidence. + +## DLSJM + +Jin and Jeon (2019) provide the canonical baseline for the doubly latent-space joint model of local item dependence and local person dependence. DLSJM keeps the item-dependence and person-dependence spaces distinct; it is not an alias for LSIRM person–item interaction geometry. + +TEPP temporal DLSJM research candidates must therefore keep separate item-space and person-space states, distances, clusters, and uncertainty. Comparison across occasions requires explicit translation/rotation/reflection alignment for each space and cluster-label alignment where clusters are interpreted longitudinally. Raw maps from separate occasions are not longitudinal evidence. + +## Promotion and recovery rule + +For any LSIRM/MLSIRM/DLSJM temporal candidate, `supported` requires all of the following: + +- exact base response and generalized-mixed formulation; +- exact dependence formulation and parameter blocks; +- explicit temporal generative/state equation and clock-role semantics; +- identification and longitudinal map-alignment rules; +- implemented estimator owned by the canonical repository; +- leakage-safe event-time/available-time recovery design; +- model-appropriate RMSE, bias, interval coverage, convergence and uncertainty evidence; +- recovery under irregular gaps, delayed/retrospective records, missing occasions, changing memberships, and applicable language/source drift; +- primary-source traceability for the established components and explicit extension labeling for novel couplings. + +Auto-expansion only materializes a candidate contract. It does not satisfy these promotion conditions. + +## APA 7 references + +Jeon, M., Jin, I. H., Schweinberger, M., & Baugh, S. (2021). Mapping unobserved item–respondent interactions: A latent space item response model with interaction map. *Psychometrika, 86*(2), 378–403. https://doi.org/10.1007/s11336-021-09762-5 + +Jin, I. H., & Jeon, M. (2019). A doubly latent space joint model for local item and person dependence in the analysis of item response data. *Psychometrika, 84*(1), 236–260. https://doi.org/10.1007/s11336-018-9630-0 + +Kang, I., & Jeon, M. (2025). Multidimensional latent space item response models: A note on the relativity of conditional dependence. *Psychometrika, 90*(2), 799–826. https://doi.org/10.1017/psy.2025.5 From feadc1ba09dc3132af3cc7ab3981908303ca5a37 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 20:10:49 +0900 Subject: [PATCH 019/235] docs(architecture): align temporal dependence authority --- .../temporal-dependence-composition.md | 36 ++++++++++--------- 1 file changed, 19 insertions(+), 17 deletions(-) diff --git a/docs/architecture/temporal-dependence-composition.md b/docs/architecture/temporal-dependence-composition.md index 4990417e7..979bac646 100644 --- a/docs/architecture/temporal-dependence-composition.md +++ b/docs/architecture/temporal-dependence-composition.md @@ -1,16 +1,18 @@ # Temporal dependence composition boundary -**Status:** Accepted target; the upstream Published Language is not yet implemented on protected `main`. +**Status:** Accepted target; the upstream Published Language is not yet a released production dependency. +**Architecture authority:** ADR 0011. +**Research authority:** [`docs/research/temporal-dependence-models.md`](../research/temporal-dependence-models.md). This document defines the anti-corruption boundary between reusable static psychometric model specification in `ContextualWisdomLab/fast-mlsirm` and TEPP-owned temporal/event composition. It does not add a numerical estimator and does not make an upstream research candidate a supported TEPP model. ## Ownership -`fast-mlsirm` owns reusable response-family, dimensional, generalized-mixed, and dependence-aware psychometric specification and numerical kernels. Its Published Language is a versioned immutable candidate manifest whose structural identity covers the exact base response formulation, parameter blocks, dimensional structure, generalized-mixed structure, and dependence structure. +`fast-mlsirm` owns reusable response-family, dimensional, generalized-mixed, and dependence-aware psychometric specification and numerical kernels. Its Published Language must be a released, versioned, immutable candidate manifest whose structural identity covers the exact base response formulation, parameter blocks, dimensional structure, generalized-mixed structure, and dependence structure. TEPP owns only the temporal/event composition placed around that published candidate: -- event time, valid time, assertion time, document time, system time, available time, and knowledge cutoff; +- event or valid time, assertion time, document time, system time, available time, and knowledge cutoff; - leakage-safe historical eligibility; - measurement occasion as a method/rater facet distinct from substantive event time; - irregular observation intervals; @@ -21,11 +23,13 @@ TEPP owns only the temporal/event composition placed around that published candi - event ontology and temporal graph constraints; - temporal known-truth recovery and rolling-origin validation. +The first clock role is **event or valid time**, matching the approved six-clock contract. A state may be represented by an event instant or a validity interval, but TEPP does not mint a seventh independent clock by storing `event_time` and `valid_time` as unrelated analysis-time authorities. + `contextual-orchestrator` owns every LLM provider call, routing decision, verifier/adjudicator workflow, credential, and model-call provenance. TEPP never calls a model provider directly. ## Published-language intake -The TEPP ACL consumes a versioned upstream candidate contract rather than branching on model-family names. At minimum the contract must carry: +The TEPP ACL consumes a released/versioned upstream candidate contract rather than branching on model-family names. At minimum the contract must carry: ```text candidate_id @@ -53,7 +57,7 @@ primary_citation_references The ACL rejects missing structural identity, unknown contract versions, digest mismatch, and a request that silently substitutes a local-independent candidate for a dependence-aware request. -TEPP does not duplicate the upstream `ResponseKernel`, `GeneralizedMixedStructure`, LSIRM, MLSIRM, or DLSJM implementation. When reusable static arithmetic currently exists locally in TEPP, its migration path is parity and recovery against the fast-mlsirm owner, followed by replacement with a versioned adapter and removal of the duplicate production source. +TEPP does not duplicate the upstream `ResponseKernel`, `GeneralizedMixedStructure`, LSIRM, MLSIRM, or DLSJM implementation. When reusable static arithmetic currently exists locally in TEPP, its migration path is parity and recovery against the fast-mlsirm owner, followed by replacement with a released versioned adapter and removal of the duplicate production source. ## Generic temporal compiler @@ -70,7 +74,7 @@ upstream_contract_version upstream_contract_digest temporal_formulation_id clock_role_contract -event_time_semantics +event_or_valid_time_semantics occasion_facet_semantics state_equation_id temporal_identification_rules @@ -109,6 +113,8 @@ MLSIRM is the multidimensional-main-effect latent-space extension described by K A temporal LSIRM/MLSIRM candidate must define how interaction geometry evolves and how successive maps are identified. Raw coordinates from two occasions cannot be compared before the declared translation/rotation/reflection alignment. If scale or orientation is not identified across time, the candidate remains `research_candidate` regardless of apparently smooth trajectories. +The canonical primary-research scope and extension limits are maintained in [`docs/research/temporal-dependence-models.md`](../research/temporal-dependence-models.md). + ## DLSJM temporal composition DLSJM follows Jin and Jeon (2019) as the baseline formulation for joint local item dependence and local person dependence. It is not an LSIRM alias. @@ -129,7 +135,7 @@ Generalized-mixed structure composes orthogonally with dependence and time when One observation may belong simultaneously to multiple organizations, projects, teams, sources, languages, item families, judges, raters, templates, or event episodes. Cross-classification is not multiple membership; both remain explicit in the candidate identity. -Multiple-membership weights are auditable and time-valid. They are either observed/normalized under the declared design or estimated by an explicit model. TEPP does not invent equal weights as a fallback. Membership changes are state input with valid/event/available-time provenance; future membership cannot enter a historical cutoff. +Multiple-membership weights are auditable and time-valid. They are either observed/normalized under the declared design or estimated by an explicit model. TEPP does not invent equal weights as a fallback. Membership changes are state input with event-or-valid/available-time provenance; future membership cannot enter a historical cutoff. ## Explanatory and exploratory candidates @@ -163,7 +169,7 @@ Every expanded temporal dependence candidate receives a generated recovery speci - temporal transition/dynamic parameters; - posterior/interval uncertainty and coverage. -Known-truth simulation separates event time from available time. The suite includes irregular gaps, delayed reports, retrospective documents, missing occasions, changing memberships, and language/source drift. Evaluation uses leakage-safe rolling origins. Monte Carlo uncertainty is reported for simulation summaries; arbitrary pass percentages or rule-of-thumb thresholds are not scientific promotion criteria. +Known-truth simulation separates event-or-valid time from available time. The suite includes irregular gaps, delayed reports, retrospective documents, missing occasions, changing memberships, and language/source drift. Evaluation uses leakage-safe rolling origins. Monte Carlo uncertainty is reported for simulation summaries; arbitrary pass percentages or rule-of-thumb thresholds are not scientific promotion criteria. A recovery artifact is evidence. A separate Scientific Claim Promotion Decision applies the preregistered method-specific acceptance contract from ADR 0014. A transport success, mergeable PR, LLM judgment, or generic RMSE threshold cannot promote a candidate. @@ -171,7 +177,7 @@ A recovery artifact is evidence. A separate Scientific Claim Promotion Decision ```text fast-mlsirm Model Specification / Numerical Core - Published Language: versioned candidate manifest + Published Language: released versioned candidate manifest | v TEPP anti-corruption layer @@ -189,18 +195,14 @@ contextual-orchestrator --ACL--> Interpretation only LineageWeave ------------ACL--> Evidence/lineage input only ``` -Dependency direction is one-way. TEPP may depend on a versioned fast-mlsirm contract. fast-mlsirm must not import TEPP temporal ontology. Neither repository accesses the other repository's database. +Dependency direction is one-way. TEPP may depend on a released versioned fast-mlsirm contract. fast-mlsirm must not import TEPP temporal ontology. Neither repository accesses the other repository's database. ## Current implementation status -As of the snapshot that introduced this document, `fast-mlsirm` PR #1714 publishes the proposed non-numerical generalized-mixed/dependence candidate compiler, but it is not yet merged into fast-mlsirm protected `main`. Therefore TEPP has no right to claim this Published Language as available production dependency yet. +The upstream generalized-mixed/dependence candidate compiler is a contract-in-progress until it reaches the canonical fast-mlsirm protected branch and is released/versioned. TEPP must re-read its live identity each execution rather than treating a remembered PR number or SHA as authority. -Until that contract lands and is versioned, TEPP should develop only the ACL schema/tests and temporal composition semantics that do not duplicate the upstream compiler or numerical kernel. Any local reusable static psychometric implementation discovered during that work is a migration candidate, not a second canonical source. +Until that contract is released, TEPP develops only ACL schema/tests and temporal composition semantics that do not duplicate the upstream compiler or numerical kernel. Any local reusable static psychometric implementation discovered during that work is a migration candidate, not a second canonical source. ## Research basis -Jin, I. H., & Jeon, M. (2019). A doubly latent space joint model for local item and person dependence in the analysis of item response data. *Psychometrika, 84*(1), 236–260. https://doi.org/10.1007/s11336-018-9630-0 - -Jeon, M., Jin, I. H., Schweinberger, M., & Baugh, S. (2021). Mapping unobserved item–respondent interactions: A latent space item response model with interaction map. *Psychometrika, 86*(2), 378–403. https://doi.org/10.1007/s11336-021-09762-5 - -Kang, I., & Jeon, M. (2025). Multidimensional latent space item response models: A note on the relativity of conditional dependence. *Psychometrika, 90*(2), 799–826. https://doi.org/10.1017/psy.2025.5 +The canonical research discussion and APA 7 references for LSIRM, MLSIRM, and DLSJM are in [`docs/research/temporal-dependence-models.md`](../research/temporal-dependence-models.md). This architecture document intentionally does not maintain a second independent citation authority. \ No newline at end of file From fd4902e210e7501eaf1c72a51651348465c02734 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 20:11:22 +0900 Subject: [PATCH 020/235] docs(map): expose DDD and dependence authorities --- DOCUMENTATION.md | 167 ++++++++--------------------------------------- 1 file changed, 29 insertions(+), 138 deletions(-) diff --git a/DOCUMENTATION.md b/DOCUMENTATION.md index 6fa4b9683..8f62c1c42 100644 --- a/DOCUMENTATION.md +++ b/DOCUMENTATION.md @@ -1,18 +1,17 @@ # TEPP Documentation Map -TEPP's approved PRD v0.4 and implementation plan are the primary product baseline. This index makes the technical, data, scientific, security/privacy, integration, quality, operating, and assurance contracts discoverable without duplicating that source material. +TEPP's approved PRD v0.4 remains the product/measurement baseline. This map identifies the canonical technical, domain, scientific, security, operating, and delivery authorities without duplicating their content. An open PR, queued check, local test, or accepted ADR is not evidence of protected-main implementation unless the maturity and exact-head gates say so. | Area | Canonical document | |---|---| | Approved product requirements | [`docs/product/prd-v0.4-approved.md`](docs/product/prd-v0.4-approved.md) | | Live product and technical gap baseline | [`docs/product-technical-gap-baseline.md`](docs/product-technical-gap-baseline.md) | -| Whole-conversation documentation fitness | [`docs/DOCUMENTATION_ASSESSMENT.md`](docs/DOCUMENTATION_ASSESSMENT.md) | +| Whole-repository documentation assessment | [`docs/DOCUMENTATION_ASSESSMENT.md`](docs/DOCUMENTATION_ASSESSMENT.md) | | Technical requirements | [`docs/TRD.md`](docs/TRD.md) | | Architecture | [`ARCHITECTURE.md`](ARCHITECTURE.md) | +| DDD bounded-context and ownership map | [`docs/architecture/domain-context-map.md`](docs/architecture/domain-context-map.md) | +| Temporal/dependence composition boundary | [`docs/architecture/temporal-dependence-composition.md`](docs/architecture/temporal-dependence-composition.md) | | Modular/API integration contract | [`docs/API_CONTRACT.md`](docs/API_CONTRACT.md) | -| naruon modular consumer contract | [`docs/connectors/naruon-artifact-consumer.md`](docs/connectors/naruon-artifact-consumer.md) | -| contextual-orchestrator interpretation port | [`docs/connectors/contextual-orchestrator-interpretation-port.md`](docs/connectors/contextual-orchestrator-interpretation-port.md) | -| Orchestrator live HTTP doctoring | [`docs/research/orchestrator-live-http.md`](docs/research/orchestrator-live-http.md) | | UML/runtime/scientific flows | [`docs/UML.md`](docs/UML.md) | | Logical/physical ERD | [`docs/ERD.md`](docs/ERD.md) | | Security policy | [`SECURITY.md`](SECURITY.md) | @@ -29,150 +28,42 @@ TEPP's approved PRD v0.4 and implementation plan are the primary product baselin | Foundation implementation plan | [`docs/superpowers/plans/2026-08-05-temporal-event-foundation.md`](docs/superpowers/plans/2026-08-05-temporal-event-foundation.md) | | Foundation validation ledger | [`docs/validation/temporal-event-foundation.md`](docs/validation/temporal-event-foundation.md) | | Standards and APA 7 literature | [`docs/research/standards-and-literature.md`](docs/research/standards-and-literature.md) | -| Operational log / source-separation doctoring | [`docs/research/operational-log-source-separation.md`](docs/research/operational-log-source-separation.md) | -| Interval cutoff eligibility doctoring | [`docs/research/interval-cutoff-eligibility.md`](docs/research/interval-cutoff-eligibility.md) | +| LSIRM/MLSIRM/DLSJM primary research authority | [`docs/research/temporal-dependence-models.md`](docs/research/temporal-dependence-models.md) | +| Multilevel/event-time recovery doctoring | [`docs/research/multilevel-event-time-recovery.md`](docs/research/multilevel-event-time-recovery.md) | +| Posterior ESEM/DSEM input-gate doctoring | [`docs/research/posterior-esem-input-gates.md`](docs/research/posterior-esem-input-gates.md) | +| Interval cutoff eligibility | [`docs/research/interval-cutoff-eligibility.md`](docs/research/interval-cutoff-eligibility.md) | +| Scientific claim-promotion gates | [`docs/research/scientific-claim-promotion-gates.md`](docs/research/scientific-claim-promotion-gates.md) | +| Causal-identification gate | [`docs/research/causal-identification-gate.md`](docs/research/causal-identification-gate.md) | +| Topic log-ratio coordinates | [`docs/research/topic-logratio-coordinates.md`](docs/research/topic-logratio-coordinates.md) | +| VRAM budget / GPU fallback | [`docs/research/vram-budget-types.md`](docs/research/vram-budget-types.md) | +| TDT story segmentation | [`docs/research/tdt-story-segmentation.md`](docs/research/tdt-story-segmentation.md) | +| TDT link-detection calibration | [`docs/research/event-link-detection-calibration.md`](docs/research/event-link-detection-calibration.md) | +| First-story detection calibration | [`docs/research/first-story-detection-calibration.md`](docs/research/first-story-detection-calibration.md) | +| CHRONOS prediction calibration | [`docs/research/chronos-prediction-calibration.md`](docs/research/chronos-prediction-calibration.md) | +| CHRONOS schema-slot calibration | [`docs/research/chronos-schema-slot-calibration.md`](docs/research/chronos-schema-slot-calibration.md) | +| Event-tracking calibration | [`docs/research/event-tracking-calibration.md`](docs/research/event-tracking-calibration.md) | +| Provider payload minimization | [`docs/research/provider-payload-minimization.md`](docs/research/provider-payload-minimization.md) | +| Operational log/source separation | [`docs/research/operational-log-source-separation.md`](docs/research/operational-log-source-separation.md) | +| Adaptive orchestration | [`docs/research/adaptive-orchestration-router.md`](docs/research/adaptive-orchestration-router.md) | | Governance | [`GOVERNANCE.md`](GOVERNANCE.md) | | Agent development rules | [`AGENTS.md`](AGENTS.md) | | Agent context | [`CLAUDE.md`](CLAUDE.md) | -| Hourly NIM product-development operations | [`docs/operations/HOURLY_NIM_PRODUCT_DEVELOPMENT.md`](docs/operations/HOURLY_NIM_PRODUCT_DEVELOPMENT.md) | +| Hourly product-development operations | [`docs/operations/HOURLY_NIM_PRODUCT_DEVELOPMENT.md`](docs/operations/HOURLY_NIM_PRODUCT_DEVELOPMENT.md) | | Actions workflow fleet audit | [`docs/operations/ACTIONS_WORKFLOW_FLEET.md`](docs/operations/ACTIONS_WORKFLOW_FLEET.md) | -| Actions fleet research doctoring | [`docs/research/actions-workflow-fleet.md`](docs/research/actions-workflow-fleet.md) | -| Inferential TF-IDF/BM25/stopword refusal doctoring | [`docs/research/inferential-retrieval-weight-gate.md`](docs/research/inferential-retrieval-weight-gate.md) | -| Simulation cutoff-eligibility doctoring | [`docs/research/simulation-cutoff-eligibility.md`](docs/research/simulation-cutoff-eligibility.md) | -| Posterior ESEM/DSEM input-gate doctoring | [`docs/research/posterior-esem-input-gates.md`](docs/research/posterior-esem-input-gates.md) | -| Multilevel/event-time recovery doctoring | [`docs/research/multilevel-event-time-recovery.md`](docs/research/multilevel-event-time-recovery.md) | -| Rubin total-variance doctoring | [`docs/research/rubin-total-variance.md`](docs/research/rubin-total-variance.md) | -| Strong-invariance latent-mean doctoring | [`docs/research/strong-invariance-latent-means.md`](docs/research/strong-invariance-latent-means.md) | -| Mention-confidence Brier doctoring | [`docs/research/mention-confidence-brier.md`](docs/research/mention-confidence-brier.md) | -| Span-grounded mention extent doctoring | [`docs/research/span-grounded-mentions.md`](docs/research/span-grounded-mentions.md) | -| Span-grounded mention numeric provenance | [`docs/doctoring/span-grounded-mentions.md`](docs/doctoring/span-grounded-mentions.md) | -| Event-intelligence status-gate doctoring | [`docs/research/event-intelligence-status-gates.md`](docs/research/event-intelligence-status-gates.md) | -| TDT link-detection precision/recall doctoring | [`docs/research/event-link-detection-calibration.md`](docs/research/event-link-detection-calibration.md) | -| First-story detection FAR/miss doctoring | [`docs/research/first-story-detection-calibration.md`](docs/research/first-story-detection-calibration.md) | -| VRAM budget / GPU fallback doctoring | [`docs/research/vram-budget-types.md`](docs/research/vram-budget-types.md) | -| Causal-identification gate doctoring | [`docs/research/causal-identification-gate.md`](docs/research/causal-identification-gate.md) | -| TDT story-segmentation `WindowDiff`/`Pk` doctoring | [`docs/research/tdt-story-segmentation.md`](docs/research/tdt-story-segmentation.md) | -| CHRONOS prediction-calibration doctoring | [`docs/research/chronos-prediction-calibration.md`](docs/research/chronos-prediction-calibration.md) | -| CHRONOS schema-slot calibration doctoring | [`docs/research/chronos-schema-slot-calibration.md`](docs/research/chronos-schema-slot-calibration.md) | -| Event-tracking calibration doctoring | [`docs/research/event-tracking-calibration.md`](docs/research/event-tracking-calibration.md) | -| Episode-membership identity doctoring | [`docs/research/episode-membership-identity.md`](docs/research/episode-membership-identity.md) | -| Entity/project target SQL doctoring | [`docs/research/entity-project-sql.md`](docs/research/entity-project-sql.md) | -| Scientific claim-promotion gate doctoring | [`docs/research/scientific-claim-promotion-gates.md`](docs/research/scientific-claim-promotion-gates.md) | -| Retention/deletion/legal-hold doctoring | [`docs/research/retention-deletion-legal-hold.md`](docs/research/retention-deletion-legal-hold.md) | -| Provider-payload minimization doctoring | [`docs/research/provider-payload-minimization.md`](docs/research/provider-payload-minimization.md) | -| Relation absence is not negative evidence | [`docs/research/relation-absence-not-negative.md`](docs/research/relation-absence-not-negative.md) | -| Adaptive orchestration router doctoring | [`docs/research/adaptive-orchestration-router.md`](docs/research/adaptive-orchestration-router.md) | -| Mention-confidence Brier doctoring | [`docs/research/mention-confidence-brier.md`](docs/research/mention-confidence-brier.md) | -| Span-grounded mention extent doctoring | [`docs/research/span-grounded-mentions.md`](docs/research/span-grounded-mentions.md) | -| Span-grounded mention numeric provenance | [`docs/doctoring/span-grounded-mentions.md`](docs/doctoring/span-grounded-mentions.md) | -| Event-intelligence status-gate doctoring | [`docs/research/event-intelligence-status-gates.md`](docs/research/event-intelligence-status-gates.md) | -| Stopword-deletion doctoring | [`docs/research/stopword-deletion.md`](docs/research/stopword-deletion.md) | -| Topic log-ratio coordinate doctoring | [`docs/research/topic-logratio-coordinates.md`](docs/research/topic-logratio-coordinates.md) | -| Hourly NIM OpenCode doctoring | [`docs/doctoring/hourly-nim-opencode-development.md`](docs/doctoring/hourly-nim-opencode-development.md) | -| Analysis engine v1 doctoring | [`docs/doctoring/analysis-engine-v1.md`](docs/doctoring/analysis-engine-v1.md) | -| Analysis engine gap-closure doctoring | [`docs/doctoring/analysis-engine-gap-closure.md`](docs/doctoring/analysis-engine-gap-closure.md) | -| Corpus-split leakage-audit wire doctoring | [`docs/research/corpus-split-manifest-wire.md`](docs/research/corpus-split-manifest-wire.md) | -| Unicode canonical-identity doctoring | [`docs/research/unicode-canonical-identity.md`](docs/research/unicode-canonical-identity.md) | | Change history | [`CHANGELOG.md`](CHANGELOG.md) | -## Maturity vocabulary - -The canonical implementation-maturity vocabulary is defined in [`docs/adr/ADR_POLICY.md`](docs/adr/ADR_POLICY.md) and promotion evidence in [`docs/TRACEABILITY.md`](docs/TRACEABILITY.md). In particular, **an ADR with decision status `Accepted` is not automatically implemented or shipped.** - -- **implemented-main** — source is integrated on protected `main` and the relevant exact-current-head tests, scientific/recovery/validation evidence, security and supply-chain gates, and qualifying review required by live policy pass. -- **active-PR** — implementation exists only on an open PR and is not a protected-main claim. -- **partial** — an explicitly identified subset is implemented on protected main while the rest remains target work. -- **accepted-target** — accepted PRD/ADR architecture not yet integrated. -- **research-only** — evaluated research direction not accepted as production behavior. -- **out-of-scope** — explicitly outside TEPP ownership. -- **conceptual** — logical entity/service/model contract; not evidence of a migration or deployment. -- **deployment-owned** — evidence depends on a concrete deployed environment or organization and cannot be claimed by repository design alone. -- **external-assurance** — certification, attestation, legal opinion, or other independent assessment that TEPP cannot self-issue. +## Authority and maturity rules -## Documentation fitness - -The documentation graph is **design-sufficient** when a reviewer can reconstruct TEPP's product requirements, technical/scientific estimands, authority boundaries, temporal/event/membership semantics, data model, failure modes, security/privacy controls, validation strategy, API/integration contract, operability, research basis, ADR ownership/supersession, and release acceptance without chat history. - -It is **protected-main-sufficient** only after the canonical documents are integrated on protected `main`, remain semantically current with live code, and their required exact-head documentation/security/review gates pass. An active documentation PR can therefore be design-sufficient while the protected branch remains documentation-insufficient. - -At the time of this review, protected `main` at `7c29e7c971d7940e1fb3def1ed3aae2d1bc8ad4a` implements immutable evidence records/exact spans, the Rust workspace quality foundation, typed six-clock values/uncertain intervals (merged PR #8), Allen interval algebra and bounded path-consistency (merged PR #9), event ontology/membership, and PostgreSQL persistence through restore-integrity probes. Superseded PRs #5 and #6 remain historical lineage only, and drafts #93, #94, #97, #101, #102, #104, #108, #109, #111, and #112 are superseded non-landable lineage; unmerged or draft PRs are never implemented-main claims. The active-PR `prediction_contradiction` coverage gate requires observed Allen coverage (`during`, `starts`, `finishes`, or `equals`) before unmatched predicted mass may be authorized for promotion; `refuse_promotion` is that authority and not a contradiction-only filter — coverage may authorize promotion but does not convert a forecast into observed fact. Remaining TDT/CHRONOS intelligence, shared-latent topic estimation, GPU kernels, longitudinal ESEM/DSEM, visual analytics, production HTTP services, and deployment assurance stay accepted-target or deployment-owned unless a [`docs/TRACEABILITY.md`](docs/TRACEABILITY.md) row records a narrower implemented-main or partial subset. -# TEPP Documentation Map - -TEPP's approved PRD v0.4 and implementation plan are the primary product baseline. This index makes the technical, data, scientific, security/privacy, integration, quality, operating, and assurance contracts discoverable without duplicating that source material. - -| Area | Canonical document | -|---|---| -| Approved product requirements | [`docs/product/prd-v0.4-approved.md`](docs/product/prd-v0.4-approved.md) | -| Live product and technical gap baseline | [`docs/product-technical-gap-baseline.md`](docs/product-technical-gap-baseline.md) | -| Whole-conversation documentation fitness | [`docs/DOCUMENTATION_ASSESSMENT.md`](docs/DOCUMENTATION_ASSESSMENT.md) | -| Technical requirements | [`docs/TRD.md`](docs/TRD.md) | -| Architecture | [`ARCHITECTURE.md`](ARCHITECTURE.md) | -| Modular/API integration contract | [`docs/API_CONTRACT.md`](docs/API_CONTRACT.md) | -| naruon modular consumer contract | [`docs/connectors/naruon-artifact-consumer.md`](docs/connectors/naruon-artifact-consumer.md) | -| contextual-orchestrator interpretation port | [`docs/connectors/contextual-orchestrator-interpretation-port.md`](docs/connectors/contextual-orchestrator-interpretation-port.md) | -| UML/runtime/scientific flows | [`docs/UML.md`](docs/UML.md) | -| Logical/physical ERD | [`docs/ERD.md`](docs/ERD.md) | -| Security policy | [`SECURITY.md`](SECURITY.md) | -| Threat model | [`docs/THREAT_MODEL.md`](docs/THREAT_MODEL.md) | -| Privacy and data governance | [`docs/PRIVACY_DATA_GOVERNANCE.md`](docs/PRIVACY_DATA_GOVERNANCE.md) | -| Compliance/assurance readiness | [`docs/COMPLIANCE_READINESS.md`](docs/COMPLIANCE_READINESS.md) | -| LLM orchestration/test-time compute | [`docs/LLM_ORCHESTRATION.md`](docs/LLM_ORCHESTRATION.md) | -| Test/scientific validation strategy | [`docs/TEST_STRATEGY.md`](docs/TEST_STRATEGY.md) | -| Operability/recovery/release | [`docs/OPERABILITY.md`](docs/OPERABILITY.md) | -| Requirement/research/evidence traceability | [`docs/TRACEABILITY.md`](docs/TRACEABILITY.md) | -| Architecture decision index / ownership map | [`docs/adr/README.md`](docs/adr/README.md) | -| ADR status, maturity, and supersession policy | [`docs/adr/ADR_POLICY.md`](docs/adr/ADR_POLICY.md) | -| Delivery roadmap | [`docs/roadmaps/2026-08-05-tepp-delivery-roadmap.md`](docs/roadmaps/2026-08-05-tepp-delivery-roadmap.md) | -| Foundation implementation plan | [`docs/superpowers/plans/2026-08-05-temporal-event-foundation.md`](docs/superpowers/plans/2026-08-05-temporal-event-foundation.md) | -| Foundation validation ledger | [`docs/validation/temporal-event-foundation.md`](docs/validation/temporal-event-foundation.md) | -| Standards and APA 7 literature | [`docs/research/standards-and-literature.md`](docs/research/standards-and-literature.md) | -| Operational log / source-separation doctoring | [`docs/research/operational-log-source-separation.md`](docs/research/operational-log-source-separation.md) | -| Interval cutoff eligibility doctoring | [`docs/research/interval-cutoff-eligibility.md`](docs/research/interval-cutoff-eligibility.md) | -| Governance | [`GOVERNANCE.md`](GOVERNANCE.md) | -| Agent development rules | [`AGENTS.md`](AGENTS.md) | -| Agent context | [`CLAUDE.md`](CLAUDE.md) | -| Hourly NIM product-development operations | [`docs/operations/HOURLY_NIM_PRODUCT_DEVELOPMENT.md`](docs/operations/HOURLY_NIM_PRODUCT_DEVELOPMENT.md) | -| Actions workflow fleet audit | [`docs/operations/ACTIONS_WORKFLOW_FLEET.md`](docs/operations/ACTIONS_WORKFLOW_FLEET.md) | -| Actions fleet research doctoring | [`docs/research/actions-workflow-fleet.md`](docs/research/actions-workflow-fleet.md) | -| Mention-confidence Brier doctoring | [`docs/research/mention-confidence-brier.md`](docs/research/mention-confidence-brier.md) | -| Span-grounded mention extent doctoring | [`docs/research/span-grounded-mentions.md`](docs/research/span-grounded-mentions.md) | -| Span-grounded mention numeric provenance | [`docs/doctoring/span-grounded-mentions.md`](docs/doctoring/span-grounded-mentions.md) | -| Event-intelligence status-gate doctoring | [`docs/research/event-intelligence-status-gates.md`](docs/research/event-intelligence-status-gates.md) | -| VRAM budget / GPU fallback doctoring | [`docs/research/vram-budget-types.md`](docs/research/vram-budget-types.md) | -| Causal-identification gate doctoring | [`docs/research/causal-identification-gate.md`](docs/research/causal-identification-gate.md) | -| TDT story-segmentation `WindowDiff`/`Pk` doctoring | [`docs/research/tdt-story-segmentation.md`](docs/research/tdt-story-segmentation.md) | -| CHRONOS prediction-calibration doctoring | [`docs/research/chronos-prediction-calibration.md`](docs/research/chronos-prediction-calibration.md) | -| CHRONOS schema-slot calibration doctoring | [`docs/research/chronos-schema-slot-calibration.md`](docs/research/chronos-schema-slot-calibration.md) | -| Event-tracking calibration doctoring | [`docs/research/event-tracking-calibration.md`](docs/research/event-tracking-calibration.md) | -| Episode-membership identity doctoring | [`docs/research/episode-membership-identity.md`](docs/research/episode-membership-identity.md) | -| Entity/project target SQL doctoring | [`docs/research/entity-project-sql.md`](docs/research/entity-project-sql.md) | -| Scientific claim-promotion gate doctoring | [`docs/research/scientific-claim-promotion-gates.md`](docs/research/scientific-claim-promotion-gates.md) | -| Retention/deletion/legal-hold doctoring | [`docs/research/retention-deletion-legal-hold.md`](docs/research/retention-deletion-legal-hold.md) | -| Stopword-deletion doctoring | [`docs/research/stopword-deletion.md`](docs/research/stopword-deletion.md) | -| Provider-payload minimization doctoring | [`docs/research/provider-payload-minimization.md`](docs/research/provider-payload-minimization.md) | -| Relation absence is not negative evidence | [`docs/research/relation-absence-not-negative.md`](docs/research/relation-absence-not-negative.md) | -| Adaptive orchestration router doctoring | [`docs/research/adaptive-orchestration-router.md`](docs/research/adaptive-orchestration-router.md) | -| Hourly NIM OpenCode doctoring | [`docs/doctoring/hourly-nim-opencode-development.md`](docs/doctoring/hourly-nim-opencode-development.md) | -| Corpus-split leakage-audit wire doctoring | [`docs/research/corpus-split-manifest-wire.md`](docs/research/corpus-split-manifest-wire.md) | -| Unicode canonical-identity doctoring | [`docs/research/unicode-canonical-identity.md`](docs/research/unicode-canonical-identity.md) | -| Change history | [`CHANGELOG.md`](CHANGELOG.md) | +The implementation-maturity vocabulary is defined by [`docs/adr/ADR_POLICY.md`](docs/adr/ADR_POLICY.md), and scientific promotion evidence is governed by [`docs/TRACEABILITY.md`](docs/TRACEABILITY.md) and ADR 0014. In particular, an Accepted ADR is a decision, not proof of a shipped implementation. -## Maturity vocabulary +`docs/architecture/domain-context-map.md` owns the strategic DDD boundary vocabulary for the delivery-recovery cycle. `docs/architecture/temporal-dependence-composition.md` refines the cross-repository dependence/temporal composition boundary under ADR 0011; it cannot override the PRD, ADR 0011, or protected-main source. The dependence-family primary citations are maintained once in `docs/research/temporal-dependence-models.md`. -The canonical implementation-maturity vocabulary is defined in [`docs/adr/ADR_POLICY.md`](docs/adr/ADR_POLICY.md) and promotion evidence in [`docs/TRACEABILITY.md`](docs/TRACEABILITY.md). In particular, **an ADR with decision status `Accepted` is not automatically implemented or shipped.** +## Six-clock contract -- **implemented-main** — source is integrated on protected `main` and the relevant exact-current-head tests, scientific/recovery/validation evidence, security and supply-chain gates, and qualifying review required by live policy pass. -- **active-PR** — implementation exists only on an open PR and is not a protected-main claim. -- **partial** — an explicitly identified subset is implemented on protected main while the rest remains target work. -- **accepted-target** — accepted PRD/ADR architecture not yet integrated. -- **research-only** — evaluated research direction not accepted as production behavior. -- **out-of-scope** — explicitly outside TEPP ownership. -- **conceptual** — logical entity/service/model contract; not evidence of a migration or deployment. -- **deployment-owned** — evidence depends on a concrete deployed environment or organization and cannot be claimed by repository design alone. -- **external-assurance** — certification, attestation, legal opinion, or other independent assessment that TEPP cannot self-issue. +The canonical six temporal roles are event **or** valid time, assertion time, document time, system time, available time, and knowledge cutoff. Event instants and validity intervals are representations of the first role, not two independent analysis clocks. Historical eligibility requires available time at or before knowledge cutoff. Forward transition/state relations and retrospective/provenance relations remain distinct. ## Documentation fitness -The documentation graph is **design-sufficient** when a reviewer can reconstruct TEPP's product requirements, technical/scientific estimands, authority boundaries, temporal/event/membership semantics, data model, failure modes, security/privacy controls, validation strategy, API/integration contract, operability, research basis, ADR ownership/supersession, and release acceptance without chat history. +The graph is design-sufficient when a reviewer can reconstruct product requirements, technical/scientific estimands, DDD/service authority, temporal/event/membership semantics, data model, failure modes, security/privacy controls, validation strategy, API/integration contract, operability, research basis, ADR ownership/supersession, and release acceptance without chat history. -It is **protected-main-sufficient** only after the canonical documents are integrated on protected `main`, remain semantically current with live code, and their required exact-head documentation/security/review gates pass. An active documentation PR can therefore be design-sufficient while the protected branch remains documentation-insufficient. +It is protected-main-sufficient only after the relevant canonical documents are integrated on protected `main`, remain semantically current with live code, and their current-head documentation/security/review gates pass. Queued, stale, skipped, predecessor-head, or branch-local evidence is non-passing. \ No newline at end of file From af2a7d98e34e6d0ff66f6569c02360bd01555a87 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 20:12:31 +0900 Subject: [PATCH 021/235] fix(docs): enforce canonical DDD authority links --- scripts/validate_documentation.py | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/scripts/validate_documentation.py b/scripts/validate_documentation.py index e25d99083..6a27e2a47 100644 --- a/scripts/validate_documentation.py +++ b/scripts/validate_documentation.py @@ -9,6 +9,9 @@ ROOT = Path(__file__).resolve().parents[1] PRODUCT_TECHNICAL_GAP_BASELINE = "docs/product-technical-gap-baseline.md" +DOMAIN_CONTEXT_MAP = "docs/architecture/domain-context-map.md" +TEMPORAL_DEPENDENCE_COMPOSITION = "docs/architecture/temporal-dependence-composition.md" +TEMPORAL_DEPENDENCE_RESEARCH = "docs/research/temporal-dependence-models.md" REQUIRED_FILES = ( "DOCUMENTATION.md", @@ -49,9 +52,12 @@ "docs/adr/0022-deterministic-analysis-run-execution.md", "docs/product/prd-v0.4-approved.md", PRODUCT_TECHNICAL_GAP_BASELINE, + DOMAIN_CONTEXT_MAP, + TEMPORAL_DEPENDENCE_COMPOSITION, "docs/roadmaps/2026-08-05-tepp-delivery-roadmap.md", "docs/superpowers/plans/2026-08-05-temporal-event-foundation.md", "docs/research/standards-and-literature.md", + TEMPORAL_DEPENDENCE_RESEARCH, ) PLACEHOLDER_PATTERNS = ( @@ -159,6 +165,8 @@ "docs/DOCUMENTATION_ASSESSMENT.md", "docs/TRD.md", "ARCHITECTURE.md", + DOMAIN_CONTEXT_MAP, + TEMPORAL_DEPENDENCE_COMPOSITION, "docs/API_CONTRACT.md", "docs/UML.md", "docs/ERD.md", @@ -175,6 +183,7 @@ "docs/roadmaps/2026-08-05-tepp-delivery-roadmap.md", "docs/superpowers/plans/2026-08-05-temporal-event-foundation.md", "docs/research/standards-and-literature.md", + TEMPORAL_DEPENDENCE_RESEARCH, "GOVERNANCE.md", "AGENTS.md", "CLAUDE.md", From 3c771d97f9095f9f4552184778ee512b6d1de382 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 20:13:44 +0900 Subject: [PATCH 022/235] docs(delivery): align six-clock and whitespace contracts --- docs/product-technical-gap-baseline.md | 33 +++++++++++++------------- 1 file changed, 16 insertions(+), 17 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 64708c868..f5029bb03 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,11 +1,11 @@ # Product and Technical Gap Baseline -**Status:** Active delivery recovery -**Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-01T10:49:02Z -**Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` -**Workspace version:** `0.2.0` -**Delivery authority:** issue [#175](https://github.com/ContextualWisdomLab/TEPP/issues/175), PR [#435](https://github.com/ContextualWisdomLab/TEPP/pull/435), and [`docs/delivery/pr-queue-authority-2026-09-01.md`](delivery/pr-queue-authority-2026-09-01.md) +**Status:** Active delivery recovery +**Product:** Temporal Event Psychometrics Platform (TEPP) +**Snapshot:** 2026-09-01T10:49:02Z +**Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` +**Workspace version:** `0.2.0` +**Delivery authority:** issue [#175](https://github.com/ContextualWisdomLab/TEPP/issues/175), PR [#435](https://github.com/ContextualWisdomLab/TEPP/pull/435), and [`docs/delivery/pr-queue-authority-2026-09-01.md`](delivery/pr-queue-authority-2026-09-01.md) **DDD authority:** [`docs/architecture/domain-context-map.md`](architecture/domain-context-map.md) and [`docs/architecture/temporal-dependence-composition.md`](architecture/temporal-dependence-composition.md) ## Purpose @@ -69,8 +69,8 @@ Cargo crates are implementation units, not bounded contexts. Current product res ### Canonical owner boundaries -- **fast-mlsirm** owns reusable static/generalized-mixed/dependence-aware psychometric model specification and numerical kernels, including LSIRM/MLSIRM/DLSJM. -- **TEPP** owns temporal/event composition: six-clock semantics, cutoff safety, irregular time, time-varying covariates/random effects/memberships, longitudinal invariance/drift, state evolution, event ontology/graph, temporal alignment and temporal recovery. +- **fast-mlsirm** owns reusable static/generalized-mixed/dependence-aware psychometric model specification and numerical kernels, including LSIRM/MLSIRM/DLSJM, under ADR 0011's cross-service boundary. +- **TEPP** owns temporal/event composition: the six-clock contract, cutoff safety, irregular time, time-varying covariates/random effects/memberships, longitudinal invariance/drift, state evolution, event ontology/graph, temporal alignment and temporal recovery. - **contextual-orchestrator** owns every LLM provider call, routing/fallback, credential, verifier/adjudicator execution, and model-call provenance. - **LineageWeave or the consuming product** owns source/item-generation lineage; lineage is evidence, not numerical authority. @@ -93,6 +93,8 @@ Every TEPP temporal candidate records the upstream contract version/digest, exac Auto-expansion is not auto-activation. Unknown or novel couplings remain `research_candidate`; incoherent couplings are `unsupported`. TEPP never silently simplifies a dependence-aware temporal request to a static or local-independent model. +The canonical dependence-family research authority is [`docs/research/temporal-dependence-models.md`](research/temporal-dependence-models.md). + ### LSIRM / MLSIRM LSIRM residual person-item interaction keeps person/item interaction positions, distances and interaction strength separate from known hierarchy, testlets, raters, methods and covariates. MLSIRM is the **multidimensional-main-effect** latent-space extension; multilevel, cross-classified and multiple-membership operators are orthogonal generalized-mixed structure. Temporal maps require declared translation/rotation/reflection identification before coordinates or trajectories are compared across occasions. @@ -115,7 +117,7 @@ Multiple-membership weights are explicit, auditable and time-valid. They are obs | GAP-002 | multilingual span-grounded semantic/concept admission incomplete | `partial` | Evidence & Semantic Measurement | immutable offsets/layout, language profiles, concept dictionary, unknown review, invariance/calibration, hostile-input tests | | GAP-003 | shared-latent temporal topic estimator incomplete | `partial` | #167 | Rust CPU `f64` likelihood/estimands/uncertainty, time/relation/membership effects, multi-seed recovery, real candidate-K fits | | GAP-004 | durable end-to-end Analysis Run incomplete | `partial` | #166 | idempotent lifecycle, persistence/recovery, estimator-bound artifacts, complete validation evidence, separate claim promotion, Compose E2E | -| GAP-005 | temporal psychometric composition fragmented and partly duplicated | `partial` | #169 + fast-mlsirm owner boundary | versioned upstream model/dependence contract, TEPP temporal ACL, invariance/alignment, irregular time, temporal recovery, duplicate static kernels removed after parity | +| GAP-005 | temporal psychometric composition fragmented and partly duplicated | `partial` | #169 + ADR 0011 / fast-mlsirm owner boundary | released upstream model/dependence contract, TEPP temporal ACL, invariance/alignment, irregular time, temporal recovery, duplicate static kernels removed after parity | | GAP-006 | TDT/CHRONOS event workflow incomplete | `partial` | #170 | calibrated event evidence/detection/tracking/schema/interval consistency with recovery and durable artifacts | | GAP-007 | real accelerator/memory evidence incomplete | `accepted-target` | #171 | real hardware execution, CPU f64 parity, bounded memory/OOM/fallback evidence | | GAP-008 | posterior network/cluster buyer workflow incomplete | `partial` | #172 | known-truth network recovery, uncertainty/stability, repeated Leiden consensus, exact-value exports | @@ -131,7 +133,7 @@ Multiple-membership weights are explicit, auditable and time-valid. They are obs 2. Consolidate Evidence & Semantic Measurement. 3. Complete the Rust CPU `f64` shared-latent topic estimator (#167). 4. Complete durable end-to-end Analysis Run and evidence/promotion separation (#166). -5. Compose temporal psychometrics through fast-mlsirm contracts (#169) and complete Event Intelligence (#170) instead of producing one-equation product slices. +5. Compose temporal psychometrics through released fast-mlsirm contracts (#169) and complete Event Intelligence (#170) instead of producing one-equation product slices. 6. Add real accelerator parity after CPU scientific authority is established (#171). 7. Complete network/cluster, interpretation and buyer visual workflows (#172/#176/#173). 8. Productionize tenancy, durability, observability, recovery, release and support (#174). @@ -195,7 +197,8 @@ Do not run a repository-wide rename across more than one hundred live heads. The ## Scientific and data invariants - Production mathematical/statistical/psychometric/vector/matrix arithmetic is Rust-owned; deterministic CPU `f64` is the scientific numerical reference. -- Event, valid, assertion, document, system, available and knowledge-cutoff semantics stay distinct; historical evidence requires availability at or before cutoff. +- The six clock roles are event **or** valid time, assertion time, document time, system time, available time, and knowledge cutoff. Event instants and validity intervals represent the first role; they are not independent seventh and eighth clocks. +- Historical evidence requires availability at or before cutoff. - Measurement occasion as a rater/method facet is distinct from substantive event time. - Process/transition edges are forward-only. Citation, support, summary, revision and retrospective report do not become transitions. - Cross-classification and weighted multiple membership are preserved rather than forced into one parent hierarchy. @@ -203,7 +206,7 @@ Do not run a repository-wide rename across more than one hundred live heads. The - Residual person-item interaction may motivate LSIRM/MLSIRM; joint local-item plus local-person dependence may motivate DLSJM only when its relational formulation matches the question. - Exploratory factors/loadings and dependence geometry remain hypotheses until confirmatory/invariance/recovery evidence permits production use. - Every temporal dependence candidate generates model-appropriate known-truth recovery for states/trajectories, fixed/random effects, covariance, membership, factors/loadings, response-family-specific parameters, dependence geometry, dynamics and uncertainty. -- Temporal recovery uses event-time/available-time separation, rolling-origin evaluation, irregular gaps, delayed/retrospective records, missing occasions, changing membership and language/source drift. +- Temporal recovery uses event-or-valid-time/available-time separation, rolling-origin evaluation, irregular gaps, delayed/retrospective records, missing occasions, changing membership and language/source drift. - Monte Carlo uncertainty is reported; arbitrary pass percentages or rule-of-thumb thresholds are not scientific promotion criteria. - LLMs never replace estimation/validation and are called only through contextual-orchestrator. - Database authority is normalized, tenant/time/provenance aware, uses descriptive multiword `snake_case`, explicit idempotency/UPSERT and measured hot-partition evidence. @@ -233,8 +236,4 @@ Before a landing vehicle merges: ## Research traceability for dependence ownership -- Jin, I. H., & Jeon, M. (2019). A doubly latent space joint model for local item and person dependence in the analysis of item response data. *Psychometrika, 84*(1), 236–260. https://doi.org/10.1007/s11336-018-9630-0 -- Jeon, M., Jin, I. H., Schweinberger, M., & Baugh, S. (2021). Mapping unobserved item–respondent interactions: A latent space item response model with interaction map. *Psychometrika, 86*(2), 378–403. https://doi.org/10.1007/s11336-021-09762-5 -- Kang, I., & Jeon, M. (2025). Multidimensional latent space item response models: A note on the relativity of conditional dependence. *Psychometrika, 90*(2), 799–826. https://doi.org/10.1017/psy.2025.5 - -The cited dependence families do not establish every novel base-family × generalized-mixed × dependence × temporal coupling. Novel compositions stay `research_candidate` until the exact combined model, identification, estimator and recovery are demonstrated. \ No newline at end of file +The canonical primary-research discussion is [`docs/research/temporal-dependence-models.md`](research/temporal-dependence-models.md). Novel base-family × generalized-mixed × dependence × temporal couplings stay `research_candidate` until the exact combined model, identification, estimator and recovery are demonstrated. \ No newline at end of file From 372a675234e71d343d39609f42a9cd663804ac3e Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 20:15:16 +0900 Subject: [PATCH 023/235] docs(architecture): normalize bounded-context ownership --- ARCHITECTURE.md | 336 +++++++++++++++++++++--------------------------- 1 file changed, 144 insertions(+), 192 deletions(-) diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md index e6dafbcc2..bc2e1fb04 100644 --- a/ARCHITECTURE.md +++ b/ARCHITECTURE.md @@ -2,227 +2,179 @@ ## Product definition -TEPP is a Temporal Event Psychometrics Platform. It measures multilingual semantic evidence, links documents and event mentions through typed temporal relations, estimates shared latent topic and higher-order psychometric structures, and renders the resulting evidence, uncertainty, trajectories, and networks. +TEPP is the Temporal Event Psychometrics Platform. It measures multilingual documentary evidence as fallible observations of semantic, event, and psychological structure while preserving temporal eligibility, relation provenance, multilevel/multiple-membership structure, uncertainty, and scientific claim boundaries. + +The approved product target is defined in [`docs/product/prd-v0.4-approved.md`](docs/product/prd-v0.4-approved.md). Strategic DDD ownership is defined in [`docs/architecture/domain-context-map.md`](docs/architecture/domain-context-map.md). Cross-repository psychometric/dependence ownership is governed by ADR 0011 and [`docs/architecture/temporal-dependence-composition.md`](docs/architecture/temporal-dependence-composition.md). ```mermaid flowchart LR - A[Immutable documents and metadata] --> B[Evidence ingestion] - B --> C[Temporal and event normalization] - C --> D[Multilingual semantic units] - D --> E[Shared-latent temporal topic measurement] - C --> F[Typed document-event-entity graph] - E --> G[Posterior topic coordinates] - F --> G - G --> H[Longitudinal ESEM and DSEM] - G --> I[Topic and event networks] - H --> J[Evidence-grounded interpretation] - I --> J - J --> K[Accessible visual analytics and exports] + E[Evidence & Semantic Measurement] --> T[Temporal Event Knowledge] + E --> M[Topic Measurement] + T --> M + T --> L[Longitudinal Modeling] + M --> L + M --> A[Analysis Run] + L --> A + A --> V[Validation Evidence] + V --> P[Claim Promotion] + A --> R[Projection / Read Models] + P --> R + R --> I[Evidence-grounded Interpretation] ``` -## Bounded services and Rust crates - -| Boundary | Primary responsibility | -|---|---| -| `evidence_ingestion` | immutable source bytes, hashes, layout, exact spans, metadata, provenance | -| `temporal_core` | instants, intervals, uncertain dates, partial orders, bitemporal availability and leakage gates | -| `event_ontology` | event mentions, event instances, roles, subevents, products, factors, places, and evidence links | -| `relation_graph` | typed document, segment, event, entity, revision, translation, evidence, and transition edges | -| `membership_model` | time-varying cross-classified and multiple-membership assignments | -| `semantic_preprocessor` | Unicode, segmentation, morphology, dependency phrases, LLM span contracts, validation | -| `concept_dictionary` | versioned multilingual concept alignment and unknown-concept review | -| `topic_measurement` | shared-latent temporal/relational topic estimation and uncertainty | -| `compute_backend` | CPU `f64`, fixed-pool multithreading, CUDA/WGPU, sparse streaming, VRAM budgeting | -| `model_selection` | fitted candidate-K scoring from the CPU reference, predictive fit, coherence, exclusivity, stability, alignment, fairness, blinded LLM review | -| `psychometric_core` | posterior-plausible-value ESEM, longitudinal invariance, DSEM, continuous-time paths | -| `event_intelligence` | TDT segmentation/link/detection/first-story/tracking and CHRONOS schema reasoning | -| `network_analysis` | log-ratio topic correlation, conditional networks, uncertainty, Leiden consensus clusters | -| `interpretation_gateway` | evidence-bounded LLM interpretation, independent verification, routing and ablations | -| `artifact_service` | model registry, manifests, JSON-LD, GraphML, Arrow/Parquet, tables, SVG/PDF exports | -| `visual_analytics` | bitemporal lens, event graph, topic river, drift, ESEM/DSEM builder, invariance and leakage audit | - -Every boundary must be independently usable and expose versioned contracts for integration with organization repositories, `naruon`, and `contextual-orchestrator`. - -The `analysis_engine` vertical slice is intentionally separate from `tepp_api`: -the API owns wire contracts while the engine owns deterministic execution. It -does not replace the future topic or psychometric estimators and does not read -another service's application tables. - -## Implemented foundation topology - -Task 1 materializes the first storage-independent workspace boundaries. The -crate names are stable implementation identifiers, while the broader service -boundaries above remain the target modular MSA architecture. - -| Rust crate | Initial responsibility | -|---|---| -| `evidence_core` | immutable evidence domain primitives | -| `semantic_core` | span-grounded semantic units; language is not identity | -| `location_membership` | location is not entity identity and not a language channel | -| `temporal_core` | typed clocks, intervals, and temporal reasoning | -| `event_core` | event instances, span-grounded `EventMention` (the only constructible mention type), roles, provenance, and CHRONOS occurrence-prediction calibration | -| `relation_graph` | typed relations and forward-transition validation | -| `membership_core` | time-varying cross-classified multiple membership, Kish ESS, nested ICC with non-nested refusal | -| `role_contradiction` | customer and competitor cannot occupy the same group | -| `relation_absence` | unobserved relation pairs are not evidence of no relationship | -| `persistence_postgres` | PostgreSQL repositories and migrations | -| `corpus_split` | cutoff-safe, relation-aware partitioning | -| `tepp_simulation` | known-truth temporal/event data generation | -| `validation_core` | RMSE, bias, coverage, graph, Monte Carlo, and exact-head claim-promotion metrics | -| `tepp_api` | versioned DTO, schema, terminal-result, and export contracts | -| `analysis_engine` | bounded cutoff-safe temporal evidence readiness execution and digest-bound terminal artifacts | -| `episode_membership` | event-time episode membership containment gate | -| `prompt_source` | prompt boilerplate is not unique latent content and not stopword deletion | -| `corpus_background` | corpus-background wording is not unique latent content and not stopword deletion | -| `modality_source` | non-lexical modality is not unique latent content and not stopword deletion | -| `copied_text` | copied-text residue is not unique latent content and not stopword deletion | -| `style_source` | house-voice style residue is not unique latent content and not stopword deletion | -| `stopword_deletion` | default stopword deletion is not a valid method for repeated report language | -| `copy_identity` | a template copy is not the source document and not a state transition | -| `intake_authorization` | untrusted intake fails closed without a grant; bounds are not authorization | -| `summarizes_edge` | a summary is not a state transition and not the source document | -| `outcome_order` | input-process-outcome edges cannot move backward in event time | -| `retrospective_edge` | retrospective reporting cannot become a transition or a translation | -| `payload_bound` | untrusted documents, records, checkpoints, and LLM outputs fail closed without identity, provenance, size, and depth | -| `inferred_status` | inferred relations cannot be promoted to observed evidence or transitions | -| `support_edge` | support, contradiction, summary, and outcome_of edges are not state transitions | -| `system_clock` | system time cannot be replaced by event, assertion, document, available, or cutoff time | -| `event_clock` | event time cannot be replaced by assertion, system, document, or available time | -| `assertion_clock` | assertion time cannot be replaced by event, system, document, or available time | -| `cutoff_clock` | knowledge cutoff cannot be replaced by event, system, or availability time | -| `available_clock` | availability time cannot be replaced by event or system time | -| `document_clocks` | document rows must carry assertion time and document time | -| `revision_order` | later document revisions must have later system time | -| `encrypted_mapping` | purpose-bound in-memory AES-256-GCM identity mappings; no plaintext persistence or KMS integration | -| `citation_edge` | citation, revision, translation, and retrospective edges are not state transitions | -| `psychometric_fit` | CPU `f64` ESEM loading recovery and event-time DSEM lag gates | -| `subevent_containment` | subevent event-time intervals must stay inside the parent | -| `prediction_contradiction` | Allen promotion gate: `before`/`after` stay contradictory; `meets`/`met_by` stay unsupported; coverage is required before unmatched predicted mass may be authorized for promotion | -| `provider_receipt` | provider-disclosure field-code receipts; source text and identity are not disclosable | -| `operational_log` | operational logs; `try_record` is the only recording API; source text and source identity are not loggable; `persistence_postgres` `audit_event` inserts call the same gate | -| `service_tls` | production TLS bind gates and rustls server config | -| `derived_sensitivity` | derived topic/factor/relation outputs inherit source sensitivity | -| `longitudinal_core` | active-PR: within/between decomposition; refuse between-as-within; component RMSE | -| `topic_lineage` | global topic identity across active/dormant/reactivated states | -| `network_analysis` | compositional cluster-pair gates; raw simplex is not Euclidean | -| `interpretation_gateway` | evidence-bounded LLM interpretations; not estimators or observed facts | -| `orchestrator_live` | loopback interpretation HTTP/1.1 listener | -| `model_selection` | fitted candidate-`K` scoring from the CPU `f64` reference plus statistical/Pareto gates; LLM votes are not numerical authority | -| `checkpoint_authority` | a model checkpoint is not the CPU `f64` estimator | -| `compute_backend` | VRAM-budgeted streamed planning, executable OOM retry plans, and a compensated CPU `f64` reference | -| `episode_membership` | episode membership cannot escape the episode event-time interval | -| `membership_target` | language, episode, template, department, and opportunity-pool targets cannot collapse into entity or project | -| `topic_measurement` | logistic-normal ALR/ILR coordinates and the CPU `f64` TRSL-TM reference estimator | -| `analysis_engine` | bounded cutoff-safe temporal evidence readiness execution and digest-bound terminal artifacts | -| `psychometric_core` | posterior-aware structural input gates, CWC within/between OLS plus the contextual effect, event-time log-rate, unequal-interval discrete-lag remapping, constant-predictor discrete effect, time-varying-predictor discrete effect (Eq. 14), exact scalar discrete process noise (Driver et al., 2017, Eq. 3), lagged latent covariance and unconditional latent variance (Driver et al., 2017, Eq. 3–4), stationary within-subject variance (Driver et al., 2017, Eq. 4 as `Δt → ∞`; `asymDIFFUSION`), trait-plus-state variance (Driver et al., 2017, §4.3 `TRAITVAR`; not process noise), observed-indicator variance and lagged observed covariance (Driver et al., 2017, Eq. 5; Table 2 `MANIFESTVAR` is `Θ`, not `Var(y)`; `MANIFESTTRAITVAR` is not `MANIFESTVAR`; `Θ` does not enter lagged observed covariance; observed-indicator mean is `τ + λ μ`; `MANIFESTMEANS` is not `E(y)`; `CINT` is not `MANIFESTMEANS`; discrete latent mean is `exp(a Δt) μ_0 + (exp(a Δt) − 1)/a κ`; `T0MEANS` is not `μ_t`; `CINT` is not the discrete increment; evolved observed mean is `τ + λ μ_t`; `τ + λ μ_0` is not `E(y_t)`; contemporaneous `TDPREDEFFECT` impulse is `m x`, not `CINT`, not `TIPREDEFFECT`, and not Voelkle Eq. 14; Eq. 5 of that contemporaneous impulse is `τ + λ(μ_t + m x)`, and `τ + λ μ_t` is not that observed mean; time-independent `TIPREDEFFECT` increment is `A^{-1}[e^{A Δt} − I] B z`, not `CINT`, not `M x`, not Voelkle Eq. 14, and not the coefficient `B`; Eq. 5 of that increment is `τ + λ(μ_t + A^{-1}[e^{A Δt} − I] B z)`, and `τ + λ μ_t` is not that observed mean; `τ + λ(μ_t + m x)` is not that observed mean; `τ + λ(μ_t + e^{a(t−u)} m x)` is not that observed mean when `u ≠ t`; within-interval `TDPREDEFFECT` carry is `e^{A(t−u)} M x` for `t0 < u < t`, not the contemporaneous Dirac, not `CINT`, not `TIPREDEFFECT`, and not Voelkle Eq. 14; Eq. 5 of that carry is `τ + λ(μ_t + e^{a(t−u)} m x)`, and `τ + λ μ_t` is not that observed mean; `τ + λ(μ_t + m x)` is not that carried observed mean when `u ≠ t`; first-occasion `T0TIPREDEFFECT` shift is `t0_b z` and Eq. 3 first-summand carry is `e^{A Δt} t0_b z` (`T0TIPREDEFFECT` is not `TIPREDEFFECT` `B`; `t0_b z` is not `A^{-1}[e^{A Δt} − I] B z`; `e^{A Δt} t0_b z` is not `t0_b z`; Eq. 5 of that carry is `τ + λ(μ_t + e^{a Δt} t0_b z)`, and `τ + λ μ_t` is not that observed mean; `τ + λ(μ_t + A^{-1}[e^{A Δt} − I] B z)` is not that observed mean), first-occasion `T0TDPREDEFFECT` shift is `t0_m x0` and Eq. 3 first-summand carry is `e^{A Δt} t0_m x0` (`T0TDPREDEFFECT` is not `TDPREDEFFECT` `M`; `t0_m x0` is not `M x`; `e^{A Δt} t0_m x0` is not `t0_m x0`; `e^{A Δt} t0_m x0` is not `e^{A(t−u)} M x` for `t0 < u < t`; `t0_m x0` is not `t0_b z`; an impulse at `u ≤ t0` that used `M` is already in `η(t0)` as `TDPREDEFFECT`, not as `T0TDPREDEFFECT`; Eq. 5 of that carry is `τ + λ(μ_t + e^{a Δt} t0_m x0)`, and `τ + λ μ_t` is not that observed mean; `τ + λ(μ_t + A^{-1}[e^{A Δt} − I] B z)` is not that observed mean; `τ + λ(μ_t + e^{a Δt} t0_b z)` is not that observed mean; §7.2 level-change `CINT` is `κ = −a m x` with `a < 0` so `−κ / a = m x` (`−a m x` is not the dissipating Dirac, not a free `CINT`, not `TIPREDEFFECT`, and not the extra near-zero-drift latent process also named in §7.2; Eq. 3 of that setting is `(1 − e^{a Δt}) m x`, which is not `m x`, not `κ`, and not `TIPREDEFFECT`; §7.2 extra-process contribution is `a_{ηξ} x (e^{ε Δt} − e^{a Δt}) / (ε − a)` (`ε = a` is `a_{ηξ} x Δt e^{a Δt}`; identification `TDPREDEFFECT` on the extra process is 1; printed extra `DRIFT` is `−0.000001`; not `κ = −a m x`, not `(1 − e^{a Δt}) m x`, and not the dissipating Dirac `m x`; `ε ≥ 0` fails closed; Eq. 5 of that contribution is `τ + λ(μ_t + a_{ηξ} x (e^{ε Δt} − e^{a Δt}) / (ε − a)`; the extra process has `LAMBDA` 0 and is not an observed indicator; `τ + λ μ_t` is not that observed mean; `τ + λ(μ_t + m x)` is not that observed mean; the contribution is not `E(y_t)`; the evolved-plus-contribution latent mean is not `E(y_t)`; after-t0 extra-process `TDPREDEFFECT` is `a_{ηξ} x (e^{ε(t−u)} − e^{a(t−u)}) / (ε − a)` for `t0 < u < t` while `μ_t` uses `Δt`; Eq. 5 of that after-t0 contribution is `τ + λ(μ_t + a_{ηξ} x (e^{ε(t−u)} − e^{a(t−u)}) / (ε − a)`; the first-occasion extra-process observed mean is not that observed mean when `u ≠ t0`; `e^{a(t−u)} m x` is a Dirac on the original process, not this `DRIFT` drive; §7.2 `asymTIPREDEFFECT` is `-B z / a` for `a < 0` (`-B z / a` is not the coefficient `B`, not `A^{-1}[e^{A Δt} − I] B z`, not `CINT`, and not `M x`; §7.2 `addedTIPREDVAR` is `(B / a)² v`, not `TRAITVAR`, not `asymDIFFUSION`, and not `-B z / a`; Table 2 `asymCINT` is `-κ / a` for `a < 0` and is not `κ`, not `A^{-1}[e^{A Δt} − I] κ`, not `T0MEANS`, and not `-B z / a`; p. 16 stationary `T0MEANS` is `-κ / a + −B z / a` and is not free `T0MEANS`, not `asymCINT` alone, not `asymTIPREDEFFECT` alone, and not the finite-interval discrete latent mean; Eq. 5 of that constrained mean is `τ + λ(−κ / a + −B z / a)`; `τ + λ μ_0` is not that observed mean; `τ + λ(−κ / a)` is not that observed mean when `B z ≠ 0`; `τ + λ μ_t` is not that observed mean; `MANIFESTMEANS` is not `E(y_0)`; the constrained latent mean is not `E(y_0)`; stationary `T0VAR` is `trait + −q / (2 a) + (B / a)² v` (not free `T0VAR`, not `asymDIFFUSION` alone, not `TRAITVAR` alone, not `addedTIPREDVAR` alone, and not the finite-interval discrete latent variance. Eq. 5 of that constrained variance is `λ²(trait + −q / (2 a) + (B / a)² v) + θ + ψ` (JSS PDF re-opened 2026-08-22T03:20Z; form the stationary latent variance first, then `λ² p + θ + ψ`; `λ² p_0` is not that observed variance; `λ²(−q / (2 a)) + θ` is not that observed variance when `TRAITVAR` or `addedTIPREDVAR` is nonzero; `MANIFESTVAR` is not `Var(y_0)`; the constrained latent variance is not `Var(y_0)`); lagged stationary `T0VAR` is `trait + e^{a Δt}(−q / (2 a)) + (B / a)² v` (trait and `addedTIPREDVAR` do not decay; contemporaneous `T0VAR` is not that lagged map; decaying the constrained total as if it were all state is not that lagged map; Eq. 5 of that lagged covariance is `λ²(trait + e^{a Δt}(−q / (2 a)) + (B / a)² v) + ψ`; `Θ` does not enter; contemporaneous `Var(y_0)` is not that lagged observed covariance; the lagged latent covariance is not that observed covariance); later-occasion stationary `T0VAR` is `trait + e^{2 a Δt}(−q / (2 a)) + Q_Δt + (B / a)² v` (trait and `addedTIPREDVAR` do not enter `Q_Δt`; under stationarity that composition equals contemporaneous `T0VAR`; evolving the constrained total as if it were all state is not that later map; the lagged covariance omits `Q_Δt`; `Q_Δt` is not that later map; Eq. 5 of that later-occasion variance is `λ²(trait + e^{2 a Δt}(−q / (2 a)) + Q_Δt + (B / a)² v) + θ + ψ`; lagged observed covariance omits `Q_Δt` and `θ`; `MANIFESTVAR` is not `Var(y_t)`; the later-occasion latent variance is not `Var(y_t)`))), irregular already-centered residual lag, Rubin `T` on OLS loadings, and strong-gated latent means (two-observation residual variance is identically `0` and caps at strong/scalar; Putnick & Bornstein, 2016) | -| `validation_core` | RMSE, bias, coverage, graph, and Monte Carlo metrics | -| `tepp_api` | versioned DTO, schema, and export contracts | -| `psychometric_core` | posterior-aware structural input gates, CWC within/between OLS plus the contextual effect, event-time log-rate, unequal-interval discrete-lag remapping, constant-predictor discrete effect, time-varying-predictor discrete effect (Eq. 14), exact scalar discrete process noise (Driver et al., 2017, Eq. 3), lagged latent covariance and unconditional latent variance (Driver et al., 2017, Eq. 3–4), stationary within-subject variance (Driver et al., 2017, Eq. 4 as `Δt → ∞`; `asymDIFFUSION`), trait-plus-state variance (Driver et al., 2017, §4.3 `TRAITVAR`; not process noise), observed-indicator variance and lagged observed covariance (Driver et al., 2017, Eq. 5; Table 2 `MANIFESTVAR` is `Θ`, not `Var(y)`; `MANIFESTTRAITVAR` is not `MANIFESTVAR`; `Θ` does not enter lagged observed covariance; observed-indicator mean is `τ + λ μ`; `MANIFESTMEANS` is not `E(y)`; `CINT` is not `MANIFESTMEANS`; discrete latent mean is `exp(a Δt) μ_0 + (exp(a Δt) − 1)/a κ`; `T0MEANS` is not `μ_t`; `CINT` is not the discrete increment; evolved observed mean is `τ + λ μ_t`; `τ + λ μ_0` is not `E(y_t)`; contemporaneous `TDPREDEFFECT` impulse is `m x`, not `CINT`, not `TIPREDEFFECT`, and not Voelkle Eq. 14; Eq. 5 of that contemporaneous impulse is `τ + λ(μ_t + m x)`, and `τ + λ μ_t` is not that observed mean; time-independent `TIPREDEFFECT` increment is `A^{-1}[e^{A Δt} − I] B z`, not `CINT`, not `M x`, not Voelkle Eq. 14, and not the coefficient `B`; Eq. 5 of that increment is `τ + λ(μ_t + A^{-1}[e^{A Δt} − I] B z)`, and `τ + λ μ_t` is not that observed mean; `τ + λ(μ_t + m x)` is not that observed mean; `τ + λ(μ_t + e^{a(t−u)} m x)` is not that observed mean when `u ≠ t`; within-interval `TDPREDEFFECT` carry is `e^{A(t−u)} M x` for `t0 < u < t`, not the contemporaneous Dirac, not `CINT`, not `TIPREDEFFECT`, and not Voelkle Eq. 14; Eq. 5 of that carry is `τ + λ(μ_t + e^{a(t−u)} m x)`, and `τ + λ μ_t` is not that observed mean; `τ + λ(μ_t + m x)` is not that carried observed mean when `u ≠ t`; first-occasion `T0TIPREDEFFECT` shift is `t0_b z` and Eq. 3 first-summand carry is `e^{A Δt} t0_b z` (`T0TIPREDEFFECT` is not `TIPREDEFFECT` `B`; `t0_b z` is not `A^{-1}[e^{A Δt} − I] B z`; `e^{A Δt} t0_b z` is not `t0_b z`; Eq. 5 of that carry is `τ + λ(μ_t + e^{a Δt} t0_b z)`, and `τ + λ μ_t` is not that observed mean; `τ + λ(μ_t + A^{-1}[e^{A Δt} − I] B z)` is not that observed mean), first-occasion `T0TDPREDEFFECT` shift is `t0_m x0` and Eq. 3 first-summand carry is `e^{A Δt} t0_m x0` (`T0TDPREDEFFECT` is not `TDPREDEFFECT` `M`; `t0_m x0` is not `M x`; `e^{A Δt} t0_m x0` is not `t0_m x0`; `e^{A Δt} t0_m x0` is not `e^{A(t−u)} M x` for `t0 < u < t`; `t0_m x0` is not `t0_b z`; an impulse at `u ≤ t0` that used `M` is already in `η(t0)` as `TDPREDEFFECT`, not as `T0TDPREDEFFECT`; Eq. 5 of that carry is `τ + λ(μ_t + e^{a Δt} t0_m x0)`, and `τ + λ μ_t` is not that observed mean; `τ + λ(μ_t + A^{-1}[e^{A Δt} − I] B z)` is not that observed mean; `τ + λ(μ_t + e^{a Δt} t0_b z)` is not that observed mean; §7.2 level-change `CINT` is `κ = −a m x` with `a < 0` so `−κ / a = m x` (`−a m x` is not the dissipating Dirac, not a free `CINT`, not `TIPREDEFFECT`, and not the extra near-zero-drift latent process also named in §7.2; Eq. 3 of that setting is `(1 − e^{a Δt}) m x`, which is not `m x`, not `κ`, and not `TIPREDEFFECT`; §7.2 extra-process contribution is `a_{ηξ} x (e^{ε Δt} − e^{a Δt}) / (ε − a)` (`ε = a` is `a_{ηξ} x Δt e^{a Δt}`; identification `TDPREDEFFECT` on the extra process is 1; printed extra `DRIFT` is `−0.000001`; not `κ = −a m x`, not `(1 − e^{a Δt}) m x`, and not the dissipating Dirac `m x`; `ε ≥ 0` fails closed; Eq. 5 of that contribution is `τ + λ(μ_t + a_{ηξ} x (e^{ε Δt} − e^{a Δt}) / (ε − a)`; the extra process has `LAMBDA` 0 and is not an observed indicator; `τ + λ μ_t` is not that observed mean; `τ + λ(μ_t + m x)` is not that observed mean; the contribution is not `E(y_t)`; the evolved-plus-contribution latent mean is not `E(y_t)`; after-t0 extra-process `TDPREDEFFECT` is `a_{ηξ} x (e^{ε(t−u)} − e^{a(t−u)}) / (ε − a)` for `t0 < u < t` while `μ_t` uses `Δt`; Eq. 5 of that after-t0 contribution is `τ + λ(μ_t + a_{ηξ} x (e^{ε(t−u)} − e^{a(t−u)}) / (ε − a)`; the first-occasion extra-process observed mean is not that observed mean when `u ≠ t0`; `e^{a(t−u)} m x` is a Dirac on the original process, not this `DRIFT` drive; §7.2 `asymTIPREDEFFECT` is `-B z / a` for `a < 0` (`-B z / a` is not the coefficient `B`, not `A^{-1}[e^{A Δt} − I] B z`, not `CINT`, and not `M x`; §7.2 `addedTIPREDVAR` is `(B / a)² v`, not `TRAITVAR`, not `asymDIFFUSION`, and not `-B z / a`; Table 2 `asymCINT` is `-κ / a` for `a < 0` and is not `κ`, not `A^{-1}[e^{A Δt} − I] κ`, not `T0MEANS`, and not `-B z / a`; p. 16 stationary `T0MEANS` is `-κ / a + −B z / a` and is not free `T0MEANS`, not `asymCINT` alone, not `asymTIPREDEFFECT` alone, and not the finite-interval discrete latent mean; Eq. 5 of that constrained mean is `τ + λ(−κ / a + −B z / a)`; `τ + λ μ_0` is not that observed mean; `τ + λ(−κ / a)` is not that observed mean when `B z ≠ 0`; `τ + λ μ_t` is not that observed mean; `MANIFESTMEANS` is not `E(y_0)`; the constrained latent mean is not `E(y_0)`; stationary `T0VAR` is `trait + −q / (2 a) + (B / a)² v` (not free `T0VAR`, not `asymDIFFUSION` alone, not `TRAITVAR` alone, not `addedTIPREDVAR` alone, and not the finite-interval discrete latent variance. Eq. 5 of that constrained variance is `λ²(trait + −q / (2 a) + (B / a)² v) + θ + ψ` (JSS PDF re-opened 2026-08-22T03:20Z; form the stationary latent variance first, then `λ² p + θ + ψ`; `λ² p_0` is not that observed variance; `λ²(−q / (2 a)) + θ` is not that observed variance when `TRAITVAR` or `addedTIPREDVAR` is nonzero; `MANIFESTVAR` is not `Var(y_0)`; the constrained latent variance is not `Var(y_0)`); lagged stationary `T0VAR` is `trait + e^{a Δt}(−q / (2 a)) + (B / a)² v` (trait and `addedTIPREDVAR` do not decay; contemporaneous `T0VAR` is not that lagged map; decaying the constrained total as if it were all state is not that lagged map; Eq. 5 of that lagged covariance is `λ²(trait + e^{a Δt}(−q / (2 a)) + (B / a)² v) + ψ`; `Θ` does not enter; contemporaneous `Var(y_0)` is not that lagged observed covariance; the lagged latent covariance is not that observed covariance); later-occasion stationary `T0VAR` is `trait + e^{2 a Δt}(−q / (2 a)) + Q_Δt + (B / a)² v` (trait and `addedTIPREDVAR` do not enter `Q_Δt`; under stationarity that composition equals contemporaneous `T0VAR`; evolving the constrained total as if it were all state is not that later map; the lagged covariance omits `Q_Δt`; `Q_Δt` is not that later map; Eq. 5 of that later-occasion variance is `λ²(trait + e^{2 a Δt}(−q / (2 a)) + Q_Δt + (B / a)² v) + θ + ψ`; lagged observed covariance omits `Q_Δt` and `θ`; `MANIFESTVAR` is not `Var(y_t)`; the later-occasion latent variance is not `Var(y_t)`); predetermined later-occasion `T0VAR` is `trait + e^{2 a Δt} p_0 + Q_Δt + (B / a)² v` (free `T0VAR` `p_0` is not that later map; setting `p_0 = −q / (2 a)` recovers the stationary later-occasion map; stationary later variance uses `−q / (2 a)` in place of `p_0` and is not that later map when `p_0` is free; evolving `trait + p_0 + (B / a)² v` as if it were all state is not that later map; Eq. 5 of that predetermined later-occasion variance is `λ²(trait + e^{2 a Δt} p_0 + Q_Δt + (B / a)² v) + θ + ψ`; `MANIFESTVAR` is not `Var(y_t)`; the predetermined later-occasion latent variance is not `Var(y_t)`; stationary later observed variance is not that observed variance when `p_0` is free); predetermined lagged `T0VAR` is `trait + e^{a Δt} p_0 + (B / a)² v` (free `T0VAR` `p_0` is not that lagged map; setting `p_0 = −q / (2 a)` recovers the stationary lagged map; stationary lagged covariance uses `−q / (2 a)` in place of `p_0` and is not that lagged map when `p_0` is free; evolving `trait + p_0 + (B / a)² v` as if it were all state is not that lagged map; later-occasion variance includes `Q_Δt` and is not that lagged map; Eq. 5 of that predetermined lagged covariance is `λ²(trait + e^{a Δt} p_0 + (B / a)² v) + ψ`; `MANIFESTVAR` does not enter; the predetermined lagged latent covariance is not that observed covariance; predetermined later observed variance includes `Q_Δt` and `θ` and is not that lagged observed covariance; stationary lagged observed covariance is not that observed covariance when `p_0` is free; the predetermined first-occasion variance of §4.3 predetermined `T0VAR` is `trait + p_0 + (B / a)² v`; free `p_0` is not that map; stationary first-occasion variance uses `−q / (2 a)` in place of `p_0` and is not that map when `p_0` is free; lagged covariance decays the state and is not that map; later-occasion variance includes `Q_Δt` and is not that map; Eq. 5 of that predetermined first-occasion variance is `λ²(trait + p_0 + (B / a)² v) + θ + ψ`; `MANIFESTVAR` is not that first-occasion observed variance; the predetermined first-occasion latent variance is not that observed variance; stationary first-occasion observed variance is not that observed variance when `p_0` is free; predetermined later observed variance includes `Q_Δt` and is not that first-occasion observed variance; later-start lagged covariance of predetermined `T0VAR` is `trait + e^{a s}(e^{2 a u} p_0 + Q_u) + (B / a)² v` (Driver et al., 2017, §4.3 `startoffset`; Eq. 4; JSS PDF re-opened 2026-08-23T10:27Z; first-occasion lagged omits `e^{a s} Q_u`; later-occasion variance does not lag; stationary lagged uses `−q / (2 a)`; decaying the later total is not that map; Eq. 5 of that later-start lagged covariance is `λ²` of it plus `ψ`; `Θ` does not enter; first-occasion lagged observed omits `e^{a s} Q_u`; later observed variance includes `Q_u` and `θ`; later-start later-occasion variance of predetermined `T0VAR` is `trait + e^{2 a s}(e^{2 a u} p_0 + Q_u) + Q_s + (B / a)² v` (Driver et al., 2017, §4.3 `startoffset`; Eq. 3–4 Chapman–Kolmogorov `Q_{u+s} = e^{2 a s} Q_u + Q_s`; JSS PDF re-opened 2026-08-23T11:05Z; later-occasion variance at `u` omits `Q_s`; later-start lagged covariance omits `Q_s`; stationary later uses `−q / (2 a)`; evolving the later total as if it were all state is not that map; ignoring `startoffset` omits `e^{2 a s} Q_u`; Eq. 5 of that later-start later-occasion variance is `λ²` of it plus `θ + ψ`; `MANIFESTVAR` is not that observed variance; p. 16 `discreteDRIFTstd` is `e^{a Δt}` after strictly positive `asymDIFFUSION` `-q / (2 a)` (footnote 4; unstandardised `e^{a Δt}` is defined for growing `a ≥ 0` and for zero diffusion and is not `discreteDRIFTstd`; the §7.1 trait-plus-state autocorrelation uses `TRAITVAR` and is not `discreteDRIFTstd`; `TRAITVAR` is not the standardisation variance; p. 16 `discreteDIFFUSIONstd` is `Q_Δt / (−q / (2 a))` after strictly positive `asymDIFFUSION` `-q / (2 a)` (footnote 4; unstandardised `Q_Δt` is defined for growing `a ≥ 0` and for zero diffusion and is not `discreteDIFFUSIONstd`; the continuous standardisation `−2 a` is not `discreteDIFFUSIONstd`; `Q_Δt / (trait + p + added)` uses `TRAITVAR` and is not `discreteDIFFUSIONstd`; `TRAITVAR` is not the standardisation variance; p. 16 `DIFFUSIONstd` is `q / (−q / (2 a)) = −2 a` after strictly positive `asymDIFFUSION` `-q / (2 a)` (Driver et al., 2017, p. 16; Eq. 4; footnote 4; JSS PDF re-opened 2026-08-23T13:20Z; unstandardised `q` is defined for growing `a ≥ 0` and for zero diffusion and is not `DIFFUSIONstd`; the discrete standardisation `Q_Δt / (−q / (2 a))` depends on `Δt` and is not `DIFFUSIONstd`; `q / (trait + p + added)` uses `TRAITVAR` and is not `DIFFUSIONstd`; `TRAITVAR` is not the standardisation variance; p. 16 `DRIFTstd` is the continuous auto-effect after strictly positive `asymDIFFUSION` `-q / (2 a)` (Driver et al., 2017, p. 16; Eq. 1; footnote 4; JSS PDF re-opened 2026-08-23T13:28Z); unstandardised `a` is defined for growing `a ≥ 0` and for zero diffusion and is not `DRIFTstd`; the discrete standardisation `e^{a Δt}` depends on the event interval and is not `DRIFTstd`; `a p / (trait + p + added)` uses `TRAITVAR` and is not `DRIFTstd`; `TRAITVAR` is not the standardisation variance); p. 16 `asymTIPREDEFFECTstd` is `(-B / a) · √v / √(-q / (2 a))` after strictly positive `asymDIFFUSION` `-q / (2 a)` and strictly positive predictor variance `v` (Driver et al., 2017, p. 16; §7.2; footnote 4; JSS PDF re-opened 2026-08-23T14:25Z; unstandardised `-B / a` is defined for a zero coefficient and for zero predictor variance and is not `asymTIPREDEFFECTstd`; the finite-interval standardisation `A^{-1}[e^{A Δt} − I] B · √v / √p` depends on the event interval and is not `asymTIPREDEFFECTstd`; `(-B / a) · √v / √(trait + p + added)` uses `TRAITVAR` and is not `asymTIPREDEFFECTstd`; `TRAITVAR` is not the standardisation variance); p. 16 `TIPREDEFFECTstd` is `B · √v / √(-q / (2 a))` after strictly positive `asymDIFFUSION` `-q / (2 a)` and strictly positive predictor variance `v` (Driver et al., 2017, p. 16; §7.2; footnote 4; JSS PDF re-opened 2026-08-23T16:21Z; unstandardised `B` is defined for a zero coefficient and for zero predictor variance and is not `TIPREDEFFECTstd`; the asymptotic standardisation `(-B / a) · √v / √p` is the total change and is not `TIPREDEFFECTstd`; the finite-interval standardisation `A^{-1}[e^{A Δt} − I] B · √v / √p` depends on the event interval and is not `TIPREDEFFECTstd`; `B · √v / √(trait + p + added)` uses `TRAITVAR` and is not `TIPREDEFFECTstd`; `TRAITVAR` is not the standardisation variance); Table 3 `T0TIPREDEFFECTstd` is `t0_b · √v / √p_0` after strictly positive free `T0VAR` `p_0` and strictly positive predictor variance `v` (Driver et al., 2017, Table 3, p. 13; p. 16; footnote 4; 2017-era ctsem `summary.ctsemFit.R`; JSS PDF re-opened 2026-08-23T17:20Z; the affected variance is free `T0VAR`, not `asymDIFFUSION`; unstandardised `t0_b` is defined for a zero coefficient and for zero predictor variance and is not `T0TIPREDEFFECTstd`; `TIPREDEFFECTstd` `B · √v / √(-q / (2 a))` is the continuous coefficient and is not `T0TIPREDEFFECTstd`; `asymTIPREDEFFECTstd` `(-B / a) · √v / √p` is the total change and is not `T0TIPREDEFFECTstd`; `t0_b · √v / √(trait + p_0 + added)` uses `TRAITVAR` and is not `T0TIPREDEFFECTstd`; `TRAITVAR` is not the standardisation variance); 2017-era `addedT0TIPREDVAR` is `t0_b² v` (Driver et al., 2017, Table 3, p. 13; p. 16; §7.2; 2017-era ctsem `summary.ctsemFit.R`; JSS PDF re-opened 2026-08-23T18:20Z; `T0TIPREDEFFECT %*% TIPREDVAR %*% t(T0TIPREDEFFECT)` immediately after `T0TIPREDEFFECTstd`; form `t0_b` first, then square, then multiply by `v`; a zero coefficient or zero predictor variance is exactly zero; free `T0TIPREDEFFECT` does not require `a < 0`; `(B / a)² v` is `addedTIPREDVAR` and is not this first-occasion map; `t0_b · √v / √p_0` is `T0TIPREDEFFECTstd` and is not this variance; free `T0VAR` is not this extra TI variance; `TRAITVAR` is not this extra TI variance; Equation 5 of 2017-era `addedT0TIPREDVAR` is `λ² t0_b² v` (Driver et al., 2017, Eq. 5, p. 5; Table 3, p. 13; Table 2, p. 12; 2017-era ctsem `summary.ctsemFit.R`; JSS PDF re-opened 2026-08-23T19:10Z; form `t0_b² v` first, then `(λ extra) λ` with `θ = 0`; a zero loading or zero extra is exactly zero; `t0_b² v` is the latent extra, not the observed extra; `λ² p_0 + θ` is first-occasion observed variance, not this extra; `λ² (B / a)² v` is Eq. 5 of `addedTIPREDVAR`, not this first-occasion observed extra; `MANIFESTVAR` `θ` is not this extra; Equation 5 of §7.2 `addedTIPREDVAR` is `λ² (B / a)² v`; form `(B / a)² v` first, then `(λ extra) λ` with `θ = 0`; a zero loading or zero extra is exactly zero; lasting asymptotic extra requires `a < 0`; `(B / a)² v` is the latent extra, not the observed extra; `λ² t0_b² v` is first-occasion extra observed TI variance, not this extra; `λ² p + θ` is stationary observed variance, not this extra; `MANIFESTVAR` `θ` is not this extra; p. 16 `TDPREDEFFECTstd` is `m · √v / √(-q / (2 a))` after strictly positive `asymDIFFUSION` and strictly positive time-dependent predictor variance; unstandardised `M` is not `TDPREDEFFECTstd`; `TIPREDEFFECTstd` is not `TDPREDEFFECTstd` even when `M = B`; intercept-style `A^{-1}[e^{A Δt} − I] M · √v / √p` is not `TDPREDEFFECTstd`; `m · √v / √(trait + p + added)` uses `TRAITVAR` and is not `TDPREDEFFECTstd`; Table 3 / p. 16 `T0TDPREDEFFECTstd` is `t0_m · √v / √p_0` after strictly positive free `T0VAR` and strictly positive TD predictor variance; unstandardised `t0_m` is not `T0TDPREDEFFECTstd`; `TDPREDEFFECTstd` uses `asymDIFFUSION` and is not `T0TDPREDEFFECTstd`; `T0TIPREDEFFECTstd` is not `T0TDPREDEFFECTstd` even when `t0_m = t0_b`; `t0_m · √v / √(trait + p_0 + added)` uses `TRAITVAR` and is not `T0TDPREDEFFECTstd`; free `T0VAR` does not require `a < 0`; p. 16 `T0VARstd` is `p_0 / p_0 = 1` after strictly positive free `T0VAR` (`solve(sqrt(diag(T0VAR))) %&% T0VAR`; OpenMx `%&%` is `t(A) %*% B %*% A`; default ridge is 0); unstandardised `T0VAR` is not `T0VARstd`; `T0TDPREDEFFECTstd` is not `T0VARstd`; `addedT0TIPREDVAR` is not `T0VARstd`; p. 16 `TRAITVARstd` is `trait / trait = 1` after strictly positive `TRAITVAR` (`solve(sqrt(diag(TRAITVAR))) %&% TRAITVAR`; OpenMx `%&%` is `t(A) %*% B %*% A`; no ridge addend); unstandardised `TRAITVAR` is not `TRAITVARstd`; `T0VARstd` is not `TRAITVARstd` even when both equal 1; `addedT0TIPREDVAR` is not `TRAITVARstd`; p. 16 `MANIFESTTRAITVARstd` is `ψ / ψ = 1` after strictly positive `MANIFESTTRAITVAR` (`solve(sqrt(diag(MANIFESTTRAITVAR))) %&% MANIFESTTRAITVAR`; OpenMx `%&%` is `t(A) %*% B %*% A`; 2017-era source adds ridging; default ridge is 0); unstandardised `MANIFESTTRAITVAR` is not `MANIFESTTRAITVARstd`; `TRAITVARstd` is not `MANIFESTTRAITVARstd` even when both equal 1; `MANIFESTVAR` is not `MANIFESTTRAITVARstd`; p. 16 `MANIFESTVARstd` is `θ / θ = 1` after strictly positive `MANIFESTVAR` (`solve(sqrt(diag(MANIFESTVAR))) %&% MANIFESTVAR`; OpenMx `%&%` is `t(A) %*% B %*% A`; 2017-era source adds ridging; default ridge is 0; 2017-era `dimnames` assignment to `latentNames` is a source bug); unstandardised `MANIFESTVAR` is not `MANIFESTVARstd`; `MANIFESTTRAITVARstd` is not `MANIFESTVARstd` even when both equal 1; Equation 5 `Var(y)` is not `MANIFESTVARstd`; p. 16 `TIPREDVARstd` is `v / v = 1` after strictly positive `TIPREDVAR` (`solve(sqrt(diag(TIPREDVAR))) %&% TIPREDVAR`; OpenMx `%&%` is `t(A) %*% B %*% A`; 2017-era source adds ridging; default ridge is 0; `dimnames` are `TIpredNames`); unstandardised `TIPREDVAR` is not `TIPREDVARstd`; `MANIFESTVARstd` is not `TIPREDVARstd` even when both equal 1; §7.2 `addedTIPREDVAR` is not `TIPREDVARstd`; p. 16 `asymDIFFUSIONstd` is `p / p = 1` after strictly positive `asymDIFFUSION` (`solve(sqrt(diag(asymDIFFUSION))) %&% asymDIFFUSION`; OpenMx `%&%` is `t(A) %*% B %*% A`; 2017-era source adds ridging; default ridge is 0; `dimnames` are `latentNames`); unstandardised `asymDIFFUSION` is not `asymDIFFUSIONstd`; `TIPREDVARstd` is not `asymDIFFUSIONstd` even when both equal 1; `DIFFUSIONstd` `−2 a` is not `asymDIFFUSIONstd`; p. 16 `discreteCINTstd` is `A^{-1}[e^{A Δt} − I] κ / √p` after strictly positive `asymDIFFUSION`; unstandardised `discreteCINT` is not `discreteCINTstd`; `κ / √p` is not `discreteCINTstd`; `(-κ / a) / √p` is not `discreteCINTstd`; `asymCINTstd` is `(-κ / a) / √p` after strictly positive `asymDIFFUSION`; unstandardised `asymCINT` is not `asymCINTstd`; `κ / √p` is not `asymCINTstd`; `discreteCINTstd` is not `asymCINTstd`; `T0MEANSstd` is `μ_0 / √p_0` after strictly positive free `T0VAR`; unstandardised `T0MEANS` is not `T0MEANSstd`; `T0VARstd` is not `T0MEANSstd`; `μ_0 / √asymDIFFUSION` is not `T0MEANSstd`; `MANIFESTMEANSstd` is `τ / √θ` after strictly positive `MANIFESTVAR`; unstandardised `MANIFESTMEANS` is not `MANIFESTMEANSstd`; `MANIFESTVARstd` is not `MANIFESTMEANSstd`; `τ / √(λ² Var(η) + θ)` is not `MANIFESTMEANSstd`; p. 16 `CINTstd` is `κ / √p` after strictly positive `asymDIFFUSION`; unstandardised `CINT` is not `CINTstd`; `asymCINTstd` is not `CINTstd`; `discreteCINTstd` is not `CINTstd`; `κ / √(trait + p + added)` is not `CINTstd`;))))), irregular already-centered residual lag, Rubin `T` on OLS loadings, and strong-gated latent means (two-observation residual variance is identically `0` and caps at strong/scalar; Putnick & Bornstein, 2016) | -| `psychometric_core` | posterior-aware structural input gates, CWC within/between OLS plus the contextual effect, event-time log-rate, unequal-interval discrete-lag remapping, constant-predictor discrete effect, time-varying-predictor discrete effect (Eq. 14), exact scalar discrete process noise (Driver et al., 2017, Eq. 3), lagged latent covariance and unconditional latent variance (Driver et al., 2017, Eq. 3–4), stationary within-subject variance (Driver et al., 2017, Eq. 4 as `Δt → ∞`; `asymDIFFUSION`), trait-plus-state variance (Driver et al., 2017, §4.3 `TRAITVAR`; not process noise), observed-indicator variance and lagged observed covariance (Driver et al., 2017, Eq. 5; Table 2 `MANIFESTVAR` is `Θ`, not `Var(y)`; `MANIFESTTRAITVAR` is not `MANIFESTVAR`; `Θ` does not enter lagged observed covariance; observed-indicator mean is `τ + λ μ`; `MANIFESTMEANS` is not `E(y)`; `CINT` is not `MANIFESTMEANS`; discrete latent mean is `exp(a Δt) μ_0 + (exp(a Δt) − 1)/a κ`; `T0MEANS` is not `μ_t`; `CINT` is not the discrete increment; evolved observed mean is `τ + λ μ_t`; `τ + λ μ_0` is not `E(y_t)`; contemporaneous `TDPREDEFFECT` impulse is `m x`, not `CINT`, not `TIPREDEFFECT`, and not Voelkle Eq. 14; Eq. 5 of that contemporaneous impulse is `τ + λ(μ_t + m x)`, and `τ + λ μ_t` is not that observed mean; time-independent `TIPREDEFFECT` increment is `A^{-1}[e^{A Δt} − I] B z`, not `CINT`, not `M x`, not Voelkle Eq. 14, and not the coefficient `B`; Eq. 5 of that increment is `τ + λ(μ_t + A^{-1}[e^{A Δt} − I] B z)`, and `τ + λ μ_t` is not that observed mean; `τ + λ(μ_t + m x)` is not that observed mean; `τ + λ(μ_t + e^{a(t−u)} m x)` is not that observed mean when `u ≠ t`; within-interval `TDPREDEFFECT` carry is `e^{A(t−u)} M x` for `t0 < u < t`, not the contemporaneous Dirac, not `CINT`, not `TIPREDEFFECT`, and not Voelkle Eq. 14; Eq. 5 of that carry is `τ + λ(μ_t + e^{a(t−u)} m x)`, and `τ + λ μ_t` is not that observed mean; `τ + λ(μ_t + m x)` is not that carried observed mean when `u ≠ t`; first-occasion `T0TIPREDEFFECT` shift is `t0_b z` and Eq. 3 first-summand carry is `e^{A Δt} t0_b z` (`T0TIPREDEFFECT` is not `TIPREDEFFECT` `B`; `t0_b z` is not `A^{-1}[e^{A Δt} − I] B z`; `e^{A Δt} t0_b z` is not `t0_b z`; Eq. 5 of that carry is `τ + λ(μ_t + e^{a Δt} t0_b z)`, and `τ + λ μ_t` is not that observed mean; `τ + λ(μ_t + A^{-1}[e^{A Δt} − I] B z)` is not that observed mean), first-occasion `T0TDPREDEFFECT` shift is `t0_m x0` and Eq. 3 first-summand carry is `e^{A Δt} t0_m x0` (`T0TDPREDEFFECT` is not `TDPREDEFFECT` `M`; `t0_m x0` is not `M x`; `e^{A Δt} t0_m x0` is not `t0_m x0`; `e^{A Δt} t0_m x0` is not `e^{A(t−u)} M x` for `t0 < u < t`; `t0_m x0` is not `t0_b z`; an impulse at `u ≤ t0` that used `M` is already in `η(t0)` as `TDPREDEFFECT`, not as `T0TDPREDEFFECT`; Eq. 5 of that carry is `τ + λ(μ_t + e^{a Δt} t0_m x0)`, and `τ + λ μ_t` is not that observed mean; `τ + λ(μ_t + A^{-1}[e^{A Δt} − I] B z)` is not that observed mean; `τ + λ(μ_t + e^{a Δt} t0_b z)` is not that observed mean; §7.2 level-change `CINT` is `κ = −a m x` with `a < 0` so `−κ / a = m x` (`−a m x` is not the dissipating Dirac, not a free `CINT`, not `TIPREDEFFECT`, and not the extra near-zero-drift latent process also named in §7.2; Eq. 3 of that setting is `(1 − e^{a Δt}) m x`, which is not `m x`, not `κ`, and not `TIPREDEFFECT`; §7.2 extra-process contribution is `a_{ηξ} x (e^{ε Δt} − e^{a Δt}) / (ε − a)` (`ε = a` is `a_{ηξ} x Δt e^{a Δt}`; identification `TDPREDEFFECT` on the extra process is 1; printed extra `DRIFT` is `−0.000001`; not `κ = −a m x`, not `(1 − e^{a Δt}) m x`, and not the dissipating Dirac `m x`; `ε ≥ 0` fails closed; Eq. 5 of that contribution is `τ + λ(μ_t + a_{ηξ} x (e^{ε Δt} − e^{a Δt}) / (ε − a)`; the extra process has `LAMBDA` 0 and is not an observed indicator; `τ + λ μ_t` is not that observed mean; `τ + λ(μ_t + m x)` is not that observed mean; the contribution is not `E(y_t)`; the evolved-plus-contribution latent mean is not `E(y_t)`; after-t0 extra-process `TDPREDEFFECT` is `a_{ηξ} x (e^{ε(t−u)} − e^{a(t−u)}) / (ε − a)` for `t0 < u < t` while `μ_t` uses `Δt`; Eq. 5 of that after-t0 contribution is `τ + λ(μ_t + a_{ηξ} x (e^{ε(t−u)} − e^{a(t−u)}) / (ε − a)`; the first-occasion extra-process observed mean is not that observed mean when `u ≠ t0`; `e^{a(t−u)} m x` is a Dirac on the original process, not this `DRIFT` drive; §7.2 `asymTIPREDEFFECT` is `-B z / a` for `a < 0` (`-B z / a` is not the coefficient `B`, not `A^{-1}[e^{A Δt} − I] B z`, not `CINT`, and not `M x`; §7.2 `addedTIPREDVAR` is `(B / a)² v`, not `TRAITVAR`, not `asymDIFFUSION`, and not `-B z / a`; Table 2 `asymCINT` is `-κ / a` for `a < 0` and is not `κ`, not `A^{-1}[e^{A Δt} − I] κ`, not `T0MEANS`, and not `-B z / a`; p. 16 stationary `T0MEANS` is `-κ / a + −B z / a` and is not free `T0MEANS`, not `asymCINT` alone, not `asymTIPREDEFFECT` alone, and not the finite-interval discrete latent mean; Eq. 5 of that constrained mean is `τ + λ(−κ / a + −B z / a)`; `τ + λ μ_0` is not that observed mean; `τ + λ(−κ / a)` is not that observed mean when `B z ≠ 0`; `τ + λ μ_t` is not that observed mean; `MANIFESTMEANS` is not `E(y_0)`; the constrained latent mean is not `E(y_0)`; stationary `T0VAR` is `trait + −q / (2 a) + (B / a)² v` (not free `T0VAR`, not `asymDIFFUSION` alone, not `TRAITVAR` alone, not `addedTIPREDVAR` alone, and not the finite-interval discrete latent variance. Eq. 5 of that constrained variance is `λ²(trait + −q / (2 a) + (B / a)² v) + θ + ψ` (JSS PDF re-opened 2026-08-22T03:20Z; form the stationary latent variance first, then `λ² p + θ + ψ`; `λ² p_0` is not that observed variance; `λ²(−q / (2 a)) + θ` is not that observed variance when `TRAITVAR` or `addedTIPREDVAR` is nonzero; `MANIFESTVAR` is not `Var(y_0)`; the constrained latent variance is not `Var(y_0)`); lagged stationary `T0VAR` is `trait + e^{a Δt}(−q / (2 a)) + (B / a)² v` (trait and `addedTIPREDVAR` do not decay; contemporaneous `T0VAR` is not that lagged map; decaying the constrained total as if it were all state is not that lagged map; Eq. 5 of that lagged covariance is `λ²(trait + e^{a Δt}(−q / (2 a)) + (B / a)² v) + ψ`; `Θ` does not enter; contemporaneous `Var(y_0)` is not that lagged observed covariance; the lagged latent covariance is not that observed covariance); later-occasion stationary `T0VAR` is `trait + e^{2 a Δt}(−q / (2 a)) + Q_Δt + (B / a)² v` (trait and `addedTIPREDVAR` do not enter `Q_Δt`; under stationarity that composition equals contemporaneous `T0VAR`; evolving the constrained total as if it were all state is not that later map; the lagged covariance omits `Q_Δt`; `Q_Δt` is not that later map; Eq. 5 of that later-occasion variance is `λ²(trait + e^{2 a Δt}(−q / (2 a)) + Q_Δt + (B / a)² v) + θ + ψ`; lagged observed covariance omits `Q_Δt` and `θ`; `MANIFESTVAR` is not `Var(y_t)`; the later-occasion latent variance is not `Var(y_t)`); predetermined later-occasion `T0VAR` is `trait + e^{2 a Δt} p_0 + Q_Δt + (B / a)² v` (free `T0VAR` `p_0` is not that later map; setting `p_0 = −q / (2 a)` recovers the stationary later-occasion map; stationary later variance uses `−q / (2 a)` in place of `p_0` and is not that later map when `p_0` is free; evolving `trait + p_0 + (B / a)² v` as if it were all state is not that later map; Eq. 5 of that predetermined later-occasion variance is `λ²(trait + e^{2 a Δt} p_0 + Q_Δt + (B / a)² v) + θ + ψ`; `MANIFESTVAR` is not `Var(y_t)`; the predetermined later-occasion latent variance is not `Var(y_t)`; stationary later observed variance is not that observed variance when `p_0` is free); predetermined lagged `T0VAR` is `trait + e^{a Δt} p_0 + (B / a)² v` (free `T0VAR` `p_0` is not that lagged map; setting `p_0 = −q / (2 a)` recovers the stationary lagged map; stationary lagged covariance uses `−q / (2 a)` in place of `p_0` and is not that lagged map when `p_0` is free; evolving `trait + p_0 + (B / a)² v` as if it were all state is not that lagged map; later-occasion variance includes `Q_Δt` and is not that lagged map; Eq. 5 of that predetermined lagged covariance is `λ²(trait + e^{a Δt} p_0 + (B / a)² v) + ψ`; `MANIFESTVAR` does not enter; the predetermined lagged latent covariance is not that observed covariance; predetermined later observed variance includes `Q_Δt` and `θ` and is not that lagged observed covariance; stationary lagged observed covariance is not that observed covariance when `p_0` is free; the predetermined first-occasion variance of §4.3 predetermined `T0VAR` is `trait + p_0 + (B / a)² v`; free `p_0` is not that map; stationary first-occasion variance uses `−q / (2 a)` in place of `p_0` and is not that map when `p_0` is free; lagged covariance decays the state and is not that map; later-occasion variance includes `Q_Δt` and is not that map; Eq. 5 of that predetermined first-occasion variance is `λ²(trait + p_0 + (B / a)² v) + θ + ψ`; `MANIFESTVAR` is not that first-occasion observed variance; the predetermined first-occasion latent variance is not that observed variance; stationary first-occasion observed variance is not that observed variance when `p_0` is free; predetermined later observed variance includes `Q_Δt` and is not that first-occasion observed variance; later-start lagged covariance of predetermined `T0VAR` is `trait + e^{a s}(e^{2 a u} p_0 + Q_u) + (B / a)² v` (Driver et al., 2017, §4.3 `startoffset`; Eq. 4; JSS PDF re-opened 2026-08-23T10:27Z; first-occasion lagged omits `e^{a s} Q_u`; later-occasion variance does not lag; stationary lagged uses `−q / (2 a)`; decaying the later total is not that map; Eq. 5 of that later-start lagged covariance is `λ²` of it plus `ψ`; `Θ` does not enter; first-occasion lagged observed omits `e^{a s} Q_u`; later observed variance includes `Q_u` and `θ`; later-start later-occasion variance of predetermined `T0VAR` is `trait + e^{2 a s}(e^{2 a u} p_0 + Q_u) + Q_s + (B / a)² v` (Driver et al., 2017, §4.3 `startoffset`; Eq. 3–4 Chapman–Kolmogorov `Q_{u+s} = e^{2 a s} Q_u + Q_s`; JSS PDF re-opened 2026-08-23T11:05Z; later-occasion variance at `u` omits `Q_s`; later-start lagged covariance omits `Q_s`; stationary later uses `−q / (2 a)`; evolving the later total as if it were all state is not that map; ignoring `startoffset` omits `e^{2 a s} Q_u`; Eq. 5 of that later-start later-occasion variance is `λ²` of it plus `θ + ψ`; `MANIFESTVAR` is not that observed variance; p. 16 `discreteDRIFTstd` is `e^{a Δt}` after strictly positive `asymDIFFUSION` `-q / (2 a)` (footnote 4; unstandardised `e^{a Δt}` is defined for growing `a ≥ 0` and for zero diffusion and is not `discreteDRIFTstd`; the §7.1 trait-plus-state autocorrelation uses `TRAITVAR` and is not `discreteDRIFTstd`; `TRAITVAR` is not the standardisation variance; p. 16 `discreteDIFFUSIONstd` is `Q_Δt / (−q / (2 a))` after strictly positive `asymDIFFUSION` `-q / (2 a)` (footnote 4; unstandardised `Q_Δt` is defined for growing `a ≥ 0` and for zero diffusion and is not `discreteDIFFUSIONstd`; the continuous standardisation `−2 a` is not `discreteDIFFUSIONstd`; `Q_Δt / (trait + p + added)` uses `TRAITVAR` and is not `discreteDIFFUSIONstd`; `TRAITVAR` is not the standardisation variance; p. 16 `DIFFUSIONstd` is `q / (−q / (2 a)) = −2 a` after strictly positive `asymDIFFUSION` `-q / (2 a)` (Driver et al., 2017, p. 16; Eq. 4; footnote 4; JSS PDF re-opened 2026-08-23T13:20Z; unstandardised `q` is defined for growing `a ≥ 0` and for zero diffusion and is not `DIFFUSIONstd`; the discrete standardisation `Q_Δt / (−q / (2 a))` depends on `Δt` and is not `DIFFUSIONstd`; `q / (trait + p + added)` uses `TRAITVAR` and is not `DIFFUSIONstd`; `TRAITVAR` is not the standardisation variance; p. 16 `DRIFTstd` is the continuous auto-effect after strictly positive `asymDIFFUSION` `-q / (2 a)` (Driver et al., 2017, p. 16; Eq. 1; footnote 4; JSS PDF re-opened 2026-08-23T13:28Z); unstandardised `a` is defined for growing `a ≥ 0` and for zero diffusion and is not `DRIFTstd`; the discrete standardisation `e^{a Δt}` depends on the event interval and is not `DRIFTstd`; `a p / (trait + p + added)` uses `TRAITVAR` and is not `DRIFTstd`; `TRAITVAR` is not the standardisation variance); p. 16 `asymTIPREDEFFECTstd` is `(-B / a) · √v / √(-q / (2 a))` after strictly positive `asymDIFFUSION` `-q / (2 a)` and strictly positive predictor variance `v` (Driver et al., 2017, p. 16; §7.2; footnote 4; JSS PDF re-opened 2026-08-23T14:25Z; unstandardised `-B / a` is defined for a zero coefficient and for zero predictor variance and is not `asymTIPREDEFFECTstd`; the finite-interval standardisation `A^{-1}[e^{A Δt} − I] B · √v / √p` depends on the event interval and is not `asymTIPREDEFFECTstd`; `(-B / a) · √v / √(trait + p + added)` uses `TRAITVAR` and is not `asymTIPREDEFFECTstd`; `TRAITVAR` is not the standardisation variance); p. 16 `TIPREDEFFECTstd` is `B · √v / √(-q / (2 a))` after strictly positive `asymDIFFUSION` `-q / (2 a)` and strictly positive predictor variance `v` (Driver et al., 2017, p. 16; §7.2; footnote 4; JSS PDF re-opened 2026-08-23T16:21Z; unstandardised `B` is defined for a zero coefficient and for zero predictor variance and is not `TIPREDEFFECTstd`; the asymptotic standardisation `(-B / a) · √v / √p` is the total change and is not `TIPREDEFFECTstd`; the finite-interval standardisation `A^{-1}[e^{A Δt} − I] B · √v / √p` depends on the event interval and is not `TIPREDEFFECTstd`; `B · √v / √(trait + p + added)` uses `TRAITVAR` and is not `TIPREDEFFECTstd`; `TRAITVAR` is not the standardisation variance); Table 3 `T0TIPREDEFFECTstd` is `t0_b · √v / √p_0` after strictly positive free `T0VAR` `p_0` and strictly positive predictor variance `v` (Driver et al., 2017, Table 3, p. 13; p. 16; footnote 4; 2017-era ctsem `summary.ctsemFit.R`; JSS PDF re-opened 2026-08-23T17:20Z; the affected variance is free `T0VAR`, not `asymDIFFUSION`; unstandardised `t0_b` is defined for a zero coefficient and for zero predictor variance and is not `T0TIPREDEFFECTstd`; `TIPREDEFFECTstd` `B · √v / √(-q / (2 a))` is the continuous coefficient and is not `T0TIPREDEFFECTstd`; `asymTIPREDEFFECTstd` `(-B / a) · √v / √p` is the total change and is not `T0TIPREDEFFECTstd`; `t0_b · √v / √(trait + p_0 + added)` uses `TRAITVAR` and is not `T0TIPREDEFFECTstd`; `TRAITVAR` is not the standardisation variance); 2017-era `addedT0TIPREDVAR` is `t0_b² v` (Driver et al., 2017, Table 3, p. 13; p. 16; §7.2; 2017-era ctsem `summary.ctsemFit.R`; JSS PDF re-opened 2026-08-23T18:20Z; `T0TIPREDEFFECT %*% TIPREDVAR %*% t(T0TIPREDEFFECT)` immediately after `T0TIPREDEFFECTstd`; form `t0_b` first, then square, then multiply by `v`; a zero coefficient or zero predictor variance is exactly zero; free `T0TIPREDEFFECT` does not require `a < 0`; `(B / a)² v` is `addedTIPREDVAR` and is not this first-occasion map; `t0_b · √v / √p_0` is `T0TIPREDEFFECTstd` and is not this variance; free `T0VAR` is not this extra TI variance; `TRAITVAR` is not this extra TI variance; Equation 5 of 2017-era `addedT0TIPREDVAR` is `λ² t0_b² v` (Driver et al., 2017, Eq. 5, p. 5; Table 3, p. 13; Table 2, p. 12; 2017-era ctsem `summary.ctsemFit.R`; JSS PDF re-opened 2026-08-23T19:10Z; form `t0_b² v` first, then `(λ extra) λ` with `θ = 0`; a zero loading or zero extra is exactly zero; `t0_b² v` is the latent extra, not the observed extra; `λ² p_0 + θ` is first-occasion observed variance, not this extra; `λ² (B / a)² v` is Eq. 5 of `addedTIPREDVAR`, not this first-occasion observed extra; `MANIFESTVAR` `θ` is not this extra; Equation 5 of §7.2 `addedTIPREDVAR` is `λ² (B / a)² v`; form `(B / a)² v` first, then `(λ extra) λ` with `θ = 0`; a zero loading or zero extra is exactly zero; lasting asymptotic extra requires `a < 0`; `(B / a)² v` is the latent extra, not the observed extra; `λ² t0_b² v` is first-occasion extra observed TI variance, not this extra; `λ² p + θ` is stationary observed variance, not this extra; `MANIFESTVAR` `θ` is not this extra; p. 16 `TDPREDEFFECTstd` is `m · √v / √(-q / (2 a))` after strictly positive `asymDIFFUSION` and strictly positive time-dependent predictor variance; unstandardised `M` is not `TDPREDEFFECTstd`; `TIPREDEFFECTstd` is not `TDPREDEFFECTstd` even when `M = B`; intercept-style `A^{-1}[e^{A Δt} − I] M · √v / √p` is not `TDPREDEFFECTstd`; `m · √v / √(trait + p + added)` uses `TRAITVAR` and is not `TDPREDEFFECTstd`; Table 3 / p. 16 `T0TDPREDEFFECTstd` is `t0_m · √v / √p_0` after strictly positive free `T0VAR` and strictly positive TD predictor variance; unstandardised `t0_m` is not `T0TDPREDEFFECTstd`; `TDPREDEFFECTstd` uses `asymDIFFUSION` and is not `T0TDPREDEFFECTstd`; `T0TIPREDEFFECTstd` is not `T0TDPREDEFFECTstd` even when `t0_m = t0_b`; `t0_m · √v / √(trait + p_0 + added)` uses `TRAITVAR` and is not `T0TDPREDEFFECTstd`; free `T0VAR` does not require `a < 0`; p. 16 `T0VARstd` is `p_0 / p_0 = 1` after strictly positive free `T0VAR` (`solve(sqrt(diag(T0VAR))) %&% T0VAR`; OpenMx `%&%` is `t(A) %*% B %*% A`; default ridge is 0); unstandardised `T0VAR` is not `T0VARstd`; `T0TDPREDEFFECTstd` is not `T0VARstd`; `addedT0TIPREDVAR` is not `T0VARstd`; p. 16 `TRAITVARstd` is `trait / trait = 1` after strictly positive `TRAITVAR` (`solve(sqrt(diag(TRAITVAR))) %&% TRAITVAR`; OpenMx `%&%` is `t(A) %*% B %*% A`; no ridge addend); unstandardised `TRAITVAR` is not `TRAITVARstd`; `T0VARstd` is not `TRAITVARstd` even when both equal 1; `addedT0TIPREDVAR` is not `TRAITVARstd`; p. 16 `MANIFESTTRAITVARstd` is `ψ / ψ = 1` after strictly positive `MANIFESTTRAITVAR` (`solve(sqrt(diag(MANIFESTTRAITVAR))) %&% MANIFESTTRAITVAR`; OpenMx `%&%` is `t(A) %*% B %*% A`; 2017-era source adds ridging; default ridge is 0); unstandardised `MANIFESTTRAITVAR` is not `MANIFESTTRAITVARstd`; `TRAITVARstd` is not `MANIFESTTRAITVARstd` even when both equal 1; `MANIFESTVAR` is not `MANIFESTTRAITVARstd`; p. 16 `MANIFESTVARstd` is `θ / θ = 1` after strictly positive `MANIFESTVAR` (`solve(sqrt(diag(MANIFESTVAR))) %&% MANIFESTVAR`; OpenMx `%&%` is `t(A) %*% B %*% A`; 2017-era source adds ridging; default ridge is 0; 2017-era `dimnames` assignment to `latentNames` is a source bug); unstandardised `MANIFESTVAR` is not `MANIFESTVARstd`; `MANIFESTTRAITVARstd` is not `MANIFESTVARstd` even when both equal 1; Equation 5 `Var(y)` is not `MANIFESTVARstd`; p. 16 `TIPREDVARstd` is `v / v = 1` after strictly positive `TIPREDVAR` (`solve(sqrt(diag(TIPREDVAR))) %&% TIPREDVAR`; OpenMx `%&%` is `t(A) %*% B %*% A`; 2017-era source adds ridging; default ridge is 0; `dimnames` are `TIpredNames`); unstandardised `TIPREDVAR` is not `TIPREDVARstd`; `MANIFESTVARstd` is not `TIPREDVARstd` even when both equal 1; §7.2 `addedTIPREDVAR` is not `TIPREDVARstd`; p. 16 `asymDIFFUSIONstd` is `p / p = 1` after strictly positive `asymDIFFUSION` (`solve(sqrt(diag(asymDIFFUSION))) %&% asymDIFFUSION`; OpenMx `%&%` is `t(A) %*% B %*% A`; 2017-era source adds ridging; default ridge is 0; `dimnames` are `latentNames`); unstandardised `asymDIFFUSION` is not `asymDIFFUSIONstd`; `TIPREDVARstd` is not `asymDIFFUSIONstd` even when both equal 1; `DIFFUSIONstd` `−2 a` is not `asymDIFFUSIONstd`; p. 16 `discreteCINTstd` is `A^{-1}[e^{A Δt} − I] κ / √p` after strictly positive `asymDIFFUSION`; unstandardised `discreteCINT` is not `discreteCINTstd`; `κ / √p` is not `discreteCINTstd`; `(-κ / a) / √p` is not `discreteCINTstd`; `asymCINTstd` is `(-κ / a) / √p` after strictly positive `asymDIFFUSION`; unstandardised `asymCINT` is not `asymCINTstd`; `κ / √p` is not `asymCINTstd`; `discreteCINTstd` is not `asymCINTstd`; `T0MEANSstd` is `μ_0 / √p_0` after strictly positive free `T0VAR`; unstandardised `T0MEANS` is not `T0MEANSstd`; `T0VARstd` is not `T0MEANSstd`; `μ_0 / √asymDIFFUSION` is not `T0MEANSstd`;))))), irregular already-centered residual lag, Rubin `T` on OLS loadings, and strong-gated latent means (two-observation residual variance is identically `0` and caps at strong/scalar; Putnick & Bornstein, 2016) | - - -Foundation crates expose only tested contracts. Empty façades are not public -APIs. - -No crate exposes placeholder production behavior in Task 1. This prevents an -empty façade from becoming a de facto public API before its invariants and tests -exist. - -## Immutable evidence boundary - -Task 2 begins the executable `evidence_core` boundary. Stable RFC 9562 `UUIDv7` -identities are independent from canonical `SHA-256` content digests. Source -bytes and UTF-8 document text are copied into immutable owned storage, bounded -before allocation, and verified without exposing mutable fields. - -A source span records an owning document, a half-open UTF-8 byte range, the -matching half-open Unicode-scalar range, and optional page/layout geometry. It -fails closed for empty or reversed ranges, byte or scalar overflow, -mid-code-point boundaries, coordinate disagreement, cross-document use, -nonfinite geometry, nonpositive dimensions, and rectangles outside the page. -Scalar coordinates are evidence locations rather than grapheme, word, or -sentence boundaries; language-tailored segmentation remains a later module. - -The boundary now exposes a strict JSON wire version `1` without exposing private -Rust fields. Artifacts, documents, spans, and nested page locations are serialized -through explicit DTOs with unknown-field rejection. Reconstruction parses and -revalidates RFC 9562 identifiers, canonical digests, content limits, exact text -coordinates, document ownership, and page geometry. Artifact bytes and document -text are rehashed during reconstruction, and digest substitution fails closed. -Malformed JSON, unsupported versions, invalid byte values, and unknown nested -fields produce stable content-redacting errors. - -Persistence, JSON Schema publication, JSON-LD, GraphML, source acquisition -metadata, signatures, and W3C PROV remain outward adapters or later contracts. -They must depend inward on these validated domain values rather than defining -them. - -## Quality architecture - -The workspace centralizes package metadata and Rust/Clippy lints. Every member -inherits `unsafe_code = "forbid"`, `missing_docs = "deny"`, and warning denial. -Repository contract scripts independently verify the approved crate set, -workspace inheritance, action SHA pinning, absence of LLM credentials from -ordinary CI, and complete Rust documentation. - -Stable Rust 1.98.0 is the compile, lint, test, and line-coverage reference. -Branch coverage runs in a pinned nightly lane because LLVM branch coverage -remains unstable in Rust. `cargo-nextest` runs tests without retries, while -doctests remain a separate `cargo test --doc` gate. `cargo-deny` enforces -advisory, license, ban, and source policy. Failed Rust coverage gates print the -exact missing source locations from the same instrumented run without weakening -the 100% contract. - -## Temporal invariants - -TEPP stores event/valid time, assertion time, document time, system time, available time, and knowledge cutoff independently. A historical analysis may include a document only when: +## Strategic bounded contexts + +Cargo crates are implementation units. A crate, API route, clock type, refusal rule, equation, or ADR number is not automatically a bounded context. + +| Bounded context | Domain responsibility | Aggregate / authority | Current implementation nucleus | +| --- | --- | --- | --- | +| Evidence & Semantic Measurement | immutable source evidence, exact spans, multilingual semantic units, concept alignment, method/source-effect admission | `EvidenceCorpus`, `SemanticUnitSet`, `ConceptDictionaryRevision` | `evidence_core`, `semantic_core`; rule-fragment crates are fold candidates | +| Temporal Event Knowledge | six-clock semantics, temporal intervals/partial order, event ontology, typed transition/provenance relations, time-varying memberships | `EventEpisode`, `TemporalRelationSet`, `MembershipAssignmentSet` | `temporal_core`, `event_core`, `relation_graph`, `membership_core`; clock/edge crates are fold candidates | +| Topic Measurement | shared-latent temporal/relational topic estimation, topic identity, uncertainty, model-selection evidence | `TopicModelRun`, `TopicLineage` | `topic_measurement`, `topic_lineage`, `model_selection`, `network_analysis` | +| Longitudinal Modeling | TEPP-owned temporal composition of psychometric models: irregular time, longitudinal invariance/drift, time-varying covariates/random effects/membership, temporal state evolution and alignment | `TemporalModelSpecification`, `TemporalModelRun` | `longitudinal_core`; legacy temporal fragments in `psychometric_core` are staged migration/fold candidates | +| Analysis Run | cutoff-safe lifecycle, idempotency, application orchestration, durable terminal binding; no scientific formula ownership | `AnalysisRun` | `analysis_engine` application modules | +| Scientific Validation | method-specific recovery, RMSE/bias/coverage, convergence, invariance, graph/parity evidence | `ValidationStudy` | `validation_core`, `tepp_simulation` | +| Scientific Claim Promotion | preregistered decision over complete validation evidence; separate from evidence generation and transport success | `ClaimPromotionDecision` | ADR 0014 policy; implementation remains incomplete | +| Projection | typed buyer/consumer read models and exports without changing scientific authority | projection-specific read models | `tepp_api`, artifact/export adapters | + +Supporting contexts are Interpretation, Persistence & Recovery, and Runtime Security & Operations. Compute execution, serialization, hashing, transport framing, and accelerator adapters are generic infrastructure and do not define scientific truth. + +## Canonical cross-repository ownership + +ADR 0011 defines the service boundary. + +- `ContextualWisdomLab/fast-mlsirm` owns reusable static/generalized-mixed/dependence-aware psychometric model specification and reusable numerical kernels, including reusable LSIRM, MLSIRM, and DLSJM computation. +- TEPP owns temporal/event composition around a released/versioned upstream candidate: event-or-valid time, assertion time, document time, system time, available time, knowledge cutoff, leakage prevention, irregular intervals, time-varying membership/covariates, longitudinal invariance/drift, state evolution, temporal map alignment, event ontology/graph, and temporal recovery. +- `ContextualWisdomLab/contextual-orchestrator` owns all LLM provider execution, routing/fallback, verifier/adjudicator execution, credentials, and model-call provenance. TEPP never calls a model provider directly. +- Naruon, LineageWeave, Context Graph, and EA Core are external bounded contexts. Integration uses released/versioned contracts and explicit anti-corruption layers; no cross-service SQL is permitted. + +When reusable static computation exists in TEPP but belongs to fast-mlsirm, migration is `owner contract -> parity/recovery -> TEPP ACL -> duplicate removal`. A second TEPP production source is not retained for convenience. An open upstream PR head is not a released production dependency. + +## Six-clock temporal contract + +TEPP has exactly six temporal roles: + +1. **event or valid time** — when an event occurs or a state holds; an instant and a validity interval are representations of this same role; +2. **assertion time** — when a claim is stated; +3. **document time** — document creation/publication/revision/reporting period; +4. **system time** — when TEPP records or observes the fact; +5. **available time** — when the evidence could actually be used; +6. **knowledge cutoff** — maximum available time admitted to an analysis. + +A historical run enforces: \[ \operatorname{available\_time}(d) \leq \operatorname{knowledge\_cutoff}. \] -When availability is an interval, every possible instant in that interval must satisfy the inequality. Unknown or open-ended availability that can extend past the cutoff fails closed; event time and document time cannot substitute for availability. +Event instants and valid-time intervals do not create separate seventh/eighth clocks. Unknown/open availability that could exceed cutoff fails closed. -Forward transition edges require a temporally valid partial order. Retrospective, revision, translation, citation, support, and contradiction relations retain their direction and provenance but do not create reverse state transitions. +Forward transition and input-process-outcome relations obey temporal order. Citation, revision, translation, summary, support, contradiction, and retrospective reporting may point backward but never become reverse state transitions. -## Measurement invariants +## Generalized mixed and membership contract -All languages share global topic identities and latent document coordinates. Language-specific lexical emissions, morphology, script, and content deviations are modeled rather than forced to be identical. Validated, calibrated, provisional, and unresolved language profiles are reported separately. +A person, document, segment, item, or occasion may be cross-classified and may have multiple simultaneous memberships. These are different operators: -Repeated report vocabulary is modeled through corpus-background, template, section, style, copied-text, prompt, modality, and substantive-topic sources. It is not silently removed by stopword lists, TF-IDF, or BM25. +- **cross-classification** describes non-nested classification dimensions; +- **multiple membership** permits one observation to belong to several units in a dimension with explicit weights. -Topic proportions are compositional (Aitchison, 1982). ESEM and network analysis consume logistic-normal latent coordinates or orthonormal log-ratio coordinates, with posterior uncertainty propagated through plausible values or a joint model (Asparouhov & Muthén, 2009; Asparouhov et al., 2018; Marsh et al., 2014). The product topic-estimator contract is TRSL-TM (ADR 0012); an STM-style logistic-normal family is the reference, not a shipped-backend claim (Blei & Lafferty, 2006; Roberts et al., 2014, 2019). TDT/CHRONOS event intelligence remains an accepted-target boundary (Allan, 2002; Anagnostopoulos et al., 2013). +Membership weights are time-valid and auditable. They are observed/normalized or model-estimated according to the declared formulation; equal weights are never invented as a fallback. Known hierarchy, testlets, item families, raters, methods, and justified covariates are represented before residual latent-space dependence is introduced. -## Compute architecture +## Dependence-aware temporal composition -The CPU `f64` implementation is the numerical reference. Rayon-style fixed worker pools and thread-local sufficient statistics minimize context switching and oversubscription. GPU work is streamed; temporary responsibilities are never retained for the full corpus. The VRAM controller estimates peak allocation, reserves a safety margin, autotunes micro-batches, records telemetry, reduces batches after OOM, and falls back to CPU safely. +TEPP consumes the complete released upstream candidate identity rather than switching on names such as `rasch`, `mirt`, `ggum`, `lsirm`, or `dlsjm`. -## Persistence +- Rasch remains distinct from generic 1PL. +- 2PLM through formulation-qualified 5PLM preserve parameter meaning. +- confirmatory/exploratory MIRT preserve factor/loading semantics; +- dominance and ideal-point/GGUM response processes remain distinct from dependence and temporal operators; +- LSIRM/MLSIRM residual person-item geometry remains distinct from known design structure; +- DLSJM preserves separate local-item and local-person dependence spaces. -PostgreSQL is the reference relational store. Database objects use two-or-more-word `snake_case` names, including `document_record`, `temporal_interval`, `event_instance`, `event_mention`, `document_relation`, `segment_relation`, `entity_role_assignment`, `model_run`, `topic_definition`, `topic_correlation`, `topic_cluster`, `factor_solution`, `validation_metric`, and `audit_event`. `audit_event` inserts call `operational_log::try_record` before SQL is rendered so source text and source identity cannot enter the row. +Every temporal candidate is `supported`, `research_candidate`, or `unsupported`. Auto-expansion never means auto-activation. `supported` requires the exact combined formulation, temporal state equation, identification/alignment, canonical estimator, primary citations, required data support, and passing known-truth recovery. Primary dependence-family evidence and extension limits are maintained in [`docs/research/temporal-dependence-models.md`](docs/research/temporal-dependence-models.md). -## Security and trust boundaries +## Longitudinal numerical boundary + +Generic temporal standardization belongs in `longitudinal_core`, not in an indefinitely expanding technical `psychometric_core` module. Model-specific static covariance/likelihood primitives migrate to fast-mlsirm when they are reusable static psychometric computation. + +A lagged correlation is defined only from a valid lagged covariance and **both** marginal variances: + +\[ +\rho_{t,t+\Delta} = +\frac{\operatorname{Cov}(Y_t,Y_{t+\Delta})} +{\sqrt{\operatorname{Var}(Y_t)\operatorname{Var}(Y_{t+\Delta})}}. +\] + +A covariance divided only by the initial variance is not generally an autocorrelation under nonstationary marginals. The repaired Longitudinal Modeling contract therefore requires both marginals and checks the covariance bound. Detailed Driver/Oud/Voelkle equation evidence stays in [`docs/research/multilevel-event-time-recovery.md`](docs/research/multilevel-event-time-recovery.md), not in this architecture table. + +## Analysis Run application boundary + +`analysis_engine` orchestrates accepted domain capabilities. `tepp_api` is a transport/projection adapter. HTTP routes, CLI verbs, export operations, project-history operations, and individual refusal helpers do not establish new bounded contexts or scientific authority. + +Target application layout is capability-oriented rather than a flat one-file-per-rule list: + +```text +analysis_engine/src/ + runs/ + evidence_measurement/ + topic_measurement/ + longitudinal_modeling/ + event_intelligence/ + validation/ +``` + +Transport-only behavior stays in `tepp_api`. Persistence adapters implement domain/application repositories; domain code does not import PostgreSQL, HTTP, CLI, or provider-specific DTOs. + +## Current implementation topology and migration + +Protected main contains useful domain primitives alongside many historical one-rule/one-clock crates and a large `psychometric_core`. Those implementation paths are not target ownership. -Documents and LLM outputs are untrusted. Exact spans, JSON Schema, size/depth limits, Unicode validity, prompt-injection isolation, provider allowlists, no-tool execution, tenant isolation, immutable audit events, dependency pinning, SBOM, provenance, and reproducible releases are mandatory. LLM live tests use `NVIDIA_NIM_API_KEY`; `COPILOT_GITHUB_TOKEN` is forbidden. +The delivery recovery folds fragments into the owning contexts while preserving unique tests, research, review evidence, and public compatibility where required. Representative folds are: -## References +| Current fragments | Owning context | +| --- | --- | +| `system_clock`, `event_clock`, `assertion_clock`, `cutoff_clock`, `available_clock`, `document_clocks`, `revision_order` | Temporal Event Knowledge | +| `summarizes_edge`, `retrospective_edge`, `support_edge`, `citation_edge`, `outcome_order`, `subevent_containment`, `prediction_contradiction`, `relation_absence`, `role_contradiction` | Temporal Event Knowledge | +| `location_membership`, `episode_membership`, `membership_target` | Temporal Event Knowledge | +| `prompt_source`, `style_source`, `modality_source`, `copied_text`, `copy_identity`, `corpus_background`, `stopword_deletion`, `payload_bound`, `derived_sensitivity` | Evidence & Semantic Measurement | +| event-time correlation standardization | Longitudinal Modeling / `longitudinal_core` | +| reusable static/generalized-mixed/dependence psychometric kernels in TEPP | fast-mlsirm owner path after parity/recovery | +| flat Analysis Run route/refusal modules | capability-oriented Analysis Run modules | -The full APA 7th register is [`docs/research/standards-and-literature.md`](docs/research/standards-and-literature.md). Method claims on this page use: +A repository-wide rename across a large active PR fleet is not used as a shortcut. Path repair is staged through coherent landing vehicles, but legacy paths are not canonical merely because migration is staged. -Aitchison, J. (1982). The statistical analysis of compositional data. *Journal of the Royal Statistical Society: Series B, 44*(2), 139–177. https://doi.org/10.1111/j.2517-6161.1982.tb01195.x +## Scientific validation and claim promotion -Allan, J. (Ed.). (2002). *Topic detection and tracking: Event-based information organization*. Kluwer Academic Publishers. +Validation Evidence and Scientific Claim Promotion are separate authorities. -Anagnostopoulos, E., Batsakis, S., & Petrakis, E. G. M. (2013). CHRONOS: A reasoning engine for qualitative temporal information in OWL. *Procedia Computer Science, 22*, 70–77. https://doi.org/10.1016/j.procs.2013.09.082 +A validation artifact may contain known-truth parameter recovery, RMSE, bias, interval coverage, convergence, invariance, graph recovery, temporal ordering, CPU/GPU parity, and Monte Carlo uncertainty. It does not itself grant a global `scientific_acceptance=true` flag. -Asparouhov, T., Hamaker, E. L., & Muthén, B. (2018). Dynamic structural equation models. *Structural Equation Modeling, 25*(3), 359–388. https://doi.org/10.1080/10705511.2017.1406803 +Claim promotion applies a preregistered method-specific evidence contract. Scale-invariant self-referential gates such as comparing an error magnitude with an uncertainty estimate computed from the same residual vector cannot substitute for a scientifically meaningful acceptance bound. LLM judgments and transport success cannot satisfy numerical evidence requirements. -Asparouhov, T., & Muthén, B. (2009). Exploratory structural equation modeling. *Structural Equation Modeling, 16*(3), 397–438. https://doi.org/10.1080/10705510903008204 +## Compute architecture + +All TEPP-owned production mathematical/statistical arithmetic is Rust-first. Deterministic CPU `f64` is the scientific numerical reference. Parallel CPU execution uses bounded/fixed worker pools and deterministic reduction where required. GPU/MLX/OpenCL/CUDA paths must demonstrate parity against the CPU reference and bounded memory/OOM fallback behavior before they are scientific evidence. + +A compute receipt proves that a named backend executed a named operation; it does not prove estimator validity. + +## Persistence + +PostgreSQL is the reference relational store. Domain persistence is normalized, tenant/time/provenance aware, and uses descriptive multiword `snake_case` objects. Bitemporal/interval constraints, immutable evidence/provenance, explicit idempotency/UPSERT behavior, and measured hot-partition behavior are required where applicable. + +`persistence_postgres` is an adapter. Other contexts do not query its tables directly, and external CWL services never read/write TEPP application tables. + +## Security and trust boundaries -Blei, D. M., & Lafferty, J. D. (2006). Dynamic topic models. In *Proceedings of the 23rd International Conference on Machine Learning* (pp. 113–120). ACM. https://doi.org/10.1145/1143844.1143859 +Documents, external metadata, serialized payloads, model artifacts, and LLM output are untrusted until their owning boundary validates identity, provenance, size/depth, authorization, and scientific semantics. Source text and secrets are not copied into ordinary operational telemetry. Service/provider credentials are scoped to their owner and cannot be repurposed as review/release authority. -Marsh, H. W., Morin, A. J. S., Parker, P. D., & Kaur, G. (2014). Exploratory structural equation modeling: An integration of the best features of exploratory and confirmatory factor analysis. *Annual Review of Clinical Psychology, 10*, 85–110. https://doi.org/10.1146/annurev-clinpsy-032813-153700 +## Documentation and research authority -Roberts, M. E., Stewart, B. M., Tingley, D., Lucas, C., Leder-Luis, J., Gadarian, S. K., Albertson, B., & Rand, D. G. (2014). Structural topic models for open-ended survey responses. *American Journal of Political Science, 58*(4), 1064–1082. https://doi.org/10.1111/ajps.12103 +- product target: [`docs/product/prd-v0.4-approved.md`](docs/product/prd-v0.4-approved.md) +- DDD context map: [`docs/architecture/domain-context-map.md`](docs/architecture/domain-context-map.md) +- service/dependence boundary: ADR 0011 and [`docs/architecture/temporal-dependence-composition.md`](docs/architecture/temporal-dependence-composition.md) +- general standards/literature: [`docs/research/standards-and-literature.md`](docs/research/standards-and-literature.md) +- LSIRM/MLSIRM/DLSJM evidence: [`docs/research/temporal-dependence-models.md`](docs/research/temporal-dependence-models.md) +- longitudinal/ctsem equation evidence: [`docs/research/multilevel-event-time-recovery.md`](docs/research/multilevel-event-time-recovery.md) +- scientific promotion: ADR 0014 and [`docs/TRACEABILITY.md`](docs/TRACEABILITY.md) -Roberts, M. E., Stewart, B. M., & Tingley, D. (2019). stm: An R package for structural topic models. *Journal of Statistical Software, 91*(2), 1–40. https://doi.org/10.18637/jss.v091.i02 +Detailed equation-by-equation recovery evidence belongs in research/doctoring documents and executable tests, not duplicated into architecture responsibility tables. \ No newline at end of file From 5314bac6b97c192f6cc01226d5c4094576c7559f Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 20:15:52 +0900 Subject: [PATCH 024/235] docs(ddd): align longitudinal owner context --- docs/architecture/domain-context-map.md | 83 ++++++++++++++----------- 1 file changed, 48 insertions(+), 35 deletions(-) diff --git a/docs/architecture/domain-context-map.md b/docs/architecture/domain-context-map.md index 16f45f848..871e8fba1 100644 --- a/docs/architecture/domain-context-map.md +++ b/docs/architecture/domain-context-map.md @@ -1,6 +1,7 @@ # TEPP Domain Context Map -Status: delivery refactoring authority for the 2026-09-01 queue-consolidation cycle. +**Status:** Delivery-refactoring authority for the 2026-09-01 queue-consolidation cycle. +**Cross-service authority:** ADR 0011. This document applies Domain-Driven Design to the protected-main product. Cargo crates are implementation units; they are not automatically bounded contexts. A crate, ADR number, refusal helper, transport operation, clock type, or equation earns a separate boundary only when it has an independently meaningful domain lifecycle, ubiquitous language, invariants, and reuse boundary. @@ -10,24 +11,26 @@ This document applies Domain-Driven Design to the protected-main product. Cargo | Bounded context | Product responsibility | Aggregate / authority | Current implementation nucleus | | --- | --- | --- | --- | -| Evidence & Semantic Measurement | Preserve source evidence and derive span-grounded semantic/concept observations without replacing source truth | `EvidenceCorpus`, `SemanticUnitSet`, `ConceptDictionaryRevision` | `evidence_core`, `semantic_core` | -| Temporal Event Knowledge | Represent six clocks, event identity, interval relations, typed provenance/transition edges, and time-varying memberships | `EventEpisode`, `TemporalRelationSet`, `MembershipAssignmentSet` | `temporal_core`, `event_core`, `relation_graph`, `membership_core` | -| Topic Measurement | Estimate shared-latent temporal topic coordinates and uncertainty; preserve topic identity through activity/dormancy/reactivation | `TopicModelRun`, `TopicLineage` | `topic_measurement`, `topic_lineage`, `model_selection`, `network_analysis` | -| Longitudinal Psychometrics | Estimate longitudinal/multilevel psychometric quantities and model-comparison evidence | `PsychometricStudy`, `LongitudinalModelRun` | `psychometric_core`, `longitudinal_core`, `psychometric_fit` | -| Analysis Run | Orchestrate cutoff-safe accepted work into durable execution and typed terminal artifacts without owning scientific formulas | `AnalysisRun` | `analysis_engine` | -| Scientific Validation & Claim Promotion | Produce method-specific validation evidence, then decide whether a claim may be promoted under a preregistered evidence contract | `ValidationStudy`, `ClaimPromotionDecision` | `validation_core`, `tepp_simulation`; claim-promotion policy remains incomplete | +| Evidence & Semantic Measurement | preserve source evidence and derive span-grounded semantic/concept observations without replacing source truth | `EvidenceCorpus`, `SemanticUnitSet`, `ConceptDictionaryRevision` | `evidence_core`, `semantic_core` | +| Temporal Event Knowledge | represent the six-clock contract, event identity, interval relations, typed provenance/transition edges, and time-varying memberships | `EventEpisode`, `TemporalRelationSet`, `MembershipAssignmentSet` | `temporal_core`, `event_core`, `relation_graph`, `membership_core` | +| Topic Measurement | estimate shared-latent temporal topic coordinates and uncertainty; preserve topic identity through activity/dormancy/reactivation | `TopicModelRun`, `TopicLineage` | `topic_measurement`, `topic_lineage`, `model_selection`, `network_analysis` | +| Longitudinal Modeling | compose TEPP-owned temporal/event state evolution, longitudinal invariance/drift, irregular time and time-varying generalized-mixed structure around released static psychometric contracts | `TemporalModelSpecification`, `TemporalModelRun` | `longitudinal_core`; reusable static kernels migrate to fast-mlsirm | +| Analysis Run | orchestrate cutoff-safe accepted work into durable execution and typed terminal artifacts without owning scientific formulas | `AnalysisRun` | `analysis_engine` | +| Scientific Validation | produce method-specific recovery/coverage/parity/invariance/convergence evidence | `ValidationStudy` | `validation_core`, `tepp_simulation` | +| Scientific Claim Promotion | decide whether a claim may be promoted under a preregistered complete evidence contract | `ClaimPromotionDecision` | ADR 0014 policy; implementation incomplete | +| Projection | publish authorized read models/exports without changing domain or scientific authority | projection-specific read models | `tepp_api`, artifact/export adapters | ### Supporting subdomains | Bounded context | Responsibility | Implementation nucleus | | --- | --- | --- | -| Interpretation | Evidence-grounded interpretation and independent verification; never numerical authority | `interpretation_gateway` plus contextual-orchestrator ACL | -| Persistence & Recovery | Durable run/artifact storage, restart/recovery, outbox/checkpoint semantics | `persistence_postgres`, `checkpoint_authority` | -| Runtime Security & Operations | authenticated intake, TLS, operational audit, provider receipts, encrypted mappings | `intake_authorization`, `service_tls`, `operational_log`, `provider_receipt`, `encrypted_mapping` | +| Interpretation | evidence-grounded interpretation and independent verification; never numerical authority | `interpretation_gateway` plus contextual-orchestrator ACL | +| Persistence & Recovery | durable run/artifact storage, restart/recovery, outbox/checkpoint semantics | `persistence_postgres`, `checkpoint_authority` | +| Runtime Security & Operations | authenticated intake, TLS, operational audit, provider receipts, encrypted mappings | runtime/security adapters | ### Generic subdomains -`compute_backend`, `mlx_native_receipt`, serialization, hashing, and transport framing are generic infrastructure. They may serve several bounded contexts but may not define domain truth. +`compute_backend`, accelerator adapters, serialization, hashing, and transport framing are generic infrastructure. They may serve several bounded contexts but may not define domain truth or scientific validity. ## Context map @@ -36,43 +39,51 @@ flowchart LR ES[Evidence & Semantic Measurement] --> TE[Temporal Event Knowledge] ES --> TM[Topic Measurement] TE --> TM - TE --> LP[Longitudinal Psychometrics] + TE --> LM[Longitudinal Modeling] + TM --> LM TM --> AR[Analysis Run] - LP --> AR - AR --> SV[Scientific Validation & Claim Promotion] - SV --> IN[Interpretation] + LM --> AR + AR --> VE[Scientific Validation] + VE --> CP[Scientific Claim Promotion] + AR --> PJ[Projection] + CP --> PJ + PJ --> IN[Interpretation] AR --> PR[Persistence & Recovery] AR --> RO[Runtime Security & Operations] - IN --> RO CB[Compute Backend] -. generic service .-> TM - CB -. generic service .-> LP - CB -. generic service .-> SV + CB -. generic service .-> LM + CB -. generic service .-> VE + FM[fast-mlsirm Model Specification / Numerical Kernel] -- released versioned contract --> LM + CO[contextual-orchestrator] -- ACL --> IN ``` Dependency direction follows the arrows. Transport, persistence, UI, and provider adapters may depend on domain/application contracts; domain code must not depend on HTTP, PostgreSQL, CLI, or provider-specific representations. ## Anti-corruption layers -- `tepp_api` is an HTTP/CLI adapter around Analysis Run and published read models. It must not own scientific acceptance, estimator formulas, event semantics, or persistence truth. -- `orchestrator_live` is an adapter for contextual-orchestrator. Provider vocabulary is translated into TEPP interpretation/application contracts before crossing the boundary. +- `tepp_api` is an HTTP/CLI/projection adapter around Analysis Run and published read models. It must not own scientific acceptance, estimator formulas, event semantics, or persistence truth. +- `contextual-orchestrator` provider vocabulary is translated into TEPP interpretation/application contracts before crossing the boundary. Direct provider calls are prohibited. +- `fast-mlsirm` is consumed through a released/versioned candidate and numerical-kernel contract. TEPP does not copy open-PR source as a dependency. - `persistence_postgres` implements repositories owned by domain/application contexts. Other contexts must not query its tables directly. -- `compute_backend` and `mlx_native_receipt` expose execution receipts; a backend receipt is not a scientific result. -- Naruon and LineageWeave contracts are external contexts. Their identifiers and transport vocabulary must remain behind explicit adapters rather than leaking into core aggregates. +- compute backends expose execution receipts; a backend receipt is not a scientific result. +- Naruon, LineageWeave, Context Graph, and EA Core are external contexts. Their identifiers and transport vocabulary remain behind explicit adapters rather than leaking into core aggregates. ## Ubiquitous language and invariants - **Evidence** is immutable source-backed observation, not an inferred fact. - **Semantic unit** is a span-grounded measured unit tied to source offsets and a versioned concept dictionary. -- **Event time** is when an event occurs; **available time** is when evidence becomes usable; **knowledge cutoff** is an analysis eligibility boundary. They are never aliases. +- **Event or valid time** is the first of six temporal roles; an event instant and validity interval are alternative representations of when a state/event holds, not separate analysis clocks. +- **Available time** is when evidence becomes usable; **knowledge cutoff** is an analysis eligibility boundary. They are never aliases for event/valid time. - **Transition edge** is forward-only state/process change; citation, summary, retrospective report, and support are provenance/evidence relations and never become transitions by coercion. - **Membership assignment** may be cross-classified or multiple-membership and must not collapse language, template, department, project, location, or role into one entity identity. +- **Temporal model specification** composes time around an exact released upstream candidate identity; it does not rewrite the base family or dependence semantics. - **Analysis run** owns lifecycle, idempotency, execution identity, and terminal artifact binding; it does not redefine estimators. -- **Validation evidence** records method-specific recovery/coverage/parity/invariance/convergence evidence. It is not itself a global scientific acceptance decision. +- **Validation evidence** records method-specific recovery/coverage/parity/invariance/convergence evidence. It is not a global scientific acceptance decision. - **Claim promotion decision** may be made only from a preregistered, versioned evidence contract whose required dimensions are complete. LLM output cannot satisfy a numerical evidence requirement. ## Crate-boundary repair register -The following protected-main crates look like rule fragments rather than independent bounded contexts. They are retained temporarily to preserve remote-head compatibility, but new work must treat them as modules/value objects/invariants of the owning context and fold them when the corresponding product-vertical landing vehicle is replayed onto current main. +The following protected-main crates look like rule fragments rather than independent bounded contexts. They are retained temporarily to preserve remote-head compatibility, but new work treats them as modules/value objects/invariants of the owning context and folds them when the corresponding product-vertical landing vehicle is replayed onto current main. | Current crate fragments | Owning bounded context | | --- | --- | @@ -80,26 +91,28 @@ The following protected-main crates look like rule fragments rather than indepen | `summarizes_edge`, `retrospective_edge`, `support_edge`, `citation_edge`, `outcome_order`, `subevent_containment`, `prediction_contradiction`, `relation_absence`, `role_contradiction` | Temporal Event Knowledge | | `location_membership`, `episode_membership`, `membership_target` | Temporal Event Knowledge | | `prompt_source`, `style_source`, `modality_source`, `copied_text`, `copy_identity`, `corpus_background`, `stopword_deletion`, `payload_bound`, `derived_sensitivity` | Evidence & Semantic Measurement | -| `psychometric_fit` | Longitudinal Psychometrics | +| event-time correlation standardization | Longitudinal Modeling / `longitudinal_core` | +| reusable static/generalized-mixed/dependence psychometric arithmetic | `fast-mlsirm` owner path after parity/recovery | +| flat `analysis_engine` one-profile files | owning Analysis Run capability module | A fold is permitted only after comparing the exact remote head and preserving unique tests, doctoring, research citations, and public compatibility. Public compatibility, when required, is provided by explicit adapters/re-exports with a removal plan; legacy paths do not remain canonical merely to avoid a refactor. ## Analysis Run directory rule -New `analysis_engine` profiles must be organized by the owning domain capability, not as an indefinitely growing flat list of one-file refusals. When the queue is replayed, use domain modules such as: +New `analysis_engine` profiles are organized by the owning domain capability, not as an indefinitely growing flat list of one-file refusals or one-route features: ```text analysis_engine/src/ - runs/ # lifecycle, identity, idempotency - evidence_measurement/ # source/method-effect admission profiles - topic_measurement/ # topic/model-selection/lineage run composition - psychometrics/ # longitudinal/measurement run composition - event_intelligence/ # TDT/CHRONOS composition - validation/ # validation evidence production only + runs/ + evidence_measurement/ + topic_measurement/ + longitudinal_modeling/ + event_intelligence/ + validation/ ``` -Transport-only features stay in `tepp_api`; scientific claim promotion remains a separate application/domain policy boundary instead of being hidden inside one validation-run helper. +Transport-only features stay in `tepp_api`; scientific claim promotion remains a separate policy boundary instead of being hidden inside one validation-run helper. ## Migration rule -Do not perform a repository-wide path rename while more than one hundred remote PR heads are open. That would create avoidable conflicts and discard concurrent-agent intent. Apply path repairs incrementally inside the selected landing vehicle for each bounded context, then close or retarget superseded micro-PRs with exact-head replacement mappings. The target architecture is mandatory; the migration is deliberately staged. \ No newline at end of file +Do not perform a repository-wide path rename while a large remote PR fleet is open. Apply path repairs incrementally inside the selected landing vehicle for each bounded context, then close or retarget superseded micro-PRs with exact-head replacement mappings. The target architecture is mandatory; the migration is staged only to preserve concurrent-agent intent and review evidence. \ No newline at end of file From a085c48a4b78988afda9510b7c0cd0cf2780ed00 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 20:18:53 +0900 Subject: [PATCH 025/235] docs(delivery): enforce declared queue classes --- .../delivery/pr-queue-authority-2026-09-01.md | 38 ++++++++++--------- 1 file changed, 21 insertions(+), 17 deletions(-) diff --git a/docs/delivery/pr-queue-authority-2026-09-01.md b/docs/delivery/pr-queue-authority-2026-09-01.md index e1578f3c8..a0f105752 100644 --- a/docs/delivery/pr-queue-authority-2026-09-01.md +++ b/docs/delivery/pr-queue-authority-2026-09-01.md @@ -6,16 +6,16 @@ This is a live-recovery record for delivery issue #175. GitHub state supersedes - Protected default branch: `main` - Protected-main SHA observed: `1bc02f580cf48e1d39da239f0e818453437c31c3` -- Snapshot stamp: `2026-09-01T10:19:29Z` -- Open pull requests: **136** -- Draft pull requests: **91** -- Non-draft pull requests: **45** +- Snapshot stamp: `2026-09-01T10:49:02Z` +- Open pull requests: **139** +- Draft pull requests: **90** +- Non-draft pull requests: **49** - Open issues: **14** - Effective required-workflow ruleset: `18156473`, `CWL Central required workflows` - GitHub releases: **0** - `docs/product-technical-gap-baseline.md` is maintained on this recovery branch so it no longer presents a former zero-queue snapshot as current authority. -The initial observation was 141/99. The queue later peaked at 149/100 while this recovery vehicle was open. The current 136/91/45 inventory is a net reduction after scientifically unsafe #356 closed without merge; it is not evidence that the queue is now a bounded landing set. A queued, skipped, cancelled, predecessor-head, or stale check is not passing evidence. +The initial observation was 141/99. The queue later peaked at 149/100, fell to 136, and then rebounded to 139 while this recovery vehicle remained open. The rebound came from additional one-operation Analysis Run slices and is a WIP circuit-breaker regression, not buyer-visible progress. A queued, skipped, cancelled, predecessor-head, or stale check is not passing evidence. ## Queue authority classes @@ -29,7 +29,7 @@ Every open PR must be classified before merge or closure as one of: - `research_lineage_only`: useful scientific provenance that is not intended to ship as a separate runtime boundary; - `blocked_external`: otherwise-valid work whose current blocker is external to TEPP and is recorded with an owning issue/PR. -A PR title, ADR number, local green test, or separate crate does not establish an independent product boundary. +A PR title, ADR number, local green test, or separate crate does not establish an independent product boundary. There is no `landing_vehicle_candidate` class; a vehicle is either selected as `landing_vehicle` or remains one of the declared non-authority classes until selection is justified. ## Landing order @@ -49,38 +49,42 @@ New unrelated micro-PRs are release-excluded while this queue exceeds the active ### PR #441 — event-time lagged association repair -Classification: `landing_vehicle_candidate` under Longitudinal Modeling; scientific root cause repaired on exact head `6f483224b3a03e8237c6f4f098a8b0e85e0a91f5`, but not merge-ready until exact-head workflows succeed and independent non-author APPROVE exists. +Classification: `landing_vehicle` under Longitudinal Modeling. The scientific root cause is repaired on exact head `6f483224b3a03e8237c6f4f098a8b0e85e0a91f5`, but the vehicle is not merge-ready until exact-head workflows succeed and a qualifying independent non-author APPROVE exists. The predecessor head exposed `(trait + e^{aΔt} p + added) / (trait + p + added)` as `expected_autocorrelation`. Review showed that a one-sided covariance/earlier-variance ratio is not a correlation under nonstationary marginals and can exceed one. The repair removes that public claim and its `psychometric_core` changes from the final diff. The replacement belongs to `longitudinal_core` and standardizes a supplied lagged covariance only when both marginal variances are available: `Cov(Y_t,Y_t+Δ) / sqrt(Var(Y_t) * Var(Y_t+Δ))`. -The invalid predecessor commit remains only as RED/scientific-failure lineage. Review threads tied to the removed implementation are resolved as outdated. Canonical `ARCHITECTURE.md` and `CHANGELOG.md` now record the event-time lagged-correlation standardizer; the one-shot self-modifying capability-record workflow was removed. Hosted exact-head Rust/documentation/security checks were still queued at this snapshot, so this PR is not yet a merge authority. +The invalid predecessor commit remains only as RED/scientific-failure lineage. Review threads tied to the removed implementation are resolved. Canonical `ARCHITECTURE.md` and `CHANGELOG.md` record the event-time lagged-correlation standardizer; the one-shot self-modifying capability-record workflow was removed. Hosted exact-head Rust/documentation/security checks were still queued at this snapshot, so this PR is not yet a merge authority. ### PR #356 — validation-run scientific evidence -Classification: **closed without merge**. Useful cutoff/run-binding/metric evidence is preserved in branch and review history for fold into the Validation landing work tracked by #166. Do not reopen this exact vehicle. +Classification: **closed without merge**. Useful cutoff/run-binding/metric evidence is preserved in branch and review history for fold into the Scientific Validation landing work tracked by #166. Do not reopen this exact vehicle. The closed head `df33bfa3e61ae4de3dbfae16df0deac12d2f4003` bound cutoff-safe evidence to a validation run, but review found a scientific-authority defect: the acceptance rule compared RMSE with a standard error derived from the same residual vector using a caller-selected preregistered multiplier. That gate can accept arbitrarily large recovery error for pathological residual shapes. The closed observation also accepted caller-supplied truth/recovered vectors and an `authored_by_llm` boolean rather than an estimator-owned, digest-bound provenance artifact. -DDD correction for the next Validation vehicle: the run should produce **Validation Evidence**. A distinct **Claim Promotion Decision** aggregate, governed by ADR 0014 and a method-specific preregistered evidence contract, decides whether a scientific claim is promotable. No generic standard-error multiplier, maximum-k, or other rule-of-thumb threshold may substitute for a research- or model-derived acceptance design. +DDD correction for the next Scientific Validation vehicle: the run produces **Validation Evidence**. A distinct **Claim Promotion Decision** aggregate, governed by ADR 0014 and a method-specific preregistered evidence contract, decides whether a scientific claim is promotable. No generic standard-error multiplier, maximum-k, or other rule-of-thumb threshold may substitute for a research- or model-derived acceptance design. -### PR #444 — export-collection CLI +### PRs #443–#446 — Analysis Run export stack -Classification: `fold_into_landing_vehicle` under Analysis Run/export, stacked on #443. Preserve CLI parsing, fail-closed origin/credential/consumer refusals, and metric-free receipt tests. Opening this slice while this recovery vehicle remains open is evidence that the WIP circuit breaker is not yet enforced. +Classification: `fold_into_landing_vehicle` under one coherent Analysis Run/export vehicle. + +Preserve each slice's unique pagination, authorization, cancellation, CLI parsing, origin/credential/consumer refusal, and metric-free receipt tests. Do not retain one route or one binary as a separate product boundary or architecture authority merely because it has its own ADR or branch. + +### PR #447 — Analysis Run project-history cancel + +Classification: `fold_into_landing_vehicle` under the Analysis Run/project-history vehicle. Preserve its empty-body, path/credential refusal, cancellation-removal, and metric-free receipt evidence before folding. ### PRs #352 and #355 — same Driver/ctsem TIPREDEFFECT rewrite -Classification: both `fold_into_landing_vehicle` candidates under Longitudinal Modeling; neither is selected as authority yet. +Classification: both `fold_into_landing_vehicle` under Longitudinal Modeling; neither is selected as a separate authority. Both implement the scalar `-a * B` rewrite from the same current-main base. They differ in public naming, refusal guards, tests, doctoring, and documentation edits. Closing either solely because the title and core equation match would discard unique evidence. The consolidation vehicle must retain the stronger named-quantity refusal coverage and realistic published-example tests while avoiding unrelated architecture mega-row edits. -### Analysis-run transport slices +### Analysis Run transport slices PRs for one GET/POST/CLI/status/cancel/retry/export/project-history operation are not separate bounded contexts. Classify them under the Analysis Run application context and `tepp_api` adapter. Parent/child stacks remain documented until a current-main landing vehicle preserves their unique contract tests and consumer compatibility. -PR #443 is a current example: it adds one export-collection GET on top of the existing export-retrieval stack. Its unique pagination/auth/refusal tests must be preserved, but the operation is a `fold_into_landing_vehicle` candidate rather than a new product boundary or architecture decision. - ### Evidence/method refusal slices PRs binding prompt/style/modality/copied-text/corpus-background/template-copy/location/membership/citation refusals to separate analysis profiles are not automatically independent products. Classify the invariant under Evidence & Semantic Measurement or Temporal Event Knowledge, then fold compatible profiles into one coherent admission/method-effect landing vehicle where the runtime contract does not require an independently versioned lifecycle. @@ -100,4 +104,4 @@ Before merge: ## DDD delivery constraint -Directory and crate moves are part of the owning product-vertical replay. Do not preserve a technical-layer or one-rule path as canonical if it obscures the domain responsibility. Conversely, do not rename all crates in one sweeping PR while 136 remote heads are active. The target bounded contexts are fixed in `docs/architecture/domain-context-map.md`; migration proceeds through safe, reviewable landing vehicles with explicit anti-corruption adapters and replacement mappings. +Directory and crate moves are part of the owning product-vertical replay. Do not preserve a technical-layer or one-rule path as canonical if it obscures the domain responsibility. Conversely, do not rename all crates in one sweeping PR while 139 remote heads are active. The target bounded contexts are fixed in `docs/architecture/domain-context-map.md`; migration proceeds through safe, reviewable landing vehicles with explicit anti-corruption adapters and replacement mappings. \ No newline at end of file From 5da1b950544619170528b4f50ccbf9895864a0a4 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 20:19:19 +0900 Subject: [PATCH 026/235] test(docs): reject near-match priority headings --- tests/quality/test_gap_inventory_heading.py | 71 +++++++++++++++++++++ 1 file changed, 71 insertions(+) create mode 100644 tests/quality/test_gap_inventory_heading.py diff --git a/tests/quality/test_gap_inventory_heading.py b/tests/quality/test_gap_inventory_heading.py new file mode 100644 index 000000000..562381753 --- /dev/null +++ b/tests/quality/test_gap_inventory_heading.py @@ -0,0 +1,71 @@ +"""Regression tests for exact priority-inventory heading recognition.""" + +from __future__ import annotations + +import tempfile +import unittest +from pathlib import Path + +from scripts import validate_documentation as docs + + +BASE = """# Product and Technical Gap Baseline + +**Snapshot:** 2026-09-01T10:49:02Z +**Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` + +## Snapshot facts + +| Signal | Snapshot evidence | Delivery implication | +|---|---:|---| +| Open pull requests | **139** | Queue only. | + +{heading} + +| PR | Exact current head | Draft | Base | Title | +|---:|---|:---:|---|---| +| #441 | `6f483224b3a03e8237c6f4f098a8b0e85e0a91f5` | false | main | repair | + +## Operator-gap register + +| ID | Closure evidence | +|---|---| +| GAP-001 | Closure evidence exists. | +""" + + +class PriorityInventoryHeadingTests(unittest.TestCase): + """Require the canonical level-two heading exactly, not a substring match.""" + + def _write(self, heading: str) -> Path: + temporary = tempfile.TemporaryDirectory() + self.addCleanup(temporary.cleanup) + root = Path(temporary.name) + path = root / docs.PRODUCT_TECHNICAL_GAP_BASELINE + path.parent.mkdir(parents=True) + path.write_text(BASE.format(heading=heading), encoding="utf-8") + return root + + def test_exact_level_two_heading_passes(self) -> None: + """The canonical priority-inventory heading is accepted.""" + + root = self._write("## Current priority open pull-request evidence") + docs.validate_product_technical_gap_baseline(root) + + def test_level_three_near_match_fails(self) -> None: + """A level-three heading cannot masquerade as the canonical inventory.""" + + root = self._write("### Current priority open pull-request evidence") + with self.assertRaisesRegex(AssertionError, "no exact-head rows"): + docs.validate_product_technical_gap_baseline(root) + + def test_suffixed_level_two_near_match_fails(self) -> None: + """A suffixed level-two heading is not the canonical inventory authority.""" + + root = self._write("## Current priority open pull-request evidence (historical)") + with self.assertRaisesRegex(AssertionError, "no exact-head rows"): + docs.validate_product_technical_gap_baseline(root) + + +if __name__ == "__main__": # pragma: no cover + unittest.main() From 5bd109c3efd5e5ca7056501ab7abe0c156d2bc6d Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 20:22:00 +0900 Subject: [PATCH 027/235] docs(adr): renumber lineage-pair decision to 0026 --- ...criterion-and-project-journey-posterior.md | 67 +++++++++++++++++++ 1 file changed, 67 insertions(+) create mode 100644 docs/adr/0026-lineage-pair-criterion-and-project-journey-posterior.md diff --git a/docs/adr/0026-lineage-pair-criterion-and-project-journey-posterior.md b/docs/adr/0026-lineage-pair-criterion-and-project-journey-posterior.md new file mode 100644 index 000000000..98d7b8fd7 --- /dev/null +++ b/docs/adr/0026-lineage-pair-criterion-and-project-journey-posterior.md @@ -0,0 +1,67 @@ +# ADR 0026 — Independent lineage-pair criterion and posterior Project Journey + +**Decision status:** Proposed +**Implementation maturity:** active-PR — strict wire contracts and Rust CPU independent-criterion estimator +**Date:** 2026-08-26 +**Supersedes:** The pre-normalization colliding identity `0024-lineage-pair-criterion-and-project-journey-posterior.md`; ADR 0024 remains the earlier posterior topic-context producer decision. This ADR narrows ADR 0016 and complements ADR 0021. + +## Context + +Event-Lineage channel weights require an independent pair-level criterion; channel covariance, a fusion floor, keywords, or one run-level accepted flag do not identify it. Project Journey cannot treat the earliest stored record or a fixed sales lifecycle as its start: prior projects, customer requests, procurement notices, direct or negotiated bids, external sensing, internal discussions, and leads can be concurrent, uncertain, or branching. + +The previous branch-local numbering collided with the already-existing ADR 0024 posterior topic-context producer contract. Architecture decision identity is repository-wide, so this genuinely distinct later decision is renumbered to ADR 0026 rather than sharing a numeric identity. + +## Decision + +TEPP publishes `tepp.lineage_pair_criterion_posterior.v2` with bijective pair identity, continuous criterion draws, separate record and event-time draws, TDT/CHRONOS provenance, unique independent anchor alignment, and CPU/GPU receipts over the same objective, parameters, and draws. On Apple Silicon the accelerator receipt is `mlx_metal_macos_native`: Rust remains the computation and validation authority. MLX Metal executes only in a macOS-native Rust-owned service; Compose reaches it through an authenticated local Unix socket or an authenticated host-gateway adapter. It never runs inside Colima's Linux VM. Python never owns or reproduces the arithmetic. Linux container/CI may record MLX CPU or CUDA only when that backend actually ran; it may never emit Metal. The CPU f64 path is an explicitly tested portability/reference fallback, not a silent replacement for a missing MLX execution. The parity bound is method-derived by the producer; a consumer may not choose or repair it. + +TEPP separately publishes `tepp.project_journey_posterior.v1`. It retains every event in stable identity order and every posterior temporal dependency, branch, and transition draw. It has no start stage, earliest-row selection, total ordering, rank, or causal status. Multiple predecessors and exact ties remain first-class. + +The Rust CHRONOS relation slice compares common event-time draws directly and publishes the complete `before`/`simultaneous`/`after` draw sequence and its posterior frequencies. It estimates no timestamp, uses no tolerance or nearest date, preserves exact ties, and cannot promote a predicted event into fact. An owning estimator may hand the Rust core an identified discrete event-time posterior as unique atoms with integer multiplicities. The core canonicalizes and materializes that mass exactly; zero mass and duplicate atoms fail closed. This operation does not estimate atom locations or posterior mass. + +For an independently observed binary TDT link criterion, the Rust scientific core fits the Bernoulli likelihood with Jeffreys' invariant `Beta(1/2, 1/2)` prior and emits posterior mean, variance, and deterministic midpoint-quantile quadrature draws. This is not a thresholded channel score. It does not turn a CHRONOS forecast into a fact, and it carries rather than invents the temporal model's event-time draws. + +## Verification and invariants + +- record time never substitutes for event time; +- present transition draws never move backward in event time; +- anchor ties, mixed draw counts, missing evidence, non-finite draws, and CPU/MLX digest or parity failures fail closed; +- synthetic tests cover record/event disagreement, multiple predecessors, branches, ties, uncertain relations, backward-edge refusal, anchor ambiguity, and hardware-receipt divergence. + +The Rust CPU independent-criterion estimator, exact event-time posterior materializer, and qualitative temporal-relation posterior have deterministic synthetic exact-recovery tests. Estimation of event-time atom locations and mass, artifact assembly with estimator-bound MLX execution, and hardware parity remain unavailable until their owning implementations and receipts pass the same gates. + +`analysis_engine::fit_exhaustive_case_deletion` is the normative producer orchestration prerequisite: it invokes one scientific fitter on `D` and every actual `D \ {i}` retained set with mutually domain-separated randomness identities, preserving deleted and retained document identities. It performs no posterior reweighting or approximation. This runner does not make the topic artifact available until a topic likelihood fitter, anchor alignment, incident relation/membership removal receipts, and estimator-bound CPU/accelerator receipts are connected. + +## Alternatives considered + +1. Earliest record as project start — rejected because reporting delay changes the journey. +2. One fixed lifecycle — rejected because evidence forms different DAGs. +3. Threshold similarity into criterion truth — rejected as circular. +4. Posterior clocks and graph relations with independent criterion evidence — accepted. +5. Keep the colliding ADR 0024 number — rejected because repository-wide architecture authority requires one immutable identity per decision. + +## Consequences and trade-offs + +Consumers can render branches and uncertainty without local inference. Artifacts are larger because draws, not point labels, cross the boundary. Until the scientific producer exists, the capability remains unavailable. + +Historic branches or discussions that refer to `0024-lineage-pair-criterion-and-project-journey-posterior.md` remain provenance only; new canonical references use ADR 0026. The unrelated ADR 0024 posterior topic-context producer identity is unchanged. + +## Failure, recovery, security, and privacy + +Malformed, oversized, mixed-provenance, ambiguous, temporally reversed, or hardware-divergent artifacts return redacted errors. A missing native Metal receipt on Apple Silicon is unavailable; recovery is replay from the owning fitted run; no consumer repair is permitted. Only opaque identities and digests cross the contract. + +## Rollback and compatibility + +Both schemas are additive. Existing deterministic project history v1 is not reinterpreted as posterior Journey evidence. Rollback disables the new adapter and retains immutable artifacts. Estimator-target or temporal-semantics changes require a superseding ADR and PRD version. + +Renumbering rollback does not reuse ADR 0024 for this decision; if ADR 0026 is rejected or superseded, its identity remains historical and a new repository-wide ADR records the successor. + +## References + +Allan, J. (Ed.). (2002). *Topic detection and tracking: Event-based information organization*. Kluwer Academic Publishers. + +Anagnostopoulos, E., Batsakis, S., & Petrakis, E. G. M. (2013). CHRONOS: A reasoning engine for qualitative temporal information in OWL. *Procedia Computer Science, 22*, 70–77. https://doi.org/10.1016/j.procs.2013.09.082 + +Li, M., Li, S., Wang, Z., Huang, L., Cho, K., Ji, H., Han, J., & Voss, C. (2021). The future is not one-dimensional: Complex event schema induction by graph modeling for event prediction. In *Proceedings of EMNLP 2021* (pp. 5203–5215). https://doi.org/10.18653/v1/2021.emnlp-main.422 + +Jeffreys, H. (1946). An invariant form for the prior probability in estimation problems. *Proceedings of the Royal Society of London. Series A, Mathematical and Physical Sciences, 186*(1007), 453–461. https://doi.org/10.1098/rspa.1946.0056 From d0152897d3b52cff6ac7b3f2d6eb5b941cf48205 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 20:22:10 +0900 Subject: [PATCH 028/235] docs(adr): remove colliding 0024 lineage-pair identity --- ...criterion-and-project-journey-posterior.md | 128 ------------------ 1 file changed, 128 deletions(-) delete mode 100644 docs/adr/0024-lineage-pair-criterion-and-project-journey-posterior.md diff --git a/docs/adr/0024-lineage-pair-criterion-and-project-journey-posterior.md b/docs/adr/0024-lineage-pair-criterion-and-project-journey-posterior.md deleted file mode 100644 index 19ec5fcb2..000000000 --- a/docs/adr/0024-lineage-pair-criterion-and-project-journey-posterior.md +++ /dev/null @@ -1,128 +0,0 @@ -# ADR 0024 — Independent lineage-pair criterion and posterior Project Journey - -**Decision status:** Proposed -**Implementation maturity:** active-PR — strict wire contracts and Rust CPU independent-criterion estimator -**Date:** 2026-08-26 -**Supersedes:** None; narrows ADR 0016 and complements ADR 0021. - -## Context - -Event-Lineage channel weights require an independent pair-level criterion; -channel covariance, a fusion floor, keywords, or one run-level accepted flag do -not identify it. Project Journey cannot treat the earliest stored record or a -fixed sales lifecycle as its start: prior projects, customer requests, -procurement notices, direct or negotiated bids, external sensing, internal -discussions, and leads can be concurrent, uncertain, or branching. - -## Decision - -TEPP publishes `tepp.lineage_pair_criterion_posterior.v2` with bijective pair -identity, continuous criterion draws, separate record and event-time draws, -TDT/CHRONOS provenance, unique independent anchor alignment, and CPU/GPU -receipts over the same objective, parameters, and draws. On Apple Silicon the -accelerator receipt is `mlx_metal_macos_native`: Rust remains the computation -and validation authority. MLX Metal executes only in a macOS-native Rust-owned -service; Compose reaches it through an authenticated local Unix socket or an -authenticated host-gateway adapter. It never runs inside Colima's Linux VM. -Python never owns or reproduces the arithmetic. Linux container/CI may record -MLX CPU or CUDA only when that backend actually ran; it may never emit Metal. -The CPU f64 path is an explicitly tested portability/reference fallback, not a -silent replacement for a missing MLX execution. The parity bound is -method-derived by the producer; a consumer may not choose or repair it. - -TEPP separately publishes `tepp.project_journey_posterior.v1`. It retains every -event in stable identity order and every posterior temporal dependency, branch, -and transition draw. It has no start stage, earliest-row selection, total -ordering, rank, or causal status. Multiple predecessors and exact ties remain -first-class. - -The Rust CHRONOS relation slice compares common event-time draws directly and -publishes the complete `before`/`simultaneous`/`after` draw sequence and its -posterior frequencies. It estimates no timestamp, uses no tolerance or nearest -date, preserves exact ties, and cannot promote a predicted event into fact. -An owning estimator may hand the Rust core an identified discrete event-time -posterior as unique atoms with integer multiplicities. The core canonicalizes -and materializes that mass exactly; zero mass and duplicate atoms fail closed. -This operation does not estimate atom locations or posterior mass. - -For an independently observed binary TDT link criterion, the Rust scientific -core fits the Bernoulli likelihood with Jeffreys' invariant -`Beta(1/2, 1/2)` prior and emits posterior mean, variance, and deterministic -midpoint-quantile quadrature draws. This is not a thresholded channel score. -It does not turn a CHRONOS forecast into a fact, and it carries rather than -invents the temporal model's event-time draws. - -## Verification and invariants - -- record time never substitutes for event time; -- present transition draws never move backward in event time; -- anchor ties, mixed draw counts, missing evidence, non-finite draws, and - CPU/MLX digest or parity failures fail closed; -- synthetic tests cover record/event disagreement, multiple predecessors, - branches, ties, uncertain relations, backward-edge refusal, anchor ambiguity, - and hardware-receipt divergence. - -The Rust CPU independent-criterion estimator, exact event-time posterior -materializer, and qualitative temporal-relation posterior have deterministic -synthetic exact-recovery tests. Estimation of event-time atom locations and -mass, artifact assembly with estimator-bound MLX execution, and hardware parity -remain unavailable until their owning implementations and receipts pass the -same gates. - -`analysis_engine::fit_exhaustive_case_deletion` is the normative producer -orchestration prerequisite: it invokes one scientific fitter on `D` and every -actual `D \ {i}` retained set with mutually domain-separated randomness -identities, preserving deleted and retained document identities. It performs -no posterior reweighting or approximation. This runner does not make the topic -artifact available until a topic likelihood fitter, anchor alignment, incident -relation/membership removal receipts, and estimator-bound CPU/accelerator -receipts are connected. - -## Alternatives considered - -1. Earliest record as project start — rejected because reporting delay changes - the journey. -2. One fixed lifecycle — rejected because evidence forms different DAGs. -3. Threshold similarity into criterion truth — rejected as circular. -4. Posterior clocks and graph relations with independent criterion evidence — - accepted. - -## Consequences and trade-offs - -Consumers can render branches and uncertainty without local inference. -Artifacts are larger because draws, not point labels, cross the boundary. Until -the scientific producer exists, the capability remains unavailable. - -## Failure, recovery, security, and privacy - -Malformed, oversized, mixed-provenance, ambiguous, temporally reversed, or -hardware-divergent artifacts return redacted errors. A missing native Metal -receipt on Apple Silicon is unavailable; recovery is replay from -the owning fitted run; no consumer repair is permitted. Only opaque identities -and digests cross the contract. - -## Rollback and compatibility - -Both schemas are additive. Existing deterministic project history v1 is not -reinterpreted as posterior Journey evidence. Rollback disables the new adapter -and retains immutable artifacts. Estimator-target or temporal-semantics changes -require a superseding ADR and PRD version. - -## References - -Allan, J. (Ed.). (2002). *Topic detection and tracking: Event-based information -organization*. Kluwer Academic Publishers. - -Anagnostopoulos, E., Batsakis, S., & Petrakis, E. G. M. (2013). CHRONOS: A -reasoning engine for qualitative temporal information in OWL. *Procedia -Computer Science, 22*, 70–77. https://doi.org/10.1016/j.procs.2013.09.082 - -Li, M., Li, S., Wang, Z., Huang, L., Cho, K., Ji, H., Han, J., & Voss, C. -(2021). The future is not one-dimensional: Complex event schema induction by -graph modeling for event prediction. In *Proceedings of EMNLP 2021* (pp. -5203–5215). https://doi.org/10.18653/v1/2021.emnlp-main.422 - -Jeffreys, H. (1946). An invariant form for the prior probability in estimation -problems. *Proceedings of the Royal Society of London. Series A, Mathematical -and Physical Sciences, 186*(1007), 453–461. -https://doi.org/10.1098/rspa.1946.0056 From 3a5786dfcacdf96a372e67c865e7c05f7887580f Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 20:28:27 +0900 Subject: [PATCH 029/235] docs(delivery): refresh live queue authority at 140 PRs --- docs/product-technical-gap-baseline.md | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index f5029bb03..c6cfc9905 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-01T10:49:02Z +**Snapshot:** 2026-09-01T11:27:07Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` **Workspace version:** `0.2.0` **Delivery authority:** issue [#175](https://github.com/ContextualWisdomLab/TEPP/issues/175), PR [#435](https://github.com/ContextualWisdomLab/TEPP/pull/435), and [`docs/delivery/pr-queue-authority-2026-09-01.md`](delivery/pr-queue-authority-2026-09-01.md) @@ -19,9 +19,9 @@ A planning document, mergeable branch, local test, predecessor-head result, queu | Signal | Current evidence | Delivery implication | | --- | ---: | --- | | Protected `main` | `1bc02f580cf48e1d39da239f0e818453437c31c3` | Capability claims remain bounded to this commit until protected main changes. | -| Open pull requests | **139** | The queue remains release-blocking. It fell from the 149-head peak to 136, then rebounded to 139 after new one-operation Analysis Run slices #445–#447 were opened while recovery remained active. | +| Open pull requests | **140** | The queue remains release-blocking. It fell from the 149-head peak to 136, then rebounded to 140 as one-operation Analysis Run slices #445–#448 were opened while recovery remained active. | | Draft pull requests | **90** | Draft state is not classification or ownership. | -| Non-draft pull requests | **49** | Ready metadata is not merge readiness without exact-head evidence. | +| Non-draft pull requests | **50** | Ready metadata is not merge readiness without exact-head evidence. | | Open issues | **14** | Includes #437 for repository-wide ADR identity normalization. | | GitHub releases | **0** | No open PR head or local branch is a released product contract. | | Effective ruleset | `18156473` | Current ruleset, exact-head workflows, resolved conversations, and qualifying review are the merge authority. | @@ -30,18 +30,19 @@ The repository-level classic branch-protection payload is not the sole policy so ## Current priority open pull-request evidence -This table is an exact-head **priority subset**, not a row-for-row copy of the 139-PR queue. The live total and this operator inventory are deliberately different concepts. +This table is an exact-head **priority subset**, not a row-for-row copy of the 140-PR queue. The live total and this operator inventory are deliberately different concepts. PR #435 itself is deliberately omitted from the exact-head table. A commit that rewrites this document necessarily advances #435's head, so embedding that same branch's “exact current head” inside the commit would be self-invalidating. The delivery-authority line links #435, while its live head is re-read from GitHub immediately before any readiness or merge decision. | PR | Exact current head | Draft | Base | Ownership / disposition | | ---: | --- | :---: | --- | --- | +| #448 | `05130b348cc75a51604188063324e74656df1c48` | false | #447/project-history stack | Analysis Run project-history cancel CLI; `fold_into_landing_vehicle` candidate | | #447 | `325590cc1664f89bf6de5f43a1b8092560dac6bc` | false | #429/project-history stack | Analysis Run project-history cancel HTTP; `fold_into_landing_vehicle` candidate | | #446 | `86a2202852595f372013d1f8ee4c604ceadbd616` | false | #445/export stack | Analysis Run export cancel CLI; `fold_into_landing_vehicle` candidate | | #445 | `e38a1c1d0bd91a97c1b6427ad2617d1837b36360` | false | #443/export stack | Analysis Run export cancel HTTP; `fold_into_landing_vehicle` candidate | | #444 | `95ab519fdb39c66a574d1452e969b0b80b9e4ba9` | false | #443/export stack | Analysis Run export collection CLI; `fold_into_landing_vehicle` candidate | | #443 | `504793d88c6b754f5181f48dc7abde073ff9146a` | false | #411/export stack | Analysis Run export collection adapter; `fold_into_landing_vehicle` candidate | -| #441 | `6f483224b3a03e8237c6f4f098a8b0e85e0a91f5` | false | main | Longitudinal Modeling lagged-correlation repair; invalid ratio retired; review threads resolved; exact-head required workflows still queued | +| #441 | `6f483224b3a03e8237c6f4f098a8b0e85e0a91f5` | false | main | Longitudinal Modeling lagged-correlation repair; invalid ratio retired; all visible review threads resolved; exact-head required workflows queued | | #436 | `460503b6e787362b702509faa955c4730f6d8680` | false | #433 head | Analysis Run/contextual-orchestrator CLI stack; `stacked_dependency` | | #434 | `c0fbaabd8c95e69407c3b9e50f8d1846bd949598` | false | main | membership-target refusal profile; `fold_into_landing_vehicle` candidate | | #432 | `3e09ff29cc89ef97a859f3ae50e1297846dd2eeb` | false | main | Topic Measurement profile binding; preserve unique contract tests | @@ -113,7 +114,7 @@ Multiple-membership weights are explicit, auditable and time-valid. They are obs | ID | Gap | Maturity | Authority | Closure evidence | | --- | --- | --- | --- | --- | -| GAP-001 | PR authority fragmented across 139 heads | `release-blocking` | #175 / #435 | exact-head classification, bounded-context landing vehicles, unique evidence preserved, safe queue reduction | +| GAP-001 | PR authority fragmented across 140 heads | `release-blocking` | #175 / #435 | exact-head classification, bounded-context landing vehicles, unique evidence preserved, safe queue reduction | | GAP-002 | multilingual span-grounded semantic/concept admission incomplete | `partial` | Evidence & Semantic Measurement | immutable offsets/layout, language profiles, concept dictionary, unknown review, invariance/calibration, hostile-input tests | | GAP-003 | shared-latent temporal topic estimator incomplete | `partial` | #167 | Rust CPU `f64` likelihood/estimands/uncertainty, time/relation/membership effects, multi-seed recovery, real candidate-K fits | | GAP-004 | durable end-to-end Analysis Run incomplete | `partial` | #166 | idempotent lifecycle, persistence/recovery, estimator-bound artifacts, complete validation evidence, separate claim promotion, Compose E2E | @@ -160,6 +161,8 @@ One-rule crates, one-clock crates and one-operation API/CLI PRs are not independ **#441 — Longitudinal Modeling lagged-correlation repair.** The invalid predecessor API that divided lagged covariance by only the earlier marginal variance was removed from the final diff after review showed it could produce impossible autocorrelations under nonstationary marginals. Exact repair head `6f483224b3a03e8237c6f4f098a8b0e85e0a91f5` places event-time association standardization in `longitudinal_core`, requires both marginal variances, enforces the covariance bound without a rounded product, and records the capability on `ARCHITECTURE.md` and `CHANGELOG.md`. All currently visible review threads are resolved. The predecessor commit remains RED/scientific-failure lineage. The one-shot self-deleting workflow is gone. The branch is not merge-ready while exact-head hosted workflows remain queued and no qualifying independent non-author APPROVE exists. Queued or predecessor-head checks are not passing evidence. +**#448 — Analysis Run project-history cancel CLI fold candidate.** This dedicated binary is stacked on #447 and is another one-operation adapter slice. Preserve its CLI parsing, fail-closed origin/credential/consumer behavior, cancellation receipt and LineageWeave-only contract, then fold it with #447 into the coherent Analysis Run/project-history landing vehicle rather than treating ADR 0080 as a new bounded-context authority. + **#447 — Analysis Run project-history cancel HTTP fold candidate.** This is another one-operation adapter slice stacked on #429. Preserve its empty-body, path/credential refusal, cancellation-removal and metric-free receipt tests, then fold it into the coherent Analysis Run/project-history vehicle rather than treating ADR 0079 as a new bounded-context authority. **#446 — Analysis Run export cancel CLI fold candidate.** This one-binary slice is stacked on #445. Preserve its CLI parsing, fail-closed origin/credential/consumer and metric-free receipt evidence, then fold it with the export landing vehicle. @@ -170,7 +173,7 @@ One-rule crates, one-clock crates and one-operation API/CLI PRs are not independ **#443 — Analysis Run export adapter fold candidate.** The export-collection GET is useful operator behavior, but one route is not an independent bounded context. Preserve its pagination, authorization and refusal tests while folding the operation into a coherent Analysis Run/export landing vehicle. -The rebound from 136 to 139 open PRs while #435 remains active is direct evidence that the WIP circuit breaker is not yet enforced by the delivery system. New one-operation slices should be folded into the existing Analysis Run landing vehicles rather than extending the branch-local ADR sequence. +The rebound from 136 to 140 open PRs while #435 remains active is direct evidence that the WIP circuit breaker is not yet enforced by the delivery system. New one-operation slices should be folded into the existing Analysis Run landing vehicles rather than extending the branch-local ADR sequence. **#356 — closed without merge.** Useful cutoff/run-binding/metric evidence is preserved in branch and review history for fold into #166. The generic `RMSE <= k * SE(RMSE)` rule, caller-declared recovery provenance, and Validation/Claim-Promotion conflation must not be revived. Scientific Claim Promotion remains a separate aggregate governed by ADR 0014. From 64277282885ded9d853feb635cbf1224ad9a705b Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 20:59:52 +0900 Subject: [PATCH 030/235] docs(adr): clarify posterior ordering and identity scope --- ...26-lineage-pair-criterion-and-project-journey-posterior.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/adr/0026-lineage-pair-criterion-and-project-journey-posterior.md b/docs/adr/0026-lineage-pair-criterion-and-project-journey-posterior.md index 98d7b8fd7..c847cd5e1 100644 --- a/docs/adr/0026-lineage-pair-criterion-and-project-journey-posterior.md +++ b/docs/adr/0026-lineage-pair-criterion-and-project-journey-posterior.md @@ -15,7 +15,7 @@ The previous branch-local numbering collided with the already-existing ADR 0024 TEPP publishes `tepp.lineage_pair_criterion_posterior.v2` with bijective pair identity, continuous criterion draws, separate record and event-time draws, TDT/CHRONOS provenance, unique independent anchor alignment, and CPU/GPU receipts over the same objective, parameters, and draws. On Apple Silicon the accelerator receipt is `mlx_metal_macos_native`: Rust remains the computation and validation authority. MLX Metal executes only in a macOS-native Rust-owned service; Compose reaches it through an authenticated local Unix socket or an authenticated host-gateway adapter. It never runs inside Colima's Linux VM. Python never owns or reproduces the arithmetic. Linux container/CI may record MLX CPU or CUDA only when that backend actually ran; it may never emit Metal. The CPU f64 path is an explicitly tested portability/reference fallback, not a silent replacement for a missing MLX execution. The parity bound is method-derived by the producer; a consumer may not choose or repair it. -TEPP separately publishes `tepp.project_journey_posterior.v1`. It retains every event in stable identity order and every posterior temporal dependency, branch, and transition draw. It has no start stage, earliest-row selection, total ordering, rank, or causal status. Multiple predecessors and exact ties remain first-class. +TEPP separately publishes `tepp.project_journey_posterior.v1`. It retains every event in deterministic, non-semantic identity serialization order and every posterior temporal dependency, branch, and transition draw. That serialization order exists only so identical artifacts produce identical bytes; consumers must not interpret it as temporal order, causal order, rank, priority, or evidence strength. The artifact has no start stage, earliest-row selection, total ordering, rank, or causal status. Multiple predecessors and exact ties remain first-class. The Rust CHRONOS relation slice compares common event-time draws directly and publishes the complete `before`/`simultaneous`/`after` draw sequence and its posterior frequencies. It estimates no timestamp, uses no tolerance or nearest date, preserves exact ties, and cannot promote a predicted event into fact. An owning estimator may hand the Rust core an identified discrete event-time posterior as unique atoms with integer multiplicities. The core canonicalizes and materializes that mass exactly; zero mass and duplicate atoms fail closed. This operation does not estimate atom locations or posterior mass. @@ -48,7 +48,7 @@ Historic branches or discussions that refer to `0024-lineage-pair-criterion-and- ## Failure, recovery, security, and privacy -Malformed, oversized, mixed-provenance, ambiguous, temporally reversed, or hardware-divergent artifacts return redacted errors. A missing native Metal receipt on Apple Silicon is unavailable; recovery is replay from the owning fitted run; no consumer repair is permitted. Only opaque identities and digests cross the contract. +Malformed, oversized, mixed-provenance, ambiguous, temporally reversed, or hardware-divergent artifacts return redacted errors. A missing native Metal receipt on Apple Silicon is unavailable; recovery is replay from the owning fitted run; no consumer repair is permitted. Identity-bearing references and error responses expose only opaque identifiers or digests. The versioned scientific payload still carries the schema-authorized posterior draws, relation sequences, frequencies, uncertainty, and execution receipts required by this decision; the opaque-identity rule does not erase those measurement fields or convert the wire contract into an identity-only envelope. ## Rollback and compatibility From e5646a0d7c59096ed5e8d68b2c1cf1a62bd4918e Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 21:00:29 +0900 Subject: [PATCH 031/235] docs(architecture): scope opaque identity boundary --- docs/architecture/temporal-dependence-composition.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/architecture/temporal-dependence-composition.md b/docs/architecture/temporal-dependence-composition.md index 979bac646..16359ba30 100644 --- a/docs/architecture/temporal-dependence-composition.md +++ b/docs/architecture/temporal-dependence-composition.md @@ -55,7 +55,7 @@ recovery_evidence_reference primary_citation_references ``` -The ACL rejects missing structural identity, unknown contract versions, digest mismatch, and a request that silently substitutes a local-independent candidate for a dependence-aware request. +The ACL rejects missing structural identity, unknown contract versions, digest mismatch, and a request that silently substitutes a local-independent candidate for a dependence-aware request. Identity-bearing fields and error responses expose only opaque identifiers or digests; this restriction does not remove schema-authorized model, event, posterior, relation, uncertainty, or statistical payload fields from the versioned ACL contract. TEPP does not duplicate the upstream `ResponseKernel`, `GeneralizedMixedStructure`, LSIRM, MLSIRM, or DLSJM implementation. When reusable static arithmetic currently exists locally in TEPP, its migration path is parity and recovery against the fast-mlsirm owner, followed by replacement with a released versioned adapter and removal of the duplicate production source. @@ -205,4 +205,4 @@ Until that contract is released, TEPP develops only ACL schema/tests and tempora ## Research basis -The canonical research discussion and APA 7 references for LSIRM, MLSIRM, and DLSJM are in [`docs/research/temporal-dependence-models.md`](../research/temporal-dependence-models.md). This architecture document intentionally does not maintain a second independent citation authority. \ No newline at end of file +The canonical research discussion and APA 7 references for LSIRM, MLSIRM, and DLSJM are in [`docs/research/temporal-dependence-models.md`](../research/temporal-dependence-models.md). This architecture document intentionally does not maintain a second independent citation authority. From 7d4bfbe7f6441805be9662c48820ab78ee1392d7 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 21:04:28 +0900 Subject: [PATCH 032/235] test(docs): require exact priority inventory heading --- scripts/validate_documentation.py | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/scripts/validate_documentation.py b/scripts/validate_documentation.py index 6a27e2a47..398aae08e 100644 --- a/scripts/validate_documentation.py +++ b/scripts/validate_documentation.py @@ -393,10 +393,14 @@ def _promotion_is_denied(text: str, claim: re.Match[str]) -> bool: def _priority_inventory_section(text: str) -> str: """Return only the canonical priority-inventory section from the gap register.""" - heading_start = text.find(PRIORITY_INVENTORY_HEADING) - if heading_start < 0: + heading = re.search( + rf"^{re.escape(PRIORITY_INVENTORY_HEADING)}[ \t]*$", + text, + re.MULTILINE, + ) + if heading is None: return "" - section_start = heading_start + len(PRIORITY_INVENTORY_HEADING) + section_start = heading.end() next_heading = LEVEL_TWO_HEADING.search(text, section_start) section_end = next_heading.start() if next_heading is not None else len(text) return text[section_start:section_end] @@ -557,4 +561,4 @@ def main() -> None: if __name__ == "__main__": - main() \ No newline at end of file + main() From a4f5ada6d4310e80b22fe01c9174c71298a5d9ef Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 21:07:27 +0900 Subject: [PATCH 033/235] test(adr): reproduce duplicate decision identities --- tests/quality/test_adr_identity_uniqueness.py | 89 +++++++++++++++++++ 1 file changed, 89 insertions(+) create mode 100644 tests/quality/test_adr_identity_uniqueness.py diff --git a/tests/quality/test_adr_identity_uniqueness.py b/tests/quality/test_adr_identity_uniqueness.py new file mode 100644 index 000000000..f920ed7e0 --- /dev/null +++ b/tests/quality/test_adr_identity_uniqueness.py @@ -0,0 +1,89 @@ +"""Regression tests for repository-wide ADR identity uniqueness.""" + +from __future__ import annotations + +import tempfile +import unittest +from pathlib import Path +from unittest import mock + +from scripts import validate_documentation as docs + + +ADR_BODY = """# ADR {number} — Test decision + +**Decision status:** Accepted +**Implementation maturity:** partial +**Supersession:** None. + +## Context + +Context. + +## Decision + +Decision. + +## Alternatives considered + +Alternative. + +## Consequences + +Consequence. + +## Verification + +Verification. + +## Rollback + +Rollback. +""" + + +class AdrIdentityUniquenessTests(unittest.TestCase): + """Reject branch-local reuse of a repository-wide ADR identifier.""" + + def _root(self, index_rows: str, files: dict[str, str]) -> Path: + temporary = tempfile.TemporaryDirectory() + self.addCleanup(temporary.cleanup) + root = Path(temporary.name) + adr_root = root / "docs" / "adr" + adr_root.mkdir(parents=True) + (adr_root / "README.md").write_text( + "| ADR | Decision | Decision status | Implementation maturity | Clarification |\n" + "|---|---|---|---|---|\n" + + index_rows, + encoding="utf-8", + ) + for name, number in files.items(): + (adr_root / name).write_text(ADR_BODY.format(number=number), encoding="utf-8") + return root + + def test_duplicate_index_rows_fail(self) -> None: + """Two index rows may not claim the same ADR number.""" + + root = self._root( + "| [0001](0001-one.md) | One | Accepted | partial | first |\n" + "| [0001](0001-one.md) | One again | Accepted | partial | duplicate |\n", + {"0001-one.md": "0001"}, + ) + with mock.patch.object(docs, "ROOT", root): + with self.assertRaisesRegex(AssertionError, "duplicate ADR index identity"): + docs.validate_adr_graph() + + def test_duplicate_numbered_files_fail(self) -> None: + """Two numbered ADR files may not share one repository-wide identity.""" + + root = self._root( + "| [0001](0001-one.md) | One | Accepted | partial | canonical |\n", + {"0001-one.md": "0001", "0001-two.md": "0001"}, + ) + with mock.patch.object(docs, "ROOT", root): + with self.assertRaisesRegex(AssertionError, "duplicate ADR file identity"): + docs.validate_adr_graph() + + +if __name__ == "__main__": # pragma: no cover + unittest.main() From b5c7688e9496066c6f7fa279f98935e1444e5aa2 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 21:09:12 +0900 Subject: [PATCH 034/235] fix(adr): reject duplicate decision identities --- scripts/validate_documentation.py | 29 ++++++++++++++++++++++++----- 1 file changed, 24 insertions(+), 5 deletions(-) diff --git a/scripts/validate_documentation.py b/scripts/validate_documentation.py index 398aae08e..dcf374423 100644 --- a/scripts/validate_documentation.py +++ b/scripts/validate_documentation.py @@ -450,21 +450,40 @@ def validate_product_technical_gap_baseline(root: Path = ROOT) -> None: def validate_adr_graph() -> None: - """Require every numbered ADR to be indexed and carry unambiguous authority metadata.""" + """Require every numbered ADR to have one repository-wide identity.""" adr_root = ROOT / "docs" / "adr" adr_index = (adr_root / "README.md").read_text(encoding="utf-8") - indexed_numbers = { + indexed_number_list = [ match.group("number") for match in ADR_TABLE_ROW.finditer(adr_index) - } + ] + duplicate_index_numbers = sorted( + number + for number in set(indexed_number_list) + if indexed_number_list.count(number) > 1 + ) + if duplicate_index_numbers: + raise AssertionError( + f"duplicate ADR index identity: {duplicate_index_numbers}" + ) + indexed_numbers = set(indexed_number_list) - adr_files: dict[str, Path] = {} + adr_paths_by_number: dict[str, list[Path]] = {} for path in sorted(adr_root.glob("[0-9][0-9][0-9][0-9]-*.md")): match = ADR_FILE_NAME.fullmatch(path.name) if not match: raise AssertionError(f"invalid ADR filename: {path.relative_to(ROOT)}") - adr_files[match.group("number")] = path + adr_paths_by_number.setdefault(match.group("number"), []).append(path) + + duplicate_file_numbers = sorted( + number for number, paths in adr_paths_by_number.items() if len(paths) > 1 + ) + if duplicate_file_numbers: + raise AssertionError( + f"duplicate ADR file identity: {duplicate_file_numbers}" + ) + adr_files = {number: paths[0] for number, paths in adr_paths_by_number.items()} file_numbers = set(adr_files) if indexed_numbers != file_numbers: raise AssertionError( From b434030a3647aa56fb67721377defec0248dbe64 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 21:09:30 +0900 Subject: [PATCH 035/235] docs(adr): preserve pre-normalization 0021 lineage --- ...21-deterministic-analysis-run-execution.md | 79 +++++++++++++++++++ 1 file changed, 79 insertions(+) create mode 100644 docs/adr/archive/pre-normalization-0021-deterministic-analysis-run-execution.md diff --git a/docs/adr/archive/pre-normalization-0021-deterministic-analysis-run-execution.md b/docs/adr/archive/pre-normalization-0021-deterministic-analysis-run-execution.md new file mode 100644 index 000000000..cf2dfcd0b --- /dev/null +++ b/docs/adr/archive/pre-normalization-0021-deterministic-analysis-run-execution.md @@ -0,0 +1,79 @@ +# ADR 0021 — Deterministic cutoff-safe analysis-run execution + +**Decision status:** Accepted +**Implementation maturity:** active-PR — stacked on PR #157; not implemented-main +**Date:** 2026-08-21 +**Supersedes:** None; complements ADR 0002, ADR 0003, ADR 0011, ADR 0013, and the terminal-result contract introduced by PR #157. +**Figma File ID:** N/A — this increment changes a Rust service crate and has no user-interface surface. +**Storybook inventory:** N/A — no reusable web object or interaction changed. + +## Context + +TEPP already accepts an analysis request and can describe a completed result, +but a buyer needs a demonstrable path between those contracts. Without one +bounded execution slice, an accepted run is only a receipt and consumers cannot +verify cutoff safety, multiple-membership preservation, or artifact identity. + +## Decision + +Add the standalone `analysis_engine` Rust crate as the first executable vertical +slice. It consumes a request, an accepted receipt, and a bounded identity-free +evidence snapshot. It: + +- excludes evidence whose `available_time` is later than the request's + `knowledge_cutoff`; +- preserves multiple-membership assignments by summing their counts rather than + reducing an evidence unit to one group; +- binds the result to the accepted run and source snapshot; +- verifies request/receipt idempotency identity before scanning the corpus; +- emits a canonical SHA-256-digested `AnalysisArtifact` and the versioned + `AnalysisRunTerminalResult` from `tepp_api`; +- returns a content-redacted failed terminal result when no evidence is + eligible; and +- remains a readiness/counting slice, not latent-variable, topic, or + psychometric estimator authority. + +The engine is deterministic, synchronous, bounded to `100_000` evidence units, +and CPU-only. Scientific estimators and their Rust CPU `f64`/GPU parity +contracts remain separate boundaries under ADR 0001 and ADR 0006. + +## Alternatives considered + +1. Keep the API as contracts only — rejected because an accepted run would not + produce a buyer-verifiable terminal outcome. +2. Put execution into `tepp_api` — rejected because transport contracts and + scientific execution would become one service boundary. +3. Add a bounded standalone engine behind the existing contracts — accepted + because it is independently testable and composable without shared tables. + +## Consequences + +Consumers can run a reproducible readiness check while seeing only opaque +identifiers, bounded counts, temporal extrema, and a digest. The engine does +not expose source text or identity mappings and does not claim a psychometric +measurement. The initial linear scan is intentionally simple; a production +large-corpus adapter must stream snapshots and preserve the same artifact +semantics before raising the bound. + +## Verification + +The stacked PR includes Rust unit and integration tests for cutoff exclusion, +multiple-membership summation, snapshot binding, duplicate identities, empty +eligibility, receipt validation, and package identity. Run: + +```text +cargo fmt --all -- --check +cargo test -p analysis_engine +cargo clippy -p analysis_engine --all-targets -- -D warnings +``` + +The supporting research and APA 7th citations are recorded in +`docs/doctoring/analysis-engine-v1.md` and the standards register. + +## Rollback and supersession + +Rollback removes the `analysis_engine` workspace member and stops publishing +the readiness artifact while preserving the request and terminal-result DTOs. +No persisted schema migration is introduced. Supersession requires a new ADR +if execution changes cutoff semantics, artifact authority, privacy fields, or +scientific estimands. From 5b15d3bf6498fa7316e002183aa0d62eb716aa3f Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 21:09:38 +0900 Subject: [PATCH 036/235] docs(adr): retire colliding pre-normalization 0021 path --- ...21-deterministic-analysis-run-execution.md | 79 ------------------- 1 file changed, 79 deletions(-) delete mode 100644 docs/adr/0021-deterministic-analysis-run-execution.md diff --git a/docs/adr/0021-deterministic-analysis-run-execution.md b/docs/adr/0021-deterministic-analysis-run-execution.md deleted file mode 100644 index cf2dfcd0b..000000000 --- a/docs/adr/0021-deterministic-analysis-run-execution.md +++ /dev/null @@ -1,79 +0,0 @@ -# ADR 0021 — Deterministic cutoff-safe analysis-run execution - -**Decision status:** Accepted -**Implementation maturity:** active-PR — stacked on PR #157; not implemented-main -**Date:** 2026-08-21 -**Supersedes:** None; complements ADR 0002, ADR 0003, ADR 0011, ADR 0013, and the terminal-result contract introduced by PR #157. -**Figma File ID:** N/A — this increment changes a Rust service crate and has no user-interface surface. -**Storybook inventory:** N/A — no reusable web object or interaction changed. - -## Context - -TEPP already accepts an analysis request and can describe a completed result, -but a buyer needs a demonstrable path between those contracts. Without one -bounded execution slice, an accepted run is only a receipt and consumers cannot -verify cutoff safety, multiple-membership preservation, or artifact identity. - -## Decision - -Add the standalone `analysis_engine` Rust crate as the first executable vertical -slice. It consumes a request, an accepted receipt, and a bounded identity-free -evidence snapshot. It: - -- excludes evidence whose `available_time` is later than the request's - `knowledge_cutoff`; -- preserves multiple-membership assignments by summing their counts rather than - reducing an evidence unit to one group; -- binds the result to the accepted run and source snapshot; -- verifies request/receipt idempotency identity before scanning the corpus; -- emits a canonical SHA-256-digested `AnalysisArtifact` and the versioned - `AnalysisRunTerminalResult` from `tepp_api`; -- returns a content-redacted failed terminal result when no evidence is - eligible; and -- remains a readiness/counting slice, not latent-variable, topic, or - psychometric estimator authority. - -The engine is deterministic, synchronous, bounded to `100_000` evidence units, -and CPU-only. Scientific estimators and their Rust CPU `f64`/GPU parity -contracts remain separate boundaries under ADR 0001 and ADR 0006. - -## Alternatives considered - -1. Keep the API as contracts only — rejected because an accepted run would not - produce a buyer-verifiable terminal outcome. -2. Put execution into `tepp_api` — rejected because transport contracts and - scientific execution would become one service boundary. -3. Add a bounded standalone engine behind the existing contracts — accepted - because it is independently testable and composable without shared tables. - -## Consequences - -Consumers can run a reproducible readiness check while seeing only opaque -identifiers, bounded counts, temporal extrema, and a digest. The engine does -not expose source text or identity mappings and does not claim a psychometric -measurement. The initial linear scan is intentionally simple; a production -large-corpus adapter must stream snapshots and preserve the same artifact -semantics before raising the bound. - -## Verification - -The stacked PR includes Rust unit and integration tests for cutoff exclusion, -multiple-membership summation, snapshot binding, duplicate identities, empty -eligibility, receipt validation, and package identity. Run: - -```text -cargo fmt --all -- --check -cargo test -p analysis_engine -cargo clippy -p analysis_engine --all-targets -- -D warnings -``` - -The supporting research and APA 7th citations are recorded in -`docs/doctoring/analysis-engine-v1.md` and the standards register. - -## Rollback and supersession - -Rollback removes the `analysis_engine` workspace member and stops publishing -the readiness artifact while preserving the request and terminal-result DTOs. -No persisted schema migration is introduced. Supersession requires a new ADR -if execution changes cutoff semantics, artifact authority, privacy fields, or -scientific estimands. From 2306cbebbb828f6be8a3c6d38d2e417aec4b087f Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 21:10:17 +0900 Subject: [PATCH 037/235] docs(adr): normalize repository-wide decision index --- docs/adr/README.md | 192 ++++++++++++++------------------------------- 1 file changed, 60 insertions(+), 132 deletions(-) diff --git a/docs/adr/README.md b/docs/adr/README.md index 1254c8079..91e92a41d 100644 --- a/docs/adr/README.md +++ b/docs/adr/README.md @@ -1,148 +1,76 @@ # Architecture Decision Records -TEPP uses numbered ADRs for decisions that constrain latent-variable meaning, temporal semantics, event ontology, multilingual measurement, numerical backends, privacy/security, persistence, orchestration, automation authority, scientific claims, and modular service boundaries. +TEPP uses repository-wide numbered ADR identities for decisions that constrain latent-variable meaning, temporal semantics, event ontology, multilingual measurement, numerical backends, privacy/security, persistence, orchestration, automation authority, scientific claims, and modular service boundaries. -Read [`ADR_POLICY.md`](ADR_POLICY.md) first. **Decision status and implementation maturity are independent. `Accepted` means the architecture decision is authoritative; it does not mean the capability is implemented or released.** +Read [`ADR_POLICY.md`](ADR_POLICY.md) first. **Decision status and implementation maturity are independent. `Accepted` means the architecture decision is authoritative; it does not mean the capability is implemented or released.** One ADR identity appears exactly once in this index and exactly once in the numbered root of `docs/adr/`. Branch-local implementation slices update implementation evidence for the owning ADR rather than minting a second row for the same decision. | ADR | Decision | Decision status | Implementation maturity | Clarification / supersession | |---|---|---|---|---| -| [0001](0001-rust-first-modular-msa.md) | Rust-first numerical core and CPU `f64` reference | Accepted | partial | Rust owns production arithmetic and the CPU reference; GPU and estimator completion remain target work. | -| [0002](0002-six-clock-temporal-semantics.md) | Six-clock temporal semantics and fail-closed historical eligibility | Accepted | partial | Protected main owns typed clocks and Allen algebra; the active consolidation PR carries clock identity, availability/cutoff, revision, provenance, and ordering gates. | -| [0003](0003-relational-event-multiple-membership.md) | Relational event ontology and time-varying multiple membership | Accepted | partial | Protected main owns the membership network and forward-transition foundation; the active consolidation PR carries typed target and identity slices. Full multilevel/MMMC estimators and persistence remain target work. | -| [0004](0004-shared-multilingual-latent-space.md) | Shared multilingual latent semantic space | Accepted | accepted-target | Shared-space estimation and measurement invariance remain the scientific target; ADR 0020 owns span-grounded units. | -| [0005](0005-posterior-esem-dsem.md) | Posterior-aware ESEM/DSEM and compositional coordinates | Accepted | active-PR | CPU `f64` fit and longitudinal within/between slices are active; invariance and multilevel estimators remain target work. | -| [0006](0006-vram-gpu-nvidia-orchestration.md) | VRAM-adaptive GPU compute and credential boundary | Accepted | accepted-target | GPU streaming/parity and backend completion remain target work; orchestration policy belongs to ADR 0010. | -| [0007](0007-rust-workspace-quality-gates.md) | Rust workspace, toolchain, and quality gates | Accepted | implemented-main | Repository quality contracts are implemented; scientific claim promotion belongs to ADR 0014. | -| [0008](0008-immutable-evidence-identities-digests-and-spans.md) | Immutable evidence identities, digests, spans, and wire reconstruction | Accepted | partial | Identity and span contracts are implemented-main; untrusted payload bounds are active in the consolidation PR. | -| [0009](0009-purpose-bound-pii-governance.md) | Purpose-bound PII governance without blanket masking | Accepted | partial | Opaque analytical IDs, purpose grants, provider minimization, retention, and encrypted mapping are covered; deployment evidence and persistent access storage remain target work. | -| [0010](0010-adaptive-llm-orchestration.md) | Adaptive LLM orchestration and test-time compute | Accepted | partial | Direct/verify/committee routing and ablation contracts exist; live provider execution and production calibration remain target work. | -| [0011](0011-standalone-modular-msa-boundary.md) | Standalone operation and modular CWL MSA boundary | Accepted | partial | Versioned service boundaries and credential separation are authoritative; production TLS and live ports remain target work. | -| [0012](0012-temporal-relational-shared-latent-topic-measurement.md) | Temporal relational shared-latent topic measurement | Accepted | partial | Coordinates and the CPU `f64` reference estimator are implemented-main; fitted candidate-`K` scoring is this PR; method effects and GPU remain accepted-target. | -| [0013](0013-bitemporal-persistence-reproducibility-and-split-authority.md) | Bitemporal persistence, reproducibility, and split authority | Accepted | partial | Migration, tenant, append-only, interval, and live SQL contracts are present; physical ERD and recovery depth remain target work. | -| [0014](0014-scientific-claim-promotion-and-release-evidence.md) | Scientific claim promotion and release evidence | Accepted | partial | Exact-head promotion authority and repository evidence exist; the complete release bundle remains target work. | -| [0015](0015-autonomous-development-review-and-merge-authority.md) | Autonomous development, review, and merge authority separation | Accepted | active-PR | Proposal, deterministic verification, publication, independent review, and merge/release authority remain separate. | -| [0016](0016-tdt-chronos-event-intelligence-boundary.md) | TDT, CHRONOS, and event-intelligence boundary | Accepted | active-PR | Span-grounded mentions with exact-extent recovery are active on this PR; unified TDT/CHRONOS workflow, interval consistency, persistence, and exports remain target work. | -| [0017](0017-hourly-contextual-orchestrator-gateway.md) | Hourly contextual-orchestrator gateway and provider discovery | Accepted | active-PR | Proposal-model execution is pinned behind a loopback gateway and remains separate from verification and merge authority. | -| [0018](0018-consumer-scoped-analysis-run-ingress.md) | Consumer-scoped modular analysis-run ingress | Accepted | active-PR | Closed consumer registry, credential-free exchange, and consumer-qualified idempotency are active. | -| [0019](0019-project-history-wire-size-symmetry.md) | Symmetric LineageWeave project-history wire-size enforcement | Accepted | active-PR | Request serialization and generated project-history projections share bounded size rules. | -| [0020](0020-span-grounded-semantic-units.md) | Span-grounded semantic units; language tags are not identity | Accepted | active-PR | First ADR 0004 production slice; concept alignment, invariance, and topic estimation are not claimed. | -| [0021](0021-lineageweave-project-history-boundary.md) | LineageWeave project-history service boundary | Accepted | active-PR | Credential-free bounded project-history API preserves LineageWeave authorization ownership. | -| [0022](0022-deterministic-analysis-run-execution.md) | Deterministic cutoff-safe analysis-run execution | Accepted | active-PR | Closes the first executable product path from accepted run to digest-bound terminal result without claiming estimator authority. | -| [0024](0024-lineage-pair-criterion-and-project-journey-posterior.md) | Independent Event Lineage pair criterion and posterior Project Journey | Proposed | active-PR | Strict artifacts preserve criterion/event-time draws, branches, ties, and CPU/GPU receipts without claiming the scientific estimator is complete. | -| [0025](0025-macos-native-rust-mlx-metal-boundary.md) | macOS-native Rust-owned MLX Metal execution | Accepted | accepted-target | Compose authenticates to a native host service; Linux never claims Metal, and actual backend/parity receipts fail closed. | -| [0023](0023-lineage-criterion-anchor-contract.md) | TEPP-owned Event Lineage criterion anchor | Accepted | active-PR | PR #237 publishes the strict accepted/rejected artifact and identities; estimator execution remains fail-closed future work. | -| [0024](0024-independent-topic-importance-anchor.md) | Posterior topic-context producer contract | Accepted | contract-only active-PR | Strict DTO/schema only; the current estimator does not emit it. fast-mlsirm owns case-deletion influence. | -| [0001](0001-rust-first-modular-msa.md) | Rust-first numerical core and CPU `f64` reference | Accepted | partial | ADR 0011 owns cross-service/MSA authority; 0001 retains numerical/backend authority. | -| [0002](0002-six-clock-temporal-semantics.md) | Six-clock temporal semantics and fail-closed historical leakage prevention | Accepted | partial | Typed clocks/intervals are implemented-main via `temporal_core`; input-process-outcome event-time order is `outcome_order` on the active PR. Remaining clock-identity and split enforcement stay accepted-target. | -| [0003](0003-relational-event-multiple-membership.md) | Relational event ontology and time-varying cross-classified multiple membership | Accepted | partial | Weighted time-varying membership network/roles and the forward-transition graph are implemented-main; IPO event-time order is `outcome_order` on the active PR; full multilevel estimators and persistence remain accepted-target. ADR 0016 owns event-intelligence tasks. | -| [0003](0003-relational-event-multiple-membership.md) | Relational event ontology and time-varying cross-classified multiple membership | Accepted | active-PR | `episode_membership` refuses episode membership windows outside the episode event-time interval; full multilevel estimators remain accepted-target. | -| [0002](0002-six-clock-temporal-semantics.md) | Six-clock temporal semantics and fail-closed historical leakage prevention | Accepted | partial | Typed clocks/intervals are implemented-main via `temporal_core`; retrospective-reporting identity is `retrospective_edge` on the active PR. Later graph/split enforcement remains target work. | -| [0003](0003-relational-event-multiple-membership.md) | Relational event ontology and time-varying cross-classified multiple membership | Accepted | partial | Weighted time-varying membership network/roles are implemented-main (PR #12); retrospective-reporting identity is `retrospective_edge` on the active PR; full multilevel estimators and persistence remain accepted-target. ADR 0016 owns event-intelligence tasks. | -| [0002](0002-six-clock-temporal-semantics.md) | Six-clock temporal semantics and fail-closed historical leakage prevention | Accepted | active-PR | Unmerged PR #8 is the canonical Task 3 replacement implementing typed clocks/intervals against the current protected-main lineage; conflicted PR #5 is superseded lineage. Later graph/split enforcement remains target work. | -| [0003](0003-relational-event-multiple-membership.md) | Relational event ontology and time-varying cross-classified multiple membership | Accepted | partial | Weighted time-varying membership network/roles are implemented-main (PR #12); copy-versus-source identity is `copy_identity` on the active PR; full multilevel estimators and persistence remain accepted-target. ADR 0016 owns event-intelligence tasks. | -| [0003](0003-relational-event-multiple-membership.md) | Relational event ontology and time-varying cross-classified multiple membership | Accepted | partial | Weighted time-varying membership network/roles are implemented-main (PR #12); customer/competitor contradiction is `role_contradiction` on this PR; full multilevel estimators and persistence remain accepted-target. ADR 0016 owns event-intelligence tasks. | -| [0003](0003-relational-event-multiple-membership.md) | Relational event ontology and time-varying cross-classified multiple membership | Accepted | partial | Weighted time-varying membership network/roles are implemented-main (PR #12); absence-is-not-negative identity is `relation_absence` on this PR; full multilevel estimators and persistence remain accepted-target. ADR 0016 owns event-intelligence tasks. | -| [0003](0003-relational-event-multiple-membership.md) | Relational event ontology and time-varying cross-classified multiple membership | Accepted | partial | Weighted time-varying membership network/roles are implemented-main (PR #12); summary-versus-source identity is `summarizes_edge` on the active PR; full multilevel estimators and persistence remain accepted-target. ADR 0016 owns event-intelligence tasks. | -| [0003](0003-relational-event-multiple-membership.md) | Relational event ontology and time-varying cross-classified multiple membership | Accepted | partial | Weighted time-varying membership network/roles are implemented-main (PR #12); inferred-versus-observed identity is `inferred_status` on the active PR; full multilevel estimators and persistence remain accepted-target. ADR 0016 owns event-intelligence tasks. | -| [0002](0002-six-clock-temporal-semantics.md) | Six-clock temporal semantics and fail-closed historical leakage prevention | Accepted | active-PR | Evidential-vs-transition gate in `support_edge` on the active PR; remaining graph/split enforcement stays accepted-target. | -| [0003](0003-relational-event-multiple-membership.md) | Relational event ontology and time-varying cross-classified multiple membership | Accepted | partial | Evidential-vs-transition identity in `support_edge` on the active PR; membership network/roles remain implemented-main; full multilevel estimators and persistence remain accepted-target. ADR 0016 owns event-intelligence tasks. | -| [0002](0002-six-clock-temporal-semantics.md) | Six-clock temporal semantics and fail-closed historical leakage prevention | Accepted | active-PR | System-clock identity in `system_clock` on the active PR; remaining graph/split enforcement stays accepted-target. | -| [0002](0002-six-clock-temporal-semantics.md) | Six-clock temporal semantics and fail-closed historical leakage prevention | Accepted | active-PR | Event-clock identity in `event_clock` on the active PR; remaining graph/split enforcement stays accepted-target. | -| [0002](0002-six-clock-temporal-semantics.md) | Six-clock temporal semantics and fail-closed historical leakage prevention | Accepted | active-PR | Assertion-clock identity in `assertion_clock` on the active PR; remaining graph/split enforcement stays accepted-target. | -| [0002](0002-six-clock-temporal-semantics.md) | Six-clock temporal semantics and fail-closed historical leakage prevention | Accepted | active-PR | Knowledge-cutoff identity is `cutoff_clock` on the active PR; typed clocks/intervals remain implemented-main via `temporal_core`. Later graph/split enforcement remains target work. | -| [0002](0002-six-clock-temporal-semantics.md) | Six-clock temporal semantics and fail-closed historical leakage prevention | Accepted | active-PR | Availability-clock identity in `available_clock` on the active PR; remaining graph/split enforcement stays accepted-target. | -| [0002](0002-six-clock-temporal-semantics.md) | Six-clock temporal semantics and fail-closed historical leakage prevention | Accepted | active-PR | Typed clocks/intervals are implemented-main; `document_clocks` refuses omitted assertion/document time on the active PR. Later graph/split enforcement remains target work. | -| [0002](0002-six-clock-temporal-semantics.md) | Six-clock temporal semantics and fail-closed historical leakage prevention | Accepted | active-PR | Provenance-vs-transition gate in `citation_edge` on the active PR; remaining graph/split enforcement stays accepted-target. | -| [0003](0003-relational-event-multiple-membership.md) | Relational event ontology and time-varying cross-classified multiple membership | Accepted | partial | Weighted time-varying membership network/roles are active-PR (PR #12); full multilevel estimators, graph ontology, and persistence remain accepted-target. ADR 0016 owns event-intelligence tasks. | -| [0004](0004-shared-multilingual-latent-space.md) | One shared multilingual latent space with explicit invariance status | Accepted | accepted-target | ADR 0020 owns the first span-grounded unit-identity slice; ADR 0012 owns the topic estimator. | -| [0004](0004-shared-multilingual-latent-space.md) | One shared multilingual latent space with explicit invariance status | Accepted | accepted-target | Prompt-versus-unique-content identity is `prompt_source` on the active PR; ADR 0012 owns the full topic-estimator contract. | -| [0004](0004-shared-multilingual-latent-space.md) | One shared multilingual latent space with explicit invariance status | Accepted | accepted-target | Corpus-background-versus-unique-content identity is `corpus_background` on the active PR; ADR 0012 owns the full topic-estimator contract. | -| [0004](0004-shared-multilingual-latent-space.md) | One shared multilingual latent space with explicit invariance status | Accepted | accepted-target | Modality-versus-unique-content identity is `modality_source` on the active PR; ADR 0012 owns the full topic-estimator contract. | -| [0004](0004-shared-multilingual-latent-space.md) | One shared multilingual latent space with explicit invariance status | Accepted | accepted-target | Copied-versus-unique-content identity is `copied_text` on the active PR; ADR 0012 owns the full topic-estimator contract. | -| [0004](0004-shared-multilingual-latent-space.md) | One shared multilingual latent space with explicit invariance status | Accepted | accepted-target | Style-versus-unique-content identity is `style_source` on the active PR; ADR 0012 owns the full topic-estimator contract. | -| [0004](0004-shared-multilingual-latent-space.md) | One shared multilingual latent space with explicit invariance status | Accepted | partial | Default stopword-deletion refusal is `stopword_deletion` on the active PR; ADR 0012 owns the full topic-estimator/backend/global-topic contract. | -| [0005](0005-posterior-esem-dsem.md) | Posterior-aware ESEM/DSEM and valid compositional coordinates | Accepted | accepted-target | Downstream psychometric authority; upstream topic/network model is clarified by ADR 0012. | -| [0002](0002-six-clock-temporal-semantics.md) | Six-clock temporal semantics and fail-closed historical leakage prevention | Accepted | partial | Typed clocks/intervals (merged PR #8) and Allen/path-consistency (merged PR #9) are implemented-main; superseded PRs #5/#6 are historical lineage only. Downstream estimator and remaining persistence-policy uses stay with their owning ADRs. | -| [0003](0003-relational-event-multiple-membership.md) | Relational event ontology and time-varying cross-classified multiple membership | Accepted | partial | Membership network/roles and forward-only relation graph are implemented-main; multilevel estimators remain accepted-target. This is an ontology/membership contract, not a statistical REM paper. ADR 0016 owns event-intelligence tasks. | -| [0001](0001-rust-first-modular-msa.md) | Rust-first numerical core and CPU `f64` reference | Accepted | partial | Workspace foundation is implemented-main; checkpoint-versus-estimator authority is `checkpoint_authority` on the active PR. ADR 0011 owns cross-service/MSA authority; 0001 retains numerical/backend authority. | -| [0002](0002-six-clock-temporal-semantics.md) | Six-clock temporal semantics and fail-closed historical leakage prevention | Accepted | active-PR | Unmerged PR #8 is the canonical Task 3 replacement implementing typed clocks/intervals against the current protected-main lineage; conflicted PR #5 is superseded lineage. Later graph/split enforcement remains target work. | -| [0003](0003-relational-event-multiple-membership.md) | Relational event ontology and time-varying cross-classified multiple membership | Accepted | active-PR | Subevent parent-window containment in `subevent_containment` on the active PR; multilevel estimators remain accepted-target. | -| [0003](0003-relational-event-multiple-membership.md) | Relational event ontology and time-varying cross-classified multiple membership | Accepted | partial | Membership network/roles and Kish ESS are implemented-main; this increment adds nested ICC with fail-closed cross-classified/multiple-membership refusal. Full multilevel/MMMC estimators, graph ontology, and remaining persistence stay accepted-target. ADR 0016 owns event-intelligence tasks. | -| [0004](0004-shared-multilingual-latent-space.md) | One shared multilingual latent space with explicit invariance status | Accepted | accepted-target | ADR 0012 owns the full topic-estimator/backend/global-topic contract. | -| [0005](0005-posterior-esem-dsem.md) | Posterior-aware ESEM/DSEM and valid compositional coordinates | Accepted | active-PR | CPU `f64` ESEM/DSEM fit in `psychometric_fit` on the active PR; `psychometric_core` input gates remain #49; invariance/multilevel remain accepted-target. | -| [0005](0005-posterior-esem-dsem.md) | Posterior-aware ESEM/DSEM and valid compositional coordinates | Accepted | active-PR | Within/between decomposition in `longitudinal_core` on the active PR; remaining ESEM/DSEM fit remains accepted-target. ADR 0012 owns the upstream topic/network contract. | -| [0002](0002-six-clock-temporal-semantics.md) | Six-clock temporal semantics and fail-closed historical leakage prevention | Accepted | partial | Typed clocks/intervals (merged PR #8), Allen/path-consistency (merged PR #9), the clock-identity/revision-order/document-completeness gates (`system_clock`, `event_clock`, `assertion_clock`, `cutoff_clock`, `available_clock`, `document_clocks`, `revision_order`), and the provenance/ordering gates (`citation_edge`, `support_edge`, `retrospective_edge`) are implemented-main; superseded PRs #5/#6 are historical lineage only; remaining graph/split enforcement stays accepted-target. | -| [0003](0003-relational-event-multiple-membership.md) | Relational event ontology and time-varying cross-classified multiple membership | Accepted | partial | Membership network/roles, Kish ESS, nested ICC, subevent parent-window containment (`subevent_containment`), the forward-only relation graph, evidential-vs-transition identity (`support_edge`), inferred-versus-observed identity (`inferred_status`), retrospective-reporting identity (`retrospective_edge`), summary-versus-source identity (`summarizes_edge`), copy-versus-source identity (`copy_identity`), location-versus-entity/language identity (`location_membership`), and IPO event-time order (`outcome_order`) are implemented-main; typed target-kind identity in `membership_target` is on PR #131; full multilevel estimators and persistence remain accepted-target. ADR 0016 owns event-intelligence tasks. | -| [0004](0004-shared-multilingual-latent-space.md) | One shared multilingual latent space with explicit invariance status | Accepted | accepted-target | ADR 0012 owns the full topic-estimator/backend/global-topic contract. | -| [0005](0005-posterior-esem-dsem.md) | Posterior-aware ESEM/DSEM and valid compositional coordinates | Accepted | active-PR | Within/between decomposition in `longitudinal_core` on the active PR; remaining ESEM/DSEM fit remains accepted-target. ADR 0012 owns the upstream topic/network contract. | -| [0006](0006-vram-gpu-nvidia-orchestration.md) | VRAM-adaptive GPU compute and model-credential boundary | Accepted | accepted-target | LLM orchestration policy superseded by ADR 0010; autonomous development authority governed by ADR 0015. | -| [0007](0007-rust-workspace-quality-gates.md) | Explicit Rust workspace, pinned toolchains, and exact quality gates | Accepted | implemented-main | ADR 0014 governs scientific/product claim promotion beyond repository-quality tooling. | -| [0008](0008-immutable-evidence-identities-digests-and-spans.md) | Immutable evidence identities, `SHA-256` digests, exact spans, and strict wire reconstruction | Accepted | implemented-main | ADR 0013 governs future persistence/reproducibility/split authority. | -| [0005](0005-posterior-esem-dsem.md) | Posterior-aware ESEM/DSEM and valid compositional coordinates | Accepted | partial | Input gates, posterior-draw point estimates, Rubin `T` on OLS loadings, CWC within/between OLS plus the contextual effect, event-time log-rate, constant- and time-varying-predictor discrete effects, exact scalar discrete process noise, lagged latent covariance and unconditional latent variance, stationary within-subject variance (`asymDIFFUSION`), trait-plus-state variance (`TRAITVAR`; not process noise), observed-indicator variance and lagged observed covariance (Eq. 5; Table 2 `MANIFESTVAR` is `Θ`, not `Var(y)`; `MANIFESTTRAITVAR` is not `MANIFESTVAR`; `Θ` does not enter lagged observed covariance; observed-indicator mean is `τ + λ μ`; `MANIFESTMEANS` is not `E(y)`; `CINT` is not `MANIFESTMEANS`; discrete latent mean is `exp(a Δt) μ_0 + (exp(a Δt) − 1)/a κ`; `T0MEANS` is not `μ_t`; evolved observed mean is `τ + λ μ_t`; `τ + λ μ_0` is not `E(y_t)`; Eq. 5 of the contemporaneous impulse is `τ + λ(μ_t + m x)`; `τ + λ μ_t` is not that observed mean; Eq. 5 of the time-independent predictor is `τ + λ(μ_t + A^{-1}[e^{A Δt} − I] B z)`; `τ + λ μ_t` is not that observed mean; `τ + λ(μ_t + m x)` is not that observed mean; `τ + λ(μ_t + e^{a(t−u)} m x)` is not that observed mean when `u ≠ t`; Eq. 5 of the within-interval impulse carry is `τ + λ(μ_t + e^{a(t−u)} m x)`; `τ + λ μ_t` is not that observed mean; `τ + λ(μ_t + m x)` is not that carried observed mean when `u ≠ t`; Table 2 `asymCINT` is `-κ / a` for `a < 0` and is not `κ`, not the finite-interval increment, not `T0MEANS`, and not `-B z / a`; p. 16 stationary `T0MEANS` is `-κ / a + −B z / a` and is not free `T0MEANS`, not `asymCINT` alone, not `asymTIPREDEFFECT` alone, and not the finite-interval discrete latent mean; Eq. 5 of that constrained mean is `τ + λ(−κ / a + −B z / a)` (`τ + λ μ_0` is not that observed mean; `MANIFESTMEANS` is not `E(y_0)`); stationary `T0VAR` is `trait + −q / (2 a) + (B / a)² v` (not free `T0VAR`, not `asymDIFFUSION` alone, not `TRAITVAR` alone, not `addedTIPREDVAR` alone; Eq. 5 is `λ²(trait + −q / (2 a) + (B / a)² v) + θ + ψ` (`λ² p_0` is not `Var(y_0)`; `λ²(−q / (2 a)) + θ` is not `Var(y_0)` when trait or TI is nonzero; `MANIFESTVAR` is not `Var(y_0)`; the constrained latent variance is not `Var(y_0)`)); §7.2 `addedTIPREDVAR` is `(B / a)² v` and is not `TRAITVAR`, not `asymDIFFUSION`, and not `-B z / a`), irregular already-centered residual lag, and strong-gated latent means are on the stacked psychometric PR; full ESEM/DSEM estimator remains accepted-target. | -| [0005](0005-posterior-esem-dsem.md) | Posterior-aware ESEM/DSEM and valid compositional coordinates | Accepted | active-PR | CPU `f64` ESEM/DSEM fit in `psychometric_fit` on the active PR; `psychometric_core` input gates remain #49; within/between decomposition in `longitudinal_core` is on the active PR; invariance/multilevel and remaining ESEM/DSEM fit remain accepted-target. ADR 0012 owns the upstream topic/network contract. | -| [0006](0006-vram-gpu-nvidia-orchestration.md) | VRAM-adaptive GPU compute and model-credential boundary | Accepted | accepted-target | LLM orchestration policy superseded by ADR 0010; autonomous development authority governed by ADR 0015. | -| [0007](0007-rust-workspace-quality-gates.md) | Explicit Rust workspace, pinned toolchains, and exact quality gates | Accepted | implemented-main | ADR 0014 governs scientific/product claim promotion beyond repository-quality tooling. | -| [0008](0008-immutable-evidence-identities-digests-and-spans.md) | Immutable evidence identities, `SHA-256` digests, exact spans, and strict wire reconstruction | Accepted | implemented-main | Identities/spans are implemented-main; inbound size/depth/identity/provenance refusal is `payload_bound` on the active PR. ADR 0013 governs persistence/split authority. | -| [0009](0009-purpose-bound-pii-governance.md) | Purpose-bound PII governance without blanket masking | Accepted | partial | Persistence retention/deletion/legal-hold (`0007`) and provider-payload minimization are implemented-main; authorization/export and deployment evidence remain accepted-target. | -| [0009](0009-purpose-bound-pii-governance.md) | Purpose-bound PII governance without blanket masking | Accepted | partial | Persistence retention/deletion/legal-hold (`0007`) and provider-payload minimization are implemented-main; untrusted-intake grant presence is `intake_authorization` on the active PR; deployment evidence remains accepted-target. | -| [0009](0009-purpose-bound-pii-governance.md) | Purpose-bound PII governance without blanket masking | Accepted | active-PR | `encrypted_mapping` AES-256-GCM envelope on the active PR; persistence retention/deletion/legal-hold (`0007`) and provider-payload minimization are implemented-main; persistence/KMS and remaining adapters stay accepted-target. Controls are not a certification claim. | -| [0009](0009-purpose-bound-pii-governance.md) | Purpose-bound PII governance without blanket masking | Accepted | partial | Retention/deletion/legal-hold and provider-payload minimization are implemented-main; provider-disclosure receipts are active-PR; deployment evidence remains accepted-target. | -| [0009](0009-purpose-bound-pii-governance.md) | Purpose-bound PII governance without blanket masking | Accepted | active-PR | Persistence retention/deletion/legal-hold (`0007`) and provider-payload minimization are implemented-main; `operational_log::try_record` and inspected `audit_event` inserts are on the active PR; tenant/purpose/role/lifetime storage, live HTTP, and certification evidence remain accepted-target. | -| [0010](0010-adaptive-llm-orchestration.md) | Adaptive LLM orchestration and test-time compute | Accepted | partial | `tepp_api` router/ablation/orchestrator binding are implemented-main; live NIM execution and production ablation evidence remain accepted-target. | -| [0010](0010-adaptive-llm-orchestration.md) | Adaptive LLM orchestration and test-time compute | Accepted | partial | `tepp_api` router/ablation/orchestrator binding are implemented-main; the `orchestrator_live` loopback interpretation listener is on this PR; live NIM execution, TLS, and production ablation evidence remain accepted-target. | -| [0009](0009-purpose-bound-pii-governance.md) | Purpose-bound PII governance without blanket masking | Accepted | active-PR | Persistence retention/deletion/legal-hold (`0007`) and provider-payload minimization implemented-main; `derived_sensitivity` inheritance on the active PR; deployment evidence remains accepted-target. | -| [0010](0010-adaptive-llm-orchestration.md) | Adaptive LLM orchestration and test-time compute | Accepted | partial | `tepp_api` router/ablation/orchestrator binding on the active PR; live NIM execution and production ablation evidence remain accepted-target. | -| [0011](0011-standalone-modular-msa-boundary.md) | Standalone operation and modular CWL MSA boundary | Accepted | partial | Owns cross-service persistence/credential/API authority; `service_tls` production bind gates are on the active PR; no direct cross-service application-table coupling. | -| [0011](0011-standalone-modular-msa-boundary.md) | Standalone operation and modular CWL MSA boundary | Accepted | partial | Owns cross-service persistence/credential/API authority; naruon interchange implemented-main and the `orchestrator_live` loopback interpretation HTTP/1.1 listener is on this PR; no direct cross-service application-table coupling. | -| [0009](0009-purpose-bound-pii-governance.md) | Purpose-bound PII governance without blanket masking | Accepted | partial | Persistence retention/deletion/legal-hold (`0007`) and provider-payload minimization implemented-main; deployment evidence remains accepted-target. | -| [0010](0010-adaptive-llm-orchestration.md) | Adaptive LLM orchestration and test-time compute | Accepted | partial | `tepp_api` router/ablation/orchestrator binding implemented-main; live NIM execution and production ablation evidence remain accepted-target. | -| [0011](0011-standalone-modular-msa-boundary.md) | Standalone operation and modular CWL MSA boundary | Accepted | partial | Owns cross-service persistence/credential/API authority; no direct cross-service application-table coupling. | -| [0012](0012-temporal-relational-shared-latent-topic-measurement.md) | Temporal Relational Shared-Latent Topic Measurement (TRSL-TM) | Accepted | partial | Coordinates and the CPU `f64` reference estimator are implemented-main; fitted candidate-`K` scoring is this PR; method effects and GPU remain accepted-target. | -| [0013](0013-bitemporal-persistence-reproducibility-and-split-authority.md) | Bitemporal persistence, reproducibility manifests, and relation-aware split authority | Accepted | partial | Owns PostgreSQL adapter semantics, immutable run/split manifests, leakage-safe partitions, and recovery identity; optional `live-sqlx` `PgPool`, live PG CI, tenant RLS, and `0006` membership implemented-main; `0007` retention/deletion/legal-hold on the active PR; remaining physical ERD/backup accepted-target. | -| [0014](0014-scientific-claim-promotion-and-release-evidence.md) | Scientific claim promotion and release evidence authority | Accepted | partial | Separates design, implementation, scientific/product claim, and release authority; repository SBOM/provenance generator implemented; checkpoint-versus-estimator refusal is `checkpoint_authority` on the active PR; full release bundle remaining. | -| [0015](0015-autonomous-development-review-and-merge-authority.md) | Autonomous development, review, and merge authority separation | Accepted | active-PR | Separates model proposal, deterministic verification, publication, independent review, and merge/release authority. | -| [0016](0016-tdt-chronos-event-intelligence-boundary.md) | TDT, CHRONOS, and Event Ontology intelligence boundary | Accepted | active-PR | TDT link precision/recall in existing `event_core`; remaining TDT/CHRONOS stack remains accepted-target. | -| [0016](0016-tdt-chronos-event-intelligence-boundary.md) | TDT, CHRONOS, and Event Ontology intelligence boundary | Accepted | accepted-target | Separates observed evidence, detection/tracking, prediction/schema inference, temporal consistency, and promoted transition authority. | -| [0021](0021-deterministic-analysis-run-execution.md) | Deterministic cutoff-safe analysis-run execution | Accepted | active-PR | Stacked on PR #157; closes the first executable buyer path from accepted run to digest-bound terminal result without claiming estimator authority. | -| [0016](0016-tdt-chronos-event-intelligence-boundary.md) | TDT, CHRONOS, and Event Ontology intelligence boundary | Accepted | active-PR | First-story FAR/miss in existing `event_core`; remaining TDT/CHRONOS stack remains accepted-target. | -| [0020](0020-span-grounded-semantic-units.md) | Span-grounded semantic units; language tags are not identity | Accepted | active-PR | First ADR 0004 production slice. Does not claim concept alignment, invariance, or a topic estimator. | -| [0017](0017-hourly-contextual-orchestrator-gateway.md) | Hourly contextual-orchestrator gateway and all-provider model discovery | Accepted | active-PR | Keeps proposal-model execution behind a pinned loopback gateway while preserving independent verifier, publisher, reviewer, and merge authority. | -| [0018](0018-consumer-scoped-analysis-run-ingress.md) | Consumer-scoped modular analysis-run ingress | Accepted | active-PR | Narrows ADR 0011 for the closed consumer registry, credential-free exchange, and consumer-qualified idempotency namespace; production TLS remains separate. | -| [0019](0019-project-history-wire-size-symmetry.md) | Symmetric project-history wire-size enforcement | Accepted | active-PR | Narrows ADR 0008 for request serialization and generated LineageWeave project-history projections. | -| [0021](0021-lineageweave-project-history-boundary.md) | LineageWeave project-history service boundary | Accepted | active-PR | Narrows ADR 0011 for the credential-free bounded project-history API and preserves LineageWeave authorization ownership. | -| [0022](0022-deterministic-analysis-run-execution.md) | Deterministic cutoff-safe analysis-run execution | Accepted | active-PR | Closes the first executable product path from accepted run to digest-bound terminal result without claiming estimator authority. | +| [0001](0001-rust-first-modular-msa.md) | Rust-first numerical core and CPU `f64` reference | Accepted | partial | Owns production arithmetic and reference-backend authority; ADR 0011 owns cross-service boundaries. | +| [0002](0002-six-clock-temporal-semantics.md) | Six-clock temporal semantics and fail-closed historical eligibility | Accepted | partial | Owns event/valid, assertion, document, system, available, and knowledge-cutoff semantics plus temporal eligibility. | +| [0003](0003-relational-event-multiple-membership.md) | Relational event ontology and time-varying cross-classified multiple membership | Accepted | partial | Owns event/relation/membership semantics; full multilevel estimators and persistence remain separate implementation work. | +| [0004](0004-shared-multilingual-latent-space.md) | Shared multilingual latent semantic space | Accepted | accepted-target | Owns multilingual latent-space and invariance intent; ADR 0020 owns span-grounded semantic-unit identity. | +| [0005](0005-posterior-esem-dsem.md) | Posterior-aware ESEM/DSEM and compositional coordinates | Accepted | active-PR | Owns longitudinal psychometric interpretation; reusable static kernels migrate to their canonical owner when applicable. | +| [0006](0006-vram-gpu-nvidia-orchestration.md) | VRAM-adaptive GPU compute and credential boundary | Accepted | accepted-target | Owns compute-backend/VRAM policy; LLM orchestration belongs to ADR 0010. | +| [0007](0007-rust-workspace-quality-gates.md) | Rust workspace, toolchain, and quality gates | Accepted | implemented-main | Owns repository quality tooling; scientific claim promotion belongs to ADR 0014. | +| [0008](0008-immutable-evidence-identities-digests-and-spans.md) | Immutable evidence identities, digests, spans, and wire reconstruction | Accepted | partial | Owns source-evidence identity and bounded reconstruction; persistence authority belongs to ADR 0013. | +| [0009](0009-purpose-bound-pii-governance.md) | Purpose-bound PII governance without blanket masking | Accepted | partial | Owns purpose-bound disclosure and re-identification controls; implementation evidence does not imply certification. | +| [0010](0010-adaptive-llm-orchestration.md) | Adaptive LLM orchestration and test-time compute | Accepted | partial | All provider execution remains behind contextual-orchestrator; LLM output has no numerical authority. | +| [0011](0011-standalone-modular-msa-boundary.md) | Standalone operation and modular CWL MSA boundary | Accepted | partial | Owns cross-service API/credential/persistence boundaries and anti-corruption-layer direction. | +| [0012](0012-temporal-relational-shared-latent-topic-measurement.md) | Temporal relational shared-latent topic measurement | Accepted | partial | Owns TEPP topic-measurement contract and fitted artifact semantics; capability promotion remains evidence-gated. | +| [0013](0013-bitemporal-persistence-reproducibility-and-split-authority.md) | Bitemporal persistence, reproducibility, and split authority | Accepted | partial | Owns PostgreSQL adapter semantics, immutable manifests, and leakage-safe split identity. | +| [0014](0014-scientific-claim-promotion-and-release-evidence.md) | Scientific claim promotion and release evidence | Accepted | partial | Keeps Validation Evidence distinct from the decision that promotes a scientific/product claim. | +| [0015](0015-autonomous-development-review-and-merge-authority.md) | Autonomous development, review, and merge authority separation | Accepted | active-PR | Keeps proposal, verification, publication, independent review, and merge/release authority separate. | +| [0016](0016-tdt-chronos-event-intelligence-boundary.md) | TDT, CHRONOS, and Event Ontology intelligence boundary | Accepted | active-PR | Separates observed evidence, event detection/tracking, prediction/schema inference, consistency, and promoted transition authority. | +| [0017](0017-hourly-contextual-orchestrator-gateway.md) | Hourly contextual-orchestrator gateway and provider discovery | Accepted | active-PR | Owns proposal-model gateway/discovery boundary; deterministic verification and merge authority remain separate. | +| [0018](0018-consumer-scoped-analysis-run-ingress.md) | Consumer-scoped modular analysis-run ingress | Accepted | active-PR | Owns closed consumer admission and consumer-qualified idempotency semantics. | +| [0019](0019-project-history-wire-size-symmetry.md) | Symmetric project-history wire-size enforcement | Accepted | active-PR | Owns bounded request/result size symmetry for the LineageWeave project-history boundary. | +| [0020](0020-span-grounded-semantic-units.md) | Span-grounded semantic units; language tags are not identity | Accepted | active-PR | First production slice of ADR 0004; does not claim completed multilingual invariance. | +| [0021](0021-lineageweave-project-history-boundary.md) | LineageWeave project-history service boundary | Accepted | active-PR | Owns the credential-free bounded project-history API while LineageWeave retains its authorization/domain authority. | +| [0022](0022-deterministic-analysis-run-execution.md) | Deterministic cutoff-safe analysis-run execution | Accepted | active-PR | Canonical identity for the analysis-engine execution decision; the pre-normalization colliding 0021 text is preserved under `archive/`. | +| [0023](0023-lineage-criterion-anchor-contract.md) | TEPP-owned Event Lineage criterion anchor | Accepted | active-PR | Owns independent criterion-anchor contract; estimator execution remains separately evidence-gated. | +| [0024](0024-independent-topic-importance-anchor.md) | Posterior topic-context producer contract | Accepted | contract-only active-PR | Owns the topic-context producer DTO/schema; fast-mlsirm owns reusable case-deletion influence arithmetic. | +| [0025](0025-macos-native-rust-mlx-metal-boundary.md) | macOS-native Rust-owned MLX Metal execution | Accepted | accepted-target | Owns native Metal execution/parity receipt boundary; Linux must not claim Metal execution. | +| [0026](0026-lineage-pair-criterion-and-project-journey-posterior.md) | Independent lineage-pair criterion and posterior Project Journey | Proposed | active-PR | Renumbered from a colliding pre-normalization 0024 identity; preserves posterior temporal/relation evidence without total-order or causal claims. | + +## Pre-normalization lineage + +The historical file [`archive/pre-normalization-0021-deterministic-analysis-run-execution.md`](archive/pre-normalization-0021-deterministic-analysis-run-execution.md) preserves the earlier branch-era ADR 0021 text byte-for-byte after that number was found to collide with the LineageWeave project-history decision. The canonical analysis-run execution decision is ADR 0022. Historical branch references to the colliding identity remain provenance, not current architecture authority. + +The former lineage-pair/Project-Journey ADR 0024 collision is represented canonically by ADR 0026; ADR 0024 remains the independent topic-importance anchor. No historical collision authorizes reuse of a retired number for a new decision. ## Decision ownership summary Use the narrowest owning ADR when decisions overlap: -- **numerical implementation / reference backend:** ADR 0001; -- **clock/time eligibility:** ADR 0002; -- **event ontology / relation / membership semantics:** ADR 0003; -- **multilingual semantic alignment:** ADR 0004; span-grounded unit identity: ADR 0020; -- **ESEM/DSEM and psychometric interpretation:** ADR 0005; -- **GPU/VRAM and model-credential boundary:** ADR 0006; -- **repository quality tooling:** ADR 0007; -- **evidence identity / spans / wire reconstruction:** ADR 0008; -- **PII/privacy authority:** ADR 0009; -- **LLM test-time compute / orchestration:** ADR 0010; -- **standalone/CWL MSA service authority:** ADR 0011; -- **topic measurement / backend/global-K/method-effect contract:** ADR 0012; -- **persistence / manifests / leakage-safe split:** ADR 0013; -- **claim maturity / release evidence:** ADR 0014; -- **autonomous development/review/merge authority:** ADR 0015; -- **TDT/CHRONOS event intelligence:** ADR 0016; -- **accepted-run execution and terminal artifact production:** ADR 0021. -- **hourly proposal gateway and provider discovery:** ADR 0017. -- **modular consumer admission / replay identity:** ADR 0018. -- **project-history wire-size symmetry:** ADR 0019. -- **LineageWeave project-history service boundary:** ADR 0021. -- **accepted-run execution and terminal artifact production:** ADR 0022. -- **independent lineage criterion and posterior Project Journey:** ADR 0023. -- **macOS-native Rust-owned MLX Metal execution:** ADR 0024. +- numerical implementation/reference backend: ADR 0001; +- clock/time eligibility: ADR 0002; +- event ontology, relation, and membership semantics: ADR 0003; +- multilingual semantic alignment: ADR 0004; span-grounded unit identity: ADR 0020; +- ESEM/DSEM and longitudinal psychometric interpretation: ADR 0005; +- GPU/VRAM compute boundary: ADR 0006; +- repository quality tooling: ADR 0007; +- evidence identity/spans/wire reconstruction: ADR 0008; +- privacy and purpose-bound disclosure: ADR 0009; +- LLM test-time compute/orchestration: ADR 0010; +- standalone/CWL MSA service authority: ADR 0011; +- topic measurement and model-artifact contract: ADR 0012; +- persistence/manifests/leakage-safe split: ADR 0013; +- scientific claim maturity/release evidence: ADR 0014; +- autonomous development/review/merge authority: ADR 0015; +- TDT/CHRONOS event intelligence: ADR 0016; +- hourly contextual-orchestrator proposal gateway: ADR 0017; +- modular analysis-run consumer admission: ADR 0018; +- project-history wire-size symmetry: ADR 0019; +- LineageWeave project-history boundary: ADR 0021; +- deterministic analysis-run execution: ADR 0022; +- Event Lineage criterion anchor: ADR 0023; +- independent topic-importance anchor: ADR 0024; +- macOS-native Rust-owned MLX/Metal boundary: ADR 0025; +- independent lineage-pair criterion and posterior Project Journey: ADR 0026. ## Change and supersession rule ADR status changes require a pull request, source traceability, tests/evidence for affected invariants, and corresponding PRD/Architecture/TRD/Traceability updates where the approved measurement target changes. Decisions that materially alter privacy authority, orchestration authority, service ownership, temporal semantics, ontology, persistence identity, scientific estimands, release evidence, or automation authority require a superseding ADR rather than silent drift. -Partial supersession must identify the exact moved decision scope in both the older ADR and this index. Historical ADR text remains evidence of why a decision existed; it must not be silently rewritten to make a later architecture appear original. +Partial supersession must identify the exact moved decision scope in both the older ADR and this index. Historical ADR text remains evidence of why a decision existed; it must not be silently rewritten to make a later architecture appear original. A pre-normalization collision may be archived outside the numbered root after its bytes are preserved and the canonical successor is explicit. From 09bf2fc78cd16f32c9cc9b6d587bc6614625893c Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 21:10:44 +0900 Subject: [PATCH 038/235] docs(adr): record analysis-run identity normalization --- ...0022-deterministic-analysis-run-execution.md | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/docs/adr/0022-deterministic-analysis-run-execution.md b/docs/adr/0022-deterministic-analysis-run-execution.md index cb7fe646d..b67386e92 100644 --- a/docs/adr/0022-deterministic-analysis-run-execution.md +++ b/docs/adr/0022-deterministic-analysis-run-execution.md @@ -3,7 +3,7 @@ **Decision status:** Accepted **Implementation maturity:** active-PR — composed on the active product branch; not implemented-main **Date:** 2026-08-21 -**Supersedes:** None; complements ADR 0002, ADR 0003, ADR 0011, ADR 0013, and the terminal-result contract. +**Supersedes:** The pre-normalization colliding `0021-deterministic-analysis-run-execution.md` identity, whose original bytes are retained at `archive/pre-normalization-0021-deterministic-analysis-run-execution.md`; complements ADR 0002, ADR 0003, ADR 0011, ADR 0013, and the terminal-result contract. **Figma File ID:** N/A — this increment changes a Rust service crate and has no user-interface surface. **Storybook inventory:** N/A — no reusable web object or interaction changed. @@ -14,6 +14,12 @@ but a consumer needs a demonstrable path between those contracts. Without one bounded execution slice, an accepted run is only a receipt and consumers cannot verify cutoff safety, multiple-membership preservation, or artifact identity. +The branch-era decision originally reused ADR 0021, which later also identified +the LineageWeave project-history boundary. Repository-wide ADR identity cannot +be branch-local, so deterministic analysis-run execution is canonicalized as +ADR 0022 and the earlier colliding bytes are retained only as historical +provenance. + ## Decision Add the standalone `analysis_engine` Rust crate as the first executable vertical @@ -56,6 +62,8 @@ produce a consumer-verifiable terminal outcome. scientific execution would become one service boundary. 3. Add a bounded standalone engine behind the existing contracts — accepted because it is independently testable and composable without shared tables. +4. Keep both decisions under ADR 0021 — rejected because one repository-wide + architecture identity cannot denote two independent decisions. ## Consequences @@ -70,6 +78,9 @@ LineageWeave may consume the topic-lineage artifact as completed model evidence beside, but never inside, the project-history temporal-association claim. The two contracts keep separate schema identities and inference-status copy. +The archived pre-normalization ADR 0021 text is historical evidence only. New +architecture references use ADR 0022 for deterministic analysis-run execution. + ## Verification The stacked PR includes Rust unit and integration tests for cutoff exclusion, @@ -97,3 +108,7 @@ the readiness artifact while preserving the request and terminal-result DTOs. No persisted schema migration is introduced. Supersession requires a new ADR if execution changes cutoff semantics, artifact authority, privacy fields, or scientific estimands. + +Identity-normalization rollback never reuses ADR 0021 for this decision. If ADR +0022 is superseded, its number remains historical and a new ADR records the +successor. From 72eb14097232fa97f41f67890bff8054bb0341b8 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 21:13:17 +0900 Subject: [PATCH 039/235] docs(delivery): refresh queue and scientific merge evidence --- .../delivery/pr-queue-authority-2026-09-01.md | 25 +++++++++++++------ 1 file changed, 17 insertions(+), 8 deletions(-) diff --git a/docs/delivery/pr-queue-authority-2026-09-01.md b/docs/delivery/pr-queue-authority-2026-09-01.md index a0f105752..85a726651 100644 --- a/docs/delivery/pr-queue-authority-2026-09-01.md +++ b/docs/delivery/pr-queue-authority-2026-09-01.md @@ -6,16 +6,16 @@ This is a live-recovery record for delivery issue #175. GitHub state supersedes - Protected default branch: `main` - Protected-main SHA observed: `1bc02f580cf48e1d39da239f0e818453437c31c3` -- Snapshot stamp: `2026-09-01T10:49:02Z` -- Open pull requests: **139** -- Draft pull requests: **90** -- Non-draft pull requests: **49** +- Snapshot stamp: `2026-09-01T12:12:35Z` +- Open pull requests: **132** +- Draft pull requests: **89** +- Non-draft pull requests: **43** - Open issues: **14** - Effective required-workflow ruleset: `18156473`, `CWL Central required workflows` - GitHub releases: **0** - `docs/product-technical-gap-baseline.md` is maintained on this recovery branch so it no longer presents a former zero-queue snapshot as current authority. -The initial observation was 141/99. The queue later peaked at 149/100, fell to 136, and then rebounded to 139 while this recovery vehicle remained open. The rebound came from additional one-operation Analysis Run slices and is a WIP circuit-breaker regression, not buyer-visible progress. A queued, skipped, cancelled, predecessor-head, or stale check is not passing evidence. +The initial observation was 141/99. The queue later peaked at 149/100, fell through 140 and 139, and is now 132/89. This reduction is useful, but new one-operation Analysis Run slices can still recreate WIP while the recovery vehicle is open; each fresh run therefore compares the live count with the immediately preceding snapshot rather than treating any historical count as authority. A queued, skipped, cancelled, predecessor-head, or stale check is not passing evidence. ## Queue authority classes @@ -75,6 +75,10 @@ Preserve each slice's unique pagination, authorization, cancellation, CLI parsin Classification: `fold_into_landing_vehicle` under the Analysis Run/project-history vehicle. Preserve its empty-body, path/credential refusal, cancellation-removal, and metric-free receipt evidence before folding. +### PR #451 — temporal-context GET by id + +Classification: `fold_into_landing_vehicle` under the existing Analysis Run/temporal-context adapter vehicle. Its path parsing, control/NUL/slash refusal, no-header replay rule, LineageWeave-only metric-free identity contract, and backward-compatibility tests are unique evidence to preserve. A single GET route and branch-local ADR number do not create a new bounded context or architecture authority. + ### PRs #352 and #355 — same Driver/ctsem TIPREDEFFECT rewrite Classification: both `fold_into_landing_vehicle` under Longitudinal Modeling; neither is selected as a separate authority. @@ -83,7 +87,7 @@ Both implement the scalar `-a * B` rewrite from the same current-main base. They ### Analysis Run transport slices -PRs for one GET/POST/CLI/status/cancel/retry/export/project-history operation are not separate bounded contexts. Classify them under the Analysis Run application context and `tepp_api` adapter. Parent/child stacks remain documented until a current-main landing vehicle preserves their unique contract tests and consumer compatibility. +PRs for one GET/POST/CLI/status/cancel/retry/export/project-history/temporal-context operation are not separate bounded contexts. Classify them under the Analysis Run application context and `tepp_api` adapter. Parent/child stacks remain documented until a current-main landing vehicle preserves their unique contract tests and consumer compatibility. ### Evidence/method refusal slices @@ -98,10 +102,15 @@ Before merge: - preserve unique tests, public compatibility contracts, citations, and doctoring; - resolve valid non-outdated review threads; - obtain the approvals required by the effective ruleset and any stronger non-stale PR-specific bar; -- require all exact-head required workflows to succeed; +- require all exact-head documentation, Rust, security, and other required workflows to succeed; +- for scientific/model vehicles, require realistic synthetic-truth evidence for the parameters the candidate actually claims: parameter/state recovery, RMSE, bias, interval/credible-interval coverage, temporal ordering and leakage safety, graph recovery where a graph is claimed, longitudinal invariance where longitudinal comparability is claimed, and CPU/GPU parity where an accelerator path is claimed; +- report Monte Carlo uncertainty for recovery summaries rather than applying arbitrary replication pass percentages; +- treat skipped, ignored, xfailed, source-rewritten, predecessor-head, or non-executed GPU tests as non-evidence; - update `docs/product-technical-gap-baseline.md`, architecture/ADR/traceability/changelog when protected-main truth changes; - do not use force push or protection bypass to simplify consolidation. +A scientific vehicle that does not claim a GPU implementation does not manufacture a GPU-parity result; it records the accelerator path as unavailable/research-only. Conversely, a vehicle that claims an accelerator implementation cannot satisfy the gate by skipping that backend. + ## DDD delivery constraint -Directory and crate moves are part of the owning product-vertical replay. Do not preserve a technical-layer or one-rule path as canonical if it obscures the domain responsibility. Conversely, do not rename all crates in one sweeping PR while 139 remote heads are active. The target bounded contexts are fixed in `docs/architecture/domain-context-map.md`; migration proceeds through safe, reviewable landing vehicles with explicit anti-corruption adapters and replacement mappings. \ No newline at end of file +Directory and crate moves are part of the owning product-vertical replay. Do not preserve a technical-layer or one-rule path as canonical if it obscures the domain responsibility. Conversely, do not rename all crates in one sweeping PR while 132 remote heads are active. The target bounded contexts are fixed in `docs/architecture/domain-context-map.md`; migration proceeds through safe, reviewable landing vehicles with explicit anti-corruption adapters and replacement mappings. From dc5804c387635cf98ffe40e97e40cb142f9b3f67 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 21:16:23 +0900 Subject: [PATCH 040/235] docs(architecture): use canonical research path --- ARCHITECTURE.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md index bc2e1fb04..7fc31b14b 100644 --- a/ARCHITECTURE.md +++ b/ARCHITECTURE.md @@ -177,4 +177,4 @@ Documents, external metadata, serialized payloads, model artifacts, and LLM outp - longitudinal/ctsem equation evidence: [`docs/research/multilevel-event-time-recovery.md`](docs/research/multilevel-event-time-recovery.md) - scientific promotion: ADR 0014 and [`docs/TRACEABILITY.md`](docs/TRACEABILITY.md) -Detailed equation-by-equation recovery evidence belongs in research/doctoring documents and executable tests, not duplicated into architecture responsibility tables. \ No newline at end of file +Detailed equation-by-equation recovery evidence belongs in `docs/research/` and executable tests, not duplicated into architecture responsibility tables. \ No newline at end of file From a6eab896bcbd9317abb33609f72fa5f18313d771 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 21:18:05 +0900 Subject: [PATCH 041/235] docs(research): narrow residual-invariance claim to verified evidence --- .../strong-invariance-latent-means.md | 39 ++++++++++--------- 1 file changed, 21 insertions(+), 18 deletions(-) diff --git a/docs/research/strong-invariance-latent-means.md b/docs/research/strong-invariance-latent-means.md index ff021bf78..983fd802f 100644 --- a/docs/research/strong-invariance-latent-means.md +++ b/docs/research/strong-invariance-latent-means.md @@ -9,44 +9,47 @@ This slice does **not** import the unpublished `measurement_invariance` crate on ## Claim boundary - `#84` `metric` licenses shared **metric** meaning. It does **not** license latent means. -- `#84` `scalar` is the strong/scalar status (equal loading and intercept). That status licenses latent means. -- Strict (also equal residual variance) also licenses latent means. Residual invariance is **not** required for those means. -- Two-observation series have no residual degrees of freedom. OLS residual variance is then identically `0` and is not an estimated residual. Those series cap at strong/scalar and still license means. +- `#84` `scalar` is the strong/scalar status (equal loading and intercept). This implementation permits latent-mean recovery at that status. +- Strict additionally requires equal residual variance and also permits latent-mean recovery. +- This document does **not** claim from primary evidence that residual/strict invariance is universally unnecessary for every latent-mean comparison. The local gate simply does not add residual equality as a further requirement once its strong/scalar loading-and-intercept contract is satisfied. That narrower implementation policy is grounded in the factor-mean model and strong/scalar boundary described below; the stronger “residual invariance is not required” wording is treated only as secondary-literature context until a primary source is verified directly. +- Two-observation series have no residual degrees of freedom. OLS residual variance is then identically `0` and is not an estimated residual. Those series cap at strong/scalar; the local OLS implementation may recover the mean difference only after its loading/intercept equality conditions pass. - This is two-group OLS, not MGCFA, not partial invariance, and not alignment optimization. -- The weak/strong/strict labels remain conventional labels here. Meredith (1993) is the primary source for the hierarchy; its Cambridge Core original-paper page and abstract were opened, but its full-text PDF was not. Unpaywall, OpenAlex, Semantic Scholar, archive.org, and Springer `content/pdf` were re-tried 2026-09-01T10:22Z and remain closed (`is_oa: false`, 0 locations; Springer historically returns an HTML stub). Putnick and Bornstein (2016) cite Meredith for residual invariance as part of *full factorial invariance*; that specific claim is not a reading of Meredith's full text. +- The weak/strong/strict labels remain conventional labels here. Meredith (1993) is the primary source for the hierarchy; its Cambridge Core original-paper page and abstract were opened, but its full-text PDF was not. Unpaywall, OpenAlex, Semantic Scholar, archive.org, and Springer `content/pdf` were re-tried 2026-09-01T10:22Z and remain closed (`is_oa: false`, 0 locations; Springer historically returns an HTML stub). No claim in this document relies on text from an unread Meredith full paper. ## Authoritative sources used for the mean gate Meredith, W. (1993). Measurement invariance, factor analysis and factorial invariance. *Psychometrika, 58*(4), 525–543. https://doi.org/10.1007/BF02294825 -The original-paper record and abstract were opened on the Cambridge Core page on 2026-08-21. Meredith defines weak measurement invariance, strong factorial invariance, and strict factorial invariance and relates factorial invariance to group differences. This is the primary source for the hierarchy used by this gate; the implementation deliberately reports the narrower local `strong`/`strict` labels rather than claiming a full multiple-group CFA. +The original-paper record and abstract were opened on the Cambridge Core page on 2026-08-21. Meredith defines weak measurement invariance, strong factorial invariance, and strict factorial invariance and relates factorial invariance to group differences. This is the primary source for the hierarchy used by this gate; the implementation deliberately reports the narrower local `strong`/`strict` labels rather than claiming a full multiple-group CFA. Because the full paper was not opened, this document does not attribute a stronger residual-invariance exception to Meredith. Sörbom, D. (1974). A general method for studying differences in factor means and factor structure between groups. *British Journal of Mathematical and Statistical Psychology, 27*(2), 229–239. https://doi.org/10.1111/j.2044-8317.1974.tb00543.x The original article record and abstract were opened on the Wiley Online Library page on 2026-08-21. Sörbom's primary model estimates factor means, loadings, and unique variances jointly from group observed means, variances, and covariances while allowing factorial-invariance constraints. It is the direct source for the factor-mean comparison target. The formula implemented here is the scalar two-group OLS reduction obtained by subtracting the observed-mean equation under equal loading and intercept; the source is not being presented as stating this crate-specific OLS formula. -Putnick, D. L., & Bornstein, M. H. (2016). Measurement invariance conventions and reporting: The state of the art and future directions for psychological research. *Developmental Review, 41*, 71–90. https://doi.org/10.1016/j.dr.2016.06.004 - -PMC author manuscript (PMC5145197) opened 2026-08-19T22:15Z from https://pmc.ncbi.nlm.nih.gov/articles/PMC5145197/. The NIHMS PDF endpoints returned HTML/500 on this cycle; the PMC HTML full text is the opened copy. - -Putnick and Bornstein write that measurement invariance is a prerequisite to comparing group means. Metric invariance is equivalence of item loadings: each item contributes to the latent construct to a similar degree across groups. Scalar invariance is equivalence of item intercepts after metric: “mean differences in the latent construct capture all mean differences in the shared variance of the items.” After those steps, “the researcher is free to compare group means on the latent factors.” Residual invariance “is not a prerequisite for testing mean differences because the residuals are not part of the latent factor” (they cite Vandenberg & Lance, 2000, unread). Configural, metric, and scalar “are required prior to group mean comparisons.” This crate’s `#84` `metric` / `scalar` split follows that terminology. The executable map remains two-group OLS, not their multiple-group CFA. - Steenkamp, J.-B. E. M., & Baumgartner, H. (1998). Assessing measurement invariance in cross-national consumer research. *Journal of Consumer Research, 25*(1), 78–90. https://doi.org/10.1086/209528 -The Oxford Academic article page and abstract were opened 2026-08-20. Steenkamp and Baumgartner connect sequential measurement-invariance requirements to when comparisons of construct means are meaningful and illustrate the procedure with multisample factor models. This is the primary source for the gate's comparison-purpose boundary; the implementation remains a narrower two-group OLS contract. +The Oxford Academic article page and abstract were opened 2026-08-20. Steenkamp and Baumgartner connect sequential measurement-invariance requirements to when comparisons of construct means are meaningful and illustrate the procedure with multisample factor models. This is a primary source for the comparison-purpose boundary used here; the implementation remains a narrower two-group OLS contract. Baumgartner, H., & Steenkamp, J.-B. E. M. (1998). Multi-group latent variable models for varying numbers of items and factors with cross-national and longitudinal applications. *Marketing Letters, 9*, 21–35. https://doi.org/10.1023/A:1007911903032 The Springer Nature article page and abstract were opened 2026-08-20. Its simulation and empirical study concerns estimates of differences between latent means. In this repository, subtracting the two-group model \(y=ν+λ f+e\) under equal loading and intercept gives \((\bar y_c-\bar y_r)/\lambda\); that algebra is an explicit derivation of this OLS slice, not a claim that the source states the same implementation formula. +## Secondary context, not primary authority for the exception + +Putnick, D. L., & Bornstein, M. H. (2016). Measurement invariance conventions and reporting: The state of the art and future directions for psychological research. *Developmental Review, 41*, 71–90. https://doi.org/10.1016/j.dr.2016.06.004 + +PMC author manuscript (PMC5145197) opened 2026-08-19T22:15Z. Putnick and Bornstein summarize scalar invariance as the point after which latent-factor means are commonly compared and state that residual invariance is not a prerequisite, citing Vandenberg and Lance (2000). That statement is useful secondary context but is **not** used here as primary evidence for a universal residual-invariance exception because the cited primary/underlying source was not verified directly in this run. + +Vandenberg, R. J., & Lance, C. E. (2000). A review and synthesis of the measurement invariance literature: Suggestions, practices, and recommendations for organizational research. *Organizational Research Methods, 3*(1), 4–70. https://doi.org/10.1177/109442810031002 + +This source remains unread in the current evidence set and therefore does not establish a scientific claim in this document. + Opened sources that constrain the surrounding longitudinal/invariance stance: Asparouhov, T., & Muthén, B. (2009). Exploratory structural equation modeling. *Structural Equation Modeling: A Multidisciplinary Journal, 16*(3), 397–438. https://doi.org/10.1080/10705510903008204 Hamaker, E. L., Kuiper, R. M., & Grasman, R. P. P. P. (2015). A critique of the cross-lagged panel model. *Psychological Methods, 20*(1), 102–116. https://doi.org/10.1037/a0038889 -Vandenberg, R. J., & Lance, C. E. (2000). A review and synthesis of the measurement invariance literature: Suggestions, practices, and recommendations for organizational research. *Organizational Research Methods, 3*(1), 4–70. https://doi.org/10.1177/109442810031002 (cited by Putnick & Bornstein, 2016, for residual invariance not being required for latent means; PDF not opened). - ## Formula notes Per group, \(y=\nu+\lambda f+e\) is fit by OLS. Status is: @@ -56,13 +59,13 @@ Per group, \(y=\nu+\lambda f+e\) is fit by OLS. Status is: - strong when loadings and intercepts match and residual variances differ, or when residual degrees of freedom are absent; - strict when both groups have residual degrees of freedom and loadings, intercepts, and residual variances match. -The latent-mean difference is \((\bar y_c-\bar y_r)/\lambda\) with \(\lambda\) the midpoint of the two loadings, and only after strong or strict. Meredith (1993) supplies the invariance hierarchy and Sörbom (1974) supplies the factor-mean comparison model; the displayed expression is the explicitly stated scalar OLS derivation for this implementation. +The latent-mean difference is \((\bar y_c-\bar y_r)/\lambda\) with \(\lambda\) the midpoint of the two loadings, and the local implementation evaluates it only after strong or strict. Meredith (1993) supplies the invariance hierarchy, Sörbom (1974) supplies the factor-mean comparison model, and Steenkamp and Baumgartner (1998) provide primary comparison-purpose context. The displayed expression is the explicitly stated scalar OLS derivation for this implementation. -The formula follows by subtracting the group means of \(y=\nu+\lambda f+e\) after the equal-loading/equal-intercept restrictions have been accepted; the cited multi-group latent-mean study supplies the comparison target, while this document records the narrower OLS derivation. +The formula follows by subtracting the group means of \(y=\nu+\lambda f+e\) after the equal-loading/equal-intercept restrictions have been accepted. This implementation policy does not assert that residual equality is scientifically irrelevant in every design; any broader exception requires separately verified primary evidence. ## Verification - strong/strict series recover a known mean difference with computed RMSE; - metric-only (equal loading, shifted intercept) and configural series return `StrongInvarianceRequired`; -- two-observation series with matching loading and intercept classify as strong, not strict, and still recover the known mean difference; -- `#84` wire-name tests: `metric` licenses shared metric meaning and refuses means; `scalar` is strong and licenses means; local `strict` is not a `#84` wire name. +- two-observation series with matching loading and intercept classify as strong, not strict, and exercise the local strong-gate recovery path; +- `#84` wire-name tests: `metric` licenses shared metric meaning and refuses means; `scalar` maps to the local strong gate; local `strict` is not a `#84` wire name. From 3f5c9d8317a7b4c588c4d6a6421cc37e5e2ca40a Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 21:18:55 +0900 Subject: [PATCH 042/235] docs(research): separate primary evidence from TEPP promotion policy --- docs/research/temporal-dependence-models.md | 58 +++++++++++++-------- 1 file changed, 36 insertions(+), 22 deletions(-) diff --git a/docs/research/temporal-dependence-models.md b/docs/research/temporal-dependence-models.md index 8d9f38758..eaf7aa8f7 100644 --- a/docs/research/temporal-dependence-models.md +++ b/docs/research/temporal-dependence-models.md @@ -1,46 +1,60 @@ # Temporal dependence model research authority -This document is the canonical primary-research register for the LSIRM, MLSIRM, and DLSJM dependence families referenced by TEPP's temporal-composition architecture. It establishes what the cited studies support and, equally importantly, what they do not establish. +This document is the canonical primary-research register for the LSIRM, MLSIRM, and DLSJM dependence families referenced by TEPP's temporal-composition architecture. It establishes what the cited studies support and, equally importantly, what they do not establish. Repository promotion policy is labeled separately and does not masquerade as a result of the cited papers. ## Scope -TEPP does not treat a published static dependence family as evidence for every possible response-family × generalized-mixed × dependence × temporal-state combination. The named studies support their stated model families. A novel temporal coupling remains `research_candidate` until the combined generative/state equation, identification and longitudinal alignment, Rust estimator, data-support conditions, and known-truth recovery are explicit and verified. +TEPP does not treat a published static dependence family as evidence for every possible response-family × generalized-mixed × dependence × temporal-state combination. The named studies support their stated model families. A novel temporal coupling remains `research_candidate` until the combined generative/state equation, identification and longitudinal comparability, Rust estimator, data-support conditions, and known-truth recovery are explicit and verified. That promotion status is **TEPP policy under ADR 0014 and ADR 0011**, not a claim that the three cited papers prescribe TEPP's release process. -The reusable static/generalized-mixed/dependence specification and numerical kernel owner is `ContextualWisdomLab/fast-mlsirm`. TEPP owns temporal/event composition, including event-or-valid time, assertion time, document time, system time, available time, knowledge cutoff, irregular intervals, time-varying membership/covariates, longitudinal alignment, and temporal recovery. +The reusable static/generalized-mixed/dependence specification and numerical kernel owner is `ContextualWisdomLab/fast-mlsirm`. TEPP owns temporal/event composition, including event-or-valid time, assertion time, document time, system time, available time, knowledge cutoff, irregular intervals, time-varying membership/covariates, longitudinal comparability, and temporal recovery. Repository ownership is an architectural decision under ADR 0011, not a conclusion of the psychometric papers. -## LSIRM +## LSIRM — primary evidence and extension boundary -Jeon et al. (2021) introduce a latent-space item response model in which residual person–item interactions are represented through person and item positions and their latent-space relationship. For TEPP this supports the existence and interpretation of a residual person–item interaction geometry. It does not establish that known testlets, raters, item families, hierarchy, cross-classification, multiple membership, or omitted covariates should be absorbed by that geometry. +Jeon et al. (2021) introduce a latent-space item response model in which residual person–item interactions are represented through person and item positions and their latent-space relationship. For TEPP this supports the existence and interpretation of a residual person–item interaction geometry. It does not establish that known testlets, raters, item families, hierarchy, cross-classification, multiple membership, or omitted covariates should be absorbed by that geometry (Jeon et al., 2021). -A temporal LSIRM extension is therefore not automatically `supported`. Longitudinal use additionally requires an explicit state model for the interaction geometry, identification across occasions, translation/rotation/reflection alignment, uncertainty propagation, and known-truth recovery. +The cited study is static and does not establish a TEPP temporal state equation. Accordingly, requiring an explicit temporal state model, cross-occasion identification/alignment, uncertainty propagation, and temporal known-truth recovery before a new longitudinal LSIRM is promoted is **TEPP scientific-promotion policy** governed by ADR 0014. These are prerequisites for TEPP to make a longitudinal claim; they are not presented as requirements printed by Jeon et al. (2021). -## MLSIRM +## MLSIRM — primary evidence and extension boundary -Kang and Jeon (2025) develop a multidimensional latent-space item-response formulation. In TEPP terminology, MLSIRM refers to that multidimensional-main-effect latent-space extension; the acronym is not redefined to mean “multilevel LSIRM.” Multilevel, cross-classified, and multiple-membership structure is represented separately in the generalized-mixed specification. +Kang and Jeon (2025) develop a multidimensional latent-space item-response formulation and discuss conditional dependence in that multidimensional setting. In TEPP terminology, MLSIRM refers to that multidimensional-main-effect latent-space extension; the acronym is not redefined to mean “multilevel LSIRM” (Kang & Jeon, 2025). Multilevel, cross-classified, and multiple-membership structure is represented separately in TEPP's generalized-mixed specification by architecture policy. -Temporal MLSIRM candidates must preserve the exact base response formulation, multidimensional loading/trait structure, person/item interaction geometry, and the temporal identification required to compare states over time. Exploratory loading or geometry hypotheses do not become production longitudinal scoring structure without confirmatory/invariance and recovery evidence. +Preserving the exact base response formulation, multidimensional loading/trait structure, and person/item interaction geometry follows the need not to change the model being attributed to Kang and Jeon (2025). Requiring a declared temporal identification/alignment procedure, longitudinal invariance evidence, and recovery before interpreting cross-time trajectories is **TEPP extension and claim-promotion policy** under ADR 0014; the 2025 paper is not cited as a longitudinal MLSIRM validation study. -## DLSJM +## DLSJM — primary evidence and extension boundary -Jin and Jeon (2019) provide the canonical baseline for the doubly latent-space joint model of local item dependence and local person dependence. DLSJM keeps the item-dependence and person-dependence spaces distinct; it is not an alias for LSIRM person–item interaction geometry. +Jin and Jeon (2019) provide the canonical baseline for the doubly latent-space joint model of local item dependence and local person dependence. DLSJM keeps the item-dependence and person-dependence spaces distinct; it is not an alias for LSIRM person–item interaction geometry (Jin & Jeon, 2019). -TEPP temporal DLSJM research candidates must therefore keep separate item-space and person-space states, distances, clusters, and uncertainty. Comparison across occasions requires explicit translation/rotation/reflection alignment for each space and cluster-label alignment where clusters are interpreted longitudinally. Raw maps from separate occasions are not longitudinal evidence. +TEPP therefore preserves separate item-space and person-space parameter/state identities when it creates a temporal DLSJM research candidate. The cited DLSJM is not itself evidence for a longitudinal DLSJM state process. Requiring explicit cross-occasion coordinate alignment and, when clusters are interpreted, label alignment before comparing maps is **TEPP temporal-extension policy** designed to prevent raw non-identified coordinate maps from being treated as longitudinal evidence. A primary longitudinal DLSJM source must be added here before those extension-specific procedures are attributed to published research. -## Promotion and recovery rule +## Scientific evidence carried from the primary families -For any LSIRM/MLSIRM/DLSJM temporal candidate, `supported` requires all of the following: +The following requirements concern fidelity to the cited static families rather than TEPP release governance: + +- an LSIRM attribution must retain the residual person–item latent-space interaction structure supported by Jeon et al. (2021); +- an MLSIRM attribution must retain the multidimensional latent-space response formulation supported by Kang and Jeon (2025); +- a DLSJM attribution must keep local item-dependence and local person-dependence spaces distinct as in Jin and Jeon (2019); +- novel response-family, generalized-mixed, or temporal couplings must be labeled as extensions rather than described as if they appeared in those papers. + +## TEPP promotion and recovery policy + +The following is repository policy governed by ADR 0014 (scientific claim promotion), ADR 0011 (service/model ownership), ADR 0002 (temporal semantics), and the approved PRD. It is intentionally stronger and broader than what any one cited dependence paper establishes. + +For an LSIRM/MLSIRM/DLSJM **temporal** candidate to be classified `supported`, TEPP requires: - exact base response and generalized-mixed formulation; - exact dependence formulation and parameter blocks; -- explicit temporal generative/state equation and clock-role semantics; -- identification and longitudinal map-alignment rules; +- explicit temporal generative/state equation and six-clock role semantics; +- identified longitudinal comparison procedure, including map alignment when the representation is only identifiable up to transformations; - implemented estimator owned by the canonical repository; -- leakage-safe event-time/available-time recovery design; -- model-appropriate RMSE, bias, interval coverage, convergence and uncertainty evidence; -- recovery under irregular gaps, delayed/retrospective records, missing occasions, changing memberships, and applicable language/source drift; -- primary-source traceability for the established components and explicit extension labeling for novel couplings. - -Auto-expansion only materializes a candidate contract. It does not satisfy these promotion conditions. +- leakage-safe recovery that separates event-or-valid time from available time and enforces the analysis knowledge cutoff; +- model-appropriate known-truth recovery with RMSE, bias, interval/credible-interval coverage, convergence, and uncertainty reporting for the parameters actually claimed; +- irregular-gap, delayed/retrospective-record, missing-occasion, and changing-membership cases when the temporal formulation permits them; +- language/source drift tests when multilingual/source invariance is part of the claim; +- CPU `f64` reference evidence and CPU/GPU parity only when an accelerator implementation is claimed; a skipped or unexecuted GPU path is not evidence; +- Monte Carlo uncertainty for simulation summaries rather than an arbitrary replication pass percentage; +- primary-source traceability for established model components and explicit `research_candidate` labeling for novel couplings. + +These items are acceptance evidence for a TEPP claim. They should not be cited as findings of Jeon et al. (2021), Jin and Jeon (2019), or Kang and Jeon (2025) unless a specific item is explicitly supported by the relevant paper. Auto-expansion only materializes a candidate contract; it does not satisfy TEPP's promotion conditions. ## APA 7 references From c0d61fb4745fcdae2b3e9f7449c6c26889a84bae Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 21:33:51 +0900 Subject: [PATCH 043/235] docs: refresh live queue and DDD gap baseline --- docs/product-technical-gap-baseline.md | 286 ++++++++++--------------- 1 file changed, 115 insertions(+), 171 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index c6cfc9905..a421e5348 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,145 +1,171 @@ # Product and Technical Gap Baseline -**Status:** Active delivery recovery -**Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-01T11:27:07Z -**Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` -**Workspace version:** `0.2.0` -**Delivery authority:** issue [#175](https://github.com/ContextualWisdomLab/TEPP/issues/175), PR [#435](https://github.com/ContextualWisdomLab/TEPP/pull/435), and [`docs/delivery/pr-queue-authority-2026-09-01.md`](delivery/pr-queue-authority-2026-09-01.md) +**Status:** Active delivery recovery +**Product:** Temporal Event Psychometrics Platform (TEPP) +**Snapshot:** 2026-09-01T12:31:35Z +**Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` +**Workspace version:** `0.2.0` +**Delivery authority:** issue [#175](https://github.com/ContextualWisdomLab/TEPP/issues/175), PR [#435](https://github.com/ContextualWisdomLab/TEPP/pull/435), and [`docs/delivery/pr-queue-authority-2026-09-01.md`](delivery/pr-queue-authority-2026-09-01.md) **DDD authority:** [`docs/architecture/domain-context-map.md`](architecture/domain-context-map.md) and [`docs/architecture/temporal-dependence-composition.md`](architecture/temporal-dependence-composition.md) ## Purpose -This is the operator-facing authority for the current product and technical gaps. Historical queue snapshots remain in Git history; stale counts and branch-local architecture claims are not carried forward as current facts. +This document is the operator-facing authority for current product and technical gaps. Historical queue snapshots remain in Git history. A planning document, mergeable branch, local test, predecessor-head result, queued/skipped check, ADR number, or LLM judgment does not make a capability shipped. -A planning document, mergeable branch, local test, predecessor-head result, queued/skipped check, ADR number, or LLM judgment does not make a capability shipped. Re-read live GitHub state before every merge, release, scientific claim, or customer-facing maturity claim. +Passing or queued Checks on an open PR never promote that PR to implemented-main. ## Live snapshot | Signal | Current evidence | Delivery implication | | --- | ---: | --- | | Protected `main` | `1bc02f580cf48e1d39da239f0e818453437c31c3` | Capability claims remain bounded to this commit until protected main changes. | -| Open pull requests | **140** | The queue remains release-blocking. It fell from the 149-head peak to 136, then rebounded to 140 as one-operation Analysis Run slices #445–#448 were opened while recovery remained active. | -| Draft pull requests | **90** | Draft state is not classification or ownership. | -| Non-draft pull requests | **50** | Ready metadata is not merge readiness without exact-head evidence. | +| Open pull requests | **135** | Release-blocking WIP remains high despite falling from the observed peak of 149. | +| Draft pull requests | **89** | Draft status is workflow metadata, not scientific or domain classification. | +| Non-draft pull requests | **46** | Ready metadata is not merge readiness without exact-head evidence. | | Open issues | **14** | Includes #437 for repository-wide ADR identity normalization. | -| GitHub releases | **0** | No open PR head or local branch is a released product contract. | -| Effective ruleset | `18156473` | Current ruleset, exact-head workflows, resolved conversations, and qualifying review are the merge authority. | +| GitHub releases | **0** | No open PR head or local branch is a released TEPP product contract. | +| Effective organization ruleset | `18156473` | Current ruleset, exact-head workflows, resolved conversations and qualifying review govern merge. | -The repository-level classic branch-protection payload is not the sole policy source. Do not infer that protection is absent from an empty classic required-check list and do not bypass the organization ruleset. +The classic branch-protection payload is not the sole policy source. Organization rulesets are the effective merge authority where applicable. -## Current priority open pull-request evidence +The queue fell from 149 to 134, then returned to 135 when #454 appeared. New one-operation Analysis Run slices therefore still count as WIP regression while queue recovery is active even though overall predecessor closure is reducing the queue. -This table is an exact-head **priority subset**, not a row-for-row copy of the 140-PR queue. The live total and this operator inventory are deliberately different concepts. +## Current priority open pull-request evidence -PR #435 itself is deliberately omitted from the exact-head table. A commit that rewrites this document necessarily advances #435's head, so embedding that same branch's “exact current head” inside the commit would be self-invalidating. The delivery-authority line links #435, while its live head is re-read from GitHub immediately before any readiness or merge decision. +This table is an exact-head **priority subset**, not a row-for-row copy of the 135-PR queue. PR #435 itself is omitted because writing its own exact head into a commit on that branch would immediately make the embedded head stale. | PR | Exact current head | Draft | Base | Ownership / disposition | | ---: | --- | :---: | --- | --- | -| #448 | `05130b348cc75a51604188063324e74656df1c48` | false | #447/project-history stack | Analysis Run project-history cancel CLI; `fold_into_landing_vehicle` candidate | -| #447 | `325590cc1664f89bf6de5f43a1b8092560dac6bc` | false | #429/project-history stack | Analysis Run project-history cancel HTTP; `fold_into_landing_vehicle` candidate | -| #446 | `86a2202852595f372013d1f8ee4c604ceadbd616` | false | #445/export stack | Analysis Run export cancel CLI; `fold_into_landing_vehicle` candidate | -| #445 | `e38a1c1d0bd91a97c1b6427ad2617d1837b36360` | false | #443/export stack | Analysis Run export cancel HTTP; `fold_into_landing_vehicle` candidate | -| #444 | `95ab519fdb39c66a574d1452e969b0b80b9e4ba9` | false | #443/export stack | Analysis Run export collection CLI; `fold_into_landing_vehicle` candidate | -| #443 | `504793d88c6b754f5181f48dc7abde073ff9146a` | false | #411/export stack | Analysis Run export collection adapter; `fold_into_landing_vehicle` candidate | -| #441 | `6f483224b3a03e8237c6f4f098a8b0e85e0a91f5` | false | main | Longitudinal Modeling lagged-correlation repair; invalid ratio retired; all visible review threads resolved; exact-head required workflows queued | -| #436 | `460503b6e787362b702509faa955c4730f6d8680` | false | #433 head | Analysis Run/contextual-orchestrator CLI stack; `stacked_dependency` | -| #434 | `c0fbaabd8c95e69407c3b9e50f8d1846bd949598` | false | main | membership-target refusal profile; `fold_into_landing_vehicle` candidate | -| #432 | `3e09ff29cc89ef97a859f3ae50e1297846dd2eeb` | false | main | Topic Measurement profile binding; preserve unique contract tests | -| #425 | `c11558313dd1b95d7528eb5fcb89ad296cf879c0` | false | main | Analysis Run/contextual-orchestrator create CLI stack root candidate | -| #389 | `035bfb087d47543fd7dd87cfdbc4edd778f4a6aa` | false | main | irregular event-time composition; Longitudinal Modeling fold candidate | - -Passing or queued Checks on an open PR never promote that PR to implemented-main. +| #454 | `c911fbcd6e13046358cc7f3692775ed4b008dadd` | false | #453 head | Analysis Run/contextual-orchestrator stored-request CLI; `fold_into_landing_vehicle` | +| #453 | `baee8854e99dc416b2b907a22101c53a6eca9eca` | false | #438 head | Analysis Run/contextual-orchestrator stored-request GET; `fold_into_landing_vehicle` | +| #452 | `cb97aad9f87283df4d94abe8c6df61a0a476c893` | false | #451 head | Analysis Run/LineageWeave temporal-context retrieval CLI; `fold_into_landing_vehicle` candidate | +| #451 | `7b117e8f69cd74e28eceaf1748c6a9210f5dffbc` | false | main | Analysis Run/LineageWeave temporal-context GET-by-id; `fold_into_landing_vehicle` candidate | +| #443 | `504793d88c6b754f5181f48dc7abde073ff9146a` | false | #411 head | Analysis Run/export collection adapter; `fold_into_landing_vehicle` | +| #441 | `6f483224b3a03e8237c6f4f098a8b0e85e0a91f5` | false | main | Longitudinal Modeling lagged-correlation root-cause repair; auto-merge enabled, exact-head hosted gates still pending | ## Strategic Domain-Driven Design baseline -Cargo crates are implementation units, not bounded contexts. Current product responsibility is organized as follows. +Cargo crates and HTTP routes are implementation units, not bounded contexts. | Subdomain | Bounded context | Aggregate authority | Primary implementation nucleus | | --- | --- | --- | --- | | Core | Evidence & Semantic Measurement | `EvidenceCorpus`, `SemanticUnitSet`, `ConceptDictionaryRevision` | `evidence_core`, `semantic_core` | -| Core | Temporal Event Knowledge | `EventEpisode`, `TemporalRelationSet`, `MembershipAssignmentSet` | `temporal_core`, `event_core`, `relation_graph`, `membership_core` | -| Core | Topic Measurement | `TopicModelRun`, `TopicLineage` | `topic_measurement`, `topic_lineage`, `model_selection`, `network_analysis` | -| Core | Longitudinal Modeling / Temporal Psychometric Composition | `TemporalModelSpecification`, `TemporalModelRun` | `longitudinal_core` plus TEPP temporal composition around versioned fast-mlsirm contracts | -| Core | Analysis Run | `AnalysisRun` | `analysis_engine` application services; transport remains adapter-owned | -| Core | Scientific Validation & Claim Promotion | `ValidationStudy`, `ClaimPromotionDecision` | `validation_core`, `tepp_simulation`; claim promotion is distinct from evidence generation | +| Core | Temporal Semantics | `TemporalEvidenceWindow`, `KnowledgeCutoffPolicy` | temporal primitives and cutoff policy | +| Core | Event Ontology & Temporal Graph | `EventEpisode`, `TemporalRelationSet` | `event_core`, `relation_graph` | +| Core | Measurement | `MeasurementSpecification`, `MeasurementRun` | topic/measurement modules plus released fast-mlsirm ACL | +| Core | Longitudinal Modeling | `TemporalModelSpecification`, `TemporalModelRun` | `longitudinal_core` and temporal/event composition | +| Core | Validation | `ValidationStudy`, `ValidationEvidence` | `validation_core`, `tepp_simulation` | +| Supporting | Projection / Analysis Run | `AnalysisRun`, published read models | application services with HTTP/CLI as adapters | | Supporting | Interpretation | evidence-grounded interpretation workflow | contextual-orchestrator ACL only | | Supporting | Persistence & Recovery | repository implementations and durable receipts | `persistence_postgres` and object-store adapters | -| Supporting | Runtime Security & Operations | authenticated tenancy/operations | runtime adapters | -| Generic | Compute backend | backend execution receipt | CPU/GPU/MLX adapters; receipt is not scientific authority | +| Generic | Compute backend | execution receipt | CPU/GPU/MLX adapters; execution is not scientific authority | ### Canonical owner boundaries -- **fast-mlsirm** owns reusable static/generalized-mixed/dependence-aware psychometric model specification and numerical kernels, including LSIRM/MLSIRM/DLSJM, under ADR 0011's cross-service boundary. -- **TEPP** owns temporal/event composition: the six-clock contract, cutoff safety, irregular time, time-varying covariates/random effects/memberships, longitudinal invariance/drift, state evolution, event ontology/graph, temporal alignment and temporal recovery. -- **contextual-orchestrator** owns every LLM provider call, routing/fallback, credential, verifier/adjudicator execution, and model-call provenance. -- **LineageWeave or the consuming product** owns source/item-generation lineage; lineage is evidence, not numerical authority. +- **fast-mlsirm** owns reusable static/generalized-mixed/dependence-aware psychometric model specification and numerical kernels, including reusable LSIRM/MLSIRM/DLSJM computation. +- **TEPP** owns temporal/event composition: event/valid/assertion/document/system/available time semantics, leakage-safe knowledge cutoff, irregular intervals, time-varying covariates/random effects/memberships, longitudinal invariance/drift, event ontology/graph, temporal alignment, state evolution and temporal recovery. +- **contextual-orchestrator** owns every model-provider call, routing/fallback, credential, verifier/adjudicator execution and LLM call provenance. +- **LineageWeave or the consuming product** owns source/item-generation lineage; lineage is evidence rather than numerical authority. +- **context-graph-contracts** is a contract-only Shared Kernel and **enterprise-architecture-core** is the authoritative EA Decision Plane. TEPP consumes only released/versioned contracts through ACLs and never writes cross-service SQL. + +### Six-clock invariant -At this snapshot, fast-mlsirm PR #1714 at `cf538931199c4433a2c018c970d3609e17939505` proposes the non-numerical candidate compiler. It preserves full candidate identity and formulation-scoped evidence but remains an unreleased upstream dependency. A TEPP consumer-boundary review also requires an explicit published-manifest schema/version/digest and typed generalized-mixed membership/weight semantics before this can serve as TEPP's versioned Published Language. TEPP does not copy its implementation or bind deployable behavior to the open head. +The following meanings remain distinct in code, schema and tests: -### Dependency invariants +- `event_time`: when a substantive event occurs; +- `assertion_time`: when a statement claims or records an event/state; +- `document_time`: when the source document is created/revised/published; +- `system_time`: when TEPP records the fact; +- `available_time`: when evidence became usable by an analysis; +- `knowledge_cutoff`: the latest available-time admitted to a run. -- Domain/application code does not depend on HTTP, CLI, PostgreSQL tables, provider SDK DTOs, or UI state. -- `tepp_api` is an adapter around Analysis Run and published read models; it does not own estimator mathematics, temporal truth, or scientific claim promotion. -- Persistence adapters implement repository contracts. Cross-context direct SQL is prohibited. -- External contexts are isolated behind versioned anti-corruption layers. -- A compute receipt proves execution of the named operation, not scientific validity. -- LLM output may propose or verify an interpretation but cannot satisfy a numerical recovery contract or promote a scientific claim. +A valid retrospective document may point to an earlier event, but it cannot enter an earlier knowledge cutoff. Forward state/transition edges are distinct from retrospective, citation, revision and provenance relations. ## Temporal dependence composition -TEPP composes time over the **full upstream candidate identity**, not over hard-coded family names. A compatible new fast-mlsirm base family therefore inherits temporal-candidate compilation without a TEPP family-specific wrapper. +TEPP composes time over the full released upstream candidate identity rather than hard-coded family names. A compatible base family added to fast-mlsirm should inherit temporal-candidate compilation without a TEPP family-specific wrapper. + +Each temporal candidate records: + +- released upstream contract version and digest; +- exact base formulation and parameter meaning; +- generalized-mixed and dependence structures; +- status: `supported`, `research_candidate`, or `unsupported`; +- temporal state/generative equation; +- event/occasion clock roles; +- identification/alignment constraints; +- time-varying covariates, random effects and membership semantics; +- estimator owner; +- required data support; +- primary citations; +- recovery contract and current recovery status. + +Auto-expansion is not auto-activation. Unknown or novel couplings remain `research_candidate`. Incoherent combinations are `unsupported`. No dependence-aware temporal request is silently simplified to a static/local-independent model. + +### Base-family identity + +Rasch remains distinct from generic 1PL. Formulation-qualified 2PLM–5PLM retain their parameter meanings. Confirmatory/exploratory MIRT and ideal-point/GGUM response processes are distinct axes from hierarchy, dependence and time. Testlet, rater/facet, nested, crossed, cross-classified and multiple-membership structure remain explicit. -Every TEPP temporal candidate records the upstream contract version/digest, exact base formulation, generalized-mixed structure, dependence structure, clock roles, event/occasion semantics, state equation, temporal identification/alignment rules, time-varying membership/covariates, estimator owner, recovery contract, citations, and one status: `supported`, `research_candidate`, or `unsupported`. +Known hierarchy/testlet/rater/method/item-family effects are modeled before residual latent-space dependence. Cross-classification and multiple membership are distinct. Multiple-membership weights are explicit, auditable, time-valid and either observed/normalized or model-estimated according to the declared formulation; equal weights are never invented as a fallback. -Auto-expansion is not auto-activation. Unknown or novel couplings remain `research_candidate`; incoherent couplings are `unsupported`. TEPP never silently simplifies a dependence-aware temporal request to a static or local-independent model. +### LSIRM / MLSIRM / DLSJM -The canonical dependence-family research authority is [`docs/research/temporal-dependence-models.md`](research/temporal-dependence-models.md). +LSIRM/MLSIRM temporal candidates preserve the complete base-family parameterization plus person/item positions, distances/interactions and the declared generalized-mixed structure. Dynamic latent-space evolution remains `research_candidate` until state equations, longitudinal identification/alignment and recovery exist. -### LSIRM / MLSIRM +DLSJM temporal candidates retain distinct item-dependence and person-dependence spaces. Jin and Jeon (2019) is the baseline authority for DLSJM itself; novel temporal couplings remain extensions. Translation/rotation/reflection and cluster-label alignment are required before maps or clusters are compared across occasions. -LSIRM residual person-item interaction keeps person/item interaction positions, distances and interaction strength separate from known hierarchy, testlets, raters, methods and covariates. MLSIRM is the **multidimensional-main-effect** latent-space extension; multilevel, cross-classified and multiple-membership operators are orthogonal generalized-mixed structure. Temporal maps require declared translation/rotation/reflection identification before coordinates or trajectories are compared across occasions. +## Scientific validation invariants -### DLSJM +Every supported temporal estimator requires realistic recovery evidence. Applicable contracts include true-state/true-parameter RMSE, bias, interval coverage, convergence, uncertainty calibration, temporal ordering, leakage-safe rolling-origin evaluation, irregular gaps, delayed and retrospective reports, missing occasions, changing memberships, language/source drift and CPU/GPU parity where an accelerator backend exists. -DLSJM follows Jin and Jeon (2019) as the baseline joint model for distinct local item-dependence and local person-dependence spaces. TEPP preserves distinct item-space and person-space temporal states, distances, clusters, uncertainty and alignment. Raw maps or raw cluster labels from separate occasions are not longitudinal evidence without alignment. +Monte Carlo decisions use uncertainty of the Monte Carlo study rather than arbitrary observed-pass percentages. Scientific failure is never hidden with skip, xfail or source rewriting. -### Base families and generalized mixed structure +A generic arithmetic standardizer is not itself a DSEM/ctsem estimator and must not be promoted as one without state equations, process-noise/marginal recovery, identification and validation evidence. -Rasch remains distinct from generic 1PL. 2PLM through formulation-qualified 5PLM retain exact parameter meanings. Confirmatory/exploratory MIRT and ideal-point/GGUM response processes remain distinct axes from hierarchy, dependence and time. Testlet, rater/facet, nested, crossed, cross-classified and multiple-membership structures remain explicit and cannot be hidden inside latent-space dependence. +## Current classifications -Multiple-membership weights are explicit, auditable and time-valid. They are observed/normalized or estimated according to the declared formulation; equal weights are never invented as a fallback. +**#441 — Longitudinal Modeling landing vehicle.** The invalid predecessor that divided lagged covariance by only the earlier marginal variance has been retired. `longitudinal_core::recover_event_time_lagged_correlation` now requires lagged covariance plus both occasion-specific marginal variances and a positive event-time lag. Exact binary64 covariance-bound checking avoids rounded-product acceptance/rejection errors and stable division order avoids avoidable overflow/underflow. All currently visible review threads are resolved. Auto-merge is enabled. Exact-head Documentation Quality, Rust Foundation CI, Security Scan and SAST Semgrep are still queued and no qualifying independent non-author APPROVE has been observed, so queued checks are not implemented-main evidence. -## Active product and scientific gaps +**#453/#454 — Analysis Run interpretation adapter fold candidates.** Their PR descriptions now explicitly classify them `fold_into_landing_vehicle`. Preserve stored-request path/CLI parsing, hostile-input, origin/credential/consumer refusal, metric-free result and `scientific_authority=false` tests. ADR 0085/0086 are implementation evidence pending #437 normalization, not branch-local architecture authority. + +**#451/#452 — Analysis Run temporal-context adapter fold candidates.** Preserve LineageWeave-only identity/refusal/metric-free tests, then fold with the coherent temporal-context adapter vehicle instead of creating a bounded context per GET/CLI operation. + +**#443/#444 and related export slices — Analysis Run export fold candidates.** Preserve pagination/auth/refusal/metric-free tests and fold into one export application-adapter landing vehicle. + +**#356 — closed, not merged.** Its self-referential RMSE-SE acceptance gate, caller-declared recovery provenance and Validation/Claim-Promotion conflation remain prohibited. Useful cutoff/run-binding/metric evidence belongs in the coherent Validation/Analysis Run vehicle. + +**#437 — ADR identity repair.** Repository-wide ADR IDs are immutable and unique. Duplicate numeric files/index rows must fail deterministic fitness tests. Implementation maturity does not create branch-local architecture authority. + +## Operator-gap register | ID | Gap | Maturity | Authority | Closure evidence | | --- | --- | --- | --- | --- | -| GAP-001 | PR authority fragmented across 140 heads | `release-blocking` | #175 / #435 | exact-head classification, bounded-context landing vehicles, unique evidence preserved, safe queue reduction | +| GAP-001 | PR authority fragmented across 135 heads | `release-blocking` | #175 / #435 | classified queue, coherent bounded-context landing vehicles, unique evidence preserved, safe reduction | | GAP-002 | multilingual span-grounded semantic/concept admission incomplete | `partial` | Evidence & Semantic Measurement | immutable offsets/layout, language profiles, concept dictionary, unknown review, invariance/calibration, hostile-input tests | -| GAP-003 | shared-latent temporal topic estimator incomplete | `partial` | #167 | Rust CPU `f64` likelihood/estimands/uncertainty, time/relation/membership effects, multi-seed recovery, real candidate-K fits | -| GAP-004 | durable end-to-end Analysis Run incomplete | `partial` | #166 | idempotent lifecycle, persistence/recovery, estimator-bound artifacts, complete validation evidence, separate claim promotion, Compose E2E | -| GAP-005 | temporal psychometric composition fragmented and partly duplicated | `partial` | #169 + ADR 0011 / fast-mlsirm owner boundary | released upstream model/dependence contract, TEPP temporal ACL, invariance/alignment, irregular time, temporal recovery, duplicate static kernels removed after parity | -| GAP-006 | TDT/CHRONOS event workflow incomplete | `partial` | #170 | calibrated event evidence/detection/tracking/schema/interval consistency with recovery and durable artifacts | -| GAP-007 | real accelerator/memory evidence incomplete | `accepted-target` | #171 | real hardware execution, CPU f64 parity, bounded memory/OOM/fallback evidence | -| GAP-008 | posterior network/cluster buyer workflow incomplete | `partial` | #172 | known-truth network recovery, uncertainty/stability, repeated Leiden consensus, exact-value exports | -| GAP-009 | production interpreter/verifier incomplete | `partial` | #176 | contextual-orchestrator execution, evidence citations, independent verifier, ablations, abstention/fallback | -| GAP-010 | coordinated accessible buyer UI incomplete | `accepted-target` | #173 | Figma/Storybook/design tokens, keyboard/touch/error/empty states, exact-value and print/export provenance | -| GAP-011 | operable multi-tenant supported release incomplete | `accepted-target` | #174 | OIDC/RLS/purpose controls, durable queues/storage, OTel/SLO, restore/load/migration, signed release/SBOM/provenance | -| GAP-012 | directory/crate structure obscures domain ownership | `active-refactor` | #435 and landing vehicles | staged folds, compatibility ACLs, no cycles/cross-context persistence/shared-kernel creep | -| GAP-013 | ADR identity is branch-local/duplicated in parts of the queue | `release-integrity` | #437 | repository-wide unique ADR identity, duplicate detection, normalized index and supersession lineage | - -## Delivery sequence - -1. Restore queue, ADR and bounded-context authority (#175, #435, #437). +| GAP-003 | shared-latent temporal topic estimator incomplete | `partial` | #167 | Rust CPU `f64` likelihood/estimands/uncertainty, relation/time/membership effects, multi-seed recovery, real candidate-K fits | +| GAP-004 | durable end-to-end Analysis Run incomplete | `partial` | #166 | idempotent lifecycle, persistence/recovery, estimator-bound artifacts, validation evidence, claim-promotion separation, Compose E2E | +| GAP-005 | temporal psychometric composition fragmented/partly duplicated | `partial` | Longitudinal Modeling + fast-mlsirm ACL | released upstream contract, TEPP temporal ACL, invariance/alignment, irregular time, temporal recovery, duplicated static kernels removed after parity | +| GAP-006 | TDT/CHRONOS event workflow incomplete | `partial` | Event Ontology & Temporal Graph | calibrated detection/tracking/schema/interval consistency with recovery and durable artifacts | +| GAP-007 | real accelerator/memory evidence incomplete | `accepted-target` | Compute backend | real hardware, CPU-f64 parity, bounded memory/OOM/fallback evidence | +| GAP-008 | network/cluster buyer workflow incomplete | `partial` | Projection | known-truth recovery, uncertainty/stability, repeated consensus, exact-value exports | +| GAP-009 | production interpreter/verifier incomplete | `partial` | Interpretation | contextual-orchestrator execution, evidence citations, independent verifier, ablations and abstention/fallback | +| GAP-010 | coordinated accessible buyer UI incomplete | `accepted-target` | Projection/UI | Figma/Storybook/design tokens, keyboard/touch/error/empty states, exact-value and print/export provenance | +| GAP-011 | operable multi-tenant supported release incomplete | `accepted-target` | Operations | OIDC/RLS/purpose controls, durable queue/storage, OTel/SLO, restore/load/migration, signed release/SBOM/provenance | +| GAP-012 | directory/crate paths obscure domain ownership | `active-refactor` | #435 / landing vehicles | staged folds, compatibility ACLs, no cycles/cross-context persistence/shared-kernel creep | +| GAP-013 | ADR identity duplicated/branch-local in parts of queue | `release-integrity` | #437 | unique repository-wide identity, duplicate detection, normalized index and supersession lineage | + +## Delivery order + +1. Restore queue, ADR and bounded-context authority. 2. Consolidate Evidence & Semantic Measurement. -3. Complete the Rust CPU `f64` shared-latent topic estimator (#167). -4. Complete durable end-to-end Analysis Run and evidence/promotion separation (#166). -5. Compose temporal psychometrics through released fast-mlsirm contracts (#169) and complete Event Intelligence (#170) instead of producing one-equation product slices. -6. Add real accelerator parity after CPU scientific authority is established (#171). -7. Complete network/cluster, interpretation and buyer visual workflows (#172/#176/#173). -8. Productionize tenancy, durability, observability, recovery, release and support (#174). +3. Complete the Rust CPU `f64` shared-latent temporal topic estimator. +4. Complete durable end-to-end Analysis Run and evidence/promotion separation. +5. Compose temporal psychometrics through released fast-mlsirm contracts and complete Event Intelligence. +6. Add real accelerator parity only after CPU scientific authority exists. +7. Complete network/cluster, interpretation and buyer visual workflows. +8. Productionize tenancy, durability, observability, recovery, release and support. -A bounded dependency repair may land ahead of this sequence when it directly unblocks a selected landing vehicle. It does not create a new product priority. +A bounded dependency/security repair may land earlier when it directly unblocks a selected landing vehicle. It does not create a new product priority. ## Queue consolidation rules @@ -153,90 +179,8 @@ Every open PR receives one of: - `research_lineage_only` - `blocked_external` -Similarity of titles is insufficient for closure. Compare exact current heads and preserve unique production behavior, public compatibility, tests, review findings, primary research, doctoring and provenance before applying `duplicate`, `superseded`, or `fold_into_landing_vehicle`. - -One-rule crates, one-clock crates and one-operation API/CLI PRs are not independent product boundaries by default. - -### Current classifications - -**#441 — Longitudinal Modeling lagged-correlation repair.** The invalid predecessor API that divided lagged covariance by only the earlier marginal variance was removed from the final diff after review showed it could produce impossible autocorrelations under nonstationary marginals. Exact repair head `6f483224b3a03e8237c6f4f098a8b0e85e0a91f5` places event-time association standardization in `longitudinal_core`, requires both marginal variances, enforces the covariance bound without a rounded product, and records the capability on `ARCHITECTURE.md` and `CHANGELOG.md`. All currently visible review threads are resolved. The predecessor commit remains RED/scientific-failure lineage. The one-shot self-deleting workflow is gone. The branch is not merge-ready while exact-head hosted workflows remain queued and no qualifying independent non-author APPROVE exists. Queued or predecessor-head checks are not passing evidence. - -**#448 — Analysis Run project-history cancel CLI fold candidate.** This dedicated binary is stacked on #447 and is another one-operation adapter slice. Preserve its CLI parsing, fail-closed origin/credential/consumer behavior, cancellation receipt and LineageWeave-only contract, then fold it with #447 into the coherent Analysis Run/project-history landing vehicle rather than treating ADR 0080 as a new bounded-context authority. - -**#447 — Analysis Run project-history cancel HTTP fold candidate.** This is another one-operation adapter slice stacked on #429. Preserve its empty-body, path/credential refusal, cancellation-removal and metric-free receipt tests, then fold it into the coherent Analysis Run/project-history vehicle rather than treating ADR 0079 as a new bounded-context authority. - -**#446 — Analysis Run export cancel CLI fold candidate.** This one-binary slice is stacked on #445. Preserve its CLI parsing, fail-closed origin/credential/consumer and metric-free receipt evidence, then fold it with the export landing vehicle. - -**#445 — Analysis Run export cancel HTTP fold candidate.** This one-route slice is stacked on #443. Preserve its cancellation-removal, auth/refusal and metric-free receipt tests, then fold it with #443/#444 rather than minting a separate product boundary. - -**#444 — Analysis Run export CLI fold candidate.** The export-collection CLI is stacked on #443 and is useful operator behavior, but one binary is not an independent bounded context. Preserve its fail-closed origin/credential/consumer tests while folding with #443 into a coherent Analysis Run/export landing vehicle. - -**#443 — Analysis Run export adapter fold candidate.** The export-collection GET is useful operator behavior, but one route is not an independent bounded context. Preserve its pagination, authorization and refusal tests while folding the operation into a coherent Analysis Run/export landing vehicle. - -The rebound from 136 to 140 open PRs while #435 remains active is direct evidence that the WIP circuit breaker is not yet enforced by the delivery system. New one-operation slices should be folded into the existing Analysis Run landing vehicles rather than extending the branch-local ADR sequence. - -**#356 — closed without merge.** Useful cutoff/run-binding/metric evidence is preserved in branch and review history for fold into #166. The generic `RMSE <= k * SE(RMSE)` rule, caller-declared recovery provenance, and Validation/Claim-Promotion conflation must not be revived. Scientific Claim Promotion remains a separate aggregate governed by ADR 0014. - -**#352/#355 — Longitudinal Modeling fold candidates.** They share a Driver/ctsem scalar rewrite but retain different public names, refusal guards, tests and research documentation. Preserve the strongest evidence before closing either. - -**#425/#433/#436 and similar route/CLI stacks — Analysis Run adapter dependencies.** They are transport/application behavior, not bounded contexts and not grounds for branch-local ADR identity. - -**#434/#430/#427/#426/#422/#421/#419/#418/#416 and similar refusal profiles — owning-context fold candidates.** Evidence/method refusals belong to Evidence & Semantic Measurement; temporal relation/membership rules belong to Temporal Event Knowledge. - -## Directory and crate repair register - -| Current fragments | Owning context | -| --- | --- | -| `system_clock`, `event_clock`, `assertion_clock`, `cutoff_clock`, `available_clock`, `document_clocks`, `revision_order` | Temporal Event Knowledge | -| `summarizes_edge`, `retrospective_edge`, `support_edge`, `citation_edge`, `outcome_order`, `subevent_containment`, `prediction_contradiction`, `relation_absence`, `role_contradiction` | Temporal Event Knowledge | -| `location_membership`, `episode_membership`, `membership_target` | Temporal Event Knowledge | -| `prompt_source`, `style_source`, `modality_source`, `copied_text`, `copy_identity`, `corpus_background`, `stopword_deletion`, `payload_bound`, `derived_sensitivity` | Evidence & Semantic Measurement | -| reusable static/generalized-mixed/dependence psychometric arithmetic in TEPP | migrate to fast-mlsirm after parity/recovery; retain only TEPP temporal/event ACL and policy | -| event-time association standardization | `longitudinal_core`; require both marginals and keep model-specific covariance construction outside this generic standardizer | -| flat `analysis_engine` one-profile files | fold by owning domain/application module through landing vehicles | - -Do not run a repository-wide rename across more than one hundred live heads. The target DDD architecture is mandatory, but path migration is staged through landing vehicles so concurrent-agent intent and review evidence survive. - -## Scientific and data invariants - -- Production mathematical/statistical/psychometric/vector/matrix arithmetic is Rust-owned; deterministic CPU `f64` is the scientific numerical reference. -- The six clock roles are event **or** valid time, assertion time, document time, system time, available time, and knowledge cutoff. Event instants and validity intervals represent the first role; they are not independent seventh and eighth clocks. -- Historical evidence requires availability at or before cutoff. -- Measurement occasion as a rater/method facet is distinct from substantive event time. -- Process/transition edges are forward-only. Citation, support, summary, revision and retrospective report do not become transitions. -- Cross-classification and weighted multiple membership are preserved rather than forced into one parent hierarchy. -- Local dependence is diagnosed after known factors/testlets/item families/raters/methods/hierarchy/membership/covariates are represented. -- Residual person-item interaction may motivate LSIRM/MLSIRM; joint local-item plus local-person dependence may motivate DLSJM only when its relational formulation matches the question. -- Exploratory factors/loadings and dependence geometry remain hypotheses until confirmatory/invariance/recovery evidence permits production use. -- Every temporal dependence candidate generates model-appropriate known-truth recovery for states/trajectories, fixed/random effects, covariance, membership, factors/loadings, response-family-specific parameters, dependence geometry, dynamics and uncertainty. -- Temporal recovery uses event-or-valid-time/available-time separation, rolling-origin evaluation, irregular gaps, delayed/retrospective records, missing occasions, changing membership and language/source drift. -- Monte Carlo uncertainty is reported; arbitrary pass percentages or rule-of-thumb thresholds are not scientific promotion criteria. -- LLMs never replace estimation/validation and are called only through contextual-orchestrator. -- Database authority is normalized, tenant/time/provenance aware, uses descriptive multiword `snake_case`, explicit idempotency/UPSERT and measured hot-partition evidence. - -## Merge gate - -Before a landing vehicle merges: - -1. Re-read exact head/base, live ruleset, review state, unresolved threads and current required workflows. -2. Repair valid findings and failures test-first; do not suppress deprecations, coverage or scientific failures. -3. Run relevant Rust unit/integration/property/fuzz/recovery tests on the exact head. -4. Require 100% production statement/branch coverage and public Rust documentation for the shipped scope. -5. Preserve unique evidence from every folded/closed PR. -6. Update PRD/TRD/ADR/context map/UML/traceability/doctoring/CHANGELOG when the protected product contract changes. -7. Use normal merge policy. Force-push and protection bypass are not queue-consolidation tools. - -## Operator-gap register - -| ID | Closure evidence | -| --- | --- | -| GAP-001 | Queue reaches a bounded, classified set of coherent landing vehicles and all superseded/duplicate closures retain replacement mapping. | -| GAP-003 | Real CPU `f64` estimator passes preregistered known-truth recovery and is invoked by the product workflow. | -| GAP-004 | One durable evidence-to-terminal-result run survives restart/restore and separates Validation Evidence from Claim Promotion. | -| GAP-005 | TEPP consumes a released/versioned fast-mlsirm candidate contract; temporal auto-expansion/recovery is generic; duplicated static kernels are removed after parity. | -| GAP-012 | Architecture fitness tests and landing vehicles demonstrate correct bounded-context paths/dependency direction. | -| GAP-013 | #437 closes with unique repository-wide ADR identities and duplicate-ID validation. | +Before classifying a PR as duplicate/superseded/folded, compare exact heads and preserve unique production behavior, compatibility, tests, review findings, primary research, doctoring and provenance. One-rule crates, one-clock crates and one-operation API/CLI PRs are not independent product boundaries by default. -## Research traceability for dependence ownership +## Release truth -The canonical primary-research discussion is [`docs/research/temporal-dependence-models.md`](research/temporal-dependence-models.md). Novel base-family × generalized-mixed × dependence × temporal couplings stay `research_candidate` until the exact combined model, identification, estimator and recovery are demonstrated. \ No newline at end of file +TEPP has no GitHub release at this snapshot. A release is permitted only after a coherent buyer/scientific vertical reaches protected main with required exact-head recovery and security evidence, reproducible package/build provenance, SBOM, upgrade/rollback evidence, and released integration contracts where cross-product deployment depends on them. From 503b807879138f7c63aa9ca9f2118a5e57fb09c6 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 21:41:44 +0900 Subject: [PATCH 044/235] fix(docs): keep queued checks non-authoritative --- docs/product-technical-gap-baseline.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index a421e5348..e1f00bd33 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -124,7 +124,7 @@ A generic arithmetic standardizer is not itself a DSEM/ctsem estimator and must ## Current classifications -**#441 — Longitudinal Modeling landing vehicle.** The invalid predecessor that divided lagged covariance by only the earlier marginal variance has been retired. `longitudinal_core::recover_event_time_lagged_correlation` now requires lagged covariance plus both occasion-specific marginal variances and a positive event-time lag. Exact binary64 covariance-bound checking avoids rounded-product acceptance/rejection errors and stable division order avoids avoidable overflow/underflow. All currently visible review threads are resolved. Auto-merge is enabled. Exact-head Documentation Quality, Rust Foundation CI, Security Scan and SAST Semgrep are still queued and no qualifying independent non-author APPROVE has been observed, so queued checks are not implemented-main evidence. +**#441 — Longitudinal Modeling landing vehicle.** The invalid predecessor that divided lagged covariance by only the earlier marginal variance has been retired. `longitudinal_core::recover_event_time_lagged_correlation` now requires lagged covariance plus both occasion-specific marginal variances and a positive event-time lag. Exact binary64 covariance-bound checking avoids rounded-product acceptance/rejection errors and stable division order avoids avoidable overflow/underflow. All currently visible review threads are resolved. Auto-merge is enabled. Exact-head Documentation Quality, Rust Foundation CI, Security Scan and SAST Semgrep are still queued and no qualifying independent non-author APPROVE has been observed, so queued checks never constitute implemented-main evidence. **#453/#454 — Analysis Run interpretation adapter fold candidates.** Their PR descriptions now explicitly classify them `fold_into_landing_vehicle`. Preserve stored-request path/CLI parsing, hostile-input, origin/credential/consumer refusal, metric-free result and `scientific_authority=false` tests. ADR 0085/0086 are implementation evidence pending #437 normalization, not branch-local architecture authority. From 76225347b8199b72de5c4ff8784fdb3fa0912889 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 21:45:53 +0900 Subject: [PATCH 045/235] test(docs): reject mislinked ADR index targets --- tests/quality/test_adr_identity_uniqueness.py | 39 ++++++++++++++++++- 1 file changed, 37 insertions(+), 2 deletions(-) diff --git a/tests/quality/test_adr_identity_uniqueness.py b/tests/quality/test_adr_identity_uniqueness.py index f920ed7e0..344d44a67 100644 --- a/tests/quality/test_adr_identity_uniqueness.py +++ b/tests/quality/test_adr_identity_uniqueness.py @@ -43,7 +43,7 @@ class AdrIdentityUniquenessTests(unittest.TestCase): - """Reject branch-local reuse of a repository-wide ADR identifier.""" + """Reject branch-local reuse or misdirection of an ADR identifier.""" def _root(self, index_rows: str, files: dict[str, str]) -> Path: temporary = tempfile.TemporaryDirectory() @@ -74,7 +74,7 @@ def test_duplicate_index_rows_fail(self) -> None: docs.validate_adr_graph() def test_duplicate_numbered_files_fail(self) -> None: - """Two numbered ADR files may not share one repository-wide identity.""" + """Two numbered root ADR files may not share one repository-wide identity.""" root = self._root( "| [0001](0001-one.md) | One | Accepted | partial | canonical |\n", @@ -84,6 +84,41 @@ def test_duplicate_numbered_files_fail(self) -> None: with self.assertRaisesRegex(AssertionError, "duplicate ADR file identity"): docs.validate_adr_graph() + def test_mismatched_index_link_identity_fails(self) -> None: + """Displayed ADR identity must match the linked numbered filename.""" + + root = self._root( + "| [0001](0002-two.md) | One mislabeled | Accepted | partial | bad link |\n" + "| [0002](0001-one.md) | Two mislabeled | Accepted | partial | bad link |\n", + {"0001-one.md": "0001", "0002-two.md": "0002"}, + ) + with mock.patch.object(docs, "ROOT", root): + with self.assertRaisesRegex(AssertionError, "ADR index target identity mismatch"): + docs.validate_adr_graph() + + def test_duplicate_index_targets_fail(self) -> None: + """Two index identities may not resolve to the same canonical ADR target.""" + + root = self._root( + "| [0001](0001-one.md) | One | Accepted | partial | canonical |\n" + "| [0002](0001-one.md) | Two | Accepted | partial | duplicate target |\n", + {"0001-one.md": "0001", "0002-two.md": "0002"}, + ) + with mock.patch.object(docs, "ROOT", root): + with self.assertRaisesRegex(AssertionError, "duplicate ADR index target"): + docs.validate_adr_graph() + + def test_canonical_index_targets_pass(self) -> None: + """Each displayed identity may link to its unique root ADR file.""" + + root = self._root( + "| [0001](0001-one.md) | One | Accepted | partial | canonical |\n" + "| [0002](0002-two.md) | Two | Accepted | partial | canonical |\n", + {"0001-one.md": "0001", "0002-two.md": "0002"}, + ) + with mock.patch.object(docs, "ROOT", root): + docs.validate_adr_graph() + if __name__ == "__main__": # pragma: no cover unittest.main() From 5d77694347880362c09248bc3af1ad4dfcd1df37 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 21:47:13 +0900 Subject: [PATCH 046/235] fix(docs): bind ADR identities to canonical targets --- scripts/validate_documentation.py | 42 ++++++++++++++++++++++++++----- 1 file changed, 36 insertions(+), 6 deletions(-) diff --git a/scripts/validate_documentation.py b/scripts/validate_documentation.py index dcf374423..67850ecc2 100644 --- a/scripts/validate_documentation.py +++ b/scripts/validate_documentation.py @@ -102,7 +102,10 @@ r"\b(?:but|however|yet|although|though)\b", re.IGNORECASE ) QUEUED_CHECKS_SENTENCE_BREAK = re.compile(r"[.;!?\n]") -ADR_TABLE_ROW = re.compile(r"^\|\s*\[(?P\d{4})\]", re.MULTILINE) +ADR_TABLE_ROW = re.compile( + r"^\|\s*\[(?P\d{4})\]\((?P[^)\s]+)\)\s*\|", + re.MULTILINE, +) ADR_FILE_NAME = re.compile(r"^(?P\d{4})-[a-z0-9-]+\.md$") ADR_DECISION_STATUS = re.compile( r"^\*\*Decision status:\*\*\s*(Accepted|Proposed|Superseded|Rejected)\b", @@ -450,13 +453,12 @@ def validate_product_technical_gap_baseline(root: Path = ROOT) -> None: def validate_adr_graph() -> None: - """Require every numbered ADR to have one repository-wide identity.""" + """Require every numbered ADR to have one repository-wide identity and target.""" adr_root = ROOT / "docs" / "adr" adr_index = (adr_root / "README.md").read_text(encoding="utf-8") - indexed_number_list = [ - match.group("number") for match in ADR_TABLE_ROW.finditer(adr_index) - ] + index_rows = list(ADR_TABLE_ROW.finditer(adr_index)) + indexed_number_list = [match.group("number") for match in index_rows] duplicate_index_numbers = sorted( number for number in set(indexed_number_list) @@ -466,8 +468,15 @@ def validate_adr_graph() -> None: raise AssertionError( f"duplicate ADR index identity: {duplicate_index_numbers}" ) - indexed_numbers = set(indexed_number_list) + indexed_targets = [match.group("target") for match in index_rows] + duplicate_targets = sorted( + target for target in set(indexed_targets) if indexed_targets.count(target) > 1 + ) + if duplicate_targets: + raise AssertionError(f"duplicate ADR index target: {duplicate_targets}") + + indexed_numbers = set(indexed_number_list) adr_paths_by_number: dict[str, list[Path]] = {} for path in sorted(adr_root.glob("[0-9][0-9][0-9][0-9]-*.md")): match = ADR_FILE_NAME.fullmatch(path.name) @@ -492,6 +501,27 @@ def validate_adr_graph() -> None: f"file_only={sorted(file_numbers - indexed_numbers)}" ) + for row in index_rows: + number = row.group("number") + target = row.group("target") + target_name = Path(target).name + target_match = ADR_FILE_NAME.fullmatch(target_name) + if ( + "/" in target + or "\\" in target + or target_match is None + or target_match.group("number") != number + ): + raise AssertionError( + f"ADR index target identity mismatch: {number} -> {target!r}" + ) + canonical_target = adr_files[number].name + if target != canonical_target: + raise AssertionError( + f"ADR index target mismatch: {number} -> {target!r}; " + f"expected {canonical_target!r}" + ) + failures: list[str] = [] for number, path in adr_files.items(): text = path.read_text(encoding="utf-8") From 680682bf8524323d422056ca2124fbda22b606b3 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 21:48:46 +0900 Subject: [PATCH 047/235] fix(docs): express queue gap in PR units --- docs/product-technical-gap-baseline.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index e1f00bd33..8e78bfe53 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -140,7 +140,7 @@ A generic arithmetic standardizer is not itself a DSEM/ctsem estimator and must | ID | Gap | Maturity | Authority | Closure evidence | | --- | --- | --- | --- | --- | -| GAP-001 | PR authority fragmented across 135 heads | `release-blocking` | #175 / #435 | classified queue, coherent bounded-context landing vehicles, unique evidence preserved, safe reduction | +| GAP-001 | PR authority fragmented across 135 open PRs | `release-blocking` | #175 / #435 | classified queue, coherent bounded-context landing vehicles, unique evidence preserved, safe reduction | | GAP-002 | multilingual span-grounded semantic/concept admission incomplete | `partial` | Evidence & Semantic Measurement | immutable offsets/layout, language profiles, concept dictionary, unknown review, invariance/calibration, hostile-input tests | | GAP-003 | shared-latent temporal topic estimator incomplete | `partial` | #167 | Rust CPU `f64` likelihood/estimands/uncertainty, relation/time/membership effects, multi-seed recovery, real candidate-K fits | | GAP-004 | durable end-to-end Analysis Run incomplete | `partial` | #166 | idempotent lifecycle, persistence/recovery, estimator-bound artifacts, validation evidence, claim-promotion separation, Compose E2E | From ff27a20e1f9cf885f5162c00bac00f15bdabc0b2 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 21:50:20 +0900 Subject: [PATCH 048/235] test(docs): cover titled ADR index links --- tests/quality/test_adr_identity_uniqueness.py | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/tests/quality/test_adr_identity_uniqueness.py b/tests/quality/test_adr_identity_uniqueness.py index 344d44a67..4951ae877 100644 --- a/tests/quality/test_adr_identity_uniqueness.py +++ b/tests/quality/test_adr_identity_uniqueness.py @@ -108,6 +108,18 @@ def test_duplicate_index_targets_fail(self) -> None: with self.assertRaisesRegex(AssertionError, "duplicate ADR index target"): docs.validate_adr_graph() + def test_titled_duplicate_index_rows_fail(self) -> None: + """Markdown link titles may not hide a duplicate ADR identity.""" + + root = self._root( + '| [0001](0001-one.md "canonical") | One | Accepted | partial | first |\n' + '| [0001](0001-one.md "duplicate") | One again | Accepted | partial | duplicate |\n', + {"0001-one.md": "0001"}, + ) + with mock.patch.object(docs, "ROOT", root): + with self.assertRaisesRegex(AssertionError, "duplicate ADR index identity"): + docs.validate_adr_graph() + def test_canonical_index_targets_pass(self) -> None: """Each displayed identity may link to its unique root ADR file.""" From e2aa7b66cc5a96dc12b21157311b1b3e6559a235 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 21:51:35 +0900 Subject: [PATCH 049/235] fix(docs): validate titled ADR links --- scripts/validate_documentation.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/validate_documentation.py b/scripts/validate_documentation.py index 67850ecc2..9c1f61501 100644 --- a/scripts/validate_documentation.py +++ b/scripts/validate_documentation.py @@ -103,7 +103,7 @@ ) QUEUED_CHECKS_SENTENCE_BREAK = re.compile(r"[.;!?\n]") ADR_TABLE_ROW = re.compile( - r"^\|\s*\[(?P\d{4})\]\((?P[^)\s]+)\)\s*\|", + r'^\|\s*\[(?P\d{4})\]\((?P[^)\s]+)(?:\s+"[^"]*")?\)\s*\|', re.MULTILINE, ) ADR_FILE_NAME = re.compile(r"^(?P\d{4})-[a-z0-9-]+\.md$") From 585da924b462e5ce94e182c79dfa145c9aae4be9 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 22:01:49 +0900 Subject: [PATCH 050/235] docs(delivery): refresh live queue baseline --- docs/product-technical-gap-baseline.md | 24 ++++++++++++++---------- 1 file changed, 14 insertions(+), 10 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 8e78bfe53..1adb488f0 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-01T12:31:35Z +**Snapshot:** 2026-09-01T12:58:29Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` **Workspace version:** `0.2.0` **Delivery authority:** issue [#175](https://github.com/ContextualWisdomLab/TEPP/issues/175), PR [#435](https://github.com/ContextualWisdomLab/TEPP/pull/435), and [`docs/delivery/pr-queue-authority-2026-09-01.md`](delivery/pr-queue-authority-2026-09-01.md) @@ -19,29 +19,31 @@ Passing or queued Checks on an open PR never promote that PR to implemented-main | Signal | Current evidence | Delivery implication | | --- | ---: | --- | | Protected `main` | `1bc02f580cf48e1d39da239f0e818453437c31c3` | Capability claims remain bounded to this commit until protected main changes. | -| Open pull requests | **135** | Release-blocking WIP remains high despite falling from the observed peak of 149. | +| Open pull requests | **137** | Release-blocking WIP remains high despite falling from the observed peak of 149. | | Draft pull requests | **89** | Draft status is workflow metadata, not scientific or domain classification. | -| Non-draft pull requests | **46** | Ready metadata is not merge readiness without exact-head evidence. | +| Non-draft pull requests | **48** | Ready metadata is not merge readiness without exact-head evidence. | | Open issues | **14** | Includes #437 for repository-wide ADR identity normalization. | | GitHub releases | **0** | No open PR head or local branch is a released TEPP product contract. | | Effective organization ruleset | `18156473` | Current ruleset, exact-head workflows, resolved conversations and qualifying review govern merge. | The classic branch-protection payload is not the sole policy source. Organization rulesets are the effective merge authority where applicable. -The queue fell from 149 to 134, then returned to 135 when #454 appeared. New one-operation Analysis Run slices therefore still count as WIP regression while queue recovery is active even though overall predecessor closure is reducing the queue. +The queue fell from the observed peak of 149 to 134, then rose to 135 when #454 appeared and to 137 with #455/#456. New one-operation Analysis Run slices therefore still count as WIP regression while queue recovery is active even though overall predecessor closure is reducing the queue. ## Current priority open pull-request evidence -This table is an exact-head **priority subset**, not a row-for-row copy of the 135-PR queue. PR #435 itself is omitted because writing its own exact head into a commit on that branch would immediately make the embedded head stale. +This table is an exact-head **priority subset**, not a row-for-row copy of the 137-PR queue. PR #435 itself is omitted because writing its own exact head into a commit on that branch would immediately make the embedded head stale. | PR | Exact current head | Draft | Base | Ownership / disposition | | ---: | --- | :---: | --- | --- | +| #456 | `ade6e27d46f477d8332bce13ccee080f0b55bfa9` | false | #455 head | Analysis Run/LineageWeave project-history stored-request CLI; `fold_into_landing_vehicle` | +| #455 | `c7e02968f147157aedbe805a8ffac823bdb716bf` | false | #429 head | Analysis Run/LineageWeave project-history stored-request GET; `fold_into_landing_vehicle` | | #454 | `c911fbcd6e13046358cc7f3692775ed4b008dadd` | false | #453 head | Analysis Run/contextual-orchestrator stored-request CLI; `fold_into_landing_vehicle` | | #453 | `baee8854e99dc416b2b907a22101c53a6eca9eca` | false | #438 head | Analysis Run/contextual-orchestrator stored-request GET; `fold_into_landing_vehicle` | | #452 | `cb97aad9f87283df4d94abe8c6df61a0a476c893` | false | #451 head | Analysis Run/LineageWeave temporal-context retrieval CLI; `fold_into_landing_vehicle` candidate | | #451 | `7b117e8f69cd74e28eceaf1748c6a9210f5dffbc` | false | main | Analysis Run/LineageWeave temporal-context GET-by-id; `fold_into_landing_vehicle` candidate | | #443 | `504793d88c6b754f5181f48dc7abde073ff9146a` | false | #411 head | Analysis Run/export collection adapter; `fold_into_landing_vehicle` | -| #441 | `6f483224b3a03e8237c6f4f098a8b0e85e0a91f5` | false | main | Longitudinal Modeling lagged-correlation root-cause repair; auto-merge enabled, exact-head hosted gates still pending | +| #441 | `6f483224b3a03e8237c6f4f098a8b0e85e0a91f5` | false | main | Longitudinal Modeling lagged-correlation root-cause repair; exact-head hosted gates still pending | ## Strategic Domain-Driven Design baseline @@ -124,9 +126,11 @@ A generic arithmetic standardizer is not itself a DSEM/ctsem estimator and must ## Current classifications -**#441 — Longitudinal Modeling landing vehicle.** The invalid predecessor that divided lagged covariance by only the earlier marginal variance has been retired. `longitudinal_core::recover_event_time_lagged_correlation` now requires lagged covariance plus both occasion-specific marginal variances and a positive event-time lag. Exact binary64 covariance-bound checking avoids rounded-product acceptance/rejection errors and stable division order avoids avoidable overflow/underflow. All currently visible review threads are resolved. Auto-merge is enabled. Exact-head Documentation Quality, Rust Foundation CI, Security Scan and SAST Semgrep are still queued and no qualifying independent non-author APPROVE has been observed, so queued checks never constitute implemented-main evidence. +**#441 — Longitudinal Modeling landing vehicle.** The invalid predecessor that divided lagged covariance by only the earlier marginal variance has been retired. `longitudinal_core::recover_event_time_lagged_correlation` now requires lagged covariance plus both occasion-specific marginal variances and a positive event-time lag. Exact binary64 covariance-bound checking avoids rounded-product acceptance/rejection errors and stable division order avoids avoidable overflow/underflow. All currently visible review threads are resolved. Exact-head Documentation Quality, Rust Foundation CI, Security Scan and SAST Semgrep remain queued, so queued checks never constitute implemented-main evidence. -**#453/#454 — Analysis Run interpretation adapter fold candidates.** Their PR descriptions now explicitly classify them `fold_into_landing_vehicle`. Preserve stored-request path/CLI parsing, hostile-input, origin/credential/consumer refusal, metric-free result and `scientific_authority=false` tests. ADR 0085/0086 are implementation evidence pending #437 normalization, not branch-local architecture authority. +**#455/#456 — Analysis Run project-history adapter fold candidates.** Their own PR descriptions classify them `fold_into_landing_vehicle` and prohibit independent merge while queue recovery is active. Preserve stored-request path/CLI parsing, hostile-input/origin/credential/consumer refusals, `inference_status=temporal_association_only`, metric-free responses and focused contract tests, then fold with #429/#431/#424/#428/#420. ADR 0087/0088 are implementation evidence pending #437 normalization, not branch-local architecture authority. + +**#453/#454 — Analysis Run interpretation adapter fold candidates.** Their PR descriptions explicitly classify them `fold_into_landing_vehicle`. Preserve stored-request path/CLI parsing, hostile-input, origin/credential/consumer refusal, metric-free result and `scientific_authority=false` tests. ADR 0085/0086 are implementation evidence pending #437 normalization, not branch-local architecture authority. **#451/#452 — Analysis Run temporal-context adapter fold candidates.** Preserve LineageWeave-only identity/refusal/metric-free tests, then fold with the coherent temporal-context adapter vehicle instead of creating a bounded context per GET/CLI operation. @@ -140,7 +144,7 @@ A generic arithmetic standardizer is not itself a DSEM/ctsem estimator and must | ID | Gap | Maturity | Authority | Closure evidence | | --- | --- | --- | --- | --- | -| GAP-001 | PR authority fragmented across 135 open PRs | `release-blocking` | #175 / #435 | classified queue, coherent bounded-context landing vehicles, unique evidence preserved, safe reduction | +| GAP-001 | PR authority fragmented across 137 open PRs | `release-blocking` | #175 / #435 | classified queue, coherent bounded-context landing vehicles, unique evidence preserved, safe reduction | | GAP-002 | multilingual span-grounded semantic/concept admission incomplete | `partial` | Evidence & Semantic Measurement | immutable offsets/layout, language profiles, concept dictionary, unknown review, invariance/calibration, hostile-input tests | | GAP-003 | shared-latent temporal topic estimator incomplete | `partial` | #167 | Rust CPU `f64` likelihood/estimands/uncertainty, relation/time/membership effects, multi-seed recovery, real candidate-K fits | | GAP-004 | durable end-to-end Analysis Run incomplete | `partial` | #166 | idempotent lifecycle, persistence/recovery, estimator-bound artifacts, validation evidence, claim-promotion separation, Compose E2E | @@ -183,4 +187,4 @@ Before classifying a PR as duplicate/superseded/folded, compare exact heads and ## Release truth -TEPP has no GitHub release at this snapshot. A release is permitted only after a coherent buyer/scientific vertical reaches protected main with required exact-head recovery and security evidence, reproducible package/build provenance, SBOM, upgrade/rollback evidence, and released integration contracts where cross-product deployment depends on them. +TEPP has no GitHub release at this snapshot. A release is permitted only after a coherent buyer/scientific vertical reaches protected main with required exact-head recovery and security evidence, reproducible package/build provenance, SBOM, upgrade/rollback evidence, and released integration contracts where cross-product deployment depends on them. \ No newline at end of file From bbff41cc1a4145ce01e070b3c5509e7edc7cad0a Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 22:13:41 +0900 Subject: [PATCH 051/235] docs(delivery): classify export stored-request slice --- docs/product-technical-gap-baseline.md | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 1adb488f0..ecac6e4b3 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-01T12:58:29Z +**Snapshot:** 2026-09-01T13:07:05Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` **Workspace version:** `0.2.0` **Delivery authority:** issue [#175](https://github.com/ContextualWisdomLab/TEPP/issues/175), PR [#435](https://github.com/ContextualWisdomLab/TEPP/pull/435), and [`docs/delivery/pr-queue-authority-2026-09-01.md`](delivery/pr-queue-authority-2026-09-01.md) @@ -19,23 +19,24 @@ Passing or queued Checks on an open PR never promote that PR to implemented-main | Signal | Current evidence | Delivery implication | | --- | ---: | --- | | Protected `main` | `1bc02f580cf48e1d39da239f0e818453437c31c3` | Capability claims remain bounded to this commit until protected main changes. | -| Open pull requests | **137** | Release-blocking WIP remains high despite falling from the observed peak of 149. | +| Open pull requests | **138** | Release-blocking WIP remains high despite falling from the observed peak of 149. | | Draft pull requests | **89** | Draft status is workflow metadata, not scientific or domain classification. | -| Non-draft pull requests | **48** | Ready metadata is not merge readiness without exact-head evidence. | +| Non-draft pull requests | **49** | Ready metadata is not merge readiness without exact-head evidence. | | Open issues | **14** | Includes #437 for repository-wide ADR identity normalization. | | GitHub releases | **0** | No open PR head or local branch is a released TEPP product contract. | | Effective organization ruleset | `18156473` | Current ruleset, exact-head workflows, resolved conversations and qualifying review govern merge. | The classic branch-protection payload is not the sole policy source. Organization rulesets are the effective merge authority where applicable. -The queue fell from the observed peak of 149 to 134, then rose to 135 when #454 appeared and to 137 with #455/#456. New one-operation Analysis Run slices therefore still count as WIP regression while queue recovery is active even though overall predecessor closure is reducing the queue. +The queue fell from the observed peak of 149 to 134, then rose to 135 when #454 appeared, to 137 with #455/#456, and to 138 with #457. New one-operation Analysis Run slices therefore still count as WIP regression while queue recovery is active even though predecessor closure has reduced the peak queue. ## Current priority open pull-request evidence -This table is an exact-head **priority subset**, not a row-for-row copy of the 137-PR queue. PR #435 itself is omitted because writing its own exact head into a commit on that branch would immediately make the embedded head stale. +This table is an exact-head **priority subset**, not a row-for-row copy of the 138-PR queue. PR #435 itself is omitted because writing its own exact head into a commit on that branch would immediately make the embedded head stale. | PR | Exact current head | Draft | Base | Ownership / disposition | | ---: | --- | :---: | --- | --- | +| #457 | `f259497ff2e45536352fa399504f56b736ad4f83` | false | #411 head | Analysis Run/naruon export stored-request GET; `fold_into_landing_vehicle` | | #456 | `ade6e27d46f477d8332bce13ccee080f0b55bfa9` | false | #455 head | Analysis Run/LineageWeave project-history stored-request CLI; `fold_into_landing_vehicle` | | #455 | `c7e02968f147157aedbe805a8ffac823bdb716bf` | false | #429 head | Analysis Run/LineageWeave project-history stored-request GET; `fold_into_landing_vehicle` | | #454 | `c911fbcd6e13046358cc7f3692775ed4b008dadd` | false | #453 head | Analysis Run/contextual-orchestrator stored-request CLI; `fold_into_landing_vehicle` | @@ -128,6 +129,8 @@ A generic arithmetic standardizer is not itself a DSEM/ctsem estimator and must **#441 — Longitudinal Modeling landing vehicle.** The invalid predecessor that divided lagged covariance by only the earlier marginal variance has been retired. `longitudinal_core::recover_event_time_lagged_correlation` now requires lagged covariance plus both occasion-specific marginal variances and a positive event-time lag. Exact binary64 covariance-bound checking avoids rounded-product acceptance/rejection errors and stable division order avoids avoidable overflow/underflow. All currently visible review threads are resolved. Exact-head Documentation Quality, Rust Foundation CI, Security Scan and SAST Semgrep remain queued, so queued checks never constitute implemented-main evidence. +**#457 — Analysis Run export adapter fold candidate.** The extra-segment `GET /v1/exports/{export_id}/request` slice is stacked on #411 and its own PR description already classifies it `fold_into_landing_vehicle`. Preserve stored-request path parsing, LineageWeave/hostile-identity/credential refusals, metric-free response, focused tests and cancel-route refusal, then fold it with #411/#417/#443/#444/#410. ADR 0089 is implementation evidence pending #437 normalization, not branch-local architecture authority. + **#455/#456 — Analysis Run project-history adapter fold candidates.** Their own PR descriptions classify them `fold_into_landing_vehicle` and prohibit independent merge while queue recovery is active. Preserve stored-request path/CLI parsing, hostile-input/origin/credential/consumer refusals, `inference_status=temporal_association_only`, metric-free responses and focused contract tests, then fold with #429/#431/#424/#428/#420. ADR 0087/0088 are implementation evidence pending #437 normalization, not branch-local architecture authority. **#453/#454 — Analysis Run interpretation adapter fold candidates.** Their PR descriptions explicitly classify them `fold_into_landing_vehicle`. Preserve stored-request path/CLI parsing, hostile-input, origin/credential/consumer refusal, metric-free result and `scientific_authority=false` tests. ADR 0085/0086 are implementation evidence pending #437 normalization, not branch-local architecture authority. @@ -140,11 +143,15 @@ A generic arithmetic standardizer is not itself a DSEM/ctsem estimator and must **#437 — ADR identity repair.** Repository-wide ADR IDs are immutable and unique. Duplicate numeric files/index rows must fail deterministic fitness tests. Implementation maturity does not create branch-local architecture authority. +## Dependency pin status + +`contextual-orchestrator` protected `main` is currently ahead of TEPP's checksum-pinned hourly gateway dependency and includes a correction to Bytez provider-declared zero-price ranking used by `select_top_n_cheapest_discovered_agents`. TEPP's hourly gateway currently remains pinned to `e226e1197bdfc890c9d8e5b9b648c78857d7e465` with a committed archive SHA-256. Do not remove or weaken that checksum merely to follow upstream. Advance the pin only after the exact replacement source archive digest is reproducibly acquired and reviewed; until then this is dependency drift rather than permission to duplicate upstream ranking logic in TEPP. The hourly single-flight gate is currently non-dispatchable anyway because open PRs/issues are non-zero. + ## Operator-gap register | ID | Gap | Maturity | Authority | Closure evidence | | --- | --- | --- | --- | --- | -| GAP-001 | PR authority fragmented across 137 open PRs | `release-blocking` | #175 / #435 | classified queue, coherent bounded-context landing vehicles, unique evidence preserved, safe reduction | +| GAP-001 | PR authority fragmented across 138 open PRs | `release-blocking` | #175 / #435 | classified queue, coherent bounded-context landing vehicles, unique evidence preserved, safe reduction | | GAP-002 | multilingual span-grounded semantic/concept admission incomplete | `partial` | Evidence & Semantic Measurement | immutable offsets/layout, language profiles, concept dictionary, unknown review, invariance/calibration, hostile-input tests | | GAP-003 | shared-latent temporal topic estimator incomplete | `partial` | #167 | Rust CPU `f64` likelihood/estimands/uncertainty, relation/time/membership effects, multi-seed recovery, real candidate-K fits | | GAP-004 | durable end-to-end Analysis Run incomplete | `partial` | #166 | idempotent lifecycle, persistence/recovery, estimator-bound artifacts, validation evidence, claim-promotion separation, Compose E2E | From 831de922948aec5953720799bfe1000b171d473e Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 23:03:52 +0900 Subject: [PATCH 052/235] docs(delivery): refresh live queue and fold new micro-slices --- docs/product-technical-gap-baseline.md | 32 +++++++++++++++----------- 1 file changed, 19 insertions(+), 13 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index ecac6e4b3..223380fc5 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-01T13:07:05Z +**Snapshot:** 2026-09-01T14:02:31Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` **Workspace version:** `0.2.0` **Delivery authority:** issue [#175](https://github.com/ContextualWisdomLab/TEPP/issues/175), PR [#435](https://github.com/ContextualWisdomLab/TEPP/pull/435), and [`docs/delivery/pr-queue-authority-2026-09-01.md`](delivery/pr-queue-authority-2026-09-01.md) @@ -19,30 +19,32 @@ Passing or queued Checks on an open PR never promote that PR to implemented-main | Signal | Current evidence | Delivery implication | | --- | ---: | --- | | Protected `main` | `1bc02f580cf48e1d39da239f0e818453437c31c3` | Capability claims remain bounded to this commit until protected main changes. | -| Open pull requests | **138** | Release-blocking WIP remains high despite falling from the observed peak of 149. | +| Open pull requests | **145** | Release-blocking WIP remains high and rose again after reaching 138. | | Draft pull requests | **89** | Draft status is workflow metadata, not scientific or domain classification. | -| Non-draft pull requests | **49** | Ready metadata is not merge readiness without exact-head evidence. | +| Non-draft pull requests | **56** | Ready metadata is not merge readiness without exact-head evidence. | | Open issues | **14** | Includes #437 for repository-wide ADR identity normalization. | | GitHub releases | **0** | No open PR head or local branch is a released TEPP product contract. | -| Effective organization ruleset | `18156473` | Current ruleset, exact-head workflows, resolved conversations and qualifying review govern merge. | +| Effective organization ruleset | `18156473` | Current ruleset requires one qualifying approval, resolved review threads, exact-head required workflows, and an allowed merge method. | The classic branch-protection payload is not the sole policy source. Organization rulesets are the effective merge authority where applicable. -The queue fell from the observed peak of 149 to 134, then rose to 135 when #454 appeared, to 137 with #455/#456, and to 138 with #457. New one-operation Analysis Run slices therefore still count as WIP regression while queue recovery is active even though predecessor closure has reduced the peak queue. +The queue fell from the observed peak of 149 to 134, then rose to 135 with #454, 137 with #455/#456, 138 with #457, and **145 with #458-#464**. That latest increase is a WIP regression. #459, #463 and #464 are additional one-operation Analysis Run adapter slices; #458, #460 and #461 are one-refusal analysis-profile slices. #462 is a bounded naming/compatibility repair and is evaluated separately rather than used to justify the surrounding micro-PR growth. ## Current priority open pull-request evidence -This table is an exact-head **priority subset**, not a row-for-row copy of the 138-PR queue. PR #435 itself is omitted because writing its own exact head into a commit on that branch would immediately make the embedded head stale. +This table is an exact-head **priority subset**, not a row-for-row copy of the 145-PR queue. PR #435 itself is omitted because writing its own exact head into a commit on that branch would immediately make the embedded head stale. | PR | Exact current head | Draft | Base | Ownership / disposition | | ---: | --- | :---: | --- | --- | +| #464 | `0a16134ab6e4d8d4a30012dc5d5234d6ff59b235` | false | #463 head | Analysis Run/LineageWeave temporal-context stored-request CLI; `fold_into_landing_vehicle` | +| #463 | `b476b9de1bbd949e7b089727bfac2256a5cbb886` | false | #451 head | Analysis Run/LineageWeave temporal-context stored-request GET; `fold_into_landing_vehicle` | | #457 | `f259497ff2e45536352fa399504f56b736ad4f83` | false | #411 head | Analysis Run/naruon export stored-request GET; `fold_into_landing_vehicle` | | #456 | `ade6e27d46f477d8332bce13ccee080f0b55bfa9` | false | #455 head | Analysis Run/LineageWeave project-history stored-request CLI; `fold_into_landing_vehicle` | | #455 | `c7e02968f147157aedbe805a8ffac823bdb716bf` | false | #429 head | Analysis Run/LineageWeave project-history stored-request GET; `fold_into_landing_vehicle` | | #454 | `c911fbcd6e13046358cc7f3692775ed4b008dadd` | false | #453 head | Analysis Run/contextual-orchestrator stored-request CLI; `fold_into_landing_vehicle` | | #453 | `baee8854e99dc416b2b907a22101c53a6eca9eca` | false | #438 head | Analysis Run/contextual-orchestrator stored-request GET; `fold_into_landing_vehicle` | -| #452 | `cb97aad9f87283df4d94abe8c6df61a0a476c893` | false | #451 head | Analysis Run/LineageWeave temporal-context retrieval CLI; `fold_into_landing_vehicle` candidate | -| #451 | `7b117e8f69cd74e28eceaf1748c6a9210f5dffbc` | false | main | Analysis Run/LineageWeave temporal-context GET-by-id; `fold_into_landing_vehicle` candidate | +| #452 | `cb97aad9f87283df4d94abe8c6df61a0a476c893` | false | #451 head | Analysis Run/LineageWeave temporal-context retrieval CLI; `fold_into_landing_vehicle` | +| #451 | `7b117e8f69cd74e28eceaf1748c6a9210f5dffbc` | false | main | Analysis Run/LineageWeave temporal-context GET-by-id; `fold_into_landing_vehicle` | | #443 | `504793d88c6b754f5181f48dc7abde073ff9146a` | false | #411 head | Analysis Run/export collection adapter; `fold_into_landing_vehicle` | | #441 | `6f483224b3a03e8237c6f4f098a8b0e85e0a91f5` | false | main | Longitudinal Modeling lagged-correlation root-cause repair; exact-head hosted gates still pending | @@ -129,19 +131,23 @@ A generic arithmetic standardizer is not itself a DSEM/ctsem estimator and must **#441 — Longitudinal Modeling landing vehicle.** The invalid predecessor that divided lagged covariance by only the earlier marginal variance has been retired. `longitudinal_core::recover_event_time_lagged_correlation` now requires lagged covariance plus both occasion-specific marginal variances and a positive event-time lag. Exact binary64 covariance-bound checking avoids rounded-product acceptance/rejection errors and stable division order avoids avoidable overflow/underflow. All currently visible review threads are resolved. Exact-head Documentation Quality, Rust Foundation CI, Security Scan and SAST Semgrep remain queued, so queued checks never constitute implemented-main evidence. -**#457 — Analysis Run export adapter fold candidate.** The extra-segment `GET /v1/exports/{export_id}/request` slice is stacked on #411 and its own PR description already classifies it `fold_into_landing_vehicle`. Preserve stored-request path parsing, LineageWeave/hostile-identity/credential refusals, metric-free response, focused tests and cancel-route refusal, then fold it with #411/#417/#443/#444/#410. ADR 0089 is implementation evidence pending #437 normalization, not branch-local architecture authority. +**#463/#464 together with #451/#452 — Analysis Run temporal-context adapter fold candidates.** #463 and #464 were created after the queue had already begun recovery and are additional GET/CLI slices over the same LineageWeave temporal-context application boundary. Preserve extra-segment/path and CLI parsing, hostile identity/body/stdin/origin/credential/consumer refusals, metric-free stored-request behavior, `temporal_association_only` semantics and focused contract tests. Fold them with #451/#452/#414 into one coherent temporal-context application-adapter landing vehicle. ADR 0091/0092 are implementation evidence pending #437 normalization, not new architecture authority. + +**#457/#459 — Analysis Run export adapter fold candidates.** The stored-request GET and dedicated CLI are additional naruon-facing export adapters stacked on the existing export family. Preserve stored-request path/CLI parsing, LineageWeave/hostile-identity/credential refusals, metric-free responses, focused tests and cancel-route refusal, then fold with #411/#417/#443/#444/#410. ADR 0089/0090 are implementation evidence pending #437 normalization, not branch-local architecture authority. **#455/#456 — Analysis Run project-history adapter fold candidates.** Their own PR descriptions classify them `fold_into_landing_vehicle` and prohibit independent merge while queue recovery is active. Preserve stored-request path/CLI parsing, hostile-input/origin/credential/consumer refusals, `inference_status=temporal_association_only`, metric-free responses and focused contract tests, then fold with #429/#431/#424/#428/#420. ADR 0087/0088 are implementation evidence pending #437 normalization, not branch-local architecture authority. **#453/#454 — Analysis Run interpretation adapter fold candidates.** Their PR descriptions explicitly classify them `fold_into_landing_vehicle`. Preserve stored-request path/CLI parsing, hostile-input, origin/credential/consumer refusal, metric-free result and `scientific_authority=false` tests. ADR 0085/0086 are implementation evidence pending #437 normalization, not branch-local architecture authority. -**#451/#452 — Analysis Run temporal-context adapter fold candidates.** Preserve LineageWeave-only identity/refusal/metric-free tests, then fold with the coherent temporal-context adapter vehicle instead of creating a bounded context per GET/CLI operation. +**#458/#460/#461 — Validation / Analysis Run profile fold candidates.** These bind one already-existing refusal rule at a time (`outcome_order`, `relation_absence`, `episode_membership`) into separate analysis-run profiles. The rules and their cutoff-safe tests are evidence worth preserving, but one refusal profile is not one bounded context. Fold compatible profile registration, cutoff/digest/census mechanics, limit handling and inspect-payload refusal tests into the coherent Validation/Analysis Run vehicle instead of extending per-rule PR/ADR proliferation. + +**#462 — bounded source-identifier repair.** Renaming the Rust source field to `node_id` while preserving the serialized v1 `id` wire key is a compatibility-scoped root-cause repair rather than a new domain slice. It may remain independently landable if current exact-head compatibility, documentation, coverage, review and security gates are satisfied; it does not justify new Analysis Run micro-PRs. **#443/#444 and related export slices — Analysis Run export fold candidates.** Preserve pagination/auth/refusal/metric-free tests and fold into one export application-adapter landing vehicle. **#356 — closed, not merged.** Its self-referential RMSE-SE acceptance gate, caller-declared recovery provenance and Validation/Claim-Promotion conflation remain prohibited. Useful cutoff/run-binding/metric evidence belongs in the coherent Validation/Analysis Run vehicle. -**#437 — ADR identity repair.** Repository-wide ADR IDs are immutable and unique. Duplicate numeric files/index rows must fail deterministic fitness tests. Implementation maturity does not create branch-local architecture authority. +**#437 — ADR identity repair.** Repository-wide ADR IDs are immutable and unique. Duplicate numeric files/index rows must fail deterministic fitness tests. The queue-authority branch now contains duplicate-index, duplicate-target and duplicate-numbered-file checks; normalization must still land coherently rather than renumbering every live micro-branch independently. Implementation maturity does not create branch-local architecture authority. ## Dependency pin status @@ -151,7 +157,7 @@ A generic arithmetic standardizer is not itself a DSEM/ctsem estimator and must | ID | Gap | Maturity | Authority | Closure evidence | | --- | --- | --- | --- | --- | -| GAP-001 | PR authority fragmented across 138 open PRs | `release-blocking` | #175 / #435 | classified queue, coherent bounded-context landing vehicles, unique evidence preserved, safe reduction | +| GAP-001 | PR authority fragmented across 145 open PRs | `release-blocking` | #175 / #435 | classified queue, coherent bounded-context landing vehicles, unique evidence preserved, safe reduction | | GAP-002 | multilingual span-grounded semantic/concept admission incomplete | `partial` | Evidence & Semantic Measurement | immutable offsets/layout, language profiles, concept dictionary, unknown review, invariance/calibration, hostile-input tests | | GAP-003 | shared-latent temporal topic estimator incomplete | `partial` | #167 | Rust CPU `f64` likelihood/estimands/uncertainty, relation/time/membership effects, multi-seed recovery, real candidate-K fits | | GAP-004 | durable end-to-end Analysis Run incomplete | `partial` | #166 | idempotent lifecycle, persistence/recovery, estimator-bound artifacts, validation evidence, claim-promotion separation, Compose E2E | @@ -194,4 +200,4 @@ Before classifying a PR as duplicate/superseded/folded, compare exact heads and ## Release truth -TEPP has no GitHub release at this snapshot. A release is permitted only after a coherent buyer/scientific vertical reaches protected main with required exact-head recovery and security evidence, reproducible package/build provenance, SBOM, upgrade/rollback evidence, and released integration contracts where cross-product deployment depends on them. \ No newline at end of file +TEPP has no GitHub release at this snapshot. A release is permitted only after a coherent buyer/scientific vertical reaches protected main with required exact-head recovery and security evidence, reproducible package/build provenance, SBOM, upgrade/rollback evidence, and released integration contracts where cross-product deployment depends on them. From 5d9c3c545ca8cd9125b0f0bbdd271e390d63ed00 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 23:11:43 +0900 Subject: [PATCH 053/235] docs: add public Pages landing source to queue authority vehicle --- docs/index.md | 32 ++++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) create mode 100644 docs/index.md diff --git a/docs/index.md b/docs/index.md new file mode 100644 index 000000000..8e5c8fc91 --- /dev/null +++ b/docs/index.md @@ -0,0 +1,32 @@ +--- +title: TEPP +--- + +# TEPP + +TEPP is the Temporal Event Psychometrics Platform: a multilingual, temporal, relational measurement system whose statistical and psychometric arithmetic is implemented in Rust. + +## Start here + +The repository is currently an actively developed Rust workspace rather than a supported commercial release. For the current executable surface, verification commands, and explicit claim boundaries, start with the [README](https://github.com/ContextualWisdomLab/TEPP#readme). + +## Product and architecture + +TEPP owns temporal/event semantics, evidence identity and availability, relational and membership structure, analysis-run composition, persistence boundaries, and psychometric recovery gates. Reusable response-family and LSIRM/MLSIRM/DLSJM numerical kernels remain in [fast-mlsirm](https://github.com/ContextualWisdomLab/fast-mlsirm), while model-provider execution and LLM orchestration remain in [contextual-orchestrator](https://github.com/ContextualWisdomLab/contextual-orchestrator). + +The current delivery and bounded-context authority is documented in: + +- [Product and technical gap baseline](https://github.com/ContextualWisdomLab/TEPP/blob/main/docs/product-technical-gap-baseline.md) +- [Domain context map](https://github.com/ContextualWisdomLab/TEPP/blob/main/docs/architecture/domain-context-map.md) +- [Temporal-dependence composition](https://github.com/ContextualWisdomLab/TEPP/blob/main/docs/architecture/temporal-dependence-composition.md) +- [Approved PRD](https://github.com/ContextualWisdomLab/TEPP/blob/main/docs/product/prd-v0.4-approved.md) +- [Standards and literature](https://github.com/ContextualWisdomLab/TEPP/blob/main/docs/research/standards-and-literature.md) +- [Releases](https://github.com/ContextualWisdomLab/TEPP/releases) + +## Onboarding and verification + +TEPP is fail-closed about scientific and release claims. Branch-local tests, open pull requests, planning documents, or queued checks are evidence for review; they do not make a capability shipped on the protected default branch. The README and repository documentation contain the supported local quality gates and current implementation boundaries. + +For repository-grounded code and documentation questions, use [Ask DeepWiki](https://deepwiki.com/ContextualWisdomLab/TEPP). + +This page is a public documentation landing source. GitHub Pages publication is a separate repository-facing state and must be verified live before it is claimed available. From d9ff031e31af4dcbdfd173e0f4fc84018de3750c Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 23:12:15 +0900 Subject: [PATCH 054/235] docs: add exact DeepWiki badge to queue authority vehicle --- README.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/README.md b/README.md index e0f6b3dd2..3b4153163 100644 --- a/README.md +++ b/README.md @@ -1,5 +1,7 @@ # TEPP +[![Ask DeepWiki](https://deepwiki.com/badge.svg)](https://deepwiki.com/ContextualWisdomLab/TEPP) + TEPP is the **Temporal Event Psychometrics Platform**: a multilingual, temporal, relational measurement system whose statistical and psychometric arithmetic is implemented in Rust. From a105d62abca93c4730f7cc00e9effb9326b9c000 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 23:30:25 +0900 Subject: [PATCH 055/235] fix(docs): align ADR identity and authority metadata --- docs/adr/README.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/docs/adr/README.md b/docs/adr/README.md index 91e92a41d..f6f48f55c 100644 --- a/docs/adr/README.md +++ b/docs/adr/README.md @@ -31,17 +31,17 @@ Read [`ADR_POLICY.md`](ADR_POLICY.md) first. **Decision status and implementatio | [0023](0023-lineage-criterion-anchor-contract.md) | TEPP-owned Event Lineage criterion anchor | Accepted | active-PR | Owns independent criterion-anchor contract; estimator execution remains separately evidence-gated. | | [0024](0024-independent-topic-importance-anchor.md) | Posterior topic-context producer contract | Accepted | contract-only active-PR | Owns the topic-context producer DTO/schema; fast-mlsirm owns reusable case-deletion influence arithmetic. | | [0025](0025-macos-native-rust-mlx-metal-boundary.md) | macOS-native Rust-owned MLX Metal execution | Accepted | accepted-target | Owns native Metal execution/parity receipt boundary; Linux must not claim Metal execution. | -| [0026](0026-lineage-pair-criterion-and-project-journey-posterior.md) | Independent lineage-pair criterion and posterior Project Journey | Proposed | active-PR | Renumbered from a colliding pre-normalization 0024 identity; preserves posterior temporal/relation evidence without total-order or causal claims. | +| [0026](0026-lineage-pair-criterion-and-project-journey-posterior.md) | Independent lineage-pair criterion and posterior Project Journey | Proposed | active-PR | Proposed successor identity for the pre-normalization colliding 0024 decision; it is not architecture authority unless and until accepted. | ## Pre-normalization lineage The historical file [`archive/pre-normalization-0021-deterministic-analysis-run-execution.md`](archive/pre-normalization-0021-deterministic-analysis-run-execution.md) preserves the earlier branch-era ADR 0021 text byte-for-byte after that number was found to collide with the LineageWeave project-history decision. The canonical analysis-run execution decision is ADR 0022. Historical branch references to the colliding identity remain provenance, not current architecture authority. -The former lineage-pair/Project-Journey ADR 0024 collision is represented canonically by ADR 0026; ADR 0024 remains the independent topic-importance anchor. No historical collision authorizes reuse of a retired number for a new decision. +The former lineage-pair/Project-Journey ADR 0024 collision is represented by proposed ADR 0026; accepted ADR 0024 remains the Posterior topic-context producer contract. No historical collision authorizes reuse of a retired number for a new decision, and a proposed successor does not become architecture authority merely because implementation work exists. ## Decision ownership summary -Use the narrowest owning ADR when decisions overlap: +Use the narrowest owning **Accepted** ADR when decisions overlap. Proposed ADRs are recorded separately and are not architecture authority until accepted: - numerical implementation/reference backend: ADR 0001; - clock/time eligibility: ADR 0002; @@ -65,9 +65,9 @@ Use the narrowest owning ADR when decisions overlap: - LineageWeave project-history boundary: ADR 0021; - deterministic analysis-run execution: ADR 0022; - Event Lineage criterion anchor: ADR 0023; -- independent topic-importance anchor: ADR 0024; +- Posterior topic-context producer contract: ADR 0024; - macOS-native Rust-owned MLX/Metal boundary: ADR 0025; -- independent lineage-pair criterion and posterior Project Journey: ADR 0026. +- proposed independent lineage-pair criterion and posterior Project Journey: ADR 0026 (`Proposed`; not current architecture authority). ## Change and supersession rule From 09b9594a36adc56af2ba04503dcbc423e51a06bb Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 23:30:57 +0900 Subject: [PATCH 056/235] fix(research): require structural temporal recovery evidence --- docs/research/temporal-dependence-models.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/docs/research/temporal-dependence-models.md b/docs/research/temporal-dependence-models.md index eaf7aa8f7..e87e35410 100644 --- a/docs/research/temporal-dependence-models.md +++ b/docs/research/temporal-dependence-models.md @@ -48,12 +48,16 @@ For an LSIRM/MLSIRM/DLSJM **temporal** candidate to be classified `supported`, T - implemented estimator owned by the canonical repository; - leakage-safe recovery that separates event-or-valid time from available time and enforces the analysis knowledge cutoff; - model-appropriate known-truth recovery with RMSE, bias, interval/credible-interval coverage, convergence, and uncertainty reporting for the parameters actually claimed; +- known-truth recovery of any claimed temporal ordering, transition ordering, dependency graph, branch graph, or cluster-transition structure; a candidate cannot be `supported` for a structural claim whose structure is not recoverable in simulation; +- longitudinal measurement-invariance evidence sufficient for every cross-time measurement or comparison claim actually made; invariance is not limited to multilingual or source-drift claims; - irregular-gap, delayed/retrospective-record, missing-occasion, and changing-membership cases when the temporal formulation permits them; - language/source drift tests when multilingual/source invariance is part of the claim; - CPU `f64` reference evidence and CPU/GPU parity only when an accelerator implementation is claimed; a skipped or unexecuted GPU path is not evidence; - Monte Carlo uncertainty for simulation summaries rather than an arbitrary replication pass percentage; - primary-source traceability for established model components and explicit `research_candidate` labeling for novel couplings. +Structural acceptance is claim-scoped: if a candidate claims only parameter recovery it is not automatically authorized to claim recovered temporal order, dependency topology, branching, clustering, or longitudinal invariance. Conversely, any such structural claim makes its corresponding known-truth recovery evidence mandatory before promotion. + These items are acceptance evidence for a TEPP claim. They should not be cited as findings of Jeon et al. (2021), Jin and Jeon (2019), or Kang and Jeon (2025) unless a specific item is explicitly supported by the relevant paper. Auto-expansion only materializes a candidate contract; it does not satisfy TEPP's promotion conditions. ## APA 7 references From d680976eb060692debc133d0c3bb6001affc2c88 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 00:24:59 +0900 Subject: [PATCH 057/235] docs: make TEPP README product-first --- README.md | 267 +++++++++++++++++++++++++++--------------------------- 1 file changed, 136 insertions(+), 131 deletions(-) diff --git a/README.md b/README.md index 3b4153163..80f59bf3d 100644 --- a/README.md +++ b/README.md @@ -2,111 +2,54 @@ [![Ask DeepWiki](https://deepwiki.com/badge.svg)](https://deepwiki.com/ContextualWisdomLab/TEPP) -TEPP is the **Temporal Event Psychometrics Platform**: a multilingual, temporal, -relational measurement system whose statistical and psychometric arithmetic is -implemented in Rust. - -## Current implementation state - -This branch preserves the protected-main Rust workspace and quality-gate -foundation. The workspace crates expose tested contracts only: immutable -evidence identities and exact spans, six-clock temporal values with Allen -algebra and cutoff eligibility, event mentions/instances with -evidence-layer intelligence gates, a forward-only relation graph, -cross-classified membership, bitemporal persistence, leakage-safe corpus -splits, simulation manifests, claim-promotion validation, API DTOs, the -purpose-bound privacy envelope, and longitudinal within/between -decomposition. It adds the independently usable `analysis_engine` vertical -slice: bounded cutoff-safe readiness work that emits a digest-bound terminal -artifact or a redacted no-eligible-evidence result. That slice is active-PR -evidence, not a psychometric estimator or a release claim. -The current workspace contains 50 independently documented Rust crates. Each -crate exposes a bounded, tested contract for evidence, temporal semantics, -event and relation reasoning, membership, persistence, simulation, validation, -API exchange, compute planning, or evidence-grounded interpretation. Numerical -and psychometric authority remains on the CPU `f64` reference path; streamed -accelerator plans must preserve the full observation set and fail closed to the -reference path when resources or validation are insufficient. -The repository currently implements 54 independently documented crates rather -than a full commercial release. The implemented crates include topic -measurement, the analysis engine, and psychometric input/recovery gates; they -do not claim a complete commercial estimator, -operator workspace, or supported release. - -- `topic_measurement`: the first production topic-measurement crate. It - estimates topic proportions from observed counts, maps those proportions into - additive log-ratio coordinates, and keeps posterior uncertainty attached so - later psychometric models do not treat raw topic proportions as ordinary - Euclidean indicators. -- `analysis_engine`: the first production analysis-run crate. It assembles one - cutoff-safe run from a validated design, documented evidence graph, and - estimator contract; persists the run with the six TEPP clocks; and emits a - typed terminal result. The crate does not claim buyer-visible product - completeness. -- `psychometric_core`: validated statistical-recovery APIs on already-mapped - coordinates. It does not implement a full ESEM/DSEM estimator. +**Temporal Event Psychometrics Platform for multilingual, relational, time-aware measurement.** -```text -crates/analysis_engine -crates/assertion_clock -crates/available_clock -crates/checkpoint_authority -crates/citation_edge -crates/compute_backend -crates/copied_text -crates/copy_identity -crates/corpus_background -crates/corpus_split -crates/cutoff_clock -crates/derived_sensitivity -crates/document_clocks -crates/encrypted_mapping -crates/episode_membership -crates/event_clock -crates/event_core -crates/evidence_core -crates/inferred_status -crates/intake_authorization -crates/interpretation_gateway -crates/location_membership -crates/longitudinal_core -crates/membership_core -crates/membership_target -crates/modality_source -crates/model_selection -crates/network_analysis -crates/operational_log -crates/outcome_order -crates/payload_bound -crates/persistence_postgres -crates/prediction_contradiction -crates/prompt_source -crates/provider_receipt -crates/psychometric_core -crates/psychometric_fit -crates/relation_absence -crates/relation_graph -crates/retrospective_edge -crates/revision_order -crates/role_contradiction -crates/semantic_core -crates/service_tls -crates/stopword_deletion -crates/style_source -crates/subevent_containment -crates/summarizes_edge -crates/support_edge -crates/system_clock -crates/temporal_core -crates/tepp_api -crates/tepp_simulation -crates/topic_lineage -crates/topic_measurement -crates/validation_core +TEPP measures documentary and event evidence as fallible observations of latent semantic, temporal, relational, and psychological structure. It preserves exact source evidence, multiple clocks, multilevel membership, measurement uncertainty, and relation history instead of flattening documents into independent rows or treating model output as scientific authority. -``` +Production mathematical and psychometric arithmetic belongs in Rust. Statistical claims remain gated by explicit evidence and validation contracts; LLMs may assist interpretation or proposal generation but do not become numerical estimators or claim-promotion authority. + +## Why TEPP + +Many analytical systems lose the context needed to decide whether an apparent change is real: when evidence became available, which revision was observed, which language or template expressed it, which people or organizations belonged to which groups at the time, and whether a result is measurement drift rather than substantive change. + +TEPP keeps those distinctions explicit. + +| Need | What TEPP is designed to preserve | +| --- | --- | +| Multilingual measurement | Shared concepts with language-specific expression and evidence-bound alignment | +| Time-aware analysis | Event, assertion, document, system, availability, and knowledge-cutoff clocks | +| Relational evidence | Documents, spans, events, entities, revisions, translations, citations, memberships, and provenance | +| Multilevel structure | Cross-classified and multiple membership without collapsing observations to one group | +| Measurement uncertainty | Posterior-aware and invariance-aware contracts instead of treating latent estimates as error-free scores | +| Scientific governance | Separate validation evidence, interpretation, and scientific claim promotion | +| Reproducibility | Immutable evidence identities, deterministic contracts, versioned decisions, and explicit failure boundaries | + +## Product boundary + +TEPP owns **temporal/event measurement composition**: evidence/time semantics, longitudinal and relational measurement context, analysis-run contracts, scientific validation boundaries, and the event-aware structures required to measure change responsibly. + +It does not absorb every adjacent capability: + +- [`fast-mlsirm`](https://github.com/ContextualWisdomLab/fast-mlsirm) owns reusable psychometric/static numerical kernels and model-family arithmetic that should not be duplicated here. +- [`contextual-orchestrator`](https://github.com/ContextualWisdomLab/contextual-orchestrator) owns model-provider execution, routing, credentials, and LLM orchestration. +- [`LineageWeave`](https://github.com/ContextualWisdomLab/LineageWeave) can preserve and render accepted lineage/evidence but is not TEPP's numerical authority. +- Consumer products such as Naruon own their workflow and decision semantics rather than becoming TEPP subdomains. + +Cross-product integrations must use released, versioned contracts. An open upstream branch or model response is never treated as production truth. + +## Current maturity -## Local verification +TEPP is an active technical platform under development, not a completed commercial release. Protected source contains a broad Rust-first contract foundation for evidence, temporal semantics, relations, membership, persistence, simulation, validation, API exchange, and selected analytical/recovery primitives. The approved PRD describes a larger target platform than the capabilities currently integrated and released. + +In particular, do not infer from the architecture that TEPP already ships a complete ESEM/DSEM/continuous-time estimator suite, production operator workspace, supported GPU backend, or generally available service. Candidate behavior in open pull requests remains candidate evidence until it reaches protected source through normal governance and, where applicable, a versioned release. + +The current product/technical gap and ownership evidence is maintained in [`docs/product-technical-gap-baseline.md`](docs/product-technical-gap-baseline.md). + +## Start here + +TEPP is currently consumed and developed from source; there is no generally available installation package or production endpoint advertised by this README. + +For a source checkout, verify the repository contract before relying on a branch: ```bash python3 scripts/check_workspace_contract.py @@ -123,32 +66,94 @@ cargo doc --workspace --all-features --no-deps cargo deny check ``` -Stable Rust line coverage is measured with `cargo-llvm-cov`. Branch coverage is -measured in a separately pinned nightly lane because Rust branch coverage remains -an unstable compiler capability. A zero denominator is reported explicitly for -any crate whose lane still ships no executable behavior; it must never conceal -uncovered production behavior. - -## Normative documents - -- `AGENTS.md` -- `ARCHITECTURE.md` -- `docs/product/prd-v0.4-approved.md` -- `docs/superpowers/plans/2026-08-05-temporal-event-foundation.md` -- `docs/research/standards-and-literature.md` - -No release, production-readiness, GPU, database, or statistical-recovery claim is -made by this foundation slice. - -The active stacked analysis-engine slice adds a bounded executable readiness path -from an accepted run to a digest-bound terminal artifact. It is not yet -implemented-main and does not replace scientific estimator contracts. -Validated statistical-recovery APIs exist only inside `psychometric_core`: OLS -loading recovery on already-mapped coordinates, posterior-draw point estimates, -the Rubin total-variance identity `T = U_bar + (1 + 1/m) B`, CWC/event-time/ -contextual recovery maps, and two-group OLS latent-mean comparison gated behind -typed strong/strict invariance evidence (`LatentMeanComparisonEvidence`; metric, -weak, or configural status cannot reduce to a passing flag). No release, -production-readiness, GPU, or database claim is made by this foundation slice, -and no crate yet implements a full ESEM/DSEM estimator (the two-group OLS -invariance gate is not MGCFA). +Stable Rust line coverage is measured with `cargo-llvm-cov`. Branch coverage uses a separately pinned nightly lane because Rust branch coverage remains an unstable compiler capability. A zero denominator is reported explicitly for a crate with no executable behavior; it must never hide uncovered production code. + +If you are evaluating TEPP as an integrator rather than developing the workspace, start with the product boundary and released-contract evidence rather than individual crate names. + +## Core concepts + +### Evidence before interpretation + +Source bytes, exact spans, identifiers, versions, provenance, and availability are first-class evidence. Derived fields and model outputs do not overwrite the observations that support them. + +### Six-clock temporal semantics + +TEPP distinguishes event/valid time, assertion time, document time, system time, availability time, and the analysis knowledge cutoff. Historical analyses exclude evidence that was not actually available by the declared cutoff. + +### Relational and multilevel measurement + +Documents and events can participate in revision, translation, citation, membership, project, organization, author, episode, and other time-varying relations. Membership can be cross-classified and multiple rather than forced into one hierarchy. + +### Measurement is not labeling + +A discovered topic, cluster, relation, or LLM explanation is not automatically a validated construct. Measurement invariance, uncertainty, known-truth recovery, model diagnostics, and external validity remain separate requirements appropriate to the claim being made. + +### Temporal precedence is not causality + +TEPP can preserve ordered events and analyze temporal association, but causal language requires an identified experimental, quasi-experimental, or defensible observational design. A successful API call, fit routine, or temporal ordering does not promote a causal claim. + +## Architecture at a glance + +```text +Documentary / event evidence + | + v ++-------------------------------+ +| Evidence & temporal semantics | +| exact spans / provenance | +| six clocks / cutoff rules | ++---------------+---------------+ + | + v ++-------------------------------+ +| Relational measurement layer | +| events / membership / lineage | +| multilingual measurement | ++---------------+---------------+ + | + v ++-------------------------------+ +| Analysis & validation | +| Rust numerical boundaries | +| recovery / invariance gates | ++---------------+---------------+ + | + v ++-------------------------------+ +| Evidence-grounded outputs | +| interpretation / audit | +| explicit claim authority | ++-------------------------------+ +``` + +Implementation crates are modular units inside these product responsibilities; crate count is not a customer capability metric and is intentionally not used as a maturity signal in this README. + +## Scientific and security guardrails + +TEPP is designed to fail closed when evidence, temporal identity, provenance, authorization, numerical validity, or claim-promotion requirements are absent or contradictory. The architecture deliberately separates statistical recovery from scientific acceptance and evidence-grounded interpretation from authoritative estimation. + +Production mathematical and psychometric arithmetic is Rust-owned. Python can support repository validation, interoperability, and independent-oracle testing, but does not become the production numerical core. + +Security, privacy, and access boundaries are part of the data contract: sensitive evidence is purpose-bound, consumer boundaries are explicit, and adjacent systems do not receive authority merely because they can call an API. + +## Documentation map + +Use the canonical documentation graph rather than treating this README as a complete technical specification: + +- [`DOCUMENTATION.md`](DOCUMENTATION.md) — documentation authority and navigation. +- [`ARCHITECTURE.md`](ARCHITECTURE.md) — system and bounded-context architecture. +- [`docs/product/prd-v0.4-approved.md`](docs/product/prd-v0.4-approved.md) — approved product requirements baseline. +- [`docs/architecture/domain-context-map.md`](docs/architecture/domain-context-map.md) — DDD ownership and dependency direction. +- [`docs/product-technical-gap-baseline.md`](docs/product-technical-gap-baseline.md) — current gaps, maturity, owners, and evidence limits. +- [`docs/adr/README.md`](docs/adr/README.md) — architecture decisions. +- [`docs/research/standards-and-literature.md`](docs/research/standards-and-literature.md) — standards and research basis. + +## Contributing and support + +Before changing product behavior, numerical authority, or cross-repository ownership, read [`AGENTS.md`](AGENTS.md), the architecture, applicable ADRs, and the product/technical gap baseline. Keep new behavior inside the bounded context that owns it, add executable evidence before promoting a claim, and update source, tests, documentation, and traceability together. + +Use repository issues for reproducible product defects, standards gaps, scientific-contract gaps, and integration problems. An open PR is not support evidence for a capability until it is integrated and released under the repository's normal governance. + +## License + +TEPP source and documentation are licensed under the [MIT License](LICENSE). Third-party dependencies and external services retain their own licenses and terms; commercially incompatible inbound software must not be treated as acceptable merely because TEPP itself is MIT-licensed. From 78452fd12614a51bd4158d9f8e8a50d7bbbafd83 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 01:38:07 +0900 Subject: [PATCH 058/235] docs(delivery): refresh live queue and security evidence --- docs/product-technical-gap-baseline.md | 130 +++++++------------------ 1 file changed, 35 insertions(+), 95 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 223380fc5..db8a50d42 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-01T14:02:31Z +**Snapshot:** 2026-09-01T16:36:55Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` **Workspace version:** `0.2.0` **Delivery authority:** issue [#175](https://github.com/ContextualWisdomLab/TEPP/issues/175), PR [#435](https://github.com/ContextualWisdomLab/TEPP/pull/435), and [`docs/delivery/pr-queue-authority-2026-09-01.md`](delivery/pr-queue-authority-2026-09-01.md) @@ -10,47 +10,40 @@ ## Purpose -This document is the operator-facing authority for current product and technical gaps. Historical queue snapshots remain in Git history. A planning document, mergeable branch, local test, predecessor-head result, queued/skipped check, ADR number, or LLM judgment does not make a capability shipped. - -Passing or queued Checks on an open PR never promote that PR to implemented-main. +This document is the operator-facing authority for current product and technical gaps. Historical snapshots remain in Git history. A planning document, mergeable branch, local test, predecessor-head result, queued/skipped check, ADR number, or LLM judgment does not make a capability shipped. Passing or queued Checks on an open PR never promote that PR to `implemented-main`. ## Live snapshot | Signal | Current evidence | Delivery implication | | --- | ---: | --- | | Protected `main` | `1bc02f580cf48e1d39da239f0e818453437c31c3` | Capability claims remain bounded to this commit until protected main changes. | -| Open pull requests | **145** | Release-blocking WIP remains high and rose again after reaching 138. | -| Draft pull requests | **89** | Draft status is workflow metadata, not scientific or domain classification. | -| Non-draft pull requests | **56** | Ready metadata is not merge readiness without exact-head evidence. | +| Open pull requests | **134** | WIP remains release-blocking, but queue consolidation has reduced the observed peak of 149. | +| Draft pull requests | **121** | Most remaining work is explicitly non-landable pending consolidation, repair, dependency or scientific evidence. | +| Non-draft pull requests | **13** | Ready metadata is not merge readiness without exact-head evidence and qualifying review. | | Open issues | **14** | Includes #437 for repository-wide ADR identity normalization. | | GitHub releases | **0** | No open PR head or local branch is a released TEPP product contract. | -| Effective organization ruleset | `18156473` | Current ruleset requires one qualifying approval, resolved review threads, exact-head required workflows, and an allowed merge method. | +| Effective organization ruleset | `18156473` | Requires one qualifying approval, resolved review threads, current required workflows and an allowed merge method. | The classic branch-protection payload is not the sole policy source. Organization rulesets are the effective merge authority where applicable. -The queue fell from the observed peak of 149 to 134, then rose to 135 with #454, 137 with #455/#456, 138 with #457, and **145 with #458-#464**. That latest increase is a WIP regression. #459, #463 and #464 are additional one-operation Analysis Run adapter slices; #458, #460 and #461 are one-refusal analysis-profile slices. #462 is a bounded naming/compatibility repair and is evaluated separately rather than used to justify the surrounding micro-PR growth. +The queue rose to 149 before the recovery vehicle started folding strict linear stacks. Since then, GET/CLI predecessor pairs in export, interpretation, project-history and temporal-context adapters have been collapsed into surviving landing vehicles while preserving predecessor discussion, RED/GREEN lineage and review evidence. New one-operation or one-refusal PR creation while #435 remains open is a delivery regression unless an existing bounded-context vehicle cannot safely own the repair. ## Current priority open pull-request evidence -This table is an exact-head **priority subset**, not a row-for-row copy of the 145-PR queue. PR #435 itself is omitted because writing its own exact head into a commit on that branch would immediately make the embedded head stale. +This table is an Exact current head **priority subset**, not a row-for-row copy of the 134-PR queue. PR #435 itself is omitted because writing its own exact head into a commit on that branch would immediately make the embedded head stale. | PR | Exact current head | Draft | Base | Ownership / disposition | | ---: | --- | :---: | --- | --- | -| #464 | `0a16134ab6e4d8d4a30012dc5d5234d6ff59b235` | false | #463 head | Analysis Run/LineageWeave temporal-context stored-request CLI; `fold_into_landing_vehicle` | -| #463 | `b476b9de1bbd949e7b089727bfac2256a5cbb886` | false | #451 head | Analysis Run/LineageWeave temporal-context stored-request GET; `fold_into_landing_vehicle` | -| #457 | `f259497ff2e45536352fa399504f56b736ad4f83` | false | #411 head | Analysis Run/naruon export stored-request GET; `fold_into_landing_vehicle` | -| #456 | `ade6e27d46f477d8332bce13ccee080f0b55bfa9` | false | #455 head | Analysis Run/LineageWeave project-history stored-request CLI; `fold_into_landing_vehicle` | -| #455 | `c7e02968f147157aedbe805a8ffac823bdb716bf` | false | #429 head | Analysis Run/LineageWeave project-history stored-request GET; `fold_into_landing_vehicle` | -| #454 | `c911fbcd6e13046358cc7f3692775ed4b008dadd` | false | #453 head | Analysis Run/contextual-orchestrator stored-request CLI; `fold_into_landing_vehicle` | -| #453 | `baee8854e99dc416b2b907a22101c53a6eca9eca` | false | #438 head | Analysis Run/contextual-orchestrator stored-request GET; `fold_into_landing_vehicle` | -| #452 | `cb97aad9f87283df4d94abe8c6df61a0a476c893` | false | #451 head | Analysis Run/LineageWeave temporal-context retrieval CLI; `fold_into_landing_vehicle` | -| #451 | `7b117e8f69cd74e28eceaf1748c6a9210f5dffbc` | false | main | Analysis Run/LineageWeave temporal-context GET-by-id; `fold_into_landing_vehicle` | -| #443 | `504793d88c6b754f5181f48dc7abde073ff9146a` | false | #411 head | Analysis Run/export collection adapter; `fold_into_landing_vehicle` | -| #441 | `6f483224b3a03e8237c6f4f098a8b0e85e0a91f5` | false | main | Longitudinal Modeling lagged-correlation root-cause repair; exact-head hosted gates still pending | +| #466 | `0c5efc3c9075115d0670b8438342c72069043dcd` | true | export-retrieval GET ancestor | Analysis Run / naruon export idempotency GET+CLI landing vehicle; fold compatible export mechanics here or a coherent successor. | +| #464 | `1b3a477242336634be2c7867b29d39979e9a6dca` | true | temporal-context retrieval GET ancestor | Analysis Run / LineageWeave temporal-context stored-request GET+CLI landing vehicle. | +| #462 | `c1b7d627167dd7636d2975cc41cec050a5e477ba` | true | main | Bounded `JsonLdExport.node_id` source-name compatibility repair; serialized v1 key remains `id`. | +| #441 | `23959d1199f84554f4a5090cea2b9e9d70b55dd8` | true | main | Longitudinal Modeling true two-marginal lagged-correlation repair; source findings resolved, security support gate remains external/configuration-blocked. | +| #417 | `1e468f62ec47f3476a7b4d18ed2980451dc425cf` | true | main | Analysis Run / naruon export retrieval GET+CLI landing vehicle. | +| #420 | `0dc8b48f66b367a90847fcfebd2c6453ff275a1d` | false | main | Project-history query CLI; must fold into the coherent Analysis Run / LineageWeave project-history vehicle rather than land as a one-operation boundary. | ## Strategic Domain-Driven Design baseline -Cargo crates and HTTP routes are implementation units, not bounded contexts. +Cargo crates, HTTP routes, CLI verbs, refusal rules and clocks are implementation units, not bounded contexts. | Subdomain | Bounded context | Aggregate authority | Primary implementation nucleus | | --- | --- | --- | --- | @@ -62,7 +55,7 @@ Cargo crates and HTTP routes are implementation units, not bounded contexts. | Core | Validation | `ValidationStudy`, `ValidationEvidence` | `validation_core`, `tepp_simulation` | | Supporting | Projection / Analysis Run | `AnalysisRun`, published read models | application services with HTTP/CLI as adapters | | Supporting | Interpretation | evidence-grounded interpretation workflow | contextual-orchestrator ACL only | -| Supporting | Persistence & Recovery | repository implementations and durable receipts | `persistence_postgres` and object-store adapters | +| Supporting | Persistence & Recovery | repositories and durable receipts | `persistence_postgres` and object-store adapters | | Generic | Compute backend | execution receipt | CPU/GPU/MLX adapters; execution is not scientific authority | ### Canonical owner boundaries @@ -75,89 +68,45 @@ Cargo crates and HTTP routes are implementation units, not bounded contexts. ### Six-clock invariant -The following meanings remain distinct in code, schema and tests: - -- `event_time`: when a substantive event occurs; -- `assertion_time`: when a statement claims or records an event/state; -- `document_time`: when the source document is created/revised/published; -- `system_time`: when TEPP records the fact; -- `available_time`: when evidence became usable by an analysis; -- `knowledge_cutoff`: the latest available-time admitted to a run. - -A valid retrospective document may point to an earlier event, but it cannot enter an earlier knowledge cutoff. Forward state/transition edges are distinct from retrospective, citation, revision and provenance relations. +`event_time`, `assertion_time`, `document_time`, `system_time`, `available_time` and `knowledge_cutoff` remain distinct in code, schema and tests. A retrospective source may describe an earlier event but cannot enter an earlier knowledge cutoff. Forward state/transition edges remain distinct from retrospective, citation, revision and provenance relations. ## Temporal dependence composition -TEPP composes time over the full released upstream candidate identity rather than hard-coded family names. A compatible base family added to fast-mlsirm should inherit temporal-candidate compilation without a TEPP family-specific wrapper. - -Each temporal candidate records: - -- released upstream contract version and digest; -- exact base formulation and parameter meaning; -- generalized-mixed and dependence structures; -- status: `supported`, `research_candidate`, or `unsupported`; -- temporal state/generative equation; -- event/occasion clock roles; -- identification/alignment constraints; -- time-varying covariates, random effects and membership semantics; -- estimator owner; -- required data support; -- primary citations; -- recovery contract and current recovery status. - -Auto-expansion is not auto-activation. Unknown or novel couplings remain `research_candidate`. Incoherent combinations are `unsupported`. No dependence-aware temporal request is silently simplified to a static/local-independent model. - -### Base-family identity - -Rasch remains distinct from generic 1PL. Formulation-qualified 2PLM–5PLM retain their parameter meanings. Confirmatory/exploratory MIRT and ideal-point/GGUM response processes are distinct axes from hierarchy, dependence and time. Testlet, rater/facet, nested, crossed, cross-classified and multiple-membership structure remain explicit. - -Known hierarchy/testlet/rater/method/item-family effects are modeled before residual latent-space dependence. Cross-classification and multiple membership are distinct. Multiple-membership weights are explicit, auditable, time-valid and either observed/normalized or model-estimated according to the declared formulation; equal weights are never invented as a fallback. +TEPP composes time over the full released upstream candidate identity rather than hard-coded family names. Every temporal candidate records the released upstream version/digest, exact response and generalized-mixed formulation, dependence structure, `supported | research_candidate | unsupported`, temporal state/generative equations, clock roles, identification/alignment, time-varying covariates/random effects/memberships, estimator owner, required data support, primary citations and recovery status. -### LSIRM / MLSIRM / DLSJM +Auto-expansion is not auto-activation. Rasch remains distinct from generic 1PL. Formulation-qualified 2PLM–5PLM, confirmatory/exploratory MIRT and ideal-point/GGUM identities are preserved. Cross-classification and multiple membership remain distinct; membership weights are explicit, auditable, time-valid and observed-normalized or model-estimated according to the declared formulation. -LSIRM/MLSIRM temporal candidates preserve the complete base-family parameterization plus person/item positions, distances/interactions and the declared generalized-mixed structure. Dynamic latent-space evolution remains `research_candidate` until state equations, longitudinal identification/alignment and recovery exist. - -DLSJM temporal candidates retain distinct item-dependence and person-dependence spaces. Jin and Jeon (2019) is the baseline authority for DLSJM itself; novel temporal couplings remain extensions. Translation/rotation/reflection and cluster-label alignment are required before maps or clusters are compared across occasions. +LSIRM/MLSIRM temporal candidates preserve full base-family parameters plus person/item geometry and generalized-mixed structure. DLSJM retains distinct item- and person-dependence spaces. Dynamic geometry remains `research_candidate` until state equations, longitudinal identification/alignment and true-parameter recovery exist. Raw latent maps are never compared across occasions without alignment. ## Scientific validation invariants -Every supported temporal estimator requires realistic recovery evidence. Applicable contracts include true-state/true-parameter RMSE, bias, interval coverage, convergence, uncertainty calibration, temporal ordering, leakage-safe rolling-origin evaluation, irregular gaps, delayed and retrospective reports, missing occasions, changing memberships, language/source drift and CPU/GPU parity where an accelerator backend exists. - -Monte Carlo decisions use uncertainty of the Monte Carlo study rather than arbitrary observed-pass percentages. Scientific failure is never hidden with skip, xfail or source rewriting. - -A generic arithmetic standardizer is not itself a DSEM/ctsem estimator and must not be promoted as one without state equations, process-noise/marginal recovery, identification and validation evidence. - -## Current classifications +Every supported temporal estimator requires realistic known-truth recovery evidence: RMSE, bias, interval coverage, convergence/uncertainty calibration, temporal ordering, leakage-safe rolling-origin evaluation, irregular gaps, delayed/retrospective reports, missing occasions, changing memberships, language/source drift and CPU/GPU parity where applicable. Monte Carlo decisions use uncertainty of the simulation study rather than arbitrary pass percentages. Scientific failure is never hidden with skip, xfail or source rewriting. -**#441 — Longitudinal Modeling landing vehicle.** The invalid predecessor that divided lagged covariance by only the earlier marginal variance has been retired. `longitudinal_core::recover_event_time_lagged_correlation` now requires lagged covariance plus both occasion-specific marginal variances and a positive event-time lag. Exact binary64 covariance-bound checking avoids rounded-product acceptance/rejection errors and stable division order avoids avoidable overflow/underflow. All currently visible review threads are resolved. Exact-head Documentation Quality, Rust Foundation CI, Security Scan and SAST Semgrep remain queued, so queued checks never constitute implemented-main evidence. +A numerical standardizer or adapter is not a DSEM/ctsem/LSIRM/MLSIRM/DLSJM estimator unless the exact generative/state equations, identification, estimator and recovery evidence exist. -**#463/#464 together with #451/#452 — Analysis Run temporal-context adapter fold candidates.** #463 and #464 were created after the queue had already begun recovery and are additional GET/CLI slices over the same LineageWeave temporal-context application boundary. Preserve extra-segment/path and CLI parsing, hostile identity/body/stdin/origin/credential/consumer refusals, metric-free stored-request behavior, `temporal_association_only` semantics and focused contract tests. Fold them with #451/#452/#414 into one coherent temporal-context application-adapter landing vehicle. ADR 0091/0092 are implementation evidence pending #437 normalization, not new architecture authority. +## Current classifications and repairs -**#457/#459 — Analysis Run export adapter fold candidates.** The stored-request GET and dedicated CLI are additional naruon-facing export adapters stacked on the existing export family. Preserve stored-request path/CLI parsing, LineageWeave/hostile-identity/credential refusals, metric-free responses, focused tests and cancel-route refusal, then fold with #411/#417/#443/#444/#410. ADR 0089/0090 are implementation evidence pending #437 normalization, not branch-local architecture authority. +**#441 — Longitudinal Modeling root-cause repair.** The invalid predecessor that divided lagged covariance by only the earlier marginal variance is retired. `longitudinal_core::recover_event_time_lagged_correlation` requires lagged covariance plus both marginal variances and a positive event-time interval. Exact binary64 covariance-bound checking and scale-ordered division cover extreme finite inputs without using an invalid one-sided ratio. Current review threads are resolved. Semgrep is GREEN on the current head. The central Security Scan fails before dependency review because `GET /repos/ContextualWisdomLab/TEPP/dependency-graph/compare/...` returns HTTP 403 even though the repository is public and the job token has `contents: read`; OSV/Trivy evidence is independently GREEN. This is `blocked_external` on repository dependency-graph/security configuration or GitHub service behavior, not a TEPP vulnerability result. Do not weaken the fail-closed workflow to make the check green. -**#455/#456 — Analysis Run project-history adapter fold candidates.** Their own PR descriptions classify them `fold_into_landing_vehicle` and prohibit independent merge while queue recovery is active. Preserve stored-request path/CLI parsing, hostile-input/origin/credential/consumer refusals, `inference_status=temporal_association_only`, metric-free responses and focused contract tests, then fold with #429/#431/#424/#428/#420. ADR 0087/0088 are implementation evidence pending #437 normalization, not branch-local architecture authority. +**Analysis Run adapter families.** Export, interpretation, project-history and temporal-context HTTP/CLI mechanics are application adapters inside one supporting bounded context. Strict predecessor/child stacks are folded only after exact ancestry is proven; siblings require real source/test consolidation before closure. #417/#466, #428/#420 and related surviving vehicles therefore remain separate until unique routes/refusals/tests are actually composed into coherent vehicles. -**#453/#454 — Analysis Run interpretation adapter fold candidates.** Their PR descriptions explicitly classify them `fold_into_landing_vehicle`. Preserve stored-request path/CLI parsing, hostile-input, origin/credential/consumer refusal, metric-free result and `scientific_authority=false` tests. ADR 0085/0086 are implementation evidence pending #437 normalization, not branch-local architecture authority. +**Validation / Analysis Run profile proliferation.** One existing refusal or one output profile does not create architecture authority. Compatible profile registration, cutoff/digest/census mechanics, limit handling and inspect-payload refusal tests must be consolidated in the Validation/Analysis Run owner path. Existing branches remain evidence until their unique behavior is folded; they are not individually production candidates merely because they are mergeable. -**#458/#460/#461 — Validation / Analysis Run profile fold candidates.** These bind one already-existing refusal rule at a time (`outcome_order`, `relation_absence`, `episode_membership`) into separate analysis-run profiles. The rules and their cutoff-safe tests are evidence worth preserving, but one refusal profile is not one bounded context. Fold compatible profile registration, cutoff/digest/census mechanics, limit handling and inspect-payload refusal tests into the coherent Validation/Analysis Run vehicle instead of extending per-rule PR/ADR proliferation. +**#462 — bounded source-identifier repair.** Rust source uses `node_id` while the versioned serialized v1 wire key remains `id`. This is a compatibility-scoped naming repair, not a new bounded context or JSON-LD `@id` semantic change. -**#462 — bounded source-identifier repair.** Renaming the Rust source field to `node_id` while preserving the serialized v1 `id` wire key is a compatibility-scoped root-cause repair rather than a new domain slice. It may remain independently landable if current exact-head compatibility, documentation, coverage, review and security gates are satisfied; it does not justify new Analysis Run micro-PRs. +**#437 — ADR identity repair.** The #435 branch now requires one repository-wide identity/target per indexed ADR and rejects duplicate index numbers, duplicate index targets and duplicate numbered ADR files. The normalized index preserves pre-normalization collision lineage under `docs/adr/archive/` rather than treating branch-local ADR numbers as architecture authority. Issue closure waits for protected-main integration. -**#443/#444 and related export slices — Analysis Run export fold candidates.** Preserve pagination/auth/refusal/metric-free tests and fold into one export application-adapter landing vehicle. +## Dependency and integration status -**#356 — closed, not merged.** Its self-referential RMSE-SE acceptance gate, caller-declared recovery provenance and Validation/Claim-Promotion conflation remain prohibited. Useful cutoff/run-binding/metric evidence belongs in the coherent Validation/Analysis Run vehicle. +TEPP must not copy reusable static psychometric kernels from fast-mlsirm or provider-selection logic from contextual-orchestrator. Upstream candidate/model contracts are consumed only through versioned ACLs. A checksum-pinned contextual-orchestrator dependency is not advanced until the exact replacement source archive digest is reproducibly acquired; the checksum is never removed merely to follow upstream. -**#437 — ADR identity repair.** Repository-wide ADR IDs are immutable and unique. Duplicate numeric files/index rows must fail deterministic fitness tests. The queue-authority branch now contains duplicate-index, duplicate-target and duplicate-numbered-file checks; normalization must still land coherently rather than renumbering every live micro-branch independently. Implementation maturity does not create branch-local architecture authority. - -## Dependency pin status - -`contextual-orchestrator` protected `main` is currently ahead of TEPP's checksum-pinned hourly gateway dependency and includes a correction to Bytez provider-declared zero-price ranking used by `select_top_n_cheapest_discovered_agents`. TEPP's hourly gateway currently remains pinned to `e226e1197bdfc890c9d8e5b9b648c78857d7e465` with a committed archive SHA-256. Do not remove or weaken that checksum merely to follow upstream. Advance the pin only after the exact replacement source archive digest is reproducibly acquired and reviewed; until then this is dependency drift rather than permission to duplicate upstream ranking logic in TEPP. The hourly single-flight gate is currently non-dispatchable anyway because open PRs/issues are non-zero. +`context-graph-contracts` and `enterprise-architecture-core` remain read-only to this writer while their dedicated Context Fabric writer is active. Open PR heads are not released contracts. With no released Context Graph artifact, TEPP may prepare conformance fixtures behind candidate/test boundaries but cannot bind deployable integration or authoritative EA projection to a stacked branch. ## Operator-gap register | ID | Gap | Maturity | Authority | Closure evidence | | --- | --- | --- | --- | --- | -| GAP-001 | PR authority fragmented across 145 open PRs | `release-blocking` | #175 / #435 | classified queue, coherent bounded-context landing vehicles, unique evidence preserved, safe reduction | +| GAP-001 | PR authority fragmented across 134 open PRs | `release-blocking` | #175 / #435 | classified queue, coherent bounded-context landing vehicles, unique evidence preserved, safe reduction | | GAP-002 | multilingual span-grounded semantic/concept admission incomplete | `partial` | Evidence & Semantic Measurement | immutable offsets/layout, language profiles, concept dictionary, unknown review, invariance/calibration, hostile-input tests | | GAP-003 | shared-latent temporal topic estimator incomplete | `partial` | #167 | Rust CPU `f64` likelihood/estimands/uncertainty, relation/time/membership effects, multi-seed recovery, real candidate-K fits | | GAP-004 | durable end-to-end Analysis Run incomplete | `partial` | #166 | idempotent lifecycle, persistence/recovery, estimator-bound artifacts, validation evidence, claim-promotion separation, Compose E2E | @@ -170,6 +119,7 @@ A generic arithmetic standardizer is not itself a DSEM/ctsem estimator and must | GAP-011 | operable multi-tenant supported release incomplete | `accepted-target` | Operations | OIDC/RLS/purpose controls, durable queue/storage, OTel/SLO, restore/load/migration, signed release/SBOM/provenance | | GAP-012 | directory/crate paths obscure domain ownership | `active-refactor` | #435 / landing vehicles | staged folds, compatibility ACLs, no cycles/cross-context persistence/shared-kernel creep | | GAP-013 | ADR identity duplicated/branch-local in parts of queue | `release-integrity` | #437 | unique repository-wide identity, duplicate detection, normalized index and supersession lineage | +| GAP-014 | required dependency-review evidence unavailable | `blocked_external` | repository security configuration + central workflow | exact base/head compare endpoint returns HTTP 403; enable/repair dependency graph support, rerun exact-head Security Scan, retain fail-closed behavior | ## Delivery order @@ -186,18 +136,8 @@ A bounded dependency/security repair may land earlier when it directly unblocks ## Queue consolidation rules -Every open PR receives one of: - -- `landing_vehicle` -- `stacked_dependency` -- `fold_into_landing_vehicle` -- `superseded` -- `duplicate` -- `research_lineage_only` -- `blocked_external` - -Before classifying a PR as duplicate/superseded/folded, compare exact heads and preserve unique production behavior, compatibility, tests, review findings, primary research, doctoring and provenance. One-rule crates, one-clock crates and one-operation API/CLI PRs are not independent product boundaries by default. +Every open PR receives one of `landing_vehicle`, `stacked_dependency`, `fold_into_landing_vehicle`, `superseded`, `duplicate`, `research_lineage_only`, or `blocked_external`. Before closing/folding work, compare exact heads and preserve unique production behavior, compatibility, tests, review findings, primary research, doctoring and provenance. Strict linear ancestry permits retarget-and-close consolidation; diverged siblings require an actual source/test fold first. ## Release truth -TEPP has no GitHub release at this snapshot. A release is permitted only after a coherent buyer/scientific vertical reaches protected main with required exact-head recovery and security evidence, reproducible package/build provenance, SBOM, upgrade/rollback evidence, and released integration contracts where cross-product deployment depends on them. +TEPP has no GitHub release at this snapshot. A release is permitted only after a coherent buyer/scientific vertical reaches protected main with current recovery and security evidence, reproducible package/build provenance, SBOM, upgrade/rollback evidence, and released integration contracts where cross-product deployment depends on them. \ No newline at end of file From df11527a3449a70f5b6f30760a12a0ad83e7f74b Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 01:43:20 +0900 Subject: [PATCH 059/235] docs(delivery): reflect single Ready PR and DDD disposition --- docs/product-technical-gap-baseline.md | 154 +++++++++++-------------- 1 file changed, 65 insertions(+), 89 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index db8a50d42..f46c262fd 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,142 +2,118 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-01T16:36:55Z +**Snapshot:** 2026-09-01T16:43:00Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` **Workspace version:** `0.2.0` **Delivery authority:** issue [#175](https://github.com/ContextualWisdomLab/TEPP/issues/175), PR [#435](https://github.com/ContextualWisdomLab/TEPP/pull/435), and [`docs/delivery/pr-queue-authority-2026-09-01.md`](delivery/pr-queue-authority-2026-09-01.md) **DDD authority:** [`docs/architecture/domain-context-map.md`](architecture/domain-context-map.md) and [`docs/architecture/temporal-dependence-composition.md`](architecture/temporal-dependence-composition.md) -## Purpose +## Delivery truth -This document is the operator-facing authority for current product and technical gaps. Historical snapshots remain in Git history. A planning document, mergeable branch, local test, predecessor-head result, queued/skipped check, ADR number, or LLM judgment does not make a capability shipped. Passing or queued Checks on an open PR never promote that PR to `implemented-main`. - -## Live snapshot +A planning document, mergeable branch, local test, predecessor-head result, queued/skipped check, ADR number, or LLM judgment does not make a capability shipped. Passing or queued Checks on an open PR never promote that PR to `implemented-main`. | Signal | Current evidence | Delivery implication | | --- | ---: | --- | | Protected `main` | `1bc02f580cf48e1d39da239f0e818453437c31c3` | Capability claims remain bounded to this commit until protected main changes. | -| Open pull requests | **134** | WIP remains release-blocking, but queue consolidation has reduced the observed peak of 149. | -| Draft pull requests | **121** | Most remaining work is explicitly non-landable pending consolidation, repair, dependency or scientific evidence. | -| Non-draft pull requests | **13** | Ready metadata is not merge readiness without exact-head evidence and qualifying review. | +| Open pull requests | **134** | WIP remains release-blocking, though verified consolidation reduced the observed peak of 149. | +| Draft pull requests | **133** | Non-landable work is now explicitly parked while it is consolidated, repaired or supplied with missing evidence. | +| Non-draft pull requests | **1** | #310 is the sole Ready PR and is not independently mergeable under the current DDD disposition. | | Open issues | **14** | Includes #437 for repository-wide ADR identity normalization. | -| GitHub releases | **0** | No open PR head or local branch is a released TEPP product contract. | -| Effective organization ruleset | `18156473` | Requires one qualifying approval, resolved review threads, current required workflows and an allowed merge method. | - -The classic branch-protection payload is not the sole policy source. Organization rulesets are the effective merge authority where applicable. +| GitHub releases | **0** | No open head is a released TEPP contract. | +| Effective organization ruleset | `18156473` | One qualifying approval, resolved conversations, exact-head required workflows and an allowed merge method are required. | -The queue rose to 149 before the recovery vehicle started folding strict linear stacks. Since then, GET/CLI predecessor pairs in export, interpretation, project-history and temporal-context adapters have been collapsed into surviving landing vehicles while preserving predecessor discussion, RED/GREEN lineage and review evidence. New one-operation or one-refusal PR creation while #435 remains open is a delivery regression unless an existing bounded-context vehicle cannot safely own the repair. +Classic branch-protection status is not the sole policy source; organization rulesets are the effective merge authority where applicable. Any increase in open PR count while #435 remains open is a WIP regression unless the new PR is a demonstrably independent root-cause repair that cannot safely belong to an existing landing vehicle. -## Current priority open pull-request evidence +## Priority exact-head inventory -This table is an Exact current head **priority subset**, not a row-for-row copy of the 134-PR queue. PR #435 itself is omitted because writing its own exact head into a commit on that branch would immediately make the embedded head stale. +This is a priority subset, not a row-for-row copy of the 134-PR queue. #435 omits its own SHA because embedding it in the same branch would make the value stale on commit. | PR | Exact current head | Draft | Base | Ownership / disposition | | ---: | --- | :---: | --- | --- | -| #466 | `0c5efc3c9075115d0670b8438342c72069043dcd` | true | export-retrieval GET ancestor | Analysis Run / naruon export idempotency GET+CLI landing vehicle; fold compatible export mechanics here or a coherent successor. | -| #464 | `1b3a477242336634be2c7867b29d39979e9a6dca` | true | temporal-context retrieval GET ancestor | Analysis Run / LineageWeave temporal-context stored-request GET+CLI landing vehicle. | -| #462 | `c1b7d627167dd7636d2975cc41cec050a5e477ba` | true | main | Bounded `JsonLdExport.node_id` source-name compatibility repair; serialized v1 key remains `id`. | -| #441 | `23959d1199f84554f4a5090cea2b9e9d70b55dd8` | true | main | Longitudinal Modeling true two-marginal lagged-correlation repair; source findings resolved, security support gate remains external/configuration-blocked. | +| #466 | `0c5efc3c9075115d0670b8438342c72069043dcd` | true | export-retrieval ancestor | Analysis Run / naruon export idempotency GET+CLI landing vehicle. | +| #464 | `1b3a477242336634be2c7867b29d39979e9a6dca` | true | temporal-context retrieval ancestor | Analysis Run / LineageWeave temporal-context stored-request GET+CLI landing vehicle. | +| #462 | `c1b7d627167dd7636d2975cc41cec050a5e477ba` | true | main | Bounded source-name compatibility repair; v1 serialized key remains `id`. | +| #441 | `23959d1199f84554f4a5090cea2b9e9d70b55dd8` | true | main | Longitudinal Modeling two-marginal lagged-correlation repair; source findings resolved, dependency-review support blocked externally. | +| #420 | `0dc8b48f66b367a90847fcfebd2c6453ff275a1d` | true | main | Project-history query CLI; `fold_into_landing_vehicle`. | | #417 | `1e468f62ec47f3476a7b4d18ed2980451dc425cf` | true | main | Analysis Run / naruon export retrieval GET+CLI landing vehicle. | -| #420 | `0dc8b48f66b367a90847fcfebd2c6453ff275a1d` | false | main | Project-history query CLI; must fold into the coherent Analysis Run / LineageWeave project-history vehicle rather than land as a one-operation boundary. | +| #310 | `cc7fad4d0bdffe7b524636737581227663f930f4` | false | main | Sole Ready PR; temporal `discreteDRIFTstd` evidence must migrate from `psychometric_core` into Longitudinal Modeling before landing. | -## Strategic Domain-Driven Design baseline +## Domain ownership Cargo crates, HTTP routes, CLI verbs, refusal rules and clocks are implementation units, not bounded contexts. -| Subdomain | Bounded context | Aggregate authority | Primary implementation nucleus | +| Subdomain | Bounded context | Aggregate authority | Implementation nucleus | | --- | --- | --- | --- | | Core | Evidence & Semantic Measurement | `EvidenceCorpus`, `SemanticUnitSet`, `ConceptDictionaryRevision` | `evidence_core`, `semantic_core` | | Core | Temporal Semantics | `TemporalEvidenceWindow`, `KnowledgeCutoffPolicy` | temporal primitives and cutoff policy | | Core | Event Ontology & Temporal Graph | `EventEpisode`, `TemporalRelationSet` | `event_core`, `relation_graph` | -| Core | Measurement | `MeasurementSpecification`, `MeasurementRun` | topic/measurement modules plus released fast-mlsirm ACL | -| Core | Longitudinal Modeling | `TemporalModelSpecification`, `TemporalModelRun` | `longitudinal_core` and temporal/event composition | +| Core | Measurement | `MeasurementSpecification`, `MeasurementRun` | measurement modules + released fast-mlsirm ACL | +| Core | Longitudinal Modeling | `TemporalModelSpecification`, `TemporalModelRun` | `longitudinal_core` + temporal/event composition | | Core | Validation | `ValidationStudy`, `ValidationEvidence` | `validation_core`, `tepp_simulation` | -| Supporting | Projection / Analysis Run | `AnalysisRun`, published read models | application services with HTTP/CLI as adapters | +| Supporting | Projection / Analysis Run | `AnalysisRun`, published read models | application services; HTTP/CLI are adapters | | Supporting | Interpretation | evidence-grounded interpretation workflow | contextual-orchestrator ACL only | -| Supporting | Persistence & Recovery | repositories and durable receipts | `persistence_postgres` and object-store adapters | +| Supporting | Persistence & Recovery | repositories and durable receipts | `persistence_postgres`, object-store adapters | | Generic | Compute backend | execution receipt | CPU/GPU/MLX adapters; execution is not scientific authority | -### Canonical owner boundaries - -- **fast-mlsirm** owns reusable static/generalized-mixed/dependence-aware psychometric model specification and numerical kernels, including reusable LSIRM/MLSIRM/DLSJM computation. -- **TEPP** owns temporal/event composition: event/valid/assertion/document/system/available time semantics, leakage-safe knowledge cutoff, irregular intervals, time-varying covariates/random effects/memberships, longitudinal invariance/drift, event ontology/graph, temporal alignment, state evolution and temporal recovery. -- **contextual-orchestrator** owns every model-provider call, routing/fallback, credential, verifier/adjudicator execution and LLM call provenance. -- **LineageWeave or the consuming product** owns source/item-generation lineage; lineage is evidence rather than numerical authority. -- **context-graph-contracts** is a contract-only Shared Kernel and **enterprise-architecture-core** is the authoritative EA Decision Plane. TEPP consumes only released/versioned contracts through ACLs and never writes cross-service SQL. +**Canonical owners:** fast-mlsirm owns reusable static/generalized-mixed/dependence-aware psychometric specification and LSIRM/MLSIRM/DLSJM kernels. TEPP owns temporal/event composition, irregular time, time-varying multilevel/cross-classified/multiple-membership semantics, longitudinal invariance/drift/alignment and temporal recovery. contextual-orchestrator owns every LLM/provider call and routing decision. Context Graph contracts are a contract-only Shared Kernel; EA Core owns authoritative architecture decisions. No cross-service SQL. -### Six-clock invariant +### Clock and relation invariants -`event_time`, `assertion_time`, `document_time`, `system_time`, `available_time` and `knowledge_cutoff` remain distinct in code, schema and tests. A retrospective source may describe an earlier event but cannot enter an earlier knowledge cutoff. Forward state/transition edges remain distinct from retrospective, citation, revision and provenance relations. +`event_time`, `assertion_time`, `document_time`, `system_time`, `available_time` and `knowledge_cutoff` remain distinct in code, schemas and tests. A retrospective source may describe an earlier event but cannot enter an earlier knowledge cutoff. Forward state/transition edges remain distinct from retrospective, citation, revision and provenance relations. -## Temporal dependence composition +## Temporal/dependence model policy -TEPP composes time over the full released upstream candidate identity rather than hard-coded family names. Every temporal candidate records the released upstream version/digest, exact response and generalized-mixed formulation, dependence structure, `supported | research_candidate | unsupported`, temporal state/generative equations, clock roles, identification/alignment, time-varying covariates/random effects/memberships, estimator owner, required data support, primary citations and recovery status. +TEPP composes time over the full released upstream candidate identity, not hard-coded model names. Every candidate records exact response/generalized-mixed/dependence formulation, `supported | research_candidate | unsupported`, state/generative equations, clock roles, identification/alignment, time-varying covariates/random effects/memberships, estimator owner, required data support, primary citations and recovery status. -Auto-expansion is not auto-activation. Rasch remains distinct from generic 1PL. Formulation-qualified 2PLM–5PLM, confirmatory/exploratory MIRT and ideal-point/GGUM identities are preserved. Cross-classification and multiple membership remain distinct; membership weights are explicit, auditable, time-valid and observed-normalized or model-estimated according to the declared formulation. +Rasch remains distinct from generic 1PL. Formulation-qualified 2PLM–5PLM, confirmatory/exploratory MIRT and ideal-point/GGUM identities are preserved. Cross-classification and multiple membership remain distinct; membership weights are explicit, time-valid and observed-normalized or model-estimated according to the formulation. LSIRM/MLSIRM temporal candidates preserve base parameters plus person/item geometry. DLSJM keeps distinct item- and person-dependence spaces. Dynamic geometry stays `research_candidate` until state equations, temporal identification/alignment and true-parameter recovery exist. -LSIRM/MLSIRM temporal candidates preserve full base-family parameters plus person/item geometry and generalized-mixed structure. DLSJM retains distinct item- and person-dependence spaces. Dynamic geometry remains `research_candidate` until state equations, longitudinal identification/alignment and true-parameter recovery exist. Raw latent maps are never compared across occasions without alignment. +Auto-expansion is not auto-activation. A numerical standardizer or adapter is not a DSEM/ctsem/LSIRM/MLSIRM/DLSJM estimator without the exact generative/state equations, identification, estimator and recovery evidence. ## Scientific validation invariants -Every supported temporal estimator requires realistic known-truth recovery evidence: RMSE, bias, interval coverage, convergence/uncertainty calibration, temporal ordering, leakage-safe rolling-origin evaluation, irregular gaps, delayed/retrospective reports, missing occasions, changing memberships, language/source drift and CPU/GPU parity where applicable. Monte Carlo decisions use uncertainty of the simulation study rather than arbitrary pass percentages. Scientific failure is never hidden with skip, xfail or source rewriting. - -A numerical standardizer or adapter is not a DSEM/ctsem/LSIRM/MLSIRM/DLSJM estimator unless the exact generative/state equations, identification, estimator and recovery evidence exist. - -## Current classifications and repairs - -**#441 — Longitudinal Modeling root-cause repair.** The invalid predecessor that divided lagged covariance by only the earlier marginal variance is retired. `longitudinal_core::recover_event_time_lagged_correlation` requires lagged covariance plus both marginal variances and a positive event-time interval. Exact binary64 covariance-bound checking and scale-ordered division cover extreme finite inputs without using an invalid one-sided ratio. Current review threads are resolved. Semgrep is GREEN on the current head. The central Security Scan fails before dependency review because `GET /repos/ContextualWisdomLab/TEPP/dependency-graph/compare/...` returns HTTP 403 even though the repository is public and the job token has `contents: read`; OSV/Trivy evidence is independently GREEN. This is `blocked_external` on repository dependency-graph/security configuration or GitHub service behavior, not a TEPP vulnerability result. Do not weaken the fail-closed workflow to make the check green. +Supported temporal estimators require realistic known-truth recovery: RMSE, bias, interval coverage, convergence and uncertainty calibration, temporal ordering, leakage-safe rolling-origin evaluation, irregular gaps, delayed/retrospective reports, missing occasions, changing memberships, language/source drift and CPU/GPU parity where applicable. Monte Carlo decisions use simulation uncertainty rather than arbitrary observed-pass percentages. Scientific failure is never hidden with skip, xfail, source rewriting or coverage exclusions. -**Analysis Run adapter families.** Export, interpretation, project-history and temporal-context HTTP/CLI mechanics are application adapters inside one supporting bounded context. Strict predecessor/child stacks are folded only after exact ancestry is proven; siblings require real source/test consolidation before closure. #417/#466, #428/#420 and related surviving vehicles therefore remain separate until unique routes/refusals/tests are actually composed into coherent vehicles. +## Current repairs and blockers -**Validation / Analysis Run profile proliferation.** One existing refusal or one output profile does not create architecture authority. Compatible profile registration, cutoff/digest/census mechanics, limit handling and inspect-payload refusal tests must be consolidated in the Validation/Analysis Run owner path. Existing branches remain evidence until their unique behavior is folded; they are not individually production candidates merely because they are mergeable. +**#441 — Longitudinal Modeling.** The invalid one-sided covariance/earlier-variance ratio is retired. `longitudinal_core::recover_event_time_lagged_correlation` requires lagged covariance, both marginal variances and a positive event-time interval. Exact binary64 covariance-bound checking and scale-ordered division cover extreme finite inputs. All visible review threads are resolved; Semgrep is GREEN. The central Security Scan fails before dependency review because the exact dependency-graph compare endpoint returns HTTP 403 for this public repository even with `contents: read`; OSV and Trivy are separately GREEN. Treat this as `blocked_external` repository dependency-graph/security support, not as a TEPP vulnerability. Never weaken the fail-closed central workflow. -**#462 — bounded source-identifier repair.** Rust source uses `node_id` while the versioned serialized v1 wire key remains `id`. This is a compatibility-scoped naming repair, not a new bounded context or JSON-LD `@id` semantic change. +**#310 — wrong-owner temporal mapping.** Its scalar Driver/Oud/Voelkle p.16 `discreteDRIFTstd` mapping is event-interval composition but currently lives in `psychometric_core::event_time`. Preserve its scientific distinction from unstandardised `discreteDRIFT`, trait-plus-state association and DSEM/ctsem estimation, but move the temporal transform/refusals/tests into Longitudinal Modeling before landing. Reusable static psychometric/dependence arithmetic remains fast-mlsirm-owned. -**#437 — ADR identity repair.** The #435 branch now requires one repository-wide identity/target per indexed ADR and rejects duplicate index numbers, duplicate index targets and duplicate numbered ADR files. The normalized index preserves pre-normalization collision lineage under `docs/adr/archive/` rather than treating branch-local ADR numbers as architecture authority. Issue closure waits for protected-main integration. +**Analysis Run adapter/profile proliferation.** Export, interpretation, project-history and temporal-context HTTP/CLI mechanics are adapters inside one supporting context. Strict predecessor/child stacks may be folded only after exact ancestry is proven; diverged siblings require an actual source/test fold. One refusal/profile does not create architecture authority. Preserve unique routes, refusals, tests and review evidence before predecessor closure. -## Dependency and integration status +**#462 — bounded naming repair.** Rust source uses `node_id` while the v1 serialized key remains `id`; this is not a JSON-LD `@id` semantic change or a new bounded context. -TEPP must not copy reusable static psychometric kernels from fast-mlsirm or provider-selection logic from contextual-orchestrator. Upstream candidate/model contracts are consumed only through versioned ACLs. A checksum-pinned contextual-orchestrator dependency is not advanced until the exact replacement source archive digest is reproducibly acquired; the checksum is never removed merely to follow upstream. +**#437 — ADR identity.** The #435 branch rejects duplicate index IDs, duplicate index targets and duplicate numbered ADR files. The normalized index preserves pre-normalization collision lineage under `docs/adr/archive/`. Closure waits for protected-main integration. -`context-graph-contracts` and `enterprise-architecture-core` remain read-only to this writer while their dedicated Context Fabric writer is active. Open PR heads are not released contracts. With no released Context Graph artifact, TEPP may prepare conformance fixtures behind candidate/test boundaries but cannot bind deployable integration or authoritative EA projection to a stacked branch. +## Dependency and Context Fabric status -## Operator-gap register +TEPP never copies fast-mlsirm numerical kernels or contextual-orchestrator provider logic. An upstream open PR head is not a released dependency. A checksum-pinned contextual-orchestrator source is advanced only after the exact replacement archive digest is reproducibly acquired and reviewed. -| ID | Gap | Maturity | Authority | Closure evidence | -| --- | --- | --- | --- | --- | -| GAP-001 | PR authority fragmented across 134 open PRs | `release-blocking` | #175 / #435 | classified queue, coherent bounded-context landing vehicles, unique evidence preserved, safe reduction | -| GAP-002 | multilingual span-grounded semantic/concept admission incomplete | `partial` | Evidence & Semantic Measurement | immutable offsets/layout, language profiles, concept dictionary, unknown review, invariance/calibration, hostile-input tests | -| GAP-003 | shared-latent temporal topic estimator incomplete | `partial` | #167 | Rust CPU `f64` likelihood/estimands/uncertainty, relation/time/membership effects, multi-seed recovery, real candidate-K fits | -| GAP-004 | durable end-to-end Analysis Run incomplete | `partial` | #166 | idempotent lifecycle, persistence/recovery, estimator-bound artifacts, validation evidence, claim-promotion separation, Compose E2E | -| GAP-005 | temporal psychometric composition fragmented/partly duplicated | `partial` | Longitudinal Modeling + fast-mlsirm ACL | released upstream contract, TEPP temporal ACL, invariance/alignment, irregular time, temporal recovery, duplicated static kernels removed after parity | -| GAP-006 | TDT/CHRONOS event workflow incomplete | `partial` | Event Ontology & Temporal Graph | calibrated detection/tracking/schema/interval consistency with recovery and durable artifacts | -| GAP-007 | real accelerator/memory evidence incomplete | `accepted-target` | Compute backend | real hardware, CPU-f64 parity, bounded memory/OOM/fallback evidence | -| GAP-008 | network/cluster buyer workflow incomplete | `partial` | Projection | known-truth recovery, uncertainty/stability, repeated consensus, exact-value exports | -| GAP-009 | production interpreter/verifier incomplete | `partial` | Interpretation | contextual-orchestrator execution, evidence citations, independent verifier, ablations and abstention/fallback | -| GAP-010 | coordinated accessible buyer UI incomplete | `accepted-target` | Projection/UI | Figma/Storybook/design tokens, keyboard/touch/error/empty states, exact-value and print/export provenance | -| GAP-011 | operable multi-tenant supported release incomplete | `accepted-target` | Operations | OIDC/RLS/purpose controls, durable queue/storage, OTel/SLO, restore/load/migration, signed release/SBOM/provenance | -| GAP-012 | directory/crate paths obscure domain ownership | `active-refactor` | #435 / landing vehicles | staged folds, compatibility ACLs, no cycles/cross-context persistence/shared-kernel creep | -| GAP-013 | ADR identity duplicated/branch-local in parts of queue | `release-integrity` | #437 | unique repository-wide identity, duplicate detection, normalized index and supersession lineage | -| GAP-014 | required dependency-review evidence unavailable | `blocked_external` | repository security configuration + central workflow | exact base/head compare endpoint returns HTTP 403; enable/repair dependency graph support, rerun exact-head Security Scan, retain fail-closed behavior | +`context-graph-contracts` and `enterprise-architecture-core` remain read-only to this writer while their dedicated owner loop is active. Open heads are candidate evidence, not released contracts. TEPP may maintain fail-closed conformance fixtures behind candidate/test boundaries, but deployable integration and authoritative EA projection require a released/versioned Context Graph artifact and passing compatibility evidence. -## Delivery order +## Gap register -1. Restore queue, ADR and bounded-context authority. -2. Consolidate Evidence & Semantic Measurement. -3. Complete the Rust CPU `f64` shared-latent temporal topic estimator. -4. Complete durable end-to-end Analysis Run and evidence/promotion separation. -5. Compose temporal psychometrics through released fast-mlsirm contracts and complete Event Intelligence. -6. Add real accelerator parity only after CPU scientific authority exists. -7. Complete network/cluster, interpretation and buyer visual workflows. -8. Productionize tenancy, durability, observability, recovery, release and support. - -A bounded dependency/security repair may land earlier when it directly unblocks a selected landing vehicle. It does not create a new product priority. - -## Queue consolidation rules - -Every open PR receives one of `landing_vehicle`, `stacked_dependency`, `fold_into_landing_vehicle`, `superseded`, `duplicate`, `research_lineage_only`, or `blocked_external`. Before closing/folding work, compare exact heads and preserve unique production behavior, compatibility, tests, review findings, primary research, doctoring and provenance. Strict linear ancestry permits retarget-and-close consolidation; diverged siblings require an actual source/test fold first. - -## Release truth - -TEPP has no GitHub release at this snapshot. A release is permitted only after a coherent buyer/scientific vertical reaches protected main with current recovery and security evidence, reproducible package/build provenance, SBOM, upgrade/rollback evidence, and released integration contracts where cross-product deployment depends on them. \ No newline at end of file +| ID | Gap | Maturity | Closure evidence | +| --- | --- | --- | --- | +| GAP-001 | PR authority fragmented across 134 open PRs | `release-blocking` | coherent landing vehicles, unique evidence preservation, protected-main reduction | +| GAP-002 | multilingual span-grounded semantic/concept admission | `partial` | immutable offsets/layout, language profiles, concept dictionary, invariance/calibration, hostile-input tests | +| GAP-003 | shared-latent temporal topic estimator | `partial` | Rust CPU f64 likelihood/uncertainty, relation/time/membership effects, true recovery, fitted candidate-K | +| GAP-004 | durable end-to-end Analysis Run | `partial` | idempotent lifecycle, persistence/recovery, estimator-bound artifacts, validation/promotion separation, Compose E2E | +| GAP-005 | temporal psychometric composition/duplication | `partial` | released fast-mlsirm contract, TEPP ACL, temporal recovery, wrong-owner static kernels removed after parity | +| GAP-006 | event intelligence | `partial` | calibrated detection/tracking/schema/interval recovery and durable artifacts | +| GAP-007 | accelerator/memory evidence | `accepted-target` | real hardware, CPU-f64 parity, bounded OOM/fallback evidence | +| GAP-008 | network/cluster buyer workflow | `partial` | known-truth recovery, uncertainty/stability, repeated consensus, exact-value export | +| GAP-009 | production interpreter/verifier | `partial` | contextual-orchestrator execution, evidence citations, independent verification, abstention/fallback | +| GAP-010 | accessible buyer UI | `accepted-target` | Figma/Storybook, keyboard/touch/error/empty states, exact-value provenance | +| GAP-011 | operable multi-tenant release | `accepted-target` | OIDC/RLS/purpose controls, durable queue/storage, OTel/SLO, restore/load/migration, signed SBOM/provenance | +| GAP-012 | paths obscure domain ownership | `active-refactor` | staged moves, ACLs, no cycles/cross-context persistence/shared-kernel creep | +| GAP-013 | ADR identity collisions | `release-integrity` | unique repository-wide identity, deterministic duplicate detection, supersession lineage | +| GAP-014 | dependency-review evidence unavailable | `blocked_external` | repair/enable dependency-graph support, exact-head Security Scan GREEN, no fail-open bypass | + +## Delivery and release order + +Queue/ADR/domain authority precedes semantic admission, the Rust CPU f64 shared-latent temporal estimator, durable Analysis Run, released fast-mlsirm temporal composition, event intelligence, accelerator parity, buyer workflows and finally tenancy/durability/observability/release support. A bounded security/dependency repair may land earlier when it directly unblocks a selected vehicle. + +Every open PR is classified as `landing_vehicle`, `stacked_dependency`, `fold_into_landing_vehicle`, `superseded`, `duplicate`, `research_lineage_only`, or `blocked_external`. Exact heads must be compared before closure. Strict ancestry permits retarget-and-close folding; diverged siblings require a real code/test fold first. + +TEPP has no GitHub release at this snapshot. Release requires a coherent buyer/scientific vertical on protected main, exact-head scientific and security evidence, reproducible package/build provenance and SBOM, upgrade/rollback evidence, and released integration contracts where deployment depends on them. \ No newline at end of file From 6ab302737a78b91db7301a4f23d09d135bacca96 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 02:15:40 +0900 Subject: [PATCH 060/235] docs(gaps): record longitudinal fold and current queue --- docs/product-technical-gap-baseline.md | 19 +++++++++---------- 1 file changed, 9 insertions(+), 10 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index f46c262fd..5d97943de 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-01T16:43:00Z +**Snapshot:** 2026-09-01T17:14:00Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` **Workspace version:** `0.2.0` **Delivery authority:** issue [#175](https://github.com/ContextualWisdomLab/TEPP/issues/175), PR [#435](https://github.com/ContextualWisdomLab/TEPP/pull/435), and [`docs/delivery/pr-queue-authority-2026-09-01.md`](delivery/pr-queue-authority-2026-09-01.md) @@ -15,9 +15,9 @@ A planning document, mergeable branch, local test, predecessor-head result, queu | Signal | Current evidence | Delivery implication | | --- | ---: | --- | | Protected `main` | `1bc02f580cf48e1d39da239f0e818453437c31c3` | Capability claims remain bounded to this commit until protected main changes. | -| Open pull requests | **134** | WIP remains release-blocking, though verified consolidation reduced the observed peak of 149. | -| Draft pull requests | **133** | Non-landable work is now explicitly parked while it is consolidated, repaired or supplied with missing evidence. | -| Non-draft pull requests | **1** | #310 is the sole Ready PR and is not independently mergeable under the current DDD disposition. | +| Open pull requests | **133** | WIP remains release-blocking, though verified consolidation reduced the observed peak of 149. | +| Draft pull requests | **132** | Non-landable work is explicitly parked while it is consolidated, repaired or supplied with missing evidence. | +| Non-draft pull requests | **1** | #310 is the sole Ready landing vehicle; it still requires fresh exact-head gates and qualifying review. | | Open issues | **14** | Includes #437 for repository-wide ADR identity normalization. | | GitHub releases | **0** | No open head is a released TEPP contract. | | Effective organization ruleset | `18156473` | One qualifying approval, resolved conversations, exact-head required workflows and an allowed merge method are required. | @@ -26,17 +26,16 @@ Classic branch-protection status is not the sole policy source; organization rul ## Priority exact-head inventory -This is a priority subset, not a row-for-row copy of the 134-PR queue. #435 omits its own SHA because embedding it in the same branch would make the value stale on commit. +This is a priority subset, not a row-for-row copy of the 133-PR queue. #435 omits its own SHA because embedding it in the same branch would make the value stale on commit. | PR | Exact current head | Draft | Base | Ownership / disposition | | ---: | --- | :---: | --- | --- | | #466 | `0c5efc3c9075115d0670b8438342c72069043dcd` | true | export-retrieval ancestor | Analysis Run / naruon export idempotency GET+CLI landing vehicle. | | #464 | `1b3a477242336634be2c7867b29d39979e9a6dca` | true | temporal-context retrieval ancestor | Analysis Run / LineageWeave temporal-context stored-request GET+CLI landing vehicle. | | #462 | `c1b7d627167dd7636d2975cc41cec050a5e477ba` | true | main | Bounded source-name compatibility repair; v1 serialized key remains `id`. | -| #441 | `23959d1199f84554f4a5090cea2b9e9d70b55dd8` | true | main | Longitudinal Modeling two-marginal lagged-correlation repair; source findings resolved, dependency-review support blocked externally. | | #420 | `0dc8b48f66b367a90847fcfebd2c6453ff275a1d` | true | main | Project-history query CLI; `fold_into_landing_vehicle`. | | #417 | `1e468f62ec47f3476a7b4d18ed2980451dc425cf` | true | main | Analysis Run / naruon export retrieval GET+CLI landing vehicle. | -| #310 | `cc7fad4d0bdffe7b524636737581227663f930f4` | false | main | Sole Ready PR; temporal `discreteDRIFTstd` evidence must migrate from `psychometric_core` into Longitudinal Modeling before landing. | +| #310 | `2d44b89ed4cd63181cdc738ff6222ede002a4f3f` | false | main | Longitudinal Modeling landing vehicle; strictly contains closed predecessor #441 and adds typed event-time admission, p.16 `discreteDRIFTstd`, overflow repair and governance amendments. | ## Domain ownership @@ -75,9 +74,9 @@ Supported temporal estimators require realistic known-truth recovery: RMSE, bias ## Current repairs and blockers -**#441 — Longitudinal Modeling.** The invalid one-sided covariance/earlier-variance ratio is retired. `longitudinal_core::recover_event_time_lagged_correlation` requires lagged covariance, both marginal variances and a positive event-time interval. Exact binary64 covariance-bound checking and scale-ordered division cover extreme finite inputs. All visible review threads are resolved; Semgrep is GREEN. The central Security Scan fails before dependency review because the exact dependency-graph compare endpoint returns HTTP 403 for this public repository even with `contents: read`; OSV and Trivy are separately GREEN. Treat this as `blocked_external` repository dependency-graph/security support, not as a TEPP vulnerability. Never weaken the fail-closed central workflow. +**#310 — Longitudinal Modeling landing vehicle.** Strict ancestry proves closed predecessor #441 is contained by #310. The invalid one-sided covariance/earlier-variance ratio remains retired; public lagged correlation requires lagged covariance and both marginal variances. Public event-time operations now admit `EventTimeInterval`, preventing an arbitrary positive duration from silently crossing the event-time boundary. RED `c52c436c6b075e3982c8195b7862ea07063930b2` reproduces the finite extreme stable-rate case where `-2a` overflowed despite a representable p.16 `discreteDRIFTstd`; the repaired implementation avoids that intermediate overflow. ADR 0005 is clarified without a new numeric identity and PRD v0.4 has a longitudinal-time ownership amendment. All previously visible #310 review findings have been answered/resolved; exact-current-head hosted checks and independent review must regenerate. -**#310 — wrong-owner temporal mapping.** Its scalar Driver/Oud/Voelkle p.16 `discreteDRIFTstd` mapping is event-interval composition but currently lives in `psychometric_core::event_time`. Preserve its scientific distinction from unstandardised `discreteDRIFT`, trait-plus-state association and DSEM/ctsem estimation, but move the temporal transform/refusals/tests into Longitudinal Modeling before landing. Reusable static psychometric/dependence arithmetic remains fast-mlsirm-owned. +**Dependency-review support.** The central Security Scan has failed before dependency review because the exact dependency-graph compare endpoint returns HTTP 403 for this public repository with the workflow's read-only token; OSV, Trivy and Scorecard independently terminate GREEN. Treat this as `blocked_external` dependency-graph/security support or GitHub control-plane behavior, not as a TEPP vulnerability and not as permission to weaken the fail-closed central workflow. Retry only after the underlying support/configuration condition changes. **Analysis Run adapter/profile proliferation.** Export, interpretation, project-history and temporal-context HTTP/CLI mechanics are adapters inside one supporting context. Strict predecessor/child stacks may be folded only after exact ancestry is proven; diverged siblings require an actual source/test fold. One refusal/profile does not create architecture authority. Preserve unique routes, refusals, tests and review evidence before predecessor closure. @@ -95,7 +94,7 @@ TEPP never copies fast-mlsirm numerical kernels or contextual-orchestrator provi | ID | Gap | Maturity | Closure evidence | | --- | --- | --- | --- | -| GAP-001 | PR authority fragmented across 134 open PRs | `release-blocking` | coherent landing vehicles, unique evidence preservation, protected-main reduction | +| GAP-001 | PR authority fragmented across 133 open PRs | `release-blocking` | coherent landing vehicles, unique evidence preservation, protected-main reduction | | GAP-002 | multilingual span-grounded semantic/concept admission | `partial` | immutable offsets/layout, language profiles, concept dictionary, invariance/calibration, hostile-input tests | | GAP-003 | shared-latent temporal topic estimator | `partial` | Rust CPU f64 likelihood/uncertainty, relation/time/membership effects, true recovery, fitted candidate-K | | GAP-004 | durable end-to-end Analysis Run | `partial` | idempotent lifecycle, persistence/recovery, estimator-bound artifacts, validation/promotion separation, Compose E2E | From cb2125496474daf0f5ba58c164452a3157a948b9 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 03:16:04 +0900 Subject: [PATCH 061/235] docs(delivery): refresh queue and longitudinal repair evidence --- docs/product-technical-gap-baseline.md | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 5d97943de..f9ef65f0b 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-01T17:14:00Z +**Snapshot:** 2026-09-01T18:14:00Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` **Workspace version:** `0.2.0` **Delivery authority:** issue [#175](https://github.com/ContextualWisdomLab/TEPP/issues/175), PR [#435](https://github.com/ContextualWisdomLab/TEPP/pull/435), and [`docs/delivery/pr-queue-authority-2026-09-01.md`](delivery/pr-queue-authority-2026-09-01.md) @@ -16,8 +16,8 @@ A planning document, mergeable branch, local test, predecessor-head result, queu | --- | ---: | --- | | Protected `main` | `1bc02f580cf48e1d39da239f0e818453437c31c3` | Capability claims remain bounded to this commit until protected main changes. | | Open pull requests | **133** | WIP remains release-blocking, though verified consolidation reduced the observed peak of 149. | -| Draft pull requests | **132** | Non-landable work is explicitly parked while it is consolidated, repaired or supplied with missing evidence. | -| Non-draft pull requests | **1** | #310 is the sole Ready landing vehicle; it still requires fresh exact-head gates and qualifying review. | +| Draft pull requests | **131** | Non-landable work is explicitly parked while it is consolidated, repaired or supplied with missing evidence. | +| Non-draft pull requests | **2** | #310 is the scientific landing vehicle; #469 remains non-Draft only because the connector's Draft-conversion GraphQL mutation failed after retargeting and must be treated as review-not-ready until fresh exact-head gates/review exist. | | Open issues | **14** | Includes #437 for repository-wide ADR identity normalization. | | GitHub releases | **0** | No open head is a released TEPP contract. | | Effective organization ruleset | `18156473` | One qualifying approval, resolved conversations, exact-head required workflows and an allowed merge method are required. | @@ -30,12 +30,13 @@ This is a priority subset, not a row-for-row copy of the 133-PR queue. #435 omit | PR | Exact current head | Draft | Base | Ownership / disposition | | ---: | --- | :---: | --- | --- | +| #469 | `6a68f98971986f3ea9562fd7a73c5974e5a4af6e` | false* | interpretation-run retrieval ancestor | Analysis Run / contextual-orchestrator stored-request + server-id lookup GET/CLI landing vehicle; *metadata non-Draft after connector Draft-conversion failure, operationally review-not-ready. | | #466 | `0c5efc3c9075115d0670b8438342c72069043dcd` | true | export-retrieval ancestor | Analysis Run / naruon export idempotency GET+CLI landing vehicle. | | #464 | `1b3a477242336634be2c7867b29d39979e9a6dca` | true | temporal-context retrieval ancestor | Analysis Run / LineageWeave temporal-context stored-request GET+CLI landing vehicle. | | #462 | `c1b7d627167dd7636d2975cc41cec050a5e477ba` | true | main | Bounded source-name compatibility repair; v1 serialized key remains `id`. | | #420 | `0dc8b48f66b367a90847fcfebd2c6453ff275a1d` | true | main | Project-history query CLI; `fold_into_landing_vehicle`. | | #417 | `1e468f62ec47f3476a7b4d18ed2980451dc425cf` | true | main | Analysis Run / naruon export retrieval GET+CLI landing vehicle. | -| #310 | `2d44b89ed4cd63181cdc738ff6222ede002a4f3f` | false | main | Longitudinal Modeling landing vehicle; strictly contains closed predecessor #441 and adds typed event-time admission, p.16 `discreteDRIFTstd`, overflow repair and governance amendments. | +| #310 | `58c1ba7f085260ee8efa90e2089828cc469581ba` | false | main | Longitudinal Modeling landing vehicle; contains closed #441 lineage, typed event-time lag association, p.16 `discreteDRIFTstd`, extreme-overflow and signed-zero-underflow repairs, temporal-ordering regression and primary-source doctoring. | ## Domain ownership @@ -74,15 +75,15 @@ Supported temporal estimators require realistic known-truth recovery: RMSE, bias ## Current repairs and blockers -**#310 — Longitudinal Modeling landing vehicle.** Strict ancestry proves closed predecessor #441 is contained by #310. The invalid one-sided covariance/earlier-variance ratio remains retired; public lagged correlation requires lagged covariance and both marginal variances. Public event-time operations now admit `EventTimeInterval`, preventing an arbitrary positive duration from silently crossing the event-time boundary. RED `c52c436c6b075e3982c8195b7862ea07063930b2` reproduces the finite extreme stable-rate case where `-2a` overflowed despite a representable p.16 `discreteDRIFTstd`; the repaired implementation avoids that intermediate overflow. ADR 0005 is clarified without a new numeric identity and PRD v0.4 has a longitudinal-time ownership amendment. All previously visible #310 review findings have been answered/resolved; exact-current-head hosted checks and independent review must regenerate. +**#310 — Longitudinal Modeling landing vehicle.** Closed predecessor #441 is contained by #310. The invalid one-sided covariance/earlier-variance ratio remains retired; public lagged correlation requires lagged covariance and both marginal variances. `EventTimeInterval` is now preserved through the public wrapper into the internal association primitive instead of being erased to a bare `f64`. RED `c52c436c6b075e3982c8195b7862ea07063930b2` reproduces the finite extreme stable-rate case where `-2a` overflowed despite a representable p.16 `discreteDRIFTstd`; the implementation avoids that intermediate overflow. RED `b6d7594208f1c469382e7d540a5507280de6a196` additionally reproduces finite negative drift × positive event-interval multiplication underflow to signed zero; GREEN `1347bfb7726fd1cb3196f6cad306aa00fe41d112` fails closed instead of silently returning `exp(-0.0) == 1.0`. The known-truth test now asserts the correct temporal ordering (`longer interval < shorter interval` for stable negative drift). Research doctoring at `58c1ba7f085260ee8efa90e2089828cc469581ba` grounds the covariance bound in Bouniakowsky's 1859 primary inequality while retaining later correlation literature as supplementary context. Current Semgrep is GREEN; Rust and Documentation are queued. Security is fail-closed only at dependency-review support preflight while OSV/Trivy/Scorecard pass. Independent current-head review is still required. -**Dependency-review support.** The central Security Scan has failed before dependency review because the exact dependency-graph compare endpoint returns HTTP 403 for this public repository with the workflow's read-only token; OSV, Trivy and Scorecard independently terminate GREEN. Treat this as `blocked_external` dependency-graph/security support or GitHub control-plane behavior, not as a TEPP vulnerability and not as permission to weaken the fail-closed central workflow. Retry only after the underlying support/configuration condition changes. +**Dependency-review support.** The central Security Scan has failed before dependency review because the exact dependency-graph compare support probe is not admitted for this repository/workflow token; OSV, Trivy and Scorecard independently terminate GREEN. Treat this as `blocked_external` dependency-graph/security support or GitHub control-plane behavior, not as a TEPP vulnerability and not as permission to weaken the fail-closed central workflow. Retry only after the underlying support/configuration condition changes. -**Analysis Run adapter/profile proliferation.** Export, interpretation, project-history and temporal-context HTTP/CLI mechanics are adapters inside one supporting context. Strict predecessor/child stacks may be folded only after exact ancestry is proven; diverged siblings require an actual source/test fold. One refusal/profile does not create architecture authority. Preserve unique routes, refusals, tests and review evidence before predecessor closure. +**Analysis Run adapter/profile proliferation.** Export, interpretation, project-history and temporal-context HTTP/CLI mechanics are adapters inside one supporting context. This run collapsed strict interpretation-run ancestry repeatedly: #454 was folded into #467, #467 into #468, and #468 into surviving #469, with each predecessor proven as the merge base and each child exactly one commit ahead/zero behind before retarget-and-close. This preserves source/tests/review evidence while preventing GET/CLI/request variants from remaining independent product WIP. Diverged siblings still require an actual source/test fold. One refusal/profile does not create architecture authority. **#462 — bounded naming repair.** Rust source uses `node_id` while the v1 serialized key remains `id`; this is not a JSON-LD `@id` semantic change or a new bounded context. -**#437 — ADR identity.** The #435 branch rejects duplicate index IDs, duplicate index targets and duplicate numbered ADR files. The normalized index preserves pre-normalization collision lineage under `docs/adr/archive/`. Closure waits for protected-main integration. +**#437 — ADR identity.** The #435 branch rejects duplicate index IDs, duplicate index targets and duplicate numbered ADR files. The normalized index preserves pre-normalization collision lineage under `docs/adr/archive/`. Operation-specific ADR 0095/0096/0097 created on active adapter branches remain implementation lineage pending normalization; route/CLI proliferation must not become architecture authority. Closure waits for protected-main integration. ## Dependency and Context Fabric status From d1d5def546198b268ebac47c3e8fd73bfc90e345 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 03:32:11 +0900 Subject: [PATCH 062/235] docs: refresh queue authority after interpretation fold --- docs/product-technical-gap-baseline.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index f9ef65f0b..fe38e4aa2 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-01T18:14:00Z +**Snapshot:** 2026-09-01T18:29:00Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` **Workspace version:** `0.2.0` **Delivery authority:** issue [#175](https://github.com/ContextualWisdomLab/TEPP/issues/175), PR [#435](https://github.com/ContextualWisdomLab/TEPP/pull/435), and [`docs/delivery/pr-queue-authority-2026-09-01.md`](delivery/pr-queue-authority-2026-09-01.md) @@ -30,7 +30,7 @@ This is a priority subset, not a row-for-row copy of the 133-PR queue. #435 omit | PR | Exact current head | Draft | Base | Ownership / disposition | | ---: | --- | :---: | --- | --- | -| #469 | `6a68f98971986f3ea9562fd7a73c5974e5a4af6e` | false* | interpretation-run retrieval ancestor | Analysis Run / contextual-orchestrator stored-request + server-id lookup GET/CLI landing vehicle; *metadata non-Draft after connector Draft-conversion failure, operationally review-not-ready. | +| #469 | `5b46d78aef81902ab12b8ad691fd83be68d616cc` | false* | interpretation-run retrieval ancestor | Analysis Run / contextual-orchestrator stored-request + server-id lookup GET/CLI landing vehicle, now also containing folded #470 lookup-request CLI; *metadata non-Draft after connector Draft-conversion failure, operationally review-not-ready. | | #466 | `0c5efc3c9075115d0670b8438342c72069043dcd` | true | export-retrieval ancestor | Analysis Run / naruon export idempotency GET+CLI landing vehicle. | | #464 | `1b3a477242336634be2c7867b29d39979e9a6dca` | true | temporal-context retrieval ancestor | Analysis Run / LineageWeave temporal-context stored-request GET+CLI landing vehicle. | | #462 | `c1b7d627167dd7636d2975cc41cec050a5e477ba` | true | main | Bounded source-name compatibility repair; v1 serialized key remains `id`. | @@ -77,13 +77,13 @@ Supported temporal estimators require realistic known-truth recovery: RMSE, bias **#310 — Longitudinal Modeling landing vehicle.** Closed predecessor #441 is contained by #310. The invalid one-sided covariance/earlier-variance ratio remains retired; public lagged correlation requires lagged covariance and both marginal variances. `EventTimeInterval` is now preserved through the public wrapper into the internal association primitive instead of being erased to a bare `f64`. RED `c52c436c6b075e3982c8195b7862ea07063930b2` reproduces the finite extreme stable-rate case where `-2a` overflowed despite a representable p.16 `discreteDRIFTstd`; the implementation avoids that intermediate overflow. RED `b6d7594208f1c469382e7d540a5507280de6a196` additionally reproduces finite negative drift × positive event-interval multiplication underflow to signed zero; GREEN `1347bfb7726fd1cb3196f6cad306aa00fe41d112` fails closed instead of silently returning `exp(-0.0) == 1.0`. The known-truth test now asserts the correct temporal ordering (`longer interval < shorter interval` for stable negative drift). Research doctoring at `58c1ba7f085260ee8efa90e2089828cc469581ba` grounds the covariance bound in Bouniakowsky's 1859 primary inequality while retaining later correlation literature as supplementary context. Current Semgrep is GREEN; Rust and Documentation are queued. Security is fail-closed only at dependency-review support preflight while OSV/Trivy/Scorecard pass. Independent current-head review is still required. -**Dependency-review support.** The central Security Scan has failed before dependency review because the exact dependency-graph compare support probe is not admitted for this repository/workflow token; OSV, Trivy and Scorecard independently terminate GREEN. Treat this as `blocked_external` dependency-graph/security support or GitHub control-plane behavior, not as a TEPP vulnerability and not as permission to weaken the fail-closed central workflow. Retry only after the underlying support/configuration condition changes. +**Dependency-review support.** The central Security Scan fails closed before Dependency Review because GitHub's exact dependency-graph comparison is unavailable to the workflow token. Central governance issue `ContextualWisdomLab/.github#810` confirms the current public non-fork incident: repeated canaries return HTTP 403 with curl exit 0, while the central workflow correctly requires transport success plus HTTP 200 before the pinned Dependency Review action may execute. OSV, Trivy and Scorecard remain independent sibling evidence and are not substitutes. There is no TEPP-local source change that can convert this missing GitHub control-plane evidence into an authoritative dependency review; do not weaken the gate. -**Analysis Run adapter/profile proliferation.** Export, interpretation, project-history and temporal-context HTTP/CLI mechanics are adapters inside one supporting context. This run collapsed strict interpretation-run ancestry repeatedly: #454 was folded into #467, #467 into #468, and #468 into surviving #469, with each predecessor proven as the merge base and each child exactly one commit ahead/zero behind before retarget-and-close. This preserves source/tests/review evidence while preventing GET/CLI/request variants from remaining independent product WIP. Diverged siblings still require an actual source/test fold. One refusal/profile does not create architecture authority. +**Analysis Run adapter/profile proliferation.** Export, interpretation, project-history and temporal-context HTTP/CLI mechanics are adapters inside one supporting context. Strict interpretation-run ancestry has been collapsed repeatedly: #454→#467→#468→#469, followed by #470→#469 after proving #470 was based exactly on #469's prior head and fast-forwarding the surviving branch without force. #469 now preserves stored-request GET/CLI, server-assigned run-id lookup GET/CLI, server-id stored-request GET, and the corresponding lookup-request CLI on one Analysis Run vehicle. Predecessor discussions remain immutable evidence. Diverged siblings still require an actual source/test fold. One refusal/profile does not create architecture authority. **#462 — bounded naming repair.** Rust source uses `node_id` while the v1 serialized key remains `id`; this is not a JSON-LD `@id` semantic change or a new bounded context. -**#437 — ADR identity.** The #435 branch rejects duplicate index IDs, duplicate index targets and duplicate numbered ADR files. The normalized index preserves pre-normalization collision lineage under `docs/adr/archive/`. Operation-specific ADR 0095/0096/0097 created on active adapter branches remain implementation lineage pending normalization; route/CLI proliferation must not become architecture authority. Closure waits for protected-main integration. +**#437 — ADR identity.** The #435 branch rejects duplicate index IDs, duplicate index targets and duplicate numbered ADR files. The normalized index preserves pre-normalization collision lineage under `docs/adr/archive/`. Operation-specific ADR 0095/0096/0097/0098 created on active adapter branches remain implementation lineage pending normalization; route/CLI proliferation must not become architecture authority. Closure waits for protected-main integration. ## Dependency and Context Fabric status @@ -108,7 +108,7 @@ TEPP never copies fast-mlsirm numerical kernels or contextual-orchestrator provi | GAP-011 | operable multi-tenant release | `accepted-target` | OIDC/RLS/purpose controls, durable queue/storage, OTel/SLO, restore/load/migration, signed SBOM/provenance | | GAP-012 | paths obscure domain ownership | `active-refactor` | staged moves, ACLs, no cycles/cross-context persistence/shared-kernel creep | | GAP-013 | ADR identity collisions | `release-integrity` | unique repository-wide identity, deterministic duplicate detection, supersession lineage | -| GAP-014 | dependency-review evidence unavailable | `blocked_external` | repair/enable dependency-graph support, exact-head Security Scan GREEN, no fail-open bypass | +| GAP-014 | dependency-review evidence unavailable | `blocked_external` | authorized GitHub/dependency-graph availability repair, unchanged-head compare HTTP 200, pinned Dependency Review execution, exact-head Security Scan GREEN, no fail-open bypass | ## Delivery and release order @@ -116,4 +116,4 @@ Queue/ADR/domain authority precedes semantic admission, the Rust CPU f64 shared- Every open PR is classified as `landing_vehicle`, `stacked_dependency`, `fold_into_landing_vehicle`, `superseded`, `duplicate`, `research_lineage_only`, or `blocked_external`. Exact heads must be compared before closure. Strict ancestry permits retarget-and-close folding; diverged siblings require a real code/test fold first. -TEPP has no GitHub release at this snapshot. Release requires a coherent buyer/scientific vertical on protected main, exact-head scientific and security evidence, reproducible package/build provenance and SBOM, upgrade/rollback evidence, and released integration contracts where deployment depends on them. \ No newline at end of file +TEPP has no GitHub release at this snapshot. Release requires a coherent buyer/scientific vertical on protected main, exact-head scientific and security evidence, reproducible package/build provenance and SBOM, upgrade/rollback evidence, and released integration contracts where deployment depends on them. From bf64e8605f74ec3a19ec0077c7cf0c23be40e895 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 05:03:31 +0900 Subject: [PATCH 063/235] docs(delivery): refresh live queue and classify diffusion micro-PRs --- docs/product-technical-gap-baseline.md | 22 ++++++++++++++-------- 1 file changed, 14 insertions(+), 8 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index fe38e4aa2..19edc5aae 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-01T18:29:00Z +**Snapshot:** 2026-09-01T20:00:32Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` **Workspace version:** `0.2.0` **Delivery authority:** issue [#175](https://github.com/ContextualWisdomLab/TEPP/issues/175), PR [#435](https://github.com/ContextualWisdomLab/TEPP/pull/435), and [`docs/delivery/pr-queue-authority-2026-09-01.md`](delivery/pr-queue-authority-2026-09-01.md) @@ -15,22 +15,26 @@ A planning document, mergeable branch, local test, predecessor-head result, queu | Signal | Current evidence | Delivery implication | | --- | ---: | --- | | Protected `main` | `1bc02f580cf48e1d39da239f0e818453437c31c3` | Capability claims remain bounded to this commit until protected main changes. | -| Open pull requests | **133** | WIP remains release-blocking, though verified consolidation reduced the observed peak of 149. | -| Draft pull requests | **131** | Non-landable work is explicitly parked while it is consolidated, repaired or supplied with missing evidence. | -| Non-draft pull requests | **2** | #310 is the scientific landing vehicle; #469 remains non-Draft only because the connector's Draft-conversion GraphQL mutation failed after retargeting and must be treated as review-not-ready until fresh exact-head gates/review exist. | -| Open issues | **14** | Includes #437 for repository-wide ADR identity normalization. | +| Open pull requests | **136** | WIP remains release-blocking. The queue is below the observed peak of 149 but has regressed upward from the previous 133-PR snapshot. | +| Draft pull requests | **135** | Non-landable work is explicitly parked while it is consolidated, repaired or supplied with missing evidence. | +| Non-draft pull requests | **1** | #310 is the only current non-Draft landing vehicle. | +| Open issues | **15** | Includes #437 for repository-wide ADR identity normalization and #472 for cutoff-safe inferred-status Analysis Run projection. | | GitHub releases | **0** | No open head is a released TEPP contract. | | Effective organization ruleset | `18156473` | One qualifying approval, resolved conversations, exact-head required workflows and an allowed merge method are required. | Classic branch-protection status is not the sole policy source; organization rulesets are the effective merge authority where applicable. Any increase in open PR count while #435 remains open is a WIP regression unless the new PR is a demonstrably independent root-cause repair that cannot safely belong to an existing landing vehicle. +The 133 -> 136 regression is concrete: new scalar Driver-map PRs #476 (`DIFFUSIONstd`) and #477 (`discreteDIFFUSIONstd`) were opened directly against `main` in `psychometric_core` while the Longitudinal Modeling vehicle #310 already owns event-time/state composition. Their paper excerpts, refusal contracts, known-truth examples and test ideas are unique evidence and must be preserved, but the model-one-wrapper / wrong-owner source layout is not a new bounded context. They are `fold_into_landing_vehicle` candidates until their current source/tests are actually composed into the owning Longitudinal Modeling structure (or moved to a proven canonical upstream owner where the computation is genuinely reusable/static). Do not close a diverged sibling merely by relabeling it; source/test parity must exist first. + ## Priority exact-head inventory -This is a priority subset, not a row-for-row copy of the 133-PR queue. #435 omits its own SHA because embedding it in the same branch would make the value stale on commit. +This is a priority subset, not a row-for-row copy of the 136-PR queue. #435 omits its own SHA because embedding it in the same branch would make the value stale on commit. | PR | Exact current head | Draft | Base | Ownership / disposition | | ---: | --- | :---: | --- | --- | -| #469 | `5b46d78aef81902ab12b8ad691fd83be68d616cc` | false* | interpretation-run retrieval ancestor | Analysis Run / contextual-orchestrator stored-request + server-id lookup GET/CLI landing vehicle, now also containing folded #470 lookup-request CLI; *metadata non-Draft after connector Draft-conversion failure, operationally review-not-ready. | +| #477 | `89c48083fe0ff8accc48f6a19c782f0adb628a2d` | true | main | `fold_into_landing_vehicle`: scalar `discreteDIFFUSIONstd` evidence currently implemented in wrong-owner `psychometric_core`; preserve paper/test/refusal evidence, then compose under Longitudinal Modeling or proven canonical owner before closure. | +| #476 | `1f1bb155194999db2168910281ff3ad1b359a378` | true | main | `fold_into_landing_vehicle`: scalar `DIFFUSIONstd` evidence currently implemented in wrong-owner `psychometric_core`; preserve paper/test/refusal evidence, then compose under Longitudinal Modeling or proven canonical owner before closure. | +| #469 | `5b46d78aef81902ab12b8ad691fd83be68d616cc` | true-equivalent | interpretation-run retrieval ancestor | Analysis Run / contextual-orchestrator stored-request + server-id lookup GET/CLI landing vehicle; connector Draft-conversion previously failed, but current live queue now reports only #310 non-Draft, so re-read #469 metadata before acting. | | #466 | `0c5efc3c9075115d0670b8438342c72069043dcd` | true | export-retrieval ancestor | Analysis Run / naruon export idempotency GET+CLI landing vehicle. | | #464 | `1b3a477242336634be2c7867b29d39979e9a6dca` | true | temporal-context retrieval ancestor | Analysis Run / LineageWeave temporal-context stored-request GET+CLI landing vehicle. | | #462 | `c1b7d627167dd7636d2975cc41cec050a5e477ba` | true | main | Bounded source-name compatibility repair; v1 serialized key remains `id`. | @@ -77,6 +81,8 @@ Supported temporal estimators require realistic known-truth recovery: RMSE, bias **#310 — Longitudinal Modeling landing vehicle.** Closed predecessor #441 is contained by #310. The invalid one-sided covariance/earlier-variance ratio remains retired; public lagged correlation requires lagged covariance and both marginal variances. `EventTimeInterval` is now preserved through the public wrapper into the internal association primitive instead of being erased to a bare `f64`. RED `c52c436c6b075e3982c8195b7862ea07063930b2` reproduces the finite extreme stable-rate case where `-2a` overflowed despite a representable p.16 `discreteDRIFTstd`; the implementation avoids that intermediate overflow. RED `b6d7594208f1c469382e7d540a5507280de6a196` additionally reproduces finite negative drift × positive event-interval multiplication underflow to signed zero; GREEN `1347bfb7726fd1cb3196f6cad306aa00fe41d112` fails closed instead of silently returning `exp(-0.0) == 1.0`. The known-truth test now asserts the correct temporal ordering (`longer interval < shorter interval` for stable negative drift). Research doctoring at `58c1ba7f085260ee8efa90e2089828cc469581ba` grounds the covariance bound in Bouniakowsky's 1859 primary inequality while retaining later correlation literature as supplementary context. Current Semgrep is GREEN; Rust and Documentation are queued. Security is fail-closed only at dependency-review support preflight while OSV/Trivy/Scorecard pass. Independent current-head review is still required. +**#476/#477 — scalar Driver-map WIP regression.** Both are one-map siblings directly against `main`, both write temporal/continuous-state transformations into `psychometric_core`, and both explicitly acknowledge that the exact named `*std` map is not printed by Driver et al. Their unique evidence may be scientifically useful, but production placement and capability naming must be decided in the Longitudinal Modeling/canonical-owner contract before landing. They must not independently grow `psychometric_core` or mint new bounded-context authority. Compose source/tests into the selected owner first; only then retire the siblings as folded/superseded. + **Dependency-review support.** The central Security Scan fails closed before Dependency Review because GitHub's exact dependency-graph comparison is unavailable to the workflow token. Central governance issue `ContextualWisdomLab/.github#810` confirms the current public non-fork incident: repeated canaries return HTTP 403 with curl exit 0, while the central workflow correctly requires transport success plus HTTP 200 before the pinned Dependency Review action may execute. OSV, Trivy and Scorecard remain independent sibling evidence and are not substitutes. There is no TEPP-local source change that can convert this missing GitHub control-plane evidence into an authoritative dependency review; do not weaken the gate. **Analysis Run adapter/profile proliferation.** Export, interpretation, project-history and temporal-context HTTP/CLI mechanics are adapters inside one supporting context. Strict interpretation-run ancestry has been collapsed repeatedly: #454→#467→#468→#469, followed by #470→#469 after proving #470 was based exactly on #469's prior head and fast-forwarding the surviving branch without force. #469 now preserves stored-request GET/CLI, server-assigned run-id lookup GET/CLI, server-id stored-request GET, and the corresponding lookup-request CLI on one Analysis Run vehicle. Predecessor discussions remain immutable evidence. Diverged siblings still require an actual source/test fold. One refusal/profile does not create architecture authority. @@ -95,7 +101,7 @@ TEPP never copies fast-mlsirm numerical kernels or contextual-orchestrator provi | ID | Gap | Maturity | Closure evidence | | --- | --- | --- | --- | -| GAP-001 | PR authority fragmented across 133 open PRs | `release-blocking` | coherent landing vehicles, unique evidence preservation, protected-main reduction | +| GAP-001 | PR authority fragmented across 136 open PRs | `release-blocking` | coherent landing vehicles, unique evidence preservation, protected-main reduction | | GAP-002 | multilingual span-grounded semantic/concept admission | `partial` | immutable offsets/layout, language profiles, concept dictionary, invariance/calibration, hostile-input tests | | GAP-003 | shared-latent temporal topic estimator | `partial` | Rust CPU f64 likelihood/uncertainty, relation/time/membership effects, true recovery, fitted candidate-K | | GAP-004 | durable end-to-end Analysis Run | `partial` | idempotent lifecycle, persistence/recovery, estimator-bound artifacts, validation/promotion separation, Compose E2E | From da9792d064b77fad34501e2269239a042b3895c9 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 05:33:53 +0900 Subject: [PATCH 064/235] docs(delivery): record verified diffusion fold --- docs/product-technical-gap-baseline.md | 74 ++++++++++++-------------- 1 file changed, 35 insertions(+), 39 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 19edc5aae..4be27e162 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-01T20:00:32Z +**Snapshot:** 2026-09-01T20:30:01Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` **Workspace version:** `0.2.0` **Delivery authority:** issue [#175](https://github.com/ContextualWisdomLab/TEPP/issues/175), PR [#435](https://github.com/ContextualWisdomLab/TEPP/pull/435), and [`docs/delivery/pr-queue-authority-2026-09-01.md`](delivery/pr-queue-authority-2026-09-01.md) @@ -10,41 +10,41 @@ ## Delivery truth -A planning document, mergeable branch, local test, predecessor-head result, queued/skipped check, ADR number, or LLM judgment does not make a capability shipped. Passing or queued Checks on an open PR never promote that PR to `implemented-main`. +A planning document, mergeable branch, local test, predecessor-head result, queued/skipped check, ADR number, or LLM judgment does not make a capability shipped. Passing or queued Checks never promote an open PR to `implemented-main`. | Signal | Current evidence | Delivery implication | | --- | ---: | --- | | Protected `main` | `1bc02f580cf48e1d39da239f0e818453437c31c3` | Capability claims remain bounded to this commit until protected main changes. | -| Open pull requests | **136** | WIP remains release-blocking. The queue is below the observed peak of 149 but has regressed upward from the previous 133-PR snapshot. | -| Draft pull requests | **135** | Non-landable work is explicitly parked while it is consolidated, repaired or supplied with missing evidence. | +| Open pull requests | **134** | WIP remains release-blocking, but the queue has been reduced from the observed peak of 149 and from the 136-PR regression at the start of this repair slice. | +| Draft pull requests | **133** | Non-landable work is explicitly parked while consolidated, repaired, or supplied with missing evidence. | | Non-draft pull requests | **1** | #310 is the only current non-Draft landing vehicle. | | Open issues | **15** | Includes #437 for repository-wide ADR identity normalization and #472 for cutoff-safe inferred-status Analysis Run projection. | | GitHub releases | **0** | No open head is a released TEPP contract. | -| Effective organization ruleset | `18156473` | One qualifying approval, resolved conversations, exact-head required workflows and an allowed merge method are required. | +| Effective organization ruleset | `18156473` | Current-head required workflows, resolved conversations, qualifying review, and an allowed merge method remain landing authority. | -Classic branch-protection status is not the sole policy source; organization rulesets are the effective merge authority where applicable. Any increase in open PR count while #435 remains open is a WIP regression unless the new PR is a demonstrably independent root-cause repair that cannot safely belong to an existing landing vehicle. +Classic branch protection is not the sole policy source; organization rulesets are effective merge authority where applicable. Any increase in open PR count while #435 remains open is a WIP regression unless the new PR is a demonstrably independent root-cause repair that cannot safely belong to an existing landing vehicle. -The 133 -> 136 regression is concrete: new scalar Driver-map PRs #476 (`DIFFUSIONstd`) and #477 (`discreteDIFFUSIONstd`) were opened directly against `main` in `psychometric_core` while the Longitudinal Modeling vehicle #310 already owns event-time/state composition. Their paper excerpts, refusal contracts, known-truth examples and test ideas are unique evidence and must be preserved, but the model-one-wrapper / wrong-owner source layout is not a new bounded context. They are `fold_into_landing_vehicle` candidates until their current source/tests are actually composed into the owning Longitudinal Modeling structure (or moved to a proven canonical upstream owner where the computation is genuinely reusable/static). Do not close a diverged sibling merely by relabeling it; source/test parity must exist first. +The most recent regression reached 136 open PRs when #476 (`DIFFUSIONstd`) and #477 (`discreteDIFFUSIONstd`) were opened as one-map Drafts under the wrong technical owner `psychometric_core`. Their scientific evidence was not discarded. Exact source and tests were verified as folded into #310 under the Longitudinal Modeling bounded context, including typed event time, positive stationarity, scale invariance, subnormal/overflow regressions, interval ordering, refusal contracts, and explicit `research_candidate` status. #476 and #477 were then closed as superseded lineage. The live queue consequently fell to 134. -## Priority exact-head inventory +## Current priority open pull-request evidence -This is a priority subset, not a row-for-row copy of the 136-PR queue. #435 omits its own SHA because embedding it in the same branch would make the value stale on commit. +This is a priority subset, not a row-for-row copy of the 134-PR queue. #435 intentionally omits its own SHA because embedding the branch head in a file changed by that same branch would make the evidence self-stale. | PR | Exact current head | Draft | Base | Ownership / disposition | | ---: | --- | :---: | --- | --- | -| #477 | `89c48083fe0ff8accc48f6a19c782f0adb628a2d` | true | main | `fold_into_landing_vehicle`: scalar `discreteDIFFUSIONstd` evidence currently implemented in wrong-owner `psychometric_core`; preserve paper/test/refusal evidence, then compose under Longitudinal Modeling or proven canonical owner before closure. | -| #476 | `1f1bb155194999db2168910281ff3ad1b359a378` | true | main | `fold_into_landing_vehicle`: scalar `DIFFUSIONstd` evidence currently implemented in wrong-owner `psychometric_core`; preserve paper/test/refusal evidence, then compose under Longitudinal Modeling or proven canonical owner before closure. | -| #469 | `5b46d78aef81902ab12b8ad691fd83be68d616cc` | true-equivalent | interpretation-run retrieval ancestor | Analysis Run / contextual-orchestrator stored-request + server-id lookup GET/CLI landing vehicle; connector Draft-conversion previously failed, but current live queue now reports only #310 non-Draft, so re-read #469 metadata before acting. | -| #466 | `0c5efc3c9075115d0670b8438342c72069043dcd` | true | export-retrieval ancestor | Analysis Run / naruon export idempotency GET+CLI landing vehicle. | -| #464 | `1b3a477242336634be2c7867b29d39979e9a6dca` | true | temporal-context retrieval ancestor | Analysis Run / LineageWeave temporal-context stored-request GET+CLI landing vehicle. | +| #469 | `72a7755bcc91b1107560c980ce817eca153126e4` | true | interpretation-run retrieval ancestry | Analysis Run / contextual-orchestrator stored-request + server-id lookup GET/CLI landing vehicle. | +| #466 | `71f34b890bbd096eee152947c5e22d9778d323e8` | true | export-retrieval ancestry | Analysis Run / naruon export idempotency lookup + quarantine-parity landing vehicle. | +| #464 | `1b3a477242336634be2c7867b29d39979e9a6dca` | true | temporal-context retrieval ancestry | Analysis Run / LineageWeave temporal-context stored-request GET+CLI landing vehicle; re-read before mutation. | | #462 | `c1b7d627167dd7636d2975cc41cec050a5e477ba` | true | main | Bounded source-name compatibility repair; v1 serialized key remains `id`. | -| #420 | `0dc8b48f66b367a90847fcfebd2c6453ff275a1d` | true | main | Project-history query CLI; `fold_into_landing_vehicle`. | -| #417 | `1e468f62ec47f3476a7b4d18ed2980451dc425cf` | true | main | Analysis Run / naruon export retrieval GET+CLI landing vehicle. | -| #310 | `58c1ba7f085260ee8efa90e2089828cc469581ba` | false | main | Longitudinal Modeling landing vehicle; contains closed #441 lineage, typed event-time lag association, p.16 `discreteDRIFTstd`, extreme-overflow and signed-zero-underflow repairs, temporal-ordering regression and primary-source doctoring. | +| #420 | `0dc8b48f66b367a90847fcfebd2c6453ff275a1d` | true | main | Project-history query CLI; `fold_into_landing_vehicle` until its unique source/tests are composed into the surviving Analysis Run vehicle. | +| #417 | `1e468f62ec47f3476a7b4d18ed2980451dc425cf` | true | main | Analysis Run / naruon export retrieval GET+CLI landing vehicle; re-read before mutation. | +| #310 | `4e7435f6dd232ae8e1e019f1393e7285e32c6527` | false | main | Longitudinal Modeling landing vehicle; contains closed #441 lineage and verified #476/#477 diffusion folds. | + +Exact current head evidence is authoritative only for the named PR and becomes stale after any source mutation. ## Domain ownership -Cargo crates, HTTP routes, CLI verbs, refusal rules and clocks are implementation units, not bounded contexts. +Cargo crates, HTTP routes, CLI verbs, refusal rules, clocks, and individual statistical maps are implementation units, not bounded contexts. | Subdomain | Bounded context | Aggregate authority | Implementation nucleus | | --- | --- | --- | --- | @@ -59,49 +59,45 @@ Cargo crates, HTTP routes, CLI verbs, refusal rules and clocks are implementatio | Supporting | Persistence & Recovery | repositories and durable receipts | `persistence_postgres`, object-store adapters | | Generic | Compute backend | execution receipt | CPU/GPU/MLX adapters; execution is not scientific authority | -**Canonical owners:** fast-mlsirm owns reusable static/generalized-mixed/dependence-aware psychometric specification and LSIRM/MLSIRM/DLSJM kernels. TEPP owns temporal/event composition, irregular time, time-varying multilevel/cross-classified/multiple-membership semantics, longitudinal invariance/drift/alignment and temporal recovery. contextual-orchestrator owns every LLM/provider call and routing decision. Context Graph contracts are a contract-only Shared Kernel; EA Core owns authoritative architecture decisions. No cross-service SQL. - -### Clock and relation invariants +**Canonical owners:** fast-mlsirm owns reusable static/generalized-mixed/dependence-aware psychometric specification and LSIRM/MLSIRM/DLSJM kernels. TEPP owns temporal/event composition, irregular time, time-varying multilevel/cross-classified/multiple-membership semantics, longitudinal invariance/drift/alignment, and temporal recovery. contextual-orchestrator owns every LLM/provider call and routing decision. Context Graph contracts are a contract-only Shared Kernel; EA Core owns authoritative architecture decisions. No cross-service SQL. -`event_time`, `assertion_time`, `document_time`, `system_time`, `available_time` and `knowledge_cutoff` remain distinct in code, schemas and tests. A retrospective source may describe an earlier event but cannot enter an earlier knowledge cutoff. Forward state/transition edges remain distinct from retrospective, citation, revision and provenance relations. +`event_time`, `assertion_time`, `document_time`, `system_time`, `available_time`, and `knowledge_cutoff` remain distinct in code, schemas, and tests. A retrospective source may describe an earlier event but cannot enter an earlier knowledge cutoff. Forward state/transition edges remain distinct from retrospective, citation, revision, and provenance relations. ## Temporal/dependence model policy -TEPP composes time over the full released upstream candidate identity, not hard-coded model names. Every candidate records exact response/generalized-mixed/dependence formulation, `supported | research_candidate | unsupported`, state/generative equations, clock roles, identification/alignment, time-varying covariates/random effects/memberships, estimator owner, required data support, primary citations and recovery status. +TEPP composes time over the full released upstream candidate identity, not hard-coded family names. Every candidate records exact response/generalized-mixed/dependence formulation, `supported | research_candidate | unsupported`, state/generative equations, clock roles, identification/alignment, time-varying covariates/random effects/memberships, estimator owner, required data support, primary citations, and recovery status. -Rasch remains distinct from generic 1PL. Formulation-qualified 2PLM–5PLM, confirmatory/exploratory MIRT and ideal-point/GGUM identities are preserved. Cross-classification and multiple membership remain distinct; membership weights are explicit, time-valid and observed-normalized or model-estimated according to the formulation. LSIRM/MLSIRM temporal candidates preserve base parameters plus person/item geometry. DLSJM keeps distinct item- and person-dependence spaces. Dynamic geometry stays `research_candidate` until state equations, temporal identification/alignment and true-parameter recovery exist. +Rasch remains distinct from generic 1PL. Formulation-qualified 2PLM–5PLM, confirmatory/exploratory MIRT, and ideal-point/GGUM identities are preserved. Cross-classification and multiple membership remain distinct; membership weights are explicit, time-valid, and observed-normalized or model-estimated according to the formulation. LSIRM/MLSIRM temporal candidates preserve base parameters plus person/item geometry. DLSJM keeps distinct item- and person-dependence spaces. Dynamic geometry stays `research_candidate` until state equations, temporal identification/alignment, and true-parameter recovery exist. -Auto-expansion is not auto-activation. A numerical standardizer or adapter is not a DSEM/ctsem/LSIRM/MLSIRM/DLSJM estimator without the exact generative/state equations, identification, estimator and recovery evidence. +Auto-expansion is not auto-activation. A numerical standardizer or adapter is not a DSEM/ctsem/LSIRM/MLSIRM/DLSJM estimator without exact generative/state equations, identification, estimator, and recovery evidence. ## Scientific validation invariants -Supported temporal estimators require realistic known-truth recovery: RMSE, bias, interval coverage, convergence and uncertainty calibration, temporal ordering, leakage-safe rolling-origin evaluation, irregular gaps, delayed/retrospective reports, missing occasions, changing memberships, language/source drift and CPU/GPU parity where applicable. Monte Carlo decisions use simulation uncertainty rather than arbitrary observed-pass percentages. Scientific failure is never hidden with skip, xfail, source rewriting or coverage exclusions. +Supported temporal estimators require realistic known-truth recovery: RMSE, bias, interval coverage, convergence and uncertainty calibration, temporal ordering, leakage-safe rolling-origin evaluation, irregular gaps, delayed/retrospective reports, missing occasions, changing memberships, language/source drift, and CPU/GPU parity where applicable. Monte Carlo decisions use simulation uncertainty rather than arbitrary pass percentages. Scientific failure is never hidden with skip, xfail, source rewriting, or coverage exclusions. ## Current repairs and blockers -**#310 — Longitudinal Modeling landing vehicle.** Closed predecessor #441 is contained by #310. The invalid one-sided covariance/earlier-variance ratio remains retired; public lagged correlation requires lagged covariance and both marginal variances. `EventTimeInterval` is now preserved through the public wrapper into the internal association primitive instead of being erased to a bare `f64`. RED `c52c436c6b075e3982c8195b7862ea07063930b2` reproduces the finite extreme stable-rate case where `-2a` overflowed despite a representable p.16 `discreteDRIFTstd`; the implementation avoids that intermediate overflow. RED `b6d7594208f1c469382e7d540a5507280de6a196` additionally reproduces finite negative drift × positive event-interval multiplication underflow to signed zero; GREEN `1347bfb7726fd1cb3196f6cad306aa00fe41d112` fails closed instead of silently returning `exp(-0.0) == 1.0`. The known-truth test now asserts the correct temporal ordering (`longer interval < shorter interval` for stable negative drift). Research doctoring at `58c1ba7f085260ee8efa90e2089828cc469581ba` grounds the covariance bound in Bouniakowsky's 1859 primary inequality while retaining later correlation literature as supplementary context. Current Semgrep is GREEN; Rust and Documentation are queued. Security is fail-closed only at dependency-review support preflight while OSV/Trivy/Scorecard pass. Independent current-head review is still required. - -**#476/#477 — scalar Driver-map WIP regression.** Both are one-map siblings directly against `main`, both write temporal/continuous-state transformations into `psychometric_core`, and both explicitly acknowledge that the exact named `*std` map is not printed by Driver et al. Their unique evidence may be scientifically useful, but production placement and capability naming must be decided in the Longitudinal Modeling/canonical-owner contract before landing. They must not independently grow `psychometric_core` or mint new bounded-context authority. Compose source/tests into the selected owner first; only then retire the siblings as folded/superseded. +**#310 — Longitudinal Modeling landing vehicle.** Closed predecessor #441 is contained by #310. The invalid one-sided covariance/earlier-variance ratio remains retired; public lagged correlation requires lagged covariance and both marginal variances. `EventTimeInterval` is preserved end-to-end. The surviving branch also contains the source/test evidence from #476/#477 under `longitudinal_core`: continuous and discrete scalar diffusion-standardisation candidates, positive stationary-within admission, subnormal-cancellation repair, scale-invariance tests, signed-zero event-product refusal, interval ordering, and named-estimand refusals. Those maps remain `research_candidate` because the 2017 ctsem summary source does not emit named `DIFFUSIONstd` / `discreteDIFFUSIONstd` matrices. On exact head `4e7435f6dd232ae8e1e019f1393e7285e32c6527`, all review threads returned by the current review-thread query are resolved. Rust Foundation CI, Documentation Quality, SAST Semgrep, and Security Scan are currently queued, and no qualifying independent APPROVE is present; therefore #310 is not mergeable by policy yet. -**Dependency-review support.** The central Security Scan fails closed before Dependency Review because GitHub's exact dependency-graph comparison is unavailable to the workflow token. Central governance issue `ContextualWisdomLab/.github#810` confirms the current public non-fork incident: repeated canaries return HTTP 403 with curl exit 0, while the central workflow correctly requires transport success plus HTTP 200 before the pinned Dependency Review action may execute. OSV, Trivy and Scorecard remain independent sibling evidence and are not substitutes. There is no TEPP-local source change that can convert this missing GitHub control-plane evidence into an authoritative dependency review; do not weaken the gate. +**#476/#477 — superseded scientific micro-PRs.** Both Drafts are closed after source-level parity verification against #310. Their immutable discussions and branches remain research lineage; they must not be merged independently. This is the required queue repair pattern: fold unique evidence into the bounded-context owner first, verify parity, then retire the micro-PR. -**Analysis Run adapter/profile proliferation.** Export, interpretation, project-history and temporal-context HTTP/CLI mechanics are adapters inside one supporting context. Strict interpretation-run ancestry has been collapsed repeatedly: #454→#467→#468→#469, followed by #470→#469 after proving #470 was based exactly on #469's prior head and fast-forwarding the surviving branch without force. #469 now preserves stored-request GET/CLI, server-assigned run-id lookup GET/CLI, server-id stored-request GET, and the corresponding lookup-request CLI on one Analysis Run vehicle. Predecessor discussions remain immutable evidence. Diverged siblings still require an actual source/test fold. One refusal/profile does not create architecture authority. +**Dependency-review support.** Where Security Scan fails before Dependency Review because GitHub dependency-graph comparison is unavailable to the workflow token, keep the gate fail-closed. OSV, Trivy, and Scorecard are sibling evidence, not substitutes. Do not weaken TEPP source to manufacture missing control-plane evidence. -**#462 — bounded naming repair.** Rust source uses `node_id` while the v1 serialized key remains `id`; this is not a JSON-LD `@id` semantic change or a new bounded context. +**Analysis Run adapter/profile proliferation.** Export, interpretation, project-history, and temporal-context HTTP/CLI mechanics are adapters inside one supporting context. Strict ancestry may be folded without force after exact comparison; diverged siblings require an actual source/test fold. One refusal/profile/route/CLI verb does not create architecture authority. -**#437 — ADR identity.** The #435 branch rejects duplicate index IDs, duplicate index targets and duplicate numbered ADR files. The normalized index preserves pre-normalization collision lineage under `docs/adr/archive/`. Operation-specific ADR 0095/0096/0097/0098 created on active adapter branches remain implementation lineage pending normalization; route/CLI proliferation must not become architecture authority. Closure waits for protected-main integration. +**#437 — ADR identity.** Repository-wide ADR IDs are immutable authority. Duplicate index IDs, duplicate targets, and duplicate numbered ADR files must fail deterministic documentation fitness tests. Operation-specific ADRs on adapter/model micro-branches are implementation lineage pending normalization, not branch-local architecture authority. ## Dependency and Context Fabric status -TEPP never copies fast-mlsirm numerical kernels or contextual-orchestrator provider logic. An upstream open PR head is not a released dependency. A checksum-pinned contextual-orchestrator source is advanced only after the exact replacement archive digest is reproducibly acquired and reviewed. +TEPP never copies fast-mlsirm numerical kernels or contextual-orchestrator provider logic. An upstream open PR head is not a released dependency. A checksum-pinned contextual-orchestrator source advances only after the exact replacement archive digest is reproducibly acquired and reviewed. -`context-graph-contracts` and `enterprise-architecture-core` remain read-only to this writer while their dedicated owner loop is active. Open heads are candidate evidence, not released contracts. TEPP may maintain fail-closed conformance fixtures behind candidate/test boundaries, but deployable integration and authoritative EA projection require a released/versioned Context Graph artifact and passing compatibility evidence. +`context-graph-contracts` and `enterprise-architecture-core` remain read-only to this writer while their dedicated Context Fabric owner loop is active. Open heads are candidate evidence, not released contracts. TEPP may maintain fail-closed conformance fixtures behind candidate/test boundaries, but deployable integration and authoritative EA projection require a released/versioned Context Graph artifact plus passing compatibility evidence. ## Gap register | ID | Gap | Maturity | Closure evidence | | --- | --- | --- | --- | -| GAP-001 | PR authority fragmented across 136 open PRs | `release-blocking` | coherent landing vehicles, unique evidence preservation, protected-main reduction | +| GAP-001 | PR authority fragmented across 134 open PRs | `release-blocking` | coherent landing vehicles, unique evidence preservation, protected-main reduction | | GAP-002 | multilingual span-grounded semantic/concept admission | `partial` | immutable offsets/layout, language profiles, concept dictionary, invariance/calibration, hostile-input tests | | GAP-003 | shared-latent temporal topic estimator | `partial` | Rust CPU f64 likelihood/uncertainty, relation/time/membership effects, true recovery, fitted candidate-K | | GAP-004 | durable end-to-end Analysis Run | `partial` | idempotent lifecycle, persistence/recovery, estimator-bound artifacts, validation/promotion separation, Compose E2E | @@ -114,12 +110,12 @@ TEPP never copies fast-mlsirm numerical kernels or contextual-orchestrator provi | GAP-011 | operable multi-tenant release | `accepted-target` | OIDC/RLS/purpose controls, durable queue/storage, OTel/SLO, restore/load/migration, signed SBOM/provenance | | GAP-012 | paths obscure domain ownership | `active-refactor` | staged moves, ACLs, no cycles/cross-context persistence/shared-kernel creep | | GAP-013 | ADR identity collisions | `release-integrity` | unique repository-wide identity, deterministic duplicate detection, supersession lineage | -| GAP-014 | dependency-review evidence unavailable | `blocked_external` | authorized GitHub/dependency-graph availability repair, unchanged-head compare HTTP 200, pinned Dependency Review execution, exact-head Security Scan GREEN, no fail-open bypass | +| GAP-014 | dependency-review evidence unavailable | `blocked_external` | authorized dependency-graph availability, pinned Dependency Review execution, exact-head Security Scan GREEN, no fail-open bypass | ## Delivery and release order -Queue/ADR/domain authority precedes semantic admission, the Rust CPU f64 shared-latent temporal estimator, durable Analysis Run, released fast-mlsirm temporal composition, event intelligence, accelerator parity, buyer workflows and finally tenancy/durability/observability/release support. A bounded security/dependency repair may land earlier when it directly unblocks a selected vehicle. +Queue/ADR/domain authority precedes semantic admission, the Rust CPU f64 shared-latent temporal estimator, durable Analysis Run, released fast-mlsirm temporal composition, event intelligence, accelerator parity, buyer workflows, and finally tenancy/durability/observability/release support. A bounded security/dependency repair may land earlier when it directly unblocks a selected vehicle. -Every open PR is classified as `landing_vehicle`, `stacked_dependency`, `fold_into_landing_vehicle`, `superseded`, `duplicate`, `research_lineage_only`, or `blocked_external`. Exact heads must be compared before closure. Strict ancestry permits retarget-and-close folding; diverged siblings require a real code/test fold first. +Every open PR is classified as `landing_vehicle`, `stacked_dependency`, `fold_into_landing_vehicle`, `superseded`, `duplicate`, `research_lineage_only`, or `blocked_external`. Exact heads must be compared before closure. Strict ancestry permits safe consolidation; diverged siblings require a real code/test fold first. TEPP has no GitHub release at this snapshot. Release requires a coherent buyer/scientific vertical on protected main, exact-head scientific and security evidence, reproducible package/build provenance and SBOM, upgrade/rollback evidence, and released integration contracts where deployment depends on them. From fbb75649385766b20c7b11959677e9e76acf95bc Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 05:44:44 +0900 Subject: [PATCH 065/235] docs(delivery): record canonical standardisation owner migration --- docs/product-technical-gap-baseline.md | 23 +++++++++++++---------- 1 file changed, 13 insertions(+), 10 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 4be27e162..520e2343e 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-01T20:30:01Z +**Snapshot:** 2026-09-01T20:44:00Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` **Workspace version:** `0.2.0` **Delivery authority:** issue [#175](https://github.com/ContextualWisdomLab/TEPP/issues/175), PR [#435](https://github.com/ContextualWisdomLab/TEPP/pull/435), and [`docs/delivery/pr-queue-authority-2026-09-01.md`](delivery/pr-queue-authority-2026-09-01.md) @@ -15,8 +15,8 @@ A planning document, mergeable branch, local test, predecessor-head result, queu | Signal | Current evidence | Delivery implication | | --- | ---: | --- | | Protected `main` | `1bc02f580cf48e1d39da239f0e818453437c31c3` | Capability claims remain bounded to this commit until protected main changes. | -| Open pull requests | **134** | WIP remains release-blocking, but the queue has been reduced from the observed peak of 149 and from the 136-PR regression at the start of this repair slice. | -| Draft pull requests | **133** | Non-landable work is explicitly parked while consolidated, repaired, or supplied with missing evidence. | +| Open pull requests | **133** | WIP remains release-blocking, but the queue has been reduced from the observed peak of 149 and from the 136-PR regression at the start of this repair slice. | +| Draft pull requests | **132** | Non-landable work is explicitly parked while consolidated, repaired, or supplied with missing evidence. | | Non-draft pull requests | **1** | #310 is the only current non-Draft landing vehicle. | | Open issues | **15** | Includes #437 for repository-wide ADR identity normalization and #472 for cutoff-safe inferred-status Analysis Run projection. | | GitHub releases | **0** | No open head is a released TEPP contract. | @@ -24,11 +24,11 @@ A planning document, mergeable branch, local test, predecessor-head result, queu Classic branch protection is not the sole policy source; organization rulesets are effective merge authority where applicable. Any increase in open PR count while #435 remains open is a WIP regression unless the new PR is a demonstrably independent root-cause repair that cannot safely belong to an existing landing vehicle. -The most recent regression reached 136 open PRs when #476 (`DIFFUSIONstd`) and #477 (`discreteDIFFUSIONstd`) were opened as one-map Drafts under the wrong technical owner `psychometric_core`. Their scientific evidence was not discarded. Exact source and tests were verified as folded into #310 under the Longitudinal Modeling bounded context, including typed event time, positive stationarity, scale invariance, subnormal/overflow regressions, interval ordering, refusal contracts, and explicit `research_candidate` status. #476 and #477 were then closed as superseded lineage. The live queue consequently fell to 134. +The queue regressed to 136 when #476 (`DIFFUSIONstd`) and #477 (`discreteDIFFUSIONstd`) appeared as one-map Drafts under the wrong technical owner `psychometric_core`. Their scientific evidence was verified as folded into #310 under the Longitudinal Modeling bounded context before both predecessors were closed. A second ownership repair closed dirty #272 only after its unique IEEE-754 exact-unit finding was promoted to the canonical reusable owner path, fast-mlsirm PR #1723. TEPP #315 remains Draft as named ctsem/TEPP adapter lineage and is forbidden from landing its duplicate local arithmetic; after an immutable fast-mlsirm release it must become an ACL/adapter and remove the duplicate kernel. The live TEPP queue is now 133. ## Current priority open pull-request evidence -This is a priority subset, not a row-for-row copy of the 134-PR queue. #435 intentionally omits its own SHA because embedding the branch head in a file changed by that same branch would make the evidence self-stale. +This is a priority subset, not a row-for-row copy of the 133-PR queue. #435 intentionally omits its own SHA because embedding the branch head in a file changed by that same branch would make the evidence self-stale. | PR | Exact current head | Draft | Base | Ownership / disposition | | ---: | --- | :---: | --- | --- | @@ -38,6 +38,7 @@ This is a priority subset, not a row-for-row copy of the 134-PR queue. #435 inte | #462 | `c1b7d627167dd7636d2975cc41cec050a5e477ba` | true | main | Bounded source-name compatibility repair; v1 serialized key remains `id`. | | #420 | `0dc8b48f66b367a90847fcfebd2c6453ff275a1d` | true | main | Project-history query CLI; `fold_into_landing_vehicle` until its unique source/tests are composed into the surviving Analysis Run vehicle. | | #417 | `1e468f62ec47f3476a7b4d18ed2980451dc425cf` | true | main | Analysis Run / naruon export retrieval GET+CLI landing vehicle; re-read before mutation. | +| #315 | `538f9bd1c76422bc894836b65083c62544330c7c` | true | main | TEPP `TIPREDVARstd` adapter lineage only; blocked on released fast-mlsirm #1723/successor and must remove duplicate arithmetic before landing. | | #310 | `4e7435f6dd232ae8e1e019f1393e7285e32c6527` | false | main | Longitudinal Modeling landing vehicle; contains closed #441 lineage and verified #476/#477 diffusion folds. | Exact current head evidence is authoritative only for the named PR and becomes stale after any source mutation. @@ -59,7 +60,7 @@ Cargo crates, HTTP routes, CLI verbs, refusal rules, clocks, and individual stat | Supporting | Persistence & Recovery | repositories and durable receipts | `persistence_postgres`, object-store adapters | | Generic | Compute backend | execution receipt | CPU/GPU/MLX adapters; execution is not scientific authority | -**Canonical owners:** fast-mlsirm owns reusable static/generalized-mixed/dependence-aware psychometric specification and LSIRM/MLSIRM/DLSJM kernels. TEPP owns temporal/event composition, irregular time, time-varying multilevel/cross-classified/multiple-membership semantics, longitudinal invariance/drift/alignment, and temporal recovery. contextual-orchestrator owns every LLM/provider call and routing decision. Context Graph contracts are a contract-only Shared Kernel; EA Core owns authoritative architecture decisions. No cross-service SQL. +**Canonical owners:** fast-mlsirm owns reusable static/generalized-mixed/dependence-aware psychometric specification and numerical kernels, including reusable covariance standardisation and LSIRM/MLSIRM/DLSJM kernels. TEPP owns temporal/event composition, irregular time, time-varying multilevel/cross-classified/multiple-membership semantics, longitudinal invariance/drift/alignment, and temporal recovery. contextual-orchestrator owns every LLM/provider call and routing decision. Context Graph contracts are a contract-only Shared Kernel; EA Core owns authoritative architecture decisions. No cross-service SQL. `event_time`, `assertion_time`, `document_time`, `system_time`, `available_time`, and `knowledge_cutoff` remain distinct in code, schemas, and tests. A retrospective source may describe an earlier event but cannot enter an earlier knowledge cutoff. Forward state/transition edges remain distinct from retrospective, citation, revision, and provenance relations. @@ -81,15 +82,17 @@ Supported temporal estimators require realistic known-truth recovery: RMSE, bias **#476/#477 — superseded scientific micro-PRs.** Both Drafts are closed after source-level parity verification against #310. Their immutable discussions and branches remain research lineage; they must not be merged independently. This is the required queue repair pattern: fold unique evidence into the bounded-context owner first, verify parity, then retire the micro-PR. +**#272/#315 — static-standardisation ownership repair.** #272 is closed after its unique exact-unit binary64 finding was preserved in fast-mlsirm owner PR #1723. #315 remains Draft only to preserve the TEPP-specific `TIPREDVARstd` naming/event-time/refusal contract. It must not merge with duplicate arithmetic. After #1723 or its successor becomes a released/versioned upstream contract, #315 must consume it through an ACL, prove parity, retain TEPP temporal/model admission, and delete wrong-owner production arithmetic before folding into a Measurement/Longitudinal Modeling landing vehicle. + **Dependency-review support.** Where Security Scan fails before Dependency Review because GitHub dependency-graph comparison is unavailable to the workflow token, keep the gate fail-closed. OSV, Trivy, and Scorecard are sibling evidence, not substitutes. Do not weaken TEPP source to manufacture missing control-plane evidence. -**Analysis Run adapter/profile proliferation.** Export, interpretation, project-history, and temporal-context HTTP/CLI mechanics are adapters inside one supporting context. Strict ancestry may be folded without force after exact comparison; diverged siblings require an actual source/test fold. One refusal/profile/route/CLI verb does not create architecture authority. +**Analysis Run adapter/profile proliferation.** Export, interpretation, project-history, inferred-status, and temporal-context HTTP/CLI mechanics are adapters inside supporting contexts. Strict ancestry may be folded without force after exact comparison; diverged siblings require an actual source/test fold. One refusal/profile/route/CLI verb does not create architecture authority. **#437 — ADR identity.** Repository-wide ADR IDs are immutable authority. Duplicate index IDs, duplicate targets, and duplicate numbered ADR files must fail deterministic documentation fitness tests. Operation-specific ADRs on adapter/model micro-branches are implementation lineage pending normalization, not branch-local architecture authority. ## Dependency and Context Fabric status -TEPP never copies fast-mlsirm numerical kernels or contextual-orchestrator provider logic. An upstream open PR head is not a released dependency. A checksum-pinned contextual-orchestrator source advances only after the exact replacement archive digest is reproducibly acquired and reviewed. +fast-mlsirm PR #1723 is the active canonical-owner candidate for domain-neutral scalar variance standardisation, with Published Language ID `fast_mlsirm.scalar_variance_standardisation@1.0.0`; it is not a TEPP production dependency until merged and released/versioned with required evidence. The generalized-mixed/dependence candidate compiler remains separately owned upstream. TEPP never copies those numerical kernels or contextual-orchestrator provider logic. An upstream open PR head is not a released dependency. A checksum-pinned contextual-orchestrator source advances only after the exact replacement archive digest is reproducibly acquired and reviewed. `context-graph-contracts` and `enterprise-architecture-core` remain read-only to this writer while their dedicated Context Fabric owner loop is active. Open heads are candidate evidence, not released contracts. TEPP may maintain fail-closed conformance fixtures behind candidate/test boundaries, but deployable integration and authoritative EA projection require a released/versioned Context Graph artifact plus passing compatibility evidence. @@ -97,11 +100,11 @@ TEPP never copies fast-mlsirm numerical kernels or contextual-orchestrator provi | ID | Gap | Maturity | Closure evidence | | --- | --- | --- | --- | -| GAP-001 | PR authority fragmented across 134 open PRs | `release-blocking` | coherent landing vehicles, unique evidence preservation, protected-main reduction | +| GAP-001 | PR authority fragmented across 133 open PRs | `release-blocking` | coherent landing vehicles, unique evidence preservation, protected-main reduction | | GAP-002 | multilingual span-grounded semantic/concept admission | `partial` | immutable offsets/layout, language profiles, concept dictionary, invariance/calibration, hostile-input tests | | GAP-003 | shared-latent temporal topic estimator | `partial` | Rust CPU f64 likelihood/uncertainty, relation/time/membership effects, true recovery, fitted candidate-K | | GAP-004 | durable end-to-end Analysis Run | `partial` | idempotent lifecycle, persistence/recovery, estimator-bound artifacts, validation/promotion separation, Compose E2E | -| GAP-005 | temporal psychometric composition/duplication | `partial` | released fast-mlsirm contract, TEPP ACL, temporal recovery, wrong-owner static kernels removed after parity | +| GAP-005 | temporal psychometric composition/duplication | `partial` | released fast-mlsirm contracts, TEPP ACLs, temporal recovery, wrong-owner static kernels removed after parity | | GAP-006 | event intelligence | `partial` | calibrated detection/tracking/schema/interval recovery and durable artifacts | | GAP-007 | accelerator/memory evidence | `accepted-target` | real hardware, CPU-f64 parity, bounded OOM/fallback evidence | | GAP-008 | network/cluster buyer workflow | `partial` | known-truth recovery, uncertainty/stability, repeated consensus, exact-value export | From 93922f5e1eb2107b4ee33564055c61ad3647332c Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 05:51:28 +0900 Subject: [PATCH 066/235] test(docs): reject malformed priority rows RED --- tests/quality/test_gap_inventory_heading.py | 29 ++++++++++++++++++--- 1 file changed, 26 insertions(+), 3 deletions(-) diff --git a/tests/quality/test_gap_inventory_heading.py b/tests/quality/test_gap_inventory_heading.py index 562381753..131edab4a 100644 --- a/tests/quality/test_gap_inventory_heading.py +++ b/tests/quality/test_gap_inventory_heading.py @@ -25,6 +25,7 @@ | PR | Exact current head | Draft | Base | Title | |---:|---|:---:|---|---| | #441 | `6f483224b3a03e8237c6f4f098a8b0e85e0a91f5` | false | main | repair | +{extra_rows} ## Operator-gap register @@ -35,15 +36,17 @@ class PriorityInventoryHeadingTests(unittest.TestCase): - """Require the canonical level-two heading exactly, not a substring match.""" + """Require the canonical level-two heading and every inventory row to be valid.""" - def _write(self, heading: str) -> Path: + def _write(self, heading: str, extra_rows: str = "") -> Path: temporary = tempfile.TemporaryDirectory() self.addCleanup(temporary.cleanup) root = Path(temporary.name) path = root / docs.PRODUCT_TECHNICAL_GAP_BASELINE path.parent.mkdir(parents=True) - path.write_text(BASE.format(heading=heading), encoding="utf-8") + path.write_text( + BASE.format(heading=heading, extra_rows=extra_rows), encoding="utf-8" + ) return root def test_exact_level_two_heading_passes(self) -> None: @@ -66,6 +69,26 @@ def test_suffixed_level_two_near_match_fails(self) -> None: with self.assertRaisesRegex(AssertionError, "no exact-head rows"): docs.validate_product_technical_gap_baseline(root) + def test_malformed_priority_row_fails_even_with_valid_sibling(self) -> None: + """A malformed data row cannot disappear from an otherwise valid inventory.""" + + root = self._write( + "## Current priority open pull-request evidence", + "| #442 | `deadbeef` | maybe | main | malformed |", + ) + with self.assertRaisesRegex(AssertionError, "malformed priority inventory row"): + docs.validate_product_technical_gap_baseline(root) + + def test_missing_priority_columns_fail_even_with_valid_sibling(self) -> None: + """Missing cells in one data row are an integrity failure, not an omission.""" + + root = self._write( + "## Current priority open pull-request evidence", + "| #442 | `0123456789012345678901234567890123456789` | true |", + ) + with self.assertRaisesRegex(AssertionError, "malformed priority inventory row"): + docs.validate_product_technical_gap_baseline(root) + if __name__ == "__main__": # pragma: no cover unittest.main() From 105d576342f10145c89a545b2afb767f6b8f88f0 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 05:51:53 +0900 Subject: [PATCH 067/235] test(adr): require single consistent authority metadata RED --- tests/quality/test_adr_identity_uniqueness.py | 70 +++++++++++++++++-- 1 file changed, 65 insertions(+), 5 deletions(-) diff --git a/tests/quality/test_adr_identity_uniqueness.py b/tests/quality/test_adr_identity_uniqueness.py index 4951ae877..a0af476fc 100644 --- a/tests/quality/test_adr_identity_uniqueness.py +++ b/tests/quality/test_adr_identity_uniqueness.py @@ -1,4 +1,4 @@ -"""Regression tests for repository-wide ADR identity uniqueness.""" +"""Regression tests for repository-wide ADR identity and authority consistency.""" from __future__ import annotations @@ -43,9 +43,14 @@ class AdrIdentityUniquenessTests(unittest.TestCase): - """Reject branch-local reuse or misdirection of an ADR identifier.""" - - def _root(self, index_rows: str, files: dict[str, str]) -> Path: + """Reject branch-local reuse, misdirection, or split ADR authority metadata.""" + + def _root( + self, + index_rows: str, + files: dict[str, str], + bodies: dict[str, str] | None = None, + ) -> Path: temporary = tempfile.TemporaryDirectory() self.addCleanup(temporary.cleanup) root = Path(temporary.name) @@ -58,7 +63,8 @@ def _root(self, index_rows: str, files: dict[str, str]) -> Path: encoding="utf-8", ) for name, number in files.items(): - (adr_root / name).write_text(ADR_BODY.format(number=number), encoding="utf-8") + body = (bodies or {}).get(name, ADR_BODY.format(number=number)) + (adr_root / name).write_text(body, encoding="utf-8") return root def test_duplicate_index_rows_fail(self) -> None: @@ -120,6 +126,60 @@ def test_titled_duplicate_index_rows_fail(self) -> None: with self.assertRaisesRegex(AssertionError, "duplicate ADR index identity"): docs.validate_adr_graph() + def test_index_maturity_must_match_canonical_adr(self) -> None: + """The index cannot advertise a different implementation maturity.""" + + root = self._root( + "| [0001](0001-one.md) | One | Accepted | active-PR | drift |\n", + {"0001-one.md": "0001"}, + ) + with mock.patch.object(docs, "ROOT", root): + with self.assertRaisesRegex(AssertionError, "ADR index maturity mismatch"): + docs.validate_adr_graph() + + def test_index_decision_status_must_match_canonical_adr(self) -> None: + """Accepted/proposed authority may not diverge between file and index.""" + + root = self._root( + "| [0001](0001-one.md) | One | Proposed | partial | drift |\n", + {"0001-one.md": "0001"}, + ) + with mock.patch.object(docs, "ROOT", root): + with self.assertRaisesRegex(AssertionError, "ADR index decision-status mismatch"): + docs.validate_adr_graph() + + def test_duplicate_maturity_metadata_fails(self) -> None: + """An ADR has exactly one canonical implementation-maturity declaration.""" + + body = ADR_BODY.format(number="0001").replace( + "**Implementation maturity:** partial", + "**Implementation maturity:** partial\n**Implementation maturity:** active-PR", + ) + root = self._root( + "| [0001](0001-one.md) | One | Accepted | partial | canonical |\n", + {"0001-one.md": "0001"}, + {"0001-one.md": body}, + ) + with mock.patch.object(docs, "ROOT", root): + with self.assertRaisesRegex(AssertionError, "multiple Implementation maturity"): + docs.validate_adr_graph() + + def test_duplicate_decision_status_metadata_fails(self) -> None: + """An ADR has exactly one canonical decision-status declaration.""" + + body = ADR_BODY.format(number="0001").replace( + "**Decision status:** Accepted", + "**Decision status:** Accepted\n**Decision status:** Proposed", + ) + root = self._root( + "| [0001](0001-one.md) | One | Accepted | partial | canonical |\n", + {"0001-one.md": "0001"}, + {"0001-one.md": body}, + ) + with mock.patch.object(docs, "ROOT", root): + with self.assertRaisesRegex(AssertionError, "multiple Decision status"): + docs.validate_adr_graph() + def test_canonical_index_targets_pass(self) -> None: """Each displayed identity may link to its unique root ADR file.""" From cee9827254e0e37893b2db9144f0a9aa99b90946 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 05:54:44 +0900 Subject: [PATCH 068/235] fix(docs): fail closed on malformed inventory and ADR drift --- scripts/validate_documentation.py | 74 ++++++++++++++++++++++++++----- 1 file changed, 64 insertions(+), 10 deletions(-) diff --git a/scripts/validate_documentation.py b/scripts/validate_documentation.py index 9c1f61501..4c74912f9 100644 --- a/scripts/validate_documentation.py +++ b/scripts/validate_documentation.py @@ -80,11 +80,13 @@ ) INVENTORY_ROW = re.compile( r"^\|\s*#(?P\d+)\s*\|\s*`(?P[0-9a-f]{40})`\s*\|\s*" - r"(?Ptrue|false)\s*\|", - re.MULTILINE, + r"(?Ptrue|false)\s*\|\s*(?P[^|]+?)\s*\|\s*" + r"(?P[^|]+?)\s*\|\s*$" ) PRIORITY_INVENTORY_HEADING = "## Current priority open pull-request evidence" LEVEL_TWO_HEADING = re.compile(r"^##\s+", re.MULTILINE) +PRIORITY_HEADER_ROW = re.compile(r"^\|\s*PR\s*\|", re.IGNORECASE) +PRIORITY_SEPARATOR_ROW = re.compile(r"^\|(?:\s*:?-+:?\s*\|)+\s*$") OPEN_PR_COUNT = re.compile( r"\|\s*Open pull requests\s*\|\s*\*\*(?P\d+)\*\*" ) @@ -102,18 +104,23 @@ r"\b(?:but|however|yet|although|though)\b", re.IGNORECASE ) QUEUED_CHECKS_SENTENCE_BREAK = re.compile(r"[.;!?\n]") +ADR_STATUS_VALUES = "Accepted|Proposed|Superseded|Rejected" +ADR_MATURITY_VALUES = ( + "implemented-main|active-PR|partial|accepted-target|research-only|out-of-scope" +) ADR_TABLE_ROW = re.compile( - r'^\|\s*\[(?P\d{4})\]\((?P[^)\s]+)(?:\s+"[^"]*")?\)\s*\|', + rf'^\|\s*\[(?P\d{{4}})\]\((?P[^)\s]+)(?:\s+"[^"]*")?\)\s*\|' + rf"\s*[^|]+\|\s*(?P{ADR_STATUS_VALUES})\s*\|" + rf"\s*(?P{ADR_MATURITY_VALUES})\s*\|", re.MULTILINE, ) ADR_FILE_NAME = re.compile(r"^(?P\d{4})-[a-z0-9-]+\.md$") ADR_DECISION_STATUS = re.compile( - r"^\*\*Decision status:\*\*\s*(Accepted|Proposed|Superseded|Rejected)\b", + rf"^\*\*Decision status:\*\*\s*({ADR_STATUS_VALUES})\b", re.MULTILINE, ) ADR_IMPLEMENTATION_STATUS = re.compile( - r"^\*\*Implementation maturity:\*\*\s*" - r"(implemented-main|active-PR|partial|accepted-target|research-only|out-of-scope)\b", + rf"^\*\*Implementation maturity:\*\*\s*({ADR_MATURITY_VALUES})\b", re.MULTILINE, ) ADR_REQUIRED_HEADINGS = ( @@ -409,6 +416,25 @@ def _priority_inventory_section(text: str) -> str: return text[section_start:section_end] +def _priority_inventory_rows(section: str) -> tuple[list[re.Match[str]], list[str]]: + """Parse every Markdown table data row in the priority inventory fail-closed.""" + + inventory: list[re.Match[str]] = [] + malformed: list[str] = [] + for raw_line in section.splitlines(): + line = raw_line.strip() + if not line.startswith("|"): + continue + if PRIORITY_HEADER_ROW.match(line) or PRIORITY_SEPARATOR_ROW.fullmatch(line): + continue + match = INVENTORY_ROW.fullmatch(line) + if match is None: + malformed.append(line) + else: + inventory.append(match) + return inventory, malformed + + def validate_product_technical_gap_baseline(root: Path = ROOT) -> None: """Require a dated live gap register with an honest priority PR inventory.""" @@ -433,7 +459,11 @@ def validate_product_technical_gap_baseline(root: Path = ROOT) -> None: ): failures.append("gap baseline treats queued Checks as implemented-main") priority_inventory = _priority_inventory_section(text) - inventory = list(INVENTORY_ROW.finditer(priority_inventory)) + inventory, malformed_rows = _priority_inventory_rows(priority_inventory) + if malformed_rows: + failures.extend( + f"malformed priority inventory row: {row}" for row in malformed_rows + ) inventory_numbers = [match.group("number") for match in inventory] if not inventory: failures.append("gap baseline open-PR inventory has no exact-head rows") @@ -453,7 +483,7 @@ def validate_product_technical_gap_baseline(root: Path = ROOT) -> None: def validate_adr_graph() -> None: - """Require every numbered ADR to have one repository-wide identity and target.""" + """Require every numbered ADR to have one repository-wide identity and authority.""" adr_root = ROOT / "docs" / "adr" adr_index = (adr_root / "README.md").read_text(encoding="utf-8") @@ -477,6 +507,7 @@ def validate_adr_graph() -> None: raise AssertionError(f"duplicate ADR index target: {duplicate_targets}") indexed_numbers = set(indexed_number_list) + index_by_number = {match.group("number"): match for match in index_rows} adr_paths_by_number: dict[str, list[Path]] = {} for path in sorted(adr_root.glob("[0-9][0-9][0-9][0-9]-*.md")): match = ADR_FILE_NAME.fullmatch(path.name) @@ -525,10 +556,33 @@ def validate_adr_graph() -> None: failures: list[str] = [] for number, path in adr_files.items(): text = path.read_text(encoding="utf-8") - if ADR_DECISION_STATUS.search(text) is None: + decision_matches = list(ADR_DECISION_STATUS.finditer(text)) + maturity_matches = list(ADR_IMPLEMENTATION_STATUS.finditer(text)) + if not decision_matches: failures.append(f"ADR {number} lacks a valid Decision status") - if ADR_IMPLEMENTATION_STATUS.search(text) is None: + elif len({match.group(1) for match in decision_matches}) > 1: + failures.append(f"ADR {number} has multiple Decision status authorities") + if not maturity_matches: failures.append(f"ADR {number} lacks a valid Implementation maturity") + elif len({match.group(1) for match in maturity_matches}) > 1: + failures.append(f"ADR {number} has multiple Implementation maturity authorities") + + index_row = index_by_number[number] + if decision_matches: + canonical_decision = decision_matches[0].group(1) + if index_row.group("decision") != canonical_decision: + failures.append( + f"ADR index decision-status mismatch for {number}: " + f"index={index_row.group('decision')} file={canonical_decision}" + ) + if maturity_matches: + canonical_maturity = maturity_matches[0].group(1) + if index_row.group("maturity") != canonical_maturity: + failures.append( + f"ADR index maturity mismatch for {number}: " + f"index={index_row.group('maturity')} file={canonical_maturity}" + ) + if "**Supersedes:**" not in text and "**Supersession:**" not in text: failures.append(f"ADR {number} lacks explicit supersession metadata") for heading in ADR_REQUIRED_HEADINGS: From 3bd77ed11240fbf4a3e404e3ae076fef11fa94aa Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 05:55:07 +0900 Subject: [PATCH 069/235] fix(adr): normalize multilingual maturity authority --- .../0004-shared-multilingual-latent-space.md | 19 ++----------------- 1 file changed, 2 insertions(+), 17 deletions(-) diff --git a/docs/adr/0004-shared-multilingual-latent-space.md b/docs/adr/0004-shared-multilingual-latent-space.md index 814998433..c50e3ef80 100644 --- a/docs/adr/0004-shared-multilingual-latent-space.md +++ b/docs/adr/0004-shared-multilingual-latent-space.md @@ -1,22 +1,7 @@ # ADR 0004 — Shared multilingual latent semantic space **Decision status:** Accepted -**Implementation maturity:** partial — default stopword-deletion refusal is `stopword_deletion` on the active PR; shared-space estimators, language profiles, and TF-IDF/BM25 inferential-weight refusal remain accepted-target -**Implementation maturity:** accepted-target — style-versus-unique-content identity in `style_source` on the active PR; shared-space estimators remain accepted-target -**Implementation maturity:** accepted-target — modality-versus-unique-content identity in `modality_source` on the active PR; shared-space estimators remain accepted-target -**Implementation maturity:** accepted-target — corpus-background-versus-unique-content identity in `corpus_background` on the active PR; shared-space estimators remain accepted-target -**Implementation maturity:** accepted-target — prompt-versus-unique-content identity in `prompt_source` on the active PR; shared-space estimators remain accepted-target -**Implementation maturity:** accepted-target — corpus-background-versus-unique-content identity in `corpus_background` on the active PR; shared-space estimators remain accepted-target -**Implementation maturity:** accepted-target — modality-versus-unique-content identity in `modality_source` on the active PR; shared-space estimators remain accepted-target -**Implementation maturity:** accepted-target — copied-versus-unique-content identity in `copied_text` on the active PR; shared-space estimators remain accepted-target -**Implementation maturity:** accepted-target — style-versus-unique-content identity in `style_source` on the active PR; shared-space estimators remain accepted-target -**Decision status:** Accepted -**Implementation maturity:** accepted-target — prompt-versus-unique-content identity in `prompt_source` on the active PR; shared-space estimators remain accepted-target -**Implementation maturity:** accepted-target — corpus-background-versus-unique-content identity in `corpus_background` on the active PR; shared-space estimators remain accepted-target -**Implementation maturity:** accepted-target — modality-versus-unique-content identity in `modality_source` on the active PR; shared-space estimators remain accepted-target -**Implementation maturity:** accepted-target — copied-versus-unique-content identity in `copied_text` on the active PR; shared-space estimators remain accepted-target -**Implementation maturity:** accepted-target — style-versus-unique-content identity in `style_source` on the active PR; shared-space estimators remain accepted-target -**Implementation maturity:** partial — default stopword-deletion refusal is `stopword_deletion` on the active PR; shared-space estimators, language profiles, and TF-IDF/BM25 inferential-weight refusal remain accepted-target +**Implementation maturity:** partial — span/source-method refusal slices are active-PR evidence; shared-space estimators, language profiles, and TF-IDF/BM25 inferential-weight refusal remain accepted-target **Date:** 2026-08-05 **Supersedes:** None. ADR 0012 governs the complete topic-estimator/backend/global-topic contract built on this multilingual measurement decision. ADR 0020 owns the first span-grounded unit-identity slice as an active-PR; it is not shared-latent estimation. @@ -30,7 +15,7 @@ The product therefore needs a language-independent analytical contract while pre TEPP learns one shared latent semantic and topic space across languages. Equivalent meanings share concept prototypes, topic identities, and document coordinates. Language-specific morphology, script, syntax, lexical emissions, and content deviations remain explicit rather than being forced to match. -This ADR owns the multilingual measurement substrate. The product topic-estimator contract is **Temporal Relational Shared-Latent Topic Measurement (TRSL-TM)** under ADR 0012. Temporal topic identity follows the dynamic topic-model family (Blei & Lafferty, 2006). An STM-style logistic-normal document-coordinate model (Roberts et al., 2014, 2019) is the **reference family**, not a claim that every compliant backend is already shipped. Implementation maturity for this ADR and for TRSL-TM remains accepted-target. +This ADR owns the multilingual measurement substrate. The product topic-estimator contract is **Temporal Relational Shared-Latent Topic Measurement (TRSL-TM)** under ADR 0012. Temporal topic identity follows the dynamic topic-model family (Blei & Lafferty, 2006). An STM-style logistic-normal document-coordinate model (Roberts et al., 2014, 2019) is the **reference family**, not a claim that every compliant backend is already shipped. Implementation maturity remains partial: bounded refusal/identity slices exist on active PRs while shared-space estimation and language-profile validation remain accepted-target. Original text and exact source spans are preserved. Segmentation and morphology are language-tailored. Universal POS/dependency information may act as soft source evidence or priors but does not authorize irreversible deletion. LLM-proposed semantic units must resolve to exact source evidence and a versioned concept/semantic contract; unknown meaning can remain unresolved rather than being forced into a known concept. From 94e4b781f22d33715e7e2ac019553e2ccd1ca708 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 05:55:27 +0900 Subject: [PATCH 070/235] fix(adr): stop promoting active evidence to main --- .../adr/0008-immutable-evidence-identities-digests-and-spans.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/adr/0008-immutable-evidence-identities-digests-and-spans.md b/docs/adr/0008-immutable-evidence-identities-digests-and-spans.md index e1154a991..05d33d41f 100644 --- a/docs/adr/0008-immutable-evidence-identities-digests-and-spans.md +++ b/docs/adr/0008-immutable-evidence-identities-digests-and-spans.md @@ -1,7 +1,7 @@ # ADR 0008 — Immutable evidence identities, digests, exact spans, and wire records **Decision status:** Accepted -**Implementation maturity:** implemented-main — inbound size/depth/identity/provenance refusal for untrusted documents, records, checkpoints, and LLM outputs is `payload_bound` on the active PR +**Implementation maturity:** active-PR — inbound size/depth/identity/provenance refusal for untrusted documents, records, checkpoints, and LLM outputs is `payload_bound` on active PR evidence and is not implemented-main until protected-main integration **Date:** 2026-08-05 **Decision owners:** Contextual Wisdom Lab **Supersedes:** None. ADR 0013 owns future persistence, reproducibility-manifest, and relation-aware split authority. From ab13a61705fa08e14ac14515c0c35eea9531e0fb Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 05:55:58 +0900 Subject: [PATCH 071/235] fix(adr): reconcile index authority and collision lineage --- docs/adr/README.md | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/docs/adr/README.md b/docs/adr/README.md index f6f48f55c..19471a2b1 100644 --- a/docs/adr/README.md +++ b/docs/adr/README.md @@ -9,11 +9,11 @@ Read [`ADR_POLICY.md`](ADR_POLICY.md) first. **Decision status and implementatio | [0001](0001-rust-first-modular-msa.md) | Rust-first numerical core and CPU `f64` reference | Accepted | partial | Owns production arithmetic and reference-backend authority; ADR 0011 owns cross-service boundaries. | | [0002](0002-six-clock-temporal-semantics.md) | Six-clock temporal semantics and fail-closed historical eligibility | Accepted | partial | Owns event/valid, assertion, document, system, available, and knowledge-cutoff semantics plus temporal eligibility. | | [0003](0003-relational-event-multiple-membership.md) | Relational event ontology and time-varying cross-classified multiple membership | Accepted | partial | Owns event/relation/membership semantics; full multilevel estimators and persistence remain separate implementation work. | -| [0004](0004-shared-multilingual-latent-space.md) | Shared multilingual latent semantic space | Accepted | accepted-target | Owns multilingual latent-space and invariance intent; ADR 0020 owns span-grounded semantic-unit identity. | -| [0005](0005-posterior-esem-dsem.md) | Posterior-aware ESEM/DSEM and compositional coordinates | Accepted | active-PR | Owns longitudinal psychometric interpretation; reusable static kernels migrate to their canonical owner when applicable. | -| [0006](0006-vram-gpu-nvidia-orchestration.md) | VRAM-adaptive GPU compute and credential boundary | Accepted | accepted-target | Owns compute-backend/VRAM policy; LLM orchestration belongs to ADR 0010. | +| [0004](0004-shared-multilingual-latent-space.md) | Shared multilingual latent semantic space | Accepted | partial | Owns multilingual latent-space and invariance intent; ADR 0020 owns span-grounded semantic-unit identity. | +| [0005](0005-posterior-esem-dsem.md) | Posterior-aware ESEM/DSEM and compositional coordinates | Accepted | partial | Owns longitudinal psychometric interpretation; reusable static kernels migrate to their canonical owner when applicable. | +| [0006](0006-vram-gpu-nvidia-orchestration.md) | VRAM-adaptive GPU compute and credential boundary | Accepted | active-PR | Owns compute-backend/VRAM policy; LLM orchestration belongs to ADR 0010. | | [0007](0007-rust-workspace-quality-gates.md) | Rust workspace, toolchain, and quality gates | Accepted | implemented-main | Owns repository quality tooling; scientific claim promotion belongs to ADR 0014. | -| [0008](0008-immutable-evidence-identities-digests-and-spans.md) | Immutable evidence identities, digests, spans, and wire reconstruction | Accepted | partial | Owns source-evidence identity and bounded reconstruction; persistence authority belongs to ADR 0013. | +| [0008](0008-immutable-evidence-identities-digests-and-spans.md) | Immutable evidence identities, digests, spans, and wire reconstruction | Accepted | active-PR | Owns source-evidence identity and bounded reconstruction; persistence authority belongs to ADR 0013. | | [0009](0009-purpose-bound-pii-governance.md) | Purpose-bound PII governance without blanket masking | Accepted | partial | Owns purpose-bound disclosure and re-identification controls; implementation evidence does not imply certification. | | [0010](0010-adaptive-llm-orchestration.md) | Adaptive LLM orchestration and test-time compute | Accepted | partial | All provider execution remains behind contextual-orchestrator; LLM output has no numerical authority. | | [0011](0011-standalone-modular-msa-boundary.md) | Standalone operation and modular CWL MSA boundary | Accepted | partial | Owns cross-service API/credential/persistence boundaries and anti-corruption-layer direction. | @@ -29,7 +29,7 @@ Read [`ADR_POLICY.md`](ADR_POLICY.md) first. **Decision status and implementatio | [0021](0021-lineageweave-project-history-boundary.md) | LineageWeave project-history service boundary | Accepted | active-PR | Owns the credential-free bounded project-history API while LineageWeave retains its authorization/domain authority. | | [0022](0022-deterministic-analysis-run-execution.md) | Deterministic cutoff-safe analysis-run execution | Accepted | active-PR | Canonical identity for the analysis-engine execution decision; the pre-normalization colliding 0021 text is preserved under `archive/`. | | [0023](0023-lineage-criterion-anchor-contract.md) | TEPP-owned Event Lineage criterion anchor | Accepted | active-PR | Owns independent criterion-anchor contract; estimator execution remains separately evidence-gated. | -| [0024](0024-independent-topic-importance-anchor.md) | Posterior topic-context producer contract | Accepted | contract-only active-PR | Owns the topic-context producer DTO/schema; fast-mlsirm owns reusable case-deletion influence arithmetic. | +| [0024](0024-independent-topic-importance-anchor.md) | Posterior topic-context producer contract | Accepted | active-PR | Owns the topic-context producer DTO/schema; fast-mlsirm owns reusable case-deletion influence arithmetic. | | [0025](0025-macos-native-rust-mlx-metal-boundary.md) | macOS-native Rust-owned MLX Metal execution | Accepted | accepted-target | Owns native Metal execution/parity receipt boundary; Linux must not claim Metal execution. | | [0026](0026-lineage-pair-criterion-and-project-journey-posterior.md) | Independent lineage-pair criterion and posterior Project Journey | Proposed | active-PR | Proposed successor identity for the pre-normalization colliding 0024 decision; it is not architecture authority unless and until accepted. | @@ -37,7 +37,9 @@ Read [`ADR_POLICY.md`](ADR_POLICY.md) first. **Decision status and implementatio The historical file [`archive/pre-normalization-0021-deterministic-analysis-run-execution.md`](archive/pre-normalization-0021-deterministic-analysis-run-execution.md) preserves the earlier branch-era ADR 0021 text byte-for-byte after that number was found to collide with the LineageWeave project-history decision. The canonical analysis-run execution decision is ADR 0022. Historical branch references to the colliding identity remain provenance, not current architecture authority. -The former lineage-pair/Project-Journey ADR 0024 collision is represented by proposed ADR 0026; accepted ADR 0024 remains the Posterior topic-context producer contract. No historical collision authorizes reuse of a retired number for a new decision, and a proposed successor does not become architecture authority merely because implementation work exists. +The former lineage-pair/Project-Journey ADR 0024 collision is handled differently and this distinction is intentional. This branch does **not** claim a byte-for-byte archive for that former 0024 text. ADR 0026 is a newly proposed successor identity that records the surviving decision intent; it is not represented as an archived copy. Historical Git/PR evidence, where retained by the repository host, remains provenance but does not become canonical ADR text. Fabricating an archive without verified original bytes would create false lineage, so accepted ADR 0024 remains the Posterior topic-context producer contract and ADR 0026 remains merely Proposed until separately accepted. + +No historical collision authorizes reuse of a retired number for a new decision, and a proposed successor does not become architecture authority merely because implementation work exists. ## Decision ownership summary From 2d1c9d7011deeca9231dade4d89dcc470f74c198 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 06:01:06 +0900 Subject: [PATCH 072/235] test(docs): lock priority inventory fail-closed parsing --- .../test_priority_inventory_fail_closed.py | 78 +++++++++++++++++++ 1 file changed, 78 insertions(+) create mode 100644 tests/quality/test_priority_inventory_fail_closed.py diff --git a/tests/quality/test_priority_inventory_fail_closed.py b/tests/quality/test_priority_inventory_fail_closed.py new file mode 100644 index 000000000..638f17260 --- /dev/null +++ b/tests/quality/test_priority_inventory_fail_closed.py @@ -0,0 +1,78 @@ +"""Fail-closed regressions for the operator priority pull-request inventory.""" + +from __future__ import annotations + +import tempfile +import unittest +from pathlib import Path + +from scripts import validate_documentation as docs + + +VALID_SHA = "c45be17a9dbce95ef81cee230e9d128abc7160ac" +VALID_HEAD = "a" * 40 + + +def baseline_with_rows(*rows: str) -> str: + """Build the minimum valid register around caller-supplied priority rows.""" + + return ( + "# Product and Technical Gap Baseline\n\n" + "**Snapshot:** 2026-09-02T00:00:00Z\n" + f"**Protected-main evidence:** `{VALID_SHA}`\n\n" + "## Snapshot facts\n\n" + "| Signal | Snapshot evidence | Delivery implication |\n" + "|---|---:|---|\n" + "| Open pull requests | **2** | Queue only. |\n\n" + "## Current priority open pull-request evidence\n\n" + "| PR | Exact current head | Draft | Base | Title |\n" + "|---:|---|:---:|---|---|\n" + + "".join(rows) + + "\n## Operator-gap register\n\n" + "| ID | Closure evidence |\n" + "|---|---|\n" + "| GAP-015 | Exact-head evidence required. |\n" + ) + + +class PriorityInventoryFailClosedTests(unittest.TestCase): + """Reject malformed rows even when another priority row parses successfully.""" + + def test_valid_row_cannot_hide_malformed_head_row(self) -> None: + """Every data row under the canonical priority heading must parse exactly.""" + + fixture = baseline_with_rows( + f"| #164 | `{VALID_HEAD}` | false | main | valid |\n", + "| #165 | `not-a-40-character-sha` | false | main | malformed |\n", + ) + with tempfile.TemporaryDirectory() as temporary: + root = Path(temporary) + path = root / docs.PRODUCT_TECHNICAL_GAP_BASELINE + path.parent.mkdir(parents=True) + path.write_text(fixture, encoding="utf-8") + with self.assertRaisesRegex( + AssertionError, "malformed priority inventory row" + ): + docs.validate_product_technical_gap_baseline(root) + + def test_valid_row_cannot_hide_invalid_draft_or_missing_columns(self) -> None: + """Invalid enums and truncated Markdown rows are also malformed inventory data.""" + + fixture = baseline_with_rows( + f"| #164 | `{VALID_HEAD}` | false | main | valid |\n", + f"| #165 | `{VALID_HEAD}` | maybe | main | invalid draft |\n", + f"| #166 | `{VALID_HEAD}` | true | main |\n", + ) + with tempfile.TemporaryDirectory() as temporary: + root = Path(temporary) + path = root / docs.PRODUCT_TECHNICAL_GAP_BASELINE + path.parent.mkdir(parents=True) + path.write_text(fixture, encoding="utf-8") + with self.assertRaisesRegex( + AssertionError, "malformed priority inventory row" + ): + docs.validate_product_technical_gap_baseline(root) + + +if __name__ == "__main__": # pragma: no cover + unittest.main() From 328dec8a5960ac4381d50701755d0227699279b8 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 06:02:16 +0900 Subject: [PATCH 073/235] docs(changelog): separate current release authority from historical lineage --- CHANGELOG.md | 458 +----------------- ...ELOG-pre-queue-normalization-2026-09-01.md | 453 +++++++++++++++++ 2 files changed, 472 insertions(+), 439 deletions(-) create mode 100644 docs/archive/CHANGELOG-pre-queue-normalization-2026-09-01.md diff --git a/CHANGELOG.md b/CHANGELOG.md index 65f7682bb..abc46bfad 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,453 +1,33 @@ # Changelog -All notable changes to TEPP are documented here. The format follows Keep a Changelog and semantic versioning once the first implementation release is cut. +All notable TEPP changes are recorded here. The current file is intentionally concise and product/release oriented; detailed pre-normalization scientific and micro-PR lineage is preserved byte-for-byte in [`docs/archive/CHANGELOG-pre-queue-normalization-2026-09-01.md`](docs/archive/CHANGELOG-pre-queue-normalization-2026-09-01.md). -## [0.2.0] - 2026-08-25 - -### Fixed - -- `network_analysis` posterior edge estimation landed with heuristic and fail-open defects that this release repairs before any consumer depends on it: a non-finite correlation now fails to the neutral p-value instead of masquerading as `|r| = 1`; negative-effect edges are excluded from the whole consensus perturbation pipeline rather than leaking into the union partition; the hardcoded 0.1 edge-drop probability became an explicit validated `edge_drop_probability` parameter; pseudo-p-values were replaced by exact two-sided Fisher z-transform p-values (Fisher, 1921) driving Benjamini–Hochberg admission (Benjamini & Hochberg, 1995) with percentile-bootstrap intervals (Efron, 1979); and 27 uncovered branch outcomes gained exact red-to-green cases. The workspace version is aligned to 0.2.0 across every crate manifest. - -### Added - -- **TDT/CHRONOS durable result contract**: canonical typed JSON and deterministic GraphML now export the actual bounded Allen reasoner result, observed/derived status, and conservative accepted-assertion support; canonical payload digest and `tdt_chronos_interval_consistency_v1` type bind the immutable bytes into ADR 0013's append-only `model_artifact` chain. -- **Analysis engine**: deterministic end-to-end analysis-run execution with cutoff-safe eligibility, immutable evidence binding, and reproducibility manifests (`analysis_engine` crate). -- **Restore Driver p.16 `MANIFESTVARstd`**: `recover_standardised_manifest_variance` maps `θ / θ = 1` with strictly positive `MANIFESTVAR`, refusing unstandardised manifest-variance, `MANIFESTTRAITVARstd`, and Equation 5 `Var(y)` substitutions (`psychometric_core`). -- **Posterior network estimator**: cross-draw Pearson correlations in ILR space, jackknife SE and CI, Benjamini–Hochberg FDR edge admission, nonparametric bootstrap stability, greedy modularity consensus clustering (`network_analysis` crate). -- **Topic measurement reference estimator**: bounded deterministic CPU `f64` TRSL-TM fitting with ALR/ILR coordinates, Aitchison distance, and lexical-inferential-weight refusal gates (`topic_measurement` crate). -- **Psychometric core**: Driver et al. (2017) SDE discrete-time recovery suite including drift, diffusion, T0VAR, TIPRED/TDPRED effects, standardised parameters, trait/state variance decomposition, and observed-indicator mapping — 18 K lines of production Rust with true-parameter RMSE tests. -- **Temporal six-clock architecture**: system, event, assertion, document, availability, and knowledge-cutoff clocks with forward-only transition enforcement and revision ordering (`temporal_core` + dedicated clock crates). -- **Membership and relation boundaries**: episode membership, role contradiction, relation absence detection, support-edge refusal, inferred-status gate, payload bounds, outcome ordering, summarises-edge identity, copy identity, citation/support non-transition, retrospective reporting, intake authorization, provider receipt, encrypted identity mapping, derived sensitivity inheritance, and purpose-bound PII governance. -- **Interpretation gateway**: loopback HTTP listener serving contextual-orchestrator interpretation POSTs with evidence-bound LLM claims and numerical-authority refusal. -- **Compute backend**: VRAM budget types with CPU `f64` fallback policy. -- **Persistence**: bitemporal PostgreSQL store with live sqlx integration, concurrent-write SQLSTATE classification, entity/project fail-closed SQL, audit-event inspection through try_record, and retention lifecycle. -- **Validation**: exact-head claim promotion gates, corpus-split leakage-audit manifests, documentation quality validation, and scientific claim boundary contracts. - -### Changed - -- Consolidated 99 open pull requests into protected main through batch integration vehicle (#215), hourly scheduler independent merges, and individual rebase-admin passes. -- Workspace grew from 10 to 57 crates covering evidence, semantic, temporal, event, relation, membership, persistence, simulation, validation, API, topic measurement, psychometric, network, interpretation, compute, and analysis-engine boundaries. -- All database objects use two-or-more-word `snake_case`; third normal form enforced; hot-partition readiness tracked as a separate acceptance gate. - -### Security - -- Purpose-bound authorization grants; blanket PII masking refused in favour of selective disclosure. -- Identity mappings sealed with HMAC; re-identification exports restricted to explicit purpose grants. -- Tenant roles bound to system-time lifetimes; privileged-access decisions replayed without source identity. -- Provider field codes recorded without source text; sensitivity inherited onto derived artifacts. +TEPP currently has **no GitHub release**. A source-version heading or historical changelog entry is not release evidence; protected-main state, exact-head gates, reproducible provenance/SBOM, scientific recovery, and required released integration contracts govern release claims. ## [Unreleased] ### Changed -- Delivery-authority recovery vehicle (#435 / #175) now records the live 2026-09-01T10:19:29Z queue as **136** open PRs (91 draft, 45 non-draft) on protected main `1bc02f580cf48e1d39da239f0e818453437c31c3`. Scientifically unsafe #356 is closed without merge. Longitudinal repair #441 advanced to `6f483224b3a03e8237c6f4f098a8b0e85e0a91f5` and is classified as a landing-vehicle candidate, not merge authority. Export-collection CLI #444 is classified `fold_into_landing_vehicle`. Queued checks remain non-passing. - -- `event_core` adds bounded Allen interval-consistency classification, atomic path-consistency closure, contradiction/resource refusals, and an explicit dependency-error fallback without claiming unrestricted global satisfiability. - -- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, Table 2, p. 12 `MANIFESTTRAITVAR`; §7.1, p. 19; p. 16 `MANIFESTTRAITVARstd`; footnote 4; 2017-era ctsem `summary.ctsemFit.R`; JSS PDF re-opened 2026-08-27T14:20Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar standardised manifest-trait variance on current main after `0ce16e8` dropped the pre-consolidation code while research notes already named the map (register items 83–84). Table 2 names `MANIFESTTRAITVAR` `Ψ_τ` the additional time-invariant variance-covariance on the measurement level and sets it `NULL` when there is no manifest trait. Equation 5 writes `Γ ~ N(τ, Ψ)` and names that covariance the manifest traits. Section 7.1 names manifest traits stable individual differences in indicator levels, distinct from process-level `TRAITVAR` `φ_ξ`. Page 16 prints standardised matrices with the suffix `std` when appropriate. The printed example on p. 16 is `discreteDRIFTstd`, not `MANIFESTTRAITVARstd`. Footnote 4 standardises using only the relevant variance, not the total. The relevant variance for that named indicator-level correlation is `MANIFESTTRAITVAR`, not process-level `TRAITVAR` and not residual `MANIFESTVAR` `θ`. The 2017-era source forms `MANIFESTTRAITVARstd` only when `MANIFESTTRAITVAR != 0`, as `solve(sqrt(diag(MANIFESTTRAITVAR) + ridging)) %&% MANIFESTTRAITVAR` when `verbose = TRUE`. OpenMx `%&%` is `t(A) %*% B %*% A`. Unlike `TRAITVARstd`, that formation adds `diag(c(ridging), n.manifest)`. The default `ridging = FALSE` adds 0, not `0.0001`; that ridge is a numerical hack and is not this exact map. The scalar correlation is `ψ / ψ = 1` after strictly positive `MANIFESTTRAITVAR`. Form strictly positive `ψ` first, then `1 / √ψ`, then `(1 / √ψ) ψ (1 / √ψ)`. Unstandardised `MANIFESTTRAITVAR` is defined for a zero trait; standardised `MANIFESTTRAITVAR` is not. Zero `MANIFESTTRAITVAR` skips forming `MANIFESTTRAITVARstd` in the 2017-era source and fails closed here. Indicator-level trait variance is an event-time structural quantity, so a non-event clock fails closed. `MANIFESTTRAITVAR` does not require stable `a < 0`. Distinct positive `ψ` recover the same 1. `trait / trait = 1` is `TRAITVARstd` and recovers the same number and remains a distinct named quantity. `θ` is `MANIFESTVAR` and is measurement error, not this correlation. Meredith (1993) remains unread (web search 2026-08-27T14:20Z: Springer/Cambridge Core paywalled; Unpaywall historically `is_oa: false`; Springer `content/pdf` is an HTML stub). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread on the same terms (DOI `10.1007/bf02294457`). Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. - -- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, Table 2, p. 12 `TRAITVAR`; §7.1, pp. 18–19; p. 16 `TRAITVARstd`; footnote 4; 2017-era ctsem `summary.ctsemFit.R`; JSS PDF re-opened 2026-08-26T17:45Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar standardised trait variance on current main after `0ce16e8` dropped the pre-consolidation code while research notes already named the map (register items 81–82). Table 2 names `TRAITVAR` `φ_ξ` the latent trait variance/covariance and sets it `NULL` when there is no trait. Section 7.1 names traits the stable between-subject differences (unit-level unobserved heterogeneity). Page 16 prints standardised matrices with the suffix `std` when appropriate. The printed example on p. 16 is `discreteDRIFTstd`, not `TRAITVARstd`. Footnote 4 standardises using only the relevant variance, not the total. The relevant variance for that named between-subject correlation is `TRAITVAR`, not free first-occasion `T0VAR` and not process-dynamics `asymDIFFUSION`. The 2017-era source forms `TRAITVARstd` only when `TRAITVAR != 0`, as `solve(sqrt(diag(TRAITVAR))) %&% TRAITVAR` when `verbose = TRUE`. OpenMx `%&%` is `t(A) %*% B %*% A`. Unlike `T0VARstd`, that formation uses `diag(diag(TRAITVAR))` and does not add `diag(c(ridging))`. The ridge is a `T0VAR` numerical hack and is not this exact map. The scalar correlation is `trait / trait = 1` after strictly positive `TRAITVAR`. Form strictly positive `trait` first, then `1 / √trait`, then `(1 / √trait) trait (1 / √trait)`. Unstandardised `TRAITVAR` is defined for a zero trait; standardised `TRAITVAR` is not. Zero `TRAITVAR` skips forming `TRAITVARstd` in the 2017-era source and fails closed here. Between-subject variance is an event-time structural quantity, so a non-event clock fails closed. `TRAITVAR` does not require stable `a < 0`. Distinct positive `trait` recover the same 1. `p_0 / p_0 = 1` is `T0VARstd` and recovers the same number and remains a distinct named quantity. `t0_b² v` is `addedT0TIPREDVAR` and is extra first-occasion TI variance, not this correlation. Meredith (1993) remains unread (Unpaywall 2026-08-26T17:20Z: `is_oa: false`; OpenAlex closed; Springer `content/pdf` is an HTML stub). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread on the same terms (DOI `10.1007/bf02294457`; Unpaywall `is_oa: false`). Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. -- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, p. 16 `asymDIFFUSIONstd`; footnote 4; Eq. 4, p. 5; Table 2, p. 12; 2017-era ctsem `summary.ctsemFit.R`; JSS PDF re-opened 2026-08-26T17:20Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar standardised asymptotic within-subject variance on current main after `0ce16e8` dropped the pre-consolidation code while research notes already named the map (register items 89–90). Page 16 prints standardised matrices with the suffix `std` when appropriate, and names `asymDIFFUSION` the total within-subject variance as `Δt → ∞`. The printed example on p. 16 is `discreteDRIFTstd`, not `asymDIFFUSIONstd`. Footnote 4 standardises using only the relevant variance, not the total. The relevant variance for that named process-dynamics correlation is within-subject `asymDIFFUSION` `p = −q / (2 a)`, not free first-occasion `T0VAR`. The 2017-era source forms `asymDIFFUSIONstd` as `solve(sqrt(diag(asymDIFFUSION))) %&% asymDIFFUSION` when `verbose = TRUE`. OpenMx `%&%` is `t(A) %*% B %*% A`. The default `ridging = FALSE` adds 0, not `0.0001`; that ridge is a numerical hack and is not this exact map. The scalar correlation is `p / p = 1` after strictly positive `p`. Form strictly positive `p` first, then `1 / √p`, then `(1 / √p) p (1 / √p)`. Unstandardised `p` is defined for a zero process; standardised `asymDIFFUSION` is not. Zero `q` has no positive SD and fails closed. Lasting `p` requires stable `a < 0`. A non-event clock fails closed. Distinct positive `p` recover the same 1. `p_0 / p_0 = 1` is `T0VARstd` and recovers the same number and remains a distinct named quantity. `q / p = −2 a` is `DIFFUSIONstd` and is not this correlation. `v / v = 1` is `TIPREDVARstd` and recovers the same number and remains a distinct named quantity. Meredith (1993) remains unread (Unpaywall 2026-08-26T17:20Z: `is_oa: false`; OpenAlex closed; Springer `content/pdf` is an HTML stub). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread on the same terms (DOI `10.1007/bf02294457`; Unpaywall `is_oa: false`). Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. -- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, p. 16 `T0VARstd`; Table 2, p. 12; footnote 4; 2017-era ctsem `summary.ctsemFit.R`; JSS PDF re-opened 2026-08-26T07:17Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar standardised initial latent variance on current main after `0ce16e8` dropped the pre-consolidation code while research notes already named the map (register items 79–80). Page 16 prints standardised matrices with the suffix `std` when appropriate. The printed example on p. 16 is `discreteDRIFTstd`, not `T0VARstd`. Footnote 4 standardises using only the relevant variance, not the total. Table 2 names `T0VAR` the latent process initial variance/covariance. The first-occasion relevant variance is free `T0VAR` `p_0`, not process-dynamics `asymDIFFUSION` `-q / (2 a)`. The 2017-era source forms `T0VARstd` as `solve(sqrt(diag(T0VAR))) %&% T0VAR` when `verbose = TRUE`. OpenMx `%&%` is `t(A) %*% B %*% A`. The default `ridging = FALSE` adds 0, not `0.0001`; that ridge is a numerical hack and is not this exact map. The scalar correlation is `p_0 / p_0 = 1` after strictly positive `p_0`. Form strictly positive `p_0` first, then `1 / √p_0`, then `(1 / √p_0) p_0 (1 / √p_0)`. A zero first-occasion variance has no positive SD and fails closed. `T0` is an event-time occasion, so a non-event clock fails closed. Free `T0VAR` does not require stable `a < 0`. Distinct positive `p_0` recover the same 1. `μ_0 / √p_0` is `T0MEANSstd` and recovers the same number when `μ_0 = √p_0` and remains a distinct named quantity. `p / p = 1` is `asymDIFFUSIONstd` and recovers the same number and remains a distinct named quantity. Meredith (1993) remains unread (Unpaywall 2026-08-26T07:17Z: `is_oa: false`; OpenAlex closed; Springer `content/pdf` is a 3038-byte HTML stub). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread on the same terms (DOI `10.1007/bf02294457`; Unpaywall `is_oa: false`). Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. -- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, p. 16 `asymCINTstd`; Eq. 3, p. 4; Table 2, p. 12; footnote 4; 2017-era ctsem `summary.ctsemFit.R`; JSS PDF re-opened 2026-08-26T00:20Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar standardised asymptotic continuous intercept on current main after consolidation dropped the pre-consolidation `(-κ / a) / √p` slice. Page 16 prints standardised matrices with the suffix `std` when appropriate, and asymptotic values as `Δt → ∞`. Footnote 4 standardises using only the relevant variance, not the total. Table 2 names `κ` `CINT`. The relevant variance for that process intercept is within-subject `asymDIFFUSION` `p = −q / (2 a)`. The 2017-era source forms unstandardised `asymCINT` whenever `verbose = TRUE` as `-solve(DRIFT) %*% CINT` and does not form an `asymCINTstd` matrix. Form strictly positive `p` first, then the asymptotic intercept, then divide by `√p`. A zero intercept is exactly zero after that positive SD. Zero `q` has no positive process SD and fails closed. Lasting `p` requires stable `a < 0`. A non-event clock fails closed. `κ / √p` is `CINTstd` and is not this total-change map. `A^{-1}[e^{A Δt} − I] κ / √p` is `discreteCINTstd` and depends on the event interval. Meredith (1993) remains unread (Unpaywall 2026-08-25T18:22Z: `is_oa: false`; Springer `content/pdf` is a 3038-byte HTML stub). Mislevy (1991) remains unread on the same terms. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. -- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, p. 16 `T0MEANSstd`; Table 2, p. 12; footnote 4; 2017-era ctsem `summary.ctsemFit.R`; JSS PDF re-opened 2026-08-26T04:09Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar standardised initial latent mean on current main after `0ce16e8` dropped the pre-consolidation code while research notes already named the map. Page 16 prints standardised matrices with the suffix `std` when appropriate. Footnote 4 standardises using only the relevant variance, not the total. Table 2 names `T0MEANS` the `n.latent × 1` matrix of latent process means at the first time point `T0` and names `T0VAR` the latent process initial variance/covariance. The first-occasion relevant variance is free `T0VAR` `p_0`, not process-dynamics `asymDIFFUSION` `-q / (2 a)`. The 2017-era source forms unstandardised `T0MEANS` and does not form a `T0MEANSstd` matrix; the scalar map is `μ_0 / √p_0` after strictly positive `p_0`. A zero mean is exactly zero. Zero `p_0` has no positive SD and fails closed. `T0` is an event-time occasion, so a non-event clock fails closed. Free `T0MEANS` does not require stable `a < 0`. `p_0 / p_0 = 1` recovers the same number when `μ_0 = √p_0` and remains a distinct named quantity. `μ_0 / √asymDIFFUSION` uses process-dynamics variance and is not this first-occasion map. Meredith (1993) remains unread (Unpaywall 2026-08-26T00:22Z: `is_oa: false`; OpenAlex closed; Springer `content/pdf` is a 3038-byte HTML stub). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread on the same terms. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. -- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, p. 16 `MANIFESTMEANSstd`; Table 2, p. 12; footnote 4; Eq. 5, p. 5; 2017-era ctsem `summary.ctsemFit.R`; JSS PDF re-opened 2026-08-25T11:32Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar standardised manifest mean on current main after `0ce16e8` restored the pre-consolidation unstandardised slice. Page 16 prints standardised matrices with the suffix `std` when appropriate. Footnote 4 standardises using only the relevant variance, not the total. Table 2 names `MANIFESTMEANS` `τ` the `n.manifest × 1` matrix of manifest means and `MANIFESTVAR` `Θ` the residual covariance of the indicators. The relevant variance for that named measurement intercept is residual `θ`, not total observed `Var(y) = λ² Var(η) + θ`. The 2017-era source forms unstandardised `MANIFESTMEANS` and does not form a `MANIFESTMEANSstd` matrix; the scalar map is `τ / √θ` after strictly positive `θ`. A zero mean is exactly zero. Zero `θ` has no positive SD and fails closed. A non-event clock fails closed. `MANIFESTMEANS` does not require stable `a < 0`. `θ / θ = 1` recovers the same number when `τ = √θ` and remains a distinct named quantity. `τ / √(λ² Var(η) + θ)` uses total observed variance and is not this residual map. Meredith (1993) remains unread (Unpaywall 2026-08-25T11:32Z: `is_oa: false`, 0 locations; OpenAlex closed; Springer `content/pdf` is a 3038-byte HTML stub). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-25T11:32Z: `is_oa: false`, 0 locations). Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. -- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, p. 16 `CINTstd`; Eq. 1, p. 4; Table 2, p. 12; footnote 4; §7.1, pp. 18–19; JSS PDF re-opened 2026-08-25T11:43Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar standardised continuous intercept on current main after consolidation dropped the pre-consolidation `κ / √p` slice. Page 16 prints standardised matrices with the suffix `std` when appropriate. Footnote 4 standardises using only the relevant variance, not the total. Table 2 names `κ` `CINT`. The relevant variance for that process intercept is within-subject `asymDIFFUSION` `p = −q / (2 a)`, not total `trait + p + added`. Form strictly positive `p` first, then `κ / √p`. A zero intercept is exactly zero after that positive SD. Zero `q` has no positive process SD and fails closed. Lasting `p` requires stable `a < 0`. A non-event clock fails closed. `(-κ / a) / √p` is `asymCINTstd` and is not this continuous intercept. `A^{-1}[e^{A Δt} − I] κ / √p` is `discreteCINTstd` and depends on the event interval. `κ / √(trait + p + added)` uses the total and is not this residual map. `TRAITVAR` is not the standardisation variance. Meredith (1993) remains unread (Unpaywall 2026-08-25T11:43Z: `is_oa: false`; Springer `content/pdf` is a 3038-byte HTML stub). Mislevy (1991) remains unread on the same terms. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. -- Operator-gap register refreshed against protected main `c482ccea` (#239): workspace version 0.2.0, 57 crates, queue at seven open PRs with exact-head SHAs, issues #156/#168/#175 closed, GAP-009 advanced to estimator-core-plus-repairs with Leiden consensus remaining, GAP-001/GAP-012/GAP-017 closed on protected main, and a new Post-#239 state note recording both the estimator repairs and the non-release status of the version bump. Supersedes #236 whose base predated #239. -- `event_core` `EventMention` is the only constructible mention type and must be span-grounded: it cites one exact `SourceSpan`, document identity, six-clock evidence, extractor/model version, and proposed/reviewed status, and the surface is the document substring at that span. Exact-extent precision/recall recover known ACE extents with occupancy RMSE 0 versus whole-document RMSE 1; reviewed status and TDT/CHRONOS detections still cannot promote an instance. Interval consistency, persistence, and exports remain later #170 work. -- Restored protected-main gate integrity after the consolidation merges: hourly-scheduler prompt-contract tests now assert the gap-baseline-derived task contract (Gap ID naming, no invented weights) instead of stale increment-specific tokens, the operator-gap register inventory matches the live 33-PR queue, `evidence_core::image_unit` non-image/empty-subtype refusals and `load_union_branch_totals` valid-record accumulation have exact coverage, and the README crate fence plus duplicate registry entries stay deduped. -- Branch-coverage diagnostics on the post-consolidation head exposed two uncovered outcomes in `evidence_core::image_unit` (`is_image_media_type_token` non-image prefix and empty-subtype refusals), one uncovered authored line (the strip-prefix refusal), and lost valid-record coverage for `load_union_branch_totals`; exact red-to-green cases now cover the non-image/empty-subtype data URIs and per-coordinate True/False accumulation. -- Repaired post-consolidation merge fallout that left protected `main` red: restored the lost `return True` in the `check_coverage.py` match-guard branch, removed the shadowed duplicate `load_union_branch_totals` and `_is_multiline_match_guard` definitions plus duplicate workspace-crate entries (`episode_membership`, `analysis_engine`) from the contract tuple and Cargo member arrays, split two union-fused four-tuples back into `(variant, message)` pairs in the `event_core` error table, repaired the fused `identity_recovery_rate` body in `episode_membership::window`, deduplicated the checked-arithmetic eligible-count block in `analysis_engine`, fixed four-argument `unit()` test call sites, rebalanced the README crate-list fence around all 54 unique crates, and deduplicated the `location_membership`/`validation_core`/`tepp_api` architecture-table rows. Also documents private `PLAUSIBLE_IMAGE_MEDIA_TYPES` so `cargo doc -D warnings` passes. -- Branch coverage JSON now unique-folds `files[].branches` True/False counts across instantiations. Nightly totals on #49 head `1e3e2eb` reported `event_time.rs` 505/506 while every unique site had both arms taken (253 sites × 2 instantiations). Summary-only reports without branch arrays still fail closed on totals. The 100% contract is unique production arms, matching the LCOV authored-line gate. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. -- `psychometric_core` maps overflowing `expm1(a Δt)` / `expm1(2 a Δt)` in `recover_discrete_constant_predictor_effect` and `recover_discrete_process_noise` through the log-space rewrite without a redundant `if !argument.is_finite()` after overflow. Local crate llvm-cov on #49 head `559e7b399473ee90ba3234677dd9ef7f05f7fd2e` was 509/510: the same LLVM `exp`/`expm1` finite-argument proof as L768/L5040. Existing rewrite (`a = 800` / `a = 400`) and overflow (`a = 1e308`) tests remain the contract. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. -- `psychometric_core` maps overflowing `e^{a Δt}` / `e^{a(t−u)}` through the log-space rewrite without redundant `if !argument.is_finite()` after `exp` overflow on lagged covariance, T0 TI/TD carry, and impulse carry. Nightly branch coverage on #49 head `7e669babcc54408dd8407bbac56be0f304fa99e5` was 1713/1714: LLVM counted `event_time.rs` L5040 True and treated the finite-argument overflow False as uncovered after proving `exp` of a finite argument is finite, which binary64 overflow falsifies. `fit_scalar_log_rate` now also skips a zero earlier residual and a negative lag while still recovering from a valid pair. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. -- `psychometric_core` maps overflowing `e^{2 a Δt}` in `recover_discrete_latent_variance` through the log-space rewrite `(ln p + 2 a Δt).exp()` without a redundant `if !2 a Δt.is_finite()` after `exp` overflow. Nightly branch coverage on #49 head `e301e9706c0bd671ccad533063fb624cc568d0b3` was 1715/1716: LLVM counted `event_time.rs` L768 True and treated the finite-argument overflow False as uncovered after proving `exp` of a finite argument is finite, which binary64 overflow falsifies. Existing rewrite (`p = 1e-308`, `a = 400`, `Δt = 1`) and overflow (`a = 1e308`) tests remain the contract. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. -- `psychometric_core` executes the later `|| !log_rate.is_finite()` operand on `recover_discrete_time_independent_predictor_effect` from both the lib tests and the multilevel integration crate. Nightly branch coverage on #49 head `90b08bbe82cbe7776365a6c04df38857dfe5e53c` was 1714/1716: both True arms at `event_time.rs` L2480 were unhit because fail-closed tests supplied a non-finite `TIPREDEFFECT` or predictor before `a`. Direct `a = NaN` now takes those arms. `LagClock::as_str` is called through `black_box` so the outlined instantiation is not const-folded away. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. -- `psychometric_core` evaluates the Driver, Oud, and Voelkle (2017, §7.2) extra-process lag as `e^{ε Δt}` even when `ε Δt` underflows to `0` (`exp(0) = 1`). Nightly branch coverage on #49 head `22b8e68813ad59a9a91689bacfa4cf033dfad158` was 1718/1720: LLVM deleted `if extra_argument == 0.0` / `original_argument == 0.0` True after proving `ε < 0` and `Δt > 0` imply a nonzero product, which binary64 underflow falsifies. The public map now uses `exp` directly; `original_log_rate == 0` remains the Brownian `e^{0} = 1` path. Recovery tests assert the §7.2 identity `a_{ηξ} x e^{a Δt}(e^{(ε−a)Δt} − 1)/(ε − a)` on `(-min_subnormal) * 1e-320`. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. -- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, p. 16 `MANIFESTMEANSstd`; Table 2, p. 12; footnote 4; Eq. 5, p. 5; 2017-era ctsem `summary.ctsemFit.R`; JSS PDF re-opened 2026-08-25T05:04Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar standardised manifest mean. Page 16 prints standardised matrices with the suffix `std` when appropriate. Footnote 4 standardises using only the relevant variance, not the total. Table 2 names `MANIFESTMEANS` `τ` the `n.manifest × 1` matrix of manifest means. Table 2 names `MANIFESTVAR` `Θ` the residual covariance of the indicators. The relevant variance for that named measurement intercept is residual `MANIFESTVAR` `θ`, not total observed `Var(y) = λ² Var(η) + θ`, matching `MANIFESTVARstd`. The 2017-era `summary.ctsemFit.R` forms unstandardised `MANIFESTMEANS` as `mxEval(MANIFESTMEANS, mxobj, compute=TRUE)`. That source does not form a `MANIFESTMEANSstd` matrix; the scalar map here is the footnote 4 standardisation of that named intercept: `τ / √θ`. Form strictly positive `θ` first, then divide `τ` by `√θ`. A zero mean is exactly zero. Unstandardised `MANIFESTMEANS` is defined for a zero residual; standardised `MANIFESTMEANS` is not. Zero `θ` has no positive SD and fails closed. Manifest means are an event-time measurement quantity, so a non-event clock fails closed. `MANIFESTMEANS` does not require stable `a < 0`. `MANIFESTVARstd` `θ / θ = 1` recovers the same number when `τ = √θ` and remains a distinct named quantity. `τ / √(λ² Var(η) + θ)` uses total observed variance and is not this residual map. The 2017-era source assigns `dimnames(MANIFESTMEANS)` to `list(manifestNames, manifestNames)` on an `n.manifest × 1` matrix; that assignment is a source bug and is not this map. `T0MEANSstd` `μ_0 / √p_0` recovers the same number when `τ = μ_0` and `θ = p_0` and remains a distinct named quantity. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall 2026-08-25T05:04Z: `is_oa: false`, 0 locations; title *Measurement Invariance, Factor Analysis and Factorial Invariance*). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-25T05:04Z: `is_oa: false`, 0 locations; title *Randomization-Based Inference about Latent Variables from Complex Samples*). -- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, p. 16 `T0MEANSstd`; Table 2, p. 12; footnote 4; 2017-era ctsem `summary.ctsemFit.R`; JSS PDF re-opened 2026-08-24T22:30Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar standardised initial latent mean. Page 16 prints standardised matrices with the suffix `std` when appropriate. Footnote 4 standardises using only the relevant variance, not the total. Table 2 names `T0MEANS` the latent process means at the first time point `T0`. The first-occasion relevant variance is free `T0VAR` `p_0`, not process-dynamics `asymDIFFUSION` `-q / (2 a)`, matching Table 3 `T0TIPREDEFFECTstd`. The 2017-era `summary.ctsemFit.R` forms unstandardised `T0MEANS` as `OpenMx::mxEval(T0MEANS, mxobj, compute=TRUE)`. That source does not form a `T0MEANSstd` matrix; the scalar map here is the footnote 4 standardisation of that named first-occasion mean: `μ_0 / √p_0`. Form strictly positive `p_0` first, then divide `μ_0` by `√p_0`. A zero mean is exactly zero. Unstandardised `T0MEANS` is defined for a zero first-occasion variance; standardised `T0MEANS` is not. Zero `p_0` has no positive SD and fails closed. `T0` is an event-time occasion, so a non-event clock fails closed. Free `T0MEANS` does not require stable `a < 0`. `T0VARstd` `p_0 / p_0 = 1` recovers the same number when `μ_0 = √p_0` and remains a distinct named quantity. `μ_0 / √asymDIFFUSION` uses process-dynamics variance and is not this first-occasion map. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall 2026-08-24T08:02Z: `is_oa: false`, 0 locations; title *Measurement Invariance, Factor Analysis and Factorial Invariance*). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-24T08:02Z: `is_oa: false`, 0 locations; title *Randomization-Based Inference about Latent Variables from Complex Samples*). -- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, p. 16 `asymCINTstd`; Eq. 3, p. 4; footnote 4; Table 2, p. 12; 2017-era ctsem `summary.ctsemFit.R`; JSS PDF re-opened 2026-08-24T09:05Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar standardised asymptotic continuous intercept. Page 16 prints standardised matrices with the suffix `std` when appropriate. Footnote 4 standardises using only the relevant variance, not the total. `CINT` is the process intercept of individual, or average individual, dynamics, so that relevant variance is within-subject `asymDIFFUSION` `p = −q / (2 a)`. The 2017-era `summary.ctsemFit.R` forms `asymCINT` whenever `verbose = TRUE`, as `-solve(DRIFT) %*% CINT`. That source does not form an `asymCINTstd` matrix; the scalar map here is the footnote 4 standardisation of that named asymptotic intercept: `(-κ / a) / √p`. Form strictly positive `p` first, then the asymptotic intercept, then divide by `√p`. A zero intercept is exactly zero. Unstandardised `asymCINT` is defined for a zero process; standardised `asymCINT` is not. Zero `q` has no positive process SD and fails closed. Lasting `asymDIFFUSION` requires stable `a < 0`. A non-event clock fails closed. `κ / √p` is the continuous intercept standardisation and is not this total-change map. `A^{-1}[e^{A Δt} − I] κ / √p` depends on the event interval and is not this `Δt → ∞` map. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, not `CINTstd`, not `discreteCINTstd`, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall 2026-08-24T08:02Z: `is_oa: false`, 0 locations; title *Measurement Invariance, Factor Analysis and Factorial Invariance*). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-24T08:02Z: `is_oa: false`, 0 locations; title *Randomization-Based Inference about Latent Variables from Complex Samples*). -- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, p. 16 `discreteCINTstd`; Eq. 3, p. 4; footnote 4; Table 2, p. 12; 2017-era ctsem `summary.ctsemFit.R`; JSS PDF re-opened 2026-08-24T05:20Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar standardised discrete continuous intercept. Page 16 prints discrete-time transformations for a chosen event interval and, when appropriate, standardised matrices with the suffix `std`. Footnote 4 standardises using only the relevant variance, not the total. `CINT` is the process intercept of individual, or average individual, dynamics, so that relevant variance is within-subject `asymDIFFUSION` `p = −q / (2 a)`. The 2017-era `summary.ctsemFit.R` forms `discreteCINT` whenever `verbose = TRUE`, as `solve(DRIFT) %*% (discreteDRIFT − I) %*% CINT`. That source does not form a `discreteCINTstd` matrix; the scalar map here is the footnote 4 standardisation of that named discrete intercept: `A^{-1}[e^{A Δt} − I] κ / √p`. Form strictly positive `p` first, then the discrete intercept, then divide by `√p`. A zero intercept is exactly zero. Unstandardised `discreteCINT` is defined for growing `a ≥ 0` and for zero diffusion; standardised `discreteCINT` is not. Zero `q` has no positive process SD and fails closed. Lasting `asymDIFFUSION` requires stable `a < 0`. A non-event clock fails closed. A non-positive event interval fails closed. `κ / √p` does not depend on `Δt` and is not this finite-interval map. `(-κ / a) / √p` is the standardised asymptotic intercept and is not this map. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, not `CINTstd`, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall 2026-08-24T08:02Z: `is_oa: false`, 0 locations; title *Measurement Invariance, Factor Analysis and Factorial Invariance*). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-24T08:02Z: `is_oa: false`, 0 locations; title *Randomization-Based Inference about Latent Variables from Complex Samples*). -- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, p. 16 `asymDIFFUSIONstd`; footnote 4; Eq. 4; 2017-era ctsem `summary.ctsemFit.R`; JSS PDF re-opened 2026-08-23T23:02Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar standardised asymptotic within-subject variance. Page 16 names `asymDIFFUSION` the total within-subject variance as `Δt → ∞` and prints standardised matrices with the suffix `std` when appropriate. Footnote 4 standardises using only the relevant variance, not the total. The 2017-era `summary.ctsemFit.R` forms `asymDIFFUSIONstd` whenever `verbose = TRUE`, as `solve(sqrt(diag(asymDIFFUSION) + ridging)) %&% asymDIFFUSION`. OpenMx `%&%` is the quadratic form `t(A) %*% B %*% A`. That formation adds `diag(c(ridging), n.latent)`. The default `ridging = FALSE` adds 0, not `0.0001`; that ridge is a numerical hack and is not this exact map. The 2017-era source assigns `dimnames(asymDIFFUSIONstd)` to `latentNames`; that assignment matches the `n.latent × n.latent` matrix and is this map. The scalar correlation is `p / p = 1` after strictly positive Lyapunov `p = −q / (2 a)`. Form strictly positive `p` first, then `1 / √p`, then `(1 / √p) p (1 / √p)`. Unstandardised `asymDIFFUSION` is defined for a zero process; standardised `asymDIFFUSION` is not. Zero `q` makes `solve(sqrt(0))` fail in the 2017-era source and fails closed here. That source does not skip forming `asymDIFFUSIONstd` when `p = 0`. Within-subject variance is an event-time structural quantity, so a non-event clock fails closed. Lasting `asymDIFFUSION` requires stable `a < 0`. Distinct positive `p` recover the same 1. `TIPREDVARstd` `v / v = 1` recovers the same number and remains a distinct named quantity. `DIFFUSIONstd` `q / p = −2 a` is the continuous-diffusion ratio, not this correlation. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall 2026-08-24T08:02Z: `is_oa: false`, 0 locations; title *Measurement Invariance, Factor Analysis and Factorial Invariance*). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-24T08:02Z: `is_oa: false`, 0 locations; title *Randomization-Based Inference about Latent Variables from Complex Samples*). -- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, Table 2, p. 12 `TIPREDVAR`; p. 16 `TIPREDVARstd`; footnote 4; 2017-era ctsem `summary.ctsemFit.R`; JSS PDF re-opened 2026-08-23T22:53Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar standardised time-independent predictor variance. Table 2 names `TIPREDVAR` the variance/covariance of time-independent predictors. Page 16 prints standardised matrices with the suffix `std` when appropriate. The 2017-era `summary.ctsemFit.R` forms `TIPREDVARstd` whenever `verbose = TRUE` and `n.TIpred > 0`, as `solve(sqrt(diag(TIPREDVAR) + ridging)) %&% TIPREDVAR`. OpenMx `%&%` is the quadratic form `t(A) %*% B %*% A`. Unlike `TRAITVARstd`, that formation adds `diag(c(ridging), n.TIpred)`. The default `ridging = FALSE` adds 0, not `0.0001`; that ridge is a numerical hack and is not this exact map. The 2017-era source assigns `dimnames(TIPREDVARstd)` to `TIpredNames`; that assignment matches the `n.TIpred × n.TIpred` matrix and is this map. The scalar correlation is `v / v = 1` after strictly positive `TIPREDVAR`. Form strictly positive `v` first, then `1 / √v`, then `(1 / √v) v (1 / √v)`. Unstandardised `TIPREDVAR` is defined for a zero predictor; standardised `TIPREDVAR` is not. Zero `v` makes `solve(sqrt(0))` fail in the 2017-era source and fails closed here. Unlike `TRAITVAR` / `MANIFESTTRAITVAR`, that source does not skip forming `TIPREDVARstd` when `v = 0`. Predictor variance is an event-time structural quantity, so a non-event clock fails closed. `TIPREDVAR` does not require stable `a < 0`. Distinct positive `v` recover the same 1. `MANIFESTVARstd` `θ / θ = 1` recovers the same number and remains a distinct named quantity. Section 7.2 `addedTIPREDVAR` `(B / a)² v` is extra process variance, not this correlation. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall 2026-08-23T22:21Z: `is_oa: false`; title *Measurement Invariance, Factor Analysis and Factorial Invariance*). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-23T22:21Z: `is_oa: false`; title *Randomization-Based Inference about Latent Variables from Complex Samples*). -- `psychometric_core` recovers Equation 5 of the scalar analog of Driver, Oud, and Voelkle (2017, Eq. 5, p. 5; Table 2, p. 12 `TDPREDVAR` / `T0TDPREDCOV`; Table 3, p. 13 `T0TIPREDEFFECT`; p. 16; §7.2, pp. 20–21; 2017-era ctsem `summary.ctsemFit.R`; JSS PDF re-opened 2026-08-23T22:26Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) extra first-occasion time-dependent predictor variance. Equation 5 writes `y_i(t) = Γ + Λ η_i(t) + ζ_i(t)` with `ζ ~ N(0, Θ)` and `Γ ~ N(τ, Ψ)`. The 2017-era `summary.ctsemFit.R` forms the latent extra `addedT0TIPREDVAR` as `T0TIPREDEFFECT %*% TIPREDVAR %*% t(T0TIPREDEFFECT)` immediately after `T0TIPREDEFFECTstd`. That file comments out `TDPREDVAR` and does not form `addedT0TDPREDVAR`. The scalar analog of that quadratic form using the stack's first-occasion TD coefficient `t0_m` and Table 2 `TDPREDVAR` `v` is `t0_m² v`. Equation 5 of that analog extra, with `θ = 0` and `ψ = 0`, is `λ² t0_m² v`. Form the analog extra first, then `(λ extra) λ`. Do not form `λ²` first. A zero loading or zero extra is exactly zero. `v < 0` fails closed. `T0` is an event-time occasion, so a non-event clock fails closed. Free `t0_m` does not require stable `a < 0`. `t0_m² v` is the latent extra, not this observed extra. `λ² p_0 + θ` is first-occasion observed variance, not this extra. `λ² t0_b² v` is Eq. 5 of `addedT0TIPREDVAR` and is not this extra even when `t0_m = t0_b`. `MANIFESTVAR` `θ` is measurement error, not this extra. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall 2026-08-23T22:26Z: `is_oa: false`; title *Measurement Invariance, Factor Analysis and Factorial Invariance*). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-23T22:26Z: `is_oa: false`; title *Randomization-Based Inference about Latent Variables from Complex Samples*). -- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, Table 2, p. 12 `MANIFESTVAR`; Eq. 5, p. 5; p. 16 `MANIFESTVARstd`; footnote 4; 2017-era ctsem `summary.ctsemFit.R`; JSS PDF re-opened 2026-08-23T22:40Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar standardised measurement-error variance. Table 2 names `MANIFESTVAR` `Θ` the residual covariance of the indicators. Equation 5 writes `ζ ~ N(0, Θ)`. Page 16 prints standardised matrices with the suffix `std` when appropriate. The 2017-era `summary.ctsemFit.R` forms `MANIFESTVARstd` whenever `verbose = TRUE`, as `solve(sqrt(diag(MANIFESTVAR) + ridging)) %&% MANIFESTVAR`. OpenMx `%&%` is the quadratic form `t(A) %*% B %*% A`. Unlike `TRAITVARstd`, that formation adds `diag(c(ridging), n.manifest)`. The default `ridging = FALSE` adds 0, not `0.0001`; that ridge is a numerical hack and is not this exact map. The 2017-era source assigns `dimnames(MANIFESTVARstd)` to `latentNames`; the matrix is `n.manifest × n.manifest`. That assignment is a source bug and is not this exact map. The scalar correlation is `θ / θ = 1` after strictly positive `MANIFESTVAR`. Form strictly positive `θ` first, then `1 / √θ`, then `(1 / √θ) θ (1 / √θ)`. Unstandardised `MANIFESTVAR` is defined for a zero residual; standardised `MANIFESTVAR` is not. Zero `θ` makes `solve(sqrt(0))` fail in the 2017-era source and fails closed here. Unlike `TRAITVAR` / `MANIFESTTRAITVAR`, that source does not skip forming `MANIFESTVARstd` when `θ = 0`. Measurement-error variance is an event-time structural quantity, so a non-event clock fails closed. `MANIFESTVAR` does not require stable `a < 0`. Distinct positive `θ` recover the same 1. `MANIFESTTRAITVARstd` `ψ / ψ = 1` recovers the same number and remains a distinct named quantity. Equation 5 `λ² Var(η) + θ` is `Var(y)`, not this correlation. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall 2026-08-23T22:21Z: `is_oa: false`; title *Measurement Invariance, Factor Analysis and Factorial Invariance*). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-23T22:21Z: `is_oa: false`; title *Randomization-Based Inference about Latent Variables from Complex Samples*). -- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, Table 2, p. 12 `MANIFESTTRAITVAR`; §7.1, p. 19; p. 16 `MANIFESTTRAITVARstd`; footnote 4; 2017-era ctsem `summary.ctsemFit.R`; JSS PDF re-opened 2026-08-23T22:28Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar standardised manifest-trait variance. Table 2 names `MANIFESTTRAITVAR` `Ψ_τ` the additional time-invariant variance-covariance on the measurement level and sets it `NULL` when there is no manifest trait. Section 7.1 names manifest traits stable individual differences in indicator levels, distinct from process-level `TRAITVAR` `φ_ξ`. Page 16 prints standardised matrices with the suffix `std` when appropriate. The 2017-era `summary.ctsemFit.R` forms `MANIFESTTRAITVARstd` only when `MANIFESTTRAITVAR != 0`, as `solve(sqrt(diag(MANIFESTTRAITVAR) + ridging)) %&% MANIFESTTRAITVAR` when `verbose = TRUE`. OpenMx `%&%` is the quadratic form `t(A) %*% B %*% A`. Unlike `TRAITVARstd`, that formation adds `diag(c(ridging), n.manifest)`. The default `ridging = FALSE` adds 0, not `0.0001`; that ridge is a numerical hack and is not this exact map. The scalar correlation is `ψ / ψ = 1` after strictly positive `MANIFESTTRAITVAR`. Form strictly positive `ψ` first, then `1 / √ψ`, then `(1 / √ψ) ψ (1 / √ψ)`. Unstandardised `MANIFESTTRAITVAR` is defined for a zero trait; standardised `MANIFESTTRAITVAR` is not. Zero `MANIFESTTRAITVAR` skips forming `MANIFESTTRAITVARstd` in the 2017-era source and fails closed here. Indicator-level trait variance is an event-time structural quantity, so a non-event clock fails closed. `MANIFESTTRAITVAR` does not require stable `a < 0`. Distinct positive `ψ` recover the same 1. `TRAITVARstd` `trait / trait = 1` recovers the same number and remains a distinct named quantity. `MANIFESTVAR` `θ` is measurement error, not this correlation. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall 2026-08-23T22:21Z: `is_oa: false`; title *Measurement Invariance, Factor Analysis and Factorial Invariance*). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-23T22:21Z: `is_oa: false`; title *Randomization-Based Inference about Latent Variables from Complex Samples*). -- `psychometric_core` recovers the scalar analog of Driver, Oud, and Voelkle (2017, Table 2, p. 12 `TDPREDVAR` / `T0TDPREDCOV`; Table 3, p. 13 `T0TIPREDEFFECT`; p. 16; §7.2, pp. 20–21; Eq. 3, p. 5; 2017-era ctsem `summary.ctsemFit.R`; JSS PDF re-opened 2026-08-23T22:13Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) extra first-occasion time-dependent predictor variance. The 2017-era `summary.ctsemFit.R` forms `addedT0TIPREDVAR` as `T0TIPREDEFFECT %*% TIPREDVAR %*% t(T0TIPREDEFFECT)` immediately after `T0TIPREDEFFECTstd`. That file comments out `TDPREDVAR` and does not form `addedT0TDPREDVAR`. Table 2 names `T0TDPREDCOV` the covariance between latents at `T0` and time-dependent predictors, not this extra variance. Table 3 names `T0TIPREDEFFECT`, not a TD first-occasion effect matrix. The scalar analog of that quadratic form using the stack's first-occasion TD coefficient `t0_m` and Table 2 `TDPREDVAR` `v` is `t0_m² v`. Form `t0_m` first, then square, then multiply by `v`. A zero coefficient or zero predictor variance is exactly zero. `v < 0` fails closed. `T0` is an event-time occasion, so a non-event clock fails closed. Free `t0_m` does not require stable `a < 0`. `t0_b² v` is `addedT0TIPREDVAR` and is not this extra even when `t0_m = t0_b`. `t0_m · √v / √p_0` is `T0TDPREDEFFECTstd` and is not this variance. `T0TDPREDCOV` is the covariance, not `t0_m² v`. Free `T0VAR` `p_0` is the first-occasion state, not the extra TD variance. `TRAITVAR` is a zero-drift latent process, not `t0_m² v`. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall 2026-08-23T21:34Z: `is_oa: false`; title *Measurement Invariance, Factor Analysis and Factorial Invariance*). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-23T21:34Z: `is_oa: false`; title *Randomization-Based Inference about Latent Variables from Complex Samples*). -- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, Table 2, p. 12 `TRAITVAR`; §7.1, pp. 18–19; p. 16 `TRAITVARstd`; footnote 4; 2017-era ctsem `summary.ctsemFit.R`; JSS PDF re-opened 2026-08-23T22:21Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar standardised trait variance. Table 2 names `TRAITVAR` `φ_ξ` the latent trait variance/covariance and sets it `NULL` when there is no trait. Section 7.1 names traits the stable between-subject differences (unit-level unobserved heterogeneity). Page 16 prints standardised matrices with the suffix `std` when appropriate. The 2017-era `summary.ctsemFit.R` forms `TRAITVARstd` only when `TRAITVAR != 0`, as `solve(sqrt(diag(TRAITVAR))) %&% TRAITVAR` when `verbose = TRUE`. OpenMx `%&%` is the quadratic form `t(A) %*% B %*% A`. Unlike `T0VARstd`, that formation uses `diag(diag(TRAITVAR))` and does not add `diag(c(ridging))`. The ridge is a `T0VAR` numerical hack and is not this exact map. The scalar correlation is `trait / trait = 1` after strictly positive `TRAITVAR`. Form strictly positive `trait` first, then `1 / √trait`, then `(1 / √trait) trait (1 / √trait)`. Unstandardised `TRAITVAR` is defined for a zero trait; standardised `TRAITVAR` is not. Zero `TRAITVAR` skips forming `TRAITVARstd` in the 2017-era source and fails closed here. Between-subject variance is an event-time structural quantity, so a non-event clock fails closed. `TRAITVAR` does not require stable `a < 0`. Distinct positive `trait` recover the same 1. `T0VARstd` `p_0 / p_0 = 1` recovers the same number and remains a distinct named quantity. `addedT0TIPREDVAR` `t0_b² v` is extra first-occasion TI variance, not this correlation. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall 2026-08-23T22:21Z: `is_oa: false`; title *Measurement Invariance, Factor Analysis and Factorial Invariance*). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-23T22:21Z: `is_oa: false`; title *Randomization-Based Inference about Latent Variables from Complex Samples*). -- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, Table 3, p. 13 `T0TDPREDEFFECTstd`; Table 2, p. 12 `TDPREDVAR`; p. 16; footnote 4; Eq. 3, p. 5; 2017-era ctsem `summary.ctsemFit.R`; JSS PDF re-opened 2026-08-23T18:17Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar standardised first-occasion time-dependent predictor effect. Table 3 names `T0TDPREDEFFECT` the effect of time-dependent predictors on latents at `T0`. Page 16 prints standardised matrices with the suffix `std` when appropriate. Footnote 4: standardisations use only the relevant variance, not the total. The affecting variance is time-dependent predictor variance `TDPREDVAR` `v_x`, not `TIPREDVAR`. The affected variance is free first-occasion `T0VAR` `p_0`, not within-subject `asymDIFFUSION` `-q / (2 a)`, because Table 3 is the first occasion, not the process dynamics. Form strictly positive `p_0` first, then strictly positive `v_x`, then `t0_m · √v_x / √p_0`. Unstandardised `t0_m` is defined for a zero coefficient and for zero predictor variance; standardised `T0TDPREDEFFECT` is not. Zero `p_0` or zero `v_x` has no positive SD and fails closed. `T0` is an event-time occasion, so a non-event clock fails closed. Free `T0VAR` does not require stable `a < 0`. Same numbers as `T0TIPREDEFFECTstd` yield the same product; Table 3 names a different matrix. The continuous standardisation `B · √v / √(-q / (2 a))` uses `asymDIFFUSION` and is not this first-occasion map. Section 7.1 warns that omitting trait variance confounds between- and within-person information. `t0_m · √v_x / √(trait + p_0 + added)` uses the total, not free `T0VAR`, and is not `T0TDPREDEFFECTstd` when `TRAITVAR` is nonzero. `TRAITVAR` is not the standardisation variance. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall 2026-08-23T18:17Z: `is_oa: false`; title *Measurement Invariance, Factor Analysis and Factorial Invariance*). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-23T18:17Z: `is_oa: false`; title *Randomization-Based Inference about Latent Variables from Complex Samples*). -- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, p. 16; §7.2, pp. 20–21; Table 2, p. 12; 2017-era ctsem `summary.ctsemFit.R`; JSS PDF re-opened 2026-08-23T21:22Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar standardised extra time-independent predictor variance `addedTIPREDVARstd`. Page 16 prints standardised matrices with the suffix `std` when appropriate. After `addedTIPREDVAR` as `asymTIPREDEFFECT %*% TIPREDVAR %*% t(asymTIPREDEFFECT)`, the 2017-era `summary.ctsemFit.R` forms `addedTIPREDVARstd = solve(sqrt(diag(addedTIPREDVAR))) %&% addedTIPREDVAR`. OpenMx `%&%` is the quadratic form `t(A) %*% B %*% A`. The default `ridging = FALSE` adds 0, not `0.0001`; that ridge is a numerical hack and is not this exact map. The scalar correlation is `extra / extra = 1` after strictly positive extra. Form `addedTIPREDVAR` first, then the ratio. A zero extra has no positive extra SD and fails closed. Unstandardised `(B / a)² v` is defined for a zero coefficient and for zero predictor variance; standardised `addedTIPREDVAR` is not. `λ² (B / a)² v` is Eq. 5 of the extra, not this correlation. `t0_b² v` is `addedT0TIPREDVAR`, not this asymptotic extra correlation. `TRAITVAR` is not the standardisation variance. The printed 2-latent `addedTIPREDVAR` 2.838 is not this scalar 1. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall 2026-08-23T21:22Z: `is_oa: false`; title *Measurement Invariance, Factor Analysis and Factorial Invariance*). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-23T21:22Z: `is_oa: false`; title *Randomization-Based Inference about Latent Variables from Complex Samples*). -- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, p. 16 `TDPREDEFFECTstd`; Table 2, p. 12; Eq. 3, p. 5; footnote 4; §7.1, pp. 18–19; JSS PDF re-opened 2026-08-23T21:10Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar standardised continuous time-dependent predictor effect. Page 16 prints continuous-time parameters and, when appropriate, standardised matrices with the suffix `std`. Table 2 names `M` `TDPREDEFFECT`. Footnote 4: standardisations use only the relevant variance, not the total. The affecting variance is time-dependent predictor variance `v`. The affected variance is within-subject `asymDIFFUSION` `-q / (2 a)`, because the process dynamics are individual, or average individual, temporal dynamics. Form strictly positive `asymDIFFUSION` first, then strictly positive `v`, then `m · √v / √(-q / (2 a))`. Unstandardised `M` is defined for a zero coefficient and for zero predictor variance; standardised `TDPREDEFFECT` is not. Zero `asymDIFFUSION` or zero `v` has no positive SD and fails closed. `TIPREDEFFECTstd` `B · √v / √p` is a different named matrix even when `M = B` and the predictor variances match. The finite-interval intercept-style standardisation `A^{-1}[e^{A Δt} − I] M · √v / √p` depends on the event interval and is not this continuous Dirac coefficient. Section 7.1 warns that omitting trait variance confounds between- and within-person information. `m · √v / √(trait + p + added)` uses the total, not `asymDIFFUSION`, and is not `TDPREDEFFECTstd` when `TRAITVAR` is nonzero. `TRAITVAR` is not the standardisation variance. Predecessor `event_time.rs` asymptotic-std `process_sd == 0` / `predictor_sd == 0` gates after already-checked `within == 0` and `v == 0` were unreachable; this slice drops them so stacked line/branch coverage can close. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall 2026-08-23T21:10Z: `is_oa: false`; title *Measurement Invariance, Factor Analysis and Factorial Invariance*). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-23T21:10Z: `is_oa: false`; title *Randomization-Based Inference about Latent Variables from Complex Samples*). -- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, p. 16 `CINTstd`; Eq. 1, p. 4; Table 2, p. 12; footnote 4; §7.1, pp. 18–19; JSS PDF re-opened 2026-08-23T17:10Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar standardised continuous intercept. Page 16 prints continuous-time parameters and, when appropriate, standardised matrices with the suffix `std`. Table 2 names `κ` `CINT`. Footnote 4: standardisations use only the relevant variance, not the total. `CINT` is the process intercept of individual, or average individual, dynamics, so that relevant variance is within-subject `asymDIFFUSION` `-q / (2 a)`. Form strictly positive `asymDIFFUSION` first, then `κ / √(-q / (2 a))`. Unstandardised `κ` is defined for growing `a ≥ 0` and for zero diffusion; standardised `CINT` is not. Zero `asymDIFFUSION` has no positive SD and fails closed. The asymptotic standardisation `(-κ / a) / √p` is the total change, not this continuous intercept. The finite-interval standardisation `A^{-1}[e^{A Δt} − I] κ / √p` depends on the event interval and is not this continuous map. Section 7.1 warns that omitting trait variance confounds between- and within-person information. `κ / √(trait + p + added)` uses the total, not `asymDIFFUSION`, and is not `CINTstd` when `TRAITVAR` is nonzero. `TRAITVAR` is not the standardisation variance. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall 2026-08-23T13:19Z: `is_oa: false`; title *Measurement Invariance, Factor Analysis and Factorial Invariance*). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-23T13:19Z: `is_oa: false`; title *Randomization-Based Inference about Latent Variables from Complex Samples*). -- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, p. 16 `TIPREDEFFECTstd`; §7.2, pp. 20–21; Eq. 3, p. 5; Table 2, p. 12; footnote 4; JSS PDF re-opened 2026-08-23T16:21Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar standardised continuous time-independent predictor effect. Page 16 prints continuous-time parameters and, when appropriate, standardised matrices with the suffix `std`. Table 2 names `B` `TIPREDEFFECT`. Footnote 4: standardisations use only the relevant variance, not the total. The affecting variance is predictor variance `TIPREDVAR` `v`. The affected variance is within-subject `asymDIFFUSION` `-q / (2 a)`, because the process dynamics are individual, or average individual, temporal dynamics. Form strictly positive `asymDIFFUSION` first, then strictly positive `v`, then `B · √v / √(-q / (2 a))`. Unstandardised `B` is defined for a zero coefficient and for zero predictor variance; standardised `TIPREDEFFECT` is not. Zero `asymDIFFUSION` or zero `v` has no positive SD and fails closed. The asymptotic standardisation `(-B / a) · √v / √p` is the total change, not this continuous coefficient. The finite-interval standardisation `A^{-1}[e^{A Δt} − I] B · √v / √p` depends on the event interval and is not this continuous map. Section 7.1 warns that omitting trait variance confounds between- and within-person information. `B · √v / √(trait + p + added)` uses the total, not `asymDIFFUSION`, and is not `TIPREDEFFECTstd` when `TRAITVAR` is nonzero. `TRAITVAR` is not the standardisation variance. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall 2026-08-23T13:19Z: `is_oa: false`; title *Measurement Invariance, Factor Analysis and Factorial Invariance*). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-23T13:19Z: `is_oa: false`; title *Randomization-Based Inference about Latent Variables from Complex Samples*). -- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, p. 16 `asymTIPREDEFFECTstd`; §7.2, pp. 20–21; Eq. 3, p. 5; Table 2, p. 12; footnote 4; JSS PDF re-opened 2026-08-23T14:25Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar standardised asymptotic time-independent predictor effect. Page 16 prints continuous-time parameters and, when appropriate, standardised matrices with the suffix `std`. Section 7.2 names `asymTIPREDEFFECT` the expected total change in process means given a unit increase on a time-independent predictor. The scalar map is `-B / a` for stable `a < 0`. Footnote 4: standardisations use only the relevant variance, not the total. The affecting variance is predictor variance `TIPREDVAR` `v`. The affected variance is within-subject `asymDIFFUSION` `-q / (2 a)`, because the process dynamics are individual, or average individual, temporal dynamics. Form strictly positive `asymDIFFUSION` first, then strictly positive `v`, then the unit asymptotic effect, then `(-B / a) · √v / √(-q / (2 a))`. Unstandardised `-B / a` is defined for a zero coefficient and for zero predictor variance; standardised `asymTIPREDEFFECT` is not. Zero `asymDIFFUSION` or zero `v` has no positive SD and fails closed. The finite-interval standardisation `A^{-1}[e^{A Δt} − I] B · √v / √p` depends on the event interval and is not this `Δt → ∞` map. Section 7.1 warns that omitting trait variance confounds between- and within-person information. `(-B / a) · √v / √(trait + p + added)` uses the total, not `asymDIFFUSION`, and is not `asymTIPREDEFFECTstd` when `TRAITVAR` is nonzero. `TRAITVAR` is not the standardisation variance. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall 2026-08-23T13:19Z: `is_oa: false`; title *Measurement Invariance, Factor Analysis and Factorial Invariance*). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-23T13:19Z: `is_oa: false`; title *Randomization-Based Inference about Latent Variables from Complex Samples*). -- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, p. 16 `DRIFTstd`; Eq. 1, p. 4; footnote 4; §7.1, pp. 18–19; JSS PDF re-opened 2026-08-23T13:28Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar standardised continuous `DRIFT`. Page 16 prints continuous-time parameters (e.g., `DRIFT`) and, when appropriate, standardised matrices with the suffix `std`. Footnote 4: standardisations use only the relevant variance, not the total. For `DRIFT` that relevant variance is within-subject `asymDIFFUSION` `-q / (2 a)`, because `DRIFT` is intended to represent individual, or average individual, temporal dynamics. Form strictly positive `asymDIFFUSION` first. In the scalar stationary case the within-subject SD ratio is 1, so the standardised auto-effect equals the unstandardised log-rate numerically; those remain distinct named quantities. Unstandardised `a` is defined for growing `a ≥ 0` and for zero diffusion; standardised `DRIFT` is not. Zero `asymDIFFUSION` has no positive SD and fails closed. The discrete standardisation `e^{a Δt}` depends on the event interval and is not the continuous map. Section 7.1 warns that omitting trait variance confounds between- and within-person information. `a p / (trait + p + added)` uses the total, not `asymDIFFUSION`, and is not `DRIFTstd` when `TRAITVAR` is nonzero. `TRAITVAR` is not the standardisation variance. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall 2026-08-23T13:19Z: `is_oa: false`; title *Measurement Invariance, Factor Analysis and Factorial Invariance*). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-23T13:19Z: `is_oa: false`; title *Randomization-Based Inference about Latent Variables from Complex Samples*). -- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, p. 16 `DIFFUSIONstd`; Eq. 4, p. 5; footnote 4; §7.1, pp. 18–19; JSS PDF re-opened 2026-08-23T13:20Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar standardised continuous `DIFFUSION`. Page 16 prints continuous-time parameters (e.g., `DRIFT`, `DIFFUSION`) and, when appropriate, standardised matrices with the suffix `std`. Footnote 4: standardisations use only the relevant variance, not the total. Process noise is within-subject stochastic input, so that relevant variance is within-subject `asymDIFFUSION` `-q / (2 a)`, the same footnote 4 variance used for `DRIFT`. Form strictly positive `asymDIFFUSION` first, then `q / (−q / (2 a))`. In the scalar stationary case that ratio equals `-2 a` and does not depend on `q` once `q > 0`. Unstandardised `q` is defined for growing `a ≥ 0` and for zero diffusion; standardised `DIFFUSION` is not. Zero `asymDIFFUSION` has no positive SD and fails closed. The discrete standardisation `Q_Δt / (−q / (2 a)) = 1 − exp(2 a Δt)` depends on the event interval and is not the continuous map. Section 7.1 warns that omitting trait variance confounds between- and within-person information. `q / (trait + p + added)` uses the total, not `asymDIFFUSION`, and is not `DIFFUSIONstd` when `TRAITVAR` is nonzero. `TRAITVAR` is not the standardisation variance. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall 2026-08-23T13:19Z: `is_oa: false`; title *Measurement Invariance, Factor Analysis and Factorial Invariance*). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-23T13:19Z: `is_oa: false`; title *Randomization-Based Inference about Latent Variables from Complex Samples*). -- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, p. 16 `discreteDIFFUSIONstd`; Eq. 3–4, pp. 4–5; footnote 4; §7.1, pp. 18–19; JSS PDF re-opened 2026-08-23T13:06Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar standardised discrete `DIFFUSION`. Page 16 prints discrete-time transformations for a chosen event interval (`discreteDRIFT`, `discreteDIFFUSION`) and, when appropriate, standardised matrices with the suffix `std`. Footnote 4: standardisations use only the relevant variance, not the total. Process noise is within-subject stochastic input, so that relevant variance is within-subject `asymDIFFUSION` `-q / (2 a)`, the same footnote 4 variance used for `DRIFT`. Form strictly positive `asymDIFFUSION` first, then `Q_Δt` from Equation 4, then `Q_Δt / (−q / (2 a))`. In the scalar stationary case that ratio equals `1 − exp(2 a Δt)`. Unstandardised `Q_Δt` is defined for growing `a ≥ 0` and for zero diffusion; standardised `DIFFUSION` is not. Zero `asymDIFFUSION` has no positive SD and fails closed. The continuous standardisation `q / (−q / (2 a)) = −2 a` is not the discrete map. Section 7.1 warns that omitting trait variance confounds between- and within-person information. `Q_Δt / (trait + p + added)` uses the total, not `asymDIFFUSION`, and is not `discreteDIFFUSIONstd` when `TRAITVAR` is nonzero. `TRAITVAR` is not the standardisation variance. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall 2026-08-23T13:06Z: `is_oa: false`; title *Measurement Invariance, Factor Analysis and Factorial Invariance*). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-23T13:06Z: `is_oa: false`; title *Randomization-Based Inference about Latent Variables from Complex Samples*). -- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, p. 16 `discreteDRIFTstd`; Eq. 3, p. 5; footnote 4; §7.1, pp. 18–19; JSS PDF re-opened 2026-08-23T11:40Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar standardised discrete `DRIFT`. Page 16 prints `discreteDRIFT` as `expm(DRIFT Δt)` and, when appropriate, `discreteDRIFTstd`. Footnote 4: standardisations use only the relevant variance, not the total. For `DRIFT` that relevant variance is within-subject `asymDIFFUSION` `-q / (2 a)`, because `DRIFT` is intended to represent individual, or average individual, temporal dynamics. Form strictly positive `asymDIFFUSION` first, then `φ = exp(a Δt)`. In the scalar stationary case the within-subject SD ratio is 1, so the standardised auto-effect equals the unstandardised discrete lag numerically; those remain distinct named quantities. Unstandardised `e^{a Δt}` is defined for growing `a ≥ 0` and for zero diffusion; standardised `DRIFT` is not. Zero `asymDIFFUSION` has no positive SD and fails closed. Section 7.1 warns that omitting trait variance confounds between- and within-person information. The trait-plus-state autocorrelation `(trait + e^{a Δt} p + added) / (trait + p + added)` uses the total, not `asymDIFFUSION`, and is not `discreteDRIFTstd` when `TRAITVAR` is nonzero. `TRAITVAR` is not the standardisation variance. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall 2026-08-23T11:40Z: `is_oa: false`; title *Measurement Invariance, Factor Analysis and Factorial Invariance*). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-23T11:40Z: `is_oa: false`; title *Randomization-Based Inference about Latent Variables from Complex Samples*). -- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, §4.3, pp. 9–10; Eq. 5, p. 5; Table 2, p. 12; p. 16; §7.2, pp. 20–21; JSS PDF re-opened 2026-08-23T10:03Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar first-occasion variance of §4.3 predetermined `T0VAR`. Section 4.3 treats the first time point as predetermined when no assumptions are made about the process prior to the initial time point. Free `T0VAR` `p_0` is then estimated. Between-subject `TRAITVAR` and `addedTIPREDVAR` are inherently stationary. The first-occasion composition is `trait + p_0 + (B / a)² v`. Form the free first-occasion state variance first, then include the trait, then include the TI extra variance, then add. Setting `p_0 = −q / (2 a)` recovers the stationary first-occasion map. Stationary first-occasion variance uses `−q / (2 a)` in place of `p_0` and is not this map when `p_0` is free. Free `T0VAR` `p_0` is not this map. The lagged map `trait + e^{a Δt} p_0 + (B / a)² v` decays the state and is not this map. The later-occasion map `trait + e^{2 a Δt} p_0 + Q_Δt + (B / a)² v` includes `Q_Δt` and is not this map. As `Δt → 0+` those maps approach this composition. A zero trait, a zero initial variance, and a zero TI contribution is exactly zero. A zero initial variance and a zero TI contribution is exactly the trait. Trait-only variance does not require a stable drift. `a ≥ 0` cannot hold a finite TI extra variance when that contribution is nonzero and fails closed. Equation 5 of that first-occasion variance is `λ²(trait + p_0 + (B / a)² v) + θ + ψ`. `MANIFESTVAR` is not that first-occasion observed variance. The predetermined first-occasion latent variance is not the predetermined first-occasion observed variance. Stationary first-occasion observed variance is not that observed variance when `p_0` is free. Predetermined later observed variance includes `Q_Δt` and is not that first-occasion observed variance. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall 2026-08-23T10:03Z: `is_oa: false`; title *Measurement Invariance, Factor Analysis and Factorial Invariance*). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-23T10:03Z: `is_oa: false`; title *Randomization-Based Inference about Latent Variables from Complex Samples*). -- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, §4.3, pp. 9–10; Eq. 3–5, pp. 4–5; Table 2, p. 12; p. 16; §7.2, pp. 20–21; JSS PDF re-opened 2026-08-23T20:20Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar lagged covariance of §4.3 predetermined `T0VAR`. Section 4.3 treats the first time point as predetermined when no assumptions are made about the process prior to the initial time point. Free `T0VAR` `p_0` is then estimated. Equation 3 writes `η(t) = exp(A Δt) η(t0) + …`. Equation 4 writes `cov(η_t, η_{t-1}) = A_Δt cov(η_{t-1})`. Trait variance and `addedTIPREDVAR` are time-invariant between-subject and do not decay with `e^{a Δt}`. The lagged composition is `trait + e^{a Δt} p_0 + (B / a)² v`. Form the lagged free first-occasion covariance first, then include the trait, then include the TI extra variance, then add. Setting `p_0 = −q / (2 a)` recovers the stationary lagged map. Stationary lagged covariance uses `−q / (2 a)` in place of `p_0` and is not this map when `p_0` is free. Evolving `trait + p_0 + (B / a)² v` as if it were all state (`e^{a Δt}` of that total) is not this map. Free `T0VAR` `p_0` is not this map. The later-occasion map `trait + e^{2 a Δt} p_0 + Q_Δt + (B / a)² v` includes `Q_Δt` and is not this map. As `Δt → ∞` with stable `a < 0` the state term vanishes. As `Δt → 0+` the composition approaches `trait + p_0 + (B / a)² v`. A zero-diffusion carry with `a ≥ 0` is `e^{a Δt} p_0` and is kept. Trait-only variance does not require a stable drift. The interval must be event time and strictly positive. Equation 5 of that lagged covariance is `λ²(trait + e^{a Δt} p_0 + (B / a)² v) + ψ`. Independent `ε_t` does not enter. `MANIFESTVAR` is not that lagged observed covariance. The predetermined lagged latent covariance is not the predetermined lagged observed covariance. Predetermined later observed variance includes `Q_Δt` and `θ` and is not that lagged observed covariance. Stationary lagged observed covariance is not that observed covariance when `p_0` is free. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall 2026-08-23T20:20Z: `is_oa: false`; title *Measurement Invariance, Factor Analysis and Factorial Invariance*). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-23T20:20Z: `is_oa: false`; title *Randomization-Based Inference about Latent Variables from Complex Samples*). -- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, §4.3, pp. 9–10; Eq. 3–5, pp. 4–5; Table 2, p. 12; p. 16; §7.2, pp. 20–21; JSS PDF re-opened 2026-08-23T20:20Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar later-occasion variance of §4.3 predetermined `T0VAR`. Section 4.3 treats the first time point as predetermined when no assumptions are made about the process prior to the initial time point. Free `T0VAR` `p_0` is then estimated. The process gradually transitions from the variances of the initial parameters toward those of the parameters when the model is stationary. Equation 3 writes `η(t) = exp(A Δt) η(t0) + … +` the stochastic integral. Equation 4 writes that the integral exhibits covariance `Q_Δt`. The law of total variance on the within-subject state is `e^{2 a Δt} p_0 + Q_Δt`. Trait variance and `addedTIPREDVAR` are time-invariant between-subject and do not enter that process-noise integral. The later-occasion composition is `trait + e^{2 a Δt} p_0 + Q_Δt + (B / a)² v`. Form the evolved free first-occasion variance first, then include the trait, then include the TI extra variance, then add. Setting `p_0 = −q / (2 a)` recovers the stationary later-occasion map. Stationary later-occasion variance uses `−q / (2 a)` in place of `p_0` and is not this map when `p_0` is free. Evolving `trait + p_0 + (B / a)² v` as if it were all state (`e^{2 a Δt}` of that total plus `Q_Δt`) is not this map. Free `T0VAR` `p_0` is not this map. As `Δt → ∞` with stable `a < 0` the carried `p_0` vanishes and `Q_Δt` approaches `−q / (2 a)`, so the composition approaches contemporaneous stationary `T0VAR`. As `Δt → 0+` the composition approaches `trait + p_0 + (B / a)² v`. Nonzero diffusion with `a ≥ 0` is a growing process and is kept. The interval must be event time and strictly positive. Equation 5 of that later-occasion variance is `λ²(trait + e^{2 a Δt} p_0 + Q_Δt + (B / a)² v) + θ + ψ`. `MANIFESTVAR` is not that later-occasion observed variance. The predetermined later-occasion latent variance is not the predetermined later-occasion observed variance. Stationary later-occasion observed variance is not that observed variance when `p_0` is free. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall 2026-08-23T20:20Z: `is_oa: false`; title *Measurement Invariance, Factor Analysis and Factorial Invariance*). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-23T20:20Z: `is_oa: false`; title *Randomization-Based Inference about Latent Variables from Complex Samples*). -- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, p. 16 finite-interval standardised `TIPREDEFFECT`; §7.2, pp. 20–21; Eq. 3, p. 5; Table 2, p. 12; footnote 4; JSS PDF re-opened 2026-08-24T01:20Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar standardised finite-interval time-independent predictor effect. Page 16 prints discrete-time transformations for a chosen event interval and, when appropriate, standardised matrices with the suffix `std`. Equation 3 maps a finite event interval as `A^{-1}[e^{A Δt} − I] B`. Table 2 names `B` `TIPREDEFFECT`. Footnote 4: standardisations use only the relevant variance, not the total. The affecting variance is predictor variance `TIPREDVAR` `v`. The affected variance is within-subject `asymDIFFUSION` `-q / (2 a)`, because the process dynamics are individual, or average individual, temporal dynamics. Form strictly positive `asymDIFFUSION` first, then strictly positive `v`, then the unit discrete increment, then `A^{-1}[e^{A Δt} − I] B · √v / √(-q / (2 a))`. Unstandardised `A^{-1}[e^{A Δt} − I] B` is defined for a zero coefficient and for zero predictor variance; standardised finite-interval `TIPREDEFFECT` is not. Zero `asymDIFFUSION` or zero `v` has no positive SD and fails closed. Page 16 `asymTIPREDEFFECTstd` `(-B / a) · √v / √p` is the `Δt → ∞` map and is not this finite interval. A later event interval yields a different standardised increment. Section 7.1 warns that omitting trait variance confounds between- and within-person information. `A^{-1}[e^{A Δt} − I] B · √v / √(trait + p + added)` uses the total, not `asymDIFFUSION`, and is not the finite-interval map when `TRAITVAR` is nonzero. `TRAITVAR` is not the standardisation variance. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall 2026-08-24T01:20Z: `is_oa: false`; Springer `content/pdf` is HTML 200; title *Measurement Invariance, Factor Analysis and Factorial Invariance*). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-24T01:20Z: `is_oa: false`; Springer `content/pdf` is HTML 200; title *Randomization-Based Inference about Latent Variables from Complex Samples*). -- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, Table 2, p. 12 `T0VAR`; p. 16 `T0VARstd`; footnote 4; 2017-era ctsem `summary.ctsemFit.R`; JSS PDF re-opened 2026-08-23T22:06Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar standardised first-occasion latent variance. Table 2 names `T0VAR` the latent process initial variance/covariance. Page 16 prints standardised matrices with the suffix `std` when appropriate. The 2017-era `summary.ctsemFit.R` forms `T0VARstd` as `solve(sqrt(diag(T0VAR))) %&% T0VAR` when `verbose = TRUE`. OpenMx `%&%` is the quadratic form `t(A) %*% B %*% A`. The default `ridging = FALSE` adds 0, not `0.0001`; that ridge is a numerical hack and is not this exact map. The scalar correlation is `p_0 / p_0 = 1` after strictly positive free `T0VAR`. Form strictly positive `p_0` first, then `1 / √p_0`, then `(1 / √p_0) p_0 (1 / √p_0)`. Unstandardised `T0VAR` is defined for a zero first-occasion variance; standardised `T0VAR` is not. Zero `p_0` has no positive SD and fails closed. `T0` is an event-time occasion, so a non-event clock fails closed. Free `T0VAR` does not require stable `a < 0`. Distinct positive `p_0` recover the same 1. `T0TDPREDEFFECTstd` `t0_m · √v / √p_0` depends on `p_0` and is not this correlation. `addedT0TIPREDVAR` `t0_b² v` is extra TI variance, not this correlation. `TRAITVAR` is not the standardisation variance. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall 2026-08-23T22:06Z: `is_oa: false`; title *Measurement Invariance, Factor Analysis and Factorial Invariance*). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-23T22:06Z: `is_oa: false`; title *Randomization-Based Inference about Latent Variables from Complex Samples*). -- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, Table 3, p. 13 `T0TDPREDEFFECTstd`; Table 2, p. 12; p. 16; footnote 4; Eq. 3, p. 5; 2017-era ctsem `summary.ctsemFit.R`; JSS PDF re-opened 2026-08-23T21:34Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar standardised first-occasion time-dependent predictor effect. Table 3 names `T0TDPREDEFFECT` the effect of time-dependent predictors on latents at `T0`. Table 2 names `M` `TDPREDEFFECT` and names `T0TDPREDCOV` the first-occasion covariance, not this coefficient. Page 16 prints standardised matrices with the suffix `std` when appropriate. Footnote 4: standardisations use only the relevant variance, not the total. The affecting variance is time-dependent predictor variance `v`, not `TIPREDVAR`. The affected variance is free first-occasion `T0VAR` `p_0`, not within-subject `asymDIFFUSION` `-q / (2 a)`, because Table 3 is the first occasion, not the process dynamics. Form strictly positive `p_0` first, then strictly positive `v`, then `t0_m · √v / √p_0`. Unstandardised `t0_m` is defined for a zero coefficient and for zero predictor variance; standardised `T0TDPREDEFFECT` is not. Zero `p_0` or zero `v` has no positive SD and fails closed. `T0` is an event-time occasion, so a non-event clock fails closed. Free `T0VAR` does not require stable `a < 0`. The continuous standardisation `m · √v / √(-q / (2 a))` uses `asymDIFFUSION` and is not this first-occasion map. `T0TIPREDEFFECTstd` `t0_b · √v / √p_0` is a different named matrix even when `t0_m = t0_b` and the predictor variances match. Section 7.1 warns that omitting trait variance confounds between- and within-person information. `t0_m · √v / √(trait + p_0 + added)` uses the total, not free `T0VAR`, and is not `T0TDPREDEFFECTstd` when `TRAITVAR` is nonzero. `TRAITVAR` is not the standardisation variance. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall 2026-08-23T21:34Z: `is_oa: false`; title *Measurement Invariance, Factor Analysis and Factorial Invariance*). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-23T21:34Z: `is_oa: false`; title *Randomization-Based Inference about Latent Variables from Complex Samples*). -- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, Eq. 5, p. 5; Table 2, p. 12; §7.2, pp. 20–21; 2017-era ctsem `summary.ctsemFit.R`; JSS PDF re-opened 2026-08-23T19:23Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar extra observed-indicator time-independent predictor variance of §7.2 `addedTIPREDVAR`. Equation 5 writes `y_i(t) = Γ + Λ η_i(t) + ζ_i(t)` with `ζ ~ N(0, Θ)` and `Γ ~ N(τ, Ψ)`. The 2017-era `summary.ctsemFit.R` forms the latent extra `addedTIPREDVAR` as `asymTIPREDEFFECT %*% TIPREDVAR %*% t(asymTIPREDEFFECT)`. The scalar latent extra is `(B / a)² v`. Equation 5 of that extra, with `θ = 0` and `ψ = 0`, is `λ² (B / a)² v`. Form `addedTIPREDVAR` first, then `(λ extra) λ`. Do not form `λ²` first. A zero loading or zero extra is exactly zero. `v < 0` fails closed. A non-event clock fails closed. `a ≥ 0` cannot hold a finite process-mean change when the extra is nonzero and fails closed. `(B / a)² v` is the latent extra, not this observed extra. `λ² t0_b² v` is Eq. 5 of `addedT0TIPREDVAR`, not this asymptotic observed extra. `λ² p + θ` is stationary observed variance, not this extra. `MANIFESTVAR` `θ` is measurement error, not this extra. `Ψ` is intercept variance and is not extra TI. The printed 2-latent `addedTIPREDVAR` 2.838 is not this scalar map. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall 2026-08-23T19:10Z: `is_oa: false`; title *Measurement Invariance, Factor Analysis and Factorial Invariance*). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-23T19:10Z: `is_oa: false`; title *Randomization-Based Inference about Latent Variables from Complex Samples*). -- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, Eq. 5, p. 5; Table 3, p. 13 `T0TIPREDEFFECT`; Table 2, p. 12; p. 16; §7.2, pp. 20–21; 2017-era ctsem `summary.ctsemFit.R`; JSS PDF re-opened 2026-08-23T19:10Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar extra observed-indicator time-independent predictor variance of 2017-era `addedT0TIPREDVAR`. Equation 5 writes `y_i(t) = Γ + Λ η_i(t) + ζ_i(t)` with `ζ ~ N(0, Θ)` and `Γ ~ N(τ, Ψ)`. The 2017-era `summary.ctsemFit.R` forms the latent extra `addedT0TIPREDVAR` as `T0TIPREDEFFECT %*% TIPREDVAR %*% t(T0TIPREDEFFECT)` immediately after `T0TIPREDEFFECTstd`. The scalar latent extra is `t0_b² v`. Equation 5 of that extra, with `θ = 0` and `ψ = 0`, is `λ² t0_b² v`. Form `addedT0TIPREDVAR` first, then `(λ extra) λ`. Do not form `λ²` first. A zero loading or zero extra is exactly zero. `v < 0` fails closed. `T0` is an event-time occasion, so a non-event clock fails closed. Free `T0TIPREDEFFECT` does not require stable `a < 0`. `t0_b² v` is the latent extra, not this observed extra. `λ² p_0 + θ` is first-occasion observed variance, not this extra. `λ² (B / a)² v` is Eq. 5 of `addedTIPREDVAR`, not this first-occasion observed extra. `MANIFESTVAR` `θ` is measurement error, not this extra. `Ψ` is intercept variance and is not extra TI. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall 2026-08-23T19:10Z: `is_oa: false`; title *Measurement Invariance, Factor Analysis and Factorial Invariance*). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-23T19:10Z: `is_oa: false`; title *Randomization-Based Inference about Latent Variables from Complex Samples*). -- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, Table 3, p. 13 `T0TIPREDEFFECT`; p. 16; §7.2, pp. 20–21; Eq. 3, p. 5; 2017-era ctsem `summary.ctsemFit.R`; JSS PDF re-opened 2026-08-23T18:20Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar first-occasion extra time-independent predictor variance `addedT0TIPREDVAR`. Table 3 names `T0TIPREDEFFECT` the effect of time-independent predictors on latents at `T0`. Page 16 prints extra summary matrices when `verbose = TRUE`. The 2017-era `summary.ctsemFit.R` forms `addedT0TIPREDVAR` as `T0TIPREDEFFECT %*% TIPREDVAR %*% t(T0TIPREDEFFECT)` immediately after `T0TIPREDEFFECTstd`. Section 7.2 names `addedTIPREDVAR` the stable between-subject variance accounted for by time-independent predictors at the process asymptote, `(B / a)² v`. The first-occasion analogue uses free `T0TIPREDEFFECT`, not `-B / a`. The scalar map is `t0_b² v`. Form `t0_b` first, then square, then multiply by `v`. A zero coefficient or zero predictor variance is exactly zero. `v < 0` fails closed. `T0` is an event-time occasion, so a non-event clock fails closed. Free `T0TIPREDEFFECT` does not require stable `a < 0`. `(B / a)² v` is `addedTIPREDVAR` and is not this first-occasion map. `t0_b · √v / √p_0` is `T0TIPREDEFFECTstd` and is not this variance. Free `T0VAR` `p_0` is the first-occasion state, not the extra TI variance. `TRAITVAR` is a zero-drift latent process, not `t0_b² v`. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall 2026-08-23T18:20Z: `is_oa: false`; title *Measurement Invariance, Factor Analysis and Factorial Invariance*). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-23T18:20Z: `is_oa: false`; title *Randomization-Based Inference about Latent Variables from Complex Samples*). -- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, Table 3, p. 13 `T0TIPREDEFFECTstd`; p. 16; footnote 4; Eq. 3, p. 5; 2017-era ctsem `summary.ctsemFit.R`; JSS PDF re-opened 2026-08-23T17:20Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar standardised first-occasion time-independent predictor effect. Table 3 names `T0TIPREDEFFECT` the effect of time-independent predictors on latents at `T0`. Page 16 prints standardised matrices with the suffix `std` when appropriate. Footnote 4: standardisations use only the relevant variance, not the total. The affecting variance is predictor variance `TIPREDVAR` `v`. The affected variance is free first-occasion `T0VAR` `p_0`, not within-subject `asymDIFFUSION` `-q / (2 a)`, because Table 3 is the first occasion, not the process dynamics. Form strictly positive `p_0` first, then strictly positive `v`, then `t0_b · √v / √p_0`. Unstandardised `t0_b` is defined for a zero coefficient and for zero predictor variance; standardised `T0TIPREDEFFECT` is not. Zero `p_0` or zero `v` has no positive SD and fails closed. `T0` is an event-time occasion, so a non-event clock fails closed. Free `T0VAR` does not require stable `a < 0`. The continuous standardisation `B · √v / √(-q / (2 a))` uses `asymDIFFUSION` and is not this first-occasion map. The asymptotic standardisation `(-B / a) · √v / √p` is the total change, not this first-occasion coefficient. Section 7.1 warns that omitting trait variance confounds between- and within-person information. `t0_b · √v / √(trait + p_0 + added)` uses the total, not free `T0VAR`, and is not `T0TIPREDEFFECTstd` when `TRAITVAR` is nonzero. `TRAITVAR` is not the standardisation variance. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall 2026-08-23T17:20Z: `is_oa: false`; title *Measurement Invariance, Factor Analysis and Factorial Invariance*). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-23T17:20Z: `is_oa: false`; title *Randomization-Based Inference about Latent Variables from Complex Samples*). -- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, §4.3, pp. 9–10; Eq. 3–5, pp. 4–5; Table 2, p. 12; p. 16; §7.2, pp. 20–21; JSS PDF re-opened 2026-08-23T11:05Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar later-start later-occasion variance of §4.3 predetermined `T0VAR`. Section 4.3 treats the first time point as predetermined when no assumptions are made about the process prior to the initial time point. Free `T0VAR` `p_0` is then estimated. Section 4.3 notes that the process gradually transitions from the initial variances toward the stationary variances, and that the initial time point need not reflect the first measurement occasion (`startoffset`). Equation 3 writes `η(t) = exp(A Δt) η(t0) + … +` the stochastic integral. Equation 4 writes that the integral exhibits covariance `Q_Δt`. After a later start `u` the within-subject state variance is `e^{2 a u} p_0 + Q_u`. Evolving that later start over `s` is `e^{2 a s}(e^{2 a u} p_0 + Q_u) + Q_s`. Chapman–Kolmogorov writes `Q_{u+s} = e^{2 a s} Q_u + Q_s`, so the later-occasion map over `u + s` is the same composition. Trait variance and `addedTIPREDVAR` are time-invariant between-subject and do not enter `Q_s`. The later-start later-occasion composition is `trait + e^{2 a s}(e^{2 a u} p_0 + Q_u) + Q_s + (B / a)² v`. Form the later-start within-subject variance first, then evolve that state, then include the trait, then include the TI extra variance, then add. Setting `p_0 = −q / (2 a)` recovers the stationary later-occasion map. Stationary later-occasion variance uses `−q / (2 a)` in place of `p_0` and is not this map when `p_0` is free. Later-occasion variance at `u` omits `Q_s` and is not this map when `s > 0`. Later-start lagged covariance is `e^{a s}` of the later state and omits `Q_s`; it is not this map. Evolving the later total as if it were all state (`e^{2 a s}` of `trait + e^{2 a u} p_0 + Q_u + (B / a)² v` plus `Q_s`) is not this map. Later-occasion variance over the lag interval alone ignores `startoffset` and omits `e^{2 a s} Q_u`; it is not this map when `u > 0`. As `u → 0+` the composition approaches later-occasion variance over `s`. As `s → 0+` the composition approaches later-occasion variance at `u`. As `s → ∞` with stable `a < 0` the carried later state vanishes and `Q_s` approaches `−q / (2 a)`, so the composition approaches contemporaneous stationary `T0VAR`. A zero trait, a zero initial variance, a zero diffusion, and a zero TI contribution is exactly zero. A zero initial variance, a zero diffusion, and a zero TI contribution is exactly the trait. Trait-only variance does not require a stable drift. `a ≥ 0` cannot hold a finite TI extra variance when that contribution is nonzero and fails closed. Nonzero diffusion with `a ≥ 0` is a growing process and is kept. Both intervals must be event time and strictly positive. Equation 5 of that later-start later-occasion variance is `λ²(trait + e^{2 a s}(e^{2 a u} p_0 + Q_u) + Q_s + (B / a)² v) + θ + ψ`. `MANIFESTVAR` is not that later-start later-occasion observed variance. The later-start later-occasion latent variance is not the later-start later-occasion observed variance. Predetermined later observed variance at `u` omits `Q_s` and is not that observed variance when `s > 0`. Later-start lagged observed covariance omits `Q_s` and `θ` and is not that observed variance. Stationary later-occasion observed variance is not that observed variance when `p_0` is free. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall 2026-08-23T11:05Z: `is_oa: false`; title *Measurement Invariance, Factor Analysis and Factorial Invariance*). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-23T11:05Z: `is_oa: false`; title *Randomization-Based Inference about Latent Variables from Complex Samples*). -- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, §4.3, pp. 9–10; Eq. 3–5, pp. 4–5; Table 2, p. 12; p. 16; §7.2, pp. 20–21; JSS PDF re-opened 2026-08-23T10:27Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar later-start lagged covariance of §4.3 predetermined `T0VAR`. Section 4.3 treats the first time point as predetermined when no assumptions are made about the process prior to the initial time point. Free `T0VAR` `p_0` is then estimated. Section 4.3 notes that the process gradually transitions from the initial variances toward the stationary variances, and that the initial time point need not reflect the first measurement occasion (`startoffset`). Equation 3 writes `η(t) = exp(A Δt) η(t0) + … +` the stochastic integral. Equation 4 writes `cov(η_t, η_{t-1}) = A_Δt cov(η_{t-1})`. After a later start `u` the within-subject state variance is `e^{2 a u} p_0 + Q_u`. Lagging that later start over `s` is `e^{a s}(e^{2 a u} p_0 + Q_u)`. Trait variance and `addedTIPREDVAR` are time-invariant between-subject and do not decay with `e^{a s}`. The lagged composition is `trait + e^{a s}(e^{2 a u} p_0 + Q_u) + (B / a)² v`. Form the later-start within-subject variance first, then lag that state, then include the trait, then include the TI extra variance, then add. Setting `p_0 = −q / (2 a)` recovers the stationary lagged map. Stationary lagged covariance uses `−q / (2 a)` in place of `p_0` and is not this map when `p_0` is free. First-occasion lagged covariance `trait + e^{a s} p_0 + (B / a)² v` omits `e^{a s} Q_u` and is not this map when `u > 0`. Later-occasion variance includes `Q_u` without lagging that later state and is not this map. Evolving the later total as if it were all state (`e^{a s}` of `trait + e^{2 a u} p_0 + Q_u + (B / a)² v`) is not this map. As `u → 0+` the composition approaches first-occasion lagged covariance. As `s → 0+` the composition approaches later-occasion variance at `u`. As `s → ∞` with stable `a < 0` the state term vanishes. A zero trait, a zero initial variance, a zero diffusion, and a zero TI contribution is exactly zero. A zero initial variance, a zero diffusion, and a zero TI contribution is exactly the trait. Trait-only variance does not require a stable drift. `a ≥ 0` cannot hold a finite TI extra variance when that contribution is nonzero and fails closed. Nonzero diffusion with `a ≥ 0` is a growing process and is kept. Both intervals must be event time and strictly positive. Equation 5 of that later-start lagged covariance is `λ²(trait + e^{a s}(e^{2 a u} p_0 + Q_u) + (B / a)² v) + ψ`. Independent `ε_t` does not enter. `MANIFESTVAR` is not that later-start lagged observed covariance. The later-start lagged latent covariance is not the later-start lagged observed covariance. First-occasion lagged observed covariance omits `e^{a s} Q_u` and is not that observed covariance when `u > 0`. Predetermined later observed variance includes `Q_u` and `θ` and is not that later-start lagged observed covariance. Stationary lagged observed covariance is not that observed covariance when `p_0` is free. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall 2026-08-23T10:27Z: `is_oa: false`; title *Measurement Invariance, Factor Analysis and Factorial Invariance*). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-23T10:27Z: `is_oa: false`; title *Randomization-Based Inference about Latent Variables from Complex Samples*). -- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, §4.3, pp. 9–10; Eq. 3–5, pp. 4–5; Table 2, p. 12; p. 16; §7.2, pp. 20–21; JSS PDF re-opened 2026-08-23T09:04Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar lagged covariance of §4.3 predetermined `T0VAR`. Section 4.3 treats the first time point as predetermined when no assumptions are made about the process prior to the initial time point. Free `T0VAR` `p_0` is then estimated. Equation 3 writes `η(t) = exp(A Δt) η(t0) + …`. Equation 4 writes `cov(η_t, η_{t-1}) = A_Δt cov(η_{t-1})`. Trait variance and `addedTIPREDVAR` are time-invariant between-subject and do not decay with `e^{a Δt}`. The lagged composition is `trait + e^{a Δt} p_0 + (B / a)² v`. Form the lagged free first-occasion covariance first, then include the trait, then include the TI extra variance, then add. Setting `p_0 = −q / (2 a)` recovers the stationary lagged map. Stationary lagged covariance uses `−q / (2 a)` in place of `p_0` and is not this map when `p_0` is free. Evolving `trait + p_0 + (B / a)² v` as if it were all state (`e^{a Δt}` of that total) is not this map. Free `T0VAR` `p_0` is not this map. The later-occasion map `trait + e^{2 a Δt} p_0 + Q_Δt + (B / a)² v` includes `Q_Δt` and is not this map. As `Δt → ∞` with stable `a < 0` the state term vanishes. As `Δt → 0+` the composition approaches `trait + p_0 + (B / a)² v`. A zero-diffusion carry with `a ≥ 0` is `e^{a Δt} p_0` and is kept. Trait-only variance does not require a stable drift. The interval must be event time and strictly positive. Equation 5 of that lagged covariance is `λ²(trait + e^{a Δt} p_0 + (B / a)² v) + ψ`. Independent `ε_t` does not enter. `MANIFESTVAR` is not that lagged observed covariance. The predetermined lagged latent covariance is not the predetermined lagged observed covariance. Predetermined later observed variance includes `Q_Δt` and `θ` and is not that lagged observed covariance. Stationary lagged observed covariance is not that observed covariance when `p_0` is free. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall 2026-08-23T09:04Z: `is_oa: false`; title *Measurement Invariance, Factor Analysis and Factorial Invariance*). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-23T09:04Z: `is_oa: false`; title *Randomization-Based Inference about Latent Variables from Complex Samples*). -- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, §4.3, pp. 9–10; Eq. 3–5, pp. 4–5; Table 2, p. 12; p. 16; §7.2, pp. 20–21; JSS PDF re-opened 2026-08-23T05:12Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar later-occasion variance of §4.3 predetermined `T0VAR`. Section 4.3 treats the first time point as predetermined when no assumptions are made about the process prior to the initial time point. Free `T0VAR` `p_0` is then estimated. The process gradually transitions from the variances of the initial parameters toward those of the parameters when the model is stationary. Equation 3 writes `η(t) = exp(A Δt) η(t0) + … +` the stochastic integral. Equation 4 writes that the integral exhibits covariance `Q_Δt`. The law of total variance on the within-subject state is `e^{2 a Δt} p_0 + Q_Δt`. Trait variance and `addedTIPREDVAR` are time-invariant between-subject and do not enter that process-noise integral. The later-occasion composition is `trait + e^{2 a Δt} p_0 + Q_Δt + (B / a)² v`. Form the evolved free first-occasion variance first, then include the trait, then include the TI extra variance, then add. Setting `p_0 = −q / (2 a)` recovers the stationary later-occasion map. Stationary later-occasion variance uses `−q / (2 a)` in place of `p_0` and is not this map when `p_0` is free. Evolving `trait + p_0 + (B / a)² v` as if it were all state (`e^{2 a Δt}` of that total plus `Q_Δt`) is not this map. Free `T0VAR` `p_0` is not this map. As `Δt → ∞` with stable `a < 0` the carried `p_0` vanishes and `Q_Δt` approaches `−q / (2 a)`, so the composition approaches contemporaneous stationary `T0VAR`. As `Δt → 0+` the composition approaches `trait + p_0 + (B / a)² v`. Nonzero diffusion with `a ≥ 0` is a growing process and is kept. The interval must be event time and strictly positive. Equation 5 of that later-occasion variance is `λ²(trait + e^{2 a Δt} p_0 + Q_Δt + (B / a)² v) + θ + ψ`. `MANIFESTVAR` is not that later-occasion observed variance. The predetermined later-occasion latent variance is not the predetermined later-occasion observed variance. Stationary later-occasion observed variance is not that observed variance when `p_0` is free. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall 2026-08-23T05:12Z: `is_oa: false`; title *Measurement Invariance, Factor Analysis and Factorial Invariance*). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-23T05:12Z: `is_oa: false`; title *Randomization-Based Inference about Latent Variables from Complex Samples*). -- Branch coverage JSON now unique-folds `files[].branches` True/False counts across instantiations. Nightly totals on #49 head `1e3e2eb` reported `event_time.rs` 505/506 while every unique site had both arms taken (253 sites × 2 instantiations). Summary-only reports without branch arrays still fail closed on totals. The 100% contract is unique production arms, matching the LCOV authored-line gate. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. -- `psychometric_core` maps overflowing `expm1(a Δt)` / `expm1(2 a Δt)` in `recover_discrete_constant_predictor_effect` and `recover_discrete_process_noise` through the log-space rewrite without a redundant `if !argument.is_finite()` after overflow. Local crate llvm-cov on #49 head `559e7b399473ee90ba3234677dd9ef7f05f7fd2e` was 509/510: the same LLVM `exp`/`expm1` finite-argument proof as L768/L5040. Existing rewrite (`a = 800` / `a = 400`) and overflow (`a = 1e308`) tests remain the contract. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. -- `psychometric_core` maps overflowing `e^{a Δt}` / `e^{a(t−u)}` through the log-space rewrite without redundant `if !argument.is_finite()` after `exp` overflow on lagged covariance, T0 TI/TD carry, and impulse carry. Nightly branch coverage on #49 head `7e669babcc54408dd8407bbac56be0f304fa99e5` was 1713/1714: LLVM counted `event_time.rs` L5040 True and treated the finite-argument overflow False as uncovered after proving `exp` of a finite argument is finite, which binary64 overflow falsifies. `fit_scalar_log_rate` now also skips a zero earlier residual and a negative lag while still recovering from a valid pair. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. -- `psychometric_core` maps overflowing `e^{2 a Δt}` in `recover_discrete_latent_variance` through the log-space rewrite `(ln p + 2 a Δt).exp()` without a redundant `if !2 a Δt.is_finite()` after `exp` overflow. Nightly branch coverage on #49 head `e301e9706c0bd671ccad533063fb624cc568d0b3` was 1715/1716: LLVM counted `event_time.rs` L768 True and treated the finite-argument overflow False as uncovered after proving `exp` of a finite argument is finite, which binary64 overflow falsifies. Existing rewrite (`p = 1e-308`, `a = 400`, `Δt = 1`) and overflow (`a = 1e308`) tests remain the contract. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. -- `psychometric_core` executes the later `|| !log_rate.is_finite()` operand on `recover_discrete_time_independent_predictor_effect` from both the lib tests and the multilevel integration crate. Nightly branch coverage on #49 head `90b08bbe82cbe7776365a6c04df38857dfe5e53c` was 1714/1716: both True arms at `event_time.rs` L2480 were unhit because fail-closed tests supplied a non-finite `TIPREDEFFECT` or predictor before `a`. Direct `a = NaN` now takes those arms. `LagClock::as_str` is called through `black_box` so the outlined instantiation is not const-folded away. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. -- `psychometric_core` evaluates the Driver, Oud, and Voelkle (2017, §7.2) extra-process lag as `e^{ε Δt}` even when `ε Δt` underflows to `0` (`exp(0) = 1`). Nightly branch coverage on #49 head `22b8e68813ad59a9a91689bacfa4cf033dfad158` was 1718/1720: LLVM deleted `if extra_argument == 0.0` / `original_argument == 0.0` True after proving `ε < 0` and `Δt > 0` imply a nonzero product, which binary64 underflow falsifies. The public map now uses `exp` directly; `original_log_rate == 0` remains the Brownian `e^{0} = 1` path. Recovery tests assert the §7.2 identity `a_{ηξ} x e^{a Δt}(e^{(ε−a)Δt} − 1)/(ε − a)` on `(-min_subnormal) * 1e-320`. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. -- `psychometric_core` integration tests now execute the Driver, Oud, and Voelkle (2017, Eq. 3 first-summand carry) overflow rewrite of Table 3 `T0TIPREDEFFECT` / `T0TDPREDEFFECT` (`sign(t0_b z) exp(ln|t0_b z| + a Δt)` and the same form for `t0_m x0`). Nightly branch coverage on #49 head `d634f5849ed8e9f75af1b43c2e59d8e7d6301b45` was 1718/1720: the two missing records were the unused non-`cfg(test)` instantiations of `if !drift_interval.is_finite()` at the T0 TI and T0 TD carry overflow rewrites (`event_time.rs` L4245 and L4628). Lib tests already covered both sides; integration tests now take overflowing `a Δt` (`1e308 * 2`) and finite-`a Δt` overflowed `exp` (`710`) on those public maps. Meredith (1993) remains unread (Unpaywall 2026-08-22T23:12Z: `is_oa: false`; title *Measurement Invariance, Factor Analysis and Factorial Invariance*). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-22T23:12Z: `is_oa: false`; title *Randomization-Based Inference about Latent Variables from Complex Samples*). Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. -- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, §4.3, pp. 9–10; Eq. 3–5, pp. 4–5; Table 2, p. 12; p. 16; §7.2, pp. 20–21; JSS PDF re-opened 2026-08-22T23:12Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar later-occasion variance of §4.3 stationary `T0VAR`. Section 4.3 constrains first-occasion variance according to the model-predicted variances across all time points. Equation 3 writes `η(t) = exp(A Δt) η(t0) + … +` the stochastic integral. Equation 4 writes that the integral exhibits covariance `Q_Δt`. The law of total variance on the within-subject state is `e^{2 a Δt}(−q / (2 a)) + Q_Δt`. Trait variance and `addedTIPREDVAR` are time-invariant between-subject and do not enter that process-noise integral. The later-occasion composition is `trait + e^{2 a Δt}(−q / (2 a)) + Q_Δt + (B / a)² v`. Form the evolved within-subject variance first, then include the trait, then include the TI extra variance, then add. Under stationarity that composition equals contemporaneous `T0VAR`. Evolving the constrained total as if it were all state (`e^{2 a Δt} p_stat + Q_Δt`) is not this map. The lagged covariance `trait + e^{a Δt}(−q / (2 a)) + (B / a)² v` omits `Q_Δt` and is not this map. `Q_Δt` is not this map. The interval must be event time and strictly positive. Equation 5 of that later-occasion variance is `λ²(trait + e^{2 a Δt}(−q / (2 a)) + Q_Δt + (B / a)² v) + θ + ψ`. The lagged observed covariance omits `Q_Δt` and `θ`. `MANIFESTVAR` is not that later-occasion observed variance. The later-occasion latent variance is not the later-occasion observed variance. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall 2026-08-22T23:12Z: `is_oa: false`; title *Measurement Invariance, Factor Analysis and Factorial Invariance*). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-22T23:12Z: `is_oa: false`; title *Randomization-Based Inference about Latent Variables from Complex Samples*). -- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, §4.3, pp. 9–10; Eq. 3–5, pp. 4–5; Table 2, p. 12; p. 16; §7.2, pp. 20–21; JSS PDF re-opened 2026-08-22T19:13Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar lagged covariance of §4.3 stationary `T0VAR`. Equation 3 writes `η(t) = exp(A Δt) η(t0) + …`. Equation 4 writes `cov(η_t, η_{t-1}) = A_Δt cov(η_{t-1})`. The contemporaneous constraint is `trait + −q / (2 a) + (B / a)² v`. Trait variance and `addedTIPREDVAR` are time-invariant between-subject and do not decay with `e^{a Δt}`. The lagged composition is `trait + e^{a Δt}(−q / (2 a)) + (B / a)² v`. Form the lagged within-subject covariance first, then include the trait, then include the TI extra variance, then add. As `Δt → ∞` with stable `a < 0` the state term vanishes. As `Δt → 0+` the lagged map approaches contemporaneous `T0VAR`. Those limits are not this finite-lag map. Evolving the constrained total as if it were all state is not this map. `trait + e^{a Δt} p` is not this map when `addedTIPREDVAR` is nonzero. Contemporaneous `T0VAR` is not this map. The interval must be event time and strictly positive. Equation 5 of that lagged covariance is `λ²(trait + e^{a Δt}(−q / (2 a)) + (B / a)² v) + ψ`. Independent `ε_t` does not enter. `MANIFESTVAR` is not that lagged observed covariance. Contemporaneous `Var(y_0)` includes `θ` and is not that lagged observed covariance. The lagged latent covariance is not the lagged observed covariance. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall 2026-08-22T19:13Z: `is_oa: false`; title *Measurement Invariance, Factor Analysis and Factorial Invariance*). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-22T19:13Z: `is_oa: false`; title *Randomization-Based Inference about Latent Variables from Complex Samples*). -- `psychometric_core` rustfmt-sorts the `event_time` test import list and wraps four long test signatures so `cargo fmt --check` matches 1.97.1. Nightly branch coverage on #49 head `a6bea47acc38de1a33ed403360eb5cacd3023df6` was 1691/1712: the 21 missing True sides in `event_time.rs` were later `||` operands and `!Δt.is_finite()` (as opposed to `Δt <= 0`) on lagged observed covariance, extra-process, asymptotic TI/CINT, T0 carry, and impulse-carry guards. Direct inner-map calls now execute those arms. `as_measurement_invariance_wire_name` maps only Configural/Metric/Strong onto `#84` `configural`/`metric`/`scalar` and returns `None` for local Strict (`as_str` remains `"strict"`). Parent-head coverage note on `ebd01c4` is historical. Meredith (1993) remains unread (Unpaywall 2026-08-22T16:13Z: `is_oa: false`; Springer `content/pdf` is HTML 200). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-22T16:13Z: `is_oa: false`; Springer `content/pdf` is HTML 200). Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. -- `psychometric_core` covers the remaining fail-closed arms on `event_time.rs` lines 1995, 1998, 2063, 2065, 3695, 3706, 3751, 4078, 4089, and 4134 (nightly line/branch gaps on predecessor #49 head `ebd01c4`). Non-event clocks, non-positive and non-finite `Δt`, after-t0 extra-process interval errors after a successful `μ_t`, a zero extra-process contribution returning `μ_t`, Table 3 `T0TIPREDEFFECT`/`T0TDPREDEFFECT` effect errors through the carry, overflowing `a Δt` products, and those carry errors through the evolved-mean composition now execute. Meredith (1993) remains unread (Unpaywall 2026-08-22T12:15Z: `is_oa: false`; Springer `content/pdf` is HTML 200; Cambridge Core PDF 302 to a closed product page). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-22T12:15Z: `is_oa: false`; Springer `content/pdf` is HTML 200; NCES 404; ETS RR-91-18 404). Driver, Oud, and Voelkle (2017) JSS PDF re-opened 2026-08-22T12:17Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. -- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, §4.3, pp. 9–10; Eq. 5, p. 5; Table 2, p. 12; p. 16; §7.2, pp. 20–21; JSS PDF re-opened 2026-08-22T03:20Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar observed-indicator variance of §4.3 stationary `T0VAR`. Section 4.3 constrains the first-occasion variance to the model-predicted variance when `stationary` includes `"T0VAR"`. Equation 5 writes `y_i(t) = Γ + Λ η_i(t) + ζ_i(t)` with `ζ ~ N(0, Θ)` and `Γ ~ N(τ, Ψ)`. The constrained latent variance is `trait + −q / (2 a) + (B / a)² v`. The scalar composition is `Var(y_0) = λ²(trait + −q / (2 a) + (B / a)² v) + θ + ψ`. Form the stationary latent variance first, then `λ² p + θ + ψ`. A zero loading is exactly `θ + ψ`. A zero trait, a zero diffusion, and a zero TI contribution is exactly `θ + ψ`. `λ² p_0` for free `T0VAR` is not this composition. `λ²(−q / (2 a)) + θ` is not this composition when `TRAITVAR` or `addedTIPREDVAR` is nonzero. Evolving the constrained variance as if it were all state is not this composition when the trait or TI contribution is nonzero. `MANIFESTVAR` is not `Var(y_0)`. The constrained latent variance is not `Var(y_0)`. `TRAITVAR` is latent and is scaled by `λ²`; `MANIFESTTRAITVAR` is not. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall 2026-08-22T03:20Z: `is_oa: false`). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-22T03:20Z: `is_oa: false`; Springer `content/pdf` is HTML 200). -- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, §4.3, pp. 9–10; p. 16; Table 2, p. 12; §7.2, pp. 20–21; Eq. 4, p. 5; JSS PDF re-opened 2026-08-22T03:07Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar stationary `T0VAR`. Section 4.3 constrains the first-occasion variance to the model-predicted variance when `stationary` includes `"T0VAR"`. Page 16 names `asymDIFFUSION` the total within-subject variance `-q / (2 a)`. Section 4.3 (p. 9) adds `TRAITVAR`. Section 7.2 names `addedTIPREDVAR` the stable between-subject variance accounted for by time-independent predictors, `(B / a)² v`. The scalar composition is `trait + −q / (2 a) + (B / a)² v`. Form the within-subject contribution first, then include the trait, then include the TI extra variance, then add. A zero trait, a zero diffusion, and a zero TI contribution is exactly zero. A zero diffusion and a zero TI contribution is exactly the trait. `a ≥ 0` cannot hold a finite process variance when the diffusion or the TI contribution is nonzero and fails closed. Trait-only variance does not require a stable drift. That constrained first-occasion variance is not free `T0VAR`, not `asymDIFFUSION` alone, not `TRAITVAR` alone, not `addedTIPREDVAR` alone, and not the finite-interval discrete latent variance. The printed 2-latent `addedTIPREDVAR` 2.838 is not this scalar map. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall 2026-08-22T03:07Z: request empty). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-22T03:07Z: request empty; ETS RR-88-45 PDF 404; Wiley PDF 403). -- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, §4.3, pp. 9–10; Eq. 5, p. 5; Table 2, p. 12; Eq. 3, p. 5; JSS PDF re-opened 2026-08-21T20:07Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar observed-indicator mean of §4.3 stationary `T0MEANS`. Section 4.3 constrains the first-occasion mean to the model-predicted mean when `stationary` includes `"T0MEANS"`. Equation 5 writes `y_i(t) = Γ + Λ η_i(t) + ζ_i(t)` with `ζ ~ N(0, Θ)` and `Γ ~ N(τ, Ψ)`. The constrained latent mean is `-κ / a + −B z / a`. The scalar composition is `E(y_0) = τ + λ(−κ / a + −B z / a)`. Form the stationary latent mean first, then `τ + λ` of that mean. A zero loading is exactly `τ`. A zero intercept and a zero TI contribution is exactly `τ`. Evolving from that stationary start with `CINT` and `TIPREDEFFECT` stays at the stationary mean. `τ + λ μ_0` for free `T0MEANS` is not this composition. `τ + λ(−κ / a)` is not this composition when `B z ≠ 0`. `τ + λ μ_t` is not this composition. `MANIFESTMEANS` is not `E(y_0)`. The constrained latent mean is not `E(y_0)`. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall request empty this cycle). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-21T20:10Z: `is_oa: false`; Springer `content/pdf` is HTML 200). -- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, p. 16; Table 2, p. 12; Eq. 3, p. 5; JSS PDF opened 2026-08-21T16:13Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar stationary `T0MEANS`. Page 16 constrains `T0MEANS` to the model-implied values using `T0MEANSbase` / `T0MEANSfree` when the first observation is determined by the process in the same way as later observations. Those constraints include extra effects due to time-independent predictors (`asymTIPREDEFFECT`). For stable `a < 0` the scalar composition is `-κ / a + −B z / a`. Form the intercept contribution first, then include the TI extra effect, then add. A zero intercept and a zero TI contribution is exactly zero. `a ≥ 0` cannot hold a finite process-mean change when either contribution is nonzero and fails closed. That constrained first-occasion mean is not free `T0MEANS`, not `asymCINT` alone, not `asymTIPREDEFFECT` alone, and not the finite-interval discrete latent mean. The printed 2-latent `T0MEANS` 2.823 is not this scalar map. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) and Mislevy (1991, *Psychometrika, 56*, 177–196) remain unread (Unpaywall 2026-08-21T16:21Z: `is_oa: false`; Springer `content/pdf` is HTML 200). -- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, Table 2, p. 12; Eq. 3, p. 5; §4.3 / p. 16; JSS PDF opened 2026-08-21T16:13Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar `asymCINT`. Table 2 names `κ` `CINT` and names `asymCINT` the asymptotic (`Δt = ∞`) expected change in processes for a 1 unit change in intercept. Equation 3 maps a finite event interval as `A^{-1}[e^{A Δt} − I] κ`. For stable `a < 0` that `Δt → ∞` limit is `-A^{-1} κ`. The scalar map is `-κ / a`. A unit intercept is `-1 / a`. Form `κ` first, then divide by `-a`. A zero intercept is exactly zero. `a ≥ 0` cannot hold a finite process-mean change and fails closed. `-κ / a` is not `κ`, not the finite-interval increment `A^{-1}[e^{A Δt} − I] κ`, not `T0MEANS`, and not `asymTIPREDEFFECT` `-B z / a`. Page 16 notes that a `T0MEANS` stationarity constraint includes time-independent predictors; that composition is not this intercept-only map. The printed 2-latent `CINT` values are not this scalar map. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) and Mislevy (1991, *Psychometrika, 56*, 177–196) remain unread (Unpaywall 2026-08-21T16:21Z: `is_oa: false`; Springer `content/pdf` is HTML 200). -- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, §7.2, pp. 20–21; Eq. 3, p. 5; Table 2, p. 12; JSS PDF opened 2026-08-21T13:08Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar `addedTIPREDVAR`. Section 7.2 names that matrix the stable between-subject variance accounted for by time-independent predictors. For stable `a < 0` and predictor variance `v ≥ 0` the scalar map is `(B / a)² v`. Form the unit asymptotic effect `-B / a` first, then square, then multiply by `v`. A zero coefficient or zero predictor variance is exactly zero. `v < 0` fails closed. `a ≥ 0` cannot hold a finite process-mean change and fails closed. `(B / a)² v` is not `TRAITVAR`, not `asymDIFFUSION`, and not the expected total change `-B z / a`. The printed 2-latent `addedTIPREDVAR` 2.838 is not this scalar map. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) and Mislevy (1991, *Psychometrika, 56*, 177–196) remain unread (Unpaywall 2026-08-21T06:24Z: `is_oa: false`; Springer `content/pdf` is HTML 200). -- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, §7.2, pp. 20–21; Eq. 3, p. 5; Table 2, p. 12; JSS PDF opened 2026-08-21T13:08Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar `asymTIPREDEFFECT`. Table 2 names `B` `TIPREDEFFECT`. Equation 3 maps a finite event interval as `A^{-1}[e^{A Δt} − I] B z`. Section 7.2 names `asymTIPREDEFFECT` the expected total change in process means given an increase of 1 on a time-independent predictor. For stable `a < 0` that total change is `-A^{-1} B`. The scalar map is `-B z / a`. Form `B z` first, then divide by `-a`. A zero coefficient or zero predictor is exactly zero. `a ≥ 0` cannot hold a finite process-mean change and fails closed. `-B z / a` is not the coefficient `B`, not the finite-interval increment `A^{-1}[e^{A Δt} − I] B z`, not `CINT`, and not `M x`. Printed LeisureTime `TIPREDEFFECT` `−0.225` / `asymTIPREDEFFECT` `−1.673` and Happiness `0.549` / `0.219` reconstruct under this map. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) and Mislevy (1991, *Psychometrika, 56*, 177–196) remain unread (Unpaywall 2026-08-21T06:24Z: `is_oa: false`; Springer `content/pdf` is HTML 200). -- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, Eq. 5, p. 5; §7.2, pp. 22–23; JSS PDF re-opened 2026-08-21T06:32Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar observed-indicator mean of an extra-process `TDPREDEFFECT` after `t0`. Section 7.2 names `T0TDPREDEFFECT` when the extra process begins at `t = 0` and `TDPREDEFFECT` when it begins after `t = 0`. The printed extra process has `LAMBDA` 0. Original indicators load on the original process after the `DRIFT` coupling over `t − u` with `t0 < u < t` while `μ_t` still uses `Δt = t − t0`. The scalar composition is `E(y_t) = τ + λ(μ_t + a_{ηξ} x (e^{ε(t−u)} − e^{a(t−u)}) / (ε − a))`. The first-occasion extra-process observed mean uses `Δt` for both the evolution and the extra drive and is not this composition when `u ≠ t0`. The evolved observed mean `τ + λ μ_t` is not this composition. The impulse-carry map `τ + λ(μ_t + e^{a(t−u)} m x)` is a Dirac on the original process and is not this `DRIFT` drive. An impulse at `u = t0` or `u = t` is not interior. A zero original-indicator loading is exactly `τ`. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) and Mislevy (1991, *Psychometrika, 56*, 177–196) remain unread (Unpaywall 2026-08-21T06:24Z: `is_oa: false`; Springer `content/pdf` is HTML 200). -- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, Eq. 5, p. 5; §7.2, pp. 22–23; Eq. 1–3, pp. 4–5; Table 2, p. 12; JSS PDF re-opened 2026-08-21T06:12Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar observed-indicator mean of the extra near-zero-drift latent process contribution. Section 7.2's printed extra process has `LAMBDA` 0 and is not an observed indicator. Original indicators load on the original process after the `DRIFT` coupling `a_{ηξ}`. After a unit identification impulse the latent process at `t` is `μ_t + a_{ηξ} x (e^{ε Δt} − e^{a Δt}) / (ε − a)`. The scalar composition is `E(y_t) = τ + λ(μ_t + a_{ηξ} x (e^{ε Δt} − e^{a Δt}) / (ε − a))`. Form the evolved-plus-contribution latent mean first, then `τ + λ` of that mean. The evolved observed mean `τ + λ μ_t` is not this composition. The contemporaneous map `τ + λ(μ_t + m x)` is not this composition. The extra-process contribution is not `E(y_t)`. The evolved-plus-contribution latent mean is not `E(y_t)`. A zero original-indicator loading is exactly `τ`. A zero coupling recovers `τ + λ μ_t`. `ε ≥ 0` fails closed. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) and Mislevy (1991, *Psychometrika, 56*, 177–196) remain unread (Unpaywall 2026-08-21T06:24Z: `is_oa: false`; Springer `content/pdf` is HTML 200). -- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, §7.2, pp. 22–23; Eq. 1–3, pp. 4–5; Table 2, p. 12; JSS PDF re-opened 2026-08-20T23:10Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar contribution of the extra near-zero-drift latent process. Section 7.2 specifies a lasting level change by that extra process: `T0MEANS`, `CINT`, `T0VAR`, `DIFFUSION`, and `TRAITVAR` of it are fixed to 0; `TDPREDEFFECT` on it is fixed to 1; its `DRIFT` diagonal is very close to 0 (printed example `−0.000001`; precisely 0 causes computational problems); and its effect on the original process is the `DRIFT` coupling `a_{ηξ}`. After a unit identification impulse the scalar contribution is `a_{ηξ} x (e^{ε Δt} − e^{a Δt}) / (ε − a)` (`ε = a` is `a_{ηξ} x Δt e^{a Δt}`). Form `a_{ηξ} x` first. A zero coupling or zero predictor is exactly zero. `ε ≥ 0` fails closed. That contribution is not `κ = −a m x`, not `(1 − e^{a Δt}) m x`, and not the dissipating Dirac `m x`. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) and Mislevy (1991, *Psychometrika, 56*, 177–196) remain unread (Unpaywall 2026-08-20T23:10Z: `is_oa: false`; Springer `content/pdf` is HTML 200). -- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, §7.2, pp. 20–21; Eq. 3, pp. 4–5; Table 2, p. 12; JSS PDF re-opened 2026-08-20T19:50Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar discrete increment of the lasting level-change `CINT`. Section 7.2 sets `CINT` to `TDPREDEFFECT * −DRIFT` (`κ = −a m x`). Equation 3 maps that intercept through `A^{-1}[e^{A Δt} − I] κ`. With `κ = −a m x` the scalar increment is `(e^{a Δt} − 1)/a · (−a m x) = (1 − e^{a Δt}) m x`. Form the level-change `CINT` first, then the discrete intercept map. Underflow of `e^{a Δt}` to `+0` keeps the equilibrium offset `m x`. `(1 − e^{a Δt}) m x` is not the contemporaneous jump `m x`. `(1 − e^{a Δt}) m x` is not `κ`. `(1 − e^{a Δt}) m x` is not `A^{-1}[e^{A Δt} − I] B z`. Stable `a < 0` is required. A zero effect or zero predictor is exactly zero. Still not a Kalman filter, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) and Mislevy (1991, *Psychometrika, 56*, 177–196) remain unread (Unpaywall 2026-08-20T19:45Z: `is_oa: false`; Springer `content/pdf` is HTML 200). -- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, §7.2, pp. 20–21; Eq. 1–3, pp. 4–5; Table 2, p. 12; JSS PDF re-opened 2026-08-20T19:45Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar lasting level-change `CINT`. Section 7.2 contrasts a sudden Dirac that dissipates back to the process mean with a lasting level change. To generate that lasting change, `CINT` is set to `TDPREDEFFECT * −DRIFT`. The scalar setting is `κ = −a m x`. Form `m x` first, then multiply by `−a`. Stable `a < 0` is required so `−κ / a = m x` is an equilibrium offset. `a ≥ 0` cannot hold a new process mean. `−a m x` is not the contemporaneous jump `m x`. `−a m x` is not a free `CINT`. `−a m x` is not `A^{-1}[e^{A Δt} − I] B z`. The extra near-zero-drift latent process also named in §7.2 is a different specification and is not this `CINT` setting. A zero effect or zero predictor is exactly zero. Still not a Kalman filter, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) and Mislevy (1991, *Psychometrika, 56*, 177–196) remain unread (Unpaywall 2026-08-20T19:45Z: `is_oa: false`; Springer `content/pdf` is HTML 200). -- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, Eq. 5, p. 5; Eq. 3 first summand, p. 5; Table 3, p. 13; JSS PDF re-opened 2026-08-20T19:07Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar observed-indicator mean of a first-occasion time-dependent predictor. Equation 5 writes `y_i(t) = Γ + Λ η_i(t) + ζ_i(t)` with `ζ ~ N(0, Θ)` and `Γ ~ N(τ, Ψ)`. Table 3 names `T0TDPREDEFFECT` the effect of time-dependent predictors on latents at `T0`. Equation 3's first summand carries that shift as `e^{A Δt} t0_m x0`. The scalar composition is `E(y_t) = τ + λ(μ_t + e^{a Δt} t0_m x0)`. Form the evolved-plus-carry latent mean first, then `τ + λ` of that mean. The evolved observed mean `τ + λ μ_t` is not this composition. The process-increment map `τ + λ(μ_t + A^{-1}[e^{A Δt} − I] B z)` is not this composition. The contemporaneous map `τ + λ(μ_t + m x)` is not this composition. The impulse-carry map `τ + λ(μ_t + e^{a(t−u)} m x)` is not this composition when `u ≠ t0`. The first-occasion TI map `τ + λ(μ_t + e^{a Δt} t0_b z)` is not this composition. `MANIFESTMEANS` is not `E(y_t)`. The evolved-plus-carry latent mean is not `E(y_t)`. `T0TDPREDEFFECT` is the coefficient, not that observed mean. Same numbers as `T0TIPREDEFFECT` yield the same product; Table 3 names a different matrix. A zero loading is exactly `τ`. Still not a Kalman filter, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) and Mislevy (1991, *Psychometrika, 56*, 177–196) remain unread (Unpaywall 2026-08-20T19:09Z: `is_oa: false`). -- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, Table 3, p. 13; Eq. 3 first summand, p. 5; JSS PDF re-opened 2026-08-20T19:10Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar first-occasion time-dependent predictor shift and its carry. Table 3 names `T0TDPREDEFFECT` the effect of time-dependent predictors on latents at `T0`. Table 2 / Table 3 name `TDPREDEFFECT` `M`, which enters Equation 3 as the printed fourth-summand Dirac `M x` at `u = t`. Those are not the same matrix. The scalar first-occasion shift is `t0_m x0`. Equation 3's first summand carries that shift as `e^{A Δt} t0_m x0`. Form `t0_m x0` first, then `e^{a Δt} t0_m x0`. Form `μ_t` first, then add that carry. A zero drift is `t0_m x0` with no dissipation. Binary64 underflow of `e^{a Δt}` to `+0` is a vanishing carry of the first-occasion shift and is kept. `t0_m x0` is not `M x`, not `e^{A(t−u)} M x` for `t0 < u < t`, not `t0_b z`, not `A^{-1}[e^{A Δt} − I] B z`, and not `κ`. `e^{A Δt} t0_m x0` is not `t0_m x0`. `T0TDPREDEFFECT` is the coefficient, not `t0_m x0`. An impulse at `u ≤ t0` that used `M` is already in `η(t0)` as `TDPREDEFFECT`, not as `T0TDPREDEFFECT`. Still not a Kalman filter, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) and Mislevy (1991, *Psychometrika, 56*, 177–196) remain unread (Unpaywall 2026-08-20T19:09Z: `is_oa: false`). -- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, Eq. 5, p. 5; Eq. 3 first summand, p. 5; Table 3, p. 13; JSS PDF re-opened 2026-08-20T15:28Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar observed-indicator mean of a first-occasion time-independent predictor. Equation 5 writes `y_i(t) = Γ + Λ η_i(t) + ζ_i(t)` with `ζ ~ N(0, Θ)` and `Γ ~ N(τ, Ψ)`. Table 3 names `T0TIPREDEFFECT` the effect of time-independent predictors on latents at `T0`. Equation 3's first summand carries that shift as `e^{A Δt} t0_b z`. The scalar composition is `E(y_t) = τ + λ(μ_t + e^{a Δt} t0_b z)`. Form the evolved-plus-carry latent mean first, then `τ + λ` of that mean. The evolved observed mean `τ + λ μ_t` is not this composition. The process-increment map `τ + λ(μ_t + A^{-1}[e^{A Δt} − I] B z)` is not this composition. The contemporaneous map `τ + λ(μ_t + m x)` is not this composition. The impulse-carry map `τ + λ(μ_t + e^{a(t−u)} m x)` is not this composition when `u ≠ t0`. `MANIFESTMEANS` is not `E(y_t)`. The evolved-plus-carry latent mean is not `E(y_t)`. `T0TIPREDEFFECT` is the coefficient, not that observed mean. A zero loading is exactly `τ`. Still not a Kalman filter, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) and Mislevy (1991, *Psychometrika, 56*, 177–196) remain unread (Unpaywall 2026-08-20T15:14Z: `is_oa: false`; Springer `content/pdf` is HTML 200). -- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, Table 3, p. 13; Eq. 3 first summand, p. 5; JSS PDF opened 2026-08-20T15:14Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar first-occasion time-independent predictor shift and its carry. Table 3 names `T0TIPREDEFFECT` the effect of time-independent predictors on latents at `T0`. Table 2 / Table 3 name `TIPREDEFFECT` `B`, which enters Equation 3 as `A^{-1}[e^{A(t−t0)} − I] B z`. Those are not the same matrix. The scalar first-occasion shift is `t0_b z`. Equation 3's first summand carries that shift as `e^{A Δt} t0_b z`. Form `t0_b z` first, then `e^{a Δt} t0_b z`. Form `μ_t` first, then add that carry. A zero drift is `t0_b z` with no dissipation. Binary64 underflow of `e^{a Δt}` to `+0` is a vanishing carry of the first-occasion shift and is kept. `t0_b z` is not `A^{-1}[e^{A Δt} − I] B z`, not `κ`, and not `M x`. `e^{A Δt} t0_b z` is not `t0_b z`. `T0TIPREDEFFECT` is the coefficient, not `t0_b z`. Still not a Kalman filter, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) and Mislevy (1991, *Psychometrika, 56*, 177–196) remain unread (Unpaywall 2026-08-20T15:14Z: `is_oa: false`; Springer `content/pdf` is HTML 200). -- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, Eq. 5, p. 5; Eq. 3, p. 5; Table 2, p. 12; JSS PDF re-opened 2026-08-20T12:12Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar observed-indicator mean of a time-independent predictor. Equation 5 writes `y_i(t) = Γ + Λ η_i(t) + ζ_i(t)` with `ζ ~ N(0, Θ)` and `Γ ~ N(τ, Ψ)`. Equation 3 prints the `TIPREDEFFECT` increment as the addend `A^{-1}[e^{A(t−t0)} − I] B z_i` after the `T0MEANS` carry and the `CINT` increment. Table 2 names `B` `TIPREDEFFECT`. The scalar composition is `E(y_t) = τ + λ(μ_t + A^{-1}[e^{A Δt} − I] B z)`. Form the evolved-plus-increment latent mean first, then `τ + λ` of that mean. The evolved observed mean `τ + λ μ_t` is not this composition. The contemporaneous map `τ + λ(μ_t + m x)` is not this composition. The carry map `τ + λ(μ_t + e^{a(t−u)} m x)` is not this composition when `u ≠ t`. `MANIFESTMEANS` is not `E(y_t)`. The evolved-plus-increment latent mean is not `E(y_t)`. `TIPREDEFFECT` is `B`, not that observed mean. A zero loading is exactly `τ`. Still not a Kalman filter, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993), Vandenberg and Lance (2000), and Mislevy (1991, *Psychometrika, 56*, 177–196) remain unread (Unpaywall 2026-08-20T05:12Z: `is_oa: false`). -- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, Eq. 5, p. 5; Eq. 1–3, pp. 4–5; Table 2, p. 12; §7.2, pp. 20–21; JSS PDF re-opened 2026-08-20T09:01Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar observed-indicator mean of a contemporaneous time-dependent impulse. Equation 5 writes `y_i(t) = Γ + Λ η_i(t) + ζ_i(t)` with `ζ ~ N(0, Θ)` and `Γ ~ N(τ, Ψ)`. The latent process at `t` after a contemporaneous Dirac (`u = t`) is `μ_t + m x`. The scalar composition is `E(y_t) = τ + λ(μ_t + m x)`. Form the evolved-plus-impulse latent mean first, then `τ + λ` of that mean. The evolved observed mean `τ + λ μ_t` is not this composition. The carry map `τ + λ(μ_t + e^{a(t−u)} m x)` is not this composition when `u ≠ t`. `MANIFESTMEANS` is not `E(y_t)`. The evolved-plus-impulse latent mean is not `E(y_t)`. A zero loading is exactly `τ`. The §7.2 level-change form is a different specification and is not this map. Still not a Kalman filter, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993), Vandenberg and Lance (2000), and Mislevy (1991, *Psychometrika, 56*, 177–196) remain unread (Unpaywall 2026-08-20T05:12Z: `is_oa: false`). -- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, Eq. 5, p. 5; Eq. 1–2, pp. 4–5; Eq. 3 exponential map; Table 2, p. 12; §7.2, pp. 20–21; JSS PDF re-opened 2026-08-20T05:12Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar observed-indicator mean of a within-interval time-dependent impulse carry. Equation 5 writes `y_i(t) = Γ + Λ η_i(t) + ζ_i(t)` with `ζ ~ N(0, Θ)` and `Γ ~ N(τ, Ψ)`. The latent process at `t` after a Dirac that occurred strictly inside `(t0, t)` is `μ_t + e^{a(t−u)} m x`. The scalar composition is `E(y_t) = τ + λ(μ_t + e^{a(t−u)} m x)`. Form the carried latent mean first, then `τ + λ` of that mean. The evolved observed mean `τ + λ μ_t` is not this composition. The contemporaneous map `τ + λ(μ_t + m x)` is not this composition when `u ≠ t`. `MANIFESTMEANS` is not `E(y_t)`. The carried latent mean is not `E(y_t)`. A zero loading is exactly `τ`. The §7.2 level-change form is a different specification and is not this map. Still not a Kalman filter, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993), Vandenberg and Lance (2000), and Mislevy (1991, *Psychometrika, 56*, 177–196) remain unread (Unpaywall 2026-08-20T05:12Z: `is_oa: false`). -- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, Eq. 1–2, pp. 4–5; Eq. 3 exponential map; Table 2, p. 12; §7.2, pp. 20–21; JSS PDF re-opened 2026-08-20T10:33Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar within-interval time-dependent predictor impulse carry. Equation 1 writes `dη = (A η + ξ + B z + M χ(t)) dt + G dW`. Equation 2 writes `χ_i(t) = Σ x_{i,u} δ(t − u)`. The Green-function integral of that Dirac on `(t0, t)` is `e^{A(t−u)} M x`. The printed Eq. 3 fourth summand is the contemporaneous jump `M x` at `u = t`. This map is the strictly within-interval case `t0 < u < t`. Form `m x` first, then `e^{a(t−u)} m x`. A zero drift is `m x` with no dissipation. Underflow of `e^{a(t−u)}` to `+0` is vanishing dissipation back to the process mean and is kept. Form `μ_t` first, then add the carry. `e^{A(t−u)} M x` is not the contemporaneous Dirac, not `CINT`, not `A^{-1}[e^{A Δt} − I] B z` (`TIPREDEFFECT`), and not Voelkle et al. (2012, Eq. 14) `a_{yx} Δt`. An impulse at `u = t` is the contemporaneous map. An impulse at `u ≤ t0` is already in `η(t0)`. The §7.2 level-change form is a different specification and is not this map. Still not a Kalman filter, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993), Vandenberg and Lance (2000), and Mislevy (1991, *Psychometrika, 56*, 177–196) remain unread (Unpaywall 2026-08-20T10:33Z: `is_oa: false`). -- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, Eq. 1–3, pp. 4–5; Table 2, p. 12; JSS PDF re-opened 2026-08-20T10:13Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar time-independent predictor increment. Equation 1 writes `dη = (A η + b + A_{ηξ} ξ + B z) dt + G dW + M dχ`. Equation 3's second summand is `A^{-1}[e^{A Δt} − I](b + A_{ηξ} ξ + B z)`. Table 2 names `B` `TIPREDEFFECT`. Form `B z` first, then the discrete intercept map. A zero drift is `B z Δt`. Form `μ_t` first, then add that increment. `TIPREDEFFECT` is `B`, not the discrete increment. `A^{-1}[e^{A Δt} − I] B z` is not `CINT`, not `M x` (`TDPREDEFFECT`), and not Voelkle et al. (2012, Eq. 14) `a_{yx} Δt`. Still not a Kalman filter, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993), Vandenberg and Lance (2000), and Mislevy (1991, *Psychometrika, 56*, 177–196) remain unread (Unpaywall 2026-08-20T10:13Z: `is_oa: false`). -- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, Eq. 1–3, pp. 4–5; Table 2, p. 12; §7.2, pp. 20–21; JSS PDF re-opened 2026-08-20T07:10Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar contemporaneous time-dependent predictor impulse. Equation 2 writes `χ_i(t) = Σ x_{i,u} δ(t − u)`. Equation 3's fourth summand is `M Σ x_{i,u} δ(t − u)`. Table 2 names `M` `TDPREDEFFECT`. Section 7.2 calls this a sudden impulse that dissipates back to the process mean and reports `TDPREDEFFECT` as the initial impact. The scalar jump is `m x`. Form `μ_t` first, then add `m x`. `TDPREDEFFECT` is not `CINT`. `M x` is not `A^{-1}[e^{A Δt} − I] B z` (`TIPREDEFFECT`). `M x` is not Voelkle et al. (2012, Eq. 14) `a_{yx} Δt`. The §7.2 level-change form is a different specification and is not this map. Still not a Kalman filter, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993), Vandenberg and Lance (2000), and Mislevy (1991, *Psychometrika, 56*, 177–196) remain unread (Unpaywall 2026-08-20T07:10Z: `is_oa: false`). -- `psychometric_core` caps two-observation two-group OLS residual invariance at strong/scalar. `ordinary_least_squares_fit` returns residual variance `0` when `n ≤ 2`; that identity is not an estimated residual and is not strict. Putnick and Bornstein (2016, PMC author manuscript PMC5145197 opened 2026-08-19T22:15Z from https://pmc.ncbi.nlm.nih.gov/articles/PMC5145197/) require scalar invariance before latent-mean comparison; residual invariance is not a prerequisite because residuals are not part of the latent factor. Matching loading and intercept with `n = 2` therefore stay strong/scalar and still license `(ȳ_c − ȳ_r)/λ`. This is still two-group OLS, not MGCFA. Meredith (1993) remains unread (OpenAlex/Semantic Scholar 2026-08-19T22:15Z: closed; Springer `content/pdf` is HTML 200). Vandenberg and Lance (2000) remains unread (cited by Putnick for the residual-not-required claim). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread. -- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, Eq. 3, p. 5; Eq. 5, p. 5; Table 2, p. 12; JSS PDF re-opened 2026-08-19T22:10Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar evolved observed-indicator mean. Equation 3 writes `η_i(t) = exp(A Δt) η_i(t0) + A^{-1}[exp(A Δt) − I] ξ_i + …` with `ξ_i ~ N(κ, φ_ξ)` (p. 4) and a stochastic integral of mean zero. Equation 5 writes `y_i(t) = Γ_i + Λ η_i(t) + ζ_i(t)` with `Γ ~ N(τ, Ψ)` and `ζ ~ N(0, Θ)`. The scalar composition is `E(y_t) = τ + λ μ_t` with `μ_t` the Eq. 3 expected-value map. Form `μ_t` first, then `τ + λ μ_t`. The first-occasion map `τ + λ μ_0` is not `E(y_t)`. `MANIFESTMEANS` is not `E(y_t)`. `T0MEANS` is not `E(y_t)`. `μ_t` is not `E(y_t)`. A zero-CINT overflow of `exp(a Δt)` fails the carried `T0MEANS` term closed (`a = 710`, `Δt = 1`). Still not a Kalman filter, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) remains unread (OpenAlex 2026-08-19T22:10Z: closed; Springer `content/pdf` is HTML 200). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (OpenAlex/Semantic Scholar 2026-08-19T22:10Z: closed). Putnick and Bornstein (2016) PMC PDF was HTML/500 on this cycle. Oud and Jansen (2000) remains unread. ZORA Anubis-blocked. Asparouhov and Muthén (2009) statmodel PDF re-opened 2026-08-19T22:10Z; it cites Meredith (1993) and discusses multiple-group intercept/mean structures but does not license this map. -- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, Eq. 3, p. 4; Table 2, p. 12; JSS PDF re-opened 2026-08-19T18:10Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar expected-value latent mean. Equation 3 writes `η(t) = exp(A Δt) η(t0) + ∫ exp(A(t−s)) (b + …) ds` plus a stochastic integral of mean zero. Table 2 names the first-occasion latent mean `T0MEANS` and `κ` `CINT`. The scalar map is `μ_t = exp(a Δt) μ_0 + (exp(a Δt) − 1)/a κ`. Form the CINT increment first, then add the carried `T0MEANS` term. A zero drift is the Eq. 3 integral `κ Δt` (`A = 0` has no inverse). As `Δt → ∞` with stable `a < 0`, `μ_t → −κ / a`. Binary64 underflow of `exp(a Δt)` to `+0` drops the carried `T0MEANS` and keeps that equilibrium increment. `T0MEANS` is not `μ_t`. `CINT` is not the discrete increment. `CINT` is not `T0MEANS`. Still not a Kalman filter, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) and Mislevy (1991, *Psychometrika, 56*, 177–196) remain unread (OpenAlex 2026-08-19T18:10Z: closed; Springer `content/pdf` is HTML 200). Oud and Jansen (2000) remains unread. ZORA Anubis-blocked. -- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, Eq. 5, p. 5; Table 2, p. 12; JSS PDF re-opened 2026-08-19T14:08Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar observed-indicator mean. Equation 5 writes `y_i(t) = Γ + Λ η_i(t) + ζ_i(t)` with `ζ ~ N(0, Θ)` and `Γ ~ N(τ, Ψ)`. Table 2 names `τ` `MANIFESTMEANS`, `κ` `CINT`, and the first-occasion latent mean `T0MEANS`. The scalar map is `E(y) = τ + λ μ`. Form `λ μ` then add `τ`. Do not treat `MANIFESTMEANS` as `E(y)`. `E(η)` is not `E(y)`. `CINT` is not `MANIFESTMEANS`. `T0MEANS` is not `E(y)`. Forming `λ²` is the variance path, not this mean. Still not a Kalman filter, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) and Mislevy (1991, *Psychometrika, 56*, 177–196) remain unread (Unpaywall 2026-08-19T14:08Z: closed). Oud and Jansen (2000) remains unread. ZORA Anubis-blocked. -- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, Eq. 5, p. 5; Eq. 3–4, pp. 4–5; Table 2, p. 12; JSS PDF re-opened 2026-08-19T04:18Z) scalar lagged observed-indicator covariance. Independent measurement error does not enter `cov(y_t, y_{t-1})`. The scalar map is `λ² cov(η_t, η_{t-1}) + ψ`. Form `(λ c) λ` then add `ψ`. Do not form `λ²` first (`λ = 1e308`, `c = 1e-308` → `1e308`). `MANIFESTVAR` is not lagged observed covariance. Lagged `Var(η)` path is not `cov(y)`. Still not a Kalman filter, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) and Mislevy (1991, *Psychometrika, 56*, 177–196) remain unread (Unpaywall 2026-08-19T04:25Z: closed). -- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, Eq. 5, p. 5; Table 2, p. 12; JSS PDF re-opened 2026-08-19T04:18Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar observed-indicator variance with `MANIFESTTRAITVAR`. Equation 5 writes `y_i(t) = τ_i + Λ η_i(t) + ε_i(t)` with `ε ~ N(0, Θ)` and `τ_i ~ N(μ_τ, Ψ_τ)`. Equation 1 (p. 4) is the latent SDE, not the measurement model. Table 2 names `Θ` `MANIFESTVAR` and `Ψ_τ` `MANIFESTTRAITVAR`; p. 16 restates those names. The scalar map is `Var(y) = λ² Var(η) + θ` when `Ψ_τ = 0` and `λ² Var(η) + θ + ψ` otherwise. Form `(λ p) λ` then add `θ`, then add `ψ`. `MANIFESTVAR` is not `Var(y)`. `MANIFESTTRAITVAR` is not `MANIFESTVAR`. `TRAITVAR` is latent additional variance and is scaled by `λ²`; `MANIFESTTRAITVAR` is not. Still not a Kalman filter, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) and Mislevy (1991, *Psychometrika, 56*, 177–196) remain unread (Unpaywall/OpenAlex 2026-08-19T04:18Z: closed). Oud and Jansen (2000) remains unread. ZORA Anubis-blocked. -- `psychometric_core` evaluates the Driver, Oud, and Voelkle (2017, Eq. 4, p. 5; JSS PDF re-opened 2026-08-19T04:10Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) stationary within-subject variance as `q / -(2 a)` when the scalar Kronecker sum `2 a` is finite. The paper limit is `-q / (2 a)` (`A# = A ⊗ I + I ⊗ A`; p. 16 `asymDIFFUSION`). Forming `q / a` first overflows at `q = MAX`, `a = -0.75` while `MAX / 1.5` is finite (CodeRabbit finding on `75ecdd3`). When `2 a` overflows (`a = -1e308`), form `(q / a) * -0.5`. Do not form `0.5 q` first (`q = from_bits(1)` underflows). Still not a Kalman filter, not DSEM, not a matrix `expm`, and not ctsem estimation. Meredith (1993) and Mislevy (1991, *Psychometrika, 56*, 177–196) remain unread (Unpaywall/OpenAlex 2026-08-19T04:10Z: closed). Oud and Jansen (2000) remains unread. ZORA Anubis-blocked. -- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, Eq. 1, p. 4; p. 16 `MANIFESTVAR`; JSS PDF re-opened 2026-08-19T00:14Z) scalar observed-indicator variance. Equation 1 writes `y_i(t) = Λ η_i(t) + τ + ε_i(t)` with `ε ~ N(0, Θ)`. The scalar map is `Var(y) = λ² Var(η) + θ`. Form `(λ p) λ` then add `θ`. Do not form `λ²` first (`λ = 1e308`, `p = 1e-308` → `1e308`). `MANIFESTVAR` is not `Var(y)`. `Var(η)` is not `Var(y)`. Still not a Kalman filter, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) and Mislevy (1991, *Psychometrika, 56*, 177–196) remain unread (Unpaywall/OpenAlex 2026-08-19T00:14Z: closed). Oud and Jansen (2000) remains unread. ZORA Anubis-blocked. -- `psychometric_core` evaluates the Driver, Oud, and Voelkle (2017, Eq. 4, p. 5; JSS PDF re-opened 2026-08-19T00:14Z) stationary within-subject variance as `(q / a) * -0.5`. The paper limit is `-q / (2 a)`. Forming `2 a` first overflows at `a = -1e308`. Forming `0.5 q` first underflows at `q = from_bits(1)`, `a = -from_bits(1)` and returns `+0` (CodeRabbit finding on `556e23d`); the representable Lyapunov solution is `0.5`. Still not a Kalman filter, not DSEM, not a matrix `expm`, and not ctsem estimation. Meredith (1993) and Mislevy (1991, *Psychometrika, 56*, 177–196) remain unread (Unpaywall/OpenAlex 2026-08-19T00:14Z: closed; Springer `content/pdf` is HTML 200). Oud and Jansen (2000) remains unread. ZORA Anubis-blocked. -- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, §4.3, p. 9; JSS PDF re-opened 2026-08-18T21:07Z) scalar trait-plus-state latent variance and lagged covariance. A stable trait process has `DRIFT` and `DIFFUSION` fixed to zero, so `Var = trait + state` and `cov(t, t-1) = trait + exp(a Δt) p`. The ctsem `TRAITVAR` rewrite that adds the trait to `DIFFUSION` does not license treating trait variance as process noise. Trait variance is not `asymDIFFUSION`. Evolving the summed variance as if it were all state is not this map. Still not RI-CLPM, not a Kalman filter, not DSEM, and not ctsem estimation. Meredith (1993) and Mislevy (1991, *Psychometrika, 56*, 177–196) remain unread (Unpaywall/OpenAlex 2026-08-18T21:07Z: closed). Oud and Jansen (2000) remains unread. ZORA accepted manuscript re-opened via bitstream `424f9082-0eeb-4a67-b687-9845a4ed892f`. -- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, Eq. 4, p. 5; §4.3 pp. 9–10; p. 16 `asymDIFFUSION`; JSS PDF re-opened 2026-08-18T18:03Z) scalar stationary within-subject variance. Eq. 4 writes `Q_Δt = irow(A#^{-1}[e^{A# Δt} − I] row(Q))` with `A# = A ⊗ I + I ⊗ A`. The scalar Kronecker sum is `2 a`. As `Δt → ∞` with stable `a < 0`, that limit is `-q / (2 a)`. Form `-0.5 q / a`; do not form `2 a` first (`a = -1e308`, `q = 1e308` → `0.5`). Starting from that variance, `Var(η_t)` is invariant across finite event intervals. A zero diffusion is exactly zero. `a ≥ 0` has no finite stationary variance. Finite-interval `Q_Δt` is not `asymDIFFUSION`. Still not a Kalman filter, not DSEM, not a matrix `expm`, and not ctsem estimation. Meredith (1993) and Mislevy (1991, *Psychometrika, 56*, 177–196) remain unread (Unpaywall/OpenAlex 2026-08-18T18:03Z: closed). Oud and Jansen (2000) remains unread. ZORA Anubis-blocked. -- `psychometric_core` refuses a zero-diffusion Driver, Oud, and Voelkle (2017, Eq. 3–4, pp. 4–5; JSS PDF re-opened 2026-08-18T14:04Z) latent variance when `2 (a Δt)` overflows to `+∞`. Zero diffusion is exactly `Q_Δt = 0` (Eq. 3 integral of a zero `G`). That skip does not license `Var(η_t) = exp(2 a Δt) p + 0` when the carried term is non-finite (`p = 2`, `q = 0`, `a = 1e308`, `Δt = 2`). Nightly uncovered production line `event_time.rs:596` on predecessor `321568a` is this arm. Still not a Kalman filter, not DSEM, and not a matrix `expm`. Meredith (1993) and Mislevy (1991, *Psychometrika, 56*, 177–196) remain unread (Unpaywall/OpenAlex/Semantic Scholar 2026-08-18T14:04Z: closed; Springer `content/pdf` is HTML 200). Oud and Jansen (2000) remains unread. -- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, Eq. 3–4, pp. 4–5; JSS PDF re-opened 2026-08-18T11:20Z) lagged latent covariance `cov(η_ti, η_{t-1,i}) = A_Δt cov(η_{t-1,i})` and the law-of-total-variance map `Var(η_ti) = A_Δt Var(η_{t-1,i}) A_Δt⊤ + Q_Δt`. Eq. 3 writes `η(t) = exp(A Δt) η(t0) + … +` the stochastic integral; Eq. 4 writes that the integral exhibits covariance `Q_Δt`. `Q_Δt` remains `cov(η_ti | η_{t-1,i})` for the homogeneous process (`ξ`, `z` given) and is refused as the unconditional variance. The JSS article has no numbered §2.2 (2.1 is Continuous time and SEM; §3 follows). Scalar `exp(a Δt) p` underflow to `+0` is a vanishing covariance and is kept. Finite-`a Δt` exponential overflow rewrites as `exp(ln p + a Δt)`. A finite `exp(a Δt)` whose product with `p` overflows fails closed. Still not a Kalman filter, not DSEM, and not a matrix `expm`. Meredith (1993) and Mislevy (1991, *Psychometrika, 56*, 177–196) remain unread (Unpaywall/OpenAlex/Semantic Scholar 2026-08-18T11:05Z: closed). Oud and Jansen (2000) remains unread (Radboud 403). ZORA Anubis-blocked. -- `psychometric_core` closes nightly branch coverage on `event_time.rs` (160/164 on `6c13dfb`). The four remaining False sides were `assert!(a && b)` in the unit-test module (Eq. 12 equilibrium-increment and expm1-overflow oracles); they cannot take False on a passing test. Split into independent asserts. Lib-instantiation fail-closed arms for Voelkle et al. (2012, Eq. 14) and Driver, Oud, and Voelkle (2017, Eq. 3) stay in the integration contract. Driver JSS PDF already opened 2026-08-18T07:06Z, p. 4 (`L` remains identity; this is not a Kalman filter). Meredith (1993) and Mislevy (1991, *Psychometrika, 56*, 177–196) remain unread (Unpaywall/OpenAlex 2026-08-18T07:17Z: closed; Springer `content/pdf` is HTML 200, not a PDF). ERIC ED334221 is Singer and Willett (1991). ZORA Anubis-blocked. Oud and Jansen (2000) remains unread. -- `psychometric_core` refuses an overflowing Driver Eq. 3 rewrite scale `0.5 q / a` (JSS PDF re-opened 2026-08-18T03:07Z, p. 4). When `expm1(z)` overflows at a finite `z = 2(a Δt)` and `0.5 q / a` is non-finite (`q = 1e308`, `a = 0.1`, `Δt = 4000` → `z = 800`), `Q_Δt = q(e^{2aΔt}−1)/(2a)` is not finite and fails closed. Algebraically identical to the licensed integral. Still not a Kalman filter, not DSEM, and not a matrix `expm`. Meredith (1993) and Mislevy (1991, *Psychometrika, 56*, 177–196) remain unread (Unpaywall/OpenAlex/Semantic Scholar/CORE 2026-08-18T03:07Z: closed). ERIC ED334221 is Singer and Willett (1991), not Mislevy (1991). ERIC ED333032 remains Mislevy, Sheehan, and Wingersky (1990). ZORA Anubis-blocked. Oud and Jansen (2000) remains unread. -- `psychometric_core` evaluates Driver, Oud, and Voelkle (2017, Eq. 3; JSS PDF re-opened 2026-08-17T21:03Z, p. 4) as \(0.5 q(\operatorname{expm1}(z)/a)\) with \(z=2(a\Delta t)\). Forming \(2a\) first overflows when \(|a|\) is at the binary64 extreme even if \(a\Delta t\) and \(Q_{\Delta t}\) are finite (`a=1e308`, `Δt=1e-308` → \(0.5(\mathrm{e}^{2}-1)/10^{308}\); `a=-1e308`, `q=1e308`, `Δt=2` → \(0.5\)). Algebraically identical to \(q(\mathrm{e}^{2a\Delta t}-1)/(2a)\). `expm1(−∞)` keeps \(-0.5 q/a\). \(z\to+\infty\) still fails closed. Still not a Kalman filter, not DSEM, and not a matrix `expm`. Meredith (1993), Mislevy (1991), and Oud and Jansen (2000) remain unread (Unpaywall/OpenAlex/Semantic Scholar 2026-08-17T21:03Z: closed; ZORA Anubis-blocked). -- `psychometric_core` recovers Voelkle et al. (2012, Eq. 14; ZORA accepted manuscript re-opened 2026-08-17T14:20Z, Introducing Intercepts, manuscript p. 21): the discrete effect of a time-varying predictor whose sampling interval equals its constancy interval is \(b^{*}_{y.x}(\Delta t)=a_{yx}\Delta t\). It does not depend on the predictor auto-effect. That product is not Eq. 12. Unmatched sampling and constancy intervals fail closed (Oud & Jansen, 2000, unread). An overflowing Eq. 12 rewrite scale \(a_{yx}/a_{xx}\) also fails closed. Still not DSEM. -- `psychometric_core` recovers Voelkle et al. (2012, Eq. 12) when `expm1(z)` overflows to `+∞` at a finite `z`. The rewrite is `sign(a_{yx}/a_{xx})\exp(\ln|a_{yx}|+z-\ln|a_{xx}|)-a_{yx}/a_{xx}` (algebraically identical to `(a_{yx}/a_{xx})(\exp(a_{xx}\Delta t)-1)`). A zero continuous effect is exactly zero even when `expm1` overflows (`0\cdot+\infty` is `NaN`). `z\to+\infty` remains fail-closed. ZORA accepted manuscript re-opened 2026-08-17T13:26Z, Introducing Intercepts, manuscript p. 20; Driver, Oud, and Voelkle (2017, Eq. 3) restated `A^{-1}[e^{A\Delta t}-I]\xi`. Still not DSEM. -- `psychometric_core` evaluates Voelkle et al. (2012, Eq. 12) as \(a_{yx}(\operatorname{expm1}(z)/a_{xx})\) with \(z=a_{xx}\Delta t\). That order is algebraically identical to \((a_{yx}/a_{xx})(\exp(a_{xx}\Delta t)-1)\). Dividing the increment by the finite auto-effect keeps the equilibrium increment \(-a_{yx}/a_{xx}\) when \(z\) overflows to \(-\infty\) (ZORA accepted manuscript, Introducing Intercepts: the exponential vanishes as \(\Delta t\) grows; CodeRabbit finding on `7ffb65b`). The prior \(a_{yx}\Delta t\) overflow case remains finite. Binary64 underflow of \(z\) to `+0` recovers the Eq. 12 limit \(a_{yx}\Delta t\); the first-order product is still not the general discrete effect. Still not DSEM. -- `psychometric_core` evaluates Voelkle et al. (2012, Eq. 12) as \(a_{yx}(\operatorname{expm1}(z)/z\cdot\Delta t)\) with \(z=a_{xx}\Delta t\). That order is algebraically identical to \((a_{yx}/a_{xx})(\exp(a_{xx}\Delta t)-1)\). Multiplying the unitless scale by \(\Delta t\) before \(a_{yx}\) keeps a finite Eq. 12 result when \(a_{yx}\Delta t\) overflows (ZORA accepted manuscript re-opened 2026-08-17T13:13Z, p. 16). Binary64 underflow of \(z\) to `+0` recovers the Eq. 12 limit \(a_{yx}\Delta t\); the first-order product is still not the general discrete effect. Driver, Oud, and Voelkle (2017, p. 4) restated the discrete intercept as a function of \(A\) and \(\Delta t\). Still not DSEM. -- `psychometric_core` evaluates Voelkle et al. (2012, Eq. 12) as \(a_{yx}\Delta t\,(\operatorname{expm1}(z)/z)\) with \(z=a_{xx}\Delta t\). That order is algebraically identical to \((a_{yx}/a_{xx})(\exp(a_{xx}\Delta t)-1)\). Binary64 underflow of \(z\) to `+0` recovers the Eq. 12 limit \(a_{yx}\Delta t\); the first-order product is still not the general discrete effect. Driver, Oud, and Voelkle (2017, p. 4) restated the discrete intercept as a function of \(A\) and \(\Delta t\) (PDF re-opened 2026-08-17T12:04Z). Still not DSEM. -- `psychometric_core` exact scalar discrete effect of a constant event-time predictor (Voelkle et al., 2012, Eq. 12): \(b^{*}_{y.x}(\Delta t)=(a_{yx}/a_{xx})(\exp(a_{xx}\Delta t)-1)\) for \(a_{xx}\neq 0\). The first-order product \(a_{yx}\Delta t\) is not that discrete effect. Still not DSEM. -- `psychometric_core` exact scalar forward map `φ(Δt) = exp(a Δt)` and interval remapping: a discrete lag at one event interval maps onto another through the Voelkle et al. (2012, Eq. 7) log-rate. Pooling discrete lags from unequal intervals fails closed. Still not a matrix `expm` and not DSEM. -- Fail-closed CWC-lag coverage in `psychometric_core`: singleton clusters are skipped, all-singleton series and overflowing CWC residuals fail closed, later-only residual overflow is checked with bitwise `is_finite`, the scalar Newton step refuses a non-finite exponential, score, start-skip, or deriv-INF, and Pearson empty/mismatch/left-INF paths are recovered. Dead post-OLS `pred_ss` and midpoint `require_finite` guards were removed because those values are already finite after OLS. -- `psychometric_core` multilevel/event-time recovery on the stacked psychometric PR: cluster-mean CWC within/between OLS, Kish ESS weighted slopes, event-time-only discrete lag-1 and exact scalar local log-rate, CWC-then-event-time residual lag, Rubin `T_m = Ū_m + (1+1/m) B_m` on draw-level OLS loadings, and two-group OLS strong/strict-gated latent-mean difference. Metric/weak is not a mean license. Not DSEM, not RI-CLPM, not MGCFA, not Mislevy PVs (ADR 0005; no new migration). -- `psychometric_core` posterior-aware structural input gates: construct classification, refusal of raw-proportion Pearson/OLS, explicit ALR-versus-ILR geometry boundaries, CPU `f64` OLS recovery, posterior-draw loading point-estimate averaging without Rubin uncertainty claims, invariance-gated latent-mean comparison, and causal-heuristic refusal (ADR 0005 first production slice; no new migration). -### Added - -- `model_selection` fitted candidate-`K` scoring: each candidate is fitted with the CPU `f64` TRSL-TM reference, scored from the actual in-sample mixture log-likelihood and Schwarz's (1978) `ℓ − (p ln N)/2` penalty, then passed through the existing Pareto gate. A typed non-convergence, non-finite, or invalid-input failure is a failed candidate, not a fabricated diagnostic. LLM-vote-only `K` remains non-authoritative. TF-IDF, BM25, stopword-deletion, and LLM labels are refused as inferential coordinates. Known two-topic counts select `K=2` over `K=3` with selected-`K` RMSE `0` across seed replications. This is not GPU execution, full Bayesian sampling, or topic birth/split/merge (ADR 0012; issue #167 remaining slice). -- `relation_absence` identity gate: unobserved relation pairs cannot become evidence of no relationship; recovered observed/inferred/unobserved statuses match known truth at a higher computed rate than collapsing every status to observed (ADR 0003). -- `orchestrator_live` loopback HTTP/1.1 listener: `POST /v1/interpretation-runs` binds loopback only, replays matching idempotency keys, and refuses non-loopback binds, table-access hosts, review/Copilot/GitHub credentials, and scientific-authority promotion. Accepted output is always hypothetical. Not TLS termination or model execution (ADR 0010; ADR 0011). -- `role_contradiction` identity gate: customer and competitor cannot occupy the same group; recovered commercial-role labels match known truth at a higher computed rate than collapsing every role to customer (ADR 0003). -- `episode_membership` identity gate: a document's episode membership cannot - start before or end after the episode event-time interval; recovered - containment flags are compared with known truth (ADR 0003). -- `tepp_simulation` cutoff eligibility: delayed-reporting documents are excluded when `available_time` exceeds the knowledge cutoff, with recovered eligible counts matching known truth. -- `topic_measurement` bounded deterministic CPU `f64` TRSL-TM reference estimator: canonical CSR/CSC inputs, cutoff-safe documents, standardized event time, weighted multiple memberships, prevalence covariates, explicit predecessor/successor regularization, multi-seed generalized EM, diagonal Laplace uncertainty, and fitted topic-lineage counts with known-truth RMSE plus exact line/branch coverage (ADR 0012; no persistence or accelerated-backend claim). -- `topic_measurement` logistic-normal additive log-ratio and sequential Egozcue isometric log-ratio coordinates: fail-closed simplex validation, max-shifted stable ALR/ILR inverses with true-parameter RMSE, pairwise CLR Aitchison distance recovered by ILR Euclidean isometry for valid composition pairs, and refusal of TF-IDF/BM25/keyword scores as inferential topic coordinates (ADR 0012 first production slice; no new migration). -- Coverage contract now excludes Rust multiline string continuation records emitted by LLVM LCOV, keeping the 100% authored-line gate focused on executable production lines. -- Coverage source classification now scans Rust normal/raw/byte strings, comments, and character literals with escape-aware state, preserving executable string method calls and ignoring quoted comments. -- Quality-gate coverage tests now exercise blank-predecessor structural commas and escaped character literals in the authored-line scanner, including the past-EOF fail-closed path. -- Restored Graham Neubig's correct APA 7 initial in the Liu et al. (2023) prompting-survey register entry after the protected-main rebase. -- After protected-main consolidation #215, the analysis-run execution decision is recorded as ADR 0022 so it does not collide with ADR 0021 LineageWeave project-history. -- Registered the analysis-engine gap-closure doctoring in the canonical documentation map so its product and scientific traceability record is discoverable. -- Authored Rust coverage classification now ignores standalone structural closing parentheses, preventing formatting-only LCOV rows from appearing as uncovered production behavior. -- `analysis_engine` vertical slice (ADR 0022): bounded Rust execution from an accepted analysis run to either a cutoff-safe readiness result or a validated `tepp.trsl_topic_lineage.v1` artifact from the ADR-0012 estimator. Topic artifacts preserve fitted predecessor/successor edges, connectable-post and lineage counts, request/snapshot/cutoff bindings, SHA-256 identity, and fail-closed non-convergence/tamper behavior with exact line/branch coverage. This remains active-PR evidence and does not claim causal or psychometric authority. -- Coverage classification preserves the final expression line of multiline Rust `match` guards while respecting preceding-arm boundaries, keeping the 100% authored-line gate conservative. -- `tepp_api` fail-closed analysis-result boundaries: status constructors reject - terminal envelopes that cannot fit the default 64 KiB status limit, and - standalone terminal results reject knowledge cutoffs in the future. -- `tepp_api` request-bound terminal analysis results and typed analysis-run status/read responses: accepted/running states cannot carry measurement evidence, terminal results bind exact request and receipt identities, and succeeded/failed payloads remain digest-bound or content-redacted. -- `evidence_core` embedded-image units: `data:image/;base64,...` URIs keep their original source spans and media types, and cannot be used as lexical inference text. -- `persistence_postgres` entity/project target SQL now rejects empty, oversized, or hostile type/status labels before insert; interpolated codes are restricted to lowercase ASCII `snake_case` characters so membership foreign keys remain referentially safe (ADR 0003 / ADR 0013). -- `persistence_postgres` live SQLx transport retains one pool-backed PostgreSQL connection per session so tenant binding and the following statement share a session, and closes the connection and owned runtime safely from another Tokio runtime (ADR 0013). -- The authored-line coverage gate now filters LLVM-only literal and expression continuation records while retaining branch coverage for their executable decisions; Rust function signatures and structural branch lines are no longer counted as uncovered statements. -- Stacked `analysis_engine` vertical slice (ADR 0021): bounded Rust execution - from an accepted analysis run to a cutoff-safe, multiple-membership-aware, - SHA-256-digest-bound terminal artifact or redacted no-eligible-evidence - result. This remains active-PR evidence and does not claim estimator - authority. -- `tepp_api` request-bound terminal analysis results and typed analysis-run - status/read responses: accepted/running states cannot carry measurement - evidence, and terminal results bind exact request and receipt identities. -- Coverage classification now preserves multiline Rust `match` guard expression - lines while ignoring structural closing parentheses and match-arm labels. -- `corpus_split` Unicode canonical identity: NFC/NFD-equivalent bodies produce `CanonicalEquivalent` leakage links and cannot occupy independent partitions; empty bodies and duplicate document identities fail closed (ADR 0004/0008/0013; PR #59). -- `semantic_core` binds exact `evidence_core` source spans as semantic units. Language profiles are `unresolved` or a primary ISO 639 subtag with an IANA-registered ISO 3166-1 alpha-2 or UN M.49 region (RFC 5646; IANA File-Date 2026-08-08); private-use and unknown regions fail closed. Unresolved metadata keeps the caller-supplied Korean `측정` span and does not retokenize. `SemanticIdentity::from_language_tag` fails closed. Korean and English report sentences remain distinct units. Not concept alignment, not invariance, not a topic estimator (ADR 0020; issue #168). The APA register cites RFC 5646 once, in the Unicode/language-tags section; the slice-specific note remains `docs/research/span-grounded-semantic-units.md`. -- `corpus_background` identity gate: corpus-level background wording is not unique latent content or a state transition; recovery tests distinguish background evidence from unique content. -- `modality_source` identity gate: non-lexical modality is not unique lexical content or a state transition; recovery tests keep modality evidence distinct from unique content. -- `copied_text` identity gate: copied-text residue is not unique latent content or a state transition; recovery tests distinguish copied-text evidence from genuinely new content. -- `style_source` identity gate: house-voice style residue is not unique latent content and is not erased by a stopword list; recovery tests distinguish style from unique content. -- `stopword_deletion` method gate: a default or global stopword list cannot erase repeated report language; recovery tests distinguish deliberate method treatment from stopword deletion. -- `copy_identity` identity gate: a template or pasted copy cannot reuse the source document identity or become a state transition; recovery tests distinguish copy kinds from source identity. -- `intake_authorization` identity gate: documents, serialized records, checkpoints, and LLM outputs require a purpose-bound grant in addition to identity, provenance, size, and depth validation; recovery tests reject ungranted intake. -- `tepp_api` LineageWeave temporal-context contract (v1): cutoff-safe event eligibility, deterministic event-time ordering, explicit non-causal association/gap boundaries, HTTPS interchange construction, and loopback listener handling at `POST /v1/temporal-context`; read-only context requests no longer require the write-only idempotency header, and no causal inference or completed-result service is included. -- `tepp_api` LineageWeave consumer-scoped analysis-run ingress: versioned, credential-free requests use a published consumer identity and isolate idempotency by consumer, tenant workspace, and opaque caller key; the one-shot restack workflow is removed after the protected-main merge is verified. -- ADR 0018 records the consumer-scoped analysis-run ingress, its in-memory loopback maturity, and the persistence boundary required before production use. -- ADR 0021 records the credential-free bounded LineageWeave project-history service boundary and keeps source authorization with LineageWeave while TEPP owns temporal validation and deterministic projection. -- `tepp_api` project-history wire-size symmetry (ADR 0019): request and projection serialization enforce the shared 256 KiB limit, and generated projections fail closed before returning when their deterministic response would exceed it. -- `summarizes_edge` identity gate: summaries may point to earlier event time without becoming state transitions or reusing source-document identity; recovery tests outperform collapsing every summary to the source. -- `outcome_order` identity gate: `input_to` and `process_to` require strict forward event-time rank, while `outcome_of` remains non-transition provenance; recovery tests outperform collapsing every kind to `input_to`. -- `location_membership` identity gate: geographic and market assignments are time-varying memberships, not permanent entity identity and not language channels; recovered location kinds match known truth at a higher computed rate than collapsing every assignment to entity identity (ADR 0003). -- `prompt_source` identity gate: instruction and prompt boilerplate is not unique latent content and is not erased by a stopword list; `identity_recovery_rate` reports exact kind matches, with a contract test comparing correct recovery with an all-unique collapse on a mixed known-truth fixture (ADR 0004/0012). -- `corpus_background` identity gate: corpus-level background wording is not unique latent content and is not erased by a stopword list; recovered background kinds match known truth at a higher computed rate than collapsing every token to unique content (ADR 0004/0012). -- `modality_source` identity gate: non-lexical modality is not unique latent content and is not erased by a stopword list; recovered modality kinds match known truth at a higher computed rate than collapsing every token to unique content (ADR 0004/0012). -- `copied_text` identity gate: copied and boilerplate residue is not unique latent content and is not erased by a stopword list; recovered copied-text kinds match known truth at a higher computed rate than collapsing every token to unique content (ADR 0004/0012). -- `style_source` identity gate: house-voice style residue is not unique latent content and is not erased by a stopword list; recovered style kinds match known truth at a higher computed rate than collapsing every token to unique content (ADR 0004/0012). -- `stopword_deletion` method gate: a default or global stopword list cannot erase repeated report language; recovered deletion kinds match known truth at a higher computed rate than collapsing every token treatment to stopword deletion (ADR 0004/0012). -- `persistence_postgres` retention/deletion/legal-hold (migration `0007`): policy rows, legal holds that block completed deletion, evidence tombstones without raw-source restore, analysis exclusion only for `logical_revocation`/`identity_tombstone` (not `cache_export_removal`), and deletion requests bound to the cited retention policy's tenant/class/purpose. -- `copy_identity` identity gate: a template or pasted copy cannot reuse the source document identity or become a state transition; recovered copy kinds match known truth at a higher computed rate than collapsing every copy to the source (ADR 0003). -- `provider_receipt` disclosure receipt: records provider field codes and - purpose-bound receipt metadata without persisting source text or source - identity (ADR 0009). -- `intake_authorization` identity gate: documents, serialized records, checkpoints, and LLM outputs cannot be accepted without a purpose-bound grant; size/identity/provenance bounds are not that grant; recovered grant-presence flags match known truth at a higher computed rate than accepting every intake (ADR 0009). -- `summarizes_edge` identity gate: a summary may point to earlier event time but cannot become a state transition or reuse the source document identity; recovered summary kinds match known truth at a higher computed rate than collapsing every summary to the source (ADR 0003). -- `outcome_order` identity gate: `input_to` and `process_to` cannot move backward or stay contemporaneous in event-time rank; `outcome_of` may point at an earlier producer and cannot become a state transition; recovered kinds match known truth at a higher computed rate than collapsing every kind to `input_to` (ADR 0002/0003). -- `retrospective_edge` identity gate: retrospective reporting may point to earlier event time but cannot become a state transition or a translation; recovered reporting kinds match known truth at a higher computed rate than collapsing every report to a contemporaneous forward report (ADR 0002/0003). -- `payload_bound` identity gate: documents, serialized records, model checkpoints, and LLM outputs stay untrusted until identity, provenance, size, and depth validate; recovered accept/reject flags match known truth at a higher computed rate than accepting every payload (ADR 0008/0013). -- `inferred_status` identity gate: inferred relations cannot be promoted to observed evidence or to state transitions; recovered observed/inferred labels match known truth at a higher computed rate than treating every status as observed (ADR 0003). -- `support_edge` identity gate: support, contradiction, summary, and `outcome_of` edges cannot become state transitions; recovered evidential kinds match known truth at a higher computed rate than collapsing every kind to support (ADR 0002/0003). -- `system_clock` identity gate: event, assertion, document, availability, and knowledge-cutoff time cannot stand in for system time; recovered system stamps match known truth at a higher computed rate than treating every stamp as event time (ADR 0002). -- `event_clock` identity gate: assertion, system, document, and availability time cannot stand in for event/valid time; recovered event stamps match known truth at a higher computed rate than treating every stamp as assertion time (ADR 0002). -- Dependabot Rust toolchain updates now use a seven-day cooldown so newly published versions receive a bounded review window before automated proposals. -- `assertion_clock` identity gate: event, system, document, and availability time cannot stand in for assertion time; recovered assertion stamps match known truth at a higher computed rate than treating every stamp as event time (ADR 0002). -- `cutoff_clock` identity gate: event time, system time, and availability time cannot stand in for knowledge cutoff; recovered cutoff stamps match known truth at a higher computed rate than treating every stamp as availability time (ADR 0002). -- `available_clock` identity gate: event time and system time cannot stand in for availability time; recovered availability stamps match known truth at a higher computed rate than treating every stamp as system time (ADR 0002). -- `document_clocks` six-clock gate: a document analytical row cannot omit assertion time or document time, and event/system time cannot stand in for those clocks; recovered completeness flags match known truth at a higher computed rate than treating every row as complete (ADR 0002/0013). -- `revision_order` system-time gate: a higher document revision number cannot carry earlier or equal system time; recovered order flags match known truth at a higher computed rate than accepting every pair (ADR 0002/0013). -- `encrypted_mapping` purpose-bound AES-256-GCM envelope: source identities are sealed with an operating-system-generated nonce and analytical/key identifiers as authenticated associated data, with a 1 MiB resource bound, so analytical, log, and model-artifact purposes cannot recover plaintext; recovered identities match known truth at a higher computed rate than collapsing every mapping to one name. Persistence and KMS wait for a later migration (ADR 0009). -- `citation_edge` provenance gate: citation, translation, revision, and retrospective-report edges may point to the past but cannot become input-process-outcome transitions; recovered kinds match known truth at a higher computed rate than collapsing every edge to citation (ADR 0002/0003). -- `psychometric_fit` CPU `f64` ESEM/DSEM fit: exploratory OLS recovers known cross-loadings from admitted log-ratio or logistic-normal coordinates with computed RMSE below a zero-loading collapse; reverse or zero event-time lagged paths fail closed; a good global fit cannot reclassify formative or network constructs as reflective (ADR 0005). No new migration number (`#45` still owns `0007`). -- `subevent_containment` parent-window gate: a half-open subevent interval that starts before or ends after its parent cannot attach; recovered containment flags match known truth at a higher computed rate than accepting every child (ADR 0003). -- `prediction_contradiction` promotion gate: `temporal_core` Allen classification refuses `before`/`after` as contradiction and `meets`/`met_by` as unsupported adjacency; `refuse_promotion` and `require_observed_coverage` refuse partial overlap that leaves unmatched predicted mass; `refuse_contradiction_or_adjacency` is the weaker contradiction/adjacency filter only; evidence available after the knowledge cutoff is ineligible. Label agreement is not RMSE recovery (ADR 0002, ADR 0016). Canonical docs name the crate, not a pull-request number, as the landable authority; `scripts/validate_documentation.py` fail-closes on `landable coverage gate is PR #N` and inverted or paraphrased forms (`PR #N is the landable coverage gate`, `the landable gate is PR #N`, `coverage-authority landing PR #N`, `merge PR #N as the coverage-authority`) including drafts #93, #94, #97, #101, #102, #104, #108, #109, #111, and #112. The hourly queue lock also fail-closes when those drafts are omitted from Keep-unmerged sentences, when a Keep-unmerged sentence is negated, or when the naruon live-HTTP *subject* is not PR #107 with #87 and #105 kept unmerged. -- `provider_receipt` disclosure audit: a receipt records purpose and field codes sent to a model provider; source text, source identity, and blanket PII masking fail closed; recovered field codes match known truth at a higher computed rate than a collapsed set (ADR 0009). -- `tepp_api` corpus-split leakage-audit manifest v1: cutoff exclusion counts, relation-component and partition digests, governed link-kind vocabulary, and a canonical `SHA-256` that binds to `corpus_split_manifest` without exporting source text. -- `persistence_postgres` `audit_event` inserts call `operational_log::try_record` before SQL is rendered: author/customer/project source text, source identity, and blanket-mask grants cannot enter `INSERT INTO audit_event`; clear inspection still persists a validated action code (ADR 0009; ISO/IEC 29100:2024). No new migration number. `OperationalLogRecord::new` stays crate-private. -- `operational_log` source separation: `try_record` is the only recording API and inspects source text, source identity, and blanket-mask intent before creating a line; `OperationalLogRecord::new` is crate-private; a source-identity `&str` cannot become an `AnalyticalSubject`; privileged-export / identity-mapping / diagnosis action codes keep author, customer, and project memberships distinct; replayed lines match known truth at a higher computed rate than a collapsed single-action or collapsed-subject log (ADR 0009; ISO/IEC 29100:2024). The live docstring crate-root count is bound to `EXPECTED_CRATES` so the eleventh crate cannot fail a hard-coded `10`. -- `service_tls` production TLS bind gates: non-loopback binds require rustls PEM material, loopback HTTP is development-only, orchestrator live ports refuse loopback plaintext, and table-access host labels fail closed. `TlsBindRequest` Debug output redacts certificate and private-key PEM. Recovered bind decisions are computed from `authorize_production_tls` / `authorize_orchestrator_live_port` outputs and match known truth at a higher rate than a collapsed production grant (ADR 0011). -- `derived_sensitivity` inheritance: topic, factor, and relation artifacts keep the source sensitivity class; unknown kind codes fail closed on both `inherit_sensitivity` and `DerivedArtifact::try_new`; derivation and blanket PII masking cannot declassify to public; paired kind-and-class recovery matches known 3×3 synthetic truth at a higher computed rate than a public collapse (ADR 0009; GDPR Art. 4(1)/Recital 26; WP 136). -- `longitudinal_core` within/between decomposition: unit means stay between-unit components, occasion residuals stay within-unit change, and recovered components match known truth with lower computed RMSE than a grand-mean pooled collapse. -- `topic_lineage` global P0 topic identity: activity may become dormant or reactivated without minting a new identity, and recovered identities match known truth at a higher computed rate than mint-on-reactivate replacements. -- `interpretation_gateway` evidence-bounded LLM interpretations: proposals must cite at least one evidence span, remain hypothetical, cannot become estimator results or observed facts, and a cited interpreter records a lower computed unsupported-claim rate than uncited promotion. -- `model_selection` candidate-`K` gates: statistical candidates require `K >= 2` and finite held-out log-likelihood/complexity, a Pareto front excludes dominated alternatives, LLM votes cannot define the numerical optimum, and selected `K` recovers known truth with computed RMSE. -- `event_core` mention-confidence Brier score: known-truth binary outcomes recover a computed Brier of 0 for perfect forecasts and 0.25 for constant 0.5, with empty or mismatched streams failing closed. -- `membership_core` nested ICC: CPU `f64` unbalanced ANOVA recovers a known cluster ICC and refuses to treat cross-classified or multiple-membership designs as a single hierarchy (ADR 0003). -- `persistence_postgres` typed `text_segment` SQL: insert/lookup of exact UTF-8 half-open byte spans on the existing `0006` table, cutoff-eligible document reads (`available_time <= knowledge_cutoff`), and live recovery of a known `hello` span. No new migration number (`#45` still owns `0007`). -- Hourly contextual-orchestrator discovery records all provider models but routes OpenCode only through general-chat candidates, excluding embedding, image, reranker, transcription, moderation, safety, and other endpoint-only identifiers before price selection. -- Live `docs/product-technical-gap-baseline.md` mapping operator-visible gaps to - protected-main maturity, exact current PR/issue state, stacked delivery order, - and closure evidence; placeholder-only issues #161 and #162 were closed as - queue hygiene. The documentation validator requires a dated UTC snapshot, a - 40-character protected-main SHA, an exact-head inventory matching the declared - open-PR count, and operator-gap closure evidence, and it rejects affirmative - queued-Checks-as-implemented-main claims even when wrapped across a line - break, and it rejects an unrelated `not` in the same span (`queued Checks are - not required; this PR is implemented-main`). Only never/do not/does not/ - cannot/must not plus promote/treat/make/mean counts as a promotion denial. -- `checkpoint_authority` estimator gate: a model checkpoint remains an untrusted run artifact until identity, canonical `SHA-256`, and model-run provenance validate, and it cannot replace the CPU `f64` estimator or promote a scientific claim; recovered roles match known truth at a higher computed rate than collapsing every artifact to the estimator (ADR 0001/0014). -- `event_core` now requires and retains `EventEvidenceLayer::PromotedTransition` when constructing an `EventInstance`; every other layer is rejected at the promotion boundary, and TDT story classification uses a caller-owned hash set for expected constant-time membership checks. -- `event_core` ADR 0016 evidence-status gates: TDT detections and CHRONOS predictions cannot admit a forward state transition; first-story detection scores miss/false-alarm rates against a known story stream (Allan 2002 task). -- `compute_backend` ADR 0006 first slice: VRAM profiles and reserve-aware micro-batching, executable successive OOM retry plans, CPU fallback, compensated `f64` reference arithmetic with scale-aware parity tolerance, grouped adaptation policies, and fail-closed estimand-preserving memory policies. -- `validation_core` ADR 0014 claim-promotion gates: `decision_accepted`, `implemented_main`, `scientifically_supported`, and `released` bind to an exact commit SHA; queued, predecessor, skipped-required, and LLM evidence fail closed; scientific promotion uses computed RMSE and its standard error rather than a hardcoded threshold (no new migration). -- `relation_graph` causal-identification gate: only `causes` and `intervenes_on` may be described as causal; association, temporal precedence, production, and provenance fail closed. -- `temporal_core` interval-aware historical eligibility: `evaluate_historical_eligibility` admits an `AvailableTime` interval only when every possible availability instant is at or before `KnowledgeCutoff`; unknown and open-ended upper availability fail closed, and event/document time cannot be substituted. -- `event_core` TDT tracking contracts: hypothesized track assignments, fail-closed duplicate mentions, refusal to treat a track as an instance or state transition, and computed pair precision/recall, identity-switch rate, and RMSE against known-truth assignments. -- `event_core` CHRONOS schema-slot gate: predicted role fillers stay distinct from promoted instances and transitions, slot precision/recall are computed from known-truth fills, and production label/confidence APIs produce calibrated occupancy RMSE ≈ 0.1411 versus always-fill ≈ 0.7071 in the contract fixture. -- `event_core` TDT story-segmentation contracts: ordered unit partitions, fail-closed empty/mismatched windows, refusal to treat a detected story cut as an instance or state transition, and computed `WindowDiff`, `Pk`, boundary precision/recall, plus RMSE against known-truth boundaries. -- `event_core` CHRONOS occurrence-prediction calibration: forecasts stay hypothetical, refuse promotion to event instances, and recover a computed Brier score against later-observed occurrence truth, with empty or mismatched streams failing closed. -- `persistence_postgres` entity/project target SQL: fail-closed insert/lookup for `entity_record` and `project_record` so membership foreign keys cannot be seeded from empty, oversized, or hostile type/status labels. No new migration number (ADR 0003 / ADR 0013). -- `cutoff_clock` identity gate: event time, system time, and availability time cannot stand in for knowledge cutoff; recovered cutoff stamps match known truth at a higher computed rate than treating every stamp as availability time (ADR 0002). -- `assertion_clock` identity gate: event, system, document, and availability time cannot stand in for assertion time; recovered assertion stamps match known truth at a higher computed rate than treating every stamp as event time (ADR 0002). -- `event_clock` identity gate: assertion, system, document, and availability time cannot stand in for event/valid time; recovered event stamps match known truth at a higher computed rate than treating every stamp as assertion time (ADR 0002). -- `system_clock` identity gate: event, assertion, document, availability, and knowledge-cutoff time cannot stand in for system time; recovered system stamps match known truth at a higher computed rate than treating every stamp as event time (ADR 0002). -- `support_edge` identity gate: support, contradiction, summary, and `outcome_of` edges cannot become state transitions; recovered evidential kinds match known truth at a higher computed rate than collapsing every kind to support (ADR 0002/0003). -- `inferred_status` identity gate: inferred relations cannot be promoted to observed evidence or to state transitions; recovered observed/inferred labels match known truth at a higher computed rate than treating every status as observed (ADR 0003). -- `payload_bound` identity gate: documents, serialized records, model checkpoints, and LLM outputs stay untrusted until identity, provenance, size, and depth validate; recovered accept/reject flags match known truth at a higher computed rate than accepting every payload (ADR 0008/0013). -- `outcome_order` identity gate: `input_to` and `process_to` cannot move backward or stay contemporaneous in event-time rank; `outcome_of` may point at an earlier producer and cannot become a state transition; recovered kinds match known truth at a higher computed rate than collapsing every kind to `input_to` (ADR 0002/0003). -- `summarizes_edge` identity gate: a summary may point to earlier event time but cannot become a state transition or reuse the source document identity; recovered summary kinds match known truth at a higher computed rate than collapsing every summary to the source (ADR 0003). -- `provider_receipt` disclosure receipt: records provider field codes and - purpose-bound receipt metadata without persisting source text or source - identity (ADR 0009). -- `intake_authorization` identity gate: documents, serialized records, checkpoints, and LLM outputs cannot be accepted without a purpose-bound grant; size/identity/provenance bounds are not that grant; recovered grant-presence flags match known truth at a higher computed rate than accepting every intake (ADR 0009). -- `copy_identity` identity gate: a template or pasted copy cannot reuse the source document identity or become a state transition; recovered copy kinds match known truth at a higher computed rate than collapsing every copy to the source (ADR 0003). -- `stopword_deletion` method gate: a default or global stopword list cannot erase repeated report language; recovered deletion kinds match known truth at a higher computed rate than collapsing every token treatment to stopword deletion (ADR 0004/0012). -- `episode_membership` identity gate: a document's episode membership cannot start before or end after the episode event-time interval; recovered containment flags match known truth at a higher computed rate than accepting every membership (ADR 0003). -- `style_source` identity gate: house-voice style residue is not unique latent content and is not erased by a stopword list; recovered style kinds match known truth at a higher computed rate than collapsing every token to unique content (ADR 0004/0012). -- `modality_source` identity gate: non-lexical modality is not unique latent content and is not erased by a stopword list; recovered modality kinds match known truth at a higher computed rate than collapsing every token to unique content (ADR 0004/0012). -- `corpus_background` identity gate: corpus-level background wording is not unique latent content and is not erased by a stopword list; recovered background kinds match known truth at a higher computed rate than collapsing every token to unique content (ADR 0004/0012). -- `prompt_source` identity gate: instruction and prompt boilerplate is not unique latent content and is not erased by a stopword list; `identity_recovery_rate` reports exact kind matches, with a contract test comparing correct recovery with an all-unique collapse on a mixed known-truth fixture (ADR 0004/0012). -- `location_membership` identity gate: geographic and market assignments are time-varying memberships, not permanent entity identity and not language channels; recovered location kinds match known truth at a higher computed rate than collapsing every assignment to entity identity (ADR 0003). -- `membership_target` identity gate: language, episode, template, department, and opportunity-pool memberships cannot collapse into the entity/project pair stored by migration `0006`; comparison-contract tests record recovered target kinds against an entity-collapse baseline (ADR 0003). -- `corpus_split` inferential-weight gate: only group-normalized ESS and uniform observation weights may enter an estimator; TF-IDF, BM25, and default global stopword deletion fail closed, with computed RMSE showing the retrieval surrogate recovers known shares worse than `group_normalized_ess`. -- `event_core` TDT link-detection contracts: undirected mention-pair hypotheses, fail-closed self-links, refusal to treat a detected link as an instance or state transition, and computed precision/recall plus RMSE against known-truth pairs. -- `event_core` first-story detection gate: first-story versus follow-up labels stay distinct from promoted instances, false-alarm and miss rates are computed from known truth, and calibrated detection scores recover the binary first-story target with lower RMSE than an always-first detector. -- `tepp_api` naruon live loopback HTTP/1.1 listener: `serve_one` installs a read/write deadline, requires a loopback `Host`, refuses `Transfer-Encoding` and NIM/proxy credential headers, parses `knowledge_cutoff` as RFC 3339 and refuses a future cutoff, keys analysis-run idempotency by tenant plus key, and proves both analysis-run and export POSTs over a real `TcpStream`. Not a production TLS/`$PORT` service (ADR 0011). -- `tepp_api` adaptive orchestration router (ADR 0010): versioned `direct`/`verify`/`committee`/`conductor`/`abstain` selection from CPU `f64` risk, ambiguity, evidence, and token-budget inputs; recorded stages, recursion, decomposition, access lists, and role-specific reasoning effort; fail-closed document-controlled policy/access/credentials; LLM plans remain proposals under deterministic statistical authority; comparable-budget ablation requires a direct baseline; credential-free contextual-orchestrator binding. Live NIM HTTP remains accepted-target. -- `tepp_api` purpose-bound provider-payload minimization: time-bounded `PurposeGrant` evaluation, fail-closed expired/not-yet-valid/inverted/cross-tenant/impossible-calendar denial, semantic UTC calendar validation, refusal to copy identity mappings into model-provider payloads or ordinary logs, preservation of opaque analytical identifiers and membership roles (no blanket PII mask), a separately authorized scientific re-identification path, and an internally bound FIPS 180-4 SHA-256 audit digest appended through `ReidentificationAuditSink` before disclosure. -- `persistence_postgres` backup/restore integrity: restored snapshots stay unusable until tenant, canonical `SHA-256`, knowledge-cutoff eligibility, temporal window order, and append-only triggers revalidate; SQL probes raise `restore integrity failed` (ADR 0013). -- `persistence_postgres` concurrent document-write stress: atomic revise `DO` block that requires exactly one open `system_to` close, SQLSTATE mapping onto `ConcurrentWriteConflict` / `DuplicateDocumentRecord`, and live multi-session insert/revise/append-only proofs. No new migration number. -- `tepp_api` naruon HTTP interchange: versioned `https` POST contracts for analysis-run create and modular export authorization that refuse table-access URLs, provider-specific API-key/secret and review/Copilot credential headers, malformed extra HTTP fields, reserved standard-header redefinition, principal-only export idempotency keys, and lexical inference claims (ADR 0011). -- `persistence_postgres` audit-event SQL contracts: append-only insert that refuses empty, oversized, or hostile `action_code` values before SQL is rendered. -- `network_analysis` compositional cluster gates: raw topic proportions cannot be treated as Euclidean coordinates; recovered clusters are scored with label-invariant pair precision and recall against known truth. -- `persistence_postgres` event-instance SQL contracts: bitemporal insert and as-known-at lookup that refuse inverted valid/system windows and hostile type/lifecycle labels before SQL is rendered. -- `persistence_postgres` event-mention SQL contracts: mention identity cannot equal the instance it supports; confidence must be finite and in `(0, 1]`. -- `persistence_postgres` event-relation SQL contracts: closed ERD transition/provenance vocabulary bound to `transition_edge`, fail-closed unknown types and transition self-loops, live insert of `causes`/`references`. -- `persistence_postgres` source-artifact SQL contracts: append-only insert and primary-key lookup that refuse non-canonical `SHA-256` digests, negative sizes, and hostile media-type or object-store labels before SQL is rendered; identical-identity retries are `ON CONFLICT DO NOTHING` plus a stored-row match assertion, and a same-id payload change fails closed as `ConflictingSourceArtifact`. -- `persistence_postgres` typed membership assignment (migration `0006`): `entity_record`, `project_record`, and `text_segment` plus exactly-one observed-unit and target constraints that replace the polymorphic `membership_target_id` stub, with SQL insert/lookup, fail-closed inverted-window and backslash-label refusal, and live proof that one document persists two entity memberships and one project membership. -- Actions workflow fleet auditor (`scripts/actions_workflow_fleet.py`): paginated registry inventory bound to the exact default-branch SHA/tree, classification of present/orphan/disabled/GitHub-dynamic identities, and fail-closed orphan disable that confirms GitHub's official `disabled_manually` state. -- `persistence_postgres` temporal interval ordering migration (`0005`): multi-word CHECK constraints on `document_record`, `event_instance`, and `membership_assignment` that reject inverted valid/system windows and non-positive document revisions while preserving open-ended NULL upper bounds and equal point bounds; catalog validation and live inverted-window proof. -- `persistence_postgres` append-only immutability migration (`0004`): `reject_append_only_mutation`, statement-level `BEFORE UPDATE OR DELETE OR TRUNCATE` triggers on identity/manifest tables, `REVOKE UPDATE`/`DELETE`/`TRUNCATE` from `tepp_app_runtime`, executable DDL/rollback contracts, and live representative mutation proof. -- `persistence_postgres` model-run artifact chain: migration `0003_model_run_artifact_chain` for append-only `corpus_split_manifest`, `model_run`, and `model_artifact` with FORCE RLS; SQL insert/lookup contracts and live repository methods binding runs to reproducibility manifests and optional splits. -- `persistence_postgres` append-only reproducibility-manifest SQL contracts and live repository methods (`insert_reproducibility_manifest`, digest/id lookup) with fail-closed SHA-256 and commit identity validation for `reproducibility_manifest`. -- `persistence_postgres` tenant row-level security: migration `0002_tenant_row_level_security`, `tepp_app_runtime` role, session GUC `tepp.current_tenant_record_id`, multi-word isolation policies with FORCE RLS, session helpers, contract validation, and live isolation proof under `TEPP_LIVE_POSTGRES=1`. -- `persistence_postgres` live PostgreSQL CI: `live-postgres` job with Postgres 16 service, `TEPP_LIVE_POSTGRES=1` gate, and integration coverage for pool open, foundation+RLS migrations, document insert/revise/as-of, audit SQL, and tenant isolation. -- Repository release evidence tooling: `scripts/release_evidence.py` generates CycloneDX 1.5 SBOM, exact-head provenance, and SHA-256 checksums from `Cargo.lock`/`Cargo.toml`, with fail-closed validation and CI generation on every quality gate. -- `persistence_postgres` `live-sqlx` feature: real `SQLx`/`PgPool` open/execute behind validated `DATABASE_URL` and `LiveSqlxPoolOptions`, with offline/live executor backends and CI coverage exclusion for the transport module. -- `persistence_postgres` live pool open gate: validated `LiveSqlxPoolOptions`, fail-closed `open_live_sqlx_pool` / `LiveSqlxPool` (`SqlSession`) with offline test backend; optional `live-sqlx` attaches real `SQLx`/`PgPool` after `DATABASE_URL` validation. -- `validation_core` recovery metrics: parameter matching, RMSE/bias with standard errors, interval coverage with Wilson bounds, relation-edge precision/recall, temporal-order accuracy, Monte Carlo summaries, and SE-aware acceptance gates with machine-readable reports. -- `tepp_api` versioned analysis-run DTOs, content-redacting error envelopes, reproducibility manifests, JSON-LD and GraphML export contracts, purpose-bound export authorization (no blanket PII masking), plus committed schemas/examples. -- `relation_graph` forward-only state-transition DAG with past-pointing provenance edges and cycle rejection. -- `tepp_simulation` deterministic truth-corpus generator with delayed reporting, multilevel memberships, method-effect variants, relation noise, and digest-bound truth manifests. -- `corpus_split` leakage-safe knowledge-cutoff snapshots, relation-connected co-partition groups, rolling-origin windows, and group-normalized ESS weight contracts. -- `persistence_postgres` live SQL port: `SqlSession` transport, migration batch applicator, document/audit SQL contracts, `LiveDocumentRepository`, and fail-closed `DATABASE_URL`/`LiveSqlxConfig` gate for SQLx pool wiring (optional `live-sqlx` driver attaches `PgPool`). -- `membership_core` Kish effective sample size, design effect, and group-normalized ESS helpers for multiple-membership estimation inputs. -- Credential-separated hourly NVIDIA NIM/OpenCode product-development workflow (issue #2): proposal, independent verification, and late Maintainer-App publication with `NVIDIA_NIM_API_KEY` only for model work. -- Hourly product-development queue gate now fails closed when either an open pull request or an open issue exists, including a second queue check immediately before publication. -- Documented modular naruon consumer contract for TEPP analysis-run and export surfaces, with a committed example request payload. -- Documented contextual-orchestrator interpretation port boundary and credential separation for TEPP. -- Foundation validation/release-readiness ledger at `docs/validation/temporal-event-foundation.md` tracking capability maturity and scientific acceptance gates. -- Research doctoring for multilevel/multiple-membership measurement and atomistic fallacy prevention. -- `persistence_postgres` bitemporal foundation: multi-word migration contracts, knowledge-cutoff eligibility, and in-memory as-known-at / as-valid-at document replay (live SQLx/PostgreSQL execution remains accepted-target). -- `event_core` mention/instance separation with explicit promotion, typed roles, event-time validity, and fail-closed mention-as-instance refusal. -- `membership_core` time-varying weighted multiple-membership network with contextual roles, event-time validity, and atomistic-fallacy prevention contracts. -- Bounded Allen interval algebra and path-consistency reasoner in `temporal_core` (Task 4; PR #9), with identity-isolated variables, resource budgets, inverse/composition, and conservative provenance. -- Approved Temporal Event Psychometrics Platform PRD v0.4 baseline. -- Canonical technical documentation map, TRD, UML/scientific runtime views, logical/planned ERD, scientific test strategy, operability/recovery guide, and requirements/research/evidence traceability with explicit implementation maturity. -- Whole-conversation documentation fitness assessment plus canonical API/MSA contract, threat model, privacy/data-governance contract, CSAP/SOC 2/ISO/NIST assurance-readiness mapping, and adaptive LLM orchestration/test-time-compute contract. -- ADR policy separating architectural **Decision status** from **Implementation maturity**, defining partial supersession, and making the ADR index the canonical decision-ownership map. -- ADR 0009 for purpose-bound PII governance without blanket masking, ADR 0010 for adaptive direct-versus-multi-agent LLM orchestration, and ADR 0011 for standalone/modular CWL service authority. -- ADR 0012 for Temporal Relational Shared-Latent Topic Measurement (TRSL-TM), global topic identity/backend compatibility/method-effect/model-selection authority. -- ADR 0013 for bitemporal persistence, immutable reproducibility/run/split manifests, relation-aware partitions, recovery, and PostgreSQL adapter authority. -- ADR 0014 separating accepted design, protected-main implementation, scientific/product claim promotion, and release evidence authority. -- ADR 0015 separating autonomous model proposal, deterministic verification, publication, independent review, and merge/release authority. -- ADR 0016 separating Event Ontology observation, TDT detection/tracking, CHRONOS schema prediction, symbolic temporal consistency, and promoted transition authority. -- Added APA 7 research traceability for ICLR 2026 TRINITY and Conductor, the 2026 Sakana Fugu technical report, ISO/IEC 42001:2023, ISO/IEC 23894:2023, NIST AI RMF/GAI Profile, AICPA Trust Services Criteria, and KISA CSAP guidance. -- Eight-phase delivery roadmap and Temporal/Event Foundation implementation plan. -- Immutable evidence, six-clock temporal semantics, interval reasoning, event ontology, typed relation graph, and time-varying multiple-membership contracts. -- Shared-latent multilingual topic measurement architecture with native lexical channels and language-profile validation. -- Longitudinal ESEM/DSEM and continuous-time structural modeling requirements. -- Rust-first CPU `f64`, multithreaded CPU, GPU, VRAM-adaptive streaming, and CPU/GPU parity requirements. -- Topic correlation, consensus clustering, TDT, CHRONOS, and evidence-grounded LLM interpretation requirements. -- APA 7th research traceability, source archive manifests, ADRs, governance, security, and contribution contracts. -- Hourly centralized PR-maintenance workflow and a documented requirement for a future credential-separated NVIDIA NIM/OpenCode product-development loop. -- Rust 1.97.1 virtual Cargo workspace with eleven explicit modular foundation crates. -- Repository contract, public-rustdoc, line-coverage, and nightly branch-coverage gates. -- Pinned `cargo-nextest` 0.9.140, `cargo-llvm-cov` 0.8.6, `cargo-deny` 0.19.7, and Coverage.py 7.15.2 quality tooling. -- Task 1 architecture decision and workspace-foundation validation report. -- Version-keyed, executable-only GitHub Actions caches for pinned Rust quality tools. -- Immutable `evidence_core` records with independent RFC 9562 `UUIDv7` identities, canonical `SHA-256` content digests, owned source bytes and UTF-8 text, exact byte/Unicode-scalar spans, and bounded page-layout coordinates. -- Strict versioned JSON wire contracts for artifacts, documents, exact spans, and nested page locations without exposing private domain storage. -- ADR 0008 and APA 7 doctoring for evidence identity, hashing, JSON interchange, UTF-8 boundaries, Unicode segmentation limits, and future W3C PROV integration. -- Same-run exact missing-line and missing-branch diagnostics for failed 100% Rust coverage gates. - -### Changed +- Delivery-authority recovery (#435 / #175) records the fresh live queue as **133 open pull requests: 132 Draft and 1 non-Draft**, with 15 open issues, on protected `main@1bc02f580cf48e1d39da239f0e818453437c31c3`. The observed queue peak in this recovery cycle was 149. Organization ruleset `18156473`, not classic branch-protection status alone, remains merge authority. +- Longitudinal Modeling PR #310 is the surviving `landing_vehicle`. Former PR #441 is closed after its corrected two-marginal lagged-correlation, typed event-time, overflow/underflow, recovery, and traceability evidence was folded into #310. #310 is **not merge-ready** until its exact-current-head required workflows terminate GREEN and qualifying independent review exists. +- One-map Drafts #476 (`DIFFUSIONstd`) and #477 (`discreteDIFFUSIONstd`) were retired only after their distinct stationarity, interval, numerical-edge, refusal, and `research_candidate` evidence was verified in #310 under `longitudinal_core`. +- Reusable scalar covariance standardisation is migrating to canonical owner `ContextualWisdomLab/fast-mlsirm` through Draft PR #1723 and Published Language candidate `fast_mlsirm.scalar_variance_standardisation@1.0.0`. TEPP #272 is retired after its exact-binary64 `v = 3` review finding was preserved upstream. TEPP #315 remains Draft adapter lineage and must remove duplicate local arithmetic after a released/versioned upstream contract is available and parity is proven. +- Documentation fitness now fails closed on malformed rows inside the priority exact-head inventory rather than silently omitting them when another valid row exists. ADR validation also requires repository-wide identity plus index/file agreement for Decision status and Implementation maturity, and rejects conflicting duplicate authority metadata. +- ADR 0004 and ADR 0008 authority metadata were normalized so active implementation evidence is not presented as protected-main capability. The ADR index now mirrors canonical file status/maturity for the repaired rows. The historical 0021 collision remains byte-preserved under `docs/adr/archive/`; the former colliding 0024 text is not falsely represented as an archive when verified original bytes are unavailable, and ADR 0026 remains only a Proposed successor identity. -- ALR and ILR inverse normalization now fails closed when division would turn - a representable subnormal weight into a zero simplex part; runtime images - are pinned to the reviewed multi-platform Rust and Debian OCI digests. -- `psychometric_core` scalar forward map `φ(Δt) = exp(a Δt)` now refuses binary64 underflow to `+0`. Voelkle et al. (2012, Eq. 7; ZORA accepted manuscript p. 16) write discrete auto-effects as `e^{a Δt}`, which are strictly positive; `a = ln(φ) / Δt` requires `φ > 0`. Direct overflow already failed closed. The Newton residual path refuses a mapped `+0` the same way. -- The docstring discovery test compares crate-root names to `EXPECTED_CRATES` instead of a hardcoded count of 10, so `semantic_core` is required and an unapproved extra crate fails closed. -- The LineageWeave temporal-context read exchange no longer emits a fabricated - `idempotency-key`; that header remains reserved for retryable write/export - operations with a caller-owned operation key. -- `tepp_api` project-history requests and projections now share the strict - `temporal_core` RFC 3339 parser and nominal `KnowledgeCutoff` boundary, - rejecting unknown offsets and other timestamp forms that the transport - parser could otherwise accept. -- Coverage validation now ignores LLVM rows for multiline call and iterator - syntax that have no independently executable source coordinate, while - retaining the authored-line 100% gate. -- Removed the temporary PR-155 review-repair workflows and source-fix helper after the bounded repair; subsequent changes use the normal reviewed branch path. -- Pinned Rust branch-coverage workflows to `nightly-2026-08-21`, which is newer than the workspace Rust 1.98.0 MSRV and avoids the previous nightly/MSRV mismatch. -- Applied the documented `sqlx_live.rs` authored-coverage exclusion to the hourly release gate so live-PostgreSQL success-path coverage is not reported as a false source failure. -- Removed unreachable duplicate Naruon host-control validation because the shared `require_nonempty` boundary already rejects C0/C1 controls; retained a C1 regression case alongside the existing C0 case. -- Kept one maturity row per capability in the traceability matrix while recording the active provider-receipt evidence without duplicating or downgrading existing capabilities. -- `tepp_api` corpus-split manifest validation now rejects governed link-kind arrays that are unsorted or duplicated, keeping untrusted JSON aligned with the schema's unique canonical representation and preventing equivalent audits from receiving different valid digests. -- Grounded `derived_sensitivity` doctoring on GDPR Article 4(1)/Recital 26 and WP29 Opinion 4/2007 (WP 136) as read from the official texts, and replaced the withdrawn ISO/IEC 29100:2011 use-limitation overclaim with the current 29100:2024 catalogue edition without quoting unread clause text. -- Added APA 7th method citations (Allen 1983; ISO 24617-1:2012; Hobbs & Pan 2017; Fox & Glas 2001; AERA/APA/NCME 2014; Blei & Lafferty 2006; Roberts et al. 2014, 2019; Chang & Blei 2009; Mimno et al. 2009; Asparouhov & Muthén 2009; Asparouhov et al. 2018; Marsh et al. 2014; Aitchison 1982; Allan 2002; Li et al. 2021; Anagnostopoulos et al. 2013) into ADRs 0002–0005, 0012, and 0016, plus TRACEABILITY/ARCHITECTURE/TRD method rows. Clarified that TRSL-TM is the product contract, STM-style logistic-normal is the reference family, ESEM/DSEM/TDT/CHRONOS remain accepted-target, and merged PRs #8/#9—not superseded drafts #5/#6—are the protected-main temporal lineage. -- Refreshed the live gap-baseline inventory to the 2026-08-24T05:41:54Z GitHub - snapshot (118 open PRs / 48 drafts / 12 issues; protected-main - `c45be17a9dbce95ef81cee230e9d128abc7160ac`), binding each operator-gap current - head SHA to that exact-head register, including #201 `6afd650667e1` (RFC 5646 - cited once; first GAP-005 slice, not implemented-main), stacked drafts - #202–#204, and #164 `ff2e645b1785` as the predecessor register head. Duplicate - PR #179 remains closed. Stacked-merged heads and queued Checks are not - implemented-main. -- Rust LCOV quality gating now ignores visibility-qualified function signatures - and structural match-arm labels that LLVM reports as zero-hit non-executable - lines. - PR #179 remains closed. Stacked-merged heads and queued Checks are not - implemented-main. -- Removed the completed one-shot PR #51 repair job from `docs-quality.yml`; the - workflow no longer invokes deleted repair scripts or requests write authority - after the executable compute implementation is already present. -- `persistence_postgres` entity and project target inserts now bind their tenant session context before rendering SQL, keeping `FORCE ROW LEVEL SECURITY` behavior consistent with every other tenant-scoped write; live coverage still proves raw wrong-tenant rejection. -- Clarified ADR 0001 so it owns Rust-first numerical/reference-backend authority while ADR 0011 owns cross-service MSA/service authority. -- Clarified ADR 0006 so it owns GPU/VRAM and model-credential boundaries; ADR 0010 now owns LLM orchestration policy and ADR 0015 owns autonomous repository-write/review/merge authority. -- Expanded ADR 0002–0005 and 0009–0011 with explicit implementation maturity, alternatives, failure/recovery, compatibility/migration, verification, and rollback/supersession boundaries where they were previously implicit. +### DDD ownership -### Security +- TEPP owns temporal/event composition, six-clock semantics, event ontology/temporal graph, longitudinal invariance/drift/alignment, leakage-safe knowledge cutoffs, and time-varying multilevel/cross-classified/multiple-membership policy. +- fast-mlsirm owns reusable static/generalized-mixed/dependence-aware psychometric numerical kernels, including reusable covariance standardisation and LSIRM/MLSIRM/DLSJM computation. +- contextual-orchestrator owns provider/LLM execution and routing. LLM output never becomes numerical or scientific authority. +- `context-graph-contracts` and `enterprise-architecture-core` are read-only to the TEPP writer while their Context Fabric owner loop is active. Open heads are candidate evidence, not released contracts. -- Naruon interchange refuses `x-apikey`, `x-api_key`, and hyphenated `api-key` credential-header aliases, not only `x-api-key`. -- GitHub HTTPS fleet transport maps request, response, and close-path network exceptions to `upstream_unavailable` without leaking raw provider exception text. -- Disabled-state classification and live disable confirmation now accept GitHub's official `disabled_manually`, `disabled_fork`, `disabled_inactivity`, and `deleted` registry states so orphan bootstrap/repair identities can be retired without name-only heuristics. -- Prohibited `COPILOT_GITHUB_TOKEN` and reserved `NVIDIA_NIM_API_KEY` for approved LLM test and development workflows. -- Defined purpose-bound PII access, opaque analytical identifiers, separately protected identity mapping, selective model-provider disclosure, retention/deletion, and privileged audit controls instead of destructive blanket masking. -- Added explicit threat classes for temporal leakage, relation/membership poisoning, model/artifact poisoning, numerical divergence, cross-tenant disclosure, prompt injection, evidence substitution, resource exhaustion, and scientific-integrity failures. -- Removed the bootstrap branch's credential-co-resident OpenCode workflow: no model process may receive repository-write authority, and scheduled product development remains disabled until proposal, independent verification, and late publication authority are separated across fresh jobs. -- Removed completed bootstrap materializers, encoded payload fragments, readiness sentinels, and push probes from the reviewable tree. -- Required full-commit GitHub Action pins, minimum permissions, concurrency controls, immutable audit evidence, SBOM, and provenance. -- Kept ordinary Rust CI free of LLM and reviewer credentials and disabled persisted checkout credentials. -- Refused to cache mutable Cargo registry, Git source, or target trees; cached quality binaries are keyed and checked by exact version. -- Copied caller-provided source bytes and document text before acceptance and kept validated evidence fields private. -- Made empty, oversized, malformed-digest, invalid UTF-8-boundary, coordinate-mismatch, cross-document, nonfinite-geometry, and out-of-page evidence fail closed with content-redacting errors. -- Rejected malformed or extended wire payloads, unsupported schema versions, invalid identifiers and byte values, digest/content substitution, stale document ownership, and invalid nested geometry during reconstruction. +### Release integrity -### Quality +- Queued, pending, skipped-required, predecessor-head, self-review, or local-only evidence is non-passing. +- No force-push, routine protection bypass, coverage exclusion, fail-open security substitution, or scientific claim promotion is authorized by this changelog. +- Deployable Context Graph/EA integration binds only to released/versioned contracts with provenance and passing compatibility evidence; TEPP latent estimates, scores, inferred event relations, and validity evidence are not copied into EA as authoritative architecture facts. -- Required 100% production line and branch coverage and complete public API docstrings. -- Required true-parameter recovery, RMSE, bias, interval coverage, temporal leakage, graph recovery, invariance, and CPU/GPU parity evidence. -- Expanded documentation contracts to require the canonical threat/privacy/assurance/API/orchestration/fitness documents, ADR policy, and every numbered ADR present in the canonical index to remain indexed and structurally complete. -- Added deterministic validation that ADR files and the index have identical decision numbers and that every ADR declares valid decision status, implementation maturity, supersession scope, core decision sections, verification, and rollback behavior. -- Added 100% statement and branch coverage for the repository quality-gate scripts. -- Made a zero executable-code coverage denominator explicit for the skeleton-only slice rather than treating it as evidence of implemented behavior. -- Denied warnings, missing public documentation, and unsafe Rust across the workspace. -- Added known digest vectors, mutation detection, hostile multibyte Unicode, exact-coordinate, page-boundary, stable-error, and invalid-input regression tests for the first evidence slice. -- Added strict wire round trips, unknown-field and version rejection, digest reconstruction, configured-limit, hostile JSON, and generated multilingual span tests. +## Historical record -The repository has not yet cut a stable implementation release, so no compare reference is published for `[Unreleased]` yet. +The complete prior changelog, including the historical `[0.2.0]` source-version record and detailed scientific branch lineage accumulated before queue/DDD normalization, is retained without rewriting at [`docs/archive/CHANGELOG-pre-queue-normalization-2026-09-01.md`](docs/archive/CHANGELOG-pre-queue-normalization-2026-09-01.md). Its archived statements remain provenance for their historical source state and do not override current protected-main, release, DDD, or scientific-promotion authority. diff --git a/docs/archive/CHANGELOG-pre-queue-normalization-2026-09-01.md b/docs/archive/CHANGELOG-pre-queue-normalization-2026-09-01.md new file mode 100644 index 000000000..65f7682bb --- /dev/null +++ b/docs/archive/CHANGELOG-pre-queue-normalization-2026-09-01.md @@ -0,0 +1,453 @@ +# Changelog + +All notable changes to TEPP are documented here. The format follows Keep a Changelog and semantic versioning once the first implementation release is cut. + +## [0.2.0] - 2026-08-25 + +### Fixed + +- `network_analysis` posterior edge estimation landed with heuristic and fail-open defects that this release repairs before any consumer depends on it: a non-finite correlation now fails to the neutral p-value instead of masquerading as `|r| = 1`; negative-effect edges are excluded from the whole consensus perturbation pipeline rather than leaking into the union partition; the hardcoded 0.1 edge-drop probability became an explicit validated `edge_drop_probability` parameter; pseudo-p-values were replaced by exact two-sided Fisher z-transform p-values (Fisher, 1921) driving Benjamini–Hochberg admission (Benjamini & Hochberg, 1995) with percentile-bootstrap intervals (Efron, 1979); and 27 uncovered branch outcomes gained exact red-to-green cases. The workspace version is aligned to 0.2.0 across every crate manifest. + +### Added + +- **TDT/CHRONOS durable result contract**: canonical typed JSON and deterministic GraphML now export the actual bounded Allen reasoner result, observed/derived status, and conservative accepted-assertion support; canonical payload digest and `tdt_chronos_interval_consistency_v1` type bind the immutable bytes into ADR 0013's append-only `model_artifact` chain. +- **Analysis engine**: deterministic end-to-end analysis-run execution with cutoff-safe eligibility, immutable evidence binding, and reproducibility manifests (`analysis_engine` crate). +- **Restore Driver p.16 `MANIFESTVARstd`**: `recover_standardised_manifest_variance` maps `θ / θ = 1` with strictly positive `MANIFESTVAR`, refusing unstandardised manifest-variance, `MANIFESTTRAITVARstd`, and Equation 5 `Var(y)` substitutions (`psychometric_core`). +- **Posterior network estimator**: cross-draw Pearson correlations in ILR space, jackknife SE and CI, Benjamini–Hochberg FDR edge admission, nonparametric bootstrap stability, greedy modularity consensus clustering (`network_analysis` crate). +- **Topic measurement reference estimator**: bounded deterministic CPU `f64` TRSL-TM fitting with ALR/ILR coordinates, Aitchison distance, and lexical-inferential-weight refusal gates (`topic_measurement` crate). +- **Psychometric core**: Driver et al. (2017) SDE discrete-time recovery suite including drift, diffusion, T0VAR, TIPRED/TDPRED effects, standardised parameters, trait/state variance decomposition, and observed-indicator mapping — 18 K lines of production Rust with true-parameter RMSE tests. +- **Temporal six-clock architecture**: system, event, assertion, document, availability, and knowledge-cutoff clocks with forward-only transition enforcement and revision ordering (`temporal_core` + dedicated clock crates). +- **Membership and relation boundaries**: episode membership, role contradiction, relation absence detection, support-edge refusal, inferred-status gate, payload bounds, outcome ordering, summarises-edge identity, copy identity, citation/support non-transition, retrospective reporting, intake authorization, provider receipt, encrypted identity mapping, derived sensitivity inheritance, and purpose-bound PII governance. +- **Interpretation gateway**: loopback HTTP listener serving contextual-orchestrator interpretation POSTs with evidence-bound LLM claims and numerical-authority refusal. +- **Compute backend**: VRAM budget types with CPU `f64` fallback policy. +- **Persistence**: bitemporal PostgreSQL store with live sqlx integration, concurrent-write SQLSTATE classification, entity/project fail-closed SQL, audit-event inspection through try_record, and retention lifecycle. +- **Validation**: exact-head claim promotion gates, corpus-split leakage-audit manifests, documentation quality validation, and scientific claim boundary contracts. + +### Changed + +- Consolidated 99 open pull requests into protected main through batch integration vehicle (#215), hourly scheduler independent merges, and individual rebase-admin passes. +- Workspace grew from 10 to 57 crates covering evidence, semantic, temporal, event, relation, membership, persistence, simulation, validation, API, topic measurement, psychometric, network, interpretation, compute, and analysis-engine boundaries. +- All database objects use two-or-more-word `snake_case`; third normal form enforced; hot-partition readiness tracked as a separate acceptance gate. + +### Security + +- Purpose-bound authorization grants; blanket PII masking refused in favour of selective disclosure. +- Identity mappings sealed with HMAC; re-identification exports restricted to explicit purpose grants. +- Tenant roles bound to system-time lifetimes; privileged-access decisions replayed without source identity. +- Provider field codes recorded without source text; sensitivity inherited onto derived artifacts. + +## [Unreleased] + +### Changed + +- Delivery-authority recovery vehicle (#435 / #175) now records the live 2026-09-01T10:19:29Z queue as **136** open PRs (91 draft, 45 non-draft) on protected main `1bc02f580cf48e1d39da239f0e818453437c31c3`. Scientifically unsafe #356 is closed without merge. Longitudinal repair #441 advanced to `6f483224b3a03e8237c6f4f098a8b0e85e0a91f5` and is classified as a landing-vehicle candidate, not merge authority. Export-collection CLI #444 is classified `fold_into_landing_vehicle`. Queued checks remain non-passing. + +- `event_core` adds bounded Allen interval-consistency classification, atomic path-consistency closure, contradiction/resource refusals, and an explicit dependency-error fallback without claiming unrestricted global satisfiability. + +- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, Table 2, p. 12 `MANIFESTTRAITVAR`; §7.1, p. 19; p. 16 `MANIFESTTRAITVARstd`; footnote 4; 2017-era ctsem `summary.ctsemFit.R`; JSS PDF re-opened 2026-08-27T14:20Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar standardised manifest-trait variance on current main after `0ce16e8` dropped the pre-consolidation code while research notes already named the map (register items 83–84). Table 2 names `MANIFESTTRAITVAR` `Ψ_τ` the additional time-invariant variance-covariance on the measurement level and sets it `NULL` when there is no manifest trait. Equation 5 writes `Γ ~ N(τ, Ψ)` and names that covariance the manifest traits. Section 7.1 names manifest traits stable individual differences in indicator levels, distinct from process-level `TRAITVAR` `φ_ξ`. Page 16 prints standardised matrices with the suffix `std` when appropriate. The printed example on p. 16 is `discreteDRIFTstd`, not `MANIFESTTRAITVARstd`. Footnote 4 standardises using only the relevant variance, not the total. The relevant variance for that named indicator-level correlation is `MANIFESTTRAITVAR`, not process-level `TRAITVAR` and not residual `MANIFESTVAR` `θ`. The 2017-era source forms `MANIFESTTRAITVARstd` only when `MANIFESTTRAITVAR != 0`, as `solve(sqrt(diag(MANIFESTTRAITVAR) + ridging)) %&% MANIFESTTRAITVAR` when `verbose = TRUE`. OpenMx `%&%` is `t(A) %*% B %*% A`. Unlike `TRAITVARstd`, that formation adds `diag(c(ridging), n.manifest)`. The default `ridging = FALSE` adds 0, not `0.0001`; that ridge is a numerical hack and is not this exact map. The scalar correlation is `ψ / ψ = 1` after strictly positive `MANIFESTTRAITVAR`. Form strictly positive `ψ` first, then `1 / √ψ`, then `(1 / √ψ) ψ (1 / √ψ)`. Unstandardised `MANIFESTTRAITVAR` is defined for a zero trait; standardised `MANIFESTTRAITVAR` is not. Zero `MANIFESTTRAITVAR` skips forming `MANIFESTTRAITVARstd` in the 2017-era source and fails closed here. Indicator-level trait variance is an event-time structural quantity, so a non-event clock fails closed. `MANIFESTTRAITVAR` does not require stable `a < 0`. Distinct positive `ψ` recover the same 1. `trait / trait = 1` is `TRAITVARstd` and recovers the same number and remains a distinct named quantity. `θ` is `MANIFESTVAR` and is measurement error, not this correlation. Meredith (1993) remains unread (web search 2026-08-27T14:20Z: Springer/Cambridge Core paywalled; Unpaywall historically `is_oa: false`; Springer `content/pdf` is an HTML stub). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread on the same terms (DOI `10.1007/bf02294457`). Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. + +- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, Table 2, p. 12 `TRAITVAR`; §7.1, pp. 18–19; p. 16 `TRAITVARstd`; footnote 4; 2017-era ctsem `summary.ctsemFit.R`; JSS PDF re-opened 2026-08-26T17:45Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar standardised trait variance on current main after `0ce16e8` dropped the pre-consolidation code while research notes already named the map (register items 81–82). Table 2 names `TRAITVAR` `φ_ξ` the latent trait variance/covariance and sets it `NULL` when there is no trait. Section 7.1 names traits the stable between-subject differences (unit-level unobserved heterogeneity). Page 16 prints standardised matrices with the suffix `std` when appropriate. The printed example on p. 16 is `discreteDRIFTstd`, not `TRAITVARstd`. Footnote 4 standardises using only the relevant variance, not the total. The relevant variance for that named between-subject correlation is `TRAITVAR`, not free first-occasion `T0VAR` and not process-dynamics `asymDIFFUSION`. The 2017-era source forms `TRAITVARstd` only when `TRAITVAR != 0`, as `solve(sqrt(diag(TRAITVAR))) %&% TRAITVAR` when `verbose = TRUE`. OpenMx `%&%` is `t(A) %*% B %*% A`. Unlike `T0VARstd`, that formation uses `diag(diag(TRAITVAR))` and does not add `diag(c(ridging))`. The ridge is a `T0VAR` numerical hack and is not this exact map. The scalar correlation is `trait / trait = 1` after strictly positive `TRAITVAR`. Form strictly positive `trait` first, then `1 / √trait`, then `(1 / √trait) trait (1 / √trait)`. Unstandardised `TRAITVAR` is defined for a zero trait; standardised `TRAITVAR` is not. Zero `TRAITVAR` skips forming `TRAITVARstd` in the 2017-era source and fails closed here. Between-subject variance is an event-time structural quantity, so a non-event clock fails closed. `TRAITVAR` does not require stable `a < 0`. Distinct positive `trait` recover the same 1. `p_0 / p_0 = 1` is `T0VARstd` and recovers the same number and remains a distinct named quantity. `t0_b² v` is `addedT0TIPREDVAR` and is extra first-occasion TI variance, not this correlation. Meredith (1993) remains unread (Unpaywall 2026-08-26T17:20Z: `is_oa: false`; OpenAlex closed; Springer `content/pdf` is an HTML stub). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread on the same terms (DOI `10.1007/bf02294457`; Unpaywall `is_oa: false`). Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. +- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, p. 16 `asymDIFFUSIONstd`; footnote 4; Eq. 4, p. 5; Table 2, p. 12; 2017-era ctsem `summary.ctsemFit.R`; JSS PDF re-opened 2026-08-26T17:20Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar standardised asymptotic within-subject variance on current main after `0ce16e8` dropped the pre-consolidation code while research notes already named the map (register items 89–90). Page 16 prints standardised matrices with the suffix `std` when appropriate, and names `asymDIFFUSION` the total within-subject variance as `Δt → ∞`. The printed example on p. 16 is `discreteDRIFTstd`, not `asymDIFFUSIONstd`. Footnote 4 standardises using only the relevant variance, not the total. The relevant variance for that named process-dynamics correlation is within-subject `asymDIFFUSION` `p = −q / (2 a)`, not free first-occasion `T0VAR`. The 2017-era source forms `asymDIFFUSIONstd` as `solve(sqrt(diag(asymDIFFUSION))) %&% asymDIFFUSION` when `verbose = TRUE`. OpenMx `%&%` is `t(A) %*% B %*% A`. The default `ridging = FALSE` adds 0, not `0.0001`; that ridge is a numerical hack and is not this exact map. The scalar correlation is `p / p = 1` after strictly positive `p`. Form strictly positive `p` first, then `1 / √p`, then `(1 / √p) p (1 / √p)`. Unstandardised `p` is defined for a zero process; standardised `asymDIFFUSION` is not. Zero `q` has no positive SD and fails closed. Lasting `p` requires stable `a < 0`. A non-event clock fails closed. Distinct positive `p` recover the same 1. `p_0 / p_0 = 1` is `T0VARstd` and recovers the same number and remains a distinct named quantity. `q / p = −2 a` is `DIFFUSIONstd` and is not this correlation. `v / v = 1` is `TIPREDVARstd` and recovers the same number and remains a distinct named quantity. Meredith (1993) remains unread (Unpaywall 2026-08-26T17:20Z: `is_oa: false`; OpenAlex closed; Springer `content/pdf` is an HTML stub). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread on the same terms (DOI `10.1007/bf02294457`; Unpaywall `is_oa: false`). Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. +- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, p. 16 `T0VARstd`; Table 2, p. 12; footnote 4; 2017-era ctsem `summary.ctsemFit.R`; JSS PDF re-opened 2026-08-26T07:17Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar standardised initial latent variance on current main after `0ce16e8` dropped the pre-consolidation code while research notes already named the map (register items 79–80). Page 16 prints standardised matrices with the suffix `std` when appropriate. The printed example on p. 16 is `discreteDRIFTstd`, not `T0VARstd`. Footnote 4 standardises using only the relevant variance, not the total. Table 2 names `T0VAR` the latent process initial variance/covariance. The first-occasion relevant variance is free `T0VAR` `p_0`, not process-dynamics `asymDIFFUSION` `-q / (2 a)`. The 2017-era source forms `T0VARstd` as `solve(sqrt(diag(T0VAR))) %&% T0VAR` when `verbose = TRUE`. OpenMx `%&%` is `t(A) %*% B %*% A`. The default `ridging = FALSE` adds 0, not `0.0001`; that ridge is a numerical hack and is not this exact map. The scalar correlation is `p_0 / p_0 = 1` after strictly positive `p_0`. Form strictly positive `p_0` first, then `1 / √p_0`, then `(1 / √p_0) p_0 (1 / √p_0)`. A zero first-occasion variance has no positive SD and fails closed. `T0` is an event-time occasion, so a non-event clock fails closed. Free `T0VAR` does not require stable `a < 0`. Distinct positive `p_0` recover the same 1. `μ_0 / √p_0` is `T0MEANSstd` and recovers the same number when `μ_0 = √p_0` and remains a distinct named quantity. `p / p = 1` is `asymDIFFUSIONstd` and recovers the same number and remains a distinct named quantity. Meredith (1993) remains unread (Unpaywall 2026-08-26T07:17Z: `is_oa: false`; OpenAlex closed; Springer `content/pdf` is a 3038-byte HTML stub). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread on the same terms (DOI `10.1007/bf02294457`; Unpaywall `is_oa: false`). Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. +- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, p. 16 `asymCINTstd`; Eq. 3, p. 4; Table 2, p. 12; footnote 4; 2017-era ctsem `summary.ctsemFit.R`; JSS PDF re-opened 2026-08-26T00:20Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar standardised asymptotic continuous intercept on current main after consolidation dropped the pre-consolidation `(-κ / a) / √p` slice. Page 16 prints standardised matrices with the suffix `std` when appropriate, and asymptotic values as `Δt → ∞`. Footnote 4 standardises using only the relevant variance, not the total. Table 2 names `κ` `CINT`. The relevant variance for that process intercept is within-subject `asymDIFFUSION` `p = −q / (2 a)`. The 2017-era source forms unstandardised `asymCINT` whenever `verbose = TRUE` as `-solve(DRIFT) %*% CINT` and does not form an `asymCINTstd` matrix. Form strictly positive `p` first, then the asymptotic intercept, then divide by `√p`. A zero intercept is exactly zero after that positive SD. Zero `q` has no positive process SD and fails closed. Lasting `p` requires stable `a < 0`. A non-event clock fails closed. `κ / √p` is `CINTstd` and is not this total-change map. `A^{-1}[e^{A Δt} − I] κ / √p` is `discreteCINTstd` and depends on the event interval. Meredith (1993) remains unread (Unpaywall 2026-08-25T18:22Z: `is_oa: false`; Springer `content/pdf` is a 3038-byte HTML stub). Mislevy (1991) remains unread on the same terms. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. +- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, p. 16 `T0MEANSstd`; Table 2, p. 12; footnote 4; 2017-era ctsem `summary.ctsemFit.R`; JSS PDF re-opened 2026-08-26T04:09Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar standardised initial latent mean on current main after `0ce16e8` dropped the pre-consolidation code while research notes already named the map. Page 16 prints standardised matrices with the suffix `std` when appropriate. Footnote 4 standardises using only the relevant variance, not the total. Table 2 names `T0MEANS` the `n.latent × 1` matrix of latent process means at the first time point `T0` and names `T0VAR` the latent process initial variance/covariance. The first-occasion relevant variance is free `T0VAR` `p_0`, not process-dynamics `asymDIFFUSION` `-q / (2 a)`. The 2017-era source forms unstandardised `T0MEANS` and does not form a `T0MEANSstd` matrix; the scalar map is `μ_0 / √p_0` after strictly positive `p_0`. A zero mean is exactly zero. Zero `p_0` has no positive SD and fails closed. `T0` is an event-time occasion, so a non-event clock fails closed. Free `T0MEANS` does not require stable `a < 0`. `p_0 / p_0 = 1` recovers the same number when `μ_0 = √p_0` and remains a distinct named quantity. `μ_0 / √asymDIFFUSION` uses process-dynamics variance and is not this first-occasion map. Meredith (1993) remains unread (Unpaywall 2026-08-26T00:22Z: `is_oa: false`; OpenAlex closed; Springer `content/pdf` is a 3038-byte HTML stub). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread on the same terms. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. +- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, p. 16 `MANIFESTMEANSstd`; Table 2, p. 12; footnote 4; Eq. 5, p. 5; 2017-era ctsem `summary.ctsemFit.R`; JSS PDF re-opened 2026-08-25T11:32Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar standardised manifest mean on current main after `0ce16e8` restored the pre-consolidation unstandardised slice. Page 16 prints standardised matrices with the suffix `std` when appropriate. Footnote 4 standardises using only the relevant variance, not the total. Table 2 names `MANIFESTMEANS` `τ` the `n.manifest × 1` matrix of manifest means and `MANIFESTVAR` `Θ` the residual covariance of the indicators. The relevant variance for that named measurement intercept is residual `θ`, not total observed `Var(y) = λ² Var(η) + θ`. The 2017-era source forms unstandardised `MANIFESTMEANS` and does not form a `MANIFESTMEANSstd` matrix; the scalar map is `τ / √θ` after strictly positive `θ`. A zero mean is exactly zero. Zero `θ` has no positive SD and fails closed. A non-event clock fails closed. `MANIFESTMEANS` does not require stable `a < 0`. `θ / θ = 1` recovers the same number when `τ = √θ` and remains a distinct named quantity. `τ / √(λ² Var(η) + θ)` uses total observed variance and is not this residual map. Meredith (1993) remains unread (Unpaywall 2026-08-25T11:32Z: `is_oa: false`, 0 locations; OpenAlex closed; Springer `content/pdf` is a 3038-byte HTML stub). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-25T11:32Z: `is_oa: false`, 0 locations). Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. +- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, p. 16 `CINTstd`; Eq. 1, p. 4; Table 2, p. 12; footnote 4; §7.1, pp. 18–19; JSS PDF re-opened 2026-08-25T11:43Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar standardised continuous intercept on current main after consolidation dropped the pre-consolidation `κ / √p` slice. Page 16 prints standardised matrices with the suffix `std` when appropriate. Footnote 4 standardises using only the relevant variance, not the total. Table 2 names `κ` `CINT`. The relevant variance for that process intercept is within-subject `asymDIFFUSION` `p = −q / (2 a)`, not total `trait + p + added`. Form strictly positive `p` first, then `κ / √p`. A zero intercept is exactly zero after that positive SD. Zero `q` has no positive process SD and fails closed. Lasting `p` requires stable `a < 0`. A non-event clock fails closed. `(-κ / a) / √p` is `asymCINTstd` and is not this continuous intercept. `A^{-1}[e^{A Δt} − I] κ / √p` is `discreteCINTstd` and depends on the event interval. `κ / √(trait + p + added)` uses the total and is not this residual map. `TRAITVAR` is not the standardisation variance. Meredith (1993) remains unread (Unpaywall 2026-08-25T11:43Z: `is_oa: false`; Springer `content/pdf` is a 3038-byte HTML stub). Mislevy (1991) remains unread on the same terms. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. +- Operator-gap register refreshed against protected main `c482ccea` (#239): workspace version 0.2.0, 57 crates, queue at seven open PRs with exact-head SHAs, issues #156/#168/#175 closed, GAP-009 advanced to estimator-core-plus-repairs with Leiden consensus remaining, GAP-001/GAP-012/GAP-017 closed on protected main, and a new Post-#239 state note recording both the estimator repairs and the non-release status of the version bump. Supersedes #236 whose base predated #239. +- `event_core` `EventMention` is the only constructible mention type and must be span-grounded: it cites one exact `SourceSpan`, document identity, six-clock evidence, extractor/model version, and proposed/reviewed status, and the surface is the document substring at that span. Exact-extent precision/recall recover known ACE extents with occupancy RMSE 0 versus whole-document RMSE 1; reviewed status and TDT/CHRONOS detections still cannot promote an instance. Interval consistency, persistence, and exports remain later #170 work. +- Restored protected-main gate integrity after the consolidation merges: hourly-scheduler prompt-contract tests now assert the gap-baseline-derived task contract (Gap ID naming, no invented weights) instead of stale increment-specific tokens, the operator-gap register inventory matches the live 33-PR queue, `evidence_core::image_unit` non-image/empty-subtype refusals and `load_union_branch_totals` valid-record accumulation have exact coverage, and the README crate fence plus duplicate registry entries stay deduped. +- Branch-coverage diagnostics on the post-consolidation head exposed two uncovered outcomes in `evidence_core::image_unit` (`is_image_media_type_token` non-image prefix and empty-subtype refusals), one uncovered authored line (the strip-prefix refusal), and lost valid-record coverage for `load_union_branch_totals`; exact red-to-green cases now cover the non-image/empty-subtype data URIs and per-coordinate True/False accumulation. +- Repaired post-consolidation merge fallout that left protected `main` red: restored the lost `return True` in the `check_coverage.py` match-guard branch, removed the shadowed duplicate `load_union_branch_totals` and `_is_multiline_match_guard` definitions plus duplicate workspace-crate entries (`episode_membership`, `analysis_engine`) from the contract tuple and Cargo member arrays, split two union-fused four-tuples back into `(variant, message)` pairs in the `event_core` error table, repaired the fused `identity_recovery_rate` body in `episode_membership::window`, deduplicated the checked-arithmetic eligible-count block in `analysis_engine`, fixed four-argument `unit()` test call sites, rebalanced the README crate-list fence around all 54 unique crates, and deduplicated the `location_membership`/`validation_core`/`tepp_api` architecture-table rows. Also documents private `PLAUSIBLE_IMAGE_MEDIA_TYPES` so `cargo doc -D warnings` passes. +- Branch coverage JSON now unique-folds `files[].branches` True/False counts across instantiations. Nightly totals on #49 head `1e3e2eb` reported `event_time.rs` 505/506 while every unique site had both arms taken (253 sites × 2 instantiations). Summary-only reports without branch arrays still fail closed on totals. The 100% contract is unique production arms, matching the LCOV authored-line gate. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. +- `psychometric_core` maps overflowing `expm1(a Δt)` / `expm1(2 a Δt)` in `recover_discrete_constant_predictor_effect` and `recover_discrete_process_noise` through the log-space rewrite without a redundant `if !argument.is_finite()` after overflow. Local crate llvm-cov on #49 head `559e7b399473ee90ba3234677dd9ef7f05f7fd2e` was 509/510: the same LLVM `exp`/`expm1` finite-argument proof as L768/L5040. Existing rewrite (`a = 800` / `a = 400`) and overflow (`a = 1e308`) tests remain the contract. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. +- `psychometric_core` maps overflowing `e^{a Δt}` / `e^{a(t−u)}` through the log-space rewrite without redundant `if !argument.is_finite()` after `exp` overflow on lagged covariance, T0 TI/TD carry, and impulse carry. Nightly branch coverage on #49 head `7e669babcc54408dd8407bbac56be0f304fa99e5` was 1713/1714: LLVM counted `event_time.rs` L5040 True and treated the finite-argument overflow False as uncovered after proving `exp` of a finite argument is finite, which binary64 overflow falsifies. `fit_scalar_log_rate` now also skips a zero earlier residual and a negative lag while still recovering from a valid pair. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. +- `psychometric_core` maps overflowing `e^{2 a Δt}` in `recover_discrete_latent_variance` through the log-space rewrite `(ln p + 2 a Δt).exp()` without a redundant `if !2 a Δt.is_finite()` after `exp` overflow. Nightly branch coverage on #49 head `e301e9706c0bd671ccad533063fb624cc568d0b3` was 1715/1716: LLVM counted `event_time.rs` L768 True and treated the finite-argument overflow False as uncovered after proving `exp` of a finite argument is finite, which binary64 overflow falsifies. Existing rewrite (`p = 1e-308`, `a = 400`, `Δt = 1`) and overflow (`a = 1e308`) tests remain the contract. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. +- `psychometric_core` executes the later `|| !log_rate.is_finite()` operand on `recover_discrete_time_independent_predictor_effect` from both the lib tests and the multilevel integration crate. Nightly branch coverage on #49 head `90b08bbe82cbe7776365a6c04df38857dfe5e53c` was 1714/1716: both True arms at `event_time.rs` L2480 were unhit because fail-closed tests supplied a non-finite `TIPREDEFFECT` or predictor before `a`. Direct `a = NaN` now takes those arms. `LagClock::as_str` is called through `black_box` so the outlined instantiation is not const-folded away. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. +- `psychometric_core` evaluates the Driver, Oud, and Voelkle (2017, §7.2) extra-process lag as `e^{ε Δt}` even when `ε Δt` underflows to `0` (`exp(0) = 1`). Nightly branch coverage on #49 head `22b8e68813ad59a9a91689bacfa4cf033dfad158` was 1718/1720: LLVM deleted `if extra_argument == 0.0` / `original_argument == 0.0` True after proving `ε < 0` and `Δt > 0` imply a nonzero product, which binary64 underflow falsifies. The public map now uses `exp` directly; `original_log_rate == 0` remains the Brownian `e^{0} = 1` path. Recovery tests assert the §7.2 identity `a_{ηξ} x e^{a Δt}(e^{(ε−a)Δt} − 1)/(ε − a)` on `(-min_subnormal) * 1e-320`. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. +- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, p. 16 `MANIFESTMEANSstd`; Table 2, p. 12; footnote 4; Eq. 5, p. 5; 2017-era ctsem `summary.ctsemFit.R`; JSS PDF re-opened 2026-08-25T05:04Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar standardised manifest mean. Page 16 prints standardised matrices with the suffix `std` when appropriate. Footnote 4 standardises using only the relevant variance, not the total. Table 2 names `MANIFESTMEANS` `τ` the `n.manifest × 1` matrix of manifest means. Table 2 names `MANIFESTVAR` `Θ` the residual covariance of the indicators. The relevant variance for that named measurement intercept is residual `MANIFESTVAR` `θ`, not total observed `Var(y) = λ² Var(η) + θ`, matching `MANIFESTVARstd`. The 2017-era `summary.ctsemFit.R` forms unstandardised `MANIFESTMEANS` as `mxEval(MANIFESTMEANS, mxobj, compute=TRUE)`. That source does not form a `MANIFESTMEANSstd` matrix; the scalar map here is the footnote 4 standardisation of that named intercept: `τ / √θ`. Form strictly positive `θ` first, then divide `τ` by `√θ`. A zero mean is exactly zero. Unstandardised `MANIFESTMEANS` is defined for a zero residual; standardised `MANIFESTMEANS` is not. Zero `θ` has no positive SD and fails closed. Manifest means are an event-time measurement quantity, so a non-event clock fails closed. `MANIFESTMEANS` does not require stable `a < 0`. `MANIFESTVARstd` `θ / θ = 1` recovers the same number when `τ = √θ` and remains a distinct named quantity. `τ / √(λ² Var(η) + θ)` uses total observed variance and is not this residual map. The 2017-era source assigns `dimnames(MANIFESTMEANS)` to `list(manifestNames, manifestNames)` on an `n.manifest × 1` matrix; that assignment is a source bug and is not this map. `T0MEANSstd` `μ_0 / √p_0` recovers the same number when `τ = μ_0` and `θ = p_0` and remains a distinct named quantity. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall 2026-08-25T05:04Z: `is_oa: false`, 0 locations; title *Measurement Invariance, Factor Analysis and Factorial Invariance*). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-25T05:04Z: `is_oa: false`, 0 locations; title *Randomization-Based Inference about Latent Variables from Complex Samples*). +- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, p. 16 `T0MEANSstd`; Table 2, p. 12; footnote 4; 2017-era ctsem `summary.ctsemFit.R`; JSS PDF re-opened 2026-08-24T22:30Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar standardised initial latent mean. Page 16 prints standardised matrices with the suffix `std` when appropriate. Footnote 4 standardises using only the relevant variance, not the total. Table 2 names `T0MEANS` the latent process means at the first time point `T0`. The first-occasion relevant variance is free `T0VAR` `p_0`, not process-dynamics `asymDIFFUSION` `-q / (2 a)`, matching Table 3 `T0TIPREDEFFECTstd`. The 2017-era `summary.ctsemFit.R` forms unstandardised `T0MEANS` as `OpenMx::mxEval(T0MEANS, mxobj, compute=TRUE)`. That source does not form a `T0MEANSstd` matrix; the scalar map here is the footnote 4 standardisation of that named first-occasion mean: `μ_0 / √p_0`. Form strictly positive `p_0` first, then divide `μ_0` by `√p_0`. A zero mean is exactly zero. Unstandardised `T0MEANS` is defined for a zero first-occasion variance; standardised `T0MEANS` is not. Zero `p_0` has no positive SD and fails closed. `T0` is an event-time occasion, so a non-event clock fails closed. Free `T0MEANS` does not require stable `a < 0`. `T0VARstd` `p_0 / p_0 = 1` recovers the same number when `μ_0 = √p_0` and remains a distinct named quantity. `μ_0 / √asymDIFFUSION` uses process-dynamics variance and is not this first-occasion map. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall 2026-08-24T08:02Z: `is_oa: false`, 0 locations; title *Measurement Invariance, Factor Analysis and Factorial Invariance*). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-24T08:02Z: `is_oa: false`, 0 locations; title *Randomization-Based Inference about Latent Variables from Complex Samples*). +- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, p. 16 `asymCINTstd`; Eq. 3, p. 4; footnote 4; Table 2, p. 12; 2017-era ctsem `summary.ctsemFit.R`; JSS PDF re-opened 2026-08-24T09:05Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar standardised asymptotic continuous intercept. Page 16 prints standardised matrices with the suffix `std` when appropriate. Footnote 4 standardises using only the relevant variance, not the total. `CINT` is the process intercept of individual, or average individual, dynamics, so that relevant variance is within-subject `asymDIFFUSION` `p = −q / (2 a)`. The 2017-era `summary.ctsemFit.R` forms `asymCINT` whenever `verbose = TRUE`, as `-solve(DRIFT) %*% CINT`. That source does not form an `asymCINTstd` matrix; the scalar map here is the footnote 4 standardisation of that named asymptotic intercept: `(-κ / a) / √p`. Form strictly positive `p` first, then the asymptotic intercept, then divide by `√p`. A zero intercept is exactly zero. Unstandardised `asymCINT` is defined for a zero process; standardised `asymCINT` is not. Zero `q` has no positive process SD and fails closed. Lasting `asymDIFFUSION` requires stable `a < 0`. A non-event clock fails closed. `κ / √p` is the continuous intercept standardisation and is not this total-change map. `A^{-1}[e^{A Δt} − I] κ / √p` depends on the event interval and is not this `Δt → ∞` map. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, not `CINTstd`, not `discreteCINTstd`, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall 2026-08-24T08:02Z: `is_oa: false`, 0 locations; title *Measurement Invariance, Factor Analysis and Factorial Invariance*). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-24T08:02Z: `is_oa: false`, 0 locations; title *Randomization-Based Inference about Latent Variables from Complex Samples*). +- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, p. 16 `discreteCINTstd`; Eq. 3, p. 4; footnote 4; Table 2, p. 12; 2017-era ctsem `summary.ctsemFit.R`; JSS PDF re-opened 2026-08-24T05:20Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar standardised discrete continuous intercept. Page 16 prints discrete-time transformations for a chosen event interval and, when appropriate, standardised matrices with the suffix `std`. Footnote 4 standardises using only the relevant variance, not the total. `CINT` is the process intercept of individual, or average individual, dynamics, so that relevant variance is within-subject `asymDIFFUSION` `p = −q / (2 a)`. The 2017-era `summary.ctsemFit.R` forms `discreteCINT` whenever `verbose = TRUE`, as `solve(DRIFT) %*% (discreteDRIFT − I) %*% CINT`. That source does not form a `discreteCINTstd` matrix; the scalar map here is the footnote 4 standardisation of that named discrete intercept: `A^{-1}[e^{A Δt} − I] κ / √p`. Form strictly positive `p` first, then the discrete intercept, then divide by `√p`. A zero intercept is exactly zero. Unstandardised `discreteCINT` is defined for growing `a ≥ 0` and for zero diffusion; standardised `discreteCINT` is not. Zero `q` has no positive process SD and fails closed. Lasting `asymDIFFUSION` requires stable `a < 0`. A non-event clock fails closed. A non-positive event interval fails closed. `κ / √p` does not depend on `Δt` and is not this finite-interval map. `(-κ / a) / √p` is the standardised asymptotic intercept and is not this map. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, not `CINTstd`, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall 2026-08-24T08:02Z: `is_oa: false`, 0 locations; title *Measurement Invariance, Factor Analysis and Factorial Invariance*). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-24T08:02Z: `is_oa: false`, 0 locations; title *Randomization-Based Inference about Latent Variables from Complex Samples*). +- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, p. 16 `asymDIFFUSIONstd`; footnote 4; Eq. 4; 2017-era ctsem `summary.ctsemFit.R`; JSS PDF re-opened 2026-08-23T23:02Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar standardised asymptotic within-subject variance. Page 16 names `asymDIFFUSION` the total within-subject variance as `Δt → ∞` and prints standardised matrices with the suffix `std` when appropriate. Footnote 4 standardises using only the relevant variance, not the total. The 2017-era `summary.ctsemFit.R` forms `asymDIFFUSIONstd` whenever `verbose = TRUE`, as `solve(sqrt(diag(asymDIFFUSION) + ridging)) %&% asymDIFFUSION`. OpenMx `%&%` is the quadratic form `t(A) %*% B %*% A`. That formation adds `diag(c(ridging), n.latent)`. The default `ridging = FALSE` adds 0, not `0.0001`; that ridge is a numerical hack and is not this exact map. The 2017-era source assigns `dimnames(asymDIFFUSIONstd)` to `latentNames`; that assignment matches the `n.latent × n.latent` matrix and is this map. The scalar correlation is `p / p = 1` after strictly positive Lyapunov `p = −q / (2 a)`. Form strictly positive `p` first, then `1 / √p`, then `(1 / √p) p (1 / √p)`. Unstandardised `asymDIFFUSION` is defined for a zero process; standardised `asymDIFFUSION` is not. Zero `q` makes `solve(sqrt(0))` fail in the 2017-era source and fails closed here. That source does not skip forming `asymDIFFUSIONstd` when `p = 0`. Within-subject variance is an event-time structural quantity, so a non-event clock fails closed. Lasting `asymDIFFUSION` requires stable `a < 0`. Distinct positive `p` recover the same 1. `TIPREDVARstd` `v / v = 1` recovers the same number and remains a distinct named quantity. `DIFFUSIONstd` `q / p = −2 a` is the continuous-diffusion ratio, not this correlation. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall 2026-08-24T08:02Z: `is_oa: false`, 0 locations; title *Measurement Invariance, Factor Analysis and Factorial Invariance*). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-24T08:02Z: `is_oa: false`, 0 locations; title *Randomization-Based Inference about Latent Variables from Complex Samples*). +- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, Table 2, p. 12 `TIPREDVAR`; p. 16 `TIPREDVARstd`; footnote 4; 2017-era ctsem `summary.ctsemFit.R`; JSS PDF re-opened 2026-08-23T22:53Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar standardised time-independent predictor variance. Table 2 names `TIPREDVAR` the variance/covariance of time-independent predictors. Page 16 prints standardised matrices with the suffix `std` when appropriate. The 2017-era `summary.ctsemFit.R` forms `TIPREDVARstd` whenever `verbose = TRUE` and `n.TIpred > 0`, as `solve(sqrt(diag(TIPREDVAR) + ridging)) %&% TIPREDVAR`. OpenMx `%&%` is the quadratic form `t(A) %*% B %*% A`. Unlike `TRAITVARstd`, that formation adds `diag(c(ridging), n.TIpred)`. The default `ridging = FALSE` adds 0, not `0.0001`; that ridge is a numerical hack and is not this exact map. The 2017-era source assigns `dimnames(TIPREDVARstd)` to `TIpredNames`; that assignment matches the `n.TIpred × n.TIpred` matrix and is this map. The scalar correlation is `v / v = 1` after strictly positive `TIPREDVAR`. Form strictly positive `v` first, then `1 / √v`, then `(1 / √v) v (1 / √v)`. Unstandardised `TIPREDVAR` is defined for a zero predictor; standardised `TIPREDVAR` is not. Zero `v` makes `solve(sqrt(0))` fail in the 2017-era source and fails closed here. Unlike `TRAITVAR` / `MANIFESTTRAITVAR`, that source does not skip forming `TIPREDVARstd` when `v = 0`. Predictor variance is an event-time structural quantity, so a non-event clock fails closed. `TIPREDVAR` does not require stable `a < 0`. Distinct positive `v` recover the same 1. `MANIFESTVARstd` `θ / θ = 1` recovers the same number and remains a distinct named quantity. Section 7.2 `addedTIPREDVAR` `(B / a)² v` is extra process variance, not this correlation. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall 2026-08-23T22:21Z: `is_oa: false`; title *Measurement Invariance, Factor Analysis and Factorial Invariance*). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-23T22:21Z: `is_oa: false`; title *Randomization-Based Inference about Latent Variables from Complex Samples*). +- `psychometric_core` recovers Equation 5 of the scalar analog of Driver, Oud, and Voelkle (2017, Eq. 5, p. 5; Table 2, p. 12 `TDPREDVAR` / `T0TDPREDCOV`; Table 3, p. 13 `T0TIPREDEFFECT`; p. 16; §7.2, pp. 20–21; 2017-era ctsem `summary.ctsemFit.R`; JSS PDF re-opened 2026-08-23T22:26Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) extra first-occasion time-dependent predictor variance. Equation 5 writes `y_i(t) = Γ + Λ η_i(t) + ζ_i(t)` with `ζ ~ N(0, Θ)` and `Γ ~ N(τ, Ψ)`. The 2017-era `summary.ctsemFit.R` forms the latent extra `addedT0TIPREDVAR` as `T0TIPREDEFFECT %*% TIPREDVAR %*% t(T0TIPREDEFFECT)` immediately after `T0TIPREDEFFECTstd`. That file comments out `TDPREDVAR` and does not form `addedT0TDPREDVAR`. The scalar analog of that quadratic form using the stack's first-occasion TD coefficient `t0_m` and Table 2 `TDPREDVAR` `v` is `t0_m² v`. Equation 5 of that analog extra, with `θ = 0` and `ψ = 0`, is `λ² t0_m² v`. Form the analog extra first, then `(λ extra) λ`. Do not form `λ²` first. A zero loading or zero extra is exactly zero. `v < 0` fails closed. `T0` is an event-time occasion, so a non-event clock fails closed. Free `t0_m` does not require stable `a < 0`. `t0_m² v` is the latent extra, not this observed extra. `λ² p_0 + θ` is first-occasion observed variance, not this extra. `λ² t0_b² v` is Eq. 5 of `addedT0TIPREDVAR` and is not this extra even when `t0_m = t0_b`. `MANIFESTVAR` `θ` is measurement error, not this extra. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall 2026-08-23T22:26Z: `is_oa: false`; title *Measurement Invariance, Factor Analysis and Factorial Invariance*). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-23T22:26Z: `is_oa: false`; title *Randomization-Based Inference about Latent Variables from Complex Samples*). +- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, Table 2, p. 12 `MANIFESTVAR`; Eq. 5, p. 5; p. 16 `MANIFESTVARstd`; footnote 4; 2017-era ctsem `summary.ctsemFit.R`; JSS PDF re-opened 2026-08-23T22:40Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar standardised measurement-error variance. Table 2 names `MANIFESTVAR` `Θ` the residual covariance of the indicators. Equation 5 writes `ζ ~ N(0, Θ)`. Page 16 prints standardised matrices with the suffix `std` when appropriate. The 2017-era `summary.ctsemFit.R` forms `MANIFESTVARstd` whenever `verbose = TRUE`, as `solve(sqrt(diag(MANIFESTVAR) + ridging)) %&% MANIFESTVAR`. OpenMx `%&%` is the quadratic form `t(A) %*% B %*% A`. Unlike `TRAITVARstd`, that formation adds `diag(c(ridging), n.manifest)`. The default `ridging = FALSE` adds 0, not `0.0001`; that ridge is a numerical hack and is not this exact map. The 2017-era source assigns `dimnames(MANIFESTVARstd)` to `latentNames`; the matrix is `n.manifest × n.manifest`. That assignment is a source bug and is not this exact map. The scalar correlation is `θ / θ = 1` after strictly positive `MANIFESTVAR`. Form strictly positive `θ` first, then `1 / √θ`, then `(1 / √θ) θ (1 / √θ)`. Unstandardised `MANIFESTVAR` is defined for a zero residual; standardised `MANIFESTVAR` is not. Zero `θ` makes `solve(sqrt(0))` fail in the 2017-era source and fails closed here. Unlike `TRAITVAR` / `MANIFESTTRAITVAR`, that source does not skip forming `MANIFESTVARstd` when `θ = 0`. Measurement-error variance is an event-time structural quantity, so a non-event clock fails closed. `MANIFESTVAR` does not require stable `a < 0`. Distinct positive `θ` recover the same 1. `MANIFESTTRAITVARstd` `ψ / ψ = 1` recovers the same number and remains a distinct named quantity. Equation 5 `λ² Var(η) + θ` is `Var(y)`, not this correlation. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall 2026-08-23T22:21Z: `is_oa: false`; title *Measurement Invariance, Factor Analysis and Factorial Invariance*). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-23T22:21Z: `is_oa: false`; title *Randomization-Based Inference about Latent Variables from Complex Samples*). +- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, Table 2, p. 12 `MANIFESTTRAITVAR`; §7.1, p. 19; p. 16 `MANIFESTTRAITVARstd`; footnote 4; 2017-era ctsem `summary.ctsemFit.R`; JSS PDF re-opened 2026-08-23T22:28Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar standardised manifest-trait variance. Table 2 names `MANIFESTTRAITVAR` `Ψ_τ` the additional time-invariant variance-covariance on the measurement level and sets it `NULL` when there is no manifest trait. Section 7.1 names manifest traits stable individual differences in indicator levels, distinct from process-level `TRAITVAR` `φ_ξ`. Page 16 prints standardised matrices with the suffix `std` when appropriate. The 2017-era `summary.ctsemFit.R` forms `MANIFESTTRAITVARstd` only when `MANIFESTTRAITVAR != 0`, as `solve(sqrt(diag(MANIFESTTRAITVAR) + ridging)) %&% MANIFESTTRAITVAR` when `verbose = TRUE`. OpenMx `%&%` is the quadratic form `t(A) %*% B %*% A`. Unlike `TRAITVARstd`, that formation adds `diag(c(ridging), n.manifest)`. The default `ridging = FALSE` adds 0, not `0.0001`; that ridge is a numerical hack and is not this exact map. The scalar correlation is `ψ / ψ = 1` after strictly positive `MANIFESTTRAITVAR`. Form strictly positive `ψ` first, then `1 / √ψ`, then `(1 / √ψ) ψ (1 / √ψ)`. Unstandardised `MANIFESTTRAITVAR` is defined for a zero trait; standardised `MANIFESTTRAITVAR` is not. Zero `MANIFESTTRAITVAR` skips forming `MANIFESTTRAITVARstd` in the 2017-era source and fails closed here. Indicator-level trait variance is an event-time structural quantity, so a non-event clock fails closed. `MANIFESTTRAITVAR` does not require stable `a < 0`. Distinct positive `ψ` recover the same 1. `TRAITVARstd` `trait / trait = 1` recovers the same number and remains a distinct named quantity. `MANIFESTVAR` `θ` is measurement error, not this correlation. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall 2026-08-23T22:21Z: `is_oa: false`; title *Measurement Invariance, Factor Analysis and Factorial Invariance*). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-23T22:21Z: `is_oa: false`; title *Randomization-Based Inference about Latent Variables from Complex Samples*). +- `psychometric_core` recovers the scalar analog of Driver, Oud, and Voelkle (2017, Table 2, p. 12 `TDPREDVAR` / `T0TDPREDCOV`; Table 3, p. 13 `T0TIPREDEFFECT`; p. 16; §7.2, pp. 20–21; Eq. 3, p. 5; 2017-era ctsem `summary.ctsemFit.R`; JSS PDF re-opened 2026-08-23T22:13Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) extra first-occasion time-dependent predictor variance. The 2017-era `summary.ctsemFit.R` forms `addedT0TIPREDVAR` as `T0TIPREDEFFECT %*% TIPREDVAR %*% t(T0TIPREDEFFECT)` immediately after `T0TIPREDEFFECTstd`. That file comments out `TDPREDVAR` and does not form `addedT0TDPREDVAR`. Table 2 names `T0TDPREDCOV` the covariance between latents at `T0` and time-dependent predictors, not this extra variance. Table 3 names `T0TIPREDEFFECT`, not a TD first-occasion effect matrix. The scalar analog of that quadratic form using the stack's first-occasion TD coefficient `t0_m` and Table 2 `TDPREDVAR` `v` is `t0_m² v`. Form `t0_m` first, then square, then multiply by `v`. A zero coefficient or zero predictor variance is exactly zero. `v < 0` fails closed. `T0` is an event-time occasion, so a non-event clock fails closed. Free `t0_m` does not require stable `a < 0`. `t0_b² v` is `addedT0TIPREDVAR` and is not this extra even when `t0_m = t0_b`. `t0_m · √v / √p_0` is `T0TDPREDEFFECTstd` and is not this variance. `T0TDPREDCOV` is the covariance, not `t0_m² v`. Free `T0VAR` `p_0` is the first-occasion state, not the extra TD variance. `TRAITVAR` is a zero-drift latent process, not `t0_m² v`. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall 2026-08-23T21:34Z: `is_oa: false`; title *Measurement Invariance, Factor Analysis and Factorial Invariance*). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-23T21:34Z: `is_oa: false`; title *Randomization-Based Inference about Latent Variables from Complex Samples*). +- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, Table 2, p. 12 `TRAITVAR`; §7.1, pp. 18–19; p. 16 `TRAITVARstd`; footnote 4; 2017-era ctsem `summary.ctsemFit.R`; JSS PDF re-opened 2026-08-23T22:21Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar standardised trait variance. Table 2 names `TRAITVAR` `φ_ξ` the latent trait variance/covariance and sets it `NULL` when there is no trait. Section 7.1 names traits the stable between-subject differences (unit-level unobserved heterogeneity). Page 16 prints standardised matrices with the suffix `std` when appropriate. The 2017-era `summary.ctsemFit.R` forms `TRAITVARstd` only when `TRAITVAR != 0`, as `solve(sqrt(diag(TRAITVAR))) %&% TRAITVAR` when `verbose = TRUE`. OpenMx `%&%` is the quadratic form `t(A) %*% B %*% A`. Unlike `T0VARstd`, that formation uses `diag(diag(TRAITVAR))` and does not add `diag(c(ridging))`. The ridge is a `T0VAR` numerical hack and is not this exact map. The scalar correlation is `trait / trait = 1` after strictly positive `TRAITVAR`. Form strictly positive `trait` first, then `1 / √trait`, then `(1 / √trait) trait (1 / √trait)`. Unstandardised `TRAITVAR` is defined for a zero trait; standardised `TRAITVAR` is not. Zero `TRAITVAR` skips forming `TRAITVARstd` in the 2017-era source and fails closed here. Between-subject variance is an event-time structural quantity, so a non-event clock fails closed. `TRAITVAR` does not require stable `a < 0`. Distinct positive `trait` recover the same 1. `T0VARstd` `p_0 / p_0 = 1` recovers the same number and remains a distinct named quantity. `addedT0TIPREDVAR` `t0_b² v` is extra first-occasion TI variance, not this correlation. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall 2026-08-23T22:21Z: `is_oa: false`; title *Measurement Invariance, Factor Analysis and Factorial Invariance*). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-23T22:21Z: `is_oa: false`; title *Randomization-Based Inference about Latent Variables from Complex Samples*). +- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, Table 3, p. 13 `T0TDPREDEFFECTstd`; Table 2, p. 12 `TDPREDVAR`; p. 16; footnote 4; Eq. 3, p. 5; 2017-era ctsem `summary.ctsemFit.R`; JSS PDF re-opened 2026-08-23T18:17Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar standardised first-occasion time-dependent predictor effect. Table 3 names `T0TDPREDEFFECT` the effect of time-dependent predictors on latents at `T0`. Page 16 prints standardised matrices with the suffix `std` when appropriate. Footnote 4: standardisations use only the relevant variance, not the total. The affecting variance is time-dependent predictor variance `TDPREDVAR` `v_x`, not `TIPREDVAR`. The affected variance is free first-occasion `T0VAR` `p_0`, not within-subject `asymDIFFUSION` `-q / (2 a)`, because Table 3 is the first occasion, not the process dynamics. Form strictly positive `p_0` first, then strictly positive `v_x`, then `t0_m · √v_x / √p_0`. Unstandardised `t0_m` is defined for a zero coefficient and for zero predictor variance; standardised `T0TDPREDEFFECT` is not. Zero `p_0` or zero `v_x` has no positive SD and fails closed. `T0` is an event-time occasion, so a non-event clock fails closed. Free `T0VAR` does not require stable `a < 0`. Same numbers as `T0TIPREDEFFECTstd` yield the same product; Table 3 names a different matrix. The continuous standardisation `B · √v / √(-q / (2 a))` uses `asymDIFFUSION` and is not this first-occasion map. Section 7.1 warns that omitting trait variance confounds between- and within-person information. `t0_m · √v_x / √(trait + p_0 + added)` uses the total, not free `T0VAR`, and is not `T0TDPREDEFFECTstd` when `TRAITVAR` is nonzero. `TRAITVAR` is not the standardisation variance. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall 2026-08-23T18:17Z: `is_oa: false`; title *Measurement Invariance, Factor Analysis and Factorial Invariance*). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-23T18:17Z: `is_oa: false`; title *Randomization-Based Inference about Latent Variables from Complex Samples*). +- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, p. 16; §7.2, pp. 20–21; Table 2, p. 12; 2017-era ctsem `summary.ctsemFit.R`; JSS PDF re-opened 2026-08-23T21:22Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar standardised extra time-independent predictor variance `addedTIPREDVARstd`. Page 16 prints standardised matrices with the suffix `std` when appropriate. After `addedTIPREDVAR` as `asymTIPREDEFFECT %*% TIPREDVAR %*% t(asymTIPREDEFFECT)`, the 2017-era `summary.ctsemFit.R` forms `addedTIPREDVARstd = solve(sqrt(diag(addedTIPREDVAR))) %&% addedTIPREDVAR`. OpenMx `%&%` is the quadratic form `t(A) %*% B %*% A`. The default `ridging = FALSE` adds 0, not `0.0001`; that ridge is a numerical hack and is not this exact map. The scalar correlation is `extra / extra = 1` after strictly positive extra. Form `addedTIPREDVAR` first, then the ratio. A zero extra has no positive extra SD and fails closed. Unstandardised `(B / a)² v` is defined for a zero coefficient and for zero predictor variance; standardised `addedTIPREDVAR` is not. `λ² (B / a)² v` is Eq. 5 of the extra, not this correlation. `t0_b² v` is `addedT0TIPREDVAR`, not this asymptotic extra correlation. `TRAITVAR` is not the standardisation variance. The printed 2-latent `addedTIPREDVAR` 2.838 is not this scalar 1. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall 2026-08-23T21:22Z: `is_oa: false`; title *Measurement Invariance, Factor Analysis and Factorial Invariance*). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-23T21:22Z: `is_oa: false`; title *Randomization-Based Inference about Latent Variables from Complex Samples*). +- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, p. 16 `TDPREDEFFECTstd`; Table 2, p. 12; Eq. 3, p. 5; footnote 4; §7.1, pp. 18–19; JSS PDF re-opened 2026-08-23T21:10Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar standardised continuous time-dependent predictor effect. Page 16 prints continuous-time parameters and, when appropriate, standardised matrices with the suffix `std`. Table 2 names `M` `TDPREDEFFECT`. Footnote 4: standardisations use only the relevant variance, not the total. The affecting variance is time-dependent predictor variance `v`. The affected variance is within-subject `asymDIFFUSION` `-q / (2 a)`, because the process dynamics are individual, or average individual, temporal dynamics. Form strictly positive `asymDIFFUSION` first, then strictly positive `v`, then `m · √v / √(-q / (2 a))`. Unstandardised `M` is defined for a zero coefficient and for zero predictor variance; standardised `TDPREDEFFECT` is not. Zero `asymDIFFUSION` or zero `v` has no positive SD and fails closed. `TIPREDEFFECTstd` `B · √v / √p` is a different named matrix even when `M = B` and the predictor variances match. The finite-interval intercept-style standardisation `A^{-1}[e^{A Δt} − I] M · √v / √p` depends on the event interval and is not this continuous Dirac coefficient. Section 7.1 warns that omitting trait variance confounds between- and within-person information. `m · √v / √(trait + p + added)` uses the total, not `asymDIFFUSION`, and is not `TDPREDEFFECTstd` when `TRAITVAR` is nonzero. `TRAITVAR` is not the standardisation variance. Predecessor `event_time.rs` asymptotic-std `process_sd == 0` / `predictor_sd == 0` gates after already-checked `within == 0` and `v == 0` were unreachable; this slice drops them so stacked line/branch coverage can close. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall 2026-08-23T21:10Z: `is_oa: false`; title *Measurement Invariance, Factor Analysis and Factorial Invariance*). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-23T21:10Z: `is_oa: false`; title *Randomization-Based Inference about Latent Variables from Complex Samples*). +- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, p. 16 `CINTstd`; Eq. 1, p. 4; Table 2, p. 12; footnote 4; §7.1, pp. 18–19; JSS PDF re-opened 2026-08-23T17:10Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar standardised continuous intercept. Page 16 prints continuous-time parameters and, when appropriate, standardised matrices with the suffix `std`. Table 2 names `κ` `CINT`. Footnote 4: standardisations use only the relevant variance, not the total. `CINT` is the process intercept of individual, or average individual, dynamics, so that relevant variance is within-subject `asymDIFFUSION` `-q / (2 a)`. Form strictly positive `asymDIFFUSION` first, then `κ / √(-q / (2 a))`. Unstandardised `κ` is defined for growing `a ≥ 0` and for zero diffusion; standardised `CINT` is not. Zero `asymDIFFUSION` has no positive SD and fails closed. The asymptotic standardisation `(-κ / a) / √p` is the total change, not this continuous intercept. The finite-interval standardisation `A^{-1}[e^{A Δt} − I] κ / √p` depends on the event interval and is not this continuous map. Section 7.1 warns that omitting trait variance confounds between- and within-person information. `κ / √(trait + p + added)` uses the total, not `asymDIFFUSION`, and is not `CINTstd` when `TRAITVAR` is nonzero. `TRAITVAR` is not the standardisation variance. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall 2026-08-23T13:19Z: `is_oa: false`; title *Measurement Invariance, Factor Analysis and Factorial Invariance*). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-23T13:19Z: `is_oa: false`; title *Randomization-Based Inference about Latent Variables from Complex Samples*). +- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, p. 16 `TIPREDEFFECTstd`; §7.2, pp. 20–21; Eq. 3, p. 5; Table 2, p. 12; footnote 4; JSS PDF re-opened 2026-08-23T16:21Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar standardised continuous time-independent predictor effect. Page 16 prints continuous-time parameters and, when appropriate, standardised matrices with the suffix `std`. Table 2 names `B` `TIPREDEFFECT`. Footnote 4: standardisations use only the relevant variance, not the total. The affecting variance is predictor variance `TIPREDVAR` `v`. The affected variance is within-subject `asymDIFFUSION` `-q / (2 a)`, because the process dynamics are individual, or average individual, temporal dynamics. Form strictly positive `asymDIFFUSION` first, then strictly positive `v`, then `B · √v / √(-q / (2 a))`. Unstandardised `B` is defined for a zero coefficient and for zero predictor variance; standardised `TIPREDEFFECT` is not. Zero `asymDIFFUSION` or zero `v` has no positive SD and fails closed. The asymptotic standardisation `(-B / a) · √v / √p` is the total change, not this continuous coefficient. The finite-interval standardisation `A^{-1}[e^{A Δt} − I] B · √v / √p` depends on the event interval and is not this continuous map. Section 7.1 warns that omitting trait variance confounds between- and within-person information. `B · √v / √(trait + p + added)` uses the total, not `asymDIFFUSION`, and is not `TIPREDEFFECTstd` when `TRAITVAR` is nonzero. `TRAITVAR` is not the standardisation variance. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall 2026-08-23T13:19Z: `is_oa: false`; title *Measurement Invariance, Factor Analysis and Factorial Invariance*). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-23T13:19Z: `is_oa: false`; title *Randomization-Based Inference about Latent Variables from Complex Samples*). +- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, p. 16 `asymTIPREDEFFECTstd`; §7.2, pp. 20–21; Eq. 3, p. 5; Table 2, p. 12; footnote 4; JSS PDF re-opened 2026-08-23T14:25Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar standardised asymptotic time-independent predictor effect. Page 16 prints continuous-time parameters and, when appropriate, standardised matrices with the suffix `std`. Section 7.2 names `asymTIPREDEFFECT` the expected total change in process means given a unit increase on a time-independent predictor. The scalar map is `-B / a` for stable `a < 0`. Footnote 4: standardisations use only the relevant variance, not the total. The affecting variance is predictor variance `TIPREDVAR` `v`. The affected variance is within-subject `asymDIFFUSION` `-q / (2 a)`, because the process dynamics are individual, or average individual, temporal dynamics. Form strictly positive `asymDIFFUSION` first, then strictly positive `v`, then the unit asymptotic effect, then `(-B / a) · √v / √(-q / (2 a))`. Unstandardised `-B / a` is defined for a zero coefficient and for zero predictor variance; standardised `asymTIPREDEFFECT` is not. Zero `asymDIFFUSION` or zero `v` has no positive SD and fails closed. The finite-interval standardisation `A^{-1}[e^{A Δt} − I] B · √v / √p` depends on the event interval and is not this `Δt → ∞` map. Section 7.1 warns that omitting trait variance confounds between- and within-person information. `(-B / a) · √v / √(trait + p + added)` uses the total, not `asymDIFFUSION`, and is not `asymTIPREDEFFECTstd` when `TRAITVAR` is nonzero. `TRAITVAR` is not the standardisation variance. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall 2026-08-23T13:19Z: `is_oa: false`; title *Measurement Invariance, Factor Analysis and Factorial Invariance*). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-23T13:19Z: `is_oa: false`; title *Randomization-Based Inference about Latent Variables from Complex Samples*). +- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, p. 16 `DRIFTstd`; Eq. 1, p. 4; footnote 4; §7.1, pp. 18–19; JSS PDF re-opened 2026-08-23T13:28Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar standardised continuous `DRIFT`. Page 16 prints continuous-time parameters (e.g., `DRIFT`) and, when appropriate, standardised matrices with the suffix `std`. Footnote 4: standardisations use only the relevant variance, not the total. For `DRIFT` that relevant variance is within-subject `asymDIFFUSION` `-q / (2 a)`, because `DRIFT` is intended to represent individual, or average individual, temporal dynamics. Form strictly positive `asymDIFFUSION` first. In the scalar stationary case the within-subject SD ratio is 1, so the standardised auto-effect equals the unstandardised log-rate numerically; those remain distinct named quantities. Unstandardised `a` is defined for growing `a ≥ 0` and for zero diffusion; standardised `DRIFT` is not. Zero `asymDIFFUSION` has no positive SD and fails closed. The discrete standardisation `e^{a Δt}` depends on the event interval and is not the continuous map. Section 7.1 warns that omitting trait variance confounds between- and within-person information. `a p / (trait + p + added)` uses the total, not `asymDIFFUSION`, and is not `DRIFTstd` when `TRAITVAR` is nonzero. `TRAITVAR` is not the standardisation variance. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall 2026-08-23T13:19Z: `is_oa: false`; title *Measurement Invariance, Factor Analysis and Factorial Invariance*). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-23T13:19Z: `is_oa: false`; title *Randomization-Based Inference about Latent Variables from Complex Samples*). +- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, p. 16 `DIFFUSIONstd`; Eq. 4, p. 5; footnote 4; §7.1, pp. 18–19; JSS PDF re-opened 2026-08-23T13:20Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar standardised continuous `DIFFUSION`. Page 16 prints continuous-time parameters (e.g., `DRIFT`, `DIFFUSION`) and, when appropriate, standardised matrices with the suffix `std`. Footnote 4: standardisations use only the relevant variance, not the total. Process noise is within-subject stochastic input, so that relevant variance is within-subject `asymDIFFUSION` `-q / (2 a)`, the same footnote 4 variance used for `DRIFT`. Form strictly positive `asymDIFFUSION` first, then `q / (−q / (2 a))`. In the scalar stationary case that ratio equals `-2 a` and does not depend on `q` once `q > 0`. Unstandardised `q` is defined for growing `a ≥ 0` and for zero diffusion; standardised `DIFFUSION` is not. Zero `asymDIFFUSION` has no positive SD and fails closed. The discrete standardisation `Q_Δt / (−q / (2 a)) = 1 − exp(2 a Δt)` depends on the event interval and is not the continuous map. Section 7.1 warns that omitting trait variance confounds between- and within-person information. `q / (trait + p + added)` uses the total, not `asymDIFFUSION`, and is not `DIFFUSIONstd` when `TRAITVAR` is nonzero. `TRAITVAR` is not the standardisation variance. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall 2026-08-23T13:19Z: `is_oa: false`; title *Measurement Invariance, Factor Analysis and Factorial Invariance*). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-23T13:19Z: `is_oa: false`; title *Randomization-Based Inference about Latent Variables from Complex Samples*). +- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, p. 16 `discreteDIFFUSIONstd`; Eq. 3–4, pp. 4–5; footnote 4; §7.1, pp. 18–19; JSS PDF re-opened 2026-08-23T13:06Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar standardised discrete `DIFFUSION`. Page 16 prints discrete-time transformations for a chosen event interval (`discreteDRIFT`, `discreteDIFFUSION`) and, when appropriate, standardised matrices with the suffix `std`. Footnote 4: standardisations use only the relevant variance, not the total. Process noise is within-subject stochastic input, so that relevant variance is within-subject `asymDIFFUSION` `-q / (2 a)`, the same footnote 4 variance used for `DRIFT`. Form strictly positive `asymDIFFUSION` first, then `Q_Δt` from Equation 4, then `Q_Δt / (−q / (2 a))`. In the scalar stationary case that ratio equals `1 − exp(2 a Δt)`. Unstandardised `Q_Δt` is defined for growing `a ≥ 0` and for zero diffusion; standardised `DIFFUSION` is not. Zero `asymDIFFUSION` has no positive SD and fails closed. The continuous standardisation `q / (−q / (2 a)) = −2 a` is not the discrete map. Section 7.1 warns that omitting trait variance confounds between- and within-person information. `Q_Δt / (trait + p + added)` uses the total, not `asymDIFFUSION`, and is not `discreteDIFFUSIONstd` when `TRAITVAR` is nonzero. `TRAITVAR` is not the standardisation variance. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall 2026-08-23T13:06Z: `is_oa: false`; title *Measurement Invariance, Factor Analysis and Factorial Invariance*). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-23T13:06Z: `is_oa: false`; title *Randomization-Based Inference about Latent Variables from Complex Samples*). +- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, p. 16 `discreteDRIFTstd`; Eq. 3, p. 5; footnote 4; §7.1, pp. 18–19; JSS PDF re-opened 2026-08-23T11:40Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar standardised discrete `DRIFT`. Page 16 prints `discreteDRIFT` as `expm(DRIFT Δt)` and, when appropriate, `discreteDRIFTstd`. Footnote 4: standardisations use only the relevant variance, not the total. For `DRIFT` that relevant variance is within-subject `asymDIFFUSION` `-q / (2 a)`, because `DRIFT` is intended to represent individual, or average individual, temporal dynamics. Form strictly positive `asymDIFFUSION` first, then `φ = exp(a Δt)`. In the scalar stationary case the within-subject SD ratio is 1, so the standardised auto-effect equals the unstandardised discrete lag numerically; those remain distinct named quantities. Unstandardised `e^{a Δt}` is defined for growing `a ≥ 0` and for zero diffusion; standardised `DRIFT` is not. Zero `asymDIFFUSION` has no positive SD and fails closed. Section 7.1 warns that omitting trait variance confounds between- and within-person information. The trait-plus-state autocorrelation `(trait + e^{a Δt} p + added) / (trait + p + added)` uses the total, not `asymDIFFUSION`, and is not `discreteDRIFTstd` when `TRAITVAR` is nonzero. `TRAITVAR` is not the standardisation variance. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall 2026-08-23T11:40Z: `is_oa: false`; title *Measurement Invariance, Factor Analysis and Factorial Invariance*). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-23T11:40Z: `is_oa: false`; title *Randomization-Based Inference about Latent Variables from Complex Samples*). +- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, §4.3, pp. 9–10; Eq. 5, p. 5; Table 2, p. 12; p. 16; §7.2, pp. 20–21; JSS PDF re-opened 2026-08-23T10:03Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar first-occasion variance of §4.3 predetermined `T0VAR`. Section 4.3 treats the first time point as predetermined when no assumptions are made about the process prior to the initial time point. Free `T0VAR` `p_0` is then estimated. Between-subject `TRAITVAR` and `addedTIPREDVAR` are inherently stationary. The first-occasion composition is `trait + p_0 + (B / a)² v`. Form the free first-occasion state variance first, then include the trait, then include the TI extra variance, then add. Setting `p_0 = −q / (2 a)` recovers the stationary first-occasion map. Stationary first-occasion variance uses `−q / (2 a)` in place of `p_0` and is not this map when `p_0` is free. Free `T0VAR` `p_0` is not this map. The lagged map `trait + e^{a Δt} p_0 + (B / a)² v` decays the state and is not this map. The later-occasion map `trait + e^{2 a Δt} p_0 + Q_Δt + (B / a)² v` includes `Q_Δt` and is not this map. As `Δt → 0+` those maps approach this composition. A zero trait, a zero initial variance, and a zero TI contribution is exactly zero. A zero initial variance and a zero TI contribution is exactly the trait. Trait-only variance does not require a stable drift. `a ≥ 0` cannot hold a finite TI extra variance when that contribution is nonzero and fails closed. Equation 5 of that first-occasion variance is `λ²(trait + p_0 + (B / a)² v) + θ + ψ`. `MANIFESTVAR` is not that first-occasion observed variance. The predetermined first-occasion latent variance is not the predetermined first-occasion observed variance. Stationary first-occasion observed variance is not that observed variance when `p_0` is free. Predetermined later observed variance includes `Q_Δt` and is not that first-occasion observed variance. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall 2026-08-23T10:03Z: `is_oa: false`; title *Measurement Invariance, Factor Analysis and Factorial Invariance*). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-23T10:03Z: `is_oa: false`; title *Randomization-Based Inference about Latent Variables from Complex Samples*). +- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, §4.3, pp. 9–10; Eq. 3–5, pp. 4–5; Table 2, p. 12; p. 16; §7.2, pp. 20–21; JSS PDF re-opened 2026-08-23T20:20Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar lagged covariance of §4.3 predetermined `T0VAR`. Section 4.3 treats the first time point as predetermined when no assumptions are made about the process prior to the initial time point. Free `T0VAR` `p_0` is then estimated. Equation 3 writes `η(t) = exp(A Δt) η(t0) + …`. Equation 4 writes `cov(η_t, η_{t-1}) = A_Δt cov(η_{t-1})`. Trait variance and `addedTIPREDVAR` are time-invariant between-subject and do not decay with `e^{a Δt}`. The lagged composition is `trait + e^{a Δt} p_0 + (B / a)² v`. Form the lagged free first-occasion covariance first, then include the trait, then include the TI extra variance, then add. Setting `p_0 = −q / (2 a)` recovers the stationary lagged map. Stationary lagged covariance uses `−q / (2 a)` in place of `p_0` and is not this map when `p_0` is free. Evolving `trait + p_0 + (B / a)² v` as if it were all state (`e^{a Δt}` of that total) is not this map. Free `T0VAR` `p_0` is not this map. The later-occasion map `trait + e^{2 a Δt} p_0 + Q_Δt + (B / a)² v` includes `Q_Δt` and is not this map. As `Δt → ∞` with stable `a < 0` the state term vanishes. As `Δt → 0+` the composition approaches `trait + p_0 + (B / a)² v`. A zero-diffusion carry with `a ≥ 0` is `e^{a Δt} p_0` and is kept. Trait-only variance does not require a stable drift. The interval must be event time and strictly positive. Equation 5 of that lagged covariance is `λ²(trait + e^{a Δt} p_0 + (B / a)² v) + ψ`. Independent `ε_t` does not enter. `MANIFESTVAR` is not that lagged observed covariance. The predetermined lagged latent covariance is not the predetermined lagged observed covariance. Predetermined later observed variance includes `Q_Δt` and `θ` and is not that lagged observed covariance. Stationary lagged observed covariance is not that observed covariance when `p_0` is free. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall 2026-08-23T20:20Z: `is_oa: false`; title *Measurement Invariance, Factor Analysis and Factorial Invariance*). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-23T20:20Z: `is_oa: false`; title *Randomization-Based Inference about Latent Variables from Complex Samples*). +- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, §4.3, pp. 9–10; Eq. 3–5, pp. 4–5; Table 2, p. 12; p. 16; §7.2, pp. 20–21; JSS PDF re-opened 2026-08-23T20:20Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar later-occasion variance of §4.3 predetermined `T0VAR`. Section 4.3 treats the first time point as predetermined when no assumptions are made about the process prior to the initial time point. Free `T0VAR` `p_0` is then estimated. The process gradually transitions from the variances of the initial parameters toward those of the parameters when the model is stationary. Equation 3 writes `η(t) = exp(A Δt) η(t0) + … +` the stochastic integral. Equation 4 writes that the integral exhibits covariance `Q_Δt`. The law of total variance on the within-subject state is `e^{2 a Δt} p_0 + Q_Δt`. Trait variance and `addedTIPREDVAR` are time-invariant between-subject and do not enter that process-noise integral. The later-occasion composition is `trait + e^{2 a Δt} p_0 + Q_Δt + (B / a)² v`. Form the evolved free first-occasion variance first, then include the trait, then include the TI extra variance, then add. Setting `p_0 = −q / (2 a)` recovers the stationary later-occasion map. Stationary later-occasion variance uses `−q / (2 a)` in place of `p_0` and is not this map when `p_0` is free. Evolving `trait + p_0 + (B / a)² v` as if it were all state (`e^{2 a Δt}` of that total plus `Q_Δt`) is not this map. Free `T0VAR` `p_0` is not this map. As `Δt → ∞` with stable `a < 0` the carried `p_0` vanishes and `Q_Δt` approaches `−q / (2 a)`, so the composition approaches contemporaneous stationary `T0VAR`. As `Δt → 0+` the composition approaches `trait + p_0 + (B / a)² v`. Nonzero diffusion with `a ≥ 0` is a growing process and is kept. The interval must be event time and strictly positive. Equation 5 of that later-occasion variance is `λ²(trait + e^{2 a Δt} p_0 + Q_Δt + (B / a)² v) + θ + ψ`. `MANIFESTVAR` is not that later-occasion observed variance. The predetermined later-occasion latent variance is not the predetermined later-occasion observed variance. Stationary later-occasion observed variance is not that observed variance when `p_0` is free. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall 2026-08-23T20:20Z: `is_oa: false`; title *Measurement Invariance, Factor Analysis and Factorial Invariance*). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-23T20:20Z: `is_oa: false`; title *Randomization-Based Inference about Latent Variables from Complex Samples*). +- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, p. 16 finite-interval standardised `TIPREDEFFECT`; §7.2, pp. 20–21; Eq. 3, p. 5; Table 2, p. 12; footnote 4; JSS PDF re-opened 2026-08-24T01:20Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar standardised finite-interval time-independent predictor effect. Page 16 prints discrete-time transformations for a chosen event interval and, when appropriate, standardised matrices with the suffix `std`. Equation 3 maps a finite event interval as `A^{-1}[e^{A Δt} − I] B`. Table 2 names `B` `TIPREDEFFECT`. Footnote 4: standardisations use only the relevant variance, not the total. The affecting variance is predictor variance `TIPREDVAR` `v`. The affected variance is within-subject `asymDIFFUSION` `-q / (2 a)`, because the process dynamics are individual, or average individual, temporal dynamics. Form strictly positive `asymDIFFUSION` first, then strictly positive `v`, then the unit discrete increment, then `A^{-1}[e^{A Δt} − I] B · √v / √(-q / (2 a))`. Unstandardised `A^{-1}[e^{A Δt} − I] B` is defined for a zero coefficient and for zero predictor variance; standardised finite-interval `TIPREDEFFECT` is not. Zero `asymDIFFUSION` or zero `v` has no positive SD and fails closed. Page 16 `asymTIPREDEFFECTstd` `(-B / a) · √v / √p` is the `Δt → ∞` map and is not this finite interval. A later event interval yields a different standardised increment. Section 7.1 warns that omitting trait variance confounds between- and within-person information. `A^{-1}[e^{A Δt} − I] B · √v / √(trait + p + added)` uses the total, not `asymDIFFUSION`, and is not the finite-interval map when `TRAITVAR` is nonzero. `TRAITVAR` is not the standardisation variance. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall 2026-08-24T01:20Z: `is_oa: false`; Springer `content/pdf` is HTML 200; title *Measurement Invariance, Factor Analysis and Factorial Invariance*). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-24T01:20Z: `is_oa: false`; Springer `content/pdf` is HTML 200; title *Randomization-Based Inference about Latent Variables from Complex Samples*). +- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, Table 2, p. 12 `T0VAR`; p. 16 `T0VARstd`; footnote 4; 2017-era ctsem `summary.ctsemFit.R`; JSS PDF re-opened 2026-08-23T22:06Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar standardised first-occasion latent variance. Table 2 names `T0VAR` the latent process initial variance/covariance. Page 16 prints standardised matrices with the suffix `std` when appropriate. The 2017-era `summary.ctsemFit.R` forms `T0VARstd` as `solve(sqrt(diag(T0VAR))) %&% T0VAR` when `verbose = TRUE`. OpenMx `%&%` is the quadratic form `t(A) %*% B %*% A`. The default `ridging = FALSE` adds 0, not `0.0001`; that ridge is a numerical hack and is not this exact map. The scalar correlation is `p_0 / p_0 = 1` after strictly positive free `T0VAR`. Form strictly positive `p_0` first, then `1 / √p_0`, then `(1 / √p_0) p_0 (1 / √p_0)`. Unstandardised `T0VAR` is defined for a zero first-occasion variance; standardised `T0VAR` is not. Zero `p_0` has no positive SD and fails closed. `T0` is an event-time occasion, so a non-event clock fails closed. Free `T0VAR` does not require stable `a < 0`. Distinct positive `p_0` recover the same 1. `T0TDPREDEFFECTstd` `t0_m · √v / √p_0` depends on `p_0` and is not this correlation. `addedT0TIPREDVAR` `t0_b² v` is extra TI variance, not this correlation. `TRAITVAR` is not the standardisation variance. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall 2026-08-23T22:06Z: `is_oa: false`; title *Measurement Invariance, Factor Analysis and Factorial Invariance*). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-23T22:06Z: `is_oa: false`; title *Randomization-Based Inference about Latent Variables from Complex Samples*). +- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, Table 3, p. 13 `T0TDPREDEFFECTstd`; Table 2, p. 12; p. 16; footnote 4; Eq. 3, p. 5; 2017-era ctsem `summary.ctsemFit.R`; JSS PDF re-opened 2026-08-23T21:34Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar standardised first-occasion time-dependent predictor effect. Table 3 names `T0TDPREDEFFECT` the effect of time-dependent predictors on latents at `T0`. Table 2 names `M` `TDPREDEFFECT` and names `T0TDPREDCOV` the first-occasion covariance, not this coefficient. Page 16 prints standardised matrices with the suffix `std` when appropriate. Footnote 4: standardisations use only the relevant variance, not the total. The affecting variance is time-dependent predictor variance `v`, not `TIPREDVAR`. The affected variance is free first-occasion `T0VAR` `p_0`, not within-subject `asymDIFFUSION` `-q / (2 a)`, because Table 3 is the first occasion, not the process dynamics. Form strictly positive `p_0` first, then strictly positive `v`, then `t0_m · √v / √p_0`. Unstandardised `t0_m` is defined for a zero coefficient and for zero predictor variance; standardised `T0TDPREDEFFECT` is not. Zero `p_0` or zero `v` has no positive SD and fails closed. `T0` is an event-time occasion, so a non-event clock fails closed. Free `T0VAR` does not require stable `a < 0`. The continuous standardisation `m · √v / √(-q / (2 a))` uses `asymDIFFUSION` and is not this first-occasion map. `T0TIPREDEFFECTstd` `t0_b · √v / √p_0` is a different named matrix even when `t0_m = t0_b` and the predictor variances match. Section 7.1 warns that omitting trait variance confounds between- and within-person information. `t0_m · √v / √(trait + p_0 + added)` uses the total, not free `T0VAR`, and is not `T0TDPREDEFFECTstd` when `TRAITVAR` is nonzero. `TRAITVAR` is not the standardisation variance. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall 2026-08-23T21:34Z: `is_oa: false`; title *Measurement Invariance, Factor Analysis and Factorial Invariance*). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-23T21:34Z: `is_oa: false`; title *Randomization-Based Inference about Latent Variables from Complex Samples*). +- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, Eq. 5, p. 5; Table 2, p. 12; §7.2, pp. 20–21; 2017-era ctsem `summary.ctsemFit.R`; JSS PDF re-opened 2026-08-23T19:23Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar extra observed-indicator time-independent predictor variance of §7.2 `addedTIPREDVAR`. Equation 5 writes `y_i(t) = Γ + Λ η_i(t) + ζ_i(t)` with `ζ ~ N(0, Θ)` and `Γ ~ N(τ, Ψ)`. The 2017-era `summary.ctsemFit.R` forms the latent extra `addedTIPREDVAR` as `asymTIPREDEFFECT %*% TIPREDVAR %*% t(asymTIPREDEFFECT)`. The scalar latent extra is `(B / a)² v`. Equation 5 of that extra, with `θ = 0` and `ψ = 0`, is `λ² (B / a)² v`. Form `addedTIPREDVAR` first, then `(λ extra) λ`. Do not form `λ²` first. A zero loading or zero extra is exactly zero. `v < 0` fails closed. A non-event clock fails closed. `a ≥ 0` cannot hold a finite process-mean change when the extra is nonzero and fails closed. `(B / a)² v` is the latent extra, not this observed extra. `λ² t0_b² v` is Eq. 5 of `addedT0TIPREDVAR`, not this asymptotic observed extra. `λ² p + θ` is stationary observed variance, not this extra. `MANIFESTVAR` `θ` is measurement error, not this extra. `Ψ` is intercept variance and is not extra TI. The printed 2-latent `addedTIPREDVAR` 2.838 is not this scalar map. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall 2026-08-23T19:10Z: `is_oa: false`; title *Measurement Invariance, Factor Analysis and Factorial Invariance*). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-23T19:10Z: `is_oa: false`; title *Randomization-Based Inference about Latent Variables from Complex Samples*). +- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, Eq. 5, p. 5; Table 3, p. 13 `T0TIPREDEFFECT`; Table 2, p. 12; p. 16; §7.2, pp. 20–21; 2017-era ctsem `summary.ctsemFit.R`; JSS PDF re-opened 2026-08-23T19:10Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar extra observed-indicator time-independent predictor variance of 2017-era `addedT0TIPREDVAR`. Equation 5 writes `y_i(t) = Γ + Λ η_i(t) + ζ_i(t)` with `ζ ~ N(0, Θ)` and `Γ ~ N(τ, Ψ)`. The 2017-era `summary.ctsemFit.R` forms the latent extra `addedT0TIPREDVAR` as `T0TIPREDEFFECT %*% TIPREDVAR %*% t(T0TIPREDEFFECT)` immediately after `T0TIPREDEFFECTstd`. The scalar latent extra is `t0_b² v`. Equation 5 of that extra, with `θ = 0` and `ψ = 0`, is `λ² t0_b² v`. Form `addedT0TIPREDVAR` first, then `(λ extra) λ`. Do not form `λ²` first. A zero loading or zero extra is exactly zero. `v < 0` fails closed. `T0` is an event-time occasion, so a non-event clock fails closed. Free `T0TIPREDEFFECT` does not require stable `a < 0`. `t0_b² v` is the latent extra, not this observed extra. `λ² p_0 + θ` is first-occasion observed variance, not this extra. `λ² (B / a)² v` is Eq. 5 of `addedTIPREDVAR`, not this first-occasion observed extra. `MANIFESTVAR` `θ` is measurement error, not this extra. `Ψ` is intercept variance and is not extra TI. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall 2026-08-23T19:10Z: `is_oa: false`; title *Measurement Invariance, Factor Analysis and Factorial Invariance*). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-23T19:10Z: `is_oa: false`; title *Randomization-Based Inference about Latent Variables from Complex Samples*). +- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, Table 3, p. 13 `T0TIPREDEFFECT`; p. 16; §7.2, pp. 20–21; Eq. 3, p. 5; 2017-era ctsem `summary.ctsemFit.R`; JSS PDF re-opened 2026-08-23T18:20Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar first-occasion extra time-independent predictor variance `addedT0TIPREDVAR`. Table 3 names `T0TIPREDEFFECT` the effect of time-independent predictors on latents at `T0`. Page 16 prints extra summary matrices when `verbose = TRUE`. The 2017-era `summary.ctsemFit.R` forms `addedT0TIPREDVAR` as `T0TIPREDEFFECT %*% TIPREDVAR %*% t(T0TIPREDEFFECT)` immediately after `T0TIPREDEFFECTstd`. Section 7.2 names `addedTIPREDVAR` the stable between-subject variance accounted for by time-independent predictors at the process asymptote, `(B / a)² v`. The first-occasion analogue uses free `T0TIPREDEFFECT`, not `-B / a`. The scalar map is `t0_b² v`. Form `t0_b` first, then square, then multiply by `v`. A zero coefficient or zero predictor variance is exactly zero. `v < 0` fails closed. `T0` is an event-time occasion, so a non-event clock fails closed. Free `T0TIPREDEFFECT` does not require stable `a < 0`. `(B / a)² v` is `addedTIPREDVAR` and is not this first-occasion map. `t0_b · √v / √p_0` is `T0TIPREDEFFECTstd` and is not this variance. Free `T0VAR` `p_0` is the first-occasion state, not the extra TI variance. `TRAITVAR` is a zero-drift latent process, not `t0_b² v`. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall 2026-08-23T18:20Z: `is_oa: false`; title *Measurement Invariance, Factor Analysis and Factorial Invariance*). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-23T18:20Z: `is_oa: false`; title *Randomization-Based Inference about Latent Variables from Complex Samples*). +- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, Table 3, p. 13 `T0TIPREDEFFECTstd`; p. 16; footnote 4; Eq. 3, p. 5; 2017-era ctsem `summary.ctsemFit.R`; JSS PDF re-opened 2026-08-23T17:20Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar standardised first-occasion time-independent predictor effect. Table 3 names `T0TIPREDEFFECT` the effect of time-independent predictors on latents at `T0`. Page 16 prints standardised matrices with the suffix `std` when appropriate. Footnote 4: standardisations use only the relevant variance, not the total. The affecting variance is predictor variance `TIPREDVAR` `v`. The affected variance is free first-occasion `T0VAR` `p_0`, not within-subject `asymDIFFUSION` `-q / (2 a)`, because Table 3 is the first occasion, not the process dynamics. Form strictly positive `p_0` first, then strictly positive `v`, then `t0_b · √v / √p_0`. Unstandardised `t0_b` is defined for a zero coefficient and for zero predictor variance; standardised `T0TIPREDEFFECT` is not. Zero `p_0` or zero `v` has no positive SD and fails closed. `T0` is an event-time occasion, so a non-event clock fails closed. Free `T0VAR` does not require stable `a < 0`. The continuous standardisation `B · √v / √(-q / (2 a))` uses `asymDIFFUSION` and is not this first-occasion map. The asymptotic standardisation `(-B / a) · √v / √p` is the total change, not this first-occasion coefficient. Section 7.1 warns that omitting trait variance confounds between- and within-person information. `t0_b · √v / √(trait + p_0 + added)` uses the total, not free `T0VAR`, and is not `T0TIPREDEFFECTstd` when `TRAITVAR` is nonzero. `TRAITVAR` is not the standardisation variance. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall 2026-08-23T17:20Z: `is_oa: false`; title *Measurement Invariance, Factor Analysis and Factorial Invariance*). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-23T17:20Z: `is_oa: false`; title *Randomization-Based Inference about Latent Variables from Complex Samples*). +- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, §4.3, pp. 9–10; Eq. 3–5, pp. 4–5; Table 2, p. 12; p. 16; §7.2, pp. 20–21; JSS PDF re-opened 2026-08-23T11:05Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar later-start later-occasion variance of §4.3 predetermined `T0VAR`. Section 4.3 treats the first time point as predetermined when no assumptions are made about the process prior to the initial time point. Free `T0VAR` `p_0` is then estimated. Section 4.3 notes that the process gradually transitions from the initial variances toward the stationary variances, and that the initial time point need not reflect the first measurement occasion (`startoffset`). Equation 3 writes `η(t) = exp(A Δt) η(t0) + … +` the stochastic integral. Equation 4 writes that the integral exhibits covariance `Q_Δt`. After a later start `u` the within-subject state variance is `e^{2 a u} p_0 + Q_u`. Evolving that later start over `s` is `e^{2 a s}(e^{2 a u} p_0 + Q_u) + Q_s`. Chapman–Kolmogorov writes `Q_{u+s} = e^{2 a s} Q_u + Q_s`, so the later-occasion map over `u + s` is the same composition. Trait variance and `addedTIPREDVAR` are time-invariant between-subject and do not enter `Q_s`. The later-start later-occasion composition is `trait + e^{2 a s}(e^{2 a u} p_0 + Q_u) + Q_s + (B / a)² v`. Form the later-start within-subject variance first, then evolve that state, then include the trait, then include the TI extra variance, then add. Setting `p_0 = −q / (2 a)` recovers the stationary later-occasion map. Stationary later-occasion variance uses `−q / (2 a)` in place of `p_0` and is not this map when `p_0` is free. Later-occasion variance at `u` omits `Q_s` and is not this map when `s > 0`. Later-start lagged covariance is `e^{a s}` of the later state and omits `Q_s`; it is not this map. Evolving the later total as if it were all state (`e^{2 a s}` of `trait + e^{2 a u} p_0 + Q_u + (B / a)² v` plus `Q_s`) is not this map. Later-occasion variance over the lag interval alone ignores `startoffset` and omits `e^{2 a s} Q_u`; it is not this map when `u > 0`. As `u → 0+` the composition approaches later-occasion variance over `s`. As `s → 0+` the composition approaches later-occasion variance at `u`. As `s → ∞` with stable `a < 0` the carried later state vanishes and `Q_s` approaches `−q / (2 a)`, so the composition approaches contemporaneous stationary `T0VAR`. A zero trait, a zero initial variance, a zero diffusion, and a zero TI contribution is exactly zero. A zero initial variance, a zero diffusion, and a zero TI contribution is exactly the trait. Trait-only variance does not require a stable drift. `a ≥ 0` cannot hold a finite TI extra variance when that contribution is nonzero and fails closed. Nonzero diffusion with `a ≥ 0` is a growing process and is kept. Both intervals must be event time and strictly positive. Equation 5 of that later-start later-occasion variance is `λ²(trait + e^{2 a s}(e^{2 a u} p_0 + Q_u) + Q_s + (B / a)² v) + θ + ψ`. `MANIFESTVAR` is not that later-start later-occasion observed variance. The later-start later-occasion latent variance is not the later-start later-occasion observed variance. Predetermined later observed variance at `u` omits `Q_s` and is not that observed variance when `s > 0`. Later-start lagged observed covariance omits `Q_s` and `θ` and is not that observed variance. Stationary later-occasion observed variance is not that observed variance when `p_0` is free. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall 2026-08-23T11:05Z: `is_oa: false`; title *Measurement Invariance, Factor Analysis and Factorial Invariance*). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-23T11:05Z: `is_oa: false`; title *Randomization-Based Inference about Latent Variables from Complex Samples*). +- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, §4.3, pp. 9–10; Eq. 3–5, pp. 4–5; Table 2, p. 12; p. 16; §7.2, pp. 20–21; JSS PDF re-opened 2026-08-23T10:27Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar later-start lagged covariance of §4.3 predetermined `T0VAR`. Section 4.3 treats the first time point as predetermined when no assumptions are made about the process prior to the initial time point. Free `T0VAR` `p_0` is then estimated. Section 4.3 notes that the process gradually transitions from the initial variances toward the stationary variances, and that the initial time point need not reflect the first measurement occasion (`startoffset`). Equation 3 writes `η(t) = exp(A Δt) η(t0) + … +` the stochastic integral. Equation 4 writes `cov(η_t, η_{t-1}) = A_Δt cov(η_{t-1})`. After a later start `u` the within-subject state variance is `e^{2 a u} p_0 + Q_u`. Lagging that later start over `s` is `e^{a s}(e^{2 a u} p_0 + Q_u)`. Trait variance and `addedTIPREDVAR` are time-invariant between-subject and do not decay with `e^{a s}`. The lagged composition is `trait + e^{a s}(e^{2 a u} p_0 + Q_u) + (B / a)² v`. Form the later-start within-subject variance first, then lag that state, then include the trait, then include the TI extra variance, then add. Setting `p_0 = −q / (2 a)` recovers the stationary lagged map. Stationary lagged covariance uses `−q / (2 a)` in place of `p_0` and is not this map when `p_0` is free. First-occasion lagged covariance `trait + e^{a s} p_0 + (B / a)² v` omits `e^{a s} Q_u` and is not this map when `u > 0`. Later-occasion variance includes `Q_u` without lagging that later state and is not this map. Evolving the later total as if it were all state (`e^{a s}` of `trait + e^{2 a u} p_0 + Q_u + (B / a)² v`) is not this map. As `u → 0+` the composition approaches first-occasion lagged covariance. As `s → 0+` the composition approaches later-occasion variance at `u`. As `s → ∞` with stable `a < 0` the state term vanishes. A zero trait, a zero initial variance, a zero diffusion, and a zero TI contribution is exactly zero. A zero initial variance, a zero diffusion, and a zero TI contribution is exactly the trait. Trait-only variance does not require a stable drift. `a ≥ 0` cannot hold a finite TI extra variance when that contribution is nonzero and fails closed. Nonzero diffusion with `a ≥ 0` is a growing process and is kept. Both intervals must be event time and strictly positive. Equation 5 of that later-start lagged covariance is `λ²(trait + e^{a s}(e^{2 a u} p_0 + Q_u) + (B / a)² v) + ψ`. Independent `ε_t` does not enter. `MANIFESTVAR` is not that later-start lagged observed covariance. The later-start lagged latent covariance is not the later-start lagged observed covariance. First-occasion lagged observed covariance omits `e^{a s} Q_u` and is not that observed covariance when `u > 0`. Predetermined later observed variance includes `Q_u` and `θ` and is not that later-start lagged observed covariance. Stationary lagged observed covariance is not that observed covariance when `p_0` is free. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall 2026-08-23T10:27Z: `is_oa: false`; title *Measurement Invariance, Factor Analysis and Factorial Invariance*). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-23T10:27Z: `is_oa: false`; title *Randomization-Based Inference about Latent Variables from Complex Samples*). +- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, §4.3, pp. 9–10; Eq. 3–5, pp. 4–5; Table 2, p. 12; p. 16; §7.2, pp. 20–21; JSS PDF re-opened 2026-08-23T09:04Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar lagged covariance of §4.3 predetermined `T0VAR`. Section 4.3 treats the first time point as predetermined when no assumptions are made about the process prior to the initial time point. Free `T0VAR` `p_0` is then estimated. Equation 3 writes `η(t) = exp(A Δt) η(t0) + …`. Equation 4 writes `cov(η_t, η_{t-1}) = A_Δt cov(η_{t-1})`. Trait variance and `addedTIPREDVAR` are time-invariant between-subject and do not decay with `e^{a Δt}`. The lagged composition is `trait + e^{a Δt} p_0 + (B / a)² v`. Form the lagged free first-occasion covariance first, then include the trait, then include the TI extra variance, then add. Setting `p_0 = −q / (2 a)` recovers the stationary lagged map. Stationary lagged covariance uses `−q / (2 a)` in place of `p_0` and is not this map when `p_0` is free. Evolving `trait + p_0 + (B / a)² v` as if it were all state (`e^{a Δt}` of that total) is not this map. Free `T0VAR` `p_0` is not this map. The later-occasion map `trait + e^{2 a Δt} p_0 + Q_Δt + (B / a)² v` includes `Q_Δt` and is not this map. As `Δt → ∞` with stable `a < 0` the state term vanishes. As `Δt → 0+` the composition approaches `trait + p_0 + (B / a)² v`. A zero-diffusion carry with `a ≥ 0` is `e^{a Δt} p_0` and is kept. Trait-only variance does not require a stable drift. The interval must be event time and strictly positive. Equation 5 of that lagged covariance is `λ²(trait + e^{a Δt} p_0 + (B / a)² v) + ψ`. Independent `ε_t` does not enter. `MANIFESTVAR` is not that lagged observed covariance. The predetermined lagged latent covariance is not the predetermined lagged observed covariance. Predetermined later observed variance includes `Q_Δt` and `θ` and is not that lagged observed covariance. Stationary lagged observed covariance is not that observed covariance when `p_0` is free. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall 2026-08-23T09:04Z: `is_oa: false`; title *Measurement Invariance, Factor Analysis and Factorial Invariance*). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-23T09:04Z: `is_oa: false`; title *Randomization-Based Inference about Latent Variables from Complex Samples*). +- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, §4.3, pp. 9–10; Eq. 3–5, pp. 4–5; Table 2, p. 12; p. 16; §7.2, pp. 20–21; JSS PDF re-opened 2026-08-23T05:12Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar later-occasion variance of §4.3 predetermined `T0VAR`. Section 4.3 treats the first time point as predetermined when no assumptions are made about the process prior to the initial time point. Free `T0VAR` `p_0` is then estimated. The process gradually transitions from the variances of the initial parameters toward those of the parameters when the model is stationary. Equation 3 writes `η(t) = exp(A Δt) η(t0) + … +` the stochastic integral. Equation 4 writes that the integral exhibits covariance `Q_Δt`. The law of total variance on the within-subject state is `e^{2 a Δt} p_0 + Q_Δt`. Trait variance and `addedTIPREDVAR` are time-invariant between-subject and do not enter that process-noise integral. The later-occasion composition is `trait + e^{2 a Δt} p_0 + Q_Δt + (B / a)² v`. Form the evolved free first-occasion variance first, then include the trait, then include the TI extra variance, then add. Setting `p_0 = −q / (2 a)` recovers the stationary later-occasion map. Stationary later-occasion variance uses `−q / (2 a)` in place of `p_0` and is not this map when `p_0` is free. Evolving `trait + p_0 + (B / a)² v` as if it were all state (`e^{2 a Δt}` of that total plus `Q_Δt`) is not this map. Free `T0VAR` `p_0` is not this map. As `Δt → ∞` with stable `a < 0` the carried `p_0` vanishes and `Q_Δt` approaches `−q / (2 a)`, so the composition approaches contemporaneous stationary `T0VAR`. As `Δt → 0+` the composition approaches `trait + p_0 + (B / a)² v`. Nonzero diffusion with `a ≥ 0` is a growing process and is kept. The interval must be event time and strictly positive. Equation 5 of that later-occasion variance is `λ²(trait + e^{2 a Δt} p_0 + Q_Δt + (B / a)² v) + θ + ψ`. `MANIFESTVAR` is not that later-occasion observed variance. The predetermined later-occasion latent variance is not the predetermined later-occasion observed variance. Stationary later-occasion observed variance is not that observed variance when `p_0` is free. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall 2026-08-23T05:12Z: `is_oa: false`; title *Measurement Invariance, Factor Analysis and Factorial Invariance*). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-23T05:12Z: `is_oa: false`; title *Randomization-Based Inference about Latent Variables from Complex Samples*). +- Branch coverage JSON now unique-folds `files[].branches` True/False counts across instantiations. Nightly totals on #49 head `1e3e2eb` reported `event_time.rs` 505/506 while every unique site had both arms taken (253 sites × 2 instantiations). Summary-only reports without branch arrays still fail closed on totals. The 100% contract is unique production arms, matching the LCOV authored-line gate. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. +- `psychometric_core` maps overflowing `expm1(a Δt)` / `expm1(2 a Δt)` in `recover_discrete_constant_predictor_effect` and `recover_discrete_process_noise` through the log-space rewrite without a redundant `if !argument.is_finite()` after overflow. Local crate llvm-cov on #49 head `559e7b399473ee90ba3234677dd9ef7f05f7fd2e` was 509/510: the same LLVM `exp`/`expm1` finite-argument proof as L768/L5040. Existing rewrite (`a = 800` / `a = 400`) and overflow (`a = 1e308`) tests remain the contract. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. +- `psychometric_core` maps overflowing `e^{a Δt}` / `e^{a(t−u)}` through the log-space rewrite without redundant `if !argument.is_finite()` after `exp` overflow on lagged covariance, T0 TI/TD carry, and impulse carry. Nightly branch coverage on #49 head `7e669babcc54408dd8407bbac56be0f304fa99e5` was 1713/1714: LLVM counted `event_time.rs` L5040 True and treated the finite-argument overflow False as uncovered after proving `exp` of a finite argument is finite, which binary64 overflow falsifies. `fit_scalar_log_rate` now also skips a zero earlier residual and a negative lag while still recovering from a valid pair. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. +- `psychometric_core` maps overflowing `e^{2 a Δt}` in `recover_discrete_latent_variance` through the log-space rewrite `(ln p + 2 a Δt).exp()` without a redundant `if !2 a Δt.is_finite()` after `exp` overflow. Nightly branch coverage on #49 head `e301e9706c0bd671ccad533063fb624cc568d0b3` was 1715/1716: LLVM counted `event_time.rs` L768 True and treated the finite-argument overflow False as uncovered after proving `exp` of a finite argument is finite, which binary64 overflow falsifies. Existing rewrite (`p = 1e-308`, `a = 400`, `Δt = 1`) and overflow (`a = 1e308`) tests remain the contract. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. +- `psychometric_core` executes the later `|| !log_rate.is_finite()` operand on `recover_discrete_time_independent_predictor_effect` from both the lib tests and the multilevel integration crate. Nightly branch coverage on #49 head `90b08bbe82cbe7776365a6c04df38857dfe5e53c` was 1714/1716: both True arms at `event_time.rs` L2480 were unhit because fail-closed tests supplied a non-finite `TIPREDEFFECT` or predictor before `a`. Direct `a = NaN` now takes those arms. `LagClock::as_str` is called through `black_box` so the outlined instantiation is not const-folded away. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. +- `psychometric_core` evaluates the Driver, Oud, and Voelkle (2017, §7.2) extra-process lag as `e^{ε Δt}` even when `ε Δt` underflows to `0` (`exp(0) = 1`). Nightly branch coverage on #49 head `22b8e68813ad59a9a91689bacfa4cf033dfad158` was 1718/1720: LLVM deleted `if extra_argument == 0.0` / `original_argument == 0.0` True after proving `ε < 0` and `Δt > 0` imply a nonzero product, which binary64 underflow falsifies. The public map now uses `exp` directly; `original_log_rate == 0` remains the Brownian `e^{0} = 1` path. Recovery tests assert the §7.2 identity `a_{ηξ} x e^{a Δt}(e^{(ε−a)Δt} − 1)/(ε − a)` on `(-min_subnormal) * 1e-320`. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. +- `psychometric_core` integration tests now execute the Driver, Oud, and Voelkle (2017, Eq. 3 first-summand carry) overflow rewrite of Table 3 `T0TIPREDEFFECT` / `T0TDPREDEFFECT` (`sign(t0_b z) exp(ln|t0_b z| + a Δt)` and the same form for `t0_m x0`). Nightly branch coverage on #49 head `d634f5849ed8e9f75af1b43c2e59d8e7d6301b45` was 1718/1720: the two missing records were the unused non-`cfg(test)` instantiations of `if !drift_interval.is_finite()` at the T0 TI and T0 TD carry overflow rewrites (`event_time.rs` L4245 and L4628). Lib tests already covered both sides; integration tests now take overflowing `a Δt` (`1e308 * 2`) and finite-`a Δt` overflowed `exp` (`710`) on those public maps. Meredith (1993) remains unread (Unpaywall 2026-08-22T23:12Z: `is_oa: false`; title *Measurement Invariance, Factor Analysis and Factorial Invariance*). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-22T23:12Z: `is_oa: false`; title *Randomization-Based Inference about Latent Variables from Complex Samples*). Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. +- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, §4.3, pp. 9–10; Eq. 3–5, pp. 4–5; Table 2, p. 12; p. 16; §7.2, pp. 20–21; JSS PDF re-opened 2026-08-22T23:12Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar later-occasion variance of §4.3 stationary `T0VAR`. Section 4.3 constrains first-occasion variance according to the model-predicted variances across all time points. Equation 3 writes `η(t) = exp(A Δt) η(t0) + … +` the stochastic integral. Equation 4 writes that the integral exhibits covariance `Q_Δt`. The law of total variance on the within-subject state is `e^{2 a Δt}(−q / (2 a)) + Q_Δt`. Trait variance and `addedTIPREDVAR` are time-invariant between-subject and do not enter that process-noise integral. The later-occasion composition is `trait + e^{2 a Δt}(−q / (2 a)) + Q_Δt + (B / a)² v`. Form the evolved within-subject variance first, then include the trait, then include the TI extra variance, then add. Under stationarity that composition equals contemporaneous `T0VAR`. Evolving the constrained total as if it were all state (`e^{2 a Δt} p_stat + Q_Δt`) is not this map. The lagged covariance `trait + e^{a Δt}(−q / (2 a)) + (B / a)² v` omits `Q_Δt` and is not this map. `Q_Δt` is not this map. The interval must be event time and strictly positive. Equation 5 of that later-occasion variance is `λ²(trait + e^{2 a Δt}(−q / (2 a)) + Q_Δt + (B / a)² v) + θ + ψ`. The lagged observed covariance omits `Q_Δt` and `θ`. `MANIFESTVAR` is not that later-occasion observed variance. The later-occasion latent variance is not the later-occasion observed variance. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall 2026-08-22T23:12Z: `is_oa: false`; title *Measurement Invariance, Factor Analysis and Factorial Invariance*). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-22T23:12Z: `is_oa: false`; title *Randomization-Based Inference about Latent Variables from Complex Samples*). +- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, §4.3, pp. 9–10; Eq. 3–5, pp. 4–5; Table 2, p. 12; p. 16; §7.2, pp. 20–21; JSS PDF re-opened 2026-08-22T19:13Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar lagged covariance of §4.3 stationary `T0VAR`. Equation 3 writes `η(t) = exp(A Δt) η(t0) + …`. Equation 4 writes `cov(η_t, η_{t-1}) = A_Δt cov(η_{t-1})`. The contemporaneous constraint is `trait + −q / (2 a) + (B / a)² v`. Trait variance and `addedTIPREDVAR` are time-invariant between-subject and do not decay with `e^{a Δt}`. The lagged composition is `trait + e^{a Δt}(−q / (2 a)) + (B / a)² v`. Form the lagged within-subject covariance first, then include the trait, then include the TI extra variance, then add. As `Δt → ∞` with stable `a < 0` the state term vanishes. As `Δt → 0+` the lagged map approaches contemporaneous `T0VAR`. Those limits are not this finite-lag map. Evolving the constrained total as if it were all state is not this map. `trait + e^{a Δt} p` is not this map when `addedTIPREDVAR` is nonzero. Contemporaneous `T0VAR` is not this map. The interval must be event time and strictly positive. Equation 5 of that lagged covariance is `λ²(trait + e^{a Δt}(−q / (2 a)) + (B / a)² v) + ψ`. Independent `ε_t` does not enter. `MANIFESTVAR` is not that lagged observed covariance. Contemporaneous `Var(y_0)` includes `θ` and is not that lagged observed covariance. The lagged latent covariance is not the lagged observed covariance. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall 2026-08-22T19:13Z: `is_oa: false`; title *Measurement Invariance, Factor Analysis and Factorial Invariance*). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-22T19:13Z: `is_oa: false`; title *Randomization-Based Inference about Latent Variables from Complex Samples*). +- `psychometric_core` rustfmt-sorts the `event_time` test import list and wraps four long test signatures so `cargo fmt --check` matches 1.97.1. Nightly branch coverage on #49 head `a6bea47acc38de1a33ed403360eb5cacd3023df6` was 1691/1712: the 21 missing True sides in `event_time.rs` were later `||` operands and `!Δt.is_finite()` (as opposed to `Δt <= 0`) on lagged observed covariance, extra-process, asymptotic TI/CINT, T0 carry, and impulse-carry guards. Direct inner-map calls now execute those arms. `as_measurement_invariance_wire_name` maps only Configural/Metric/Strong onto `#84` `configural`/`metric`/`scalar` and returns `None` for local Strict (`as_str` remains `"strict"`). Parent-head coverage note on `ebd01c4` is historical. Meredith (1993) remains unread (Unpaywall 2026-08-22T16:13Z: `is_oa: false`; Springer `content/pdf` is HTML 200). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-22T16:13Z: `is_oa: false`; Springer `content/pdf` is HTML 200). Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. +- `psychometric_core` covers the remaining fail-closed arms on `event_time.rs` lines 1995, 1998, 2063, 2065, 3695, 3706, 3751, 4078, 4089, and 4134 (nightly line/branch gaps on predecessor #49 head `ebd01c4`). Non-event clocks, non-positive and non-finite `Δt`, after-t0 extra-process interval errors after a successful `μ_t`, a zero extra-process contribution returning `μ_t`, Table 3 `T0TIPREDEFFECT`/`T0TDPREDEFFECT` effect errors through the carry, overflowing `a Δt` products, and those carry errors through the evolved-mean composition now execute. Meredith (1993) remains unread (Unpaywall 2026-08-22T12:15Z: `is_oa: false`; Springer `content/pdf` is HTML 200; Cambridge Core PDF 302 to a closed product page). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-22T12:15Z: `is_oa: false`; Springer `content/pdf` is HTML 200; NCES 404; ETS RR-91-18 404). Driver, Oud, and Voelkle (2017) JSS PDF re-opened 2026-08-22T12:17Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. +- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, §4.3, pp. 9–10; Eq. 5, p. 5; Table 2, p. 12; p. 16; §7.2, pp. 20–21; JSS PDF re-opened 2026-08-22T03:20Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar observed-indicator variance of §4.3 stationary `T0VAR`. Section 4.3 constrains the first-occasion variance to the model-predicted variance when `stationary` includes `"T0VAR"`. Equation 5 writes `y_i(t) = Γ + Λ η_i(t) + ζ_i(t)` with `ζ ~ N(0, Θ)` and `Γ ~ N(τ, Ψ)`. The constrained latent variance is `trait + −q / (2 a) + (B / a)² v`. The scalar composition is `Var(y_0) = λ²(trait + −q / (2 a) + (B / a)² v) + θ + ψ`. Form the stationary latent variance first, then `λ² p + θ + ψ`. A zero loading is exactly `θ + ψ`. A zero trait, a zero diffusion, and a zero TI contribution is exactly `θ + ψ`. `λ² p_0` for free `T0VAR` is not this composition. `λ²(−q / (2 a)) + θ` is not this composition when `TRAITVAR` or `addedTIPREDVAR` is nonzero. Evolving the constrained variance as if it were all state is not this composition when the trait or TI contribution is nonzero. `MANIFESTVAR` is not `Var(y_0)`. The constrained latent variance is not `Var(y_0)`. `TRAITVAR` is latent and is scaled by `λ²`; `MANIFESTTRAITVAR` is not. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall 2026-08-22T03:20Z: `is_oa: false`). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-22T03:20Z: `is_oa: false`; Springer `content/pdf` is HTML 200). +- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, §4.3, pp. 9–10; p. 16; Table 2, p. 12; §7.2, pp. 20–21; Eq. 4, p. 5; JSS PDF re-opened 2026-08-22T03:07Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar stationary `T0VAR`. Section 4.3 constrains the first-occasion variance to the model-predicted variance when `stationary` includes `"T0VAR"`. Page 16 names `asymDIFFUSION` the total within-subject variance `-q / (2 a)`. Section 4.3 (p. 9) adds `TRAITVAR`. Section 7.2 names `addedTIPREDVAR` the stable between-subject variance accounted for by time-independent predictors, `(B / a)² v`. The scalar composition is `trait + −q / (2 a) + (B / a)² v`. Form the within-subject contribution first, then include the trait, then include the TI extra variance, then add. A zero trait, a zero diffusion, and a zero TI contribution is exactly zero. A zero diffusion and a zero TI contribution is exactly the trait. `a ≥ 0` cannot hold a finite process variance when the diffusion or the TI contribution is nonzero and fails closed. Trait-only variance does not require a stable drift. That constrained first-occasion variance is not free `T0VAR`, not `asymDIFFUSION` alone, not `TRAITVAR` alone, not `addedTIPREDVAR` alone, and not the finite-interval discrete latent variance. The printed 2-latent `addedTIPREDVAR` 2.838 is not this scalar map. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall 2026-08-22T03:07Z: request empty). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-22T03:07Z: request empty; ETS RR-88-45 PDF 404; Wiley PDF 403). +- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, §4.3, pp. 9–10; Eq. 5, p. 5; Table 2, p. 12; Eq. 3, p. 5; JSS PDF re-opened 2026-08-21T20:07Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar observed-indicator mean of §4.3 stationary `T0MEANS`. Section 4.3 constrains the first-occasion mean to the model-predicted mean when `stationary` includes `"T0MEANS"`. Equation 5 writes `y_i(t) = Γ + Λ η_i(t) + ζ_i(t)` with `ζ ~ N(0, Θ)` and `Γ ~ N(τ, Ψ)`. The constrained latent mean is `-κ / a + −B z / a`. The scalar composition is `E(y_0) = τ + λ(−κ / a + −B z / a)`. Form the stationary latent mean first, then `τ + λ` of that mean. A zero loading is exactly `τ`. A zero intercept and a zero TI contribution is exactly `τ`. Evolving from that stationary start with `CINT` and `TIPREDEFFECT` stays at the stationary mean. `τ + λ μ_0` for free `T0MEANS` is not this composition. `τ + λ(−κ / a)` is not this composition when `B z ≠ 0`. `τ + λ μ_t` is not this composition. `MANIFESTMEANS` is not `E(y_0)`. The constrained latent mean is not `E(y_0)`. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall request empty this cycle). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-21T20:10Z: `is_oa: false`; Springer `content/pdf` is HTML 200). +- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, p. 16; Table 2, p. 12; Eq. 3, p. 5; JSS PDF opened 2026-08-21T16:13Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar stationary `T0MEANS`. Page 16 constrains `T0MEANS` to the model-implied values using `T0MEANSbase` / `T0MEANSfree` when the first observation is determined by the process in the same way as later observations. Those constraints include extra effects due to time-independent predictors (`asymTIPREDEFFECT`). For stable `a < 0` the scalar composition is `-κ / a + −B z / a`. Form the intercept contribution first, then include the TI extra effect, then add. A zero intercept and a zero TI contribution is exactly zero. `a ≥ 0` cannot hold a finite process-mean change when either contribution is nonzero and fails closed. That constrained first-occasion mean is not free `T0MEANS`, not `asymCINT` alone, not `asymTIPREDEFFECT` alone, and not the finite-interval discrete latent mean. The printed 2-latent `T0MEANS` 2.823 is not this scalar map. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) and Mislevy (1991, *Psychometrika, 56*, 177–196) remain unread (Unpaywall 2026-08-21T16:21Z: `is_oa: false`; Springer `content/pdf` is HTML 200). +- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, Table 2, p. 12; Eq. 3, p. 5; §4.3 / p. 16; JSS PDF opened 2026-08-21T16:13Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar `asymCINT`. Table 2 names `κ` `CINT` and names `asymCINT` the asymptotic (`Δt = ∞`) expected change in processes for a 1 unit change in intercept. Equation 3 maps a finite event interval as `A^{-1}[e^{A Δt} − I] κ`. For stable `a < 0` that `Δt → ∞` limit is `-A^{-1} κ`. The scalar map is `-κ / a`. A unit intercept is `-1 / a`. Form `κ` first, then divide by `-a`. A zero intercept is exactly zero. `a ≥ 0` cannot hold a finite process-mean change and fails closed. `-κ / a` is not `κ`, not the finite-interval increment `A^{-1}[e^{A Δt} − I] κ`, not `T0MEANS`, and not `asymTIPREDEFFECT` `-B z / a`. Page 16 notes that a `T0MEANS` stationarity constraint includes time-independent predictors; that composition is not this intercept-only map. The printed 2-latent `CINT` values are not this scalar map. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) and Mislevy (1991, *Psychometrika, 56*, 177–196) remain unread (Unpaywall 2026-08-21T16:21Z: `is_oa: false`; Springer `content/pdf` is HTML 200). +- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, §7.2, pp. 20–21; Eq. 3, p. 5; Table 2, p. 12; JSS PDF opened 2026-08-21T13:08Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar `addedTIPREDVAR`. Section 7.2 names that matrix the stable between-subject variance accounted for by time-independent predictors. For stable `a < 0` and predictor variance `v ≥ 0` the scalar map is `(B / a)² v`. Form the unit asymptotic effect `-B / a` first, then square, then multiply by `v`. A zero coefficient or zero predictor variance is exactly zero. `v < 0` fails closed. `a ≥ 0` cannot hold a finite process-mean change and fails closed. `(B / a)² v` is not `TRAITVAR`, not `asymDIFFUSION`, and not the expected total change `-B z / a`. The printed 2-latent `addedTIPREDVAR` 2.838 is not this scalar map. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) and Mislevy (1991, *Psychometrika, 56*, 177–196) remain unread (Unpaywall 2026-08-21T06:24Z: `is_oa: false`; Springer `content/pdf` is HTML 200). +- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, §7.2, pp. 20–21; Eq. 3, p. 5; Table 2, p. 12; JSS PDF opened 2026-08-21T13:08Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar `asymTIPREDEFFECT`. Table 2 names `B` `TIPREDEFFECT`. Equation 3 maps a finite event interval as `A^{-1}[e^{A Δt} − I] B z`. Section 7.2 names `asymTIPREDEFFECT` the expected total change in process means given an increase of 1 on a time-independent predictor. For stable `a < 0` that total change is `-A^{-1} B`. The scalar map is `-B z / a`. Form `B z` first, then divide by `-a`. A zero coefficient or zero predictor is exactly zero. `a ≥ 0` cannot hold a finite process-mean change and fails closed. `-B z / a` is not the coefficient `B`, not the finite-interval increment `A^{-1}[e^{A Δt} − I] B z`, not `CINT`, and not `M x`. Printed LeisureTime `TIPREDEFFECT` `−0.225` / `asymTIPREDEFFECT` `−1.673` and Happiness `0.549` / `0.219` reconstruct under this map. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) and Mislevy (1991, *Psychometrika, 56*, 177–196) remain unread (Unpaywall 2026-08-21T06:24Z: `is_oa: false`; Springer `content/pdf` is HTML 200). +- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, Eq. 5, p. 5; §7.2, pp. 22–23; JSS PDF re-opened 2026-08-21T06:32Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar observed-indicator mean of an extra-process `TDPREDEFFECT` after `t0`. Section 7.2 names `T0TDPREDEFFECT` when the extra process begins at `t = 0` and `TDPREDEFFECT` when it begins after `t = 0`. The printed extra process has `LAMBDA` 0. Original indicators load on the original process after the `DRIFT` coupling over `t − u` with `t0 < u < t` while `μ_t` still uses `Δt = t − t0`. The scalar composition is `E(y_t) = τ + λ(μ_t + a_{ηξ} x (e^{ε(t−u)} − e^{a(t−u)}) / (ε − a))`. The first-occasion extra-process observed mean uses `Δt` for both the evolution and the extra drive and is not this composition when `u ≠ t0`. The evolved observed mean `τ + λ μ_t` is not this composition. The impulse-carry map `τ + λ(μ_t + e^{a(t−u)} m x)` is a Dirac on the original process and is not this `DRIFT` drive. An impulse at `u = t0` or `u = t` is not interior. A zero original-indicator loading is exactly `τ`. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) and Mislevy (1991, *Psychometrika, 56*, 177–196) remain unread (Unpaywall 2026-08-21T06:24Z: `is_oa: false`; Springer `content/pdf` is HTML 200). +- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, Eq. 5, p. 5; §7.2, pp. 22–23; Eq. 1–3, pp. 4–5; Table 2, p. 12; JSS PDF re-opened 2026-08-21T06:12Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar observed-indicator mean of the extra near-zero-drift latent process contribution. Section 7.2's printed extra process has `LAMBDA` 0 and is not an observed indicator. Original indicators load on the original process after the `DRIFT` coupling `a_{ηξ}`. After a unit identification impulse the latent process at `t` is `μ_t + a_{ηξ} x (e^{ε Δt} − e^{a Δt}) / (ε − a)`. The scalar composition is `E(y_t) = τ + λ(μ_t + a_{ηξ} x (e^{ε Δt} − e^{a Δt}) / (ε − a))`. Form the evolved-plus-contribution latent mean first, then `τ + λ` of that mean. The evolved observed mean `τ + λ μ_t` is not this composition. The contemporaneous map `τ + λ(μ_t + m x)` is not this composition. The extra-process contribution is not `E(y_t)`. The evolved-plus-contribution latent mean is not `E(y_t)`. A zero original-indicator loading is exactly `τ`. A zero coupling recovers `τ + λ μ_t`. `ε ≥ 0` fails closed. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) and Mislevy (1991, *Psychometrika, 56*, 177–196) remain unread (Unpaywall 2026-08-21T06:24Z: `is_oa: false`; Springer `content/pdf` is HTML 200). +- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, §7.2, pp. 22–23; Eq. 1–3, pp. 4–5; Table 2, p. 12; JSS PDF re-opened 2026-08-20T23:10Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar contribution of the extra near-zero-drift latent process. Section 7.2 specifies a lasting level change by that extra process: `T0MEANS`, `CINT`, `T0VAR`, `DIFFUSION`, and `TRAITVAR` of it are fixed to 0; `TDPREDEFFECT` on it is fixed to 1; its `DRIFT` diagonal is very close to 0 (printed example `−0.000001`; precisely 0 causes computational problems); and its effect on the original process is the `DRIFT` coupling `a_{ηξ}`. After a unit identification impulse the scalar contribution is `a_{ηξ} x (e^{ε Δt} − e^{a Δt}) / (ε − a)` (`ε = a` is `a_{ηξ} x Δt e^{a Δt}`). Form `a_{ηξ} x` first. A zero coupling or zero predictor is exactly zero. `ε ≥ 0` fails closed. That contribution is not `κ = −a m x`, not `(1 − e^{a Δt}) m x`, and not the dissipating Dirac `m x`. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) and Mislevy (1991, *Psychometrika, 56*, 177–196) remain unread (Unpaywall 2026-08-20T23:10Z: `is_oa: false`; Springer `content/pdf` is HTML 200). +- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, §7.2, pp. 20–21; Eq. 3, pp. 4–5; Table 2, p. 12; JSS PDF re-opened 2026-08-20T19:50Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar discrete increment of the lasting level-change `CINT`. Section 7.2 sets `CINT` to `TDPREDEFFECT * −DRIFT` (`κ = −a m x`). Equation 3 maps that intercept through `A^{-1}[e^{A Δt} − I] κ`. With `κ = −a m x` the scalar increment is `(e^{a Δt} − 1)/a · (−a m x) = (1 − e^{a Δt}) m x`. Form the level-change `CINT` first, then the discrete intercept map. Underflow of `e^{a Δt}` to `+0` keeps the equilibrium offset `m x`. `(1 − e^{a Δt}) m x` is not the contemporaneous jump `m x`. `(1 − e^{a Δt}) m x` is not `κ`. `(1 − e^{a Δt}) m x` is not `A^{-1}[e^{A Δt} − I] B z`. Stable `a < 0` is required. A zero effect or zero predictor is exactly zero. Still not a Kalman filter, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) and Mislevy (1991, *Psychometrika, 56*, 177–196) remain unread (Unpaywall 2026-08-20T19:45Z: `is_oa: false`; Springer `content/pdf` is HTML 200). +- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, §7.2, pp. 20–21; Eq. 1–3, pp. 4–5; Table 2, p. 12; JSS PDF re-opened 2026-08-20T19:45Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar lasting level-change `CINT`. Section 7.2 contrasts a sudden Dirac that dissipates back to the process mean with a lasting level change. To generate that lasting change, `CINT` is set to `TDPREDEFFECT * −DRIFT`. The scalar setting is `κ = −a m x`. Form `m x` first, then multiply by `−a`. Stable `a < 0` is required so `−κ / a = m x` is an equilibrium offset. `a ≥ 0` cannot hold a new process mean. `−a m x` is not the contemporaneous jump `m x`. `−a m x` is not a free `CINT`. `−a m x` is not `A^{-1}[e^{A Δt} − I] B z`. The extra near-zero-drift latent process also named in §7.2 is a different specification and is not this `CINT` setting. A zero effect or zero predictor is exactly zero. Still not a Kalman filter, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) and Mislevy (1991, *Psychometrika, 56*, 177–196) remain unread (Unpaywall 2026-08-20T19:45Z: `is_oa: false`; Springer `content/pdf` is HTML 200). +- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, Eq. 5, p. 5; Eq. 3 first summand, p. 5; Table 3, p. 13; JSS PDF re-opened 2026-08-20T19:07Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar observed-indicator mean of a first-occasion time-dependent predictor. Equation 5 writes `y_i(t) = Γ + Λ η_i(t) + ζ_i(t)` with `ζ ~ N(0, Θ)` and `Γ ~ N(τ, Ψ)`. Table 3 names `T0TDPREDEFFECT` the effect of time-dependent predictors on latents at `T0`. Equation 3's first summand carries that shift as `e^{A Δt} t0_m x0`. The scalar composition is `E(y_t) = τ + λ(μ_t + e^{a Δt} t0_m x0)`. Form the evolved-plus-carry latent mean first, then `τ + λ` of that mean. The evolved observed mean `τ + λ μ_t` is not this composition. The process-increment map `τ + λ(μ_t + A^{-1}[e^{A Δt} − I] B z)` is not this composition. The contemporaneous map `τ + λ(μ_t + m x)` is not this composition. The impulse-carry map `τ + λ(μ_t + e^{a(t−u)} m x)` is not this composition when `u ≠ t0`. The first-occasion TI map `τ + λ(μ_t + e^{a Δt} t0_b z)` is not this composition. `MANIFESTMEANS` is not `E(y_t)`. The evolved-plus-carry latent mean is not `E(y_t)`. `T0TDPREDEFFECT` is the coefficient, not that observed mean. Same numbers as `T0TIPREDEFFECT` yield the same product; Table 3 names a different matrix. A zero loading is exactly `τ`. Still not a Kalman filter, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) and Mislevy (1991, *Psychometrika, 56*, 177–196) remain unread (Unpaywall 2026-08-20T19:09Z: `is_oa: false`). +- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, Table 3, p. 13; Eq. 3 first summand, p. 5; JSS PDF re-opened 2026-08-20T19:10Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar first-occasion time-dependent predictor shift and its carry. Table 3 names `T0TDPREDEFFECT` the effect of time-dependent predictors on latents at `T0`. Table 2 / Table 3 name `TDPREDEFFECT` `M`, which enters Equation 3 as the printed fourth-summand Dirac `M x` at `u = t`. Those are not the same matrix. The scalar first-occasion shift is `t0_m x0`. Equation 3's first summand carries that shift as `e^{A Δt} t0_m x0`. Form `t0_m x0` first, then `e^{a Δt} t0_m x0`. Form `μ_t` first, then add that carry. A zero drift is `t0_m x0` with no dissipation. Binary64 underflow of `e^{a Δt}` to `+0` is a vanishing carry of the first-occasion shift and is kept. `t0_m x0` is not `M x`, not `e^{A(t−u)} M x` for `t0 < u < t`, not `t0_b z`, not `A^{-1}[e^{A Δt} − I] B z`, and not `κ`. `e^{A Δt} t0_m x0` is not `t0_m x0`. `T0TDPREDEFFECT` is the coefficient, not `t0_m x0`. An impulse at `u ≤ t0` that used `M` is already in `η(t0)` as `TDPREDEFFECT`, not as `T0TDPREDEFFECT`. Still not a Kalman filter, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) and Mislevy (1991, *Psychometrika, 56*, 177–196) remain unread (Unpaywall 2026-08-20T19:09Z: `is_oa: false`). +- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, Eq. 5, p. 5; Eq. 3 first summand, p. 5; Table 3, p. 13; JSS PDF re-opened 2026-08-20T15:28Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar observed-indicator mean of a first-occasion time-independent predictor. Equation 5 writes `y_i(t) = Γ + Λ η_i(t) + ζ_i(t)` with `ζ ~ N(0, Θ)` and `Γ ~ N(τ, Ψ)`. Table 3 names `T0TIPREDEFFECT` the effect of time-independent predictors on latents at `T0`. Equation 3's first summand carries that shift as `e^{A Δt} t0_b z`. The scalar composition is `E(y_t) = τ + λ(μ_t + e^{a Δt} t0_b z)`. Form the evolved-plus-carry latent mean first, then `τ + λ` of that mean. The evolved observed mean `τ + λ μ_t` is not this composition. The process-increment map `τ + λ(μ_t + A^{-1}[e^{A Δt} − I] B z)` is not this composition. The contemporaneous map `τ + λ(μ_t + m x)` is not this composition. The impulse-carry map `τ + λ(μ_t + e^{a(t−u)} m x)` is not this composition when `u ≠ t0`. `MANIFESTMEANS` is not `E(y_t)`. The evolved-plus-carry latent mean is not `E(y_t)`. `T0TIPREDEFFECT` is the coefficient, not that observed mean. A zero loading is exactly `τ`. Still not a Kalman filter, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) and Mislevy (1991, *Psychometrika, 56*, 177–196) remain unread (Unpaywall 2026-08-20T15:14Z: `is_oa: false`; Springer `content/pdf` is HTML 200). +- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, Table 3, p. 13; Eq. 3 first summand, p. 5; JSS PDF opened 2026-08-20T15:14Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar first-occasion time-independent predictor shift and its carry. Table 3 names `T0TIPREDEFFECT` the effect of time-independent predictors on latents at `T0`. Table 2 / Table 3 name `TIPREDEFFECT` `B`, which enters Equation 3 as `A^{-1}[e^{A(t−t0)} − I] B z`. Those are not the same matrix. The scalar first-occasion shift is `t0_b z`. Equation 3's first summand carries that shift as `e^{A Δt} t0_b z`. Form `t0_b z` first, then `e^{a Δt} t0_b z`. Form `μ_t` first, then add that carry. A zero drift is `t0_b z` with no dissipation. Binary64 underflow of `e^{a Δt}` to `+0` is a vanishing carry of the first-occasion shift and is kept. `t0_b z` is not `A^{-1}[e^{A Δt} − I] B z`, not `κ`, and not `M x`. `e^{A Δt} t0_b z` is not `t0_b z`. `T0TIPREDEFFECT` is the coefficient, not `t0_b z`. Still not a Kalman filter, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) and Mislevy (1991, *Psychometrika, 56*, 177–196) remain unread (Unpaywall 2026-08-20T15:14Z: `is_oa: false`; Springer `content/pdf` is HTML 200). +- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, Eq. 5, p. 5; Eq. 3, p. 5; Table 2, p. 12; JSS PDF re-opened 2026-08-20T12:12Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar observed-indicator mean of a time-independent predictor. Equation 5 writes `y_i(t) = Γ + Λ η_i(t) + ζ_i(t)` with `ζ ~ N(0, Θ)` and `Γ ~ N(τ, Ψ)`. Equation 3 prints the `TIPREDEFFECT` increment as the addend `A^{-1}[e^{A(t−t0)} − I] B z_i` after the `T0MEANS` carry and the `CINT` increment. Table 2 names `B` `TIPREDEFFECT`. The scalar composition is `E(y_t) = τ + λ(μ_t + A^{-1}[e^{A Δt} − I] B z)`. Form the evolved-plus-increment latent mean first, then `τ + λ` of that mean. The evolved observed mean `τ + λ μ_t` is not this composition. The contemporaneous map `τ + λ(μ_t + m x)` is not this composition. The carry map `τ + λ(μ_t + e^{a(t−u)} m x)` is not this composition when `u ≠ t`. `MANIFESTMEANS` is not `E(y_t)`. The evolved-plus-increment latent mean is not `E(y_t)`. `TIPREDEFFECT` is `B`, not that observed mean. A zero loading is exactly `τ`. Still not a Kalman filter, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993), Vandenberg and Lance (2000), and Mislevy (1991, *Psychometrika, 56*, 177–196) remain unread (Unpaywall 2026-08-20T05:12Z: `is_oa: false`). +- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, Eq. 5, p. 5; Eq. 1–3, pp. 4–5; Table 2, p. 12; §7.2, pp. 20–21; JSS PDF re-opened 2026-08-20T09:01Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar observed-indicator mean of a contemporaneous time-dependent impulse. Equation 5 writes `y_i(t) = Γ + Λ η_i(t) + ζ_i(t)` with `ζ ~ N(0, Θ)` and `Γ ~ N(τ, Ψ)`. The latent process at `t` after a contemporaneous Dirac (`u = t`) is `μ_t + m x`. The scalar composition is `E(y_t) = τ + λ(μ_t + m x)`. Form the evolved-plus-impulse latent mean first, then `τ + λ` of that mean. The evolved observed mean `τ + λ μ_t` is not this composition. The carry map `τ + λ(μ_t + e^{a(t−u)} m x)` is not this composition when `u ≠ t`. `MANIFESTMEANS` is not `E(y_t)`. The evolved-plus-impulse latent mean is not `E(y_t)`. A zero loading is exactly `τ`. The §7.2 level-change form is a different specification and is not this map. Still not a Kalman filter, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993), Vandenberg and Lance (2000), and Mislevy (1991, *Psychometrika, 56*, 177–196) remain unread (Unpaywall 2026-08-20T05:12Z: `is_oa: false`). +- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, Eq. 5, p. 5; Eq. 1–2, pp. 4–5; Eq. 3 exponential map; Table 2, p. 12; §7.2, pp. 20–21; JSS PDF re-opened 2026-08-20T05:12Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar observed-indicator mean of a within-interval time-dependent impulse carry. Equation 5 writes `y_i(t) = Γ + Λ η_i(t) + ζ_i(t)` with `ζ ~ N(0, Θ)` and `Γ ~ N(τ, Ψ)`. The latent process at `t` after a Dirac that occurred strictly inside `(t0, t)` is `μ_t + e^{a(t−u)} m x`. The scalar composition is `E(y_t) = τ + λ(μ_t + e^{a(t−u)} m x)`. Form the carried latent mean first, then `τ + λ` of that mean. The evolved observed mean `τ + λ μ_t` is not this composition. The contemporaneous map `τ + λ(μ_t + m x)` is not this composition when `u ≠ t`. `MANIFESTMEANS` is not `E(y_t)`. The carried latent mean is not `E(y_t)`. A zero loading is exactly `τ`. The §7.2 level-change form is a different specification and is not this map. Still not a Kalman filter, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993), Vandenberg and Lance (2000), and Mislevy (1991, *Psychometrika, 56*, 177–196) remain unread (Unpaywall 2026-08-20T05:12Z: `is_oa: false`). +- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, Eq. 1–2, pp. 4–5; Eq. 3 exponential map; Table 2, p. 12; §7.2, pp. 20–21; JSS PDF re-opened 2026-08-20T10:33Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar within-interval time-dependent predictor impulse carry. Equation 1 writes `dη = (A η + ξ + B z + M χ(t)) dt + G dW`. Equation 2 writes `χ_i(t) = Σ x_{i,u} δ(t − u)`. The Green-function integral of that Dirac on `(t0, t)` is `e^{A(t−u)} M x`. The printed Eq. 3 fourth summand is the contemporaneous jump `M x` at `u = t`. This map is the strictly within-interval case `t0 < u < t`. Form `m x` first, then `e^{a(t−u)} m x`. A zero drift is `m x` with no dissipation. Underflow of `e^{a(t−u)}` to `+0` is vanishing dissipation back to the process mean and is kept. Form `μ_t` first, then add the carry. `e^{A(t−u)} M x` is not the contemporaneous Dirac, not `CINT`, not `A^{-1}[e^{A Δt} − I] B z` (`TIPREDEFFECT`), and not Voelkle et al. (2012, Eq. 14) `a_{yx} Δt`. An impulse at `u = t` is the contemporaneous map. An impulse at `u ≤ t0` is already in `η(t0)`. The §7.2 level-change form is a different specification and is not this map. Still not a Kalman filter, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993), Vandenberg and Lance (2000), and Mislevy (1991, *Psychometrika, 56*, 177–196) remain unread (Unpaywall 2026-08-20T10:33Z: `is_oa: false`). +- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, Eq. 1–3, pp. 4–5; Table 2, p. 12; JSS PDF re-opened 2026-08-20T10:13Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar time-independent predictor increment. Equation 1 writes `dη = (A η + b + A_{ηξ} ξ + B z) dt + G dW + M dχ`. Equation 3's second summand is `A^{-1}[e^{A Δt} − I](b + A_{ηξ} ξ + B z)`. Table 2 names `B` `TIPREDEFFECT`. Form `B z` first, then the discrete intercept map. A zero drift is `B z Δt`. Form `μ_t` first, then add that increment. `TIPREDEFFECT` is `B`, not the discrete increment. `A^{-1}[e^{A Δt} − I] B z` is not `CINT`, not `M x` (`TDPREDEFFECT`), and not Voelkle et al. (2012, Eq. 14) `a_{yx} Δt`. Still not a Kalman filter, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993), Vandenberg and Lance (2000), and Mislevy (1991, *Psychometrika, 56*, 177–196) remain unread (Unpaywall 2026-08-20T10:13Z: `is_oa: false`). +- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, Eq. 1–3, pp. 4–5; Table 2, p. 12; §7.2, pp. 20–21; JSS PDF re-opened 2026-08-20T07:10Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar contemporaneous time-dependent predictor impulse. Equation 2 writes `χ_i(t) = Σ x_{i,u} δ(t − u)`. Equation 3's fourth summand is `M Σ x_{i,u} δ(t − u)`. Table 2 names `M` `TDPREDEFFECT`. Section 7.2 calls this a sudden impulse that dissipates back to the process mean and reports `TDPREDEFFECT` as the initial impact. The scalar jump is `m x`. Form `μ_t` first, then add `m x`. `TDPREDEFFECT` is not `CINT`. `M x` is not `A^{-1}[e^{A Δt} − I] B z` (`TIPREDEFFECT`). `M x` is not Voelkle et al. (2012, Eq. 14) `a_{yx} Δt`. The §7.2 level-change form is a different specification and is not this map. Still not a Kalman filter, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993), Vandenberg and Lance (2000), and Mislevy (1991, *Psychometrika, 56*, 177–196) remain unread (Unpaywall 2026-08-20T07:10Z: `is_oa: false`). +- `psychometric_core` caps two-observation two-group OLS residual invariance at strong/scalar. `ordinary_least_squares_fit` returns residual variance `0` when `n ≤ 2`; that identity is not an estimated residual and is not strict. Putnick and Bornstein (2016, PMC author manuscript PMC5145197 opened 2026-08-19T22:15Z from https://pmc.ncbi.nlm.nih.gov/articles/PMC5145197/) require scalar invariance before latent-mean comparison; residual invariance is not a prerequisite because residuals are not part of the latent factor. Matching loading and intercept with `n = 2` therefore stay strong/scalar and still license `(ȳ_c − ȳ_r)/λ`. This is still two-group OLS, not MGCFA. Meredith (1993) remains unread (OpenAlex/Semantic Scholar 2026-08-19T22:15Z: closed; Springer `content/pdf` is HTML 200). Vandenberg and Lance (2000) remains unread (cited by Putnick for the residual-not-required claim). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread. +- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, Eq. 3, p. 5; Eq. 5, p. 5; Table 2, p. 12; JSS PDF re-opened 2026-08-19T22:10Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar evolved observed-indicator mean. Equation 3 writes `η_i(t) = exp(A Δt) η_i(t0) + A^{-1}[exp(A Δt) − I] ξ_i + …` with `ξ_i ~ N(κ, φ_ξ)` (p. 4) and a stochastic integral of mean zero. Equation 5 writes `y_i(t) = Γ_i + Λ η_i(t) + ζ_i(t)` with `Γ ~ N(τ, Ψ)` and `ζ ~ N(0, Θ)`. The scalar composition is `E(y_t) = τ + λ μ_t` with `μ_t` the Eq. 3 expected-value map. Form `μ_t` first, then `τ + λ μ_t`. The first-occasion map `τ + λ μ_0` is not `E(y_t)`. `MANIFESTMEANS` is not `E(y_t)`. `T0MEANS` is not `E(y_t)`. `μ_t` is not `E(y_t)`. A zero-CINT overflow of `exp(a Δt)` fails the carried `T0MEANS` term closed (`a = 710`, `Δt = 1`). Still not a Kalman filter, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) remains unread (OpenAlex 2026-08-19T22:10Z: closed; Springer `content/pdf` is HTML 200). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (OpenAlex/Semantic Scholar 2026-08-19T22:10Z: closed). Putnick and Bornstein (2016) PMC PDF was HTML/500 on this cycle. Oud and Jansen (2000) remains unread. ZORA Anubis-blocked. Asparouhov and Muthén (2009) statmodel PDF re-opened 2026-08-19T22:10Z; it cites Meredith (1993) and discusses multiple-group intercept/mean structures but does not license this map. +- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, Eq. 3, p. 4; Table 2, p. 12; JSS PDF re-opened 2026-08-19T18:10Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar expected-value latent mean. Equation 3 writes `η(t) = exp(A Δt) η(t0) + ∫ exp(A(t−s)) (b + …) ds` plus a stochastic integral of mean zero. Table 2 names the first-occasion latent mean `T0MEANS` and `κ` `CINT`. The scalar map is `μ_t = exp(a Δt) μ_0 + (exp(a Δt) − 1)/a κ`. Form the CINT increment first, then add the carried `T0MEANS` term. A zero drift is the Eq. 3 integral `κ Δt` (`A = 0` has no inverse). As `Δt → ∞` with stable `a < 0`, `μ_t → −κ / a`. Binary64 underflow of `exp(a Δt)` to `+0` drops the carried `T0MEANS` and keeps that equilibrium increment. `T0MEANS` is not `μ_t`. `CINT` is not the discrete increment. `CINT` is not `T0MEANS`. Still not a Kalman filter, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) and Mislevy (1991, *Psychometrika, 56*, 177–196) remain unread (OpenAlex 2026-08-19T18:10Z: closed; Springer `content/pdf` is HTML 200). Oud and Jansen (2000) remains unread. ZORA Anubis-blocked. +- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, Eq. 5, p. 5; Table 2, p. 12; JSS PDF re-opened 2026-08-19T14:08Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar observed-indicator mean. Equation 5 writes `y_i(t) = Γ + Λ η_i(t) + ζ_i(t)` with `ζ ~ N(0, Θ)` and `Γ ~ N(τ, Ψ)`. Table 2 names `τ` `MANIFESTMEANS`, `κ` `CINT`, and the first-occasion latent mean `T0MEANS`. The scalar map is `E(y) = τ + λ μ`. Form `λ μ` then add `τ`. Do not treat `MANIFESTMEANS` as `E(y)`. `E(η)` is not `E(y)`. `CINT` is not `MANIFESTMEANS`. `T0MEANS` is not `E(y)`. Forming `λ²` is the variance path, not this mean. Still not a Kalman filter, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) and Mislevy (1991, *Psychometrika, 56*, 177–196) remain unread (Unpaywall 2026-08-19T14:08Z: closed). Oud and Jansen (2000) remains unread. ZORA Anubis-blocked. +- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, Eq. 5, p. 5; Eq. 3–4, pp. 4–5; Table 2, p. 12; JSS PDF re-opened 2026-08-19T04:18Z) scalar lagged observed-indicator covariance. Independent measurement error does not enter `cov(y_t, y_{t-1})`. The scalar map is `λ² cov(η_t, η_{t-1}) + ψ`. Form `(λ c) λ` then add `ψ`. Do not form `λ²` first (`λ = 1e308`, `c = 1e-308` → `1e308`). `MANIFESTVAR` is not lagged observed covariance. Lagged `Var(η)` path is not `cov(y)`. Still not a Kalman filter, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) and Mislevy (1991, *Psychometrika, 56*, 177–196) remain unread (Unpaywall 2026-08-19T04:25Z: closed). +- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, Eq. 5, p. 5; Table 2, p. 12; JSS PDF re-opened 2026-08-19T04:18Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar observed-indicator variance with `MANIFESTTRAITVAR`. Equation 5 writes `y_i(t) = τ_i + Λ η_i(t) + ε_i(t)` with `ε ~ N(0, Θ)` and `τ_i ~ N(μ_τ, Ψ_τ)`. Equation 1 (p. 4) is the latent SDE, not the measurement model. Table 2 names `Θ` `MANIFESTVAR` and `Ψ_τ` `MANIFESTTRAITVAR`; p. 16 restates those names. The scalar map is `Var(y) = λ² Var(η) + θ` when `Ψ_τ = 0` and `λ² Var(η) + θ + ψ` otherwise. Form `(λ p) λ` then add `θ`, then add `ψ`. `MANIFESTVAR` is not `Var(y)`. `MANIFESTTRAITVAR` is not `MANIFESTVAR`. `TRAITVAR` is latent additional variance and is scaled by `λ²`; `MANIFESTTRAITVAR` is not. Still not a Kalman filter, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) and Mislevy (1991, *Psychometrika, 56*, 177–196) remain unread (Unpaywall/OpenAlex 2026-08-19T04:18Z: closed). Oud and Jansen (2000) remains unread. ZORA Anubis-blocked. +- `psychometric_core` evaluates the Driver, Oud, and Voelkle (2017, Eq. 4, p. 5; JSS PDF re-opened 2026-08-19T04:10Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) stationary within-subject variance as `q / -(2 a)` when the scalar Kronecker sum `2 a` is finite. The paper limit is `-q / (2 a)` (`A# = A ⊗ I + I ⊗ A`; p. 16 `asymDIFFUSION`). Forming `q / a` first overflows at `q = MAX`, `a = -0.75` while `MAX / 1.5` is finite (CodeRabbit finding on `75ecdd3`). When `2 a` overflows (`a = -1e308`), form `(q / a) * -0.5`. Do not form `0.5 q` first (`q = from_bits(1)` underflows). Still not a Kalman filter, not DSEM, not a matrix `expm`, and not ctsem estimation. Meredith (1993) and Mislevy (1991, *Psychometrika, 56*, 177–196) remain unread (Unpaywall/OpenAlex 2026-08-19T04:10Z: closed). Oud and Jansen (2000) remains unread. ZORA Anubis-blocked. +- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, Eq. 1, p. 4; p. 16 `MANIFESTVAR`; JSS PDF re-opened 2026-08-19T00:14Z) scalar observed-indicator variance. Equation 1 writes `y_i(t) = Λ η_i(t) + τ + ε_i(t)` with `ε ~ N(0, Θ)`. The scalar map is `Var(y) = λ² Var(η) + θ`. Form `(λ p) λ` then add `θ`. Do not form `λ²` first (`λ = 1e308`, `p = 1e-308` → `1e308`). `MANIFESTVAR` is not `Var(y)`. `Var(η)` is not `Var(y)`. Still not a Kalman filter, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) and Mislevy (1991, *Psychometrika, 56*, 177–196) remain unread (Unpaywall/OpenAlex 2026-08-19T00:14Z: closed). Oud and Jansen (2000) remains unread. ZORA Anubis-blocked. +- `psychometric_core` evaluates the Driver, Oud, and Voelkle (2017, Eq. 4, p. 5; JSS PDF re-opened 2026-08-19T00:14Z) stationary within-subject variance as `(q / a) * -0.5`. The paper limit is `-q / (2 a)`. Forming `2 a` first overflows at `a = -1e308`. Forming `0.5 q` first underflows at `q = from_bits(1)`, `a = -from_bits(1)` and returns `+0` (CodeRabbit finding on `556e23d`); the representable Lyapunov solution is `0.5`. Still not a Kalman filter, not DSEM, not a matrix `expm`, and not ctsem estimation. Meredith (1993) and Mislevy (1991, *Psychometrika, 56*, 177–196) remain unread (Unpaywall/OpenAlex 2026-08-19T00:14Z: closed; Springer `content/pdf` is HTML 200). Oud and Jansen (2000) remains unread. ZORA Anubis-blocked. +- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, §4.3, p. 9; JSS PDF re-opened 2026-08-18T21:07Z) scalar trait-plus-state latent variance and lagged covariance. A stable trait process has `DRIFT` and `DIFFUSION` fixed to zero, so `Var = trait + state` and `cov(t, t-1) = trait + exp(a Δt) p`. The ctsem `TRAITVAR` rewrite that adds the trait to `DIFFUSION` does not license treating trait variance as process noise. Trait variance is not `asymDIFFUSION`. Evolving the summed variance as if it were all state is not this map. Still not RI-CLPM, not a Kalman filter, not DSEM, and not ctsem estimation. Meredith (1993) and Mislevy (1991, *Psychometrika, 56*, 177–196) remain unread (Unpaywall/OpenAlex 2026-08-18T21:07Z: closed). Oud and Jansen (2000) remains unread. ZORA accepted manuscript re-opened via bitstream `424f9082-0eeb-4a67-b687-9845a4ed892f`. +- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, Eq. 4, p. 5; §4.3 pp. 9–10; p. 16 `asymDIFFUSION`; JSS PDF re-opened 2026-08-18T18:03Z) scalar stationary within-subject variance. Eq. 4 writes `Q_Δt = irow(A#^{-1}[e^{A# Δt} − I] row(Q))` with `A# = A ⊗ I + I ⊗ A`. The scalar Kronecker sum is `2 a`. As `Δt → ∞` with stable `a < 0`, that limit is `-q / (2 a)`. Form `-0.5 q / a`; do not form `2 a` first (`a = -1e308`, `q = 1e308` → `0.5`). Starting from that variance, `Var(η_t)` is invariant across finite event intervals. A zero diffusion is exactly zero. `a ≥ 0` has no finite stationary variance. Finite-interval `Q_Δt` is not `asymDIFFUSION`. Still not a Kalman filter, not DSEM, not a matrix `expm`, and not ctsem estimation. Meredith (1993) and Mislevy (1991, *Psychometrika, 56*, 177–196) remain unread (Unpaywall/OpenAlex 2026-08-18T18:03Z: closed). Oud and Jansen (2000) remains unread. ZORA Anubis-blocked. +- `psychometric_core` refuses a zero-diffusion Driver, Oud, and Voelkle (2017, Eq. 3–4, pp. 4–5; JSS PDF re-opened 2026-08-18T14:04Z) latent variance when `2 (a Δt)` overflows to `+∞`. Zero diffusion is exactly `Q_Δt = 0` (Eq. 3 integral of a zero `G`). That skip does not license `Var(η_t) = exp(2 a Δt) p + 0` when the carried term is non-finite (`p = 2`, `q = 0`, `a = 1e308`, `Δt = 2`). Nightly uncovered production line `event_time.rs:596` on predecessor `321568a` is this arm. Still not a Kalman filter, not DSEM, and not a matrix `expm`. Meredith (1993) and Mislevy (1991, *Psychometrika, 56*, 177–196) remain unread (Unpaywall/OpenAlex/Semantic Scholar 2026-08-18T14:04Z: closed; Springer `content/pdf` is HTML 200). Oud and Jansen (2000) remains unread. +- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, Eq. 3–4, pp. 4–5; JSS PDF re-opened 2026-08-18T11:20Z) lagged latent covariance `cov(η_ti, η_{t-1,i}) = A_Δt cov(η_{t-1,i})` and the law-of-total-variance map `Var(η_ti) = A_Δt Var(η_{t-1,i}) A_Δt⊤ + Q_Δt`. Eq. 3 writes `η(t) = exp(A Δt) η(t0) + … +` the stochastic integral; Eq. 4 writes that the integral exhibits covariance `Q_Δt`. `Q_Δt` remains `cov(η_ti | η_{t-1,i})` for the homogeneous process (`ξ`, `z` given) and is refused as the unconditional variance. The JSS article has no numbered §2.2 (2.1 is Continuous time and SEM; §3 follows). Scalar `exp(a Δt) p` underflow to `+0` is a vanishing covariance and is kept. Finite-`a Δt` exponential overflow rewrites as `exp(ln p + a Δt)`. A finite `exp(a Δt)` whose product with `p` overflows fails closed. Still not a Kalman filter, not DSEM, and not a matrix `expm`. Meredith (1993) and Mislevy (1991, *Psychometrika, 56*, 177–196) remain unread (Unpaywall/OpenAlex/Semantic Scholar 2026-08-18T11:05Z: closed). Oud and Jansen (2000) remains unread (Radboud 403). ZORA Anubis-blocked. +- `psychometric_core` closes nightly branch coverage on `event_time.rs` (160/164 on `6c13dfb`). The four remaining False sides were `assert!(a && b)` in the unit-test module (Eq. 12 equilibrium-increment and expm1-overflow oracles); they cannot take False on a passing test. Split into independent asserts. Lib-instantiation fail-closed arms for Voelkle et al. (2012, Eq. 14) and Driver, Oud, and Voelkle (2017, Eq. 3) stay in the integration contract. Driver JSS PDF already opened 2026-08-18T07:06Z, p. 4 (`L` remains identity; this is not a Kalman filter). Meredith (1993) and Mislevy (1991, *Psychometrika, 56*, 177–196) remain unread (Unpaywall/OpenAlex 2026-08-18T07:17Z: closed; Springer `content/pdf` is HTML 200, not a PDF). ERIC ED334221 is Singer and Willett (1991). ZORA Anubis-blocked. Oud and Jansen (2000) remains unread. +- `psychometric_core` refuses an overflowing Driver Eq. 3 rewrite scale `0.5 q / a` (JSS PDF re-opened 2026-08-18T03:07Z, p. 4). When `expm1(z)` overflows at a finite `z = 2(a Δt)` and `0.5 q / a` is non-finite (`q = 1e308`, `a = 0.1`, `Δt = 4000` → `z = 800`), `Q_Δt = q(e^{2aΔt}−1)/(2a)` is not finite and fails closed. Algebraically identical to the licensed integral. Still not a Kalman filter, not DSEM, and not a matrix `expm`. Meredith (1993) and Mislevy (1991, *Psychometrika, 56*, 177–196) remain unread (Unpaywall/OpenAlex/Semantic Scholar/CORE 2026-08-18T03:07Z: closed). ERIC ED334221 is Singer and Willett (1991), not Mislevy (1991). ERIC ED333032 remains Mislevy, Sheehan, and Wingersky (1990). ZORA Anubis-blocked. Oud and Jansen (2000) remains unread. +- `psychometric_core` evaluates Driver, Oud, and Voelkle (2017, Eq. 3; JSS PDF re-opened 2026-08-17T21:03Z, p. 4) as \(0.5 q(\operatorname{expm1}(z)/a)\) with \(z=2(a\Delta t)\). Forming \(2a\) first overflows when \(|a|\) is at the binary64 extreme even if \(a\Delta t\) and \(Q_{\Delta t}\) are finite (`a=1e308`, `Δt=1e-308` → \(0.5(\mathrm{e}^{2}-1)/10^{308}\); `a=-1e308`, `q=1e308`, `Δt=2` → \(0.5\)). Algebraically identical to \(q(\mathrm{e}^{2a\Delta t}-1)/(2a)\). `expm1(−∞)` keeps \(-0.5 q/a\). \(z\to+\infty\) still fails closed. Still not a Kalman filter, not DSEM, and not a matrix `expm`. Meredith (1993), Mislevy (1991), and Oud and Jansen (2000) remain unread (Unpaywall/OpenAlex/Semantic Scholar 2026-08-17T21:03Z: closed; ZORA Anubis-blocked). +- `psychometric_core` recovers Voelkle et al. (2012, Eq. 14; ZORA accepted manuscript re-opened 2026-08-17T14:20Z, Introducing Intercepts, manuscript p. 21): the discrete effect of a time-varying predictor whose sampling interval equals its constancy interval is \(b^{*}_{y.x}(\Delta t)=a_{yx}\Delta t\). It does not depend on the predictor auto-effect. That product is not Eq. 12. Unmatched sampling and constancy intervals fail closed (Oud & Jansen, 2000, unread). An overflowing Eq. 12 rewrite scale \(a_{yx}/a_{xx}\) also fails closed. Still not DSEM. +- `psychometric_core` recovers Voelkle et al. (2012, Eq. 12) when `expm1(z)` overflows to `+∞` at a finite `z`. The rewrite is `sign(a_{yx}/a_{xx})\exp(\ln|a_{yx}|+z-\ln|a_{xx}|)-a_{yx}/a_{xx}` (algebraically identical to `(a_{yx}/a_{xx})(\exp(a_{xx}\Delta t)-1)`). A zero continuous effect is exactly zero even when `expm1` overflows (`0\cdot+\infty` is `NaN`). `z\to+\infty` remains fail-closed. ZORA accepted manuscript re-opened 2026-08-17T13:26Z, Introducing Intercepts, manuscript p. 20; Driver, Oud, and Voelkle (2017, Eq. 3) restated `A^{-1}[e^{A\Delta t}-I]\xi`. Still not DSEM. +- `psychometric_core` evaluates Voelkle et al. (2012, Eq. 12) as \(a_{yx}(\operatorname{expm1}(z)/a_{xx})\) with \(z=a_{xx}\Delta t\). That order is algebraically identical to \((a_{yx}/a_{xx})(\exp(a_{xx}\Delta t)-1)\). Dividing the increment by the finite auto-effect keeps the equilibrium increment \(-a_{yx}/a_{xx}\) when \(z\) overflows to \(-\infty\) (ZORA accepted manuscript, Introducing Intercepts: the exponential vanishes as \(\Delta t\) grows; CodeRabbit finding on `7ffb65b`). The prior \(a_{yx}\Delta t\) overflow case remains finite. Binary64 underflow of \(z\) to `+0` recovers the Eq. 12 limit \(a_{yx}\Delta t\); the first-order product is still not the general discrete effect. Still not DSEM. +- `psychometric_core` evaluates Voelkle et al. (2012, Eq. 12) as \(a_{yx}(\operatorname{expm1}(z)/z\cdot\Delta t)\) with \(z=a_{xx}\Delta t\). That order is algebraically identical to \((a_{yx}/a_{xx})(\exp(a_{xx}\Delta t)-1)\). Multiplying the unitless scale by \(\Delta t\) before \(a_{yx}\) keeps a finite Eq. 12 result when \(a_{yx}\Delta t\) overflows (ZORA accepted manuscript re-opened 2026-08-17T13:13Z, p. 16). Binary64 underflow of \(z\) to `+0` recovers the Eq. 12 limit \(a_{yx}\Delta t\); the first-order product is still not the general discrete effect. Driver, Oud, and Voelkle (2017, p. 4) restated the discrete intercept as a function of \(A\) and \(\Delta t\). Still not DSEM. +- `psychometric_core` evaluates Voelkle et al. (2012, Eq. 12) as \(a_{yx}\Delta t\,(\operatorname{expm1}(z)/z)\) with \(z=a_{xx}\Delta t\). That order is algebraically identical to \((a_{yx}/a_{xx})(\exp(a_{xx}\Delta t)-1)\). Binary64 underflow of \(z\) to `+0` recovers the Eq. 12 limit \(a_{yx}\Delta t\); the first-order product is still not the general discrete effect. Driver, Oud, and Voelkle (2017, p. 4) restated the discrete intercept as a function of \(A\) and \(\Delta t\) (PDF re-opened 2026-08-17T12:04Z). Still not DSEM. +- `psychometric_core` exact scalar discrete effect of a constant event-time predictor (Voelkle et al., 2012, Eq. 12): \(b^{*}_{y.x}(\Delta t)=(a_{yx}/a_{xx})(\exp(a_{xx}\Delta t)-1)\) for \(a_{xx}\neq 0\). The first-order product \(a_{yx}\Delta t\) is not that discrete effect. Still not DSEM. +- `psychometric_core` exact scalar forward map `φ(Δt) = exp(a Δt)` and interval remapping: a discrete lag at one event interval maps onto another through the Voelkle et al. (2012, Eq. 7) log-rate. Pooling discrete lags from unequal intervals fails closed. Still not a matrix `expm` and not DSEM. +- Fail-closed CWC-lag coverage in `psychometric_core`: singleton clusters are skipped, all-singleton series and overflowing CWC residuals fail closed, later-only residual overflow is checked with bitwise `is_finite`, the scalar Newton step refuses a non-finite exponential, score, start-skip, or deriv-INF, and Pearson empty/mismatch/left-INF paths are recovered. Dead post-OLS `pred_ss` and midpoint `require_finite` guards were removed because those values are already finite after OLS. +- `psychometric_core` multilevel/event-time recovery on the stacked psychometric PR: cluster-mean CWC within/between OLS, Kish ESS weighted slopes, event-time-only discrete lag-1 and exact scalar local log-rate, CWC-then-event-time residual lag, Rubin `T_m = Ū_m + (1+1/m) B_m` on draw-level OLS loadings, and two-group OLS strong/strict-gated latent-mean difference. Metric/weak is not a mean license. Not DSEM, not RI-CLPM, not MGCFA, not Mislevy PVs (ADR 0005; no new migration). +- `psychometric_core` posterior-aware structural input gates: construct classification, refusal of raw-proportion Pearson/OLS, explicit ALR-versus-ILR geometry boundaries, CPU `f64` OLS recovery, posterior-draw loading point-estimate averaging without Rubin uncertainty claims, invariance-gated latent-mean comparison, and causal-heuristic refusal (ADR 0005 first production slice; no new migration). +### Added + +- `model_selection` fitted candidate-`K` scoring: each candidate is fitted with the CPU `f64` TRSL-TM reference, scored from the actual in-sample mixture log-likelihood and Schwarz's (1978) `ℓ − (p ln N)/2` penalty, then passed through the existing Pareto gate. A typed non-convergence, non-finite, or invalid-input failure is a failed candidate, not a fabricated diagnostic. LLM-vote-only `K` remains non-authoritative. TF-IDF, BM25, stopword-deletion, and LLM labels are refused as inferential coordinates. Known two-topic counts select `K=2` over `K=3` with selected-`K` RMSE `0` across seed replications. This is not GPU execution, full Bayesian sampling, or topic birth/split/merge (ADR 0012; issue #167 remaining slice). +- `relation_absence` identity gate: unobserved relation pairs cannot become evidence of no relationship; recovered observed/inferred/unobserved statuses match known truth at a higher computed rate than collapsing every status to observed (ADR 0003). +- `orchestrator_live` loopback HTTP/1.1 listener: `POST /v1/interpretation-runs` binds loopback only, replays matching idempotency keys, and refuses non-loopback binds, table-access hosts, review/Copilot/GitHub credentials, and scientific-authority promotion. Accepted output is always hypothetical. Not TLS termination or model execution (ADR 0010; ADR 0011). +- `role_contradiction` identity gate: customer and competitor cannot occupy the same group; recovered commercial-role labels match known truth at a higher computed rate than collapsing every role to customer (ADR 0003). +- `episode_membership` identity gate: a document's episode membership cannot + start before or end after the episode event-time interval; recovered + containment flags are compared with known truth (ADR 0003). +- `tepp_simulation` cutoff eligibility: delayed-reporting documents are excluded when `available_time` exceeds the knowledge cutoff, with recovered eligible counts matching known truth. +- `topic_measurement` bounded deterministic CPU `f64` TRSL-TM reference estimator: canonical CSR/CSC inputs, cutoff-safe documents, standardized event time, weighted multiple memberships, prevalence covariates, explicit predecessor/successor regularization, multi-seed generalized EM, diagonal Laplace uncertainty, and fitted topic-lineage counts with known-truth RMSE plus exact line/branch coverage (ADR 0012; no persistence or accelerated-backend claim). +- `topic_measurement` logistic-normal additive log-ratio and sequential Egozcue isometric log-ratio coordinates: fail-closed simplex validation, max-shifted stable ALR/ILR inverses with true-parameter RMSE, pairwise CLR Aitchison distance recovered by ILR Euclidean isometry for valid composition pairs, and refusal of TF-IDF/BM25/keyword scores as inferential topic coordinates (ADR 0012 first production slice; no new migration). +- Coverage contract now excludes Rust multiline string continuation records emitted by LLVM LCOV, keeping the 100% authored-line gate focused on executable production lines. +- Coverage source classification now scans Rust normal/raw/byte strings, comments, and character literals with escape-aware state, preserving executable string method calls and ignoring quoted comments. +- Quality-gate coverage tests now exercise blank-predecessor structural commas and escaped character literals in the authored-line scanner, including the past-EOF fail-closed path. +- Restored Graham Neubig's correct APA 7 initial in the Liu et al. (2023) prompting-survey register entry after the protected-main rebase. +- After protected-main consolidation #215, the analysis-run execution decision is recorded as ADR 0022 so it does not collide with ADR 0021 LineageWeave project-history. +- Registered the analysis-engine gap-closure doctoring in the canonical documentation map so its product and scientific traceability record is discoverable. +- Authored Rust coverage classification now ignores standalone structural closing parentheses, preventing formatting-only LCOV rows from appearing as uncovered production behavior. +- `analysis_engine` vertical slice (ADR 0022): bounded Rust execution from an accepted analysis run to either a cutoff-safe readiness result or a validated `tepp.trsl_topic_lineage.v1` artifact from the ADR-0012 estimator. Topic artifacts preserve fitted predecessor/successor edges, connectable-post and lineage counts, request/snapshot/cutoff bindings, SHA-256 identity, and fail-closed non-convergence/tamper behavior with exact line/branch coverage. This remains active-PR evidence and does not claim causal or psychometric authority. +- Coverage classification preserves the final expression line of multiline Rust `match` guards while respecting preceding-arm boundaries, keeping the 100% authored-line gate conservative. +- `tepp_api` fail-closed analysis-result boundaries: status constructors reject + terminal envelopes that cannot fit the default 64 KiB status limit, and + standalone terminal results reject knowledge cutoffs in the future. +- `tepp_api` request-bound terminal analysis results and typed analysis-run status/read responses: accepted/running states cannot carry measurement evidence, terminal results bind exact request and receipt identities, and succeeded/failed payloads remain digest-bound or content-redacted. +- `evidence_core` embedded-image units: `data:image/;base64,...` URIs keep their original source spans and media types, and cannot be used as lexical inference text. +- `persistence_postgres` entity/project target SQL now rejects empty, oversized, or hostile type/status labels before insert; interpolated codes are restricted to lowercase ASCII `snake_case` characters so membership foreign keys remain referentially safe (ADR 0003 / ADR 0013). +- `persistence_postgres` live SQLx transport retains one pool-backed PostgreSQL connection per session so tenant binding and the following statement share a session, and closes the connection and owned runtime safely from another Tokio runtime (ADR 0013). +- The authored-line coverage gate now filters LLVM-only literal and expression continuation records while retaining branch coverage for their executable decisions; Rust function signatures and structural branch lines are no longer counted as uncovered statements. +- Stacked `analysis_engine` vertical slice (ADR 0021): bounded Rust execution + from an accepted analysis run to a cutoff-safe, multiple-membership-aware, + SHA-256-digest-bound terminal artifact or redacted no-eligible-evidence + result. This remains active-PR evidence and does not claim estimator + authority. +- `tepp_api` request-bound terminal analysis results and typed analysis-run + status/read responses: accepted/running states cannot carry measurement + evidence, and terminal results bind exact request and receipt identities. +- Coverage classification now preserves multiline Rust `match` guard expression + lines while ignoring structural closing parentheses and match-arm labels. +- `corpus_split` Unicode canonical identity: NFC/NFD-equivalent bodies produce `CanonicalEquivalent` leakage links and cannot occupy independent partitions; empty bodies and duplicate document identities fail closed (ADR 0004/0008/0013; PR #59). +- `semantic_core` binds exact `evidence_core` source spans as semantic units. Language profiles are `unresolved` or a primary ISO 639 subtag with an IANA-registered ISO 3166-1 alpha-2 or UN M.49 region (RFC 5646; IANA File-Date 2026-08-08); private-use and unknown regions fail closed. Unresolved metadata keeps the caller-supplied Korean `측정` span and does not retokenize. `SemanticIdentity::from_language_tag` fails closed. Korean and English report sentences remain distinct units. Not concept alignment, not invariance, not a topic estimator (ADR 0020; issue #168). The APA register cites RFC 5646 once, in the Unicode/language-tags section; the slice-specific note remains `docs/research/span-grounded-semantic-units.md`. +- `corpus_background` identity gate: corpus-level background wording is not unique latent content or a state transition; recovery tests distinguish background evidence from unique content. +- `modality_source` identity gate: non-lexical modality is not unique lexical content or a state transition; recovery tests keep modality evidence distinct from unique content. +- `copied_text` identity gate: copied-text residue is not unique latent content or a state transition; recovery tests distinguish copied-text evidence from genuinely new content. +- `style_source` identity gate: house-voice style residue is not unique latent content and is not erased by a stopword list; recovery tests distinguish style from unique content. +- `stopword_deletion` method gate: a default or global stopword list cannot erase repeated report language; recovery tests distinguish deliberate method treatment from stopword deletion. +- `copy_identity` identity gate: a template or pasted copy cannot reuse the source document identity or become a state transition; recovery tests distinguish copy kinds from source identity. +- `intake_authorization` identity gate: documents, serialized records, checkpoints, and LLM outputs require a purpose-bound grant in addition to identity, provenance, size, and depth validation; recovery tests reject ungranted intake. +- `tepp_api` LineageWeave temporal-context contract (v1): cutoff-safe event eligibility, deterministic event-time ordering, explicit non-causal association/gap boundaries, HTTPS interchange construction, and loopback listener handling at `POST /v1/temporal-context`; read-only context requests no longer require the write-only idempotency header, and no causal inference or completed-result service is included. +- `tepp_api` LineageWeave consumer-scoped analysis-run ingress: versioned, credential-free requests use a published consumer identity and isolate idempotency by consumer, tenant workspace, and opaque caller key; the one-shot restack workflow is removed after the protected-main merge is verified. +- ADR 0018 records the consumer-scoped analysis-run ingress, its in-memory loopback maturity, and the persistence boundary required before production use. +- ADR 0021 records the credential-free bounded LineageWeave project-history service boundary and keeps source authorization with LineageWeave while TEPP owns temporal validation and deterministic projection. +- `tepp_api` project-history wire-size symmetry (ADR 0019): request and projection serialization enforce the shared 256 KiB limit, and generated projections fail closed before returning when their deterministic response would exceed it. +- `summarizes_edge` identity gate: summaries may point to earlier event time without becoming state transitions or reusing source-document identity; recovery tests outperform collapsing every summary to the source. +- `outcome_order` identity gate: `input_to` and `process_to` require strict forward event-time rank, while `outcome_of` remains non-transition provenance; recovery tests outperform collapsing every kind to `input_to`. +- `location_membership` identity gate: geographic and market assignments are time-varying memberships, not permanent entity identity and not language channels; recovered location kinds match known truth at a higher computed rate than collapsing every assignment to entity identity (ADR 0003). +- `prompt_source` identity gate: instruction and prompt boilerplate is not unique latent content and is not erased by a stopword list; `identity_recovery_rate` reports exact kind matches, with a contract test comparing correct recovery with an all-unique collapse on a mixed known-truth fixture (ADR 0004/0012). +- `corpus_background` identity gate: corpus-level background wording is not unique latent content and is not erased by a stopword list; recovered background kinds match known truth at a higher computed rate than collapsing every token to unique content (ADR 0004/0012). +- `modality_source` identity gate: non-lexical modality is not unique latent content and is not erased by a stopword list; recovered modality kinds match known truth at a higher computed rate than collapsing every token to unique content (ADR 0004/0012). +- `copied_text` identity gate: copied and boilerplate residue is not unique latent content and is not erased by a stopword list; recovered copied-text kinds match known truth at a higher computed rate than collapsing every token to unique content (ADR 0004/0012). +- `style_source` identity gate: house-voice style residue is not unique latent content and is not erased by a stopword list; recovered style kinds match known truth at a higher computed rate than collapsing every token to unique content (ADR 0004/0012). +- `stopword_deletion` method gate: a default or global stopword list cannot erase repeated report language; recovered deletion kinds match known truth at a higher computed rate than collapsing every token treatment to stopword deletion (ADR 0004/0012). +- `persistence_postgres` retention/deletion/legal-hold (migration `0007`): policy rows, legal holds that block completed deletion, evidence tombstones without raw-source restore, analysis exclusion only for `logical_revocation`/`identity_tombstone` (not `cache_export_removal`), and deletion requests bound to the cited retention policy's tenant/class/purpose. +- `copy_identity` identity gate: a template or pasted copy cannot reuse the source document identity or become a state transition; recovered copy kinds match known truth at a higher computed rate than collapsing every copy to the source (ADR 0003). +- `provider_receipt` disclosure receipt: records provider field codes and + purpose-bound receipt metadata without persisting source text or source + identity (ADR 0009). +- `intake_authorization` identity gate: documents, serialized records, checkpoints, and LLM outputs cannot be accepted without a purpose-bound grant; size/identity/provenance bounds are not that grant; recovered grant-presence flags match known truth at a higher computed rate than accepting every intake (ADR 0009). +- `summarizes_edge` identity gate: a summary may point to earlier event time but cannot become a state transition or reuse the source document identity; recovered summary kinds match known truth at a higher computed rate than collapsing every summary to the source (ADR 0003). +- `outcome_order` identity gate: `input_to` and `process_to` cannot move backward or stay contemporaneous in event-time rank; `outcome_of` may point at an earlier producer and cannot become a state transition; recovered kinds match known truth at a higher computed rate than collapsing every kind to `input_to` (ADR 0002/0003). +- `retrospective_edge` identity gate: retrospective reporting may point to earlier event time but cannot become a state transition or a translation; recovered reporting kinds match known truth at a higher computed rate than collapsing every report to a contemporaneous forward report (ADR 0002/0003). +- `payload_bound` identity gate: documents, serialized records, model checkpoints, and LLM outputs stay untrusted until identity, provenance, size, and depth validate; recovered accept/reject flags match known truth at a higher computed rate than accepting every payload (ADR 0008/0013). +- `inferred_status` identity gate: inferred relations cannot be promoted to observed evidence or to state transitions; recovered observed/inferred labels match known truth at a higher computed rate than treating every status as observed (ADR 0003). +- `support_edge` identity gate: support, contradiction, summary, and `outcome_of` edges cannot become state transitions; recovered evidential kinds match known truth at a higher computed rate than collapsing every kind to support (ADR 0002/0003). +- `system_clock` identity gate: event, assertion, document, availability, and knowledge-cutoff time cannot stand in for system time; recovered system stamps match known truth at a higher computed rate than treating every stamp as event time (ADR 0002). +- `event_clock` identity gate: assertion, system, document, and availability time cannot stand in for event/valid time; recovered event stamps match known truth at a higher computed rate than treating every stamp as assertion time (ADR 0002). +- Dependabot Rust toolchain updates now use a seven-day cooldown so newly published versions receive a bounded review window before automated proposals. +- `assertion_clock` identity gate: event, system, document, and availability time cannot stand in for assertion time; recovered assertion stamps match known truth at a higher computed rate than treating every stamp as event time (ADR 0002). +- `cutoff_clock` identity gate: event time, system time, and availability time cannot stand in for knowledge cutoff; recovered cutoff stamps match known truth at a higher computed rate than treating every stamp as availability time (ADR 0002). +- `available_clock` identity gate: event time and system time cannot stand in for availability time; recovered availability stamps match known truth at a higher computed rate than treating every stamp as system time (ADR 0002). +- `document_clocks` six-clock gate: a document analytical row cannot omit assertion time or document time, and event/system time cannot stand in for those clocks; recovered completeness flags match known truth at a higher computed rate than treating every row as complete (ADR 0002/0013). +- `revision_order` system-time gate: a higher document revision number cannot carry earlier or equal system time; recovered order flags match known truth at a higher computed rate than accepting every pair (ADR 0002/0013). +- `encrypted_mapping` purpose-bound AES-256-GCM envelope: source identities are sealed with an operating-system-generated nonce and analytical/key identifiers as authenticated associated data, with a 1 MiB resource bound, so analytical, log, and model-artifact purposes cannot recover plaintext; recovered identities match known truth at a higher computed rate than collapsing every mapping to one name. Persistence and KMS wait for a later migration (ADR 0009). +- `citation_edge` provenance gate: citation, translation, revision, and retrospective-report edges may point to the past but cannot become input-process-outcome transitions; recovered kinds match known truth at a higher computed rate than collapsing every edge to citation (ADR 0002/0003). +- `psychometric_fit` CPU `f64` ESEM/DSEM fit: exploratory OLS recovers known cross-loadings from admitted log-ratio or logistic-normal coordinates with computed RMSE below a zero-loading collapse; reverse or zero event-time lagged paths fail closed; a good global fit cannot reclassify formative or network constructs as reflective (ADR 0005). No new migration number (`#45` still owns `0007`). +- `subevent_containment` parent-window gate: a half-open subevent interval that starts before or ends after its parent cannot attach; recovered containment flags match known truth at a higher computed rate than accepting every child (ADR 0003). +- `prediction_contradiction` promotion gate: `temporal_core` Allen classification refuses `before`/`after` as contradiction and `meets`/`met_by` as unsupported adjacency; `refuse_promotion` and `require_observed_coverage` refuse partial overlap that leaves unmatched predicted mass; `refuse_contradiction_or_adjacency` is the weaker contradiction/adjacency filter only; evidence available after the knowledge cutoff is ineligible. Label agreement is not RMSE recovery (ADR 0002, ADR 0016). Canonical docs name the crate, not a pull-request number, as the landable authority; `scripts/validate_documentation.py` fail-closes on `landable coverage gate is PR #N` and inverted or paraphrased forms (`PR #N is the landable coverage gate`, `the landable gate is PR #N`, `coverage-authority landing PR #N`, `merge PR #N as the coverage-authority`) including drafts #93, #94, #97, #101, #102, #104, #108, #109, #111, and #112. The hourly queue lock also fail-closes when those drafts are omitted from Keep-unmerged sentences, when a Keep-unmerged sentence is negated, or when the naruon live-HTTP *subject* is not PR #107 with #87 and #105 kept unmerged. +- `provider_receipt` disclosure audit: a receipt records purpose and field codes sent to a model provider; source text, source identity, and blanket PII masking fail closed; recovered field codes match known truth at a higher computed rate than a collapsed set (ADR 0009). +- `tepp_api` corpus-split leakage-audit manifest v1: cutoff exclusion counts, relation-component and partition digests, governed link-kind vocabulary, and a canonical `SHA-256` that binds to `corpus_split_manifest` without exporting source text. +- `persistence_postgres` `audit_event` inserts call `operational_log::try_record` before SQL is rendered: author/customer/project source text, source identity, and blanket-mask grants cannot enter `INSERT INTO audit_event`; clear inspection still persists a validated action code (ADR 0009; ISO/IEC 29100:2024). No new migration number. `OperationalLogRecord::new` stays crate-private. +- `operational_log` source separation: `try_record` is the only recording API and inspects source text, source identity, and blanket-mask intent before creating a line; `OperationalLogRecord::new` is crate-private; a source-identity `&str` cannot become an `AnalyticalSubject`; privileged-export / identity-mapping / diagnosis action codes keep author, customer, and project memberships distinct; replayed lines match known truth at a higher computed rate than a collapsed single-action or collapsed-subject log (ADR 0009; ISO/IEC 29100:2024). The live docstring crate-root count is bound to `EXPECTED_CRATES` so the eleventh crate cannot fail a hard-coded `10`. +- `service_tls` production TLS bind gates: non-loopback binds require rustls PEM material, loopback HTTP is development-only, orchestrator live ports refuse loopback plaintext, and table-access host labels fail closed. `TlsBindRequest` Debug output redacts certificate and private-key PEM. Recovered bind decisions are computed from `authorize_production_tls` / `authorize_orchestrator_live_port` outputs and match known truth at a higher rate than a collapsed production grant (ADR 0011). +- `derived_sensitivity` inheritance: topic, factor, and relation artifacts keep the source sensitivity class; unknown kind codes fail closed on both `inherit_sensitivity` and `DerivedArtifact::try_new`; derivation and blanket PII masking cannot declassify to public; paired kind-and-class recovery matches known 3×3 synthetic truth at a higher computed rate than a public collapse (ADR 0009; GDPR Art. 4(1)/Recital 26; WP 136). +- `longitudinal_core` within/between decomposition: unit means stay between-unit components, occasion residuals stay within-unit change, and recovered components match known truth with lower computed RMSE than a grand-mean pooled collapse. +- `topic_lineage` global P0 topic identity: activity may become dormant or reactivated without minting a new identity, and recovered identities match known truth at a higher computed rate than mint-on-reactivate replacements. +- `interpretation_gateway` evidence-bounded LLM interpretations: proposals must cite at least one evidence span, remain hypothetical, cannot become estimator results or observed facts, and a cited interpreter records a lower computed unsupported-claim rate than uncited promotion. +- `model_selection` candidate-`K` gates: statistical candidates require `K >= 2` and finite held-out log-likelihood/complexity, a Pareto front excludes dominated alternatives, LLM votes cannot define the numerical optimum, and selected `K` recovers known truth with computed RMSE. +- `event_core` mention-confidence Brier score: known-truth binary outcomes recover a computed Brier of 0 for perfect forecasts and 0.25 for constant 0.5, with empty or mismatched streams failing closed. +- `membership_core` nested ICC: CPU `f64` unbalanced ANOVA recovers a known cluster ICC and refuses to treat cross-classified or multiple-membership designs as a single hierarchy (ADR 0003). +- `persistence_postgres` typed `text_segment` SQL: insert/lookup of exact UTF-8 half-open byte spans on the existing `0006` table, cutoff-eligible document reads (`available_time <= knowledge_cutoff`), and live recovery of a known `hello` span. No new migration number (`#45` still owns `0007`). +- Hourly contextual-orchestrator discovery records all provider models but routes OpenCode only through general-chat candidates, excluding embedding, image, reranker, transcription, moderation, safety, and other endpoint-only identifiers before price selection. +- Live `docs/product-technical-gap-baseline.md` mapping operator-visible gaps to + protected-main maturity, exact current PR/issue state, stacked delivery order, + and closure evidence; placeholder-only issues #161 and #162 were closed as + queue hygiene. The documentation validator requires a dated UTC snapshot, a + 40-character protected-main SHA, an exact-head inventory matching the declared + open-PR count, and operator-gap closure evidence, and it rejects affirmative + queued-Checks-as-implemented-main claims even when wrapped across a line + break, and it rejects an unrelated `not` in the same span (`queued Checks are + not required; this PR is implemented-main`). Only never/do not/does not/ + cannot/must not plus promote/treat/make/mean counts as a promotion denial. +- `checkpoint_authority` estimator gate: a model checkpoint remains an untrusted run artifact until identity, canonical `SHA-256`, and model-run provenance validate, and it cannot replace the CPU `f64` estimator or promote a scientific claim; recovered roles match known truth at a higher computed rate than collapsing every artifact to the estimator (ADR 0001/0014). +- `event_core` now requires and retains `EventEvidenceLayer::PromotedTransition` when constructing an `EventInstance`; every other layer is rejected at the promotion boundary, and TDT story classification uses a caller-owned hash set for expected constant-time membership checks. +- `event_core` ADR 0016 evidence-status gates: TDT detections and CHRONOS predictions cannot admit a forward state transition; first-story detection scores miss/false-alarm rates against a known story stream (Allan 2002 task). +- `compute_backend` ADR 0006 first slice: VRAM profiles and reserve-aware micro-batching, executable successive OOM retry plans, CPU fallback, compensated `f64` reference arithmetic with scale-aware parity tolerance, grouped adaptation policies, and fail-closed estimand-preserving memory policies. +- `validation_core` ADR 0014 claim-promotion gates: `decision_accepted`, `implemented_main`, `scientifically_supported`, and `released` bind to an exact commit SHA; queued, predecessor, skipped-required, and LLM evidence fail closed; scientific promotion uses computed RMSE and its standard error rather than a hardcoded threshold (no new migration). +- `relation_graph` causal-identification gate: only `causes` and `intervenes_on` may be described as causal; association, temporal precedence, production, and provenance fail closed. +- `temporal_core` interval-aware historical eligibility: `evaluate_historical_eligibility` admits an `AvailableTime` interval only when every possible availability instant is at or before `KnowledgeCutoff`; unknown and open-ended upper availability fail closed, and event/document time cannot be substituted. +- `event_core` TDT tracking contracts: hypothesized track assignments, fail-closed duplicate mentions, refusal to treat a track as an instance or state transition, and computed pair precision/recall, identity-switch rate, and RMSE against known-truth assignments. +- `event_core` CHRONOS schema-slot gate: predicted role fillers stay distinct from promoted instances and transitions, slot precision/recall are computed from known-truth fills, and production label/confidence APIs produce calibrated occupancy RMSE ≈ 0.1411 versus always-fill ≈ 0.7071 in the contract fixture. +- `event_core` TDT story-segmentation contracts: ordered unit partitions, fail-closed empty/mismatched windows, refusal to treat a detected story cut as an instance or state transition, and computed `WindowDiff`, `Pk`, boundary precision/recall, plus RMSE against known-truth boundaries. +- `event_core` CHRONOS occurrence-prediction calibration: forecasts stay hypothetical, refuse promotion to event instances, and recover a computed Brier score against later-observed occurrence truth, with empty or mismatched streams failing closed. +- `persistence_postgres` entity/project target SQL: fail-closed insert/lookup for `entity_record` and `project_record` so membership foreign keys cannot be seeded from empty, oversized, or hostile type/status labels. No new migration number (ADR 0003 / ADR 0013). +- `cutoff_clock` identity gate: event time, system time, and availability time cannot stand in for knowledge cutoff; recovered cutoff stamps match known truth at a higher computed rate than treating every stamp as availability time (ADR 0002). +- `assertion_clock` identity gate: event, system, document, and availability time cannot stand in for assertion time; recovered assertion stamps match known truth at a higher computed rate than treating every stamp as event time (ADR 0002). +- `event_clock` identity gate: assertion, system, document, and availability time cannot stand in for event/valid time; recovered event stamps match known truth at a higher computed rate than treating every stamp as assertion time (ADR 0002). +- `system_clock` identity gate: event, assertion, document, availability, and knowledge-cutoff time cannot stand in for system time; recovered system stamps match known truth at a higher computed rate than treating every stamp as event time (ADR 0002). +- `support_edge` identity gate: support, contradiction, summary, and `outcome_of` edges cannot become state transitions; recovered evidential kinds match known truth at a higher computed rate than collapsing every kind to support (ADR 0002/0003). +- `inferred_status` identity gate: inferred relations cannot be promoted to observed evidence or to state transitions; recovered observed/inferred labels match known truth at a higher computed rate than treating every status as observed (ADR 0003). +- `payload_bound` identity gate: documents, serialized records, model checkpoints, and LLM outputs stay untrusted until identity, provenance, size, and depth validate; recovered accept/reject flags match known truth at a higher computed rate than accepting every payload (ADR 0008/0013). +- `outcome_order` identity gate: `input_to` and `process_to` cannot move backward or stay contemporaneous in event-time rank; `outcome_of` may point at an earlier producer and cannot become a state transition; recovered kinds match known truth at a higher computed rate than collapsing every kind to `input_to` (ADR 0002/0003). +- `summarizes_edge` identity gate: a summary may point to earlier event time but cannot become a state transition or reuse the source document identity; recovered summary kinds match known truth at a higher computed rate than collapsing every summary to the source (ADR 0003). +- `provider_receipt` disclosure receipt: records provider field codes and + purpose-bound receipt metadata without persisting source text or source + identity (ADR 0009). +- `intake_authorization` identity gate: documents, serialized records, checkpoints, and LLM outputs cannot be accepted without a purpose-bound grant; size/identity/provenance bounds are not that grant; recovered grant-presence flags match known truth at a higher computed rate than accepting every intake (ADR 0009). +- `copy_identity` identity gate: a template or pasted copy cannot reuse the source document identity or become a state transition; recovered copy kinds match known truth at a higher computed rate than collapsing every copy to the source (ADR 0003). +- `stopword_deletion` method gate: a default or global stopword list cannot erase repeated report language; recovered deletion kinds match known truth at a higher computed rate than collapsing every token treatment to stopword deletion (ADR 0004/0012). +- `episode_membership` identity gate: a document's episode membership cannot start before or end after the episode event-time interval; recovered containment flags match known truth at a higher computed rate than accepting every membership (ADR 0003). +- `style_source` identity gate: house-voice style residue is not unique latent content and is not erased by a stopword list; recovered style kinds match known truth at a higher computed rate than collapsing every token to unique content (ADR 0004/0012). +- `modality_source` identity gate: non-lexical modality is not unique latent content and is not erased by a stopword list; recovered modality kinds match known truth at a higher computed rate than collapsing every token to unique content (ADR 0004/0012). +- `corpus_background` identity gate: corpus-level background wording is not unique latent content and is not erased by a stopword list; recovered background kinds match known truth at a higher computed rate than collapsing every token to unique content (ADR 0004/0012). +- `prompt_source` identity gate: instruction and prompt boilerplate is not unique latent content and is not erased by a stopword list; `identity_recovery_rate` reports exact kind matches, with a contract test comparing correct recovery with an all-unique collapse on a mixed known-truth fixture (ADR 0004/0012). +- `location_membership` identity gate: geographic and market assignments are time-varying memberships, not permanent entity identity and not language channels; recovered location kinds match known truth at a higher computed rate than collapsing every assignment to entity identity (ADR 0003). +- `membership_target` identity gate: language, episode, template, department, and opportunity-pool memberships cannot collapse into the entity/project pair stored by migration `0006`; comparison-contract tests record recovered target kinds against an entity-collapse baseline (ADR 0003). +- `corpus_split` inferential-weight gate: only group-normalized ESS and uniform observation weights may enter an estimator; TF-IDF, BM25, and default global stopword deletion fail closed, with computed RMSE showing the retrieval surrogate recovers known shares worse than `group_normalized_ess`. +- `event_core` TDT link-detection contracts: undirected mention-pair hypotheses, fail-closed self-links, refusal to treat a detected link as an instance or state transition, and computed precision/recall plus RMSE against known-truth pairs. +- `event_core` first-story detection gate: first-story versus follow-up labels stay distinct from promoted instances, false-alarm and miss rates are computed from known truth, and calibrated detection scores recover the binary first-story target with lower RMSE than an always-first detector. +- `tepp_api` naruon live loopback HTTP/1.1 listener: `serve_one` installs a read/write deadline, requires a loopback `Host`, refuses `Transfer-Encoding` and NIM/proxy credential headers, parses `knowledge_cutoff` as RFC 3339 and refuses a future cutoff, keys analysis-run idempotency by tenant plus key, and proves both analysis-run and export POSTs over a real `TcpStream`. Not a production TLS/`$PORT` service (ADR 0011). +- `tepp_api` adaptive orchestration router (ADR 0010): versioned `direct`/`verify`/`committee`/`conductor`/`abstain` selection from CPU `f64` risk, ambiguity, evidence, and token-budget inputs; recorded stages, recursion, decomposition, access lists, and role-specific reasoning effort; fail-closed document-controlled policy/access/credentials; LLM plans remain proposals under deterministic statistical authority; comparable-budget ablation requires a direct baseline; credential-free contextual-orchestrator binding. Live NIM HTTP remains accepted-target. +- `tepp_api` purpose-bound provider-payload minimization: time-bounded `PurposeGrant` evaluation, fail-closed expired/not-yet-valid/inverted/cross-tenant/impossible-calendar denial, semantic UTC calendar validation, refusal to copy identity mappings into model-provider payloads or ordinary logs, preservation of opaque analytical identifiers and membership roles (no blanket PII mask), a separately authorized scientific re-identification path, and an internally bound FIPS 180-4 SHA-256 audit digest appended through `ReidentificationAuditSink` before disclosure. +- `persistence_postgres` backup/restore integrity: restored snapshots stay unusable until tenant, canonical `SHA-256`, knowledge-cutoff eligibility, temporal window order, and append-only triggers revalidate; SQL probes raise `restore integrity failed` (ADR 0013). +- `persistence_postgres` concurrent document-write stress: atomic revise `DO` block that requires exactly one open `system_to` close, SQLSTATE mapping onto `ConcurrentWriteConflict` / `DuplicateDocumentRecord`, and live multi-session insert/revise/append-only proofs. No new migration number. +- `tepp_api` naruon HTTP interchange: versioned `https` POST contracts for analysis-run create and modular export authorization that refuse table-access URLs, provider-specific API-key/secret and review/Copilot credential headers, malformed extra HTTP fields, reserved standard-header redefinition, principal-only export idempotency keys, and lexical inference claims (ADR 0011). +- `persistence_postgres` audit-event SQL contracts: append-only insert that refuses empty, oversized, or hostile `action_code` values before SQL is rendered. +- `network_analysis` compositional cluster gates: raw topic proportions cannot be treated as Euclidean coordinates; recovered clusters are scored with label-invariant pair precision and recall against known truth. +- `persistence_postgres` event-instance SQL contracts: bitemporal insert and as-known-at lookup that refuse inverted valid/system windows and hostile type/lifecycle labels before SQL is rendered. +- `persistence_postgres` event-mention SQL contracts: mention identity cannot equal the instance it supports; confidence must be finite and in `(0, 1]`. +- `persistence_postgres` event-relation SQL contracts: closed ERD transition/provenance vocabulary bound to `transition_edge`, fail-closed unknown types and transition self-loops, live insert of `causes`/`references`. +- `persistence_postgres` source-artifact SQL contracts: append-only insert and primary-key lookup that refuse non-canonical `SHA-256` digests, negative sizes, and hostile media-type or object-store labels before SQL is rendered; identical-identity retries are `ON CONFLICT DO NOTHING` plus a stored-row match assertion, and a same-id payload change fails closed as `ConflictingSourceArtifact`. +- `persistence_postgres` typed membership assignment (migration `0006`): `entity_record`, `project_record`, and `text_segment` plus exactly-one observed-unit and target constraints that replace the polymorphic `membership_target_id` stub, with SQL insert/lookup, fail-closed inverted-window and backslash-label refusal, and live proof that one document persists two entity memberships and one project membership. +- Actions workflow fleet auditor (`scripts/actions_workflow_fleet.py`): paginated registry inventory bound to the exact default-branch SHA/tree, classification of present/orphan/disabled/GitHub-dynamic identities, and fail-closed orphan disable that confirms GitHub's official `disabled_manually` state. +- `persistence_postgres` temporal interval ordering migration (`0005`): multi-word CHECK constraints on `document_record`, `event_instance`, and `membership_assignment` that reject inverted valid/system windows and non-positive document revisions while preserving open-ended NULL upper bounds and equal point bounds; catalog validation and live inverted-window proof. +- `persistence_postgres` append-only immutability migration (`0004`): `reject_append_only_mutation`, statement-level `BEFORE UPDATE OR DELETE OR TRUNCATE` triggers on identity/manifest tables, `REVOKE UPDATE`/`DELETE`/`TRUNCATE` from `tepp_app_runtime`, executable DDL/rollback contracts, and live representative mutation proof. +- `persistence_postgres` model-run artifact chain: migration `0003_model_run_artifact_chain` for append-only `corpus_split_manifest`, `model_run`, and `model_artifact` with FORCE RLS; SQL insert/lookup contracts and live repository methods binding runs to reproducibility manifests and optional splits. +- `persistence_postgres` append-only reproducibility-manifest SQL contracts and live repository methods (`insert_reproducibility_manifest`, digest/id lookup) with fail-closed SHA-256 and commit identity validation for `reproducibility_manifest`. +- `persistence_postgres` tenant row-level security: migration `0002_tenant_row_level_security`, `tepp_app_runtime` role, session GUC `tepp.current_tenant_record_id`, multi-word isolation policies with FORCE RLS, session helpers, contract validation, and live isolation proof under `TEPP_LIVE_POSTGRES=1`. +- `persistence_postgres` live PostgreSQL CI: `live-postgres` job with Postgres 16 service, `TEPP_LIVE_POSTGRES=1` gate, and integration coverage for pool open, foundation+RLS migrations, document insert/revise/as-of, audit SQL, and tenant isolation. +- Repository release evidence tooling: `scripts/release_evidence.py` generates CycloneDX 1.5 SBOM, exact-head provenance, and SHA-256 checksums from `Cargo.lock`/`Cargo.toml`, with fail-closed validation and CI generation on every quality gate. +- `persistence_postgres` `live-sqlx` feature: real `SQLx`/`PgPool` open/execute behind validated `DATABASE_URL` and `LiveSqlxPoolOptions`, with offline/live executor backends and CI coverage exclusion for the transport module. +- `persistence_postgres` live pool open gate: validated `LiveSqlxPoolOptions`, fail-closed `open_live_sqlx_pool` / `LiveSqlxPool` (`SqlSession`) with offline test backend; optional `live-sqlx` attaches real `SQLx`/`PgPool` after `DATABASE_URL` validation. +- `validation_core` recovery metrics: parameter matching, RMSE/bias with standard errors, interval coverage with Wilson bounds, relation-edge precision/recall, temporal-order accuracy, Monte Carlo summaries, and SE-aware acceptance gates with machine-readable reports. +- `tepp_api` versioned analysis-run DTOs, content-redacting error envelopes, reproducibility manifests, JSON-LD and GraphML export contracts, purpose-bound export authorization (no blanket PII masking), plus committed schemas/examples. +- `relation_graph` forward-only state-transition DAG with past-pointing provenance edges and cycle rejection. +- `tepp_simulation` deterministic truth-corpus generator with delayed reporting, multilevel memberships, method-effect variants, relation noise, and digest-bound truth manifests. +- `corpus_split` leakage-safe knowledge-cutoff snapshots, relation-connected co-partition groups, rolling-origin windows, and group-normalized ESS weight contracts. +- `persistence_postgres` live SQL port: `SqlSession` transport, migration batch applicator, document/audit SQL contracts, `LiveDocumentRepository`, and fail-closed `DATABASE_URL`/`LiveSqlxConfig` gate for SQLx pool wiring (optional `live-sqlx` driver attaches `PgPool`). +- `membership_core` Kish effective sample size, design effect, and group-normalized ESS helpers for multiple-membership estimation inputs. +- Credential-separated hourly NVIDIA NIM/OpenCode product-development workflow (issue #2): proposal, independent verification, and late Maintainer-App publication with `NVIDIA_NIM_API_KEY` only for model work. +- Hourly product-development queue gate now fails closed when either an open pull request or an open issue exists, including a second queue check immediately before publication. +- Documented modular naruon consumer contract for TEPP analysis-run and export surfaces, with a committed example request payload. +- Documented contextual-orchestrator interpretation port boundary and credential separation for TEPP. +- Foundation validation/release-readiness ledger at `docs/validation/temporal-event-foundation.md` tracking capability maturity and scientific acceptance gates. +- Research doctoring for multilevel/multiple-membership measurement and atomistic fallacy prevention. +- `persistence_postgres` bitemporal foundation: multi-word migration contracts, knowledge-cutoff eligibility, and in-memory as-known-at / as-valid-at document replay (live SQLx/PostgreSQL execution remains accepted-target). +- `event_core` mention/instance separation with explicit promotion, typed roles, event-time validity, and fail-closed mention-as-instance refusal. +- `membership_core` time-varying weighted multiple-membership network with contextual roles, event-time validity, and atomistic-fallacy prevention contracts. +- Bounded Allen interval algebra and path-consistency reasoner in `temporal_core` (Task 4; PR #9), with identity-isolated variables, resource budgets, inverse/composition, and conservative provenance. +- Approved Temporal Event Psychometrics Platform PRD v0.4 baseline. +- Canonical technical documentation map, TRD, UML/scientific runtime views, logical/planned ERD, scientific test strategy, operability/recovery guide, and requirements/research/evidence traceability with explicit implementation maturity. +- Whole-conversation documentation fitness assessment plus canonical API/MSA contract, threat model, privacy/data-governance contract, CSAP/SOC 2/ISO/NIST assurance-readiness mapping, and adaptive LLM orchestration/test-time-compute contract. +- ADR policy separating architectural **Decision status** from **Implementation maturity**, defining partial supersession, and making the ADR index the canonical decision-ownership map. +- ADR 0009 for purpose-bound PII governance without blanket masking, ADR 0010 for adaptive direct-versus-multi-agent LLM orchestration, and ADR 0011 for standalone/modular CWL service authority. +- ADR 0012 for Temporal Relational Shared-Latent Topic Measurement (TRSL-TM), global topic identity/backend compatibility/method-effect/model-selection authority. +- ADR 0013 for bitemporal persistence, immutable reproducibility/run/split manifests, relation-aware partitions, recovery, and PostgreSQL adapter authority. +- ADR 0014 separating accepted design, protected-main implementation, scientific/product claim promotion, and release evidence authority. +- ADR 0015 separating autonomous model proposal, deterministic verification, publication, independent review, and merge/release authority. +- ADR 0016 separating Event Ontology observation, TDT detection/tracking, CHRONOS schema prediction, symbolic temporal consistency, and promoted transition authority. +- Added APA 7 research traceability for ICLR 2026 TRINITY and Conductor, the 2026 Sakana Fugu technical report, ISO/IEC 42001:2023, ISO/IEC 23894:2023, NIST AI RMF/GAI Profile, AICPA Trust Services Criteria, and KISA CSAP guidance. +- Eight-phase delivery roadmap and Temporal/Event Foundation implementation plan. +- Immutable evidence, six-clock temporal semantics, interval reasoning, event ontology, typed relation graph, and time-varying multiple-membership contracts. +- Shared-latent multilingual topic measurement architecture with native lexical channels and language-profile validation. +- Longitudinal ESEM/DSEM and continuous-time structural modeling requirements. +- Rust-first CPU `f64`, multithreaded CPU, GPU, VRAM-adaptive streaming, and CPU/GPU parity requirements. +- Topic correlation, consensus clustering, TDT, CHRONOS, and evidence-grounded LLM interpretation requirements. +- APA 7th research traceability, source archive manifests, ADRs, governance, security, and contribution contracts. +- Hourly centralized PR-maintenance workflow and a documented requirement for a future credential-separated NVIDIA NIM/OpenCode product-development loop. +- Rust 1.97.1 virtual Cargo workspace with eleven explicit modular foundation crates. +- Repository contract, public-rustdoc, line-coverage, and nightly branch-coverage gates. +- Pinned `cargo-nextest` 0.9.140, `cargo-llvm-cov` 0.8.6, `cargo-deny` 0.19.7, and Coverage.py 7.15.2 quality tooling. +- Task 1 architecture decision and workspace-foundation validation report. +- Version-keyed, executable-only GitHub Actions caches for pinned Rust quality tools. +- Immutable `evidence_core` records with independent RFC 9562 `UUIDv7` identities, canonical `SHA-256` content digests, owned source bytes and UTF-8 text, exact byte/Unicode-scalar spans, and bounded page-layout coordinates. +- Strict versioned JSON wire contracts for artifacts, documents, exact spans, and nested page locations without exposing private domain storage. +- ADR 0008 and APA 7 doctoring for evidence identity, hashing, JSON interchange, UTF-8 boundaries, Unicode segmentation limits, and future W3C PROV integration. +- Same-run exact missing-line and missing-branch diagnostics for failed 100% Rust coverage gates. + +### Changed + +- ALR and ILR inverse normalization now fails closed when division would turn + a representable subnormal weight into a zero simplex part; runtime images + are pinned to the reviewed multi-platform Rust and Debian OCI digests. +- `psychometric_core` scalar forward map `φ(Δt) = exp(a Δt)` now refuses binary64 underflow to `+0`. Voelkle et al. (2012, Eq. 7; ZORA accepted manuscript p. 16) write discrete auto-effects as `e^{a Δt}`, which are strictly positive; `a = ln(φ) / Δt` requires `φ > 0`. Direct overflow already failed closed. The Newton residual path refuses a mapped `+0` the same way. +- The docstring discovery test compares crate-root names to `EXPECTED_CRATES` instead of a hardcoded count of 10, so `semantic_core` is required and an unapproved extra crate fails closed. +- The LineageWeave temporal-context read exchange no longer emits a fabricated + `idempotency-key`; that header remains reserved for retryable write/export + operations with a caller-owned operation key. +- `tepp_api` project-history requests and projections now share the strict + `temporal_core` RFC 3339 parser and nominal `KnowledgeCutoff` boundary, + rejecting unknown offsets and other timestamp forms that the transport + parser could otherwise accept. +- Coverage validation now ignores LLVM rows for multiline call and iterator + syntax that have no independently executable source coordinate, while + retaining the authored-line 100% gate. +- Removed the temporary PR-155 review-repair workflows and source-fix helper after the bounded repair; subsequent changes use the normal reviewed branch path. +- Pinned Rust branch-coverage workflows to `nightly-2026-08-21`, which is newer than the workspace Rust 1.98.0 MSRV and avoids the previous nightly/MSRV mismatch. +- Applied the documented `sqlx_live.rs` authored-coverage exclusion to the hourly release gate so live-PostgreSQL success-path coverage is not reported as a false source failure. +- Removed unreachable duplicate Naruon host-control validation because the shared `require_nonempty` boundary already rejects C0/C1 controls; retained a C1 regression case alongside the existing C0 case. +- Kept one maturity row per capability in the traceability matrix while recording the active provider-receipt evidence without duplicating or downgrading existing capabilities. +- `tepp_api` corpus-split manifest validation now rejects governed link-kind arrays that are unsorted or duplicated, keeping untrusted JSON aligned with the schema's unique canonical representation and preventing equivalent audits from receiving different valid digests. +- Grounded `derived_sensitivity` doctoring on GDPR Article 4(1)/Recital 26 and WP29 Opinion 4/2007 (WP 136) as read from the official texts, and replaced the withdrawn ISO/IEC 29100:2011 use-limitation overclaim with the current 29100:2024 catalogue edition without quoting unread clause text. +- Added APA 7th method citations (Allen 1983; ISO 24617-1:2012; Hobbs & Pan 2017; Fox & Glas 2001; AERA/APA/NCME 2014; Blei & Lafferty 2006; Roberts et al. 2014, 2019; Chang & Blei 2009; Mimno et al. 2009; Asparouhov & Muthén 2009; Asparouhov et al. 2018; Marsh et al. 2014; Aitchison 1982; Allan 2002; Li et al. 2021; Anagnostopoulos et al. 2013) into ADRs 0002–0005, 0012, and 0016, plus TRACEABILITY/ARCHITECTURE/TRD method rows. Clarified that TRSL-TM is the product contract, STM-style logistic-normal is the reference family, ESEM/DSEM/TDT/CHRONOS remain accepted-target, and merged PRs #8/#9—not superseded drafts #5/#6—are the protected-main temporal lineage. +- Refreshed the live gap-baseline inventory to the 2026-08-24T05:41:54Z GitHub + snapshot (118 open PRs / 48 drafts / 12 issues; protected-main + `c45be17a9dbce95ef81cee230e9d128abc7160ac`), binding each operator-gap current + head SHA to that exact-head register, including #201 `6afd650667e1` (RFC 5646 + cited once; first GAP-005 slice, not implemented-main), stacked drafts + #202–#204, and #164 `ff2e645b1785` as the predecessor register head. Duplicate + PR #179 remains closed. Stacked-merged heads and queued Checks are not + implemented-main. +- Rust LCOV quality gating now ignores visibility-qualified function signatures + and structural match-arm labels that LLVM reports as zero-hit non-executable + lines. + PR #179 remains closed. Stacked-merged heads and queued Checks are not + implemented-main. +- Removed the completed one-shot PR #51 repair job from `docs-quality.yml`; the + workflow no longer invokes deleted repair scripts or requests write authority + after the executable compute implementation is already present. +- `persistence_postgres` entity and project target inserts now bind their tenant session context before rendering SQL, keeping `FORCE ROW LEVEL SECURITY` behavior consistent with every other tenant-scoped write; live coverage still proves raw wrong-tenant rejection. +- Clarified ADR 0001 so it owns Rust-first numerical/reference-backend authority while ADR 0011 owns cross-service MSA/service authority. +- Clarified ADR 0006 so it owns GPU/VRAM and model-credential boundaries; ADR 0010 now owns LLM orchestration policy and ADR 0015 owns autonomous repository-write/review/merge authority. +- Expanded ADR 0002–0005 and 0009–0011 with explicit implementation maturity, alternatives, failure/recovery, compatibility/migration, verification, and rollback/supersession boundaries where they were previously implicit. + +### Security + +- Naruon interchange refuses `x-apikey`, `x-api_key`, and hyphenated `api-key` credential-header aliases, not only `x-api-key`. +- GitHub HTTPS fleet transport maps request, response, and close-path network exceptions to `upstream_unavailable` without leaking raw provider exception text. +- Disabled-state classification and live disable confirmation now accept GitHub's official `disabled_manually`, `disabled_fork`, `disabled_inactivity`, and `deleted` registry states so orphan bootstrap/repair identities can be retired without name-only heuristics. +- Prohibited `COPILOT_GITHUB_TOKEN` and reserved `NVIDIA_NIM_API_KEY` for approved LLM test and development workflows. +- Defined purpose-bound PII access, opaque analytical identifiers, separately protected identity mapping, selective model-provider disclosure, retention/deletion, and privileged audit controls instead of destructive blanket masking. +- Added explicit threat classes for temporal leakage, relation/membership poisoning, model/artifact poisoning, numerical divergence, cross-tenant disclosure, prompt injection, evidence substitution, resource exhaustion, and scientific-integrity failures. +- Removed the bootstrap branch's credential-co-resident OpenCode workflow: no model process may receive repository-write authority, and scheduled product development remains disabled until proposal, independent verification, and late publication authority are separated across fresh jobs. +- Removed completed bootstrap materializers, encoded payload fragments, readiness sentinels, and push probes from the reviewable tree. +- Required full-commit GitHub Action pins, minimum permissions, concurrency controls, immutable audit evidence, SBOM, and provenance. +- Kept ordinary Rust CI free of LLM and reviewer credentials and disabled persisted checkout credentials. +- Refused to cache mutable Cargo registry, Git source, or target trees; cached quality binaries are keyed and checked by exact version. +- Copied caller-provided source bytes and document text before acceptance and kept validated evidence fields private. +- Made empty, oversized, malformed-digest, invalid UTF-8-boundary, coordinate-mismatch, cross-document, nonfinite-geometry, and out-of-page evidence fail closed with content-redacting errors. +- Rejected malformed or extended wire payloads, unsupported schema versions, invalid identifiers and byte values, digest/content substitution, stale document ownership, and invalid nested geometry during reconstruction. + +### Quality + +- Required 100% production line and branch coverage and complete public API docstrings. +- Required true-parameter recovery, RMSE, bias, interval coverage, temporal leakage, graph recovery, invariance, and CPU/GPU parity evidence. +- Expanded documentation contracts to require the canonical threat/privacy/assurance/API/orchestration/fitness documents, ADR policy, and every numbered ADR present in the canonical index to remain indexed and structurally complete. +- Added deterministic validation that ADR files and the index have identical decision numbers and that every ADR declares valid decision status, implementation maturity, supersession scope, core decision sections, verification, and rollback behavior. +- Added 100% statement and branch coverage for the repository quality-gate scripts. +- Made a zero executable-code coverage denominator explicit for the skeleton-only slice rather than treating it as evidence of implemented behavior. +- Denied warnings, missing public documentation, and unsafe Rust across the workspace. +- Added known digest vectors, mutation detection, hostile multibyte Unicode, exact-coordinate, page-boundary, stable-error, and invalid-input regression tests for the first evidence slice. +- Added strict wire round trips, unknown-field and version rejection, digest reconstruction, configured-limit, hostile JSON, and generated multilingual span tests. + +The repository has not yet cut a stable implementation release, so no compare reference is published for `[Unreleased]` yet. From 7f4e3f10711d745c9451dbd4e10ee3e3ce07bedc Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 06:07:19 +0900 Subject: [PATCH 074/235] test(adr): reject identical duplicate authority RED --- tests/quality/test_adr_identity_uniqueness.py | 32 +++++++++++++++++++ 1 file changed, 32 insertions(+) diff --git a/tests/quality/test_adr_identity_uniqueness.py b/tests/quality/test_adr_identity_uniqueness.py index a0af476fc..1c18878f2 100644 --- a/tests/quality/test_adr_identity_uniqueness.py +++ b/tests/quality/test_adr_identity_uniqueness.py @@ -164,6 +164,22 @@ def test_duplicate_maturity_metadata_fails(self) -> None: with self.assertRaisesRegex(AssertionError, "multiple Implementation maturity"): docs.validate_adr_graph() + def test_identical_duplicate_maturity_metadata_fails(self) -> None: + """Repeating the same maturity is still competing canonical authority.""" + + body = ADR_BODY.format(number="0001").replace( + "**Implementation maturity:** partial", + "**Implementation maturity:** partial\n**Implementation maturity:** partial", + ) + root = self._root( + "| [0001](0001-one.md) | One | Accepted | partial | canonical |\n", + {"0001-one.md": "0001"}, + {"0001-one.md": body}, + ) + with mock.patch.object(docs, "ROOT", root): + with self.assertRaisesRegex(AssertionError, "multiple Implementation maturity"): + docs.validate_adr_graph() + def test_duplicate_decision_status_metadata_fails(self) -> None: """An ADR has exactly one canonical decision-status declaration.""" @@ -180,6 +196,22 @@ def test_duplicate_decision_status_metadata_fails(self) -> None: with self.assertRaisesRegex(AssertionError, "multiple Decision status"): docs.validate_adr_graph() + def test_identical_duplicate_decision_status_metadata_fails(self) -> None: + """Repeating the same Decision status is still competing authority.""" + + body = ADR_BODY.format(number="0001").replace( + "**Decision status:** Accepted", + "**Decision status:** Accepted\n**Decision status:** Accepted", + ) + root = self._root( + "| [0001](0001-one.md) | One | Accepted | partial | canonical |\n", + {"0001-one.md": "0001"}, + {"0001-one.md": body}, + ) + with mock.patch.object(docs, "ROOT", root): + with self.assertRaisesRegex(AssertionError, "multiple Decision status"): + docs.validate_adr_graph() + def test_canonical_index_targets_pass(self) -> None: """Each displayed identity may link to its unique root ADR file.""" From 8b0d3a8b9a57607299d8441b0e130715c03b7ca2 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 06:08:33 +0900 Subject: [PATCH 075/235] fix(adr): reject duplicate authority declarations --- scripts/validate_documentation.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/scripts/validate_documentation.py b/scripts/validate_documentation.py index 4c74912f9..f2f47684f 100644 --- a/scripts/validate_documentation.py +++ b/scripts/validate_documentation.py @@ -560,11 +560,11 @@ def validate_adr_graph() -> None: maturity_matches = list(ADR_IMPLEMENTATION_STATUS.finditer(text)) if not decision_matches: failures.append(f"ADR {number} lacks a valid Decision status") - elif len({match.group(1) for match in decision_matches}) > 1: + elif len(decision_matches) > 1: failures.append(f"ADR {number} has multiple Decision status authorities") if not maturity_matches: failures.append(f"ADR {number} lacks a valid Implementation maturity") - elif len({match.group(1) for match in maturity_matches}) > 1: + elif len(maturity_matches) > 1: failures.append(f"ADR {number} has multiple Implementation maturity authorities") index_row = index_by_number[number] From f48b00d2d0163bce7aa83f7e470ddb6ebffb03b1 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 06:12:08 +0900 Subject: [PATCH 076/235] docs(deps): follow surviving covariance owner --- CHANGELOG.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index abc46bfad..ab8621adc 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -11,20 +11,22 @@ TEPP currently has **no GitHub release**. A source-version heading or historical - Delivery-authority recovery (#435 / #175) records the fresh live queue as **133 open pull requests: 132 Draft and 1 non-Draft**, with 15 open issues, on protected `main@1bc02f580cf48e1d39da239f0e818453437c31c3`. The observed queue peak in this recovery cycle was 149. Organization ruleset `18156473`, not classic branch-protection status alone, remains merge authority. - Longitudinal Modeling PR #310 is the surviving `landing_vehicle`. Former PR #441 is closed after its corrected two-marginal lagged-correlation, typed event-time, overflow/underflow, recovery, and traceability evidence was folded into #310. #310 is **not merge-ready** until its exact-current-head required workflows terminate GREEN and qualifying independent review exists. - One-map Drafts #476 (`DIFFUSIONstd`) and #477 (`discreteDIFFUSIONstd`) were retired only after their distinct stationarity, interval, numerical-edge, refusal, and `research_candidate` evidence was verified in #310 under `longitudinal_core`. -- Reusable scalar covariance standardisation is migrating to canonical owner `ContextualWisdomLab/fast-mlsirm` through Draft PR #1723 and Published Language candidate `fast_mlsirm.scalar_variance_standardisation@1.0.0`. TEPP #272 is retired after its exact-binary64 `v = 3` review finding was preserved upstream. TEPP #315 remains Draft adapter lineage and must remove duplicate local arithmetic after a released/versioned upstream contract is available and parity is proven. -- Documentation fitness now fails closed on malformed rows inside the priority exact-head inventory rather than silently omitting them when another valid row exists. ADR validation also requires repository-wide identity plus index/file agreement for Decision status and Implementation maturity, and rejects conflicting duplicate authority metadata. +- Reusable covariance-to-correlation standardisation is owned upstream by `ContextualWisdomLab/fast-mlsirm` surviving PR #1722 and Published Language candidate `fast_mlsirm.covariance_standardization@1.0.0`. The narrower concurrent #1723 was closed unmerged only after its exact-unit scalar evidence was preserved in #1722. TEPP #272 is retired; TEPP #315 remains Draft adapter lineage and must remove duplicate local arithmetic only after a released/versioned upstream contract is available and parity is proven. +- Documentation fitness now fails closed on malformed rows inside the priority exact-head inventory rather than silently omitting them when another valid row exists. ADR validation also requires repository-wide identity plus index/file agreement for Decision status and Implementation maturity, and rejects repeated authority declarations even when their values are identical. - ADR 0004 and ADR 0008 authority metadata were normalized so active implementation evidence is not presented as protected-main capability. The ADR index now mirrors canonical file status/maturity for the repaired rows. The historical 0021 collision remains byte-preserved under `docs/adr/archive/`; the former colliding 0024 text is not falsely represented as an archive when verified original bytes are unavailable, and ADR 0026 remains only a Proposed successor identity. ### DDD ownership - TEPP owns temporal/event composition, six-clock semantics, event ontology/temporal graph, longitudinal invariance/drift/alignment, leakage-safe knowledge cutoffs, and time-varying multilevel/cross-classified/multiple-membership policy. - fast-mlsirm owns reusable static/generalized-mixed/dependence-aware psychometric numerical kernels, including reusable covariance standardisation and LSIRM/MLSIRM/DLSJM computation. +- Validation Evidence and Scientific Claim Promotion remain separate authorities; transport/application layers cannot promote a scientific claim. - contextual-orchestrator owns provider/LLM execution and routing. LLM output never becomes numerical or scientific authority. - `context-graph-contracts` and `enterprise-architecture-core` are read-only to the TEPP writer while their Context Fabric owner loop is active. Open heads are candidate evidence, not released contracts. ### Release integrity - Queued, pending, skipped-required, predecessor-head, self-review, or local-only evidence is non-passing. +- Release requires a clean protected-main integration state, exact protected-head CI/security evidence, claim-scoped scientific/recovery acceptance, reproducible artifacts with SBOM and provenance, validated migration/upgrade/rollback/recovery where applicable, consistent version metadata, an updated current changelog, accessibility and operability evidence for user-facing components, and no unresolved scientific/privacy/security/supply-chain blocker. - No force-push, routine protection bypass, coverage exclusion, fail-open security substitution, or scientific claim promotion is authorized by this changelog. - Deployable Context Graph/EA integration binds only to released/versioned contracts with provenance and passing compatibility evidence; TEPP latent estimates, scores, inferred event relations, and validity evidence are not copied into EA as authoritative architecture facts. From e6d5b29204cb99ef2bc48973ef988177a2e3ee91 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 06:12:53 +0900 Subject: [PATCH 077/235] docs(deps): follow surviving covariance owner contract --- docs/product-technical-gap-baseline.md | 39 +++++++++++++------------- 1 file changed, 20 insertions(+), 19 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 520e2343e..75ab0e3f9 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,11 +1,11 @@ # Product and Technical Gap Baseline -**Status:** Active delivery recovery -**Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-01T20:44:00Z -**Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` -**Workspace version:** `0.2.0` -**Delivery authority:** issue [#175](https://github.com/ContextualWisdomLab/TEPP/issues/175), PR [#435](https://github.com/ContextualWisdomLab/TEPP/pull/435), and [`docs/delivery/pr-queue-authority-2026-09-01.md`](delivery/pr-queue-authority-2026-09-01.md) +**Status:** Active delivery recovery +**Product:** Temporal Event Psychometrics Platform (TEPP) +**Snapshot:** 2026-09-01T21:12:00Z +**Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` +**Workspace version:** `0.2.0` +**Delivery authority:** issue [#175](https://github.com/ContextualWisdomLab/TEPP/issues/175), PR [#435](https://github.com/ContextualWisdomLab/TEPP/pull/435), and [`docs/delivery/pr-queue-authority-2026-09-01.md`](delivery/pr-queue-authority-2026-09-01.md) **DDD authority:** [`docs/architecture/domain-context-map.md`](architecture/domain-context-map.md) and [`docs/architecture/temporal-dependence-composition.md`](architecture/temporal-dependence-composition.md) ## Delivery truth @@ -15,7 +15,7 @@ A planning document, mergeable branch, local test, predecessor-head result, queu | Signal | Current evidence | Delivery implication | | --- | ---: | --- | | Protected `main` | `1bc02f580cf48e1d39da239f0e818453437c31c3` | Capability claims remain bounded to this commit until protected main changes. | -| Open pull requests | **133** | WIP remains release-blocking, but the queue has been reduced from the observed peak of 149 and from the 136-PR regression at the start of this repair slice. | +| Open pull requests | **133** | WIP remains release-blocking, but the queue has been reduced from the observed peak of 149 and from the 136-PR regression repaired in this slice. | | Draft pull requests | **132** | Non-landable work is explicitly parked while consolidated, repaired, or supplied with missing evidence. | | Non-draft pull requests | **1** | #310 is the only current non-Draft landing vehicle. | | Open issues | **15** | Includes #437 for repository-wide ADR identity normalization and #472 for cutoff-safe inferred-status Analysis Run projection. | @@ -24,7 +24,7 @@ A planning document, mergeable branch, local test, predecessor-head result, queu Classic branch protection is not the sole policy source; organization rulesets are effective merge authority where applicable. Any increase in open PR count while #435 remains open is a WIP regression unless the new PR is a demonstrably independent root-cause repair that cannot safely belong to an existing landing vehicle. -The queue regressed to 136 when #476 (`DIFFUSIONstd`) and #477 (`discreteDIFFUSIONstd`) appeared as one-map Drafts under the wrong technical owner `psychometric_core`. Their scientific evidence was verified as folded into #310 under the Longitudinal Modeling bounded context before both predecessors were closed. A second ownership repair closed dirty #272 only after its unique IEEE-754 exact-unit finding was promoted to the canonical reusable owner path, fast-mlsirm PR #1723. TEPP #315 remains Draft as named ctsem/TEPP adapter lineage and is forbidden from landing its duplicate local arithmetic; after an immutable fast-mlsirm release it must become an ACL/adapter and remove the duplicate kernel. The live TEPP queue is now 133. +The queue regressed to 136 when #476 (`DIFFUSIONstd`) and #477 (`discreteDIFFUSIONstd`) appeared as one-map Drafts under the wrong technical owner `psychometric_core`. Their distinct scientific evidence was verified as folded into #310 under Longitudinal Modeling before both predecessors were closed. A second ownership repair retired dirty #272 only after its IEEE-754 exact-unit finding moved to the fast-mlsirm owner lane. Concurrent upstream owner work then converged again: fast-mlsirm #1723 was closed unmerged only after its scalar evidence was preserved in the broader surviving #1722 covariance-standardisation contract. TEPP #315 remains Draft adapter lineage and may not land duplicate local arithmetic. The live TEPP queue is 133. ## Current priority open pull-request evidence @@ -36,9 +36,9 @@ This is a priority subset, not a row-for-row copy of the 133-PR queue. #435 inte | #466 | `71f34b890bbd096eee152947c5e22d9778d323e8` | true | export-retrieval ancestry | Analysis Run / naruon export idempotency lookup + quarantine-parity landing vehicle. | | #464 | `1b3a477242336634be2c7867b29d39979e9a6dca` | true | temporal-context retrieval ancestry | Analysis Run / LineageWeave temporal-context stored-request GET+CLI landing vehicle; re-read before mutation. | | #462 | `c1b7d627167dd7636d2975cc41cec050a5e477ba` | true | main | Bounded source-name compatibility repair; v1 serialized key remains `id`. | -| #420 | `0dc8b48f66b367a90847fcfebd2c6453ff275a1d` | true | main | Project-history query CLI; `fold_into_landing_vehicle` until its unique source/tests are composed into the surviving Analysis Run vehicle. | +| #420 | `0dc8b48f66b367a90847fcfebd2c6453ff275a1d` | true | main | Project-history query CLI; `fold_into_landing_vehicle` until unique source/tests are composed into the surviving Analysis Run vehicle. | | #417 | `1e468f62ec47f3476a7b4d18ed2980451dc425cf` | true | main | Analysis Run / naruon export retrieval GET+CLI landing vehicle; re-read before mutation. | -| #315 | `538f9bd1c76422bc894836b65083c62544330c7c` | true | main | TEPP `TIPREDVARstd` adapter lineage only; blocked on released fast-mlsirm #1723/successor and must remove duplicate arithmetic before landing. | +| #315 | `538f9bd1c76422bc894836b65083c62544330c7c` | true | main | TEPP `TIPREDVARstd` adapter lineage only; blocked on a released fast-mlsirm #1722/successor contract and must remove duplicate arithmetic before landing. | | #310 | `4e7435f6dd232ae8e1e019f1393e7285e32c6527` | false | main | Longitudinal Modeling landing vehicle; contains closed #441 lineage and verified #476/#477 diffusion folds. | Exact current head evidence is authoritative only for the named PR and becomes stale after any source mutation. @@ -54,7 +54,8 @@ Cargo crates, HTTP routes, CLI verbs, refusal rules, clocks, and individual stat | Core | Event Ontology & Temporal Graph | `EventEpisode`, `TemporalRelationSet` | `event_core`, `relation_graph` | | Core | Measurement | `MeasurementSpecification`, `MeasurementRun` | measurement modules + released fast-mlsirm ACL | | Core | Longitudinal Modeling | `TemporalModelSpecification`, `TemporalModelRun` | `longitudinal_core` + temporal/event composition | -| Core | Validation | `ValidationStudy`, `ValidationEvidence` | `validation_core`, `tepp_simulation` | +| Core | Validation Evidence | `ValidationStudy`, `ValidationEvidence` | `validation_core`, `tepp_simulation` | +| Core | Scientific Claim Promotion | `ClaimPromotionDecision` | ADR 0014 policy; consumes validation evidence but does not own estimators or transport | | Supporting | Projection / Analysis Run | `AnalysisRun`, published read models | application services; HTTP/CLI are adapters | | Supporting | Interpretation | evidence-grounded interpretation workflow | contextual-orchestrator ACL only | | Supporting | Persistence & Recovery | repositories and durable receipts | `persistence_postgres`, object-store adapters | @@ -62,7 +63,7 @@ Cargo crates, HTTP routes, CLI verbs, refusal rules, clocks, and individual stat **Canonical owners:** fast-mlsirm owns reusable static/generalized-mixed/dependence-aware psychometric specification and numerical kernels, including reusable covariance standardisation and LSIRM/MLSIRM/DLSJM kernels. TEPP owns temporal/event composition, irregular time, time-varying multilevel/cross-classified/multiple-membership semantics, longitudinal invariance/drift/alignment, and temporal recovery. contextual-orchestrator owns every LLM/provider call and routing decision. Context Graph contracts are a contract-only Shared Kernel; EA Core owns authoritative architecture decisions. No cross-service SQL. -`event_time`, `assertion_time`, `document_time`, `system_time`, `available_time`, and `knowledge_cutoff` remain distinct in code, schemas, and tests. A retrospective source may describe an earlier event but cannot enter an earlier knowledge cutoff. Forward state/transition edges remain distinct from retrospective, citation, revision, and provenance relations. +The six-clock contract keeps event/valid time as one role, followed by assertion time, document time, system time, available time, and knowledge cutoff. A retrospective source may describe an earlier event but cannot enter an earlier knowledge cutoff. Forward state/transition edges remain distinct from retrospective, citation, revision, and provenance relations. ## Temporal/dependence model policy @@ -74,25 +75,25 @@ Auto-expansion is not auto-activation. A numerical standardizer or adapter is no ## Scientific validation invariants -Supported temporal estimators require realistic known-truth recovery: RMSE, bias, interval coverage, convergence and uncertainty calibration, temporal ordering, leakage-safe rolling-origin evaluation, irregular gaps, delayed/retrospective reports, missing occasions, changing memberships, language/source drift, and CPU/GPU parity where applicable. Monte Carlo decisions use simulation uncertainty rather than arbitrary pass percentages. Scientific failure is never hidden with skip, xfail, source rewriting, or coverage exclusions. +Supported temporal estimators require realistic known-truth recovery for every claimed structure. Parameter claims require RMSE, bias, interval/credible-interval coverage, convergence, and uncertainty calibration. Temporal-order, transition, dependency-graph, branch-graph, cluster-transition, or cross-time comparison claims additionally require recovery of that structure and applicable longitudinal measurement-invariance evidence. Leakage-safe rolling-origin evaluation separates event/valid time from available time and tests irregular gaps, delayed or retrospective reports, missing occasions, changing memberships, and relevant language/source drift. CPU/GPU parity is evidence only when the corresponding accelerator path actually runs; skipped or ignored GPU tests do not qualify. Monte Carlo decisions use simulation uncertainty rather than arbitrary pass percentages. Scientific failure is never hidden with skip, xfail, source rewriting, or coverage exclusions. ## Current repairs and blockers -**#310 — Longitudinal Modeling landing vehicle.** Closed predecessor #441 is contained by #310. The invalid one-sided covariance/earlier-variance ratio remains retired; public lagged correlation requires lagged covariance and both marginal variances. `EventTimeInterval` is preserved end-to-end. The surviving branch also contains the source/test evidence from #476/#477 under `longitudinal_core`: continuous and discrete scalar diffusion-standardisation candidates, positive stationary-within admission, subnormal-cancellation repair, scale-invariance tests, signed-zero event-product refusal, interval ordering, and named-estimand refusals. Those maps remain `research_candidate` because the 2017 ctsem summary source does not emit named `DIFFUSIONstd` / `discreteDIFFUSIONstd` matrices. On exact head `4e7435f6dd232ae8e1e019f1393e7285e32c6527`, all review threads returned by the current review-thread query are resolved. Rust Foundation CI, Documentation Quality, SAST Semgrep, and Security Scan are currently queued, and no qualifying independent APPROVE is present; therefore #310 is not mergeable by policy yet. +**#310 — Longitudinal Modeling landing vehicle.** Closed predecessor #441 is contained by #310. The invalid one-sided covariance/earlier-variance ratio remains retired; public lagged correlation requires lagged covariance and both marginal variances. `EventTimeInterval` is preserved end-to-end. The surviving branch also contains source/test evidence folded from #476/#477 under `longitudinal_core`: continuous and discrete scalar diffusion-standardisation candidates, positive stationary-within admission, subnormal-cancellation repair, scale-invariance tests, signed-zero event-product refusal, interval ordering, and named-estimand refusals. Those maps remain `research_candidate` because the 2017 ctsem summary source does not emit named `DIFFUSIONstd` / `discreteDIFFUSIONstd` matrices. On exact head `4e7435f6dd232ae8e1e019f1393e7285e32c6527`, queried review threads are resolved, but Rust Foundation CI, Documentation Quality, SAST Semgrep, and Security Scan are queued and no qualifying independent APPROVE is present. #310 is therefore not mergeable by policy. -**#476/#477 — superseded scientific micro-PRs.** Both Drafts are closed after source-level parity verification against #310. Their immutable discussions and branches remain research lineage; they must not be merged independently. This is the required queue repair pattern: fold unique evidence into the bounded-context owner first, verify parity, then retire the micro-PR. +**#476/#477 — superseded scientific micro-PRs.** Both Drafts are closed after source-level parity verification against #310. Their immutable discussions and branches remain research lineage; they must not be merged independently. This is the queue-repair pattern: fold unique evidence into the bounded-context owner, verify parity, then retire the micro-PR. -**#272/#315 — static-standardisation ownership repair.** #272 is closed after its unique exact-unit binary64 finding was preserved in fast-mlsirm owner PR #1723. #315 remains Draft only to preserve the TEPP-specific `TIPREDVARstd` naming/event-time/refusal contract. It must not merge with duplicate arithmetic. After #1723 or its successor becomes a released/versioned upstream contract, #315 must consume it through an ACL, prove parity, retain TEPP temporal/model admission, and delete wrong-owner production arithmetic before folding into a Measurement/Longitudinal Modeling landing vehicle. +**#272/#315 — static-standardisation ownership repair.** #272 is closed after its exact-unit binary64 finding moved to fast-mlsirm. The narrower upstream #1723 was subsequently closed unmerged because its unique scalar evidence was preserved in surviving fast-mlsirm #1722, whose current candidate contract is `fast_mlsirm.covariance_standardization@1.0.0`. #315 remains Draft only to preserve the TEPP-specific `TIPREDVARstd` naming/event-time/refusal contract. It must not merge with duplicate arithmetic. After #1722 or its successor is merged and released/versioned, #315 must consume that immutable contract through an ACL, prove parity, retain TEPP temporal/model admission, and delete wrong-owner production arithmetic before folding into a Measurement/Longitudinal Modeling landing vehicle. **Dependency-review support.** Where Security Scan fails before Dependency Review because GitHub dependency-graph comparison is unavailable to the workflow token, keep the gate fail-closed. OSV, Trivy, and Scorecard are sibling evidence, not substitutes. Do not weaken TEPP source to manufacture missing control-plane evidence. **Analysis Run adapter/profile proliferation.** Export, interpretation, project-history, inferred-status, and temporal-context HTTP/CLI mechanics are adapters inside supporting contexts. Strict ancestry may be folded without force after exact comparison; diverged siblings require an actual source/test fold. One refusal/profile/route/CLI verb does not create architecture authority. -**#437 — ADR identity.** Repository-wide ADR IDs are immutable authority. Duplicate index IDs, duplicate targets, and duplicate numbered ADR files must fail deterministic documentation fitness tests. Operation-specific ADRs on adapter/model micro-branches are implementation lineage pending normalization, not branch-local architecture authority. +**#437 — ADR identity.** Repository-wide ADR IDs are immutable authority. Duplicate index IDs, duplicate targets, duplicate numbered ADR files, repeated authority declarations, and index/file status or maturity drift must fail deterministic documentation fitness tests. Operation-specific ADRs on adapter/model micro-branches are implementation lineage pending normalization, not branch-local architecture authority. ## Dependency and Context Fabric status -fast-mlsirm PR #1723 is the active canonical-owner candidate for domain-neutral scalar variance standardisation, with Published Language ID `fast_mlsirm.scalar_variance_standardisation@1.0.0`; it is not a TEPP production dependency until merged and released/versioned with required evidence. The generalized-mixed/dependence candidate compiler remains separately owned upstream. TEPP never copies those numerical kernels or contextual-orchestrator provider logic. An upstream open PR head is not a released dependency. A checksum-pinned contextual-orchestrator source advances only after the exact replacement archive digest is reproducibly acquired and reviewed. +fast-mlsirm PR #1722 is the surviving canonical-owner candidate for domain-neutral covariance-to-correlation standardisation at exact head `e1847c07fd7ef8331dcebd0dd588b1381cc1231d`, with Published Language candidate `fast_mlsirm.covariance_standardization@1.0.0`. The narrower #1723 is closed unmerged after unique evidence preservation. Neither open PR heads nor closed predecessor heads are TEPP production dependencies: adoption waits for an immutable released/versioned upstream contract and fresh parity/conformance evidence. The generalized-mixed/dependence candidate compiler remains separately owned upstream. TEPP never copies those numerical kernels or contextual-orchestrator provider logic. A checksum-pinned contextual-orchestrator source advances only after the exact replacement archive digest is reproducibly acquired and reviewed. `context-graph-contracts` and `enterprise-architecture-core` remain read-only to this writer while their dedicated Context Fabric owner loop is active. Open heads are candidate evidence, not released contracts. TEPP may maintain fail-closed conformance fixtures behind candidate/test boundaries, but deployable integration and authoritative EA projection require a released/versioned Context Graph artifact plus passing compatibility evidence. @@ -121,4 +122,4 @@ Queue/ADR/domain authority precedes semantic admission, the Rust CPU f64 shared- Every open PR is classified as `landing_vehicle`, `stacked_dependency`, `fold_into_landing_vehicle`, `superseded`, `duplicate`, `research_lineage_only`, or `blocked_external`. Exact heads must be compared before closure. Strict ancestry permits safe consolidation; diverged siblings require a real code/test fold first. -TEPP has no GitHub release at this snapshot. Release requires a coherent buyer/scientific vertical on protected main, exact-head scientific and security evidence, reproducible package/build provenance and SBOM, upgrade/rollback evidence, and released integration contracts where deployment depends on them. +TEPP has no GitHub release at this snapshot. A release is permitted only after a clean integration state reaches protected main with exact protected-head CI/security evidence, claim-scoped scientific and recovery acceptance, reproducible artifacts with SBOM and provenance, validated migrations/upgrade/rollback/recovery where applicable, consistent version metadata and a current `CHANGELOG.md`, accessibility and operability evidence for user-facing components, no unresolved scientific/privacy/security/supply-chain blockers, and released integration contracts where cross-product deployment depends on them. From 7bce7e41aa13d63d7d65f97258b07b32a9d68011 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 06:14:43 +0900 Subject: [PATCH 078/235] docs(queue): record project-history fold and 132-PR state --- docs/product-technical-gap-baseline.md | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 75ab0e3f9..656070c7a 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -15,8 +15,8 @@ A planning document, mergeable branch, local test, predecessor-head result, queu | Signal | Current evidence | Delivery implication | | --- | ---: | --- | | Protected `main` | `1bc02f580cf48e1d39da239f0e818453437c31c3` | Capability claims remain bounded to this commit until protected main changes. | -| Open pull requests | **133** | WIP remains release-blocking, but the queue has been reduced from the observed peak of 149 and from the 136-PR regression repaired in this slice. | -| Draft pull requests | **132** | Non-landable work is explicitly parked while consolidated, repaired, or supplied with missing evidence. | +| Open pull requests | **132** | WIP remains release-blocking, but the queue has been reduced from the observed peak of 149 and from the 136-PR regression repaired in this slice. | +| Draft pull requests | **131** | Non-landable work is explicitly parked while consolidated, repaired, or supplied with missing evidence. | | Non-draft pull requests | **1** | #310 is the only current non-Draft landing vehicle. | | Open issues | **15** | Includes #437 for repository-wide ADR identity normalization and #472 for cutoff-safe inferred-status Analysis Run projection. | | GitHub releases | **0** | No open head is a released TEPP contract. | @@ -24,11 +24,11 @@ A planning document, mergeable branch, local test, predecessor-head result, queu Classic branch protection is not the sole policy source; organization rulesets are effective merge authority where applicable. Any increase in open PR count while #435 remains open is a WIP regression unless the new PR is a demonstrably independent root-cause repair that cannot safely belong to an existing landing vehicle. -The queue regressed to 136 when #476 (`DIFFUSIONstd`) and #477 (`discreteDIFFUSIONstd`) appeared as one-map Drafts under the wrong technical owner `psychometric_core`. Their distinct scientific evidence was verified as folded into #310 under Longitudinal Modeling before both predecessors were closed. A second ownership repair retired dirty #272 only after its IEEE-754 exact-unit finding moved to the fast-mlsirm owner lane. Concurrent upstream owner work then converged again: fast-mlsirm #1723 was closed unmerged only after its scalar evidence was preserved in the broader surviving #1722 covariance-standardisation contract. TEPP #315 remains Draft adapter lineage and may not land duplicate local arithmetic. The live TEPP queue is 133. +The queue regressed to 136 when #476 (`DIFFUSIONstd`) and #477 (`discreteDIFFUSIONstd`) appeared as one-map Drafts under the wrong technical owner `psychometric_core`. Their distinct scientific evidence was verified as folded into #310 under Longitudinal Modeling before both predecessors were closed. A second ownership repair retired dirty #272 only after its IEEE-754 exact-unit finding moved to the fast-mlsirm owner lane. Concurrent upstream owner work then converged again: fast-mlsirm #1723 was closed unmerged only after its scalar evidence was preserved in the broader surviving #1722 covariance-standardisation contract. TEPP #315 remains Draft adapter lineage and may not land duplicate local arithmetic. #420 is now closed only after its project-history query CLI source, integration tests, changelog fragment and doctoring were folded into the surviving #456 Analysis Run adapter at exact head `5e327b8c6238aa1f3777bac4390be32d58adcfac`. The live TEPP queue is 132. ## Current priority open pull-request evidence -This is a priority subset, not a row-for-row copy of the 133-PR queue. #435 intentionally omits its own SHA because embedding the branch head in a file changed by that same branch would make the evidence self-stale. +This is a priority subset, not a row-for-row copy of the 132-PR queue. #435 intentionally omits its own SHA because embedding the branch head in a file changed by that same branch would make the evidence self-stale. | PR | Exact current head | Draft | Base | Ownership / disposition | | ---: | --- | :---: | --- | --- | @@ -36,7 +36,7 @@ This is a priority subset, not a row-for-row copy of the 133-PR queue. #435 inte | #466 | `71f34b890bbd096eee152947c5e22d9778d323e8` | true | export-retrieval ancestry | Analysis Run / naruon export idempotency lookup + quarantine-parity landing vehicle. | | #464 | `1b3a477242336634be2c7867b29d39979e9a6dca` | true | temporal-context retrieval ancestry | Analysis Run / LineageWeave temporal-context stored-request GET+CLI landing vehicle; re-read before mutation. | | #462 | `c1b7d627167dd7636d2975cc41cec050a5e477ba` | true | main | Bounded source-name compatibility repair; v1 serialized key remains `id`. | -| #420 | `0dc8b48f66b367a90847fcfebd2c6453ff275a1d` | true | main | Project-history query CLI; `fold_into_landing_vehicle` until unique source/tests are composed into the surviving Analysis Run vehicle. | +| #456 | `5e327b8c6238aa1f3777bac4390be32d58adcfac` | true | project-history retrieval ancestry | Analysis Run / LineageWeave project-history landing vehicle; stored-request GET/CLI plus folded #420 query CLI source/tests. | | #417 | `1e468f62ec47f3476a7b4d18ed2980451dc425cf` | true | main | Analysis Run / naruon export retrieval GET+CLI landing vehicle; re-read before mutation. | | #315 | `538f9bd1c76422bc894836b65083c62544330c7c` | true | main | TEPP `TIPREDVARstd` adapter lineage only; blocked on a released fast-mlsirm #1722/successor contract and must remove duplicate arithmetic before landing. | | #310 | `4e7435f6dd232ae8e1e019f1393e7285e32c6527` | false | main | Longitudinal Modeling landing vehicle; contains closed #441 lineage and verified #476/#477 diffusion folds. | @@ -85,6 +85,8 @@ Supported temporal estimators require realistic known-truth recovery for every c **#272/#315 — static-standardisation ownership repair.** #272 is closed after its exact-unit binary64 finding moved to fast-mlsirm. The narrower upstream #1723 was subsequently closed unmerged because its unique scalar evidence was preserved in surviving fast-mlsirm #1722, whose current candidate contract is `fast_mlsirm.covariance_standardization@1.0.0`. #315 remains Draft only to preserve the TEPP-specific `TIPREDVARstd` naming/event-time/refusal contract. It must not merge with duplicate arithmetic. After #1722 or its successor is merged and released/versioned, #315 must consume that immutable contract through an ACL, prove parity, retain TEPP temporal/model admission, and delete wrong-owner production arithmetic before folding into a Measurement/Longitudinal Modeling landing vehicle. +**#420/#456 — project-history adapter consolidation.** #420 is closed as `superseded_by_fold` only after #456 exact head `5e327b8c6238aa1f3777bac4390be32d58adcfac` was verified to contain the original query-CLI implementation blob `4b3dd9950d2328cbb7ed4d32aeb5ee2c19590435`, original integration-test blob `6740078cc42cefbf5d906603d6b55657eb8241d1`, binary registration, changelog evidence and doctoring. #456 must reacquire its own exact-head hosted checks/review; no #420 check evidence transfers. + **Dependency-review support.** Where Security Scan fails before Dependency Review because GitHub dependency-graph comparison is unavailable to the workflow token, keep the gate fail-closed. OSV, Trivy, and Scorecard are sibling evidence, not substitutes. Do not weaken TEPP source to manufacture missing control-plane evidence. **Analysis Run adapter/profile proliferation.** Export, interpretation, project-history, inferred-status, and temporal-context HTTP/CLI mechanics are adapters inside supporting contexts. Strict ancestry may be folded without force after exact comparison; diverged siblings require an actual source/test fold. One refusal/profile/route/CLI verb does not create architecture authority. @@ -101,7 +103,7 @@ fast-mlsirm PR #1722 is the surviving canonical-owner candidate for domain-neutr | ID | Gap | Maturity | Closure evidence | | --- | --- | --- | --- | -| GAP-001 | PR authority fragmented across 133 open PRs | `release-blocking` | coherent landing vehicles, unique evidence preservation, protected-main reduction | +| GAP-001 | PR authority fragmented across 132 open PRs | `release-blocking` | coherent landing vehicles, unique evidence preservation, protected-main reduction | | GAP-002 | multilingual span-grounded semantic/concept admission | `partial` | immutable offsets/layout, language profiles, concept dictionary, invariance/calibration, hostile-input tests | | GAP-003 | shared-latent temporal topic estimator | `partial` | Rust CPU f64 likelihood/uncertainty, relation/time/membership effects, true recovery, fitted candidate-K | | GAP-004 | durable end-to-end Analysis Run | `partial` | idempotent lifecycle, persistence/recovery, estimator-bound artifacts, validation/promotion separation, Compose E2E | From e118080fbf84f45c836b186d6309a1c21d8eb9b9 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 08:13:20 +0900 Subject: [PATCH 079/235] docs(delivery): refresh live queue and repair evidence baseline --- docs/product-technical-gap-baseline.md | 64 +++++++++++++++----------- 1 file changed, 38 insertions(+), 26 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 656070c7a..9374cf680 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-01T21:12:00Z +**Snapshot:** 2026-09-01T23:11:53Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` **Workspace version:** `0.2.0` **Delivery authority:** issue [#175](https://github.com/ContextualWisdomLab/TEPP/issues/175), PR [#435](https://github.com/ContextualWisdomLab/TEPP/pull/435), and [`docs/delivery/pr-queue-authority-2026-09-01.md`](delivery/pr-queue-authority-2026-09-01.md) @@ -10,38 +10,40 @@ ## Delivery truth -A planning document, mergeable branch, local test, predecessor-head result, queued/skipped check, ADR number, or LLM judgment does not make a capability shipped. Passing or queued Checks never promote an open PR to `implemented-main`. +A planning document, mergeable branch, local test, predecessor-head result, queued/skipped check, ADR number, or LLM judgment does not make a capability shipped. Passing or queued checks never promote an open PR to `implemented-main`. | Signal | Current evidence | Delivery implication | | --- | ---: | --- | | Protected `main` | `1bc02f580cf48e1d39da239f0e818453437c31c3` | Capability claims remain bounded to this commit until protected main changes. | -| Open pull requests | **132** | WIP remains release-blocking, but the queue has been reduced from the observed peak of 149 and from the 136-PR regression repaired in this slice. | -| Draft pull requests | **131** | Non-landable work is explicitly parked while consolidated, repaired, or supplied with missing evidence. | +| Open pull requests | **131** | WIP remains release-blocking, but the queue is down from the observed peak of 149. | +| Draft pull requests | **130** | Non-landable work is explicitly parked while consolidated, repaired, or supplied with missing evidence. | | Non-draft pull requests | **1** | #310 is the only current non-Draft landing vehicle. | -| Open issues | **15** | Includes #437 for repository-wide ADR identity normalization and #472 for cutoff-safe inferred-status Analysis Run projection. | +| Open issues | **15** | Includes #437 for repository-wide ADR identity normalization and the active Analysis Run/product gaps. | | GitHub releases | **0** | No open head is a released TEPP contract. | | Effective organization ruleset | `18156473` | Current-head required workflows, resolved conversations, qualifying review, and an allowed merge method remain landing authority. | Classic branch protection is not the sole policy source; organization rulesets are effective merge authority where applicable. Any increase in open PR count while #435 remains open is a WIP regression unless the new PR is a demonstrably independent root-cause repair that cannot safely belong to an existing landing vehicle. -The queue regressed to 136 when #476 (`DIFFUSIONstd`) and #477 (`discreteDIFFUSIONstd`) appeared as one-map Drafts under the wrong technical owner `psychometric_core`. Their distinct scientific evidence was verified as folded into #310 under Longitudinal Modeling before both predecessors were closed. A second ownership repair retired dirty #272 only after its IEEE-754 exact-unit finding moved to the fast-mlsirm owner lane. Concurrent upstream owner work then converged again: fast-mlsirm #1723 was closed unmerged only after its scalar evidence was preserved in the broader surviving #1722 covariance-standardisation contract. TEPP #315 remains Draft adapter lineage and may not land duplicate local arithmetic. #420 is now closed only after its project-history query CLI source, integration tests, changelog fragment and doctoring were folded into the surviving #456 Analysis Run adapter at exact head `5e327b8c6238aa1f3777bac4390be32d58adcfac`. The live TEPP queue is 132. +The queue previously regressed when one-map and one-route Drafts appeared as independently shippable work. Recovery now preserves unique RED/GREEN, review, research and contract evidence on coherent bounded-context landing vehicles before strict ancestors or superseded siblings are closed. The live TEPP queue is **131**. ## Current priority open pull-request evidence -This is a priority subset, not a row-for-row copy of the 132-PR queue. #435 intentionally omits its own SHA because embedding the branch head in a file changed by that same branch would make the evidence self-stale. +This is a priority subset, not a row-for-row copy of the 131-PR queue. #435 intentionally omits its own SHA because embedding the branch head in a file changed by that same branch would make the evidence self-stale. Every row below was re-read before this snapshot. | PR | Exact current head | Draft | Base | Ownership / disposition | | ---: | --- | :---: | --- | --- | -| #469 | `72a7755bcc91b1107560c980ce817eca153126e4` | true | interpretation-run retrieval ancestry | Analysis Run / contextual-orchestrator stored-request + server-id lookup GET/CLI landing vehicle. | -| #466 | `71f34b890bbd096eee152947c5e22d9778d323e8` | true | export-retrieval ancestry | Analysis Run / naruon export idempotency lookup + quarantine-parity landing vehicle. | -| #464 | `1b3a477242336634be2c7867b29d39979e9a6dca` | true | temporal-context retrieval ancestry | Analysis Run / LineageWeave temporal-context stored-request GET+CLI landing vehicle; re-read before mutation. | -| #462 | `c1b7d627167dd7636d2975cc41cec050a5e477ba` | true | main | Bounded source-name compatibility repair; v1 serialized key remains `id`. | -| #456 | `5e327b8c6238aa1f3777bac4390be32d58adcfac` | true | project-history retrieval ancestry | Analysis Run / LineageWeave project-history landing vehicle; stored-request GET/CLI plus folded #420 query CLI source/tests. | -| #417 | `1e468f62ec47f3476a7b4d18ed2980451dc425cf` | true | main | Analysis Run / naruon export retrieval GET+CLI landing vehicle; re-read before mutation. | -| #315 | `538f9bd1c76422bc894836b65083c62544330c7c` | true | main | TEPP `TIPREDVARstd` adapter lineage only; blocked on a released fast-mlsirm #1722/successor contract and must remove duplicate arithmetic before landing. | -| #310 | `4e7435f6dd232ae8e1e019f1393e7285e32c6527` | false | main | Longitudinal Modeling landing vehicle; contains closed #441 lineage and verified #476/#477 diffusion folds. | - -Exact current head evidence is authoritative only for the named PR and becomes stale after any source mutation. +| #473 | `9ae0488e44bc0775b2289c71d83d88c57e660b0d` | true | profile ancestry | Validation / Analysis Run inferred-status refusal profile; `fold_into_landing_vehicle`, not independent architecture authority. | +| #469 | `72a7755bcc91b1107560c980ce817eca153126e4` | true | interpretation-run retrieval ancestry | Analysis Run / contextual-orchestrator interpretation-run retrieval, lookup and stored-request adapter landing vehicle. | +| #466 | `71f34b890bbd096eee152947c5e22d9778d323e8` | true | export-retrieval ancestry | Analysis Run / naruon export idempotency lookup and quarantine-parity landing vehicle. | +| #464 | `1b3a477242336634be2c7867b29d39979e9a6dca` | true | temporal-context retrieval ancestry | Analysis Run / LineageWeave temporal-context stored-request GET+CLI landing vehicle. | +| #462 | `c1b7d627167dd7636d2975cc41cec050a5e477ba` | true | main | Bounded source-name compatibility repair; Rust `node_id`, v1 serialized key remains `id`. | +| #456 | `f02436236a73824c87c6043fc5d1e0b08cb0d448` | true | project-history retrieval ancestry | Analysis Run / LineageWeave project-history landing vehicle; includes folded query CLI evidence. | +| #417 | `1e468f62ec47f3476a7b4d18ed2980451dc425cf` | true | main | Analysis Run / naruon export retrieval GET+CLI landing vehicle. | +| #416 | `d5c9811f3d0547fab811252d27c202d011759048` | true | main | Provisional Validation / Analysis Run simple-refusal landing vehicle; shared admission/artifact invariants plus profile-specific adapters. | +| #315 | `538f9bd1c76422bc894836b65083c62544330c7c` | true | main | TEPP `TIPREDVARstd` adapter lineage only; blocked on a released fast-mlsirm covariance-standardisation contract and removal of duplicate local arithmetic. | +| #310 | `623fb253ba9de67dc3f18743c7c223bad97c0954` | false | main | Longitudinal Modeling landing vehicle; contains repaired lagged correlation, diffusion research candidates, and current CWC deterministic-arithmetic repair. | + +Exact current-head evidence is authoritative only for the named PR and becomes stale after any source mutation. ## Domain ownership @@ -79,15 +81,17 @@ Supported temporal estimators require realistic known-truth recovery for every c ## Current repairs and blockers -**#310 — Longitudinal Modeling landing vehicle.** Closed predecessor #441 is contained by #310. The invalid one-sided covariance/earlier-variance ratio remains retired; public lagged correlation requires lagged covariance and both marginal variances. `EventTimeInterval` is preserved end-to-end. The surviving branch also contains source/test evidence folded from #476/#477 under `longitudinal_core`: continuous and discrete scalar diffusion-standardisation candidates, positive stationary-within admission, subnormal-cancellation repair, scale-invariance tests, signed-zero event-product refusal, interval ordering, and named-estimand refusals. Those maps remain `research_candidate` because the 2017 ctsem summary source does not emit named `DIFFUSIONstd` / `discreteDIFFUSIONstd` matrices. On exact head `4e7435f6dd232ae8e1e019f1393e7285e32c6527`, queried review threads are resolved, but Rust Foundation CI, Documentation Quality, SAST Semgrep, and Security Scan are queued and no qualifying independent APPROVE is present. #310 is therefore not mergeable by policy. +**#310 — Longitudinal Modeling landing vehicle.** Closed predecessor #441 is contained by #310. The invalid one-sided covariance/earlier-variance ratio remains retired; public lagged correlation requires lagged covariance and both marginal variances. `EventTimeInterval` is preserved end-to-end. This run found a new deterministic-arithmetic defect in CWC processing: unit scores were accumulated before event-time sorting, so input-row permutation could alter low-order floating centering results. RED `fb784f103ddb6fc69b7ffbf13df0e8f62bf007cb` proves the permutation failure. GREEN `e9e6a409acf6eac0b1e0ba24a73c8f7325fae391` sorts per-unit observations before mean accumulation and then forms chronological lag pairs. ADR/source-hygiene follow-up `623fb253ba9de67dc3f18743c7c223bad97c0954` preserves readable ADR metadata without trailing-space hard breaks and qualifies the already-centered `(1, 0.5)` mapping as `ln(0.5)` only at `Δt = 1`. + +#310 is not mergeable yet. The exact head `623fb253ba9de67dc3f18743c7c223bad97c0954` has fresh Rust Foundation CI, Documentation Quality, Security Scan, and SAST Semgrep runs queued. One CodeRabbit documentation conversation also remains valid: `docs/research/multilevel-event-time-recovery.md` and `CLAUDE.md` must state that `(1, 0.5)` maps to `ln(0.5) / Δt` generally and equals `ln(0.5)` only for unit event time. The local source-access date `2026-09-02` is retained as truthful local evidence rather than rewritten to satisfy a reviewer generated on the prior UTC date. Current-head qualifying independent approval is also required. -**#476/#477 — superseded scientific micro-PRs.** Both Drafts are closed after source-level parity verification against #310. Their immutable discussions and branches remain research lineage; they must not be merged independently. This is the queue-repair pattern: fold unique evidence into the bounded-context owner, verify parity, then retire the micro-PR. +The surviving branch also contains source/test evidence folded from #476/#477 under `longitudinal_core`: continuous and discrete scalar diffusion-standardisation candidates, positive stationary-within admission, subnormal-cancellation repair, scale-invariance tests, signed-zero event-product refusal, interval ordering, and named-estimand refusals. Those maps remain `research_candidate` because the 2017 ctsem summary source does not emit named `DIFFUSIONstd` / `discreteDIFFUSIONstd` matrices. -**#272/#315 — static-standardisation ownership repair.** #272 is closed after its exact-unit binary64 finding moved to fast-mlsirm. The narrower upstream #1723 was subsequently closed unmerged because its unique scalar evidence was preserved in surviving fast-mlsirm #1722, whose current candidate contract is `fast_mlsirm.covariance_standardization@1.0.0`. #315 remains Draft only to preserve the TEPP-specific `TIPREDVARstd` naming/event-time/refusal contract. It must not merge with duplicate arithmetic. After #1722 or its successor is merged and released/versioned, #315 must consume that immutable contract through an ACL, prove parity, retain TEPP temporal/model admission, and delete wrong-owner production arithmetic before folding into a Measurement/Longitudinal Modeling landing vehicle. +**#416 and sibling simple-refusal profiles.** #416 is the provisional Validation / Analysis Run landing vehicle. Compatible style/prompt/modality/background/citation/copied-text/location/membership-target/outcome-order/relation-absence/episode-membership/inferred-status profiles must preserve unique refusal vocabulary, cutoff behavior, tests and evidence while sharing execution/artifact-count/output-size invariants. #473 is explicitly `fold_into_landing_vehicle`; it is not independently shippable. -**#420/#456 — project-history adapter consolidation.** #420 is closed as `superseded_by_fold` only after #456 exact head `5e327b8c6238aa1f3777bac4390be32d58adcfac` was verified to contain the original query-CLI implementation blob `4b3dd9950d2328cbb7ed4d32aeb5ee2c19590435`, original integration-test blob `6740078cc42cefbf5d906603d6b55657eb8241d1`, binary registration, changelog evidence and doctoring. #456 must reacquire its own exact-head hosted checks/review; no #420 check evidence transfers. +**#315 — static-standardisation ownership repair.** #315 remains Draft only to preserve TEPP-specific `TIPREDVARstd` naming/event-time/refusal semantics. It must not merge with duplicate reusable arithmetic. After fast-mlsirm #1722 or its live successor is merged and released/versioned, #315 must consume that immutable contract through an ACL, prove parity, retain TEPP temporal/model admission, delete wrong-owner production arithmetic, and fold into a Measurement/Longitudinal Modeling landing vehicle. -**Dependency-review support.** Where Security Scan fails before Dependency Review because GitHub dependency-graph comparison is unavailable to the workflow token, keep the gate fail-closed. OSV, Trivy, and Scorecard are sibling evidence, not substitutes. Do not weaken TEPP source to manufacture missing control-plane evidence. +**Dependency-review support.** An earlier #310 head failed central Security Scan before Dependency Review because GitHub dependency-graph comparison was unavailable to the workflow token. That is predecessor evidence, not a permanent current-head exemption. The gate remains fail-closed; OSV, Trivy and Scorecard are sibling evidence, not substitutes. Current head `623fb253...` must obtain its own terminal Security Scan. **Analysis Run adapter/profile proliferation.** Export, interpretation, project-history, inferred-status, and temporal-context HTTP/CLI mechanics are adapters inside supporting contexts. Strict ancestry may be folded without force after exact comparison; diverged siblings require an actual source/test fold. One refusal/profile/route/CLI verb does not create architecture authority. @@ -95,15 +99,22 @@ Supported temporal estimators require realistic known-truth recovery for every c ## Dependency and Context Fabric status -fast-mlsirm PR #1722 is the surviving canonical-owner candidate for domain-neutral covariance-to-correlation standardisation at exact head `e1847c07fd7ef8331dcebd0dd588b1381cc1231d`, with Published Language candidate `fast_mlsirm.covariance_standardization@1.0.0`. The narrower #1723 is closed unmerged after unique evidence preservation. Neither open PR heads nor closed predecessor heads are TEPP production dependencies: adoption waits for an immutable released/versioned upstream contract and fresh parity/conformance evidence. The generalized-mixed/dependence candidate compiler remains separately owned upstream. TEPP never copies those numerical kernels or contextual-orchestrator provider logic. A checksum-pinned contextual-orchestrator source advances only after the exact replacement archive digest is reproducibly acquired and reviewed. +The fast-mlsirm generalized-mixed/dependence compiler remains PR #1714 at exact head `6abdcc2acab7be463977e35191566119e384c906`. It publishes typed response/dimensional/generalized-mixed/dependence identities, typed membership topology and weight authority, formulation-scoped promotion evidence, and deterministic candidate manifest `fast_mlsirm.model_specification.candidate_manifest@1.0.0` with SHA-256 digest. All visible substantive review conversations are resolved, but exact-head CI is pending and Security/SAST/CodeQL are queued. It is not a released TEPP dependency. + +TEPP protected main checksum-pins contextual-orchestrator commit `e226e1197bdfc890c9d8e5b9b648c78857d7e465` with SHA-256 `964b22ff577e3862b761af847ccad65489bb3f8fc750c8f84fcf8628df096673`. Upstream protected `main` is now `4d143601c2904a28e95d091b261c0a15e9a4f283`, which merged the Bytez zero-price ranking repair. Advancing TEPP requires a reproducible archive digest and review of the exact replacement; removing checksum validation or pinning an unverified digest is prohibited. + +`context-graph-contracts` and `enterprise-architecture-core` remain read-only to this writer while their dedicated Context Fabric owner loop is active. Fresh state is: + +- context-graph-contracts default/protected `develop@99cb5468ba3c15c5e79688f53dee74724fae2d13`, 13 open PRs, zero releases. The current Context Assertion/CloudEvent envelope work remains unreleased candidate work. +- enterprise-architecture-core default/protected `develop@1c0fa8b15ceb9e72186274aeb255d6777eb84ef4`, 25 open PRs, zero releases. -`context-graph-contracts` and `enterprise-architecture-core` remain read-only to this writer while their dedicated Context Fabric owner loop is active. Open heads are candidate evidence, not released contracts. TEPP may maintain fail-closed conformance fixtures behind candidate/test boundaries, but deployable integration and authoritative EA projection require a released/versioned Context Graph artifact plus passing compatibility evidence. +Open heads are candidate evidence, not released contracts. TEPP may maintain fail-closed conformance fixtures behind candidate/test boundaries, but deployable integration and authoritative EA projection require a released/versioned Context Graph artifact plus passing compatibility evidence. TEPP latent estimates, measurement scores, inferred event relations and validity evidence do not become authoritative EA facts. ## Gap register | ID | Gap | Maturity | Closure evidence | | --- | --- | --- | --- | -| GAP-001 | PR authority fragmented across 132 open PRs | `release-blocking` | coherent landing vehicles, unique evidence preservation, protected-main reduction | +| GAP-001 | PR authority fragmented across 131 open PRs | `release-blocking` | coherent landing vehicles, unique evidence preservation, protected-main reduction | | GAP-002 | multilingual span-grounded semantic/concept admission | `partial` | immutable offsets/layout, language profiles, concept dictionary, invariance/calibration, hostile-input tests | | GAP-003 | shared-latent temporal topic estimator | `partial` | Rust CPU f64 likelihood/uncertainty, relation/time/membership effects, true recovery, fitted candidate-K | | GAP-004 | durable end-to-end Analysis Run | `partial` | idempotent lifecycle, persistence/recovery, estimator-bound artifacts, validation/promotion separation, Compose E2E | @@ -116,7 +127,8 @@ fast-mlsirm PR #1722 is the surviving canonical-owner candidate for domain-neutr | GAP-011 | operable multi-tenant release | `accepted-target` | OIDC/RLS/purpose controls, durable queue/storage, OTel/SLO, restore/load/migration, signed SBOM/provenance | | GAP-012 | paths obscure domain ownership | `active-refactor` | staged moves, ACLs, no cycles/cross-context persistence/shared-kernel creep | | GAP-013 | ADR identity collisions | `release-integrity` | unique repository-wide identity, deterministic duplicate detection, supersession lineage | -| GAP-014 | dependency-review evidence unavailable | `blocked_external` | authorized dependency-graph availability, pinned Dependency Review execution, exact-head Security Scan GREEN, no fail-open bypass | +| GAP-014 | dependency-review evidence unavailable on predecessor heads | `external-control-risk` | authorized dependency-graph availability, pinned Dependency Review execution, exact-current Security Scan GREEN, no fail-open bypass | +| GAP-015 | contextual-orchestrator pin behind protected upstream | `supply-chain-pinned` | reproducible replacement archive SHA-256, exact diff/review, pinned TEPP adoption | ## Delivery and release order From a21948b54d54817beaca0eb78e5f7f8a15d6504a Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 09:09:37 +0900 Subject: [PATCH 080/235] docs(delivery): refresh exact-head repair authority --- docs/product-technical-gap-baseline.md | 32 +++++++++++++++----------- 1 file changed, 18 insertions(+), 14 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 9374cf680..112030ef1 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-01T23:11:53Z +**Snapshot:** 2026-09-02T00:05Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` **Workspace version:** `0.2.0` **Delivery authority:** issue [#175](https://github.com/ContextualWisdomLab/TEPP/issues/175), PR [#435](https://github.com/ContextualWisdomLab/TEPP/pull/435), and [`docs/delivery/pr-queue-authority-2026-09-01.md`](delivery/pr-queue-authority-2026-09-01.md) @@ -18,13 +18,13 @@ A planning document, mergeable branch, local test, predecessor-head result, queu | Open pull requests | **131** | WIP remains release-blocking, but the queue is down from the observed peak of 149. | | Draft pull requests | **130** | Non-landable work is explicitly parked while consolidated, repaired, or supplied with missing evidence. | | Non-draft pull requests | **1** | #310 is the only current non-Draft landing vehicle. | -| Open issues | **15** | Includes #437 for repository-wide ADR identity normalization and the active Analysis Run/product gaps. | +| Open issues | **15** | Includes #437 for repository-wide ADR identity normalization and active Analysis Run/product gaps. | | GitHub releases | **0** | No open head is a released TEPP contract. | | Effective organization ruleset | `18156473` | Current-head required workflows, resolved conversations, qualifying review, and an allowed merge method remain landing authority. | Classic branch protection is not the sole policy source; organization rulesets are effective merge authority where applicable. Any increase in open PR count while #435 remains open is a WIP regression unless the new PR is a demonstrably independent root-cause repair that cannot safely belong to an existing landing vehicle. -The queue previously regressed when one-map and one-route Drafts appeared as independently shippable work. Recovery now preserves unique RED/GREEN, review, research and contract evidence on coherent bounded-context landing vehicles before strict ancestors or superseded siblings are closed. The live TEPP queue is **131**. +The queue previously regressed when one-map and one-route Drafts appeared as independently shippable work. Recovery preserves unique RED/GREEN, review, research, and contract evidence on coherent bounded-context landing vehicles before strict ancestors or superseded siblings are closed. The live TEPP queue is **131**. ## Current priority open pull-request evidence @@ -33,15 +33,15 @@ This is a priority subset, not a row-for-row copy of the 131-PR queue. #435 inte | PR | Exact current head | Draft | Base | Ownership / disposition | | ---: | --- | :---: | --- | --- | | #473 | `9ae0488e44bc0775b2289c71d83d88c57e660b0d` | true | profile ancestry | Validation / Analysis Run inferred-status refusal profile; `fold_into_landing_vehicle`, not independent architecture authority. | -| #469 | `72a7755bcc91b1107560c980ce817eca153126e4` | true | interpretation-run retrieval ancestry | Analysis Run / contextual-orchestrator interpretation-run retrieval, lookup and stored-request adapter landing vehicle. | +| #469 | `72a7755bcc91b1107560c980ce817eca153126e4` | true | interpretation-run retrieval ancestry | Analysis Run / contextual-orchestrator interpretation-run retrieval, lookup, and stored-request adapter landing vehicle. | | #466 | `71f34b890bbd096eee152947c5e22d9778d323e8` | true | export-retrieval ancestry | Analysis Run / naruon export idempotency lookup and quarantine-parity landing vehicle. | | #464 | `1b3a477242336634be2c7867b29d39979e9a6dca` | true | temporal-context retrieval ancestry | Analysis Run / LineageWeave temporal-context stored-request GET+CLI landing vehicle. | | #462 | `c1b7d627167dd7636d2975cc41cec050a5e477ba` | true | main | Bounded source-name compatibility repair; Rust `node_id`, v1 serialized key remains `id`. | | #456 | `f02436236a73824c87c6043fc5d1e0b08cb0d448` | true | project-history retrieval ancestry | Analysis Run / LineageWeave project-history landing vehicle; includes folded query CLI evidence. | | #417 | `1e468f62ec47f3476a7b4d18ed2980451dc425cf` | true | main | Analysis Run / naruon export retrieval GET+CLI landing vehicle. | -| #416 | `d5c9811f3d0547fab811252d27c202d011759048` | true | main | Provisional Validation / Analysis Run simple-refusal landing vehicle; shared admission/artifact invariants plus profile-specific adapters. | +| #416 | `a6ba5d79c8d9acc1e7b4a53b3be5ef3d70ab19e7` | true | main | Provisional Validation / Analysis Run simple-refusal landing vehicle; shared admission/artifact invariants plus profile-specific adapters. | | #315 | `538f9bd1c76422bc894836b65083c62544330c7c` | true | main | TEPP `TIPREDVARstd` adapter lineage only; blocked on a released fast-mlsirm covariance-standardisation contract and removal of duplicate local arithmetic. | -| #310 | `623fb253ba9de67dc3f18743c7c223bad97c0954` | false | main | Longitudinal Modeling landing vehicle; contains repaired lagged correlation, diffusion research candidates, and current CWC deterministic-arithmetic repair. | +| #310 | `af767e1bb9ab27c71023e0c3f4be1bb0918dd20f` | false | main | Longitudinal Modeling landing vehicle; repaired lagged correlation, diffusion research candidates, and full-range stable CWC mean arithmetic. | Exact current-head evidence is authoritative only for the named PR and becomes stale after any source mutation. @@ -81,17 +81,21 @@ Supported temporal estimators require realistic known-truth recovery for every c ## Current repairs and blockers -**#310 — Longitudinal Modeling landing vehicle.** Closed predecessor #441 is contained by #310. The invalid one-sided covariance/earlier-variance ratio remains retired; public lagged correlation requires lagged covariance and both marginal variances. `EventTimeInterval` is preserved end-to-end. This run found a new deterministic-arithmetic defect in CWC processing: unit scores were accumulated before event-time sorting, so input-row permutation could alter low-order floating centering results. RED `fb784f103ddb6fc69b7ffbf13df0e8f62bf007cb` proves the permutation failure. GREEN `e9e6a409acf6eac0b1e0ba24a73c8f7325fae391` sorts per-unit observations before mean accumulation and then forms chronological lag pairs. ADR/source-hygiene follow-up `623fb253ba9de67dc3f18743c7c223bad97c0954` preserves readable ADR metadata without trailing-space hard breaks and qualifies the already-centered `(1, 0.5)` mapping as `ln(0.5)` only at `Δt = 1`. +**#310 — Longitudinal Modeling landing vehicle.** Closed predecessor #441 is contained by #310. The invalid one-sided covariance/earlier-variance ratio remains retired; public lagged Pearson correlation requires lagged covariance and both occasion-specific marginal variances. `EventTimeInterval` is preserved end-to-end. Earlier RED/GREEN slices already repaired event-order-sensitive CWC accumulation and the `ln(0.5) / Δt` documentation boundary. -#310 is not mergeable yet. The exact head `623fb253ba9de67dc3f18743c7c223bad97c0954` has fresh Rust Foundation CI, Documentation Quality, Security Scan, and SAST Semgrep runs queued. One CodeRabbit documentation conversation also remains valid: `docs/research/multilevel-event-time-recovery.md` and `CLAUDE.md` must state that `(1, 0.5)` maps to `ln(0.5) / Δt` generally and equals `ln(0.5)` only for unit event time. The local source-access date `2026-09-02` is retained as truthful local evidence rather than rewritten to satisfy a reviewer generated on the prior UTC date. Current-head qualifying independent approval is also required. +The current run found a further numerical-stability defect in pairwise irregular-residual mean recovery. Largest-magnitude normalization could erase a representable low-order contribution before cancellation when very large positive and negative finite rates coexist with a much smaller finite rate. RED `0057b85a8467b9c904aaa20ffe79462aa3339786` reproduces the full binary64 exponent-range loss. GREEN `af767e1bb9ab27c71023e0c3f4be1bb0918dd20f` replaces the largest-magnitude scaling path. Mixed-sign means use an exact power-of-two divisor sized to the larger sign population plus Neumaier compensation, while same-sign finite inputs use a convex running mean whose intermediate remains inside the observed finite range. The branch-local contract includes `[f64::MAX, 1e-16, -f64::MAX]` with bit-for-bit `1e-16/3` recovery, negative same-sign coverage, and empty/non-finite fail-closed behavior. The corresponding substantive review thread is resolved on the current head. + +#310 is still not landable. Exact head `af767e1bb9ab27c71023e0c3f4be1bb0918dd20f` has fresh Rust Foundation CI and SAST Semgrep queued, Documentation Quality pending, and Security Scan queued. Queued/pending evidence is non-passing. There is no qualifying current-head independent `APPROVED` review. The exact-head verification conversation remains intentionally unresolved until the required workflows terminate successfully and review policy is satisfied. The surviving branch also contains source/test evidence folded from #476/#477 under `longitudinal_core`: continuous and discrete scalar diffusion-standardisation candidates, positive stationary-within admission, subnormal-cancellation repair, scale-invariance tests, signed-zero event-product refusal, interval ordering, and named-estimand refusals. Those maps remain `research_candidate` because the 2017 ctsem summary source does not emit named `DIFFUSIONstd` / `discreteDIFFUSIONstd` matrices. -**#416 and sibling simple-refusal profiles.** #416 is the provisional Validation / Analysis Run landing vehicle. Compatible style/prompt/modality/background/citation/copied-text/location/membership-target/outcome-order/relation-absence/episode-membership/inferred-status profiles must preserve unique refusal vocabulary, cutoff behavior, tests and evidence while sharing execution/artifact-count/output-size invariants. #473 is explicitly `fold_into_landing_vehicle`; it is not independently shippable. +**#416 and sibling simple-refusal profiles.** #416 is the provisional Validation / Analysis Run landing vehicle. Its current head `a6ba5d79c8d9acc1e7b4a53b3be5ef3d70ab19e7` keeps the already-repaired `MAX_EVIDENCE_UNITS` execution/artifact bound before identity-set growth and adds a fresh temporal-admission repair. RED `b7312eed81e25aba586323be058077dabc38a2df` proves that equivalent RFC 3339 spellings such as `2026-08-01T09:00:00+09:00` and `2026-08-01T00:00:00Z` were incorrectly rejected when request cutoff text was compared directly. GREEN `a6ba5d79c8d9acc1e7b4a53b3be5ef3d70ab19e7` parses the request cutoff into `KnowledgeCutoff` and compares `instant()` values, retaining genuine cutoff/profile/model mismatch refusal. The stale oversize-census thread and the equivalent-offset thread are resolved after current-source verification. Fresh exact-head Rust, Documentation, Security, and SAST workflows are queued, so #416 remains Draft and must not independently land ahead of consolidation. + +Compatible style/prompt/modality/background/citation/copied-text/location/membership-target/outcome-order/relation-absence/episode-membership/inferred-status profiles must preserve unique refusal vocabulary, cutoff behavior, tests, and evidence while sharing execution/artifact-count/output-size invariants. #473 is explicitly `fold_into_landing_vehicle`; it is not independently shippable. **#315 — static-standardisation ownership repair.** #315 remains Draft only to preserve TEPP-specific `TIPREDVARstd` naming/event-time/refusal semantics. It must not merge with duplicate reusable arithmetic. After fast-mlsirm #1722 or its live successor is merged and released/versioned, #315 must consume that immutable contract through an ACL, prove parity, retain TEPP temporal/model admission, delete wrong-owner production arithmetic, and fold into a Measurement/Longitudinal Modeling landing vehicle. -**Dependency-review support.** An earlier #310 head failed central Security Scan before Dependency Review because GitHub dependency-graph comparison was unavailable to the workflow token. That is predecessor evidence, not a permanent current-head exemption. The gate remains fail-closed; OSV, Trivy and Scorecard are sibling evidence, not substitutes. Current head `623fb253...` must obtain its own terminal Security Scan. +**Dependency-review support.** An earlier #310 head failed central Security Scan before Dependency Review because GitHub dependency-graph comparison was unavailable to the workflow token. That is predecessor evidence, not a permanent current-head exemption. The gate remains fail-closed; OSV, Trivy, and Scorecard are sibling evidence, not substitutes. Current head `af767e1bb9ab27c71023e0c3f4be1bb0918dd20f` must obtain its own terminal Security Scan. **Analysis Run adapter/profile proliferation.** Export, interpretation, project-history, inferred-status, and temporal-context HTTP/CLI mechanics are adapters inside supporting contexts. Strict ancestry may be folded without force after exact comparison; diverged siblings require an actual source/test fold. One refusal/profile/route/CLI verb does not create architecture authority. @@ -101,14 +105,14 @@ The surviving branch also contains source/test evidence folded from #476/#477 un The fast-mlsirm generalized-mixed/dependence compiler remains PR #1714 at exact head `6abdcc2acab7be463977e35191566119e384c906`. It publishes typed response/dimensional/generalized-mixed/dependence identities, typed membership topology and weight authority, formulation-scoped promotion evidence, and deterministic candidate manifest `fast_mlsirm.model_specification.candidate_manifest@1.0.0` with SHA-256 digest. All visible substantive review conversations are resolved, but exact-head CI is pending and Security/SAST/CodeQL are queued. It is not a released TEPP dependency. -TEPP protected main checksum-pins contextual-orchestrator commit `e226e1197bdfc890c9d8e5b9b648c78857d7e465` with SHA-256 `964b22ff577e3862b761af847ccad65489bb3f8fc750c8f84fcf8628df096673`. Upstream protected `main` is now `4d143601c2904a28e95d091b261c0a15e9a4f283`, which merged the Bytez zero-price ranking repair. Advancing TEPP requires a reproducible archive digest and review of the exact replacement; removing checksum validation or pinning an unverified digest is prohibited. +TEPP protected main checksum-pins contextual-orchestrator commit `e226e1197bdfc890c9d8e5b9b648c78857d7e465` with SHA-256 `964b22ff577e3862b761af847ccad65489bb3f8fc750c8f84fcf8628df096673`. Upstream protected `main` is `4d143601c2904a28e95d091b261c0a15e9a4f283`, which merged the Bytez zero-price ranking repair. Advancing TEPP requires a reproducible replacement archive digest and review of the exact replacement; removing checksum validation or pinning an unverified digest is prohibited. `context-graph-contracts` and `enterprise-architecture-core` remain read-only to this writer while their dedicated Context Fabric owner loop is active. Fresh state is: -- context-graph-contracts default/protected `develop@99cb5468ba3c15c5e79688f53dee74724fae2d13`, 13 open PRs, zero releases. The current Context Assertion/CloudEvent envelope work remains unreleased candidate work. -- enterprise-architecture-core default/protected `develop@1c0fa8b15ceb9e72186274aeb255d6777eb84ef4`, 25 open PRs, zero releases. +- context-graph-contracts default/protected `develop@99cb5468ba3c15c5e79688f53dee74724fae2d13`, 13 open PRs, zero releases. Current Context Assertion/CloudEvent envelope work remains unreleased candidate work. +- enterprise-architecture-core default/protected `develop@1c0fa8b15ceb9e72186274aeb255d6777eb84ef4`, 24 open PRs, zero releases. -Open heads are candidate evidence, not released contracts. TEPP may maintain fail-closed conformance fixtures behind candidate/test boundaries, but deployable integration and authoritative EA projection require a released/versioned Context Graph artifact plus passing compatibility evidence. TEPP latent estimates, measurement scores, inferred event relations and validity evidence do not become authoritative EA facts. +Open heads are candidate evidence, not released contracts. TEPP may maintain fail-closed conformance fixtures behind candidate/test boundaries, but deployable integration and authoritative EA projection require a released/versioned Context Graph artifact plus passing compatibility evidence. TEPP latent estimates, measurement scores, inferred event relations, and validity evidence do not become authoritative EA facts. ## Gap register From 65df32ec360f2707789e5c411c412202ce2d46a2 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 09:16:03 +0900 Subject: [PATCH 081/235] docs(delivery): record subnormal cancellation repair --- docs/product-technical-gap-baseline.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 112030ef1..0b0af9af3 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-02T00:05Z +**Snapshot:** 2026-09-02T00:15Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` **Workspace version:** `0.2.0` **Delivery authority:** issue [#175](https://github.com/ContextualWisdomLab/TEPP/issues/175), PR [#435](https://github.com/ContextualWisdomLab/TEPP/pull/435), and [`docs/delivery/pr-queue-authority-2026-09-01.md`](delivery/pr-queue-authority-2026-09-01.md) @@ -41,7 +41,7 @@ This is a priority subset, not a row-for-row copy of the 131-PR queue. #435 inte | #417 | `1e468f62ec47f3476a7b4d18ed2980451dc425cf` | true | main | Analysis Run / naruon export retrieval GET+CLI landing vehicle. | | #416 | `a6ba5d79c8d9acc1e7b4a53b3be5ef3d70ab19e7` | true | main | Provisional Validation / Analysis Run simple-refusal landing vehicle; shared admission/artifact invariants plus profile-specific adapters. | | #315 | `538f9bd1c76422bc894836b65083c62544330c7c` | true | main | TEPP `TIPREDVARstd` adapter lineage only; blocked on a released fast-mlsirm covariance-standardisation contract and removal of duplicate local arithmetic. | -| #310 | `af767e1bb9ab27c71023e0c3f4be1bb0918dd20f` | false | main | Longitudinal Modeling landing vehicle; repaired lagged correlation, diffusion research candidates, and full-range stable CWC mean arithmetic. | +| #310 | `3132a0818455c982f211a7f170fdf2b8db63fa7b` | false | main | Longitudinal Modeling landing vehicle; repaired lagged correlation, diffusion research candidates, and mixed-sign full-range/subnormal-safe CWC mean arithmetic. | Exact current-head evidence is authoritative only for the named PR and becomes stale after any source mutation. @@ -81,21 +81,21 @@ Supported temporal estimators require realistic known-truth recovery for every c ## Current repairs and blockers -**#310 — Longitudinal Modeling landing vehicle.** Closed predecessor #441 is contained by #310. The invalid one-sided covariance/earlier-variance ratio remains retired; public lagged Pearson correlation requires lagged covariance and both occasion-specific marginal variances. `EventTimeInterval` is preserved end-to-end. Earlier RED/GREEN slices already repaired event-order-sensitive CWC accumulation and the `ln(0.5) / Δt` documentation boundary. +**#310 — Longitudinal Modeling landing vehicle.** Closed predecessor #441 is contained by #310. The invalid one-sided covariance/earlier-variance ratio remains retired; public lagged Pearson correlation requires lagged covariance and both occasion-specific marginal variances. `EventTimeInterval` is preserved end-to-end. Earlier RED/GREEN slices repaired event-order-sensitive CWC accumulation, stationary/diffusion edge arithmetic, and the `ln(0.5) / Δt` documentation boundary. -The current run found a further numerical-stability defect in pairwise irregular-residual mean recovery. Largest-magnitude normalization could erase a representable low-order contribution before cancellation when very large positive and negative finite rates coexist with a much smaller finite rate. RED `0057b85a8467b9c904aaa20ffe79462aa3339786` reproduces the full binary64 exponent-range loss. GREEN `af767e1bb9ab27c71023e0c3f4be1bb0918dd20f` replaces the largest-magnitude scaling path. Mixed-sign means use an exact power-of-two divisor sized to the larger sign population plus Neumaier compensation, while same-sign finite inputs use a convex running mean whose intermediate remains inside the observed finite range. The branch-local contract includes `[f64::MAX, 1e-16, -f64::MAX]` with bit-for-bit `1e-16/3` recovery, negative same-sign coverage, and empty/non-finite fail-closed behavior. The corresponding substantive review thread is resolved on the current head. +The current arithmetic repair progressed through two additional RED/GREEN slices. RED `0057b85a8467b9c904aaa20ffe79462aa3339786` showed that largest-magnitude normalization could erase a representable low-order contribution when near-maximum positive and negative rates cancelled. GREEN `af767e1bb9ab27c71023e0c3f4be1bb0918dd20f` removed that magnitude normalization, but fresh review found its count-derived power-of-two pre-scaling could still divide positive subnormal terms to zero before cancellation. RED `203a926680f52cf0a75de909247e6ad5db237403` reproduces the remaining defect with two positive subnormal rates bracketed by opposing extreme finite rates. GREEN `3132a0818455c982f211a7f170fdf2b8db63fa7b` removes mixed-sign pre-scaling entirely: values are partitioned by sign, ordered from largest magnitude down, opposite signs are cancelled first without overflow, and surviving same-sign residuals are averaged by the bounded convex path and weighted to the original sample count. The internal contract includes `[f64::MAX, 2*min_subnormal, 2*min_subnormal, -f64::MAX] -> min_subnormal`, plus previous full-range, same-sign-overflow, zero, empty, and non-finite cases. The two substantive cancellation review threads are resolved on the current source. -#310 is still not landable. Exact head `af767e1bb9ab27c71023e0c3f4be1bb0918dd20f` has fresh Rust Foundation CI and SAST Semgrep queued, Documentation Quality pending, and Security Scan queued. Queued/pending evidence is non-passing. There is no qualifying current-head independent `APPROVED` review. The exact-head verification conversation remains intentionally unresolved until the required workflows terminate successfully and review policy is satisfied. +#310 is still not landable. Exact head `3132a0818455c982f211a7f170fdf2b8db63fa7b` has fresh Rust Foundation CI, Documentation Quality, Security Scan, and SAST Semgrep queued. Queued evidence is non-passing. There is no qualifying current-head independent `APPROVED` review. The exact-head verification conversation remains intentionally unresolved until the required workflows terminate successfully and review policy is satisfied. The surviving branch also contains source/test evidence folded from #476/#477 under `longitudinal_core`: continuous and discrete scalar diffusion-standardisation candidates, positive stationary-within admission, subnormal-cancellation repair, scale-invariance tests, signed-zero event-product refusal, interval ordering, and named-estimand refusals. Those maps remain `research_candidate` because the 2017 ctsem summary source does not emit named `DIFFUSIONstd` / `discreteDIFFUSIONstd` matrices. -**#416 and sibling simple-refusal profiles.** #416 is the provisional Validation / Analysis Run landing vehicle. Its current head `a6ba5d79c8d9acc1e7b4a53b3be5ef3d70ab19e7` keeps the already-repaired `MAX_EVIDENCE_UNITS` execution/artifact bound before identity-set growth and adds a fresh temporal-admission repair. RED `b7312eed81e25aba586323be058077dabc38a2df` proves that equivalent RFC 3339 spellings such as `2026-08-01T09:00:00+09:00` and `2026-08-01T00:00:00Z` were incorrectly rejected when request cutoff text was compared directly. GREEN `a6ba5d79c8d9acc1e7b4a53b3be5ef3d70ab19e7` parses the request cutoff into `KnowledgeCutoff` and compares `instant()` values, retaining genuine cutoff/profile/model mismatch refusal. The stale oversize-census thread and the equivalent-offset thread are resolved after current-source verification. Fresh exact-head Rust, Documentation, Security, and SAST workflows are queued, so #416 remains Draft and must not independently land ahead of consolidation. +**#416 and sibling simple-refusal profiles.** #416 is the provisional Validation / Analysis Run landing vehicle. Its current head `a6ba5d79c8d9acc1e7b4a53b3be5ef3d70ab19e7` keeps the already-repaired `MAX_EVIDENCE_UNITS` execution/artifact bound before identity-set growth and adds a temporal-admission repair. RED `b7312eed81e25aba586323be058077dabc38a2df` proves that equivalent RFC 3339 spellings such as `2026-08-01T09:00:00+09:00` and `2026-08-01T00:00:00Z` were incorrectly rejected when request cutoff text was compared directly. GREEN `a6ba5d79c8d9acc1e7b4a53b3be5ef3d70ab19e7` parses the request cutoff into `KnowledgeCutoff` and compares `instant()` values, retaining genuine cutoff/profile/model mismatch refusal. The stale oversize-census thread and the equivalent-offset thread are resolved after current-source verification. Fresh exact-head Rust, Documentation, Security, and SAST workflows are queued, so #416 remains Draft and must not independently land ahead of consolidation. Compatible style/prompt/modality/background/citation/copied-text/location/membership-target/outcome-order/relation-absence/episode-membership/inferred-status profiles must preserve unique refusal vocabulary, cutoff behavior, tests, and evidence while sharing execution/artifact-count/output-size invariants. #473 is explicitly `fold_into_landing_vehicle`; it is not independently shippable. **#315 — static-standardisation ownership repair.** #315 remains Draft only to preserve TEPP-specific `TIPREDVARstd` naming/event-time/refusal semantics. It must not merge with duplicate reusable arithmetic. After fast-mlsirm #1722 or its live successor is merged and released/versioned, #315 must consume that immutable contract through an ACL, prove parity, retain TEPP temporal/model admission, delete wrong-owner production arithmetic, and fold into a Measurement/Longitudinal Modeling landing vehicle. -**Dependency-review support.** An earlier #310 head failed central Security Scan before Dependency Review because GitHub dependency-graph comparison was unavailable to the workflow token. That is predecessor evidence, not a permanent current-head exemption. The gate remains fail-closed; OSV, Trivy, and Scorecard are sibling evidence, not substitutes. Current head `af767e1bb9ab27c71023e0c3f4be1bb0918dd20f` must obtain its own terminal Security Scan. +**Dependency-review support.** An earlier #310 head failed central Security Scan before Dependency Review because GitHub dependency-graph comparison was unavailable to the workflow token. That is predecessor evidence, not a permanent current-head exemption. The gate remains fail-closed; OSV, Trivy, and Scorecard are sibling evidence, not substitutes. Current head `3132a0818455c982f211a7f170fdf2b8db63fa7b` must obtain its own terminal Security Scan. **Analysis Run adapter/profile proliferation.** Export, interpretation, project-history, inferred-status, and temporal-context HTTP/CLI mechanics are adapters inside supporting contexts. Strict ancestry may be folded without force after exact comparison; diverged siblings require an actual source/test fold. One refusal/profile/route/CLI verb does not create architecture authority. From 6d219cf7d20849a6cc4e5af9154ed120b80dce98 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 10:44:33 +0900 Subject: [PATCH 082/235] docs(delivery): refresh queue after inferred-status fold --- docs/product-technical-gap-baseline.md | 27 +++++++++++++------------- 1 file changed, 14 insertions(+), 13 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 0b0af9af3..c3eb5f8d4 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-02T00:15Z +**Snapshot:** 2026-09-02T01:42Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` **Workspace version:** `0.2.0` **Delivery authority:** issue [#175](https://github.com/ContextualWisdomLab/TEPP/issues/175), PR [#435](https://github.com/ContextualWisdomLab/TEPP/pull/435), and [`docs/delivery/pr-queue-authority-2026-09-01.md`](delivery/pr-queue-authority-2026-09-01.md) @@ -15,8 +15,8 @@ A planning document, mergeable branch, local test, predecessor-head result, queu | Signal | Current evidence | Delivery implication | | --- | ---: | --- | | Protected `main` | `1bc02f580cf48e1d39da239f0e818453437c31c3` | Capability claims remain bounded to this commit until protected main changes. | -| Open pull requests | **131** | WIP remains release-blocking, but the queue is down from the observed peak of 149. | -| Draft pull requests | **130** | Non-landable work is explicitly parked while consolidated, repaired, or supplied with missing evidence. | +| Open pull requests | **130** | WIP remains release-blocking, but the queue is down from the observed peak of 149. | +| Draft pull requests | **129** | Non-landable work is explicitly parked while consolidated, repaired, or supplied with missing evidence. | | Non-draft pull requests | **1** | #310 is the only current non-Draft landing vehicle. | | Open issues | **15** | Includes #437 for repository-wide ADR identity normalization and active Analysis Run/product gaps. | | GitHub releases | **0** | No open head is a released TEPP contract. | @@ -24,22 +24,21 @@ A planning document, mergeable branch, local test, predecessor-head result, queu Classic branch protection is not the sole policy source; organization rulesets are effective merge authority where applicable. Any increase in open PR count while #435 remains open is a WIP regression unless the new PR is a demonstrably independent root-cause repair that cannot safely belong to an existing landing vehicle. -The queue previously regressed when one-map and one-route Drafts appeared as independently shippable work. Recovery preserves unique RED/GREEN, review, research, and contract evidence on coherent bounded-context landing vehicles before strict ancestors or superseded siblings are closed. The live TEPP queue is **131**. +The queue previously regressed when one-map and one-route Drafts appeared as independently shippable work. Recovery preserves unique RED/GREEN, review, research, and contract evidence on coherent bounded-context landing vehicles before strict ancestors or superseded siblings are closed. The live TEPP queue is **130**. ## Current priority open pull-request evidence -This is a priority subset, not a row-for-row copy of the 131-PR queue. #435 intentionally omits its own SHA because embedding the branch head in a file changed by that same branch would make the evidence self-stale. Every row below was re-read before this snapshot. +This is a priority subset, not a row-for-row copy of the 130-PR queue. #435 intentionally omits its own SHA because embedding the branch head in a file changed by that same branch would make the evidence self-stale. Every row below was re-read before this snapshot. | PR | Exact current head | Draft | Base | Ownership / disposition | | ---: | --- | :---: | --- | --- | -| #473 | `9ae0488e44bc0775b2289c71d83d88c57e660b0d` | true | profile ancestry | Validation / Analysis Run inferred-status refusal profile; `fold_into_landing_vehicle`, not independent architecture authority. | | #469 | `72a7755bcc91b1107560c980ce817eca153126e4` | true | interpretation-run retrieval ancestry | Analysis Run / contextual-orchestrator interpretation-run retrieval, lookup, and stored-request adapter landing vehicle. | | #466 | `71f34b890bbd096eee152947c5e22d9778d323e8` | true | export-retrieval ancestry | Analysis Run / naruon export idempotency lookup and quarantine-parity landing vehicle. | | #464 | `1b3a477242336634be2c7867b29d39979e9a6dca` | true | temporal-context retrieval ancestry | Analysis Run / LineageWeave temporal-context stored-request GET+CLI landing vehicle. | | #462 | `c1b7d627167dd7636d2975cc41cec050a5e477ba` | true | main | Bounded source-name compatibility repair; Rust `node_id`, v1 serialized key remains `id`. | | #456 | `f02436236a73824c87c6043fc5d1e0b08cb0d448` | true | project-history retrieval ancestry | Analysis Run / LineageWeave project-history landing vehicle; includes folded query CLI evidence. | | #417 | `1e468f62ec47f3476a7b4d18ed2980451dc425cf` | true | main | Analysis Run / naruon export retrieval GET+CLI landing vehicle. | -| #416 | `a6ba5d79c8d9acc1e7b4a53b3be5ef3d70ab19e7` | true | main | Provisional Validation / Analysis Run simple-refusal landing vehicle; shared admission/artifact invariants plus profile-specific adapters. | +| #416 | `e0e44805acf3a5ec833e83baa37cc72c80544514` | true | main | Provisional Validation / Analysis Run simple-refusal landing vehicle; copy-identity plus folded inferred-status evidence and shared admission/artifact invariants. | | #315 | `538f9bd1c76422bc894836b65083c62544330c7c` | true | main | TEPP `TIPREDVARstd` adapter lineage only; blocked on a released fast-mlsirm covariance-standardisation contract and removal of duplicate local arithmetic. | | #310 | `3132a0818455c982f211a7f170fdf2b8db63fa7b` | false | main | Longitudinal Modeling landing vehicle; repaired lagged correlation, diffusion research candidates, and mixed-sign full-range/subnormal-safe CWC mean arithmetic. | @@ -89,9 +88,11 @@ The current arithmetic repair progressed through two additional RED/GREEN slices The surviving branch also contains source/test evidence folded from #476/#477 under `longitudinal_core`: continuous and discrete scalar diffusion-standardisation candidates, positive stationary-within admission, subnormal-cancellation repair, scale-invariance tests, signed-zero event-product refusal, interval ordering, and named-estimand refusals. Those maps remain `research_candidate` because the 2017 ctsem summary source does not emit named `DIFFUSIONstd` / `discreteDIFFUSIONstd` matrices. -**#416 and sibling simple-refusal profiles.** #416 is the provisional Validation / Analysis Run landing vehicle. Its current head `a6ba5d79c8d9acc1e7b4a53b3be5ef3d70ab19e7` keeps the already-repaired `MAX_EVIDENCE_UNITS` execution/artifact bound before identity-set growth and adds a temporal-admission repair. RED `b7312eed81e25aba586323be058077dabc38a2df` proves that equivalent RFC 3339 spellings such as `2026-08-01T09:00:00+09:00` and `2026-08-01T00:00:00Z` were incorrectly rejected when request cutoff text was compared directly. GREEN `a6ba5d79c8d9acc1e7b4a53b3be5ef3d70ab19e7` parses the request cutoff into `KnowledgeCutoff` and compares `instant()` values, retaining genuine cutoff/profile/model mismatch refusal. The stale oversize-census thread and the equivalent-offset thread are resolved after current-source verification. Fresh exact-head Rust, Documentation, Security, and SAST workflows are queued, so #416 remains Draft and must not independently land ahead of consolidation. +**#416 and sibling simple-refusal profiles.** #416 is the provisional Validation / Analysis Run landing vehicle. Its current head `e0e44805acf3a5ec833e83baa37cc72c80544514` is a non-force merge of the repaired copy-identity vehicle and inferred-status micro-profile #473. It preserves both profile source/tests plus inferred-status doctoring; #473 is merged and no longer independently shippable. Per-stack ADR/index records from #473 were not copied into the surviving tree while #437 normalization remains open. -Compatible style/prompt/modality/background/citation/copied-text/location/membership-target/outcome-order/relation-absence/episode-membership/inferred-status profiles must preserve unique refusal vocabulary, cutoff behavior, tests, and evidence while sharing execution/artifact-count/output-size invariants. #473 is explicitly `fold_into_landing_vehicle`; it is not independently shippable. +Copy identity retains the `MAX_EVIDENCE_UNITS` execution/artifact bound, canonical-output byte limit, and typed cutoff comparison. During the fold, inferred-status review found the same RFC 3339 spelling defect: semantically identical cutoff instants were compared by string. The surviving head parses the request cutoff into `KnowledgeCutoff`, compares `instant()` values, and adds a focused regression admitting `2026-08-01T09:00:00+09:00` against `2026-08-01T00:00:00Z` while retaining genuine mismatch refusal. #473's compact `evidence_count > MAX_EVIDENCE_UNITS` artifact regression is also preserved. + +Fresh exact-head Rust Foundation CI, Documentation Quality, Security Scan and SAST Semgrep are queued on `e0e44805acf3a5ec833e83baa37cc72c80544514`; predecessor evidence does not transfer. If the dependency union makes `Cargo.lock` stale, regenerate only the exact lock delta rather than weakening `--locked` policy. Compatible style/prompt/modality/background/citation/copied-text/location/membership-target/outcome-order/relation-absence/episode-membership profiles must preserve unique refusal vocabulary, cutoff behavior, tests, and evidence while sharing admission/artifact invariants. **#315 — static-standardisation ownership repair.** #315 remains Draft only to preserve TEPP-specific `TIPREDVARstd` naming/event-time/refusal semantics. It must not merge with duplicate reusable arithmetic. After fast-mlsirm #1722 or its live successor is merged and released/versioned, #315 must consume that immutable contract through an ACL, prove parity, retain TEPP temporal/model admission, delete wrong-owner production arithmetic, and fold into a Measurement/Longitudinal Modeling landing vehicle. @@ -103,9 +104,9 @@ Compatible style/prompt/modality/background/citation/copied-text/location/member ## Dependency and Context Fabric status -The fast-mlsirm generalized-mixed/dependence compiler remains PR #1714 at exact head `6abdcc2acab7be463977e35191566119e384c906`. It publishes typed response/dimensional/generalized-mixed/dependence identities, typed membership topology and weight authority, formulation-scoped promotion evidence, and deterministic candidate manifest `fast_mlsirm.model_specification.candidate_manifest@1.0.0` with SHA-256 digest. All visible substantive review conversations are resolved, but exact-head CI is pending and Security/SAST/CodeQL are queued. It is not a released TEPP dependency. +The fast-mlsirm generalized-mixed/dependence compiler remains PR #1714 at exact head `6abdcc2acab7be463977e35191566119e384c906`. It publishes typed response/dimensional/generalized-mixed/dependence identities, typed membership topology and weight authority, formulation-scoped promotion evidence, and deterministic candidate manifest `fast_mlsirm.model_specification.candidate_manifest@1.0.0` with SHA-256 digest. All visible substantive review conversations are resolved. Exact-head Security Scan, SAST Semgrep, and CodeQL are GREEN; CI remains queued. It is not a released TEPP dependency. -TEPP protected main checksum-pins contextual-orchestrator commit `e226e1197bdfc890c9d8e5b9b648c78857d7e465` with SHA-256 `964b22ff577e3862b761af847ccad65489bb3f8fc750c8f84fcf8628df096673`. Upstream protected `main` is `4d143601c2904a28e95d091b261c0a15e9a4f283`, which merged the Bytez zero-price ranking repair. Advancing TEPP requires a reproducible replacement archive digest and review of the exact replacement; removing checksum validation or pinning an unverified digest is prohibited. +TEPP protected main checksum-pins contextual-orchestrator commit `e226e1197bdfc890c9d8e5b9b648c78857d7e465` with SHA-256 `964b22ff577e3862b761af847ccad65489bb3f8fc750c8f84fcf8628df096673`. Upstream protected `main` is now `8839081659df587b19642be17b9114f9dee8b666`, after the Bytez zero-price ranking repair and the subsequent `orchestrator/free` stream-test route-mode repair. contextual-orchestrator still has zero GitHub releases. Advancing TEPP requires a reproducible replacement archive digest and review of the exact replacement; removing checksum validation or pinning an unverified digest is prohibited. `context-graph-contracts` and `enterprise-architecture-core` remain read-only to this writer while their dedicated Context Fabric owner loop is active. Fresh state is: @@ -118,7 +119,7 @@ Open heads are candidate evidence, not released contracts. TEPP may maintain fai | ID | Gap | Maturity | Closure evidence | | --- | --- | --- | --- | -| GAP-001 | PR authority fragmented across 131 open PRs | `release-blocking` | coherent landing vehicles, unique evidence preservation, protected-main reduction | +| GAP-001 | PR authority fragmented across 130 open PRs | `release-blocking` | coherent landing vehicles, unique evidence preservation, protected-main reduction | | GAP-002 | multilingual span-grounded semantic/concept admission | `partial` | immutable offsets/layout, language profiles, concept dictionary, invariance/calibration, hostile-input tests | | GAP-003 | shared-latent temporal topic estimator | `partial` | Rust CPU f64 likelihood/uncertainty, relation/time/membership effects, true recovery, fitted candidate-K | | GAP-004 | durable end-to-end Analysis Run | `partial` | idempotent lifecycle, persistence/recovery, estimator-bound artifacts, validation/promotion separation, Compose E2E | @@ -140,4 +141,4 @@ Queue/ADR/domain authority precedes semantic admission, the Rust CPU f64 shared- Every open PR is classified as `landing_vehicle`, `stacked_dependency`, `fold_into_landing_vehicle`, `superseded`, `duplicate`, `research_lineage_only`, or `blocked_external`. Exact heads must be compared before closure. Strict ancestry permits safe consolidation; diverged siblings require a real code/test fold first. -TEPP has no GitHub release at this snapshot. A release is permitted only after a clean integration state reaches protected main with exact protected-head CI/security evidence, claim-scoped scientific and recovery acceptance, reproducible artifacts with SBOM and provenance, validated migrations/upgrade/rollback/recovery where applicable, consistent version metadata and a current `CHANGELOG.md`, accessibility and operability evidence for user-facing components, no unresolved scientific/privacy/security/supply-chain blockers, and released integration contracts where cross-product deployment depends on them. +TEPP has no GitHub release at this snapshot. A release is permitted only after a clean integration state reaches protected main with exact protected-head CI/security evidence, claim-scoped scientific and recovery acceptance, reproducible artifacts with SBOM and provenance, validated migrations/upgrade/rollback/recovery where applicable, consistent version metadata and a current `CHANGELOG.md`, accessibility and operability evidence for user-facing components, no unresolved scientific/privacy/security/supply-chain blockers, and released integration contracts where cross-product deployment depends on them. \ No newline at end of file From bbd5215c09e3298f6d0a365c7f8a061e3e3521bb Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 12:54:48 +0900 Subject: [PATCH 083/235] docs: refresh live delivery snapshot --- docs/product-technical-gap-baseline.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index c3eb5f8d4..dfb776a6c 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-02T01:42Z +**Snapshot:** 2026-09-02T03:46Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` **Workspace version:** `0.2.0` **Delivery authority:** issue [#175](https://github.com/ContextualWisdomLab/TEPP/issues/175), PR [#435](https://github.com/ContextualWisdomLab/TEPP/pull/435), and [`docs/delivery/pr-queue-authority-2026-09-01.md`](delivery/pr-queue-authority-2026-09-01.md) @@ -15,20 +15,20 @@ A planning document, mergeable branch, local test, predecessor-head result, queu | Signal | Current evidence | Delivery implication | | --- | ---: | --- | | Protected `main` | `1bc02f580cf48e1d39da239f0e818453437c31c3` | Capability claims remain bounded to this commit until protected main changes. | -| Open pull requests | **130** | WIP remains release-blocking, but the queue is down from the observed peak of 149. | -| Draft pull requests | **129** | Non-landable work is explicitly parked while consolidated, repaired, or supplied with missing evidence. | +| Open pull requests | **131** | WIP remains release-blocking, but the queue is down from the observed peak of 149. | +| Draft pull requests | **130** | Non-landable work is explicitly parked while consolidated, repaired, or supplied with missing evidence. | | Non-draft pull requests | **1** | #310 is the only current non-Draft landing vehicle. | -| Open issues | **15** | Includes #437 for repository-wide ADR identity normalization and active Analysis Run/product gaps. | +| Open issues | **14** | Includes #437 for repository-wide ADR identity normalization and active Analysis Run/product gaps. | | GitHub releases | **0** | No open head is a released TEPP contract. | | Effective organization ruleset | `18156473` | Current-head required workflows, resolved conversations, qualifying review, and an allowed merge method remain landing authority. | Classic branch protection is not the sole policy source; organization rulesets are effective merge authority where applicable. Any increase in open PR count while #435 remains open is a WIP regression unless the new PR is a demonstrably independent root-cause repair that cannot safely belong to an existing landing vehicle. -The queue previously regressed when one-map and one-route Drafts appeared as independently shippable work. Recovery preserves unique RED/GREEN, review, research, and contract evidence on coherent bounded-context landing vehicles before strict ancestors or superseded siblings are closed. The live TEPP queue is **130**. +The queue previously regressed when one-map and one-route Drafts appeared as independently shippable work. Recovery preserves unique RED/GREEN, review, research, and contract evidence on coherent bounded-context landing vehicles before strict ancestors or superseded siblings are closed. The live TEPP queue is **131**. ## Current priority open pull-request evidence -This is a priority subset, not a row-for-row copy of the 130-PR queue. #435 intentionally omits its own SHA because embedding the branch head in a file changed by that same branch would make the evidence self-stale. Every row below was re-read before this snapshot. +This is a priority subset, not a row-for-row copy of the 131-PR queue. #435 intentionally omits its own SHA because embedding the branch head in a file changed by that same branch would make the evidence self-stale. Every row below was re-read before this snapshot. | PR | Exact current head | Draft | Base | Ownership / disposition | | ---: | --- | :---: | --- | --- | @@ -119,7 +119,7 @@ Open heads are candidate evidence, not released contracts. TEPP may maintain fai | ID | Gap | Maturity | Closure evidence | | --- | --- | --- | --- | -| GAP-001 | PR authority fragmented across 130 open PRs | `release-blocking` | coherent landing vehicles, unique evidence preservation, protected-main reduction | +| GAP-001 | PR authority fragmented across 131 open PRs | `release-blocking` | coherent landing vehicles, unique evidence preservation, protected-main reduction | | GAP-002 | multilingual span-grounded semantic/concept admission | `partial` | immutable offsets/layout, language profiles, concept dictionary, invariance/calibration, hostile-input tests | | GAP-003 | shared-latent temporal topic estimator | `partial` | Rust CPU f64 likelihood/uncertainty, relation/time/membership effects, true recovery, fitted candidate-K | | GAP-004 | durable end-to-end Analysis Run | `partial` | idempotent lifecycle, persistence/recovery, estimator-bound artifacts, validation/promotion separation, Compose E2E | From f6edcf6426216791275fcc9cd6627c54b2e1a5f9 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 15:06:41 +0900 Subject: [PATCH 084/235] docs(queue): refresh live delivery and free-route repair state --- docs/product-technical-gap-baseline.md | 69 ++++++++++---------------- 1 file changed, 27 insertions(+), 42 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index dfb776a6c..504030646 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-02T03:46Z +**Snapshot:** 2026-09-02T06:04Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` **Workspace version:** `0.2.0` **Delivery authority:** issue [#175](https://github.com/ContextualWisdomLab/TEPP/issues/175), PR [#435](https://github.com/ContextualWisdomLab/TEPP/pull/435), and [`docs/delivery/pr-queue-authority-2026-09-01.md`](delivery/pr-queue-authority-2026-09-01.md) @@ -15,32 +15,33 @@ A planning document, mergeable branch, local test, predecessor-head result, queu | Signal | Current evidence | Delivery implication | | --- | ---: | --- | | Protected `main` | `1bc02f580cf48e1d39da239f0e818453437c31c3` | Capability claims remain bounded to this commit until protected main changes. | -| Open pull requests | **131** | WIP remains release-blocking, but the queue is down from the observed peak of 149. | -| Draft pull requests | **130** | Non-landable work is explicitly parked while consolidated, repaired, or supplied with missing evidence. | -| Non-draft pull requests | **1** | #310 is the only current non-Draft landing vehicle. | -| Open issues | **14** | Includes #437 for repository-wide ADR identity normalization and active Analysis Run/product gaps. | -| GitHub releases | **0** | No open head is a released TEPP contract. | +| Open pull requests | **128** | The queue is down from the observed peak of 149, but remains release-blocking. | +| Draft pull requests | **126** | Non-landable work is explicitly parked while consolidated, repaired, or supplied with missing evidence. | +| Non-draft pull requests | **2** | #310 is the scientific landing vehicle; #480 is an independently landable CI/provider-admission repair. | +| Open issues | **15** | Includes #437 ADR identity normalization and #479 hourly free-route admission tracking. | +| GitHub releases | **0** | No open TEPP head is a released contract. | | Effective organization ruleset | `18156473` | Current-head required workflows, resolved conversations, qualifying review, and an allowed merge method remain landing authority. | -Classic branch protection is not the sole policy source; organization rulesets are effective merge authority where applicable. Any increase in open PR count while #435 remains open is a WIP regression unless the new PR is a demonstrably independent root-cause repair that cannot safely belong to an existing landing vehicle. +Classic branch protection is not the sole policy source; organization rulesets are effective merge authority where applicable. Any increase in open PR count while #435 remains open is a WIP regression unless the new PR is a demonstrably independent root-cause repair that cannot safely belong to an existing landing vehicle. #480 is such an exception: it owns TEPP CI/provider-admission policy and cannot coherently belong to the Validation/Analysis Run, Longitudinal Modeling, or queue-documentation vehicles. -The queue previously regressed when one-map and one-route Drafts appeared as independently shippable work. Recovery preserves unique RED/GREEN, review, research, and contract evidence on coherent bounded-context landing vehicles before strict ancestors or superseded siblings are closed. The live TEPP queue is **131**. +The live queue was **127** immediately before #480 was opened and is **128** after that bounded governance repair. This increase is intentional and must not be used as precedent for one-operation/model/route micro-PR creation. ## Current priority open pull-request evidence -This is a priority subset, not a row-for-row copy of the 131-PR queue. #435 intentionally omits its own SHA because embedding the branch head in a file changed by that same branch would make the evidence self-stale. Every row below was re-read before this snapshot. +This is a priority subset, not a row-for-row copy of the 128-PR queue. #435 intentionally omits its own SHA because embedding the branch head in a file changed by that same branch would make the evidence self-stale. | PR | Exact current head | Draft | Base | Ownership / disposition | | ---: | --- | :---: | --- | --- | +| #480 | `feb3399cad55b00f957263e4f60f0df8531a71c8` | false | main | TEPP CI/provider-admission governance repair for issue #479; explicit zero-cost discovered routes only, fail-closed when none exist. | | #469 | `72a7755bcc91b1107560c980ce817eca153126e4` | true | interpretation-run retrieval ancestry | Analysis Run / contextual-orchestrator interpretation-run retrieval, lookup, and stored-request adapter landing vehicle. | | #466 | `71f34b890bbd096eee152947c5e22d9778d323e8` | true | export-retrieval ancestry | Analysis Run / naruon export idempotency lookup and quarantine-parity landing vehicle. | | #464 | `1b3a477242336634be2c7867b29d39979e9a6dca` | true | temporal-context retrieval ancestry | Analysis Run / LineageWeave temporal-context stored-request GET+CLI landing vehicle. | | #462 | `c1b7d627167dd7636d2975cc41cec050a5e477ba` | true | main | Bounded source-name compatibility repair; Rust `node_id`, v1 serialized key remains `id`. | | #456 | `f02436236a73824c87c6043fc5d1e0b08cb0d448` | true | project-history retrieval ancestry | Analysis Run / LineageWeave project-history landing vehicle; includes folded query CLI evidence. | | #417 | `1e468f62ec47f3476a7b4d18ed2980451dc425cf` | true | main | Analysis Run / naruon export retrieval GET+CLI landing vehicle. | -| #416 | `e0e44805acf3a5ec833e83baa37cc72c80544514` | true | main | Provisional Validation / Analysis Run simple-refusal landing vehicle; copy-identity plus folded inferred-status evidence and shared admission/artifact invariants. | -| #315 | `538f9bd1c76422bc894836b65083c62544330c7c` | true | main | TEPP `TIPREDVARstd` adapter lineage only; blocked on a released fast-mlsirm covariance-standardisation contract and removal of duplicate local arithmetic. | -| #310 | `3132a0818455c982f211a7f170fdf2b8db63fa7b` | false | main | Longitudinal Modeling landing vehicle; repaired lagged correlation, diffusion research candidates, and mixed-sign full-range/subnormal-safe CWC mean arithmetic. | +| #416 | `b0d6cb8969aa0ddd386ab82a1755155fa13d18a8` | true | main | Provisional Validation / Analysis Run simple-refusal landing vehicle; now preserves copy identity, inferred status, location membership, episode membership, subevent containment, and membership-target evidence. | +| #315 | `538f9bd1c76422bc894836b65083c62544330c7c` | true | main | TEPP `TIPREDVARstd` adapter lineage only; blocked on a released fast-mlsirm covariance-standardisation contract and deletion of duplicate local arithmetic. | +| #310 | `3132a0818455c982f211a7f170fdf2b8db63fa7b` | false | main | Longitudinal Modeling landing vehicle; repaired lagged correlation, diffusion research candidates, and full-range/subnormal-safe CWC mean arithmetic. | Exact current-head evidence is authoritative only for the named PR and becomes stale after any source mutation. @@ -62,7 +63,7 @@ Cargo crates, HTTP routes, CLI verbs, refusal rules, clocks, and individual stat | Supporting | Persistence & Recovery | repositories and durable receipts | `persistence_postgres`, object-store adapters | | Generic | Compute backend | execution receipt | CPU/GPU/MLX adapters; execution is not scientific authority | -**Canonical owners:** fast-mlsirm owns reusable static/generalized-mixed/dependence-aware psychometric specification and numerical kernels, including reusable covariance standardisation and LSIRM/MLSIRM/DLSJM kernels. TEPP owns temporal/event composition, irregular time, time-varying multilevel/cross-classified/multiple-membership semantics, longitudinal invariance/drift/alignment, and temporal recovery. contextual-orchestrator owns every LLM/provider call and routing decision. Context Graph contracts are a contract-only Shared Kernel; EA Core owns authoritative architecture decisions. No cross-service SQL. +fast-mlsirm owns reusable static/generalized-mixed/dependence-aware psychometric specification and numerical kernels, including reusable covariance standardisation and LSIRM/MLSIRM/DLSJM kernels. TEPP owns temporal/event composition, irregular time, time-varying multilevel/cross-classified/multiple-membership semantics, longitudinal invariance/drift/alignment, and temporal recovery. contextual-orchestrator owns every LLM/provider execution and routing decision. Context Graph contracts are a contract-only Shared Kernel; EA Core owns authoritative architecture decisions. No cross-service SQL. The six-clock contract keeps event/valid time as one role, followed by assertion time, document time, system time, available time, and knowledge cutoff. A retrospective source may describe an earlier event but cannot enter an earlier knowledge cutoff. Forward state/transition edges remain distinct from retrospective, citation, revision, and provenance relations. @@ -80,46 +81,29 @@ Supported temporal estimators require realistic known-truth recovery for every c ## Current repairs and blockers -**#310 — Longitudinal Modeling landing vehicle.** Closed predecessor #441 is contained by #310. The invalid one-sided covariance/earlier-variance ratio remains retired; public lagged Pearson correlation requires lagged covariance and both occasion-specific marginal variances. `EventTimeInterval` is preserved end-to-end. Earlier RED/GREEN slices repaired event-order-sensitive CWC accumulation, stationary/diffusion edge arithmetic, and the `ln(0.5) / Δt` documentation boundary. +**#310 — Longitudinal Modeling landing vehicle.** Closed predecessor #441 is contained by #310. The invalid one-sided covariance/earlier-variance ratio remains retired; public lagged Pearson correlation requires lagged covariance and both occasion-specific marginal variances. `EventTimeInterval` is preserved end-to-end. Current head `3132a0818455c982f211a7f170fdf2b8db63fa7b` also preserves the full-range/subnormal-safe mixed-sign CWC mean repair. It is not landable until exact-head required workflows terminate successfully and a qualifying independent approval exists. -The current arithmetic repair progressed through two additional RED/GREEN slices. RED `0057b85a8467b9c904aaa20ffe79462aa3339786` showed that largest-magnitude normalization could erase a representable low-order contribution when near-maximum positive and negative rates cancelled. GREEN `af767e1bb9ab27c71023e0c3f4be1bb0918dd20f` removed that magnitude normalization, but fresh review found its count-derived power-of-two pre-scaling could still divide positive subnormal terms to zero before cancellation. RED `203a926680f52cf0a75de909247e6ad5db237403` reproduces the remaining defect with two positive subnormal rates bracketed by opposing extreme finite rates. GREEN `3132a0818455c982f211a7f170fdf2b8db63fa7b` removes mixed-sign pre-scaling entirely: values are partitioned by sign, ordered from largest magnitude down, opposite signs are cancelled first without overflow, and surviving same-sign residuals are averaged by the bounded convex path and weighted to the original sample count. The internal contract includes `[f64::MAX, 2*min_subnormal, 2*min_subnormal, -f64::MAX] -> min_subnormal`, plus previous full-range, same-sign-overflow, zero, empty, and non-finite cases. The two substantive cancellation review threads are resolved on the current source. +**#416 — Validation / Analysis Run consolidation.** Current head `b0d6cb8969aa0ddd386ab82a1755155fa13d18a8` contains non-force lineage from #473, #430, #461, #478, and #434. Shared admission/artifact invariants remain centralized while each refusal profile keeps its domain vocabulary. The #478 TRACEABILITY repair now explicitly keeps both `containment_recovery_rate` and `identity_recovery_rate` out of inspect payloads. Next compatible simple-refusal siblings still targeting `main` are #458 (`outcome_order_v1`) and #460 (`relation_absence_v1`); they should fold into this vehicle or a coherent successor rather than ship as independent bounded contexts. -#310 is still not landable. Exact head `3132a0818455c982f211a7f170fdf2b8db63fa7b` has fresh Rust Foundation CI, Documentation Quality, Security Scan, and SAST Semgrep queued. Queued evidence is non-passing. There is no qualifying current-head independent `APPROVED` review. The exact-head verification conversation remains intentionally unresolved until the required workflows terminate successfully and review policy is satisfied. +**#480 / #479 — hourly free-route admission.** Protected main currently ranks all discovered chat candidates without a free-only admission step. #480 repairs the TEPP-owned bootstrap ACL so both provider-reported token-price components must be explicitly zero before a route reaches ranking. Paid, partially priced, and fully unpriced production rows are excluded; an empty explicit-free pool fails closed. The focused regression file covers paid-vs-free ranking, unknown Bytez-style prices, partial prices, and empty-pool refusal. This is a justified independent governance PR, not a precedent for route/model micro-PR proliferation. Exact-head Rust Foundation CI, Security Scan, and SAST were queued immediately after creation; no queued result is GREEN. -The surviving branch also contains source/test evidence folded from #476/#477 under `longitudinal_core`: continuous and discrete scalar diffusion-standardisation candidates, positive stationary-within admission, subnormal-cancellation repair, scale-invariance tests, signed-zero event-product refusal, interval ordering, and named-estimand refusals. Those maps remain `research_candidate` because the 2017 ctsem summary source does not emit named `DIFFUSIONstd` / `discreteDIFFUSIONstd` matrices. +**#315 — static-standardisation ownership repair.** #315 remains Draft only to preserve TEPP-specific `TIPREDVARstd` naming/event-time/refusal semantics. It must not merge with duplicate reusable arithmetic. After the live fast-mlsirm owner contract is merged and released/versioned, #315 must consume that immutable contract through an ACL, prove parity, retain TEPP temporal/model admission, delete wrong-owner production arithmetic, and fold into a Measurement/Longitudinal Modeling landing vehicle. -**#416 and sibling simple-refusal profiles.** #416 is the provisional Validation / Analysis Run landing vehicle. Its current head `e0e44805acf3a5ec833e83baa37cc72c80544514` is a non-force merge of the repaired copy-identity vehicle and inferred-status micro-profile #473. It preserves both profile source/tests plus inferred-status doctoring; #473 is merged and no longer independently shippable. Per-stack ADR/index records from #473 were not copied into the surviving tree while #437 normalization remains open. - -Copy identity retains the `MAX_EVIDENCE_UNITS` execution/artifact bound, canonical-output byte limit, and typed cutoff comparison. During the fold, inferred-status review found the same RFC 3339 spelling defect: semantically identical cutoff instants were compared by string. The surviving head parses the request cutoff into `KnowledgeCutoff`, compares `instant()` values, and adds a focused regression admitting `2026-08-01T09:00:00+09:00` against `2026-08-01T00:00:00Z` while retaining genuine mismatch refusal. #473's compact `evidence_count > MAX_EVIDENCE_UNITS` artifact regression is also preserved. - -Fresh exact-head Rust Foundation CI, Documentation Quality, Security Scan and SAST Semgrep are queued on `e0e44805acf3a5ec833e83baa37cc72c80544514`; predecessor evidence does not transfer. If the dependency union makes `Cargo.lock` stale, regenerate only the exact lock delta rather than weakening `--locked` policy. Compatible style/prompt/modality/background/citation/copied-text/location/membership-target/outcome-order/relation-absence/episode-membership profiles must preserve unique refusal vocabulary, cutoff behavior, tests, and evidence while sharing admission/artifact invariants. - -**#315 — static-standardisation ownership repair.** #315 remains Draft only to preserve TEPP-specific `TIPREDVARstd` naming/event-time/refusal semantics. It must not merge with duplicate reusable arithmetic. After fast-mlsirm #1722 or its live successor is merged and released/versioned, #315 must consume that immutable contract through an ACL, prove parity, retain TEPP temporal/model admission, delete wrong-owner production arithmetic, and fold into a Measurement/Longitudinal Modeling landing vehicle. - -**Dependency-review support.** An earlier #310 head failed central Security Scan before Dependency Review because GitHub dependency-graph comparison was unavailable to the workflow token. That is predecessor evidence, not a permanent current-head exemption. The gate remains fail-closed; OSV, Trivy, and Scorecard are sibling evidence, not substitutes. Current head `3132a0818455c982f211a7f170fdf2b8db63fa7b` must obtain its own terminal Security Scan. - -**Analysis Run adapter/profile proliferation.** Export, interpretation, project-history, inferred-status, and temporal-context HTTP/CLI mechanics are adapters inside supporting contexts. Strict ancestry may be folded without force after exact comparison; diverged siblings require an actual source/test fold. One refusal/profile/route/CLI verb does not create architecture authority. - -**#437 — ADR identity.** Repository-wide ADR IDs are immutable authority. Duplicate index IDs, duplicate targets, duplicate numbered ADR files, repeated authority declarations, and index/file status or maturity drift must fail deterministic documentation fitness tests. Operation-specific ADRs on adapter/model micro-branches are implementation lineage pending normalization, not branch-local architecture authority. +**#437 — ADR identity.** Repository-wide ADR IDs are immutable authority. Duplicate index IDs, duplicate targets, duplicate numbered ADR files, repeated authority declarations, and index/file status or maturity drift must fail deterministic documentation fitness tests. Operation-specific ADRs on adapter/model micro-branches are implementation lineage pending normalization, not branch-local architecture authority. #435 contains the current deterministic fitness implementation; issue closure still requires exact-head hosted evidence and a coherent landing decision. ## Dependency and Context Fabric status -The fast-mlsirm generalized-mixed/dependence compiler remains PR #1714 at exact head `6abdcc2acab7be463977e35191566119e384c906`. It publishes typed response/dimensional/generalized-mixed/dependence identities, typed membership topology and weight authority, formulation-scoped promotion evidence, and deterministic candidate manifest `fast_mlsirm.model_specification.candidate_manifest@1.0.0` with SHA-256 digest. All visible substantive review conversations are resolved. Exact-head Security Scan, SAST Semgrep, and CodeQL are GREEN; CI remains queued. It is not a released TEPP dependency. - -TEPP protected main checksum-pins contextual-orchestrator commit `e226e1197bdfc890c9d8e5b9b648c78857d7e465` with SHA-256 `964b22ff577e3862b761af847ccad65489bb3f8fc750c8f84fcf8628df096673`. Upstream protected `main` is now `8839081659df587b19642be17b9114f9dee8b666`, after the Bytez zero-price ranking repair and the subsequent `orchestrator/free` stream-test route-mode repair. contextual-orchestrator still has zero GitHub releases. Advancing TEPP requires a reproducible replacement archive digest and review of the exact replacement; removing checksum validation or pinning an unverified digest is prohibited. - -`context-graph-contracts` and `enterprise-architecture-core` remain read-only to this writer while their dedicated Context Fabric owner loop is active. Fresh state is: +The live fast-mlsirm generalized-mixed/dependence compiler remains owner-side candidate work and is not a TEPP production dependency until merged and released/versioned. TEPP consumes its Published Language through an ACL and never copies the static kernel implementation. -- context-graph-contracts default/protected `develop@99cb5468ba3c15c5e79688f53dee74724fae2d13`, 13 open PRs, zero releases. Current Context Assertion/CloudEvent envelope work remains unreleased candidate work. -- enterprise-architecture-core default/protected `develop@1c0fa8b15ceb9e72186274aeb255d6777eb84ef4`, 24 open PRs, zero releases. +TEPP protected main checksum-pins contextual-orchestrator commit `e226e1197bdfc890c9d8e5b9b648c78857d7e465` with SHA-256 `964b22ff577e3862b761af847ccad65489bb3f8fc750c8f84fcf8628df096673`. Upstream protected `main` is `8839081659df587b19642be17b9114f9dee8b666`, which contains the richer `orchestrator/free` route-mode and discovery work absent from the pinned revision. Advancing TEPP still requires a reproducible replacement archive digest and exact replacement review; checksum validation must not be removed or guessed. #480 therefore repairs free-only admission using the current pinned public discovery-price contract rather than silently upgrading the supply-chain pin. -Open heads are candidate evidence, not released contracts. TEPP may maintain fail-closed conformance fixtures behind candidate/test boundaries, but deployable integration and authoritative EA projection require a released/versioned Context Graph artifact plus passing compatibility evidence. TEPP latent estimates, measurement scores, inferred event relations, and validity evidence do not become authoritative EA facts. +`context-graph-contracts` and `enterprise-architecture-core` remain read-only to this writer while their dedicated Context Fabric owner loop is active. Open heads are candidate evidence, not released contracts. TEPP may maintain fail-closed conformance fixtures behind candidate/test boundaries, but deployable integration and authoritative EA projection require a released/versioned Context Graph artifact plus passing compatibility evidence. TEPP latent estimates, measurement scores, inferred event relations, and validity evidence do not become authoritative EA facts. ## Gap register | ID | Gap | Maturity | Closure evidence | | --- | --- | --- | --- | -| GAP-001 | PR authority fragmented across 131 open PRs | `release-blocking` | coherent landing vehicles, unique evidence preservation, protected-main reduction | +| GAP-001 | PR authority fragmented across 128 open PRs | `release-blocking` | coherent landing vehicles, unique evidence preservation, protected-main reduction | | GAP-002 | multilingual span-grounded semantic/concept admission | `partial` | immutable offsets/layout, language profiles, concept dictionary, invariance/calibration, hostile-input tests | | GAP-003 | shared-latent temporal topic estimator | `partial` | Rust CPU f64 likelihood/uncertainty, relation/time/membership effects, true recovery, fitted candidate-K | | GAP-004 | durable end-to-end Analysis Run | `partial` | idempotent lifecycle, persistence/recovery, estimator-bound artifacts, validation/promotion separation, Compose E2E | @@ -134,11 +118,12 @@ Open heads are candidate evidence, not released contracts. TEPP may maintain fai | GAP-013 | ADR identity collisions | `release-integrity` | unique repository-wide identity, deterministic duplicate detection, supersession lineage | | GAP-014 | dependency-review evidence unavailable on predecessor heads | `external-control-risk` | authorized dependency-graph availability, pinned Dependency Review execution, exact-current Security Scan GREEN, no fail-open bypass | | GAP-015 | contextual-orchestrator pin behind protected upstream | `supply-chain-pinned` | reproducible replacement archive SHA-256, exact diff/review, pinned TEPP adoption | +| GAP-016 | hourly LLM bootstrap can admit paid/unknown-price routes | `active-repair` | #480 exact-head GREEN, qualifying review, merge to protected main, issue #479 closure | ## Delivery and release order -Queue/ADR/domain authority precedes semantic admission, the Rust CPU f64 shared-latent temporal estimator, durable Analysis Run, released fast-mlsirm temporal composition, event intelligence, accelerator parity, buyer workflows, and finally tenancy/durability/observability/release support. A bounded security/dependency repair may land earlier when it directly unblocks a selected vehicle. +Queue/ADR/domain authority precedes semantic admission, the Rust CPU f64 shared-latent temporal estimator, durable Analysis Run, released fast-mlsirm temporal composition, event intelligence, accelerator parity, buyer workflows, and finally tenancy/durability/observability/release support. A bounded security/dependency/provider-admission repair may land earlier when it directly closes a fail-closed control defect. -Every open PR is classified as `landing_vehicle`, `stacked_dependency`, `fold_into_landing_vehicle`, `superseded`, `duplicate`, `research_lineage_only`, or `blocked_external`. Exact heads must be compared before closure. Strict ancestry permits safe consolidation; diverged siblings require a real code/test fold first. +Every open PR is classified as `landing_vehicle`, `stacked_dependency`, `fold_into_landing_vehicle`, `superseded`, `duplicate`, `research_lineage_only`, `blocked_external`, or an explicitly justified independent root-cause repair. Exact heads must be compared before closure. Strict ancestry permits safe consolidation; diverged siblings require a real code/test fold first. -TEPP has no GitHub release at this snapshot. A release is permitted only after a clean integration state reaches protected main with exact protected-head CI/security evidence, claim-scoped scientific and recovery acceptance, reproducible artifacts with SBOM and provenance, validated migrations/upgrade/rollback/recovery where applicable, consistent version metadata and a current `CHANGELOG.md`, accessibility and operability evidence for user-facing components, no unresolved scientific/privacy/security/supply-chain blockers, and released integration contracts where cross-product deployment depends on them. \ No newline at end of file +TEPP has no GitHub release at this snapshot. A release is permitted only after a clean integration state reaches protected main with exact protected-head CI/security evidence, claim-scoped scientific and recovery acceptance, reproducible artifacts with SBOM and provenance, validated migrations/upgrade/rollback/recovery where applicable, consistent version metadata and a current `CHANGELOG.md`, accessibility and operability evidence for user-facing components, no unresolved scientific/privacy/security/supply-chain blockers, and released integration contracts where cross-product deployment depends on them. From 58a19b7e1e82b12f5019eda0f053bb7ac30bf3cd Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 15:45:23 +0900 Subject: [PATCH 085/235] docs: refresh live queue and drift-design evidence --- docs/product-technical-gap-baseline.md | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 504030646..e793ffb5a 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-02T06:04Z +**Snapshot:** 2026-09-02T06:44Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` **Workspace version:** `0.2.0` **Delivery authority:** issue [#175](https://github.com/ContextualWisdomLab/TEPP/issues/175), PR [#435](https://github.com/ContextualWisdomLab/TEPP/pull/435), and [`docs/delivery/pr-queue-authority-2026-09-01.md`](delivery/pr-queue-authority-2026-09-01.md) @@ -18,13 +18,13 @@ A planning document, mergeable branch, local test, predecessor-head result, queu | Open pull requests | **128** | The queue is down from the observed peak of 149, but remains release-blocking. | | Draft pull requests | **126** | Non-landable work is explicitly parked while consolidated, repaired, or supplied with missing evidence. | | Non-draft pull requests | **2** | #310 is the scientific landing vehicle; #480 is an independently landable CI/provider-admission repair. | -| Open issues | **15** | Includes #437 ADR identity normalization and #479 hourly free-route admission tracking. | +| Open issues | **16** | Includes #437 ADR identity normalization, #479 hourly free-route admission, and #481 dynamic-evaluation drift design/evidence gathering. | | GitHub releases | **0** | No open TEPP head is a released contract. | | Effective organization ruleset | `18156473` | Current-head required workflows, resolved conversations, qualifying review, and an allowed merge method remain landing authority. | Classic branch protection is not the sole policy source; organization rulesets are effective merge authority where applicable. Any increase in open PR count while #435 remains open is a WIP regression unless the new PR is a demonstrably independent root-cause repair that cannot safely belong to an existing landing vehicle. #480 is such an exception: it owns TEPP CI/provider-admission policy and cannot coherently belong to the Validation/Analysis Run, Longitudinal Modeling, or queue-documentation vehicles. -The live queue was **127** immediately before #480 was opened and is **128** after that bounded governance repair. This increase is intentional and must not be used as precedent for one-operation/model/route micro-PR creation. +The live queue was **127** immediately before #480 was opened and is **128** after that bounded governance repair. This increase is intentional and must not be used as precedent for one-operation/model/route micro-PR creation. Issue #481 adds design/evidence work only; it does not authorize an implementation PR until immutable released upstream contracts exist. ## Current priority open pull-request evidence @@ -32,7 +32,7 @@ This is a priority subset, not a row-for-row copy of the 128-PR queue. #435 inte | PR | Exact current head | Draft | Base | Ownership / disposition | | ---: | --- | :---: | --- | --- | -| #480 | `feb3399cad55b00f957263e4f60f0df8531a71c8` | false | main | TEPP CI/provider-admission governance repair for issue #479; explicit zero-cost discovered routes only, fail-closed when none exist. | +| #480 | `f8749d315bf65ad3ba0e3f790c6e00d90072de00` | false | main | TEPP CI/provider-admission governance repair for issue #479; explicit zero-cost discovered routes only, fail-closed when none exist; review-driven ADR/runbook/fixture/CHANGELOG repairs present. | | #469 | `72a7755bcc91b1107560c980ce817eca153126e4` | true | interpretation-run retrieval ancestry | Analysis Run / contextual-orchestrator interpretation-run retrieval, lookup, and stored-request adapter landing vehicle. | | #466 | `71f34b890bbd096eee152947c5e22d9778d323e8` | true | export-retrieval ancestry | Analysis Run / naruon export idempotency lookup and quarantine-parity landing vehicle. | | #464 | `1b3a477242336634be2c7867b29d39979e9a6dca` | true | temporal-context retrieval ancestry | Analysis Run / LineageWeave temporal-context stored-request GET+CLI landing vehicle. | @@ -85,7 +85,9 @@ Supported temporal estimators require realistic known-truth recovery for every c **#416 — Validation / Analysis Run consolidation.** Current head `b0d6cb8969aa0ddd386ab82a1755155fa13d18a8` contains non-force lineage from #473, #430, #461, #478, and #434. Shared admission/artifact invariants remain centralized while each refusal profile keeps its domain vocabulary. The #478 TRACEABILITY repair now explicitly keeps both `containment_recovery_rate` and `identity_recovery_rate` out of inspect payloads. Next compatible simple-refusal siblings still targeting `main` are #458 (`outcome_order_v1`) and #460 (`relation_absence_v1`); they should fold into this vehicle or a coherent successor rather than ship as independent bounded contexts. -**#480 / #479 — hourly free-route admission.** Protected main currently ranks all discovered chat candidates without a free-only admission step. #480 repairs the TEPP-owned bootstrap ACL so both provider-reported token-price components must be explicitly zero before a route reaches ranking. Paid, partially priced, and fully unpriced production rows are excluded; an empty explicit-free pool fails closed. The focused regression file covers paid-vs-free ranking, unknown Bytez-style prices, partial prices, and empty-pool refusal. This is a justified independent governance PR, not a precedent for route/model micro-PR proliferation. Exact-head Rust Foundation CI, Security Scan, and SAST were queued immediately after creation; no queued result is GREEN. +**#480 / #479 — hourly free-route admission.** Protected main currently ranks all discovered chat candidates without a free-only admission step. #480 current exact head `f8749d315bf65ad3ba0e3f790c6e00d90072de00` repairs the TEPP-owned bootstrap ACL so both provider-reported token-price components must be explicitly zero before a route reaches ranking. Paid, partially priced, fully unpriced, and missing-price production rows are excluded; an empty explicit-free pool fails closed. Focused regressions cover paid-vs-free ranking, unknown Bytez-style prices, partial prices, missing price attributes, and empty-pool refusal. Review-driven runbook, ADR, legacy-fixture, and CHANGELOG findings are repaired and observed threads are resolved. Exact-head Rust Foundation CI, Documentation Quality, Security Scan, and SAST Semgrep remain queued; no queued result is GREEN and no qualifying independent approval has been observed. + +**#481 — dynamic evaluation drift monitoring design/evidence lane.** TEPP owns temporal composition, availability/knowledge-cutoff semantics, longitudinal/multilevel/multiple-membership structure, drift/change-point evidence, and time-indexed invariance monitoring. It does not own item generation, provider/rater invocation, adjudication, anchor promotion, or reusable static psychometric kernels. Implementation remains blocked until canonical owners publish immutable released/digest-pinned run/item/rater/adjudication/linking contracts. The first eventual slice is a versioned ACL with no-anchor/no-linking fail-closed tests, not a drift score or dashboard. Current mutable sibling PR heads are evidence only and must not become production dependencies. **#315 — static-standardisation ownership repair.** #315 remains Draft only to preserve TEPP-specific `TIPREDVARstd` naming/event-time/refusal semantics. It must not merge with duplicate reusable arithmetic. After the live fast-mlsirm owner contract is merged and released/versioned, #315 must consume that immutable contract through an ACL, prove parity, retain TEPP temporal/model admission, delete wrong-owner production arithmetic, and fold into a Measurement/Longitudinal Modeling landing vehicle. @@ -119,6 +121,7 @@ TEPP protected main checksum-pins contextual-orchestrator commit `e226e1197bdfc8 | GAP-014 | dependency-review evidence unavailable on predecessor heads | `external-control-risk` | authorized dependency-graph availability, pinned Dependency Review execution, exact-current Security Scan GREEN, no fail-open bypass | | GAP-015 | contextual-orchestrator pin behind protected upstream | `supply-chain-pinned` | reproducible replacement archive SHA-256, exact diff/review, pinned TEPP adoption | | GAP-016 | hourly LLM bootstrap can admit paid/unknown-price routes | `active-repair` | #480 exact-head GREEN, qualifying review, merge to protected main, issue #479 closure | +| GAP-017 | dynamic evaluation item/rater/anchor drift monitoring | `blocked-external-design` | released/digest-pinned owner contracts, ACL conformance, no-anchor/no-linking refusal, then evidence-gated temporal monitoring | ## Delivery and release order From 336cd48499f415f7951823e870eabaf8884f77ed Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 18:06:17 +0900 Subject: [PATCH 086/235] docs: refresh queue and Analysis Run consolidation facts --- docs/product-technical-gap-baseline.md | 32 ++++++++++++++------------ 1 file changed, 17 insertions(+), 15 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index e793ffb5a..ac7c4a0ed 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-02T06:44Z +**Snapshot:** 2026-09-02T09:04Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` **Workspace version:** `0.2.0` **Delivery authority:** issue [#175](https://github.com/ContextualWisdomLab/TEPP/issues/175), PR [#435](https://github.com/ContextualWisdomLab/TEPP/pull/435), and [`docs/delivery/pr-queue-authority-2026-09-01.md`](delivery/pr-queue-authority-2026-09-01.md) @@ -15,23 +15,25 @@ A planning document, mergeable branch, local test, predecessor-head result, queu | Signal | Current evidence | Delivery implication | | --- | ---: | --- | | Protected `main` | `1bc02f580cf48e1d39da239f0e818453437c31c3` | Capability claims remain bounded to this commit until protected main changes. | -| Open pull requests | **128** | The queue is down from the observed peak of 149, but remains release-blocking. | -| Draft pull requests | **126** | Non-landable work is explicitly parked while consolidated, repaired, or supplied with missing evidence. | -| Non-draft pull requests | **2** | #310 is the scientific landing vehicle; #480 is an independently landable CI/provider-admission repair. | +| Open pull requests | **130** | The queue is down from the observed peak of 149 but increased from the prior fresh 128-PR snapshot; #482/#483 are classified as WIP-regression fold children, not independent landing authority. | +| Draft pull requests | **129** | Non-landable work is explicitly parked while consolidated, repaired, or supplied with missing evidence. | +| Non-draft pull requests | **1** | #480 is currently the only non-Draft PR; #310 is Draft and remains scientific lineage/landing work rather than protected-main delivery. | | Open issues | **16** | Includes #437 ADR identity normalization, #479 hourly free-route admission, and #481 dynamic-evaluation drift design/evidence gathering. | | GitHub releases | **0** | No open TEPP head is a released contract. | -| Effective organization ruleset | `18156473` | Current-head required workflows, resolved conversations, qualifying review, and an allowed merge method remain landing authority. | +| Effective organization ruleset | `18156473` | One qualifying approval, stale-review dismissal after push, resolved review threads, unattributed-change approval where applicable, and central required workflows remain landing authority. | Classic branch protection is not the sole policy source; organization rulesets are effective merge authority where applicable. Any increase in open PR count while #435 remains open is a WIP regression unless the new PR is a demonstrably independent root-cause repair that cannot safely belong to an existing landing vehicle. #480 is such an exception: it owns TEPP CI/provider-admission policy and cannot coherently belong to the Validation/Analysis Run, Longitudinal Modeling, or queue-documentation vehicles. -The live queue was **127** immediately before #480 was opened and is **128** after that bounded governance repair. This increase is intentional and must not be used as precedent for one-operation/model/route micro-PR creation. Issue #481 adds design/evidence work only; it does not authorize an implementation PR until immutable released upstream contracts exist. +The queue was **128** at the previous fresh snapshot and rose to **130** when #482 `role_contradiction_v1` and #483 `retrospective_edge_v1` were opened as independent main-targeting one-profile slices. Fresh changed-file classification showed both modify the same Analysis Run/Validation shared Cargo/lib/docs surfaces as #416. Both have therefore been retargeted non-destructively to #416 and marked `fold_into_landing_vehicle`; GitHub now reports both as non-mergeable children, proving that a real conflict-resolving fold is required. Their unique source, tests, doctoring, and temporal-refusal semantics must be preserved. Issue #481 adds design/evidence work only; it does not authorize an implementation PR until immutable released upstream contracts exist. ## Current priority open pull-request evidence -This is a priority subset, not a row-for-row copy of the 128-PR queue. #435 intentionally omits its own SHA because embedding the branch head in a file changed by that same branch would make the evidence self-stale. +This is a priority subset, not a row-for-row copy of the 130-PR queue. #435 intentionally omits its own SHA because embedding the branch head in a file changed by that same branch would make the evidence self-stale. | PR | Exact current head | Draft | Base | Ownership / disposition | | ---: | --- | :---: | --- | --- | +| #483 | `541b8a8adce5602710becbc7c2c42f1d43cd0b73` | true | #416 branch | `retrospective_edge_v1` fold child; typed cutoff, bounded evidence, validated terminal status, source/tests/doctoring preserved; shared-file conflict must be resolved in the surviving landing head. | +| #482 | `6066981fd98807e5ee18c247c64afbc0e9ecad9c` | true | #416 branch | `role_contradiction_v1` fold child; typed cutoff, bounded evidence, validated terminal status, source/tests/doctoring preserved; shared-file conflict must be resolved in the surviving landing head. | | #480 | `f8749d315bf65ad3ba0e3f790c6e00d90072de00` | false | main | TEPP CI/provider-admission governance repair for issue #479; explicit zero-cost discovered routes only, fail-closed when none exist; review-driven ADR/runbook/fixture/CHANGELOG repairs present. | | #469 | `72a7755bcc91b1107560c980ce817eca153126e4` | true | interpretation-run retrieval ancestry | Analysis Run / contextual-orchestrator interpretation-run retrieval, lookup, and stored-request adapter landing vehicle. | | #466 | `71f34b890bbd096eee152947c5e22d9778d323e8` | true | export-retrieval ancestry | Analysis Run / naruon export idempotency lookup and quarantine-parity landing vehicle. | @@ -39,9 +41,9 @@ This is a priority subset, not a row-for-row copy of the 128-PR queue. #435 inte | #462 | `c1b7d627167dd7636d2975cc41cec050a5e477ba` | true | main | Bounded source-name compatibility repair; Rust `node_id`, v1 serialized key remains `id`. | | #456 | `f02436236a73824c87c6043fc5d1e0b08cb0d448` | true | project-history retrieval ancestry | Analysis Run / LineageWeave project-history landing vehicle; includes folded query CLI evidence. | | #417 | `1e468f62ec47f3476a7b4d18ed2980451dc425cf` | true | main | Analysis Run / naruon export retrieval GET+CLI landing vehicle. | -| #416 | `b0d6cb8969aa0ddd386ab82a1755155fa13d18a8` | true | main | Provisional Validation / Analysis Run simple-refusal landing vehicle; now preserves copy identity, inferred status, location membership, episode membership, subevent containment, and membership-target evidence. | +| #416 | `10b61fcd4e0e421ce76fd3d5553ac6e2038ca219` | true | main | Provisional Validation / Analysis Run simple-refusal landing vehicle; preserves copy identity, inferred status, location membership, episode membership, subevent containment, and membership-target evidence with typed cutoff and terminal-validation repairs. | | #315 | `538f9bd1c76422bc894836b65083c62544330c7c` | true | main | TEPP `TIPREDVARstd` adapter lineage only; blocked on a released fast-mlsirm covariance-standardisation contract and deletion of duplicate local arithmetic. | -| #310 | `3132a0818455c982f211a7f170fdf2b8db63fa7b` | false | main | Longitudinal Modeling landing vehicle; repaired lagged correlation, diffusion research candidates, and full-range/subnormal-safe CWC mean arithmetic. | +| #310 | `3132a0818455c982f211a7f170fdf2b8db63fa7b` | true | main | Longitudinal Modeling scientific landing work; repaired lagged correlation, diffusion research candidates, and full-range/subnormal-safe CWC mean arithmetic; currently Draft. | Exact current-head evidence is authoritative only for the named PR and becomes stale after any source mutation. @@ -81,11 +83,11 @@ Supported temporal estimators require realistic known-truth recovery for every c ## Current repairs and blockers -**#310 — Longitudinal Modeling landing vehicle.** Closed predecessor #441 is contained by #310. The invalid one-sided covariance/earlier-variance ratio remains retired; public lagged Pearson correlation requires lagged covariance and both occasion-specific marginal variances. `EventTimeInterval` is preserved end-to-end. Current head `3132a0818455c982f211a7f170fdf2b8db63fa7b` also preserves the full-range/subnormal-safe mixed-sign CWC mean repair. It is not landable until exact-head required workflows terminate successfully and a qualifying independent approval exists. +**#310 — Longitudinal Modeling scientific landing work.** Closed predecessor #441 is contained by #310. The invalid one-sided covariance/earlier-variance ratio remains retired; public lagged Pearson correlation requires lagged covariance and both occasion-specific marginal variances. `EventTimeInterval` is preserved end-to-end. Current head `3132a0818455c982f211a7f170fdf2b8db63fa7b` also preserves the full-range/subnormal-safe mixed-sign CWC mean repair. It is currently Draft and is not landable until it is coherently Ready, exact-head required workflows terminate successfully, current review threads are resolved, and a qualifying independent approval exists. -**#416 — Validation / Analysis Run consolidation.** Current head `b0d6cb8969aa0ddd386ab82a1755155fa13d18a8` contains non-force lineage from #473, #430, #461, #478, and #434. Shared admission/artifact invariants remain centralized while each refusal profile keeps its domain vocabulary. The #478 TRACEABILITY repair now explicitly keeps both `containment_recovery_rate` and `identity_recovery_rate` out of inspect payloads. Next compatible simple-refusal siblings still targeting `main` are #458 (`outcome_order_v1`) and #460 (`relation_absence_v1`); they should fold into this vehicle or a coherent successor rather than ship as independent bounded contexts. +**#416 — Validation / Analysis Run consolidation.** Current head `10b61fcd4e0e421ce76fd3d5553ac6e2038ca219` contains non-force lineage from #473, #430, #461, #478, and #434. Shared admission/artifact invariants remain centralized while each refusal profile keeps its domain vocabulary. Cross-profile repairs enforce typed `KnowledgeCutoff::instant()` equality and keep inference claims out of terminal `validation_status`. #458 (`outcome_order_v1`) and #460 (`relation_absence_v1`) remain fold children. #482 (`role_contradiction_v1`) and #483 (`retrospective_edge_v1`) were newly opened against `main`, triggered the WIP circuit breaker, and have now been retargeted to #416; both expose real shared-file conflicts and require a conflict-resolving fold rather than independent landing. Unique RED/repair/tests/doctoring evidence must survive into the eventual landing head. -**#480 / #479 — hourly free-route admission.** Protected main currently ranks all discovered chat candidates without a free-only admission step. #480 current exact head `f8749d315bf65ad3ba0e3f790c6e00d90072de00` repairs the TEPP-owned bootstrap ACL so both provider-reported token-price components must be explicitly zero before a route reaches ranking. Paid, partially priced, fully unpriced, and missing-price production rows are excluded; an empty explicit-free pool fails closed. Focused regressions cover paid-vs-free ranking, unknown Bytez-style prices, partial prices, missing price attributes, and empty-pool refusal. Review-driven runbook, ADR, legacy-fixture, and CHANGELOG findings are repaired and observed threads are resolved. Exact-head Rust Foundation CI, Documentation Quality, Security Scan, and SAST Semgrep remain queued; no queued result is GREEN and no qualifying independent approval has been observed. +**#480 / #479 — hourly free-route admission.** Protected main currently ranks all discovered chat candidates without a free-only admission step. #480 current exact head `f8749d315bf65ad3ba0e3f790c6e00d90072de00` repairs the TEPP-owned bootstrap ACL so both provider-reported token-price components must be explicitly zero before a route reaches ranking. Paid, partially priced, fully unpriced, and missing-price production rows are excluded; an empty explicit-free pool fails closed. Focused regressions cover paid-vs-free ranking, unknown Bytez-style prices, partial prices, missing price attributes, and empty-pool refusal. Review-driven runbook, ADR, legacy-fixture, and CHANGELOG findings are repaired. Exact-head required workflows and qualifying independent review remain the merge authority; queued evidence is not GREEN. **#481 — dynamic evaluation drift monitoring design/evidence lane.** TEPP owns temporal composition, availability/knowledge-cutoff semantics, longitudinal/multilevel/multiple-membership structure, drift/change-point evidence, and time-indexed invariance monitoring. It does not own item generation, provider/rater invocation, adjudication, anchor promotion, or reusable static psychometric kernels. Implementation remains blocked until canonical owners publish immutable released/digest-pinned run/item/rater/adjudication/linking contracts. The first eventual slice is a versioned ACL with no-anchor/no-linking fail-closed tests, not a drift score or dashboard. Current mutable sibling PR heads are evidence only and must not become production dependencies. @@ -97,7 +99,7 @@ Supported temporal estimators require realistic known-truth recovery for every c The live fast-mlsirm generalized-mixed/dependence compiler remains owner-side candidate work and is not a TEPP production dependency until merged and released/versioned. TEPP consumes its Published Language through an ACL and never copies the static kernel implementation. -TEPP protected main checksum-pins contextual-orchestrator commit `e226e1197bdfc890c9d8e5b9b648c78857d7e465` with SHA-256 `964b22ff577e3862b761af847ccad65489bb3f8fc750c8f84fcf8628df096673`. Upstream protected `main` is `8839081659df587b19642be17b9114f9dee8b666`, which contains the richer `orchestrator/free` route-mode and discovery work absent from the pinned revision. Advancing TEPP still requires a reproducible replacement archive digest and exact replacement review; checksum validation must not be removed or guessed. #480 therefore repairs free-only admission using the current pinned public discovery-price contract rather than silently upgrading the supply-chain pin. +TEPP protected main checksum-pins contextual-orchestrator commit `e226e1197bdfc890c9d8e5b9b648c78857d7e465` with SHA-256 `964b22ff577e3862b761af847ccad65489bb3f8fc750c8f84fcf8628df096673`. Upstream protected `main` must be re-read before any adoption. Advancing TEPP requires a reproducible replacement archive digest and exact replacement review; checksum validation must not be removed or guessed. #480 therefore repairs free-only admission using the currently pinned discovery-price contract rather than silently upgrading the supply-chain pin. `context-graph-contracts` and `enterprise-architecture-core` remain read-only to this writer while their dedicated Context Fabric owner loop is active. Open heads are candidate evidence, not released contracts. TEPP may maintain fail-closed conformance fixtures behind candidate/test boundaries, but deployable integration and authoritative EA projection require a released/versioned Context Graph artifact plus passing compatibility evidence. TEPP latent estimates, measurement scores, inferred event relations, and validity evidence do not become authoritative EA facts. @@ -105,7 +107,7 @@ TEPP protected main checksum-pins contextual-orchestrator commit `e226e1197bdfc8 | ID | Gap | Maturity | Closure evidence | | --- | --- | --- | --- | -| GAP-001 | PR authority fragmented across 128 open PRs | `release-blocking` | coherent landing vehicles, unique evidence preservation, protected-main reduction | +| GAP-001 | PR authority fragmented across 130 open PRs | `release-blocking` | coherent landing vehicles, unique evidence preservation, protected-main reduction | | GAP-002 | multilingual span-grounded semantic/concept admission | `partial` | immutable offsets/layout, language profiles, concept dictionary, invariance/calibration, hostile-input tests | | GAP-003 | shared-latent temporal topic estimator | `partial` | Rust CPU f64 likelihood/uncertainty, relation/time/membership effects, true recovery, fitted candidate-K | | GAP-004 | durable end-to-end Analysis Run | `partial` | idempotent lifecycle, persistence/recovery, estimator-bound artifacts, validation/promotion separation, Compose E2E | @@ -129,4 +131,4 @@ Queue/ADR/domain authority precedes semantic admission, the Rust CPU f64 shared- Every open PR is classified as `landing_vehicle`, `stacked_dependency`, `fold_into_landing_vehicle`, `superseded`, `duplicate`, `research_lineage_only`, `blocked_external`, or an explicitly justified independent root-cause repair. Exact heads must be compared before closure. Strict ancestry permits safe consolidation; diverged siblings require a real code/test fold first. -TEPP has no GitHub release at this snapshot. A release is permitted only after a clean integration state reaches protected main with exact protected-head CI/security evidence, claim-scoped scientific and recovery acceptance, reproducible artifacts with SBOM and provenance, validated migrations/upgrade/rollback/recovery where applicable, consistent version metadata and a current `CHANGELOG.md`, accessibility and operability evidence for user-facing components, no unresolved scientific/privacy/security/supply-chain blockers, and released integration contracts where cross-product deployment depends on them. +TEPP has no GitHub release at this snapshot. A release is permitted only after a clean integration state reaches protected main with exact protected-head CI/security evidence, claim-scoped scientific and recovery acceptance, reproducible artifacts with SBOM and provenance, validated migrations/upgrade/rollback/recovery where applicable, consistent version metadata and a current `CHANGELOG.md`, accessibility and operability evidence for user-facing components, no unresolved scientific/privacy/security/supply-chain blockers, and released integration contracts where cross-product deployment depends on them. \ No newline at end of file From c67ed700f0e7d187c0830493a15bcc37bb4aee85 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 20:33:13 +0900 Subject: [PATCH 087/235] docs(queue): refresh live landing evidence --- docs/product-technical-gap-baseline.md | 55 ++++++++++++-------------- 1 file changed, 25 insertions(+), 30 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index ac7c4a0ed..4faea55da 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-02T09:04Z +**Snapshot:** 2026-09-02T11:29Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` **Workspace version:** `0.2.0` **Delivery authority:** issue [#175](https://github.com/ContextualWisdomLab/TEPP/issues/175), PR [#435](https://github.com/ContextualWisdomLab/TEPP/pull/435), and [`docs/delivery/pr-queue-authority-2026-09-01.md`](delivery/pr-queue-authority-2026-09-01.md) @@ -15,35 +15,30 @@ A planning document, mergeable branch, local test, predecessor-head result, queu | Signal | Current evidence | Delivery implication | | --- | ---: | --- | | Protected `main` | `1bc02f580cf48e1d39da239f0e818453437c31c3` | Capability claims remain bounded to this commit until protected main changes. | -| Open pull requests | **130** | The queue is down from the observed peak of 149 but increased from the prior fresh 128-PR snapshot; #482/#483 are classified as WIP-regression fold children, not independent landing authority. | +| Open pull requests | **130** | The queue is down from the observed peak of 149 but remains above the prior fresh 128-PR snapshot; #482/#483 are WIP-regression fold children, not independent landing authority. | | Draft pull requests | **129** | Non-landable work is explicitly parked while consolidated, repaired, or supplied with missing evidence. | -| Non-draft pull requests | **1** | #480 is currently the only non-Draft PR; #310 is Draft and remains scientific lineage/landing work rather than protected-main delivery. | +| Non-draft pull requests | **1** | #480 is the only non-Draft PR, but it is not deployable while contextual-orchestrator has no compatible immutable release. | | Open issues | **16** | Includes #437 ADR identity normalization, #479 hourly free-route admission, and #481 dynamic-evaluation drift design/evidence gathering. | | GitHub releases | **0** | No open TEPP head is a released contract. | | Effective organization ruleset | `18156473` | One qualifying approval, stale-review dismissal after push, resolved review threads, unattributed-change approval where applicable, and central required workflows remain landing authority. | -Classic branch protection is not the sole policy source; organization rulesets are effective merge authority where applicable. Any increase in open PR count while #435 remains open is a WIP regression unless the new PR is a demonstrably independent root-cause repair that cannot safely belong to an existing landing vehicle. #480 is such an exception: it owns TEPP CI/provider-admission policy and cannot coherently belong to the Validation/Analysis Run, Longitudinal Modeling, or queue-documentation vehicles. +Classic branch protection is not the sole policy source; organization rulesets are effective merge authority where applicable. Any increase in open PR count while #435 remains open is a WIP regression unless the new PR is a demonstrably independent root-cause repair that cannot safely belong to an existing landing vehicle. #480 is such an exception because it owns TEPP CI/provider-admission policy and cannot coherently belong to the Validation/Analysis Run, Longitudinal Modeling, or queue-documentation vehicles. -The queue was **128** at the previous fresh snapshot and rose to **130** when #482 `role_contradiction_v1` and #483 `retrospective_edge_v1` were opened as independent main-targeting one-profile slices. Fresh changed-file classification showed both modify the same Analysis Run/Validation shared Cargo/lib/docs surfaces as #416. Both have therefore been retargeted non-destructively to #416 and marked `fold_into_landing_vehicle`; GitHub now reports both as non-mergeable children, proving that a real conflict-resolving fold is required. Their unique source, tests, doctoring, and temporal-refusal semantics must be preserved. Issue #481 adds design/evidence work only; it does not authorize an implementation PR until immutable released upstream contracts exist. +The queue was **128** at the previous fresh snapshot and rose to **130** when #482 `role_contradiction_v1` and #483 `retrospective_edge_v1` were opened as one-profile slices. Fresh changed-file classification showed both modify the same Analysis Run/Validation shared Cargo/lib/docs surfaces as #416. #458, #460, #482, and #483 now all target the #416 branch with comparison base SHA `0b7155cc238defb1e55129ff3000658f04b343cf`; GitHub still reports all four as non-mergeable. The remaining conflicts are therefore real shared-file fold work rather than stale base metadata. Unique source, tests, doctoring, RED/repair lineage, and temporal-refusal semantics must survive into the eventual #416 landing head. Issue #481 remains design/evidence work only and does not authorize implementation against mutable upstream PR heads. ## Current priority open pull-request evidence -This is a priority subset, not a row-for-row copy of the 130-PR queue. #435 intentionally omits its own SHA because embedding the branch head in a file changed by that same branch would make the evidence self-stale. +This is a freshly verified priority subset, not a row-for-row copy of the 130-PR queue. #435 intentionally omits its own SHA because embedding a branch head inside a file changed by that same branch would make the file self-stale. | PR | Exact current head | Draft | Base | Ownership / disposition | | ---: | --- | :---: | --- | --- | -| #483 | `541b8a8adce5602710becbc7c2c42f1d43cd0b73` | true | #416 branch | `retrospective_edge_v1` fold child; typed cutoff, bounded evidence, validated terminal status, source/tests/doctoring preserved; shared-file conflict must be resolved in the surviving landing head. | -| #482 | `6066981fd98807e5ee18c247c64afbc0e9ecad9c` | true | #416 branch | `role_contradiction_v1` fold child; typed cutoff, bounded evidence, validated terminal status, source/tests/doctoring preserved; shared-file conflict must be resolved in the surviving landing head. | -| #480 | `f8749d315bf65ad3ba0e3f790c6e00d90072de00` | false | main | TEPP CI/provider-admission governance repair for issue #479; explicit zero-cost discovered routes only, fail-closed when none exist; review-driven ADR/runbook/fixture/CHANGELOG repairs present. | -| #469 | `72a7755bcc91b1107560c980ce817eca153126e4` | true | interpretation-run retrieval ancestry | Analysis Run / contextual-orchestrator interpretation-run retrieval, lookup, and stored-request adapter landing vehicle. | -| #466 | `71f34b890bbd096eee152947c5e22d9778d323e8` | true | export-retrieval ancestry | Analysis Run / naruon export idempotency lookup and quarantine-parity landing vehicle. | -| #464 | `1b3a477242336634be2c7867b29d39979e9a6dca` | true | temporal-context retrieval ancestry | Analysis Run / LineageWeave temporal-context stored-request GET+CLI landing vehicle. | -| #462 | `c1b7d627167dd7636d2975cc41cec050a5e477ba` | true | main | Bounded source-name compatibility repair; Rust `node_id`, v1 serialized key remains `id`. | -| #456 | `f02436236a73824c87c6043fc5d1e0b08cb0d448` | true | project-history retrieval ancestry | Analysis Run / LineageWeave project-history landing vehicle; includes folded query CLI evidence. | -| #417 | `1e468f62ec47f3476a7b4d18ed2980451dc425cf` | true | main | Analysis Run / naruon export retrieval GET+CLI landing vehicle. | -| #416 | `10b61fcd4e0e421ce76fd3d5553ac6e2038ca219` | true | main | Provisional Validation / Analysis Run simple-refusal landing vehicle; preserves copy identity, inferred status, location membership, episode membership, subevent containment, and membership-target evidence with typed cutoff and terminal-validation repairs. | -| #315 | `538f9bd1c76422bc894836b65083c62544330c7c` | true | main | TEPP `TIPREDVARstd` adapter lineage only; blocked on a released fast-mlsirm covariance-standardisation contract and deletion of duplicate local arithmetic. | -| #310 | `3132a0818455c982f211a7f170fdf2b8db63fa7b` | true | main | Longitudinal Modeling scientific landing work; repaired lagged correlation, diffusion research candidates, and full-range/subnormal-safe CWC mean arithmetic; currently Draft. | +| #483 | `847d96f913bb261803ac0bd751ad7e4f51324cee` | true | #416 branch @ `0b7155cc238defb1e55129ff3000658f04b343cf` | `retrospective_edge_v1` fold child; cutoff-before-identity admission repair and unique tests/doctoring must survive the conflict-resolving fold. | +| #482 | `506dbae236a4484301b704b6c6a05b20faf0fe69` | true | #416 branch @ `0b7155cc238defb1e55129ff3000658f04b343cf` | `role_contradiction_v1` fold child; cutoff-before-identity admission repair and unique tests/doctoring must survive the conflict-resolving fold. | +| #480 | `d4b5f1687a9a898683894388582405a184ceb0d1` | false | main | TEPP CI/provider-admission governance repair; explicit zero-cost routes only and fail-closed empty pool. Not deployable until a compatible immutable contextual-orchestrator release is adopted. | +| #460 | `dfab4eab5ff733731e565a9348072b8dab2e4912` | true | #416 branch @ `0b7155cc238defb1e55129ff3000658f04b343cf` | `relation_absence_v1` fold child; typed cutoff equality and terminal validation-status separation preserved. | +| #458 | `08165e3b3c929b4ae77396689549f72723ff8ff5` | true | #416 branch @ `0b7155cc238defb1e55129ff3000658f04b343cf` | `outcome_order_v1` fold child; typed cutoff equality and terminal validation-status separation preserved. | +| #416 | `0b7155cc238defb1e55129ff3000658f04b343cf` | true | main | Provisional Validation / Analysis Run simple-refusal landing vehicle; generic cutoff-before-identity admission is the surviving leakage-safe invariant. | +| #310 | `a9f84756d9e47f945040470b04268fb837ddfe4e` | true | main | Longitudinal Modeling scientific landing work; one numerical authority for irregular residual log-rate and repaired lagged correlation. Current hosted merge evidence is non-GREEN. | Exact current-head evidence is authoritative only for the named PR and becomes stale after any source mutation. @@ -83,25 +78,25 @@ Supported temporal estimators require realistic known-truth recovery for every c ## Current repairs and blockers -**#310 — Longitudinal Modeling scientific landing work.** Closed predecessor #441 is contained by #310. The invalid one-sided covariance/earlier-variance ratio remains retired; public lagged Pearson correlation requires lagged covariance and both occasion-specific marginal variances. `EventTimeInterval` is preserved end-to-end. Current head `3132a0818455c982f211a7f170fdf2b8db63fa7b` also preserves the full-range/subnormal-safe mixed-sign CWC mean repair. It is currently Draft and is not landable until it is coherently Ready, exact-head required workflows terminate successfully, current review threads are resolved, and a qualifying independent approval exists. +**#310 — Longitudinal Modeling scientific landing work.** Closed predecessor #441 is contained by #310. The invalid one-sided covariance/earlier-variance ratio remains retired; public lagged Pearson correlation requires lagged covariance and both occasion-specific marginal variances. `EventTimeInterval` is preserved end-to-end. Current head `a9f84756d9e47f945040470b04268fb837ddfe4e` also removes duplicate numerical authority: `stable_irregular_rate` is a compatibility facade over the canonical `irregular_residual` implementation, preserving log-domain recovery when direct same-sign ratios overflow or underflow. The PR is Draft. Exact-head CodeQL PR run `33623224470` ends in `startup_failure` with zero jobs before checkout; Documentation Quality is pending and Rust/Security/Semgrep/OSV/Scorecard remain queued. No qualifying independent approval exists. This is central workflow evidence, not permission to bypass the gate. -**#416 — Validation / Analysis Run consolidation.** Current head `10b61fcd4e0e421ce76fd3d5553ac6e2038ca219` contains non-force lineage from #473, #430, #461, #478, and #434. Shared admission/artifact invariants remain centralized while each refusal profile keeps its domain vocabulary. Cross-profile repairs enforce typed `KnowledgeCutoff::instant()` equality and keep inference claims out of terminal `validation_status`. #458 (`outcome_order_v1`) and #460 (`relation_absence_v1`) remain fold children. #482 (`role_contradiction_v1`) and #483 (`retrospective_edge_v1`) were newly opened against `main`, triggered the WIP circuit breaker, and have now been retargeted to #416; both expose real shared-file conflicts and require a conflict-resolving fold rather than independent landing. Unique RED/repair/tests/doctoring evidence must survive into the eventual landing head. +**#416 — Validation / Analysis Run consolidation.** Current head `0b7155cc238defb1e55129ff3000658f04b343cf` contains non-force lineage from #473, #430, #461, #478, and #434. Shared admission/artifact invariants remain centralized while each refusal profile keeps its domain vocabulary. Generic RED `ffee655404716bf8d33c898a3c1a87a543abe701` and repair `0b7155cc238defb1e55129ff3000658f04b343cf` enforce availability cutoff before duplicate-identity admission so future-unavailable rows cannot change historical replay. #458, #460, #482, and #483 are now compared against this exact head and still conflict on shared Cargo/lib/lock/docs surfaces. Their unique evidence must be folded, not replaced or independently landed. -**#480 / #479 — hourly free-route admission.** Protected main currently ranks all discovered chat candidates without a free-only admission step. #480 current exact head `f8749d315bf65ad3ba0e3f790c6e00d90072de00` repairs the TEPP-owned bootstrap ACL so both provider-reported token-price components must be explicitly zero before a route reaches ranking. Paid, partially priced, fully unpriced, and missing-price production rows are excluded; an empty explicit-free pool fails closed. Focused regressions cover paid-vs-free ranking, unknown Bytez-style prices, partial prices, missing price attributes, and empty-pool refusal. Review-driven runbook, ADR, legacy-fixture, and CHANGELOG findings are repaired. Exact-head required workflows and qualifying independent review remain the merge authority; queued evidence is not GREEN. +**#480 / #479 — hourly free-route admission.** #480 current exact head `d4b5f1687a9a898683894388582405a184ceb0d1` repairs the TEPP-owned bootstrap ACL so both provider-reported token-price components must be explicitly zero before a route reaches ranking. Paid, partially priced, fully unpriced, and missing-price rows are excluded; an empty explicit-free pool fails closed. Exact-head CodeQL also terminates as `startup_failure` while other required lanes remain queued. More importantly, contextual-orchestrator protected `main` is now `6d60c756b6481c59bd8fee95996315279bd708d5` and has **zero GitHub releases**. A mutable owner head is not production dependency authority, so #480 cannot be deployed or merged as a complete integration until a compatible immutable contextual-orchestrator release is verified and TEPP adopts it through an exact ACL/dependency bump. **#481 — dynamic evaluation drift monitoring design/evidence lane.** TEPP owns temporal composition, availability/knowledge-cutoff semantics, longitudinal/multilevel/multiple-membership structure, drift/change-point evidence, and time-indexed invariance monitoring. It does not own item generation, provider/rater invocation, adjudication, anchor promotion, or reusable static psychometric kernels. Implementation remains blocked until canonical owners publish immutable released/digest-pinned run/item/rater/adjudication/linking contracts. The first eventual slice is a versioned ACL with no-anchor/no-linking fail-closed tests, not a drift score or dashboard. Current mutable sibling PR heads are evidence only and must not become production dependencies. -**#315 — static-standardisation ownership repair.** #315 remains Draft only to preserve TEPP-specific `TIPREDVARstd` naming/event-time/refusal semantics. It must not merge with duplicate reusable arithmetic. After the live fast-mlsirm owner contract is merged and released/versioned, #315 must consume that immutable contract through an ACL, prove parity, retain TEPP temporal/model admission, delete wrong-owner production arithmetic, and fold into a Measurement/Longitudinal Modeling landing vehicle. +**#315 — static-standardisation ownership repair.** #315 remains lineage only to preserve TEPP-specific `TIPREDVARstd` naming/event-time/refusal semantics. It must not merge with duplicate reusable arithmetic. After the live fast-mlsirm owner contract is merged and released/versioned, TEPP must consume that immutable contract through an ACL, prove parity, retain temporal/model admission, delete wrong-owner production arithmetic, and fold into a Measurement/Longitudinal Modeling landing vehicle. **#437 — ADR identity.** Repository-wide ADR IDs are immutable authority. Duplicate index IDs, duplicate targets, duplicate numbered ADR files, repeated authority declarations, and index/file status or maturity drift must fail deterministic documentation fitness tests. Operation-specific ADRs on adapter/model micro-branches are implementation lineage pending normalization, not branch-local architecture authority. #435 contains the current deterministic fitness implementation; issue closure still requires exact-head hosted evidence and a coherent landing decision. ## Dependency and Context Fabric status -The live fast-mlsirm generalized-mixed/dependence compiler remains owner-side candidate work and is not a TEPP production dependency until merged and released/versioned. TEPP consumes its Published Language through an ACL and never copies the static kernel implementation. +fast-mlsirm protected `main` is `45627700c26c29bca150896a9519a9b7426acb56`. Generalized-mixed/dependence compiler #1714 remains open at `6abdcc2acab7be463977e35191566119e384c906`; its typed membership topology/weight authority and deterministic candidate manifest are owner-side candidate work, not TEPP production dependency authority. The latest immutable fast-mlsirm release is `v0.9.1` from 2026-08-26 and predates #1714. TEPP consumes future compatible Published Language through an ACL and never copies the static implementation. -TEPP protected main checksum-pins contextual-orchestrator commit `e226e1197bdfc890c9d8e5b9b648c78857d7e465` with SHA-256 `964b22ff577e3862b761af847ccad65489bb3f8fc750c8f84fcf8628df096673`. Upstream protected `main` must be re-read before any adoption. Advancing TEPP requires a reproducible replacement archive digest and exact replacement review; checksum validation must not be removed or guessed. #480 therefore repairs free-only admission using the currently pinned discovery-price contract rather than silently upgrading the supply-chain pin. +TEPP protected main checksum-pins contextual-orchestrator commit `e226e1197bdfc890c9d8e5b9b648c78857d7e465` with SHA-256 `964b22ff577e3862b761af847ccad65489bb3f8fc750c8f84fcf8628df096673`. Fresh owner state is protected `main@6d60c756b6481c59bd8fee95996315279bd708d5`, but contextual-orchestrator has zero GitHub releases. Advancing TEPP requires a compatible immutable release, reproducible identity/provenance, and an exact reviewed ACL/dependency bump; checksum validation must not be removed or guessed. -`context-graph-contracts` and `enterprise-architecture-core` remain read-only to this writer while their dedicated Context Fabric owner loop is active. Open heads are candidate evidence, not released contracts. TEPP may maintain fail-closed conformance fixtures behind candidate/test boundaries, but deployable integration and authoritative EA projection require a released/versioned Context Graph artifact plus passing compatibility evidence. TEPP latent estimates, measurement scores, inferred event relations, and validity evidence do not become authoritative EA facts. +`context-graph-contracts` and `enterprise-architecture-core` remain read-only to this writer. Context Graph protected/default `develop` is `99cb5468ba3c15c5e79688f53dee74724fae2d13`, with **14 open PRs** and **zero releases**. EA Core protected/default `develop` is `1c0fa8b15ceb9e72186274aeb255d6777eb84ef4`, with **24 open PRs** and **zero releases**. Their open heads are candidate evidence, not released contracts. TEPP may maintain fail-closed conformance fixtures behind candidate/test boundaries, but deployable integration and authoritative EA projection require released/versioned Context Graph artifacts plus passing compatibility and provenance evidence. TEPP latent estimates, measurement scores, inferred event relations, and validity evidence do not become authoritative EA facts. ## Gap register @@ -115,19 +110,19 @@ TEPP protected main checksum-pins contextual-orchestrator commit `e226e1197bdfc8 | GAP-006 | event intelligence | `partial` | calibrated detection/tracking/schema/interval recovery and durable artifacts | | GAP-007 | accelerator/memory evidence | `accepted-target` | real hardware, CPU-f64 parity, bounded OOM/fallback evidence | | GAP-008 | network/cluster buyer workflow | `partial` | known-truth recovery, uncertainty/stability, repeated consensus, exact-value export | -| GAP-009 | production interpreter/verifier | `partial` | contextual-orchestrator execution, evidence citations, independent verification, abstention/fallback | +| GAP-009 | production interpreter/verifier | `partial` | released contextual-orchestrator execution, evidence citations, independent verification, abstention/fallback | | GAP-010 | accessible buyer UI | `accepted-target` | Figma/Storybook, keyboard/touch/error/empty states, exact-value provenance | | GAP-011 | operable multi-tenant release | `accepted-target` | OIDC/RLS/purpose controls, durable queue/storage, OTel/SLO, restore/load/migration, signed SBOM/provenance | | GAP-012 | paths obscure domain ownership | `active-refactor` | staged moves, ACLs, no cycles/cross-context persistence/shared-kernel creep | | GAP-013 | ADR identity collisions | `release-integrity` | unique repository-wide identity, deterministic duplicate detection, supersession lineage | -| GAP-014 | dependency-review evidence unavailable on predecessor heads | `external-control-risk` | authorized dependency-graph availability, pinned Dependency Review execution, exact-current Security Scan GREEN, no fail-open bypass | -| GAP-015 | contextual-orchestrator pin behind protected upstream | `supply-chain-pinned` | reproducible replacement archive SHA-256, exact diff/review, pinned TEPP adoption | -| GAP-016 | hourly LLM bootstrap can admit paid/unknown-price routes | `active-repair` | #480 exact-head GREEN, qualifying review, merge to protected main, issue #479 closure | +| GAP-014 | required workflow startup/runner evidence unavailable on current heads | `external-control-risk` | central runner/workflow repair, exact-current required workflows GREEN, no fail-open bypass | +| GAP-015 | contextual-orchestrator lacks immutable released contract for current owner behavior | `release-blocking` | compatible immutable CO release, reproducible provenance/digest, exact TEPP ACL/dependency adoption | +| GAP-016 | hourly LLM bootstrap can admit paid/unknown-price routes | `active-repair` | #480 TEPP repair plus released CO adoption, exact-head GREEN, qualifying review, protected-main merge | | GAP-017 | dynamic evaluation item/rater/anchor drift monitoring | `blocked-external-design` | released/digest-pinned owner contracts, ACL conformance, no-anchor/no-linking refusal, then evidence-gated temporal monitoring | ## Delivery and release order -Queue/ADR/domain authority precedes semantic admission, the Rust CPU f64 shared-latent temporal estimator, durable Analysis Run, released fast-mlsirm temporal composition, event intelligence, accelerator parity, buyer workflows, and finally tenancy/durability/observability/release support. A bounded security/dependency/provider-admission repair may land earlier when it directly closes a fail-closed control defect. +Queue/ADR/domain authority precedes semantic admission, the Rust CPU f64 shared-latent temporal estimator, durable Analysis Run, released fast-mlsirm temporal composition, event intelligence, accelerator parity, buyer workflows, and finally tenancy/durability/observability/release support. A bounded security/dependency/provider-admission repair may land earlier when it directly closes a fail-closed control defect and all immutable-owner prerequisites exist. Every open PR is classified as `landing_vehicle`, `stacked_dependency`, `fold_into_landing_vehicle`, `superseded`, `duplicate`, `research_lineage_only`, `blocked_external`, or an explicitly justified independent root-cause repair. Exact heads must be compared before closure. Strict ancestry permits safe consolidation; diverged siblings require a real code/test fold first. From b0db83ea306d397f26c6bab40590639999463f84 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 22:08:46 +0900 Subject: [PATCH 088/235] docs: refresh live queue and owner dependency evidence --- docs/product-technical-gap-baseline.md | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 4faea55da..8aa8d8293 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-02T11:29Z +**Snapshot:** 2026-09-02T13:07Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` **Workspace version:** `0.2.0` **Delivery authority:** issue [#175](https://github.com/ContextualWisdomLab/TEPP/issues/175), PR [#435](https://github.com/ContextualWisdomLab/TEPP/pull/435), and [`docs/delivery/pr-queue-authority-2026-09-01.md`](delivery/pr-queue-authority-2026-09-01.md) @@ -17,12 +17,12 @@ A planning document, mergeable branch, local test, predecessor-head result, queu | Protected `main` | `1bc02f580cf48e1d39da239f0e818453437c31c3` | Capability claims remain bounded to this commit until protected main changes. | | Open pull requests | **130** | The queue is down from the observed peak of 149 but remains above the prior fresh 128-PR snapshot; #482/#483 are WIP-regression fold children, not independent landing authority. | | Draft pull requests | **129** | Non-landable work is explicitly parked while consolidated, repaired, or supplied with missing evidence. | -| Non-draft pull requests | **1** | #480 is the only non-Draft PR, but it is not deployable while contextual-orchestrator has no compatible immutable release. | -| Open issues | **16** | Includes #437 ADR identity normalization, #479 hourly free-route admission, and #481 dynamic-evaluation drift design/evidence gathering. | +| Non-draft pull requests | **1** | #480 is the only non-Draft PR, but it is not deployable while contextual-orchestrator has no compatible immutable release and released gateway identity/authentication contracts remain incomplete. | +| Open issues | **16** | Includes #437 ADR identity normalization, #479 hourly orchestrator admission, and #481 dynamic-evaluation drift design/evidence gathering. | | GitHub releases | **0** | No open TEPP head is a released contract. | | Effective organization ruleset | `18156473` | One qualifying approval, stale-review dismissal after push, resolved review threads, unattributed-change approval where applicable, and central required workflows remain landing authority. | -Classic branch protection is not the sole policy source; organization rulesets are effective merge authority where applicable. Any increase in open PR count while #435 remains open is a WIP regression unless the new PR is a demonstrably independent root-cause repair that cannot safely belong to an existing landing vehicle. #480 is such an exception because it owns TEPP CI/provider-admission policy and cannot coherently belong to the Validation/Analysis Run, Longitudinal Modeling, or queue-documentation vehicles. +Classic branch protection is not the sole policy source; organization rulesets are effective merge authority where applicable. Any increase in open PR count while #435 remains open is a WIP regression unless the new PR is a demonstrably independent root-cause repair that cannot safely belong to an existing landing vehicle. #480 is such an exception because it owns TEPP's consumer-side CI/orchestrator admission boundary and cannot coherently belong to the Validation/Analysis Run, Longitudinal Modeling, or queue-documentation vehicles. The queue was **128** at the previous fresh snapshot and rose to **130** when #482 `role_contradiction_v1` and #483 `retrospective_edge_v1` were opened as one-profile slices. Fresh changed-file classification showed both modify the same Analysis Run/Validation shared Cargo/lib/docs surfaces as #416. #458, #460, #482, and #483 now all target the #416 branch with comparison base SHA `0b7155cc238defb1e55129ff3000658f04b343cf`; GitHub still reports all four as non-mergeable. The remaining conflicts are therefore real shared-file fold work rather than stale base metadata. Unique source, tests, doctoring, RED/repair lineage, and temporal-refusal semantics must survive into the eventual #416 landing head. Issue #481 remains design/evidence work only and does not authorize implementation against mutable upstream PR heads. @@ -34,7 +34,7 @@ This is a freshly verified priority subset, not a row-for-row copy of the 130-PR | ---: | --- | :---: | --- | --- | | #483 | `847d96f913bb261803ac0bd751ad7e4f51324cee` | true | #416 branch @ `0b7155cc238defb1e55129ff3000658f04b343cf` | `retrospective_edge_v1` fold child; cutoff-before-identity admission repair and unique tests/doctoring must survive the conflict-resolving fold. | | #482 | `506dbae236a4484301b704b6c6a05b20faf0fe69` | true | #416 branch @ `0b7155cc238defb1e55129ff3000658f04b343cf` | `role_contradiction_v1` fold child; cutoff-before-identity admission repair and unique tests/doctoring must survive the conflict-resolving fold. | -| #480 | `d4b5f1687a9a898683894388582405a184ceb0d1` | false | main | TEPP CI/provider-admission governance repair; explicit zero-cost routes only and fail-closed empty pool. Not deployable until a compatible immutable contextual-orchestrator release is adopted. | +| #480 | `4475542750eda01afad0cf9ea8d563f508f63fd3` | false | main | TEPP consumer-side LLM governance repair; removes provider discovery/ranking and requires released `orchestrator/free` through HTTPS. Still blocked on immutable owner release, authenticated deployment provenance, and non-reusable/brokered gateway authentication. | | #460 | `dfab4eab5ff733731e565a9348072b8dab2e4912` | true | #416 branch @ `0b7155cc238defb1e55129ff3000658f04b343cf` | `relation_absence_v1` fold child; typed cutoff equality and terminal validation-status separation preserved. | | #458 | `08165e3b3c929b4ae77396689549f72723ff8ff5` | true | #416 branch @ `0b7155cc238defb1e55129ff3000658f04b343cf` | `outcome_order_v1` fold child; typed cutoff equality and terminal validation-status separation preserved. | | #416 | `0b7155cc238defb1e55129ff3000658f04b343cf` | true | main | Provisional Validation / Analysis Run simple-refusal landing vehicle; generic cutoff-before-identity admission is the surviving leakage-safe invariant. | @@ -82,7 +82,7 @@ Supported temporal estimators require realistic known-truth recovery for every c **#416 — Validation / Analysis Run consolidation.** Current head `0b7155cc238defb1e55129ff3000658f04b343cf` contains non-force lineage from #473, #430, #461, #478, and #434. Shared admission/artifact invariants remain centralized while each refusal profile keeps its domain vocabulary. Generic RED `ffee655404716bf8d33c898a3c1a87a543abe701` and repair `0b7155cc238defb1e55129ff3000658f04b343cf` enforce availability cutoff before duplicate-identity admission so future-unavailable rows cannot change historical replay. #458, #460, #482, and #483 are now compared against this exact head and still conflict on shared Cargo/lib/lock/docs surfaces. Their unique evidence must be folded, not replaced or independently landed. -**#480 / #479 — hourly free-route admission.** #480 current exact head `d4b5f1687a9a898683894388582405a184ceb0d1` repairs the TEPP-owned bootstrap ACL so both provider-reported token-price components must be explicitly zero before a route reaches ranking. Paid, partially priced, fully unpriced, and missing-price rows are excluded; an empty explicit-free pool fails closed. Exact-head CodeQL also terminates as `startup_failure` while other required lanes remain queued. More importantly, contextual-orchestrator protected `main` is now `6d60c756b6481c59bd8fee95996315279bd708d5` and has **zero GitHub releases**. A mutable owner head is not production dependency authority, so #480 cannot be deployed or merged as a complete integration until a compatible immutable contextual-orchestrator release is verified and TEPP adopts it through an exact ACL/dependency bump. +**#480 / #479 — hourly orchestrator admission.** Current exact head `4475542750eda01afad0cf9ea8d563f508f63fd3` removes TEPP's second provider-routing authority. Scheduled execution now requires an immutable contextual-orchestrator release, an HTTPS gateway, gateway authentication, and only `contextual-orchestrator/orchestrator/free`; provider discovery, provider/model/group ranking, free/paid admission, and provider credentials remain owner-side. RED `6d756d02409d0eb11a35146b9abfe41369efd2ad` → repair `f1da3f29ee1c9d3de6923a52d6cf26b71b96d257` restricts gateway redirects to HTTPS, and RED `1f0d2ddfb3ac5d8e6c8e1c1c5c40d47c46a017c9` → repair `4475542750eda01afad0cf9ea8d563f508f63fd3` applies the same downgrade protection to the checksum-pinned OpenCode archive path. Two owner gaps remain: the running gateway cannot yet prove authenticated identity bound to the selected immutable release/schema/artifact, and the model-controlled process still receives a reusable gateway bearer. Both are tracked in contextual-orchestrator #1023 and require owner-side release/provenance plus scoped/ephemeral or brokered authentication. contextual-orchestrator protected `main@464da4715b495b5eaaa593eba3796e2d976ee0c9` has zero GitHub releases, so #480 remains deliberately non-deployable rather than falling back to mutable source or direct provider execution. **#481 — dynamic evaluation drift monitoring design/evidence lane.** TEPP owns temporal composition, availability/knowledge-cutoff semantics, longitudinal/multilevel/multiple-membership structure, drift/change-point evidence, and time-indexed invariance monitoring. It does not own item generation, provider/rater invocation, adjudication, anchor promotion, or reusable static psychometric kernels. Implementation remains blocked until canonical owners publish immutable released/digest-pinned run/item/rater/adjudication/linking contracts. The first eventual slice is a versioned ACL with no-anchor/no-linking fail-closed tests, not a drift score or dashboard. Current mutable sibling PR heads are evidence only and must not become production dependencies. @@ -92,9 +92,9 @@ Supported temporal estimators require realistic known-truth recovery for every c ## Dependency and Context Fabric status -fast-mlsirm protected `main` is `45627700c26c29bca150896a9519a9b7426acb56`. Generalized-mixed/dependence compiler #1714 remains open at `6abdcc2acab7be463977e35191566119e384c906`; its typed membership topology/weight authority and deterministic candidate manifest are owner-side candidate work, not TEPP production dependency authority. The latest immutable fast-mlsirm release is `v0.9.1` from 2026-08-26 and predates #1714. TEPP consumes future compatible Published Language through an ACL and never copies the static implementation. +fast-mlsirm protected `main` is `b5a3a0c1057d4b53d7a4bb18e0de69f630c2b45c`. Generalized-mixed/dependence compiler #1714 is open and Ready at `92a3f2152033b61ca89661b5ba8a584842e8c3a9` after a non-destructive restack onto that exact base; GitHub reports it mergeable. The branch preserves typed membership topology/weight authority and deterministic `fast_mlsirm.model_specification.candidate_manifest@1.0.0`, but the restack invalidated predecessor evidence: exact-head `CodeQL PR` ended in `startup_failure`, CI is pending, and Security/SAST/CodeQL/OSV/Scorecard remain queued. The latest immutable fast-mlsirm release is `v0.9.1` from 2026-08-26 and predates #1714, so TEPP must not consume the new compiler Published Language until an immutable compatible owner release exists. -TEPP protected main checksum-pins contextual-orchestrator commit `e226e1197bdfc890c9d8e5b9b648c78857d7e465` with SHA-256 `964b22ff577e3862b761af847ccad65489bb3f8fc750c8f84fcf8628df096673`. Fresh owner state is protected `main@6d60c756b6481c59bd8fee95996315279bd708d5`, but contextual-orchestrator has zero GitHub releases. Advancing TEPP requires a compatible immutable release, reproducible identity/provenance, and an exact reviewed ACL/dependency bump; checksum validation must not be removed or guessed. +TEPP protected main checksum-pins contextual-orchestrator commit `e226e1197bdfc890c9d8e5b9b648c78857d7e465` with SHA-256 `964b22ff577e3862b761af847ccad65489bb3f8fc750c8f84fcf8628df096673`. Fresh owner state is protected `main@464da4715b495b5eaaa593eba3796e2d976ee0c9`, but contextual-orchestrator has zero GitHub releases. Advancing TEPP requires a compatible immutable release, authenticated deployment/release provenance, a safe gateway-authentication contract, and an exact reviewed ACL/dependency bump; checksum validation must not be removed or guessed. `context-graph-contracts` and `enterprise-architecture-core` remain read-only to this writer. Context Graph protected/default `develop` is `99cb5468ba3c15c5e79688f53dee74724fae2d13`, with **14 open PRs** and **zero releases**. EA Core protected/default `develop` is `1c0fa8b15ceb9e72186274aeb255d6777eb84ef4`, with **24 open PRs** and **zero releases**. Their open heads are candidate evidence, not released contracts. TEPP may maintain fail-closed conformance fixtures behind candidate/test boundaries, but deployable integration and authoritative EA projection require released/versioned Context Graph artifacts plus passing compatibility and provenance evidence. TEPP latent estimates, measurement scores, inferred event relations, and validity evidence do not become authoritative EA facts. @@ -116,8 +116,8 @@ TEPP protected main checksum-pins contextual-orchestrator commit `e226e1197bdfc8 | GAP-012 | paths obscure domain ownership | `active-refactor` | staged moves, ACLs, no cycles/cross-context persistence/shared-kernel creep | | GAP-013 | ADR identity collisions | `release-integrity` | unique repository-wide identity, deterministic duplicate detection, supersession lineage | | GAP-014 | required workflow startup/runner evidence unavailable on current heads | `external-control-risk` | central runner/workflow repair, exact-current required workflows GREEN, no fail-open bypass | -| GAP-015 | contextual-orchestrator lacks immutable released contract for current owner behavior | `release-blocking` | compatible immutable CO release, reproducible provenance/digest, exact TEPP ACL/dependency adoption | -| GAP-016 | hourly LLM bootstrap can admit paid/unknown-price routes | `active-repair` | #480 TEPP repair plus released CO adoption, exact-head GREEN, qualifying review, protected-main merge | +| GAP-015 | contextual-orchestrator lacks immutable released contract for current owner behavior | `release-blocking` | compatible immutable CO release, deployment identity/provenance, safe gateway authentication, exact TEPP ACL/dependency adoption | +| GAP-016 | hourly LLM path needs released owner-only routing/authentication | `active-repair` | #480 consumer repair plus released CO adoption, authenticated deployment identity, brokered/scoped auth, exact-head GREEN, qualifying review, protected-main merge | | GAP-017 | dynamic evaluation item/rater/anchor drift monitoring | `blocked-external-design` | released/digest-pinned owner contracts, ACL conformance, no-anchor/no-linking refusal, then evidence-gated temporal monitoring | ## Delivery and release order From c90c948dcb39ab56f60669888d14c353193cf8b2 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 22:36:35 +0900 Subject: [PATCH 089/235] docs(delivery): refresh longitudinal exact-head evidence --- docs/product-technical-gap-baseline.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 8aa8d8293..b4934cd79 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-02T13:07Z +**Snapshot:** 2026-09-02T13:35Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` **Workspace version:** `0.2.0` **Delivery authority:** issue [#175](https://github.com/ContextualWisdomLab/TEPP/issues/175), PR [#435](https://github.com/ContextualWisdomLab/TEPP/pull/435), and [`docs/delivery/pr-queue-authority-2026-09-01.md`](delivery/pr-queue-authority-2026-09-01.md) @@ -38,7 +38,7 @@ This is a freshly verified priority subset, not a row-for-row copy of the 130-PR | #460 | `dfab4eab5ff733731e565a9348072b8dab2e4912` | true | #416 branch @ `0b7155cc238defb1e55129ff3000658f04b343cf` | `relation_absence_v1` fold child; typed cutoff equality and terminal validation-status separation preserved. | | #458 | `08165e3b3c929b4ae77396689549f72723ff8ff5` | true | #416 branch @ `0b7155cc238defb1e55129ff3000658f04b343cf` | `outcome_order_v1` fold child; typed cutoff equality and terminal validation-status separation preserved. | | #416 | `0b7155cc238defb1e55129ff3000658f04b343cf` | true | main | Provisional Validation / Analysis Run simple-refusal landing vehicle; generic cutoff-before-identity admission is the surviving leakage-safe invariant. | -| #310 | `a9f84756d9e47f945040470b04268fb837ddfe4e` | true | main | Longitudinal Modeling scientific landing work; one numerical authority for irregular residual log-rate and repaired lagged correlation. Current hosted merge evidence is non-GREEN. | +| #310 | `5c21ca130c1054307b00d369d970bc8caa31ff03` | true | main | Longitudinal Modeling scientific landing work; repaired stationary fallback double rounding plus one numerical authority for irregular residual log-rate and repaired lagged correlation. Current hosted merge evidence is non-GREEN. | Exact current-head evidence is authoritative only for the named PR and becomes stale after any source mutation. @@ -78,7 +78,7 @@ Supported temporal estimators require realistic known-truth recovery for every c ## Current repairs and blockers -**#310 — Longitudinal Modeling scientific landing work.** Closed predecessor #441 is contained by #310. The invalid one-sided covariance/earlier-variance ratio remains retired; public lagged Pearson correlation requires lagged covariance and both occasion-specific marginal variances. `EventTimeInterval` is preserved end-to-end. Current head `a9f84756d9e47f945040470b04268fb837ddfe4e` also removes duplicate numerical authority: `stable_irregular_rate` is a compatibility facade over the canonical `irregular_residual` implementation, preserving log-domain recovery when direct same-sign ratios overflow or underflow. The PR is Draft. Exact-head CodeQL PR run `33623224470` ends in `startup_failure` with zero jobs before checkout; Documentation Quality is pending and Rust/Security/Semgrep/OSV/Scorecard remain queued. No qualifying independent approval exists. This is central workflow evidence, not permission to bypass the gate. +**#310 — Longitudinal Modeling scientific landing work.** Closed predecessor #441 is contained by #310. The invalid one-sided covariance/earlier-variance ratio remains retired; public lagged Pearson correlation requires lagged covariance and both occasion-specific marginal variances. `EventTimeInterval` is preserved end-to-end. Current head `5c21ca130c1054307b00d369d970bc8caa31ff03` adds RED `cb416f7cc63f4ee9d08ef51e23ad48b62ba977dc` and a causal repair for double rounding in the stationary-variance `2a`-overflow fallback: `(q * 1/2) / |a|` replaces `q / (|a|/2) * 1/4`, preserving the exact minimum-subnormal rounding case while keeping the earlier overflow/subnormal contracts. It also removes duplicate numerical authority: `stable_irregular_rate` is a compatibility facade over the canonical `irregular_residual` implementation, preserving log-domain recovery when direct same-sign ratios overflow or underflow. The PR is Draft. Exact-head CodeQL PR run `33636460752` ends in `startup_failure` before job materialization; Documentation Quality, Rust, Security, Semgrep, OSV, and Scorecard are queued. No qualifying independent approval exists. This is central workflow evidence, not permission to bypass the gate. **#416 — Validation / Analysis Run consolidation.** Current head `0b7155cc238defb1e55129ff3000658f04b343cf` contains non-force lineage from #473, #430, #461, #478, and #434. Shared admission/artifact invariants remain centralized while each refusal profile keeps its domain vocabulary. Generic RED `ffee655404716bf8d33c898a3c1a87a543abe701` and repair `0b7155cc238defb1e55129ff3000658f04b343cf` enforce availability cutoff before duplicate-identity admission so future-unavailable rows cannot change historical replay. #458, #460, #482, and #483 are now compared against this exact head and still conflict on shared Cargo/lib/lock/docs surfaces. Their unique evidence must be folded, not replaced or independently landed. From ff5fd834f518d9bb56f0d2e8df08e39a19eec5d3 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 23:07:23 +0900 Subject: [PATCH 090/235] docs: refresh static psychometric owner evidence --- docs/product-technical-gap-baseline.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index b4934cd79..77c2e0b5e 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-02T13:35Z +**Snapshot:** 2026-09-02T13:58Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` **Workspace version:** `0.2.0` **Delivery authority:** issue [#175](https://github.com/ContextualWisdomLab/TEPP/issues/175), PR [#435](https://github.com/ContextualWisdomLab/TEPP/pull/435), and [`docs/delivery/pr-queue-authority-2026-09-01.md`](delivery/pr-queue-authority-2026-09-01.md) @@ -86,13 +86,13 @@ Supported temporal estimators require realistic known-truth recovery for every c **#481 — dynamic evaluation drift monitoring design/evidence lane.** TEPP owns temporal composition, availability/knowledge-cutoff semantics, longitudinal/multilevel/multiple-membership structure, drift/change-point evidence, and time-indexed invariance monitoring. It does not own item generation, provider/rater invocation, adjudication, anchor promotion, or reusable static psychometric kernels. Implementation remains blocked until canonical owners publish immutable released/digest-pinned run/item/rater/adjudication/linking contracts. The first eventual slice is a versioned ACL with no-anchor/no-linking fail-closed tests, not a drift score or dashboard. Current mutable sibling PR heads are evidence only and must not become production dependencies. -**#315 — static-standardisation ownership repair.** #315 remains lineage only to preserve TEPP-specific `TIPREDVARstd` naming/event-time/refusal semantics. It must not merge with duplicate reusable arithmetic. After the live fast-mlsirm owner contract is merged and released/versioned, TEPP must consume that immutable contract through an ACL, prove parity, retain temporal/model admission, delete wrong-owner production arithmetic, and fold into a Measurement/Longitudinal Modeling landing vehicle. +**#315 — static-standardisation ownership repair.** #315 remains lineage only to preserve TEPP-specific `TIPREDVARstd` naming/event-time/refusal semantics. It must not merge with duplicate reusable arithmetic. The current canonical owner candidate is fast-mlsirm #1722 at exact head `338dbb2d25f32b0e201102e7bf73076846fb57b3`, exposing `fast_mlsirm.covariance_standardization@1.0.0` from protected-base `main@b5a3a0c1057d4b53d7a4bb18e0de69f630c2b45c`. #1722 is Ready and mergeable, but its reconciled exact head is not GREEN: `CodeQL PR` ended in `startup_failure`, CI is pending, and CodeQL/Security/SAST/OSV/Scorecard/fuzzing are queued; no qualifying independent approval exists. Immutable `v0.9.1` predates #1722. TEPP therefore keeps #315 as research/compatibility lineage only. After #1722 or its verified successor lands and is immutably released, TEPP must consume that released contract through an ACL, prove parity, retain temporal/model admission, delete wrong-owner production arithmetic, and fold the TEPP-specific composition into a Measurement/Longitudinal Modeling landing vehicle. **#437 — ADR identity.** Repository-wide ADR IDs are immutable authority. Duplicate index IDs, duplicate targets, duplicate numbered ADR files, repeated authority declarations, and index/file status or maturity drift must fail deterministic documentation fitness tests. Operation-specific ADRs on adapter/model micro-branches are implementation lineage pending normalization, not branch-local architecture authority. #435 contains the current deterministic fitness implementation; issue closure still requires exact-head hosted evidence and a coherent landing decision. ## Dependency and Context Fabric status -fast-mlsirm protected `main` is `b5a3a0c1057d4b53d7a4bb18e0de69f630c2b45c`. Generalized-mixed/dependence compiler #1714 is open and Ready at `92a3f2152033b61ca89661b5ba8a584842e8c3a9` after a non-destructive restack onto that exact base; GitHub reports it mergeable. The branch preserves typed membership topology/weight authority and deterministic `fast_mlsirm.model_specification.candidate_manifest@1.0.0`, but the restack invalidated predecessor evidence: exact-head `CodeQL PR` ended in `startup_failure`, CI is pending, and Security/SAST/CodeQL/OSV/Scorecard remain queued. The latest immutable fast-mlsirm release is `v0.9.1` from 2026-08-26 and predates #1714, so TEPP must not consume the new compiler Published Language until an immutable compatible owner release exists. +fast-mlsirm protected `main` is `b5a3a0c1057d4b53d7a4bb18e0de69f630c2b45c`. Generalized-mixed/dependence compiler #1714 is open and Ready at `92a3f2152033b61ca89661b5ba8a584842e8c3a9` after a non-destructive restack onto that exact base; GitHub reports it mergeable. The branch preserves typed membership topology/weight authority and deterministic `fast_mlsirm.model_specification.candidate_manifest@1.0.0`, but the restack invalidated predecessor evidence: exact-head `CodeQL PR` ended in `startup_failure`, CI is pending, and Security/SAST/CodeQL/OSV/Scorecard remain queued. Static covariance-standardization owner #1722 is also Ready/mergeable at `338dbb2d25f32b0e201102e7bf73076846fb57b3`; it exposes `fast_mlsirm.covariance_standardization@1.0.0`, but its exact head likewise has `CodeQL PR` `startup_failure`, pending CI, queued CodeQL/Security/SAST/OSV/Scorecard/fuzzing, and no qualifying independent approval. The latest immutable fast-mlsirm release is `v0.9.1` from 2026-08-26 and predates both #1714 and #1722, so TEPP must not consume either new Published Language until an immutable compatible owner release exists. TEPP protected main checksum-pins contextual-orchestrator commit `e226e1197bdfc890c9d8e5b9b648c78857d7e465` with SHA-256 `964b22ff577e3862b761af847ccad65489bb3f8fc750c8f84fcf8628df096673`. Fresh owner state is protected `main@464da4715b495b5eaaa593eba3796e2d976ee0c9`, but contextual-orchestrator has zero GitHub releases. Advancing TEPP requires a compatible immutable release, authenticated deployment/release provenance, a safe gateway-authentication contract, and an exact reviewed ACL/dependency bump; checksum validation must not be removed or guessed. @@ -122,7 +122,7 @@ TEPP protected main checksum-pins contextual-orchestrator commit `e226e1197bdfc8 ## Delivery and release order -Queue/ADR/domain authority precedes semantic admission, the Rust CPU f64 shared-latent temporal estimator, durable Analysis Run, released fast-mlsirm temporal composition, event intelligence, accelerator parity, buyer workflows, and finally tenancy/durability/observability/release support. A bounded security/dependency/provider-admission repair may land earlier when it directly closes a fail-closed control defect and all immutable-owner prerequisites exist. +Queue/ADR/domain authority precedes semantic admission, the Rust CPU f64 shared-latent temporal estimator, durable Analysis Run, released fast-mlsirm static psychometric owner contracts plus TEPP-owned temporal composition, event intelligence, accelerator parity, buyer workflows, and finally tenancy/durability/observability/release support. A bounded security/dependency/provider-admission repair may land earlier when it directly closes a fail-closed control defect and all immutable-owner prerequisites exist. Every open PR is classified as `landing_vehicle`, `stacked_dependency`, `fold_into_landing_vehicle`, `superseded`, `duplicate`, `research_lineage_only`, `blocked_external`, or an explicitly justified independent root-cause repair. Exact heads must be compared before closure. Strict ancestry permits safe consolidation; diverged siblings require a real code/test fold first. From 9d1e932dcc3b55c1c997b8196ec51bcd9fb8d677 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 23:35:52 +0900 Subject: [PATCH 091/235] docs(delivery): refresh Longitudinal CWC recovery evidence --- docs/product-technical-gap-baseline.md | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 77c2e0b5e..e8e0b5145 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-02T13:58Z +**Snapshot:** 2026-09-02T14:34Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` **Workspace version:** `0.2.0` **Delivery authority:** issue [#175](https://github.com/ContextualWisdomLab/TEPP/issues/175), PR [#435](https://github.com/ContextualWisdomLab/TEPP/pull/435), and [`docs/delivery/pr-queue-authority-2026-09-01.md`](delivery/pr-queue-authority-2026-09-01.md) @@ -38,7 +38,7 @@ This is a freshly verified priority subset, not a row-for-row copy of the 130-PR | #460 | `dfab4eab5ff733731e565a9348072b8dab2e4912` | true | #416 branch @ `0b7155cc238defb1e55129ff3000658f04b343cf` | `relation_absence_v1` fold child; typed cutoff equality and terminal validation-status separation preserved. | | #458 | `08165e3b3c929b4ae77396689549f72723ff8ff5` | true | #416 branch @ `0b7155cc238defb1e55129ff3000658f04b343cf` | `outcome_order_v1` fold child; typed cutoff equality and terminal validation-status separation preserved. | | #416 | `0b7155cc238defb1e55129ff3000658f04b343cf` | true | main | Provisional Validation / Analysis Run simple-refusal landing vehicle; generic cutoff-before-identity admission is the surviving leakage-safe invariant. | -| #310 | `5c21ca130c1054307b00d369d970bc8caa31ff03` | true | main | Longitudinal Modeling scientific landing work; repaired stationary fallback double rounding plus one numerical authority for irregular residual log-rate and repaired lagged correlation. Current hosted merge evidence is non-GREEN. | +| #310 | `260413efb9d95039b5fbba41919cba8097fcf8b5` | true | main | Longitudinal Modeling scientific landing work; CWC unit-mean accumulation now survives overflowing raw partial sums when the mean/residuals remain representable, reusing the canonical compensated mean. Current hosted merge evidence is non-GREEN. | Exact current-head evidence is authoritative only for the named PR and becomes stale after any source mutation. @@ -78,25 +78,25 @@ Supported temporal estimators require realistic known-truth recovery for every c ## Current repairs and blockers -**#310 — Longitudinal Modeling scientific landing work.** Closed predecessor #441 is contained by #310. The invalid one-sided covariance/earlier-variance ratio remains retired; public lagged Pearson correlation requires lagged covariance and both occasion-specific marginal variances. `EventTimeInterval` is preserved end-to-end. Current head `5c21ca130c1054307b00d369d970bc8caa31ff03` adds RED `cb416f7cc63f4ee9d08ef51e23ad48b62ba977dc` and a causal repair for double rounding in the stationary-variance `2a`-overflow fallback: `(q * 1/2) / |a|` replaces `q / (|a|/2) * 1/4`, preserving the exact minimum-subnormal rounding case while keeping the earlier overflow/subnormal contracts. It also removes duplicate numerical authority: `stable_irregular_rate` is a compatibility facade over the canonical `irregular_residual` implementation, preserving log-domain recovery when direct same-sign ratios overflow or underflow. The PR is Draft. Exact-head CodeQL PR run `33636460752` ends in `startup_failure` before job materialization; Documentation Quality, Rust, Security, Semgrep, OSV, and Scorecard are queued. No qualifying independent approval exists. This is central workflow evidence, not permission to bypass the gate. +**#310 — Longitudinal Modeling scientific landing work.** Closed predecessor #441 is contained by #310. The invalid one-sided covariance/earlier-variance ratio remains retired; public lagged Pearson correlation requires lagged covariance and both occasion-specific marginal variances. `EventTimeInterval` is preserved end-to-end. Current head `260413efb9d95039b5fbba41919cba8097fcf8b5` preserves the prior stationary-variance/cancellation/log-domain repairs and adds RED `9a706c3c0e9e0db68e88f89b94c64c13ea7fafd0` plus causal repair `260413efb9d95039b5fbba41919cba8097fcf8b5` for a distinct CWC centering defect. The predecessor formed the unit mean with a naive raw sum, so finite `[0.75·MAX, 0.75·MAX, -0.5·MAX]` observations were rejected when the first partial sum overflowed even though the final mean and centered residuals were representable. The repair reuses the canonical Longitudinal Modeling `scaled_compensated_mean`; it does not mint a second numerical implementation. The historical `[MAX, MAX]` input now forms the valid finite mean `MAX`, then correctly fails later because zero residuals provide no admissible real log-rate, rather than being mislabeled as an observation-payload overflow. The PR remains Draft. Current exact-head hosted merge evidence is non-GREEN: the first materialized PR workflow observed after the repair is Scorecard run `33642604895`, still queued, and predecessor-head CI/review results do not transfer. A qualifying current-head independent approval is still required. This is not permission to bypass the gate. **#416 — Validation / Analysis Run consolidation.** Current head `0b7155cc238defb1e55129ff3000658f04b343cf` contains non-force lineage from #473, #430, #461, #478, and #434. Shared admission/artifact invariants remain centralized while each refusal profile keeps its domain vocabulary. Generic RED `ffee655404716bf8d33c898a3c1a87a543abe701` and repair `0b7155cc238defb1e55129ff3000658f04b343cf` enforce availability cutoff before duplicate-identity admission so future-unavailable rows cannot change historical replay. #458, #460, #482, and #483 are now compared against this exact head and still conflict on shared Cargo/lib/lock/docs surfaces. Their unique evidence must be folded, not replaced or independently landed. -**#480 / #479 — hourly orchestrator admission.** Current exact head `4475542750eda01afad0cf9ea8d563f508f63fd3` removes TEPP's second provider-routing authority. Scheduled execution now requires an immutable contextual-orchestrator release, an HTTPS gateway, gateway authentication, and only `contextual-orchestrator/orchestrator/free`; provider discovery, provider/model/group ranking, free/paid admission, and provider credentials remain owner-side. RED `6d756d02409d0eb11a35146b9abfe41369efd2ad` → repair `f1da3f29ee1c9d3de6923a52d6cf26b71b96d257` restricts gateway redirects to HTTPS, and RED `1f0d2ddfb3ac5d8e6c8e1c1c5c40d47c46a017c9` → repair `4475542750eda01afad0cf9ea8d563f508f63fd3` applies the same downgrade protection to the checksum-pinned OpenCode archive path. Two owner gaps remain: the running gateway cannot yet prove authenticated identity bound to the selected immutable release/schema/artifact, and the model-controlled process still receives a reusable gateway bearer. Both are tracked in contextual-orchestrator #1023 and require owner-side release/provenance plus scoped/ephemeral or brokered authentication. contextual-orchestrator protected `main@464da4715b495b5eaaa593eba3796e2d976ee0c9` has zero GitHub releases, so #480 remains deliberately non-deployable rather than falling back to mutable source or direct provider execution. +**#480 / #479 — hourly orchestrator admission.** Current exact head `4475542750eda01afad0cf9ea8d563f508f63fd3` removes TEPP's second provider-routing authority. Scheduled execution now requires an immutable contextual-orchestrator release, an HTTPS gateway, gateway authentication, and only `contextual-orchestrator/orchestrator/free`; provider discovery, provider/model/group ranking, free/paid admission, and provider credentials remain owner-side. RED `6d756d02409d0eb11a35146b9abfe41369efd2ad` → repair `f1da3f29ee1c9d3de6923a52d6cf26b71b96d257` restricts gateway redirects to HTTPS, and RED `1f0d2ddfb3ac5d8e6c8e1c1c5c40d47c46a017c9` → repair `4475542750eda01afad0cf9ea8d563f508f63fd3` applies the same downgrade protection to the checksum-pinned OpenCode archive path. Two owner gaps remain: the running gateway cannot yet prove authenticated identity bound to the selected immutable release/schema/artifact, and the model-controlled process still receives a reusable gateway bearer. Both are tracked in contextual-orchestrator #1023 and require owner-side release/provenance plus scoped/ephemeral or brokered authentication. contextual-orchestrator protected `main@464da4715b495b5eaaa593eba3796e2d976ee0c9` still has zero GitHub releases, so #480 remains deliberately non-deployable rather than falling back to mutable source or direct provider execution. **#481 — dynamic evaluation drift monitoring design/evidence lane.** TEPP owns temporal composition, availability/knowledge-cutoff semantics, longitudinal/multilevel/multiple-membership structure, drift/change-point evidence, and time-indexed invariance monitoring. It does not own item generation, provider/rater invocation, adjudication, anchor promotion, or reusable static psychometric kernels. Implementation remains blocked until canonical owners publish immutable released/digest-pinned run/item/rater/adjudication/linking contracts. The first eventual slice is a versioned ACL with no-anchor/no-linking fail-closed tests, not a drift score or dashboard. Current mutable sibling PR heads are evidence only and must not become production dependencies. -**#315 — static-standardisation ownership repair.** #315 remains lineage only to preserve TEPP-specific `TIPREDVARstd` naming/event-time/refusal semantics. It must not merge with duplicate reusable arithmetic. The current canonical owner candidate is fast-mlsirm #1722 at exact head `338dbb2d25f32b0e201102e7bf73076846fb57b3`, exposing `fast_mlsirm.covariance_standardization@1.0.0` from protected-base `main@b5a3a0c1057d4b53d7a4bb18e0de69f630c2b45c`. #1722 is Ready and mergeable, but its reconciled exact head is not GREEN: `CodeQL PR` ended in `startup_failure`, CI is pending, and CodeQL/Security/SAST/OSV/Scorecard/fuzzing are queued; no qualifying independent approval exists. Immutable `v0.9.1` predates #1722. TEPP therefore keeps #315 as research/compatibility lineage only. After #1722 or its verified successor lands and is immutably released, TEPP must consume that released contract through an ACL, prove parity, retain temporal/model admission, delete wrong-owner production arithmetic, and fold the TEPP-specific composition into a Measurement/Longitudinal Modeling landing vehicle. +**#315 — static-standardisation ownership repair.** #315 remains lineage only to preserve TEPP-specific `TIPREDVARstd` naming/event-time/refusal semantics. It must not merge with duplicate reusable arithmetic. The current canonical owner candidate is fast-mlsirm #1722 at exact head `338dbb2d25f32b0e201102e7bf73076846fb57b3`, exposing `fast_mlsirm.covariance_standardization@1.0.0` from protected-base `main@b5a3a0c1057d4b53d7a4bb18e0de69f630c2b45c`. Immutable `v0.9.1` predates #1722. TEPP therefore keeps #315 as research/compatibility lineage only until #1722 or its verified successor lands and is immutably released, after which TEPP must consume that released contract through an ACL, prove parity, retain temporal/model admission, delete wrong-owner production arithmetic, and fold TEPP-specific composition into a Measurement/Longitudinal Modeling landing vehicle. **#437 — ADR identity.** Repository-wide ADR IDs are immutable authority. Duplicate index IDs, duplicate targets, duplicate numbered ADR files, repeated authority declarations, and index/file status or maturity drift must fail deterministic documentation fitness tests. Operation-specific ADRs on adapter/model micro-branches are implementation lineage pending normalization, not branch-local architecture authority. #435 contains the current deterministic fitness implementation; issue closure still requires exact-head hosted evidence and a coherent landing decision. ## Dependency and Context Fabric status -fast-mlsirm protected `main` is `b5a3a0c1057d4b53d7a4bb18e0de69f630c2b45c`. Generalized-mixed/dependence compiler #1714 is open and Ready at `92a3f2152033b61ca89661b5ba8a584842e8c3a9` after a non-destructive restack onto that exact base; GitHub reports it mergeable. The branch preserves typed membership topology/weight authority and deterministic `fast_mlsirm.model_specification.candidate_manifest@1.0.0`, but the restack invalidated predecessor evidence: exact-head `CodeQL PR` ended in `startup_failure`, CI is pending, and Security/SAST/CodeQL/OSV/Scorecard remain queued. Static covariance-standardization owner #1722 is also Ready/mergeable at `338dbb2d25f32b0e201102e7bf73076846fb57b3`; it exposes `fast_mlsirm.covariance_standardization@1.0.0`, but its exact head likewise has `CodeQL PR` `startup_failure`, pending CI, queued CodeQL/Security/SAST/OSV/Scorecard/fuzzing, and no qualifying independent approval. The latest immutable fast-mlsirm release is `v0.9.1` from 2026-08-26 and predates both #1714 and #1722, so TEPP must not consume either new Published Language until an immutable compatible owner release exists. +fast-mlsirm protected `main` is `b5a3a0c1057d4b53d7a4bb18e0de69f630c2b45c`. Generalized-mixed/dependence compiler #1714 is open, Ready, mergeable, and currently at `92a3f2152033b61ca89661b5ba8a584842e8c3a9` on that exact base. It preserves typed membership topology/weight authority and deterministic `fast_mlsirm.model_specification.candidate_manifest@1.0.0`. The latest immutable fast-mlsirm release is `v0.9.1` from 2026-08-26 and predates #1714 and #1722, so TEPP must not consume either new Published Language until an immutable compatible owner release exists. -TEPP protected main checksum-pins contextual-orchestrator commit `e226e1197bdfc890c9d8e5b9b648c78857d7e465` with SHA-256 `964b22ff577e3862b761af847ccad65489bb3f8fc750c8f84fcf8628df096673`. Fresh owner state is protected `main@464da4715b495b5eaaa593eba3796e2d976ee0c9`, but contextual-orchestrator has zero GitHub releases. Advancing TEPP requires a compatible immutable release, authenticated deployment/release provenance, a safe gateway-authentication contract, and an exact reviewed ACL/dependency bump; checksum validation must not be removed or guessed. +TEPP protected main checksum-pins contextual-orchestrator commit `e226e1197bdfc890c9d8e5b9b648c78857d7e465` with SHA-256 `964b22ff577e3862b761af847ccad65489bb3f8fc750c8f84fcf8628df096673`. Fresh owner state is protected `main@464da4715b495b5eaaa593eba3796e2d976ee0c9`, but contextual-orchestrator still has zero GitHub releases. Advancing TEPP requires a compatible immutable release, authenticated deployment/release provenance, a safe gateway-authentication contract, and an exact reviewed ACL/dependency bump; checksum validation must not be removed or guessed. -`context-graph-contracts` and `enterprise-architecture-core` remain read-only to this writer. Context Graph protected/default `develop` is `99cb5468ba3c15c5e79688f53dee74724fae2d13`, with **14 open PRs** and **zero releases**. EA Core protected/default `develop` is `1c0fa8b15ceb9e72186274aeb255d6777eb84ef4`, with **24 open PRs** and **zero releases**. Their open heads are candidate evidence, not released contracts. TEPP may maintain fail-closed conformance fixtures behind candidate/test boundaries, but deployable integration and authoritative EA projection require released/versioned Context Graph artifacts plus passing compatibility and provenance evidence. TEPP latent estimates, measurement scores, inferred event relations, and validity evidence do not become authoritative EA facts. +`context-graph-contracts` and `enterprise-architecture-core` remain read-only to this writer. Their open heads are candidate evidence, not released contracts. TEPP may maintain fail-closed conformance fixtures behind candidate/test boundaries, but deployable integration and authoritative EA projection require released/versioned Context Graph artifacts plus passing compatibility and provenance evidence. TEPP latent estimates, measurement scores, inferred event relations, and validity evidence do not become authoritative EA facts. ## Gap register From 8a68fd1eb48e119ad56f33071d5e526457811390 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 23:40:24 +0900 Subject: [PATCH 092/235] docs(delivery): classify summarizes-edge WIP regression --- docs/product-technical-gap-baseline.md | 130 +++++++++++++------------ 1 file changed, 67 insertions(+), 63 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index e8e0b5145..3e8bbfe09 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,50 +1,49 @@ # Product and Technical Gap Baseline -**Status:** Active delivery recovery -**Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-02T14:34Z -**Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` -**Workspace version:** `0.2.0` -**Delivery authority:** issue [#175](https://github.com/ContextualWisdomLab/TEPP/issues/175), PR [#435](https://github.com/ContextualWisdomLab/TEPP/pull/435), and [`docs/delivery/pr-queue-authority-2026-09-01.md`](delivery/pr-queue-authority-2026-09-01.md) +**Status:** Active delivery recovery +**Product:** Temporal Event Psychometrics Platform (TEPP) +**Snapshot:** 2026-09-02T14:40Z +**Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` +**Workspace version:** `0.2.0` +**Delivery authority:** issue [#175](https://github.com/ContextualWisdomLab/TEPP/issues/175), PR [#435](https://github.com/ContextualWisdomLab/TEPP/pull/435), and [`docs/delivery/pr-queue-authority-2026-09-01.md`](delivery/pr-queue-authority-2026-09-01.md) **DDD authority:** [`docs/architecture/domain-context-map.md`](architecture/domain-context-map.md) and [`docs/architecture/temporal-dependence-composition.md`](architecture/temporal-dependence-composition.md) ## Delivery truth -A planning document, mergeable branch, local test, predecessor-head result, queued/skipped check, ADR number, or LLM judgment does not make a capability shipped. Passing or queued checks never promote an open PR to `implemented-main`. +A planning document, mergeable branch, local test, predecessor-head result, queued/skipped check, ADR number, or LLM judgment does not make a capability shipped. Only protected-main integration plus current required evidence can establish delivery. -| Signal | Current evidence | Delivery implication | +| Signal | Fresh evidence | Implication | | --- | ---: | --- | -| Protected `main` | `1bc02f580cf48e1d39da239f0e818453437c31c3` | Capability claims remain bounded to this commit until protected main changes. | -| Open pull requests | **130** | The queue is down from the observed peak of 149 but remains above the prior fresh 128-PR snapshot; #482/#483 are WIP-regression fold children, not independent landing authority. | -| Draft pull requests | **129** | Non-landable work is explicitly parked while consolidated, repaired, or supplied with missing evidence. | -| Non-draft pull requests | **1** | #480 is the only non-Draft PR, but it is not deployable while contextual-orchestrator has no compatible immutable release and released gateway identity/authentication contracts remain incomplete. | -| Open issues | **16** | Includes #437 ADR identity normalization, #479 hourly orchestrator admission, and #481 dynamic-evaluation drift design/evidence gathering. | -| GitHub releases | **0** | No open TEPP head is a released contract. | -| Effective organization ruleset | `18156473` | One qualifying approval, stale-review dismissal after push, resolved review threads, unattributed-change approval where applicable, and central required workflows remain landing authority. | +| Protected `main` | `1bc02f580cf48e1d39da239f0e818453437c31c3` | Capability claims remain bounded to this commit until main advances. | +| Open pull requests | **131** | Queue increased from 130 when #484 appeared while #435 remained open; WIP circuit breaker is active. | +| Draft pull requests | **130** | Draft work must be consolidated/repaired rather than independently landed. | +| Non-Draft pull requests | **1** | #480 remains the only non-Draft PR and is still non-deployable without a compatible immutable contextual-orchestrator release. | +| Open issues | **16** | Includes ADR normalization, orchestrator admission, and dynamic-evaluation drift design/evidence work. | +| GitHub releases | **0** | No TEPP open head is a released contract. | +| Organization ruleset | `18156473` | One qualifying current-head approval, stale-review dismissal after push, resolved threads, unattributed-change approval where applicable, and central required workflows. | -Classic branch protection is not the sole policy source; organization rulesets are effective merge authority where applicable. Any increase in open PR count while #435 remains open is a WIP regression unless the new PR is a demonstrably independent root-cause repair that cannot safely belong to an existing landing vehicle. #480 is such an exception because it owns TEPP's consumer-side CI/orchestrator admission boundary and cannot coherently belong to the Validation/Analysis Run, Longitudinal Modeling, or queue-documentation vehicles. +The queue rose from **130 to 131** at 2026-09-02T14:37Z because #484 `summarizes_edge_v1` was opened as another Analysis Run profile against `main`. Its changed files overlap the existing Analysis Run landing surfaces (`Cargo.lock`, `crates/analysis_engine/Cargo.toml`, `crates/analysis_engine/src/lib.rs`, TRACEABILITY/ADR/doctoring). It has therefore been non-destructively retargeted to #416 rather than treated as an independent landing authority. The resulting conflict is real shared-file fold work; unique source/tests/doctoring and RED/repair evidence must survive into the eventual #416 head. The PR is not closed merely to reduce the count. -The queue was **128** at the previous fresh snapshot and rose to **130** when #482 `role_contradiction_v1` and #483 `retrospective_edge_v1` were opened as one-profile slices. Fresh changed-file classification showed both modify the same Analysis Run/Validation shared Cargo/lib/docs surfaces as #416. #458, #460, #482, and #483 now all target the #416 branch with comparison base SHA `0b7155cc238defb1e55129ff3000658f04b343cf`; GitHub still reports all four as non-mergeable. The remaining conflicts are therefore real shared-file fold work rather than stale base metadata. Unique source, tests, doctoring, RED/repair lineage, and temporal-refusal semantics must survive into the eventual #416 landing head. Issue #481 remains design/evidence work only and does not authorize implementation against mutable upstream PR heads. +## Priority landing evidence -## Current priority open pull-request evidence +This is a priority subset, not a row-for-row copy of the 131-PR queue. #435 intentionally omits its own SHA from this file because embedding a branch head inside a file changed by the same branch would make the file self-stale. -This is a freshly verified priority subset, not a row-for-row copy of the 130-PR queue. #435 intentionally omits its own SHA because embedding a branch head inside a file changed by that same branch would make the file self-stale. - -| PR | Exact current head | Draft | Base | Ownership / disposition | +| PR | Exact head | Draft | Base | Ownership / disposition | | ---: | --- | :---: | --- | --- | -| #483 | `847d96f913bb261803ac0bd751ad7e4f51324cee` | true | #416 branch @ `0b7155cc238defb1e55129ff3000658f04b343cf` | `retrospective_edge_v1` fold child; cutoff-before-identity admission repair and unique tests/doctoring must survive the conflict-resolving fold. | -| #482 | `506dbae236a4484301b704b6c6a05b20faf0fe69` | true | #416 branch @ `0b7155cc238defb1e55129ff3000658f04b343cf` | `role_contradiction_v1` fold child; cutoff-before-identity admission repair and unique tests/doctoring must survive the conflict-resolving fold. | -| #480 | `4475542750eda01afad0cf9ea8d563f508f63fd3` | false | main | TEPP consumer-side LLM governance repair; removes provider discovery/ranking and requires released `orchestrator/free` through HTTPS. Still blocked on immutable owner release, authenticated deployment provenance, and non-reusable/brokered gateway authentication. | -| #460 | `dfab4eab5ff733731e565a9348072b8dab2e4912` | true | #416 branch @ `0b7155cc238defb1e55129ff3000658f04b343cf` | `relation_absence_v1` fold child; typed cutoff equality and terminal validation-status separation preserved. | -| #458 | `08165e3b3c929b4ae77396689549f72723ff8ff5` | true | #416 branch @ `0b7155cc238defb1e55129ff3000658f04b343cf` | `outcome_order_v1` fold child; typed cutoff equality and terminal validation-status separation preserved. | -| #416 | `0b7155cc238defb1e55129ff3000658f04b343cf` | true | main | Provisional Validation / Analysis Run simple-refusal landing vehicle; generic cutoff-before-identity admission is the surviving leakage-safe invariant. | -| #310 | `260413efb9d95039b5fbba41919cba8097fcf8b5` | true | main | Longitudinal Modeling scientific landing work; CWC unit-mean accumulation now survives overflowing raw partial sums when the mean/residuals remain representable, reusing the canonical compensated mean. Current hosted merge evidence is non-GREEN. | +| #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 branch @ `0b7155cc238defb1e55129ff3000658f04b343cf` | `summarizes_edge_v1` fold child; future-unavailable evidence is filtered before duplicate-identity admission. | +| #483 | `847d96f913bb261803ac0bd751ad7e4f51324cee` | true | #416 branch @ `0b7155cc238defb1e55129ff3000658f04b343cf` | `retrospective_edge_v1` fold child; unique tests/doctoring must survive. | +| #482 | `506dbae236a4484301b704b6c6a05b20faf0fe69` | true | #416 branch @ `0b7155cc238defb1e55129ff3000658f04b343cf` | `role_contradiction_v1` fold child; unique tests/doctoring must survive. | +| #480 | `4475542750eda01afad0cf9ea8d563f508f63fd3` | false | main | Independent consumer-side LLM-governance repair; requires released CO + HTTPS `orchestrator/free`, deployment provenance and safe gateway auth. | +| #460 | `dfab4eab5ff733731e565a9348072b8dab2e4912` | true | #416 branch @ `0b7155cc238defb1e55129ff3000658f04b343cf` | `relation_absence_v1` fold child; typed cutoff equality and terminal validation separation preserved. | +| #458 | `08165e3b3c929b4ae77396689549f72723ff8ff5` | true | #416 branch @ `0b7155cc238defb1e55129ff3000658f04b343cf` | `outcome_order_v1` fold child; typed cutoff equality and terminal validation separation preserved. | +| #416 | `0b7155cc238defb1e55129ff3000658f04b343cf` | true | main | Validation / Analysis Run landing candidate; availability cutoff precedes duplicate-identity admission. | +| #310 | `260413efb9d95039b5fbba41919cba8097fcf8b5` | true | main | Longitudinal Modeling vehicle; new CWC stable-mean repair plus prior lagged-correlation/stationary/log-rate repair lineage. | -Exact current-head evidence is authoritative only for the named PR and becomes stale after any source mutation. +Exact-head evidence becomes stale after source mutation. ## Domain ownership -Cargo crates, HTTP routes, CLI verbs, refusal rules, clocks, and individual statistical maps are implementation units, not bounded contexts. +Cargo crates, HTTP routes, CLI verbs, refusal rules, clocks, and individual statistical maps are implementation units rather than bounded contexts. | Subdomain | Bounded context | Aggregate authority | Implementation nucleus | | --- | --- | --- | --- | @@ -54,55 +53,64 @@ Cargo crates, HTTP routes, CLI verbs, refusal rules, clocks, and individual stat | Core | Measurement | `MeasurementSpecification`, `MeasurementRun` | measurement modules + released fast-mlsirm ACL | | Core | Longitudinal Modeling | `TemporalModelSpecification`, `TemporalModelRun` | `longitudinal_core` + temporal/event composition | | Core | Validation Evidence | `ValidationStudy`, `ValidationEvidence` | `validation_core`, `tepp_simulation` | -| Core | Scientific Claim Promotion | `ClaimPromotionDecision` | ADR 0014 policy; consumes validation evidence but does not own estimators or transport | -| Supporting | Projection / Analysis Run | `AnalysisRun`, published read models | application services; HTTP/CLI are adapters | +| Core | Scientific Claim Promotion | `ClaimPromotionDecision` | validation evidence + ADR 0014 policy | +| Supporting | Projection / Analysis Run | `AnalysisRun`, published read models | application services; HTTP/CLI adapters | | Supporting | Interpretation | evidence-grounded interpretation workflow | contextual-orchestrator ACL only | -| Supporting | Persistence & Recovery | repositories and durable receipts | `persistence_postgres`, object-store adapters | +| Supporting | Persistence & Recovery | repositories and durable receipts | persistence/object-store adapters | | Generic | Compute backend | execution receipt | CPU/GPU/MLX adapters; execution is not scientific authority | -fast-mlsirm owns reusable static/generalized-mixed/dependence-aware psychometric specification and numerical kernels, including reusable covariance standardisation and LSIRM/MLSIRM/DLSJM kernels. TEPP owns temporal/event composition, irregular time, time-varying multilevel/cross-classified/multiple-membership semantics, longitudinal invariance/drift/alignment, and temporal recovery. contextual-orchestrator owns every LLM/provider execution and routing decision. Context Graph contracts are a contract-only Shared Kernel; EA Core owns authoritative architecture decisions. No cross-service SQL. +fast-mlsirm owns reusable static/generalized-mixed/dependence-aware psychometric specification and arithmetic, including LSIRM/MLSIRM/DLSJM kernels. TEPP owns temporal/event composition, irregular time, time-varying multilevel/cross-classified/multiple-membership semantics, longitudinal invariance/drift/alignment and temporal recovery. contextual-orchestrator owns provider/model routing and semantic LLM execution. Context Graph contracts are contract-only integration authority; EA Core owns enterprise-architecture decisions. No source copying, mutable sibling dependency, or cross-service SQL. + +The clock contract separates event/valid time, assertion time, document time, system time, available time, and knowledge cutoff. Retrospective evidence may describe an earlier event but cannot enter an earlier knowledge cutoff. Forward state/transition edges remain distinct from retrospective/citation/revision/provenance relations. -The six-clock contract keeps event/valid time as one role, followed by assertion time, document time, system time, available time, and knowledge cutoff. A retrospective source may describe an earlier event but cannot enter an earlier knowledge cutoff. Forward state/transition edges remain distinct from retrospective, citation, revision, and provenance relations. +## Scientific invariants -## Temporal/dependence model policy +- Rasch remains distinct from generic 1PL; formulation-qualified 2PLM–5PLM, MIRT, ideal-point/GGUM, testlet/rater/facet/generalized-mixed identity is preserved. +- Cross-classification and multiple membership remain distinct; weights are explicit, auditable, time-valid and observed-normalized or model-estimated according to formulation. +- TEPP composes time over the full released upstream candidate identity; auto-expansion never means auto-activation. +- Supported temporal estimators require state/trajectory and claimed-structure recovery, bias/RMSE, interval coverage, convergence, uncertainty calibration and leakage-safe rolling-origin evidence. +- CPU/GPU parity counts only when the relevant accelerator path actually runs. Monte Carlo decisions use simulation uncertainty rather than arbitrary pass percentages. +- Scientific failures are never hidden with skip/xfail/source rewriting/coverage exclusions. -TEPP composes time over the full released upstream candidate identity, not hard-coded family names. Every candidate records exact response/generalized-mixed/dependence formulation, `supported | research_candidate | unsupported`, state/generative equations, clock roles, identification/alignment, time-varying covariates/random effects/memberships, estimator owner, required data support, primary citations, and recovery status. +## Current repairs and blockers -Rasch remains distinct from generic 1PL. Formulation-qualified 2PLM–5PLM, confirmatory/exploratory MIRT, and ideal-point/GGUM identities are preserved. Cross-classification and multiple membership remain distinct; membership weights are explicit, time-valid, and observed-normalized or model-estimated according to the formulation. LSIRM/MLSIRM temporal candidates preserve base parameters plus person/item geometry. DLSJM keeps distinct item- and person-dependence spaces. Dynamic geometry stays `research_candidate` until state equations, temporal identification/alignment, and true-parameter recovery exist. +### #310 — Longitudinal Modeling -Auto-expansion is not auto-activation. A numerical standardizer or adapter is not a DSEM/ctsem/LSIRM/MLSIRM/DLSJM estimator without exact generative/state equations, identification, estimator, and recovery evidence. +Closed predecessor #441 is contained by #310. The invalid covariance/earlier-variance quantity is not exposed as autocorrelation; lagged Pearson correlation requires lagged covariance and both occasion-specific marginal variances. Temporal/state composition is owned by `longitudinal_core`. -## Scientific validation invariants +Current head `260413efb9d95039b5fbba41919cba8097fcf8b5` preserves prior stationary-variance, full-range cancellation, log-domain same-sign ratio, and one-numerical-authority repairs. Fresh review found a separate CWC mean defect: naive unit-score summation rejected finite observations when an intermediate partial sum overflowed although the final mean and centered residuals were representable. -Supported temporal estimators require realistic known-truth recovery for every claimed structure. Parameter claims require RMSE, bias, interval/credible-interval coverage, convergence, and uncertainty calibration. Temporal-order, transition, dependency-graph, branch-graph, cluster-transition, or cross-time comparison claims additionally require recovery of that structure and applicable longitudinal measurement-invariance evidence. Leakage-safe rolling-origin evaluation separates event/valid time from available time and tests irregular gaps, delayed or retrospective reports, missing occasions, changing memberships, and relevant language/source drift. CPU/GPU parity is evidence only when the corresponding accelerator path actually runs; skipped or ignored GPU tests do not qualify. Monte Carlo decisions use simulation uncertainty rather than arbitrary pass percentages. Scientific failure is never hidden with skip, xfail, source rewriting, or coverage exclusions. +RED `9a706c3c0e9e0db68e88f89b94c64c13ea7fafd0` fixes the counterexample `[0.75·MAX, 0.75·MAX, -0.5·MAX]`; the first raw partial sum is infinite while the exact final mean and residuals are representable. Repair `260413efb9d95039b5fbba41919cba8097fcf8b5` reuses the existing Longitudinal Modeling `scaled_compensated_mean` for CWC unit means. `[MAX, MAX]` now forms the valid mean `MAX` and fails only at the later semantic boundary because zero residuals do not admit the real log-rate. -## Current repairs and blockers +Hosted evidence for this exact head is not GREEN. CodeQL PR run `33642608009` completed as `startup_failure`; OSV, Rust Foundation CI and Scorecard are pending, while Security Scan, SAST Semgrep and Documentation Quality are queued. No qualifying current-head independent approval exists. Predecessor-head results do not transfer and the central CodeQL startup failure does not authorize bypass. -**#310 — Longitudinal Modeling scientific landing work.** Closed predecessor #441 is contained by #310. The invalid one-sided covariance/earlier-variance ratio remains retired; public lagged Pearson correlation requires lagged covariance and both occasion-specific marginal variances. `EventTimeInterval` is preserved end-to-end. Current head `260413efb9d95039b5fbba41919cba8097fcf8b5` preserves the prior stationary-variance/cancellation/log-domain repairs and adds RED `9a706c3c0e9e0db68e88f89b94c64c13ea7fafd0` plus causal repair `260413efb9d95039b5fbba41919cba8097fcf8b5` for a distinct CWC centering defect. The predecessor formed the unit mean with a naive raw sum, so finite `[0.75·MAX, 0.75·MAX, -0.5·MAX]` observations were rejected when the first partial sum overflowed even though the final mean and centered residuals were representable. The repair reuses the canonical Longitudinal Modeling `scaled_compensated_mean`; it does not mint a second numerical implementation. The historical `[MAX, MAX]` input now forms the valid finite mean `MAX`, then correctly fails later because zero residuals provide no admissible real log-rate, rather than being mislabeled as an observation-payload overflow. The PR remains Draft. Current exact-head hosted merge evidence is non-GREEN: the first materialized PR workflow observed after the repair is Scorecard run `33642604895`, still queued, and predecessor-head CI/review results do not transfer. A qualifying current-head independent approval is still required. This is not permission to bypass the gate. +### #416 — Validation / Analysis Run consolidation -**#416 — Validation / Analysis Run consolidation.** Current head `0b7155cc238defb1e55129ff3000658f04b343cf` contains non-force lineage from #473, #430, #461, #478, and #434. Shared admission/artifact invariants remain centralized while each refusal profile keeps its domain vocabulary. Generic RED `ffee655404716bf8d33c898a3c1a87a543abe701` and repair `0b7155cc238defb1e55129ff3000658f04b343cf` enforce availability cutoff before duplicate-identity admission so future-unavailable rows cannot change historical replay. #458, #460, #482, and #483 are now compared against this exact head and still conflict on shared Cargo/lib/lock/docs surfaces. Their unique evidence must be folded, not replaced or independently landed. +Current head `0b7155cc238defb1e55129ff3000658f04b343cf` centralizes the leakage-safe invariant established by RED `ffee655404716bf8d33c898a3c1a87a543abe701`: availability filtering occurs before duplicate-identity admission. #458/#460/#482/#483/#484 are comparison/fold children over shared Cargo/lib/lock/docs surfaces. Their unique evidence must be merged into a surviving #416 head before any child can be considered fully superseded. -**#480 / #479 — hourly orchestrator admission.** Current exact head `4475542750eda01afad0cf9ea8d563f508f63fd3` removes TEPP's second provider-routing authority. Scheduled execution now requires an immutable contextual-orchestrator release, an HTTPS gateway, gateway authentication, and only `contextual-orchestrator/orchestrator/free`; provider discovery, provider/model/group ranking, free/paid admission, and provider credentials remain owner-side. RED `6d756d02409d0eb11a35146b9abfe41369efd2ad` → repair `f1da3f29ee1c9d3de6923a52d6cf26b71b96d257` restricts gateway redirects to HTTPS, and RED `1f0d2ddfb3ac5d8e6c8e1c1c5c40d47c46a017c9` → repair `4475542750eda01afad0cf9ea8d563f508f63fd3` applies the same downgrade protection to the checksum-pinned OpenCode archive path. Two owner gaps remain: the running gateway cannot yet prove authenticated identity bound to the selected immutable release/schema/artifact, and the model-controlled process still receives a reusable gateway bearer. Both are tracked in contextual-orchestrator #1023 and require owner-side release/provenance plus scoped/ephemeral or brokered authentication. contextual-orchestrator protected `main@464da4715b495b5eaaa593eba3796e2d976ee0c9` still has zero GitHub releases, so #480 remains deliberately non-deployable rather than falling back to mutable source or direct provider execution. +### #480 / #479 — LLM owner boundary -**#481 — dynamic evaluation drift monitoring design/evidence lane.** TEPP owns temporal composition, availability/knowledge-cutoff semantics, longitudinal/multilevel/multiple-membership structure, drift/change-point evidence, and time-indexed invariance monitoring. It does not own item generation, provider/rater invocation, adjudication, anchor promotion, or reusable static psychometric kernels. Implementation remains blocked until canonical owners publish immutable released/digest-pinned run/item/rater/adjudication/linking contracts. The first eventual slice is a versioned ACL with no-anchor/no-linking fail-closed tests, not a drift score or dashboard. Current mutable sibling PR heads are evidence only and must not become production dependencies. +#480 removes TEPP-owned provider discovery/ranking and requires HTTPS `contextual-orchestrator/orchestrator/free` from an immutable owner release. contextual-orchestrator protected `main@464da4715b495b5eaaa593eba3796e2d976ee0c9` still has **zero GitHub releases**, so the consumer remains deliberately non-deployable. Do not fall back to mutable source, direct provider calls or guessed checksums. -**#315 — static-standardisation ownership repair.** #315 remains lineage only to preserve TEPP-specific `TIPREDVARstd` naming/event-time/refusal semantics. It must not merge with duplicate reusable arithmetic. The current canonical owner candidate is fast-mlsirm #1722 at exact head `338dbb2d25f32b0e201102e7bf73076846fb57b3`, exposing `fast_mlsirm.covariance_standardization@1.0.0` from protected-base `main@b5a3a0c1057d4b53d7a4bb18e0de69f630c2b45c`. Immutable `v0.9.1` predates #1722. TEPP therefore keeps #315 as research/compatibility lineage only until #1722 or its verified successor lands and is immutably released, after which TEPP must consume that released contract through an ACL, prove parity, retain temporal/model admission, delete wrong-owner production arithmetic, and fold TEPP-specific composition into a Measurement/Longitudinal Modeling landing vehicle. +### #315 / fast-mlsirm owner handoff -**#437 — ADR identity.** Repository-wide ADR IDs are immutable authority. Duplicate index IDs, duplicate targets, duplicate numbered ADR files, repeated authority declarations, and index/file status or maturity drift must fail deterministic documentation fitness tests. Operation-specific ADRs on adapter/model micro-branches are implementation lineage pending normalization, not branch-local architecture authority. #435 contains the current deterministic fitness implementation; issue closure still requires exact-head hosted evidence and a coherent landing decision. +TEPP-specific static-standardisation lineage must not become a second reusable arithmetic authority. fast-mlsirm protected `main@b5a3a0c1057d4b53d7a4bb18e0de69f630c2b45c`; generalized-mixed/dependence compiler #1714 is Ready/mergeable at `92a3f2152033b61ca89661b5ba8a584842e8c3a9`. Latest immutable release is `v0.9.1` (2026-08-26), which predates #1714 and the covariance-standardization candidate. TEPP may adopt their new Published Language only after a compatible immutable release and ACL/parity evidence. -## Dependency and Context Fabric status +### #437 — ADR identity -fast-mlsirm protected `main` is `b5a3a0c1057d4b53d7a4bb18e0de69f630c2b45c`. Generalized-mixed/dependence compiler #1714 is open, Ready, mergeable, and currently at `92a3f2152033b61ca89661b5ba8a584842e8c3a9` on that exact base. It preserves typed membership topology/weight authority and deterministic `fast_mlsirm.model_specification.candidate_manifest@1.0.0`. The latest immutable fast-mlsirm release is `v0.9.1` from 2026-08-26 and predates #1714 and #1722, so TEPP must not consume either new Published Language until an immutable compatible owner release exists. +Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/numbered files, index/file mismatch and repeated Decision-status or Implementation-maturity authority must fail deterministic documentation fitness. Adapter/model micro-slice ADR numbers remain implementation lineage pending normalization through #435, not branch-local architecture authority. -TEPP protected main checksum-pins contextual-orchestrator commit `e226e1197bdfc890c9d8e5b9b648c78857d7e465` with SHA-256 `964b22ff577e3862b761af847ccad65489bb3f8fc750c8f84fcf8628df096673`. Fresh owner state is protected `main@464da4715b495b5eaaa593eba3796e2d976ee0c9`, but contextual-orchestrator still has zero GitHub releases. Advancing TEPP requires a compatible immutable release, authenticated deployment/release provenance, a safe gateway-authentication contract, and an exact reviewed ACL/dependency bump; checksum validation must not be removed or guessed. +## External contract state -`context-graph-contracts` and `enterprise-architecture-core` remain read-only to this writer. Their open heads are candidate evidence, not released contracts. TEPP may maintain fail-closed conformance fixtures behind candidate/test boundaries, but deployable integration and authoritative EA projection require released/versioned Context Graph artifacts plus passing compatibility and provenance evidence. TEPP latent estimates, measurement scores, inferred event relations, and validity evidence do not become authoritative EA facts. +`context-graph-contracts` protected/default `develop@99cb5468ba3c15c5e79688f53dee74724fae2d13` has zero GitHub releases. `enterprise-architecture-core` protected/default `develop@1c0fa8b15ceb9e72186274aeb255d6777eb84ef4` also has zero releases. Both remain read-only from this TEPP writer; open heads are candidate evidence rather than production contracts. TEPP deployable integration and authoritative EA projection require released/versioned contract artifacts plus compatibility/provenance evidence. + +TEPP latent estimates, measurement scores, inferred event relations and validity evidence are not authoritative EA facts. ## Gap register | ID | Gap | Maturity | Closure evidence | | --- | --- | --- | --- | -| GAP-001 | PR authority fragmented across 130 open PRs | `release-blocking` | coherent landing vehicles, unique evidence preservation, protected-main reduction | +| GAP-001 | PR authority fragmented across 131 open PRs | `release-blocking` | coherent landing vehicles, unique-evidence preservation, protected-main reduction | | GAP-002 | multilingual span-grounded semantic/concept admission | `partial` | immutable offsets/layout, language profiles, concept dictionary, invariance/calibration, hostile-input tests | | GAP-003 | shared-latent temporal topic estimator | `partial` | Rust CPU f64 likelihood/uncertainty, relation/time/membership effects, true recovery, fitted candidate-K | | GAP-004 | durable end-to-end Analysis Run | `partial` | idempotent lifecycle, persistence/recovery, estimator-bound artifacts, validation/promotion separation, Compose E2E | @@ -115,15 +123,11 @@ TEPP protected main checksum-pins contextual-orchestrator commit `e226e1197bdfc8 | GAP-011 | operable multi-tenant release | `accepted-target` | OIDC/RLS/purpose controls, durable queue/storage, OTel/SLO, restore/load/migration, signed SBOM/provenance | | GAP-012 | paths obscure domain ownership | `active-refactor` | staged moves, ACLs, no cycles/cross-context persistence/shared-kernel creep | | GAP-013 | ADR identity collisions | `release-integrity` | unique repository-wide identity, deterministic duplicate detection, supersession lineage | -| GAP-014 | required workflow startup/runner evidence unavailable on current heads | `external-control-risk` | central runner/workflow repair, exact-current required workflows GREEN, no fail-open bypass | -| GAP-015 | contextual-orchestrator lacks immutable released contract for current owner behavior | `release-blocking` | compatible immutable CO release, deployment identity/provenance, safe gateway authentication, exact TEPP ACL/dependency adoption | -| GAP-016 | hourly LLM path needs released owner-only routing/authentication | `active-repair` | #480 consumer repair plus released CO adoption, authenticated deployment identity, brokered/scoped auth, exact-head GREEN, qualifying review, protected-main merge | -| GAP-017 | dynamic evaluation item/rater/anchor drift monitoring | `blocked-external-design` | released/digest-pinned owner contracts, ACL conformance, no-anchor/no-linking refusal, then evidence-gated temporal monitoring | - -## Delivery and release order - -Queue/ADR/domain authority precedes semantic admission, the Rust CPU f64 shared-latent temporal estimator, durable Analysis Run, released fast-mlsirm static psychometric owner contracts plus TEPP-owned temporal composition, event intelligence, accelerator parity, buyer workflows, and finally tenancy/durability/observability/release support. A bounded security/dependency/provider-admission repair may land earlier when it directly closes a fail-closed control defect and all immutable-owner prerequisites exist. +| GAP-014 | current required-workflow startup/runner evidence unavailable | `external-control-risk` | central workflow repair, exact-current required workflows GREEN, no bypass | +| GAP-015 | contextual-orchestrator has no immutable released contract for current owner behavior | `release-blocking` | compatible immutable CO release, deployment provenance, safe gateway auth, exact TEPP ACL adoption | +| GAP-016 | hourly LLM path needs released owner-only routing/authentication | `active-repair` | #480 + released CO adoption + exact-head GREEN/review/main merge | +| GAP-017 | dynamic evaluation item/rater/anchor drift monitoring | `blocked-external-design` | released/digest-pinned owner contracts, ACL conformance, no-anchor/no-linking refusal, evidence-gated temporal monitoring | -Every open PR is classified as `landing_vehicle`, `stacked_dependency`, `fold_into_landing_vehicle`, `superseded`, `duplicate`, `research_lineage_only`, `blocked_external`, or an explicitly justified independent root-cause repair. Exact heads must be compared before closure. Strict ancestry permits safe consolidation; diverged siblings require a real code/test fold first. +## Release gate -TEPP has no GitHub release at this snapshot. A release is permitted only after a clean integration state reaches protected main with exact protected-head CI/security evidence, claim-scoped scientific and recovery acceptance, reproducible artifacts with SBOM and provenance, validated migrations/upgrade/rollback/recovery where applicable, consistent version metadata and a current `CHANGELOG.md`, accessibility and operability evidence for user-facing components, no unresolved scientific/privacy/security/supply-chain blockers, and released integration contracts where cross-product deployment depends on them. \ No newline at end of file +TEPP currently has no GitHub release. Release is permitted only after a coherent vertical reaches protected main with exact protected-head CI/security/recovery evidence, reproducible package + SBOM + provenance + rollback artifacts, current version/CHANGELOG, required migration/restore/load evidence, and released integration contracts where deployment depends on them. Queued/pending/startup-failed/skipped or predecessor-head evidence is not GREEN. \ No newline at end of file From a7ef28a6acdca9caa77d95db47b0a8be94a4f751 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 3 Sep 2026 00:13:20 +0900 Subject: [PATCH 093/235] docs(delivery): refresh longitudinal recovery evidence --- docs/product-technical-gap-baseline.md | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 3e8bbfe09..6cd19b0a8 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-02T14:40Z +**Snapshot:** 2026-09-02T15:10Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` **Workspace version:** `0.2.0` **Delivery authority:** issue [#175](https://github.com/ContextualWisdomLab/TEPP/issues/175), PR [#435](https://github.com/ContextualWisdomLab/TEPP/pull/435), and [`docs/delivery/pr-queue-authority-2026-09-01.md`](delivery/pr-queue-authority-2026-09-01.md) @@ -22,7 +22,7 @@ A planning document, mergeable branch, local test, predecessor-head result, queu | GitHub releases | **0** | No TEPP open head is a released contract. | | Organization ruleset | `18156473` | One qualifying current-head approval, stale-review dismissal after push, resolved threads, unattributed-change approval where applicable, and central required workflows. | -The queue rose from **130 to 131** at 2026-09-02T14:37Z because #484 `summarizes_edge_v1` was opened as another Analysis Run profile against `main`. Its changed files overlap the existing Analysis Run landing surfaces (`Cargo.lock`, `crates/analysis_engine/Cargo.toml`, `crates/analysis_engine/src/lib.rs`, TRACEABILITY/ADR/doctoring). It has therefore been non-destructively retargeted to #416 rather than treated as an independent landing authority. The resulting conflict is real shared-file fold work; unique source/tests/doctoring and RED/repair evidence must survive into the eventual #416 head. The PR is not closed merely to reduce the count. +The queue rose from **130 to 131** because #484 `summarizes_edge_v1` was opened as another Analysis Run profile against `main`. Its changed files overlap the existing Analysis Run landing surfaces (`Cargo.lock`, `crates/analysis_engine/Cargo.toml`, `crates/analysis_engine/src/lib.rs`, TRACEABILITY/ADR/doctoring). It has therefore been non-destructively retargeted to #416 rather than treated as an independent landing authority. The resulting conflict is real shared-file fold work; unique source/tests/doctoring and RED/repair evidence must survive into the eventual #416 head. The PR is not closed merely to reduce the count. ## Priority landing evidence @@ -37,7 +37,7 @@ This is a priority subset, not a row-for-row copy of the 131-PR queue. #435 inte | #460 | `dfab4eab5ff733731e565a9348072b8dab2e4912` | true | #416 branch @ `0b7155cc238defb1e55129ff3000658f04b343cf` | `relation_absence_v1` fold child; typed cutoff equality and terminal validation separation preserved. | | #458 | `08165e3b3c929b4ae77396689549f72723ff8ff5` | true | #416 branch @ `0b7155cc238defb1e55129ff3000658f04b343cf` | `outcome_order_v1` fold child; typed cutoff equality and terminal validation separation preserved. | | #416 | `0b7155cc238defb1e55129ff3000658f04b343cf` | true | main | Validation / Analysis Run landing candidate; availability cutoff precedes duplicate-identity admission. | -| #310 | `260413efb9d95039b5fbba41919cba8097fcf8b5` | true | main | Longitudinal Modeling vehicle; new CWC stable-mean repair plus prior lagged-correlation/stationary/log-rate repair lineage. | +| #310 | `406e6ae2b2a8fd99494e9bc82e61ced9b81bffe0` | true | main | Longitudinal Modeling vehicle; CWC stable-mean plus known-truth RMSE intermediate-overflow repairs preserve scientific fail-closed boundaries. | Exact-head evidence becomes stale after source mutation. @@ -78,11 +78,13 @@ The clock contract separates event/valid time, assertion time, document time, sy Closed predecessor #441 is contained by #310. The invalid covariance/earlier-variance quantity is not exposed as autocorrelation; lagged Pearson correlation requires lagged covariance and both occasion-specific marginal variances. Temporal/state composition is owned by `longitudinal_core`. -Current head `260413efb9d95039b5fbba41919cba8097fcf8b5` preserves prior stationary-variance, full-range cancellation, log-domain same-sign ratio, and one-numerical-authority repairs. Fresh review found a separate CWC mean defect: naive unit-score summation rejected finite observations when an intermediate partial sum overflowed although the final mean and centered residuals were representable. +Current head `406e6ae2b2a8fd99494e9bc82e61ced9b81bffe0` preserves prior stationary-variance, full-range cancellation, log-domain same-sign ratio, one-numerical-authority, and CWC stable-mean repairs. CWC RED `9a706c3c0e9e0db68e88f89b94c64c13ea7fafd0` fixed the counterexample `[0.75·MAX, 0.75·MAX, -0.5·MAX]`; repair `260413efb9d95039b5fbba41919cba8097fcf8b5` reuses the Longitudinal Modeling `scaled_compensated_mean` so representable means/residuals are not rejected by a raw partial-sum overflow. -RED `9a706c3c0e9e0db68e88f89b94c64c13ea7fafd0` fixes the counterexample `[0.75·MAX, 0.75·MAX, -0.5·MAX]`; the first raw partial sum is infinite while the exact final mean and residuals are representable. Repair `260413efb9d95039b5fbba41919cba8097fcf8b5` reuses the existing Longitudinal Modeling `scaled_compensated_mean` for CWC unit means. `[MAX, MAX]` now forms the valid mean `MAX` and fails only at the later semantic boundary because zero residuals do not admit the real log-rate. +Fresh review then found the same class of defect one stage later in known-truth recovery. `component_root_mean_square_error` scaled the sum of squared residuals only after computing each raw `decided - truth`. For four matched components with one `truth=-MAX, decided=MAX` pair and three zero residuals, that individual subtraction overflows even though the exact aggregate RMSE is `MAX` and therefore representable. -Hosted evidence for this exact head is not GREEN. CodeQL PR run `33642608009` completed as `startup_failure`; OSV, Rust Foundation CI and Scorecard are pending, while Security Scan, SAST Semgrep and Documentation Quality are queued. No qualifying current-head independent approval exists. Predecessor-head results do not transfer and the central CodeQL startup failure does not authorize bypass. +RED `d72ba2b6e28909c6def73a2638ebd63258dec500` pins that four-row recovery case. Causal repair `406e6ae2b2a8fd99494e9bc82e61ced9b81bffe0` validates finite matched identities first, normalizes truth and decided values by the largest absolute component magnitude before subtraction, computes the bounded normalized mean square/root, and scales only the final RMSE back to component units. The representable four-row case returns `MAX`; the one-row `-MAX → MAX` case remains fail-closed because its final RMSE is genuinely non-representable. Component identity, failure denominator, and scientific acceptance semantics are unchanged. + +Hosted evidence for this exact head is not GREEN. CodeQL PR run `33646689205` completed as `startup_failure`; OSV-Scanner PR, Rust Foundation CI, Scorecard PR, Security Scan, SAST Semgrep and Documentation Quality are queued. No qualifying current-head independent approval exists. Predecessor-head results do not transfer and the central CodeQL startup failure does not authorize bypass. ### #416 — Validation / Analysis Run consolidation @@ -94,7 +96,7 @@ Current head `0b7155cc238defb1e55129ff3000658f04b343cf` centralizes the leakage- ### #315 / fast-mlsirm owner handoff -TEPP-specific static-standardisation lineage must not become a second reusable arithmetic authority. fast-mlsirm protected `main@b5a3a0c1057d4b53d7a4bb18e0de69f630c2b45c`; generalized-mixed/dependence compiler #1714 is Ready/mergeable at `92a3f2152033b61ca89661b5ba8a584842e8c3a9`. Latest immutable release is `v0.9.1` (2026-08-26), which predates #1714 and the covariance-standardization candidate. TEPP may adopt their new Published Language only after a compatible immutable release and ACL/parity evidence. +TEPP-specific static-standardisation lineage must not become a second reusable arithmetic authority. fast-mlsirm protected `main@b5a3a0c1057d4b53d7a4bb18e0de69f630c2b45c`; generalized-mixed/dependence compiler #1714 is Ready/mergeable at `92a3f2152033b61ca89661b5ba8a584842e8c3a9`. Latest immutable release is `v0.9.1` (2026-08-26), which predates #1714. TEPP may adopt the new Published Language only after a compatible immutable release and ACL/parity evidence. Current #1714 exact-head evidence is non-GREEN: CI is pending; CodeQL PR is startup-failed; OSV, Scorecard, Semgrep, CodeQL and Security Scan are queued. ### #437 — ADR identity @@ -102,7 +104,7 @@ Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/num ## External contract state -`context-graph-contracts` protected/default `develop@99cb5468ba3c15c5e79688f53dee74724fae2d13` has zero GitHub releases. `enterprise-architecture-core` protected/default `develop@1c0fa8b15ceb9e72186274aeb255d6777eb84ef4` also has zero releases. Both remain read-only from this TEPP writer; open heads are candidate evidence rather than production contracts. TEPP deployable integration and authoritative EA projection require released/versioned contract artifacts plus compatibility/provenance evidence. +`context-graph-contracts` protected/default `develop@99cb5468ba3c15c5e79688f53dee74724fae2d13` has **14 open PRs, 2 open issues, and zero GitHub releases**. Its new release-source/provenance work remains Draft/unreleased evidence. `enterprise-architecture-core` protected/default `develop@1c0fa8b15ceb9e72186274aeb255d6777eb84ef4` has **24 open PRs, 2 open issues, and zero releases**. Both remain read-only from this TEPP writer; open heads are candidate evidence rather than production contracts. TEPP deployable integration and authoritative EA projection require released/versioned contract artifacts plus compatibility/provenance evidence. TEPP latent estimates, measurement scores, inferred event relations and validity evidence are not authoritative EA facts. From 89dad5f74aab0c799c63700631b93d3c04b1d5fd Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 3 Sep 2026 00:36:50 +0900 Subject: [PATCH 094/235] docs(delivery): refresh exact queue and owner evidence --- docs/product-technical-gap-baseline.md | 40 +++++++++++++++----------- 1 file changed, 24 insertions(+), 16 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 6cd19b0a8..e1a9c15c0 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,11 +1,17 @@ # Product and Technical Gap Baseline -**Status:** Active delivery recovery -**Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-02T15:10Z -**Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` -**Workspace version:** `0.2.0` -**Delivery authority:** issue [#175](https://github.com/ContextualWisdomLab/TEPP/issues/175), PR [#435](https://github.com/ContextualWisdomLab/TEPP/pull/435), and [`docs/delivery/pr-queue-authority-2026-09-01.md`](delivery/pr-queue-authority-2026-09-01.md) +**Status:** Active delivery recovery + +**Product:** Temporal Event Psychometrics Platform (TEPP) + +**Snapshot:** 2026-09-02T15:36Z + +**Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` + +**Workspace version:** `0.2.0` + +**Delivery authority:** issue [#175](https://github.com/ContextualWisdomLab/TEPP/issues/175), PR [#435](https://github.com/ContextualWisdomLab/TEPP/pull/435), and [`docs/delivery/pr-queue-authority-2026-09-01.md`](delivery/pr-queue-authority-2026-09-01.md) + **DDD authority:** [`docs/architecture/domain-context-map.md`](architecture/domain-context-map.md) and [`docs/architecture/temporal-dependence-composition.md`](architecture/temporal-dependence-composition.md) ## Delivery truth @@ -22,7 +28,7 @@ A planning document, mergeable branch, local test, predecessor-head result, queu | GitHub releases | **0** | No TEPP open head is a released contract. | | Organization ruleset | `18156473` | One qualifying current-head approval, stale-review dismissal after push, resolved threads, unattributed-change approval where applicable, and central required workflows. | -The queue rose from **130 to 131** because #484 `summarizes_edge_v1` was opened as another Analysis Run profile against `main`. Its changed files overlap the existing Analysis Run landing surfaces (`Cargo.lock`, `crates/analysis_engine/Cargo.toml`, `crates/analysis_engine/src/lib.rs`, TRACEABILITY/ADR/doctoring). It has therefore been non-destructively retargeted to #416 rather than treated as an independent landing authority. The resulting conflict is real shared-file fold work; unique source/tests/doctoring and RED/repair evidence must survive into the eventual #416 head. The PR is not closed merely to reduce the count. +The queue rose from **130 to 131** because #484 `summarizes_edge_v1` was opened as another Analysis Run profile against `main`. Its changed files overlap the existing Analysis Run landing surfaces (`Cargo.lock`, `crates/analysis_engine/Cargo.toml`, `crates/analysis_engine/src/lib.rs`, TRACEABILITY/ADR/doctoring). It is therefore non-destructively retargeted to #416 rather than treated as an independent landing authority. The resulting conflict is real shared-file fold work; unique source/tests/doctoring and RED/repair evidence must survive into the eventual #416 head. The PR is not closed merely to reduce the count. ## Priority landing evidence @@ -37,7 +43,7 @@ This is a priority subset, not a row-for-row copy of the 131-PR queue. #435 inte | #460 | `dfab4eab5ff733731e565a9348072b8dab2e4912` | true | #416 branch @ `0b7155cc238defb1e55129ff3000658f04b343cf` | `relation_absence_v1` fold child; typed cutoff equality and terminal validation separation preserved. | | #458 | `08165e3b3c929b4ae77396689549f72723ff8ff5` | true | #416 branch @ `0b7155cc238defb1e55129ff3000658f04b343cf` | `outcome_order_v1` fold child; typed cutoff equality and terminal validation separation preserved. | | #416 | `0b7155cc238defb1e55129ff3000658f04b343cf` | true | main | Validation / Analysis Run landing candidate; availability cutoff precedes duplicate-identity admission. | -| #310 | `406e6ae2b2a8fd99494e9bc82e61ced9b81bffe0` | true | main | Longitudinal Modeling vehicle; CWC stable-mean plus known-truth RMSE intermediate-overflow repairs preserve scientific fail-closed boundaries. | +| #310 | `8111b58ac3374ae26b159868ce002d755e9e7d9e` | true | main | Longitudinal Modeling vehicle; stable CWC/within-between means and overflow-safe, precision-preserving known-truth RMSE recovery are current. | Exact-head evidence becomes stale after source mutation. @@ -78,13 +84,15 @@ The clock contract separates event/valid time, assertion time, document time, sy Closed predecessor #441 is contained by #310. The invalid covariance/earlier-variance quantity is not exposed as autocorrelation; lagged Pearson correlation requires lagged covariance and both occasion-specific marginal variances. Temporal/state composition is owned by `longitudinal_core`. -Current head `406e6ae2b2a8fd99494e9bc82e61ced9b81bffe0` preserves prior stationary-variance, full-range cancellation, log-domain same-sign ratio, one-numerical-authority, and CWC stable-mean repairs. CWC RED `9a706c3c0e9e0db68e88f89b94c64c13ea7fafd0` fixed the counterexample `[0.75·MAX, 0.75·MAX, -0.5·MAX]`; repair `260413efb9d95039b5fbba41919cba8097fcf8b5` reuses the Longitudinal Modeling `scaled_compensated_mean` so representable means/residuals are not rejected by a raw partial-sum overflow. +Current head `8111b58ac3374ae26b159868ce002d755e9e7d9e` preserves typed event-time admission, covariance-bound Pearson correlation, stationary-variance/subnormal handling, full-range cancellation, one irregular-rate numerical authority, CWC stable-mean repair, precision-preserving known-truth recovery, and stable within/between decomposition. + +CWC RED `9a706c3c0e9e0db68e88f89b94c64c13ea7fafd0` fixes `[0.75·MAX, 0.75·MAX, -0.5·MAX]`, whose raw partial sum overflows although the centered result is representable. Repair `260413efb9d95039b5fbba41919cba8097fcf8b5` routes CWC means through the Longitudinal Modeling stable compensated mean rather than adding a second arithmetic authority. -Fresh review then found the same class of defect one stage later in known-truth recovery. `component_root_mean_square_error` scaled the sum of squared residuals only after computing each raw `decided - truth`. For four matched components with one `truth=-MAX, decided=MAX` pair and three zero residuals, that individual subtraction overflows even though the exact aggregate RMSE is `MAX` and therefore representable. +Known-truth `component_root_mean_square_error` originally formed raw `decided - truth` before its scaled sum-of-squares path. RED `d72ba2b6e28909c6def73a2638ebd63258dec500` pins four matched components with one mathematical `2·MAX` residual and three zero residuals: the aggregate RMSE is representable `MAX`, but the predecessor rejected it because the individual subtraction overflowed. Initial repair `406e6ae2b2a8fd99494e9bc82e61ced9b81bffe0` removed that intermediate overflow, but fresh verification found a precision regression: normalizing every residual by an unrelated extreme endpoint could erase an ordinary finite residual. RED `dd0718e5d1b91baccc7efa4d196825c9119cd8e7` pins `[MAX→MAX, 0→1]`, whose RMSE is `1/sqrt(2)`, not zero. Corrective repair `312dbcd25a7246683d5596385571068d475fc4c3` keeps direct finite residual subtraction and its own magnitude; only an actually overflowing subtraction is represented as `endpoint_scale × normalized_difference`, after which the residual representations enter the scaled sum-of-squares accumulator. Current head `8111b58ac3374ae26b159868ce002d755e9e7d9e` tightens the finite-residual regression to a binary64 tolerance instead of requiring bit identity between algebraically equivalent square-root expressions. -RED `d72ba2b6e28909c6def73a2638ebd63258dec500` pins that four-row recovery case. Causal repair `406e6ae2b2a8fd99494e9bc82e61ced9b81bffe0` validates finite matched identities first, normalizes truth and decided values by the largest absolute component magnitude before subtraction, computes the bounded normalized mean square/root, and scales only the final RMSE back to component units. The representable four-row case returns `MAX`; the one-row `-MAX → MAX` case remains fail-closed because its final RMSE is genuinely non-representable. Component identity, failure denominator, and scientific acceptance semantics are unchanged. +`decompose_within_between` also retained a raw `sum / n` mean after CWC was stabilized. RED `1292fdc77b810dedf3d75b836744ac9ce8611014` pins a valid unit with `[MAX, MAX]`, whose mean is `MAX` and within residuals are zero. Repair `6bf3661bf390e0de00e1bb83539e6d62ee06b85f` uses magnitude-normalized Neumaier accumulation for each unit mean, scales back only after dividing by count, and rejects any non-finite resulting residual. Sorting, duplicate `(unit, occasion)` refusal, minimum-unit/occasion requirements, and component identity remain unchanged. -Hosted evidence for this exact head is not GREEN. CodeQL PR run `33646689205` completed as `startup_failure`; OSV-Scanner PR, Rust Foundation CI, Scorecard PR, Security Scan, SAST Semgrep and Documentation Quality are queued. No qualifying current-head independent approval exists. Predecessor-head results do not transfer and the central CodeQL startup failure does not authorize bypass. +Hosted evidence for exact head `8111b58ac3374ae26b159868ce002d755e9e7d9e` is not GREEN. CodeQL PR run `33648256909` completed as `startup_failure`; OSV-Scanner PR, Rust Foundation CI, Scorecard PR, Security Scan, SAST Semgrep and Documentation Quality are queued. All visible review threads are resolved, but there is no qualifying current-head independent `APPROVED` review. Predecessor evidence does not transfer and the central CodeQL startup failure does not authorize bypass. ### #416 — Validation / Analysis Run consolidation @@ -92,11 +100,11 @@ Current head `0b7155cc238defb1e55129ff3000658f04b343cf` centralizes the leakage- ### #480 / #479 — LLM owner boundary -#480 removes TEPP-owned provider discovery/ranking and requires HTTPS `contextual-orchestrator/orchestrator/free` from an immutable owner release. contextual-orchestrator protected `main@464da4715b495b5eaaa593eba3796e2d976ee0c9` still has **zero GitHub releases**, so the consumer remains deliberately non-deployable. Do not fall back to mutable source, direct provider calls or guessed checksums. +#480 removes TEPP-owned provider discovery/ranking and requires HTTPS `contextual-orchestrator/orchestrator/free` from an immutable owner release. contextual-orchestrator protected `main@212ff437dc297613289dba2e6064ade9942e07d8` has advanced since the preceding snapshot but still has **zero GitHub releases**. The branch movement is mutable owner state, not a released contract. The consumer remains deliberately non-deployable; do not fall back to mutable source, direct provider calls, or guessed checksums. ### #315 / fast-mlsirm owner handoff -TEPP-specific static-standardisation lineage must not become a second reusable arithmetic authority. fast-mlsirm protected `main@b5a3a0c1057d4b53d7a4bb18e0de69f630c2b45c`; generalized-mixed/dependence compiler #1714 is Ready/mergeable at `92a3f2152033b61ca89661b5ba8a584842e8c3a9`. Latest immutable release is `v0.9.1` (2026-08-26), which predates #1714. TEPP may adopt the new Published Language only after a compatible immutable release and ACL/parity evidence. Current #1714 exact-head evidence is non-GREEN: CI is pending; CodeQL PR is startup-failed; OSV, Scorecard, Semgrep, CodeQL and Security Scan are queued. +TEPP-specific static-standardisation lineage must not become a second reusable arithmetic authority. fast-mlsirm protected `main@b5a3a0c1057d4b53d7a4bb18e0de69f630c2b45c`; generalized-mixed/dependence compiler #1714 is Ready/mergeable at `92a3f2152033b61ca89661b5ba8a584842e8c3a9`. Latest immutable release is `v0.9.1` (2026-08-26), which predates #1714. TEPP may adopt the new Published Language only after a compatible immutable release and ACL/parity evidence. Open #1714 remains candidate owner evidence, not a released dependency. ### #437 — ADR identity @@ -104,7 +112,7 @@ Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/num ## External contract state -`context-graph-contracts` protected/default `develop@99cb5468ba3c15c5e79688f53dee74724fae2d13` has **14 open PRs, 2 open issues, and zero GitHub releases**. Its new release-source/provenance work remains Draft/unreleased evidence. `enterprise-architecture-core` protected/default `develop@1c0fa8b15ceb9e72186274aeb255d6777eb84ef4` has **24 open PRs, 2 open issues, and zero releases**. Both remain read-only from this TEPP writer; open heads are candidate evidence rather than production contracts. TEPP deployable integration and authoritative EA projection require released/versioned contract artifacts plus compatibility/provenance evidence. +`context-graph-contracts` protected/default `develop@99cb5468ba3c15c5e79688f53dee74724fae2d13` has **14 open PRs, 2 open issues, and zero GitHub releases**. Its release-source/provenance work remains Draft/unreleased evidence. `enterprise-architecture-core` protected/default `develop@1c0fa8b15ceb9e72186274aeb255d6777eb84ef4` has **24 open PRs, 2 open issues, and zero releases**. Both remain read-only from this TEPP writer; open heads are candidate evidence rather than production contracts. TEPP deployable integration and authoritative EA projection require released/versioned contract artifacts plus compatibility/provenance evidence. TEPP latent estimates, measurement scores, inferred event relations and validity evidence are not authoritative EA facts. @@ -132,4 +140,4 @@ TEPP latent estimates, measurement scores, inferred event relations and validity ## Release gate -TEPP currently has no GitHub release. Release is permitted only after a coherent vertical reaches protected main with exact protected-head CI/security/recovery evidence, reproducible package + SBOM + provenance + rollback artifacts, current version/CHANGELOG, required migration/restore/load evidence, and released integration contracts where deployment depends on them. Queued/pending/startup-failed/skipped or predecessor-head evidence is not GREEN. \ No newline at end of file +TEPP currently has no GitHub release. Release is permitted only after a coherent vertical reaches protected main with exact protected-head CI/security/recovery evidence, reproducible package + SBOM + provenance + rollback artifacts, current version/CHANGELOG, required migration/restore/load evidence, and released integration contracts where deployment depends on them. Queued/pending/startup-failed/skipped or predecessor-head evidence is not GREEN. From 15eef30fb1d91b7dec138f3b944ee18ba080df83 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 3 Sep 2026 00:49:00 +0900 Subject: [PATCH 095/235] docs(delivery): refresh longitudinal exact-head evidence --- docs/product-technical-gap-baseline.md | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index e1a9c15c0..59f9c7c3a 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,7 +4,7 @@ **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-02T15:36Z +**Snapshot:** 2026-09-02T15:48Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` @@ -43,9 +43,9 @@ This is a priority subset, not a row-for-row copy of the 131-PR queue. #435 inte | #460 | `dfab4eab5ff733731e565a9348072b8dab2e4912` | true | #416 branch @ `0b7155cc238defb1e55129ff3000658f04b343cf` | `relation_absence_v1` fold child; typed cutoff equality and terminal validation separation preserved. | | #458 | `08165e3b3c929b4ae77396689549f72723ff8ff5` | true | #416 branch @ `0b7155cc238defb1e55129ff3000658f04b343cf` | `outcome_order_v1` fold child; typed cutoff equality and terminal validation separation preserved. | | #416 | `0b7155cc238defb1e55129ff3000658f04b343cf` | true | main | Validation / Analysis Run landing candidate; availability cutoff precedes duplicate-identity admission. | -| #310 | `8111b58ac3374ae26b159868ce002d755e9e7d9e` | true | main | Longitudinal Modeling vehicle; stable CWC/within-between means and overflow-safe, precision-preserving known-truth RMSE recovery are current. | +| #310 | `75306b2445b071fa1c3201f5dd31a8c1eba08383` | true | main | Longitudinal Modeling vehicle; current tree preserves stable CWC/within-between means, overflow-safe known-truth RMSE, and one externally reachable irregular-rate facade. | -Exact-head evidence becomes stale after source mutation. +Exact-head evidence becomes stale after source mutation or any new commit, even when a later commit restores byte-equivalent files. ## Domain ownership @@ -84,15 +84,15 @@ The clock contract separates event/valid time, assertion time, document time, sy Closed predecessor #441 is contained by #310. The invalid covariance/earlier-variance quantity is not exposed as autocorrelation; lagged Pearson correlation requires lagged covariance and both occasion-specific marginal variances. Temporal/state composition is owned by `longitudinal_core`. -Current head `8111b58ac3374ae26b159868ce002d755e9e7d9e` preserves typed event-time admission, covariance-bound Pearson correlation, stationary-variance/subnormal handling, full-range cancellation, one irregular-rate numerical authority, CWC stable-mean repair, precision-preserving known-truth recovery, and stable within/between decomposition. +Current head `75306b2445b071fa1c3201f5dd31a8c1eba08383` has the same file tree as `8111b58ac3374ae26b159868ce002d755e9e7d9e`; GitHub compare reports two commits and zero changed files. The two commits record verification of a review suggestion that the canonical irregular-rate functions should be syntactically `pub(crate)`: because `lib.rs` keeps `mod irregular_residual;` private and exposes the recover operations only through `stable_irregular_rate`, plain `pub fn` inside that private module does not create a second externally reachable crate API. An exploratory syntax assertion was therefore removed rather than turning an internal spelling preference into a false architecture invariant. The facade continues to delegate to one canonical numerical implementation. CWC RED `9a706c3c0e9e0db68e88f89b94c64c13ea7fafd0` fixes `[0.75·MAX, 0.75·MAX, -0.5·MAX]`, whose raw partial sum overflows although the centered result is representable. Repair `260413efb9d95039b5fbba41919cba8097fcf8b5` routes CWC means through the Longitudinal Modeling stable compensated mean rather than adding a second arithmetic authority. -Known-truth `component_root_mean_square_error` originally formed raw `decided - truth` before its scaled sum-of-squares path. RED `d72ba2b6e28909c6def73a2638ebd63258dec500` pins four matched components with one mathematical `2·MAX` residual and three zero residuals: the aggregate RMSE is representable `MAX`, but the predecessor rejected it because the individual subtraction overflowed. Initial repair `406e6ae2b2a8fd99494e9bc82e61ced9b81bffe0` removed that intermediate overflow, but fresh verification found a precision regression: normalizing every residual by an unrelated extreme endpoint could erase an ordinary finite residual. RED `dd0718e5d1b91baccc7efa4d196825c9119cd8e7` pins `[MAX→MAX, 0→1]`, whose RMSE is `1/sqrt(2)`, not zero. Corrective repair `312dbcd25a7246683d5596385571068d475fc4c3` keeps direct finite residual subtraction and its own magnitude; only an actually overflowing subtraction is represented as `endpoint_scale × normalized_difference`, after which the residual representations enter the scaled sum-of-squares accumulator. Current head `8111b58ac3374ae26b159868ce002d755e9e7d9e` tightens the finite-residual regression to a binary64 tolerance instead of requiring bit identity between algebraically equivalent square-root expressions. +Known-truth `component_root_mean_square_error` originally formed raw `decided - truth` before its scaled sum-of-squares path. RED `d72ba2b6e28909c6def73a2638ebd63258dec500` pins four matched components with one mathematical `2·MAX` residual and three zero residuals: the aggregate RMSE is representable `MAX`, but the predecessor rejected it because the individual subtraction overflowed. Initial repair `406e6ae2b2a8fd99494e9bc82e61ced9b81bffe0` removed that intermediate overflow, but RED `dd0718e5d1b91baccc7efa4d196825c9119cd8e7` caught a precision regression for `[MAX→MAX, 0→1]`. Corrective repair `312dbcd25a7246683d5596385571068d475fc4c3` keeps direct finite residual subtraction and scales only actually overflowing differences. -`decompose_within_between` also retained a raw `sum / n` mean after CWC was stabilized. RED `1292fdc77b810dedf3d75b836744ac9ce8611014` pins a valid unit with `[MAX, MAX]`, whose mean is `MAX` and within residuals are zero. Repair `6bf3661bf390e0de00e1bb83539e6d62ee06b85f` uses magnitude-normalized Neumaier accumulation for each unit mean, scales back only after dividing by count, and rejects any non-finite resulting residual. Sorting, duplicate `(unit, occasion)` refusal, minimum-unit/occasion requirements, and component identity remain unchanged. +`decompose_within_between` also retained a raw `sum / n` mean after CWC was stabilized. RED `1292fdc77b810dedf3d75b836744ac9ce8611014` pins a valid unit with `[MAX, MAX]`; repair `6bf3661bf390e0de00e1bb83539e6d62ee06b85f` uses magnitude-normalized Neumaier accumulation and rejects only a non-representable resulting mean/residual. -Hosted evidence for exact head `8111b58ac3374ae26b159868ce002d755e9e7d9e` is not GREEN. CodeQL PR run `33648256909` completed as `startup_failure`; OSV-Scanner PR, Rust Foundation CI, Scorecard PR, Security Scan, SAST Semgrep and Documentation Quality are queued. All visible review threads are resolved, but there is no qualifying current-head independent `APPROVED` review. Predecessor evidence does not transfer and the central CodeQL startup failure does not authorize bypass. +The current exact head must reacquire hosted evidence from scratch. Any workflow/review result on `8111b58...` or earlier is historical even though the final file tree is equal. There is no qualifying current-head independent `APPROVED` review. No merge is authorized until all central required workflows are exact-head passing. ### #416 — Validation / Analysis Run consolidation @@ -100,7 +100,7 @@ Current head `0b7155cc238defb1e55129ff3000658f04b343cf` centralizes the leakage- ### #480 / #479 — LLM owner boundary -#480 removes TEPP-owned provider discovery/ranking and requires HTTPS `contextual-orchestrator/orchestrator/free` from an immutable owner release. contextual-orchestrator protected `main@212ff437dc297613289dba2e6064ade9942e07d8` has advanced since the preceding snapshot but still has **zero GitHub releases**. The branch movement is mutable owner state, not a released contract. The consumer remains deliberately non-deployable; do not fall back to mutable source, direct provider calls, or guessed checksums. +#480 removes TEPP-owned provider discovery/ranking and requires HTTPS `contextual-orchestrator/orchestrator/free` from an immutable owner release. contextual-orchestrator protected `main@212ff437dc297613289dba2e6064ade9942e07d8` has advanced since earlier snapshots but still has **zero GitHub releases**. The branch movement is mutable owner state, not a released contract. The consumer remains deliberately non-deployable; do not fall back to mutable source, direct provider calls, or guessed checksums. ### #315 / fast-mlsirm owner handoff From b5b499d558b8f265eb37910952c10c55528b8d1f Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 3 Sep 2026 01:10:30 +0900 Subject: [PATCH 096/235] docs(gap): refresh longitudinal exact-head evidence --- docs/product-technical-gap-baseline.md | 86 ++++++++++---------------- 1 file changed, 32 insertions(+), 54 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 59f9c7c3a..5ddcea93c 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,68 +4,52 @@ **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-02T15:48Z +**Snapshot:** 2026-09-02T16:06Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` **Workspace version:** `0.2.0` -**Delivery authority:** issue [#175](https://github.com/ContextualWisdomLab/TEPP/issues/175), PR [#435](https://github.com/ContextualWisdomLab/TEPP/pull/435), and [`docs/delivery/pr-queue-authority-2026-09-01.md`](delivery/pr-queue-authority-2026-09-01.md) +**Delivery authority:** issue [#175](https://github.com/ContextualWisdomLab/TEPP/issues/175), PR [#435](https://github.com/ContextualWisdomLab/TEPP/pull/435), and [`docs/delivery/pr-queue-authority-2026-09-01.md`](delivery/pr-queue-authority-2026-09-01.md). -**DDD authority:** [`docs/architecture/domain-context-map.md`](architecture/domain-context-map.md) and [`docs/architecture/temporal-dependence-composition.md`](architecture/temporal-dependence-composition.md) +**DDD authority:** [`docs/architecture/domain-context-map.md`](architecture/domain-context-map.md) and [`docs/architecture/temporal-dependence-composition.md`](architecture/temporal-dependence-composition.md). ## Delivery truth -A planning document, mergeable branch, local test, predecessor-head result, queued/skipped check, ADR number, or LLM judgment does not make a capability shipped. Only protected-main integration plus current required evidence can establish delivery. +A planning document, mergeable branch, local test, predecessor-head result, queued/skipped check, ADR number, or LLM judgment does not make a capability shipped. Only protected-main integration plus current required evidence establishes delivery. | Signal | Fresh evidence | Implication | | --- | ---: | --- | | Protected `main` | `1bc02f580cf48e1d39da239f0e818453437c31c3` | Capability claims remain bounded to this commit until main advances. | -| Open pull requests | **131** | Queue increased from 130 when #484 appeared while #435 remained open; WIP circuit breaker is active. | -| Draft pull requests | **130** | Draft work must be consolidated/repaired rather than independently landed. | -| Non-Draft pull requests | **1** | #480 remains the only non-Draft PR and is still non-deployable without a compatible immutable contextual-orchestrator release. | -| Open issues | **16** | Includes ADR normalization, orchestrator admission, and dynamic-evaluation drift design/evidence work. | +| Open pull requests | **131** | WIP circuit breaker remains active. | +| Draft pull requests | **130** | Draft work must consolidate/repair rather than independently land. | +| Non-Draft pull requests | **1** | #480 is the only non-Draft PR and is not deployable without a compatible immutable contextual-orchestrator release. | +| Open issues | **16** | Includes ADR normalization, orchestrator admission, and dynamic-evaluation drift evidence work. | | GitHub releases | **0** | No TEPP open head is a released contract. | | Organization ruleset | `18156473` | One qualifying current-head approval, stale-review dismissal after push, resolved threads, unattributed-change approval where applicable, and central required workflows. | -The queue rose from **130 to 131** because #484 `summarizes_edge_v1` was opened as another Analysis Run profile against `main`. Its changed files overlap the existing Analysis Run landing surfaces (`Cargo.lock`, `crates/analysis_engine/Cargo.toml`, `crates/analysis_engine/src/lib.rs`, TRACEABILITY/ADR/doctoring). It is therefore non-destructively retargeted to #416 rather than treated as an independent landing authority. The resulting conflict is real shared-file fold work; unique source/tests/doctoring and RED/repair evidence must survive into the eventual #416 head. The PR is not closed merely to reduce the count. +#484 `summarizes_edge_v1` is a #416 Analysis Run fold child, not an independent bounded-context landing authority. Its unique source/tests/doctoring must survive the eventual shared-file fold; it is not closed merely to reduce queue count. ## Priority landing evidence -This is a priority subset, not a row-for-row copy of the 131-PR queue. #435 intentionally omits its own SHA from this file because embedding a branch head inside a file changed by the same branch would make the file self-stale. +#435 intentionally omits its own SHA from this file because embedding a branch head inside a file changed by that branch makes the file self-stale. -| PR | Exact head | Draft | Base | Ownership / disposition | -| ---: | --- | :---: | --- | --- | -| #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 branch @ `0b7155cc238defb1e55129ff3000658f04b343cf` | `summarizes_edge_v1` fold child; future-unavailable evidence is filtered before duplicate-identity admission. | -| #483 | `847d96f913bb261803ac0bd751ad7e4f51324cee` | true | #416 branch @ `0b7155cc238defb1e55129ff3000658f04b343cf` | `retrospective_edge_v1` fold child; unique tests/doctoring must survive. | -| #482 | `506dbae236a4484301b704b6c6a05b20faf0fe69` | true | #416 branch @ `0b7155cc238defb1e55129ff3000658f04b343cf` | `role_contradiction_v1` fold child; unique tests/doctoring must survive. | -| #480 | `4475542750eda01afad0cf9ea8d563f508f63fd3` | false | main | Independent consumer-side LLM-governance repair; requires released CO + HTTPS `orchestrator/free`, deployment provenance and safe gateway auth. | -| #460 | `dfab4eab5ff733731e565a9348072b8dab2e4912` | true | #416 branch @ `0b7155cc238defb1e55129ff3000658f04b343cf` | `relation_absence_v1` fold child; typed cutoff equality and terminal validation separation preserved. | -| #458 | `08165e3b3c929b4ae77396689549f72723ff8ff5` | true | #416 branch @ `0b7155cc238defb1e55129ff3000658f04b343cf` | `outcome_order_v1` fold child; typed cutoff equality and terminal validation separation preserved. | -| #416 | `0b7155cc238defb1e55129ff3000658f04b343cf` | true | main | Validation / Analysis Run landing candidate; availability cutoff precedes duplicate-identity admission. | -| #310 | `75306b2445b071fa1c3201f5dd31a8c1eba08383` | true | main | Longitudinal Modeling vehicle; current tree preserves stable CWC/within-between means, overflow-safe known-truth RMSE, and one externally reachable irregular-rate facade. | +| PR | Exact head | Draft | Ownership / disposition | +| ---: | --- | :---: | --- | +| #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 Analysis Run fold child. | +| #483 | `847d96f913bb261803ac0bd751ad7e4f51324cee` | true | #416 Analysis Run fold child. | +| #482 | `506dbae236a4484301b704b6c6a05b20faf0fe69` | true | #416 Analysis Run fold child. | +| #480 | `4475542750eda01afad0cf9ea8d563f508f63fd3` | false | Independent consumer-side LLM-governance repair; requires released CO plus deployment/auth provenance. | +| #460 | `dfab4eab5ff733731e565a9348072b8dab2e4912` | true | #416 fold child; typed cutoff equality and terminal validation separation preserved. | +| #458 | `08165e3b3c929b4ae77396689549f72723ff8ff5` | true | #416 fold child; typed cutoff equality and terminal validation separation preserved. | +| #416 | `0b7155cc238defb1e55129ff3000658f04b343cf` | true | Validation / Analysis Run landing candidate; availability cutoff precedes duplicate-identity admission. | +| #310 | `440ac6902d86dce48fedd1229ac71ab8c133bdf0` | true | Longitudinal Modeling vehicle; nonzero irregular-rate underflow now fails closed while exact no-change remains zero. | -Exact-head evidence becomes stale after source mutation or any new commit, even when a later commit restores byte-equivalent files. +Exact-head evidence becomes stale after source mutation or any new commit. ## Domain ownership -Cargo crates, HTTP routes, CLI verbs, refusal rules, clocks, and individual statistical maps are implementation units rather than bounded contexts. - -| Subdomain | Bounded context | Aggregate authority | Implementation nucleus | -| --- | --- | --- | --- | -| Core | Evidence & Semantic Measurement | `EvidenceCorpus`, `SemanticUnitSet`, `ConceptDictionaryRevision` | `evidence_core`, `semantic_core` | -| Core | Temporal Semantics | `TemporalEvidenceWindow`, `KnowledgeCutoffPolicy` | temporal primitives and cutoff policy | -| Core | Event Ontology & Temporal Graph | `EventEpisode`, `TemporalRelationSet` | `event_core`, `relation_graph` | -| Core | Measurement | `MeasurementSpecification`, `MeasurementRun` | measurement modules + released fast-mlsirm ACL | -| Core | Longitudinal Modeling | `TemporalModelSpecification`, `TemporalModelRun` | `longitudinal_core` + temporal/event composition | -| Core | Validation Evidence | `ValidationStudy`, `ValidationEvidence` | `validation_core`, `tepp_simulation` | -| Core | Scientific Claim Promotion | `ClaimPromotionDecision` | validation evidence + ADR 0014 policy | -| Supporting | Projection / Analysis Run | `AnalysisRun`, published read models | application services; HTTP/CLI adapters | -| Supporting | Interpretation | evidence-grounded interpretation workflow | contextual-orchestrator ACL only | -| Supporting | Persistence & Recovery | repositories and durable receipts | persistence/object-store adapters | -| Generic | Compute backend | execution receipt | CPU/GPU/MLX adapters; execution is not scientific authority | - -fast-mlsirm owns reusable static/generalized-mixed/dependence-aware psychometric specification and arithmetic, including LSIRM/MLSIRM/DLSJM kernels. TEPP owns temporal/event composition, irregular time, time-varying multilevel/cross-classified/multiple-membership semantics, longitudinal invariance/drift/alignment and temporal recovery. contextual-orchestrator owns provider/model routing and semantic LLM execution. Context Graph contracts are contract-only integration authority; EA Core owns enterprise-architecture decisions. No source copying, mutable sibling dependency, or cross-service SQL. +TEPP owns temporal/event composition, irregular time, time-varying multilevel/cross-classified/multiple-membership semantics, longitudinal invariance/drift/alignment, leakage-safe knowledge cutoff, temporal recovery and projection policy. fast-mlsirm owns reusable static/generalized-mixed/dependence-aware psychometric specification and arithmetic, including LSIRM/MLSIRM/DLSJM kernels. contextual-orchestrator owns provider/model routing and semantic LLM execution. Context Graph contracts are contract-only integration authority; EA Core owns enterprise-architecture decisions. No source copying, mutable sibling dependency, or cross-service SQL. The clock contract separates event/valid time, assertion time, document time, system time, available time, and knowledge cutoff. Retrospective evidence may describe an earlier event but cannot enter an earlier knowledge cutoff. Forward state/transition edges remain distinct from retrospective/citation/revision/provenance relations. @@ -84,37 +68,31 @@ The clock contract separates event/valid time, assertion time, document time, sy Closed predecessor #441 is contained by #310. The invalid covariance/earlier-variance quantity is not exposed as autocorrelation; lagged Pearson correlation requires lagged covariance and both occasion-specific marginal variances. Temporal/state composition is owned by `longitudinal_core`. -Current head `75306b2445b071fa1c3201f5dd31a8c1eba08383` has the same file tree as `8111b58ac3374ae26b159868ce002d755e9e7d9e`; GitHub compare reports two commits and zero changed files. The two commits record verification of a review suggestion that the canonical irregular-rate functions should be syntactically `pub(crate)`: because `lib.rs` keeps `mod irregular_residual;` private and exposes the recover operations only through `stable_irregular_rate`, plain `pub fn` inside that private module does not create a second externally reachable crate API. An exploratory syntax assertion was therefore removed rather than turning an internal spelling preference into a false architecture invariant. The facade continues to delegate to one canonical numerical implementation. - -CWC RED `9a706c3c0e9e0db68e88f89b94c64c13ea7fafd0` fixes `[0.75·MAX, 0.75·MAX, -0.5·MAX]`, whose raw partial sum overflows although the centered result is representable. Repair `260413efb9d95039b5fbba41919cba8097fcf8b5` routes CWC means through the Longitudinal Modeling stable compensated mean rather than adding a second arithmetic authority. +Current head `440ac6902d86dce48fedd1229ac71ab8c133bdf0` adds a fail-closed contract for an irregular residual log-rate that is mathematically nonzero but smaller than binary64 can represent after division by an extreme positive event interval. RED `4d1031092388f6237d99fe29149c9fbccf453d1c` uses `earlier=1.0`, the next representable `later`, and `Δt=f64::MAX`; predecessor source returned `Ok(0.0)`, conflating nonrepresentable change with exact no-change. Repair `021130aa09584c56d77c91a2b090c34da4a484b9` rejects represented zero when residual magnitudes differ. Edge coverage `440ac6902d86dce48fedd1229ac71ab8c133bdf0` proves equal residual magnitudes still return exact zero. -Known-truth `component_root_mean_square_error` originally formed raw `decided - truth` before its scaled sum-of-squares path. RED `d72ba2b6e28909c6def73a2638ebd63258dec500` pins four matched components with one mathematical `2·MAX` residual and three zero residuals: the aggregate RMSE is representable `MAX`, but the predecessor rejected it because the individual subtraction overflowed. Initial repair `406e6ae2b2a8fd99494e9bc82e61ced9b81bffe0` removed that intermediate overflow, but RED `dd0718e5d1b91baccc7efa4d196825c9119cd8e7` caught a precision regression for `[MAX→MAX, 0→1]`. Corrective repair `312dbcd25a7246683d5596385571068d475fc4c3` keeps direct finite residual subtraction and scales only actually overflowing differences. +Earlier numerical lineages remain active: CWC RED `9a706c3c0e9e0db68e88f89b94c64c13ea7fafd0` / repair `260413efb9d95039b5fbba41919cba8097fcf8b5`; known-truth RMSE overflow/precision repair ending at `312dbcd25a7246683d5596385571068d475fc4c3`; within/between stable-mean repair `6bf3661bf390e0de00e1bb83539e6d62ee06b85f`; stationary-variance fallback `(q * 0.5) / |a|`; and two-marginal lagged Pearson correlation with covariance-bound admission. -`decompose_within_between` also retained a raw `sum / n` mean after CWC was stabilized. RED `1292fdc77b810dedf3d75b836744ac9ce8611014` pins a valid unit with `[MAX, MAX]`; repair `6bf3661bf390e0de00e1bb83539e6d62ee06b85f` uses magnitude-normalized Neumaier accumulation and rejects only a non-representable resulting mean/residual. - -The current exact head must reacquire hosted evidence from scratch. Any workflow/review result on `8111b58...` or earlier is historical even though the final file tree is equal. There is no qualifying current-head independent `APPROVED` review. No merge is authorized until all central required workflows are exact-head passing. +The current head is mergeable but remains Draft. CodeQL PR ends as `startup_failure` before any job is materialized; Rust Foundation CI, Security Scan, Documentation Quality, SAST Semgrep, Scorecard and OSV are queued/pending. There is no qualifying current-head independent approval. No merge is authorized until current ruleset evidence passes. ### #416 — Validation / Analysis Run consolidation -Current head `0b7155cc238defb1e55129ff3000658f04b343cf` centralizes the leakage-safe invariant established by RED `ffee655404716bf8d33c898a3c1a87a543abe701`: availability filtering occurs before duplicate-identity admission. #458/#460/#482/#483/#484 are comparison/fold children over shared Cargo/lib/lock/docs surfaces. Their unique evidence must be merged into a surviving #416 head before any child can be considered fully superseded. +Current head `0b7155cc238defb1e55129ff3000658f04b343cf` centralizes the leakage-safe invariant established by RED `ffee655404716bf8d33c898a3c1a87a543abe701`: availability filtering occurs before duplicate-identity admission. #458/#460/#482/#483/#484 remain fold children over shared Cargo/lib/lock/docs surfaces. Their unique evidence must reach a surviving #416 head before any child can be considered fully superseded. -### #480 / #479 — LLM owner boundary +### #480 / #479 — contextual-orchestrator boundary -#480 removes TEPP-owned provider discovery/ranking and requires HTTPS `contextual-orchestrator/orchestrator/free` from an immutable owner release. contextual-orchestrator protected `main@212ff437dc297613289dba2e6064ade9942e07d8` has advanced since earlier snapshots but still has **zero GitHub releases**. The branch movement is mutable owner state, not a released contract. The consumer remains deliberately non-deployable; do not fall back to mutable source, direct provider calls, or guessed checksums. +#480 removes TEPP-owned provider discovery/ranking and requires HTTPS `contextual-orchestrator/orchestrator/free` from an immutable owner release. contextual-orchestrator protected `main@212ff437dc297613289dba2e6064ade9942e07d8` has **zero GitHub releases**. Mutable branch state is not a released contract. The consumer remains deliberately fail-closed. -### #315 / fast-mlsirm owner handoff +### fast-mlsirm owner handoff -TEPP-specific static-standardisation lineage must not become a second reusable arithmetic authority. fast-mlsirm protected `main@b5a3a0c1057d4b53d7a4bb18e0de69f630c2b45c`; generalized-mixed/dependence compiler #1714 is Ready/mergeable at `92a3f2152033b61ca89661b5ba8a584842e8c3a9`. Latest immutable release is `v0.9.1` (2026-08-26), which predates #1714. TEPP may adopt the new Published Language only after a compatible immutable release and ACL/parity evidence. Open #1714 remains candidate owner evidence, not a released dependency. +fast-mlsirm protected `main@b5a3a0c1057d4b53d7a4bb18e0de69f630c2b45c`; generalized-mixed/dependence compiler #1714 remains Ready/mergeable at `92a3f2152033b61ca89661b5ba8a584842e8c3a9`. Immutable `v0.9.1` predates #1714. Exact #1714 CI is pending/queued and CodeQL PR is startup-failed. TEPP does not consume the new Published Language until a compatible immutable release and ACL/parity evidence exist. ### #437 — ADR identity -Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/numbered files, index/file mismatch and repeated Decision-status or Implementation-maturity authority must fail deterministic documentation fitness. Adapter/model micro-slice ADR numbers remain implementation lineage pending normalization through #435, not branch-local architecture authority. +Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/numbered files, index/file mismatch and repeated Decision-status or Implementation-maturity authority must fail deterministic documentation fitness. Adapter/model micro-slice ADR numbers remain implementation lineage pending normalization through #435. ## External contract state -`context-graph-contracts` protected/default `develop@99cb5468ba3c15c5e79688f53dee74724fae2d13` has **14 open PRs, 2 open issues, and zero GitHub releases**. Its release-source/provenance work remains Draft/unreleased evidence. `enterprise-architecture-core` protected/default `develop@1c0fa8b15ceb9e72186274aeb255d6777eb84ef4` has **24 open PRs, 2 open issues, and zero releases**. Both remain read-only from this TEPP writer; open heads are candidate evidence rather than production contracts. TEPP deployable integration and authoritative EA projection require released/versioned contract artifacts plus compatibility/provenance evidence. - -TEPP latent estimates, measurement scores, inferred event relations and validity evidence are not authoritative EA facts. +`context-graph-contracts` protected/default `develop@99cb5468ba3c15c5e79688f53dee74724fae2d13` has **14 open PRs, 2 open issues, and zero releases**. `enterprise-architecture-core` protected/default `develop@1c0fa8b15ceb9e72186274aeb255d6777eb84ef4` has **24 open PRs, 2 open issues, and zero releases**. Both remain read-only from this TEPP writer; open heads are candidate evidence rather than production contracts. ## Gap register From 33d7ffc59b47a8a60835d20052f3d9031ba399e2 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 3 Sep 2026 01:14:35 +0900 Subject: [PATCH 097/235] fix(docs): restore canonical priority-inventory contract --- docs/product-technical-gap-baseline.md | 28 +++++++++++++------------- 1 file changed, 14 insertions(+), 14 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 5ddcea93c..3d82e94da 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,7 +4,7 @@ **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-02T16:06Z +**Snapshot:** 2026-09-02T16:13Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` @@ -30,22 +30,22 @@ A planning document, mergeable branch, local test, predecessor-head result, queu #484 `summarizes_edge_v1` is a #416 Analysis Run fold child, not an independent bounded-context landing authority. Its unique source/tests/doctoring must survive the eventual shared-file fold; it is not closed merely to reduce queue count. -## Priority landing evidence +## Current priority open pull-request evidence #435 intentionally omits its own SHA from this file because embedding a branch head inside a file changed by that branch makes the file self-stale. -| PR | Exact head | Draft | Ownership / disposition | -| ---: | --- | :---: | --- | -| #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 Analysis Run fold child. | -| #483 | `847d96f913bb261803ac0bd751ad7e4f51324cee` | true | #416 Analysis Run fold child. | -| #482 | `506dbae236a4484301b704b6c6a05b20faf0fe69` | true | #416 Analysis Run fold child. | -| #480 | `4475542750eda01afad0cf9ea8d563f508f63fd3` | false | Independent consumer-side LLM-governance repair; requires released CO plus deployment/auth provenance. | -| #460 | `dfab4eab5ff733731e565a9348072b8dab2e4912` | true | #416 fold child; typed cutoff equality and terminal validation separation preserved. | -| #458 | `08165e3b3c929b4ae77396689549f72723ff8ff5` | true | #416 fold child; typed cutoff equality and terminal validation separation preserved. | -| #416 | `0b7155cc238defb1e55129ff3000658f04b343cf` | true | Validation / Analysis Run landing candidate; availability cutoff precedes duplicate-identity admission. | -| #310 | `440ac6902d86dce48fedd1229ac71ab8c133bdf0` | true | Longitudinal Modeling vehicle; nonzero irregular-rate underflow now fails closed while exact no-change remains zero. | - -Exact-head evidence becomes stale after source mutation or any new commit. +| PR | Exact current head | Draft | Base | Disposition | +| ---: | --- | :---: | --- | --- | +| #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 `feat/copy-identity-analysis-run-gap-004@0b7155cc238defb1e55129ff3000658f04b343cf` | Analysis Run fold child; preserve profile-specific source/tests/doctoring. | +| #483 | `847d96f913bb261803ac0bd751ad7e4f51324cee` | true | #416 `feat/copy-identity-analysis-run-gap-004@0b7155cc238defb1e55129ff3000658f04b343cf` | Analysis Run fold child; preserve unique evidence. | +| #482 | `506dbae236a4484301b704b6c6a05b20faf0fe69` | true | #416 `feat/copy-identity-analysis-run-gap-004@0b7155cc238defb1e55129ff3000658f04b343cf` | Analysis Run fold child; preserve unique evidence. | +| #480 | `4475542750eda01afad0cf9ea8d563f508f63fd3` | false | `main@1bc02f580cf48e1d39da239f0e818453437c31c3` | Independent consumer-side LLM-governance repair; released CO plus deployment/auth provenance required. | +| #460 | `dfab4eab5ff733731e565a9348072b8dab2e4912` | true | #416 `feat/copy-identity-analysis-run-gap-004@0b7155cc238defb1e55129ff3000658f04b343cf` | Fold child; typed cutoff equality and terminal validation separation preserved. | +| #458 | `08165e3b3c929b4ae77396689549f72723ff8ff5` | true | #416 `feat/copy-identity-analysis-run-gap-004@0b7155cc238defb1e55129ff3000658f04b343cf` | Fold child; typed cutoff equality and terminal validation separation preserved. | +| #416 | `0b7155cc238defb1e55129ff3000658f04b343cf` | true | `main@1bc02f580cf48e1d39da239f0e818453437c31c3` | Validation / Analysis Run landing candidate; availability cutoff precedes duplicate-identity admission. | +| #310 | `440ac6902d86dce48fedd1229ac71ab8c133bdf0` | true | `main@1bc02f580cf48e1d39da239f0e818453437c31c3` | Longitudinal Modeling vehicle; nonzero irregular-rate underflow fails closed while exact no-change remains zero. | + +Exact-current-head evidence becomes stale after source mutation or any new commit. ## Domain ownership From c81e3388a30c0daefd2af03dc0466774914a3b9e Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 3 Sep 2026 02:09:55 +0900 Subject: [PATCH 098/235] docs: refresh queue and longitudinal recovery evidence --- docs/product-technical-gap-baseline.md | 37 +++++++++++++++----------- 1 file changed, 21 insertions(+), 16 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 3d82e94da..8ab311f49 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,7 +4,7 @@ **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-02T16:13Z +**Snapshot:** 2026-09-02T17:10:00Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` @@ -24,11 +24,11 @@ A planning document, mergeable branch, local test, predecessor-head result, queu | Open pull requests | **131** | WIP circuit breaker remains active. | | Draft pull requests | **130** | Draft work must consolidate/repair rather than independently land. | | Non-Draft pull requests | **1** | #480 is the only non-Draft PR and is not deployable without a compatible immutable contextual-orchestrator release. | -| Open issues | **16** | Includes ADR normalization, orchestrator admission, and dynamic-evaluation drift evidence work. | +| Open issues | **16** | ADR normalization, orchestration admission, evaluation drift and scientific recovery work remain open. | | GitHub releases | **0** | No TEPP open head is a released contract. | | Organization ruleset | `18156473` | One qualifying current-head approval, stale-review dismissal after push, resolved threads, unattributed-change approval where applicable, and central required workflows. | -#484 `summarizes_edge_v1` is a #416 Analysis Run fold child, not an independent bounded-context landing authority. Its unique source/tests/doctoring must survive the eventual shared-file fold; it is not closed merely to reduce queue count. +#484 `summarizes_edge_v1` remains a #416 Analysis Run fold child. Its unique source/tests/doctoring must survive the shared-file fold; it is not closed merely to reduce queue count. ## Current priority open pull-request evidence @@ -40,16 +40,16 @@ A planning document, mergeable branch, local test, predecessor-head result, queu | #483 | `847d96f913bb261803ac0bd751ad7e4f51324cee` | true | #416 `feat/copy-identity-analysis-run-gap-004@0b7155cc238defb1e55129ff3000658f04b343cf` | Analysis Run fold child; preserve unique evidence. | | #482 | `506dbae236a4484301b704b6c6a05b20faf0fe69` | true | #416 `feat/copy-identity-analysis-run-gap-004@0b7155cc238defb1e55129ff3000658f04b343cf` | Analysis Run fold child; preserve unique evidence. | | #480 | `4475542750eda01afad0cf9ea8d563f508f63fd3` | false | `main@1bc02f580cf48e1d39da239f0e818453437c31c3` | Independent consumer-side LLM-governance repair; released CO plus deployment/auth provenance required. | -| #460 | `dfab4eab5ff733731e565a9348072b8dab2e4912` | true | #416 `feat/copy-identity-analysis-run-gap-004@0b7155cc238defb1e55129ff3000658f04b343cf` | Fold child; typed cutoff equality and terminal validation separation preserved. | -| #458 | `08165e3b3c929b4ae77396689549f72723ff8ff5` | true | #416 `feat/copy-identity-analysis-run-gap-004@0b7155cc238defb1e55129ff3000658f04b343cf` | Fold child; typed cutoff equality and terminal validation separation preserved. | +| #460 | `dfab4eab5ff733731e565a9348072b8dab2e4912` | true | #416 `feat/copy-identity-analysis-run-gap-004@0b7155cc238defb1e55129ff3000658f04b343cf` | Fold child; typed cutoff equality and terminal-validation separation preserved. | +| #458 | `08165e3b3c929b4ae77396689549f72723ff8ff5` | true | #416 `feat/copy-identity-analysis-run-gap-004@0b7155cc238defb1e55129ff3000658f04b343cf` | Fold child; typed cutoff equality and terminal-validation separation preserved. | | #416 | `0b7155cc238defb1e55129ff3000658f04b343cf` | true | `main@1bc02f580cf48e1d39da239f0e818453437c31c3` | Validation / Analysis Run landing candidate; availability cutoff precedes duplicate-identity admission. | -| #310 | `440ac6902d86dce48fedd1229ac71ab8c133bdf0` | true | `main@1bc02f580cf48e1d39da239f0e818453437c31c3` | Longitudinal Modeling vehicle; nonzero irregular-rate underflow fails closed while exact no-change remains zero. | +| #310 | `bd7191cf176c9e68e450757294086429cd880b09` | true | `main@1bc02f580cf48e1d39da239f0e818453437c31c3` | Longitudinal Modeling vehicle; subnormal unit means survive extreme cancellation without fail-open arithmetic. | Exact-current-head evidence becomes stale after source mutation or any new commit. ## Domain ownership -TEPP owns temporal/event composition, irregular time, time-varying multilevel/cross-classified/multiple-membership semantics, longitudinal invariance/drift/alignment, leakage-safe knowledge cutoff, temporal recovery and projection policy. fast-mlsirm owns reusable static/generalized-mixed/dependence-aware psychometric specification and arithmetic, including LSIRM/MLSIRM/DLSJM kernels. contextual-orchestrator owns provider/model routing and semantic LLM execution. Context Graph contracts are contract-only integration authority; EA Core owns enterprise-architecture decisions. No source copying, mutable sibling dependency, or cross-service SQL. +TEPP owns temporal/event composition, irregular time, time-varying multilevel/cross-classified/multiple-membership semantics, longitudinal invariance/drift/alignment, leakage-safe knowledge cutoff, temporal recovery and projection policy. fast-mlsirm owns reusable static/generalized-mixed/dependence-aware psychometric specification and arithmetic, including covariance-to-correlation standardization and LSIRM/MLSIRM/DLSJM kernels. contextual-orchestrator owns provider/model routing and semantic LLM execution. Context Graph contracts are contract-only integration authority; EA Core owns enterprise-architecture decisions. No source copying, mutable sibling dependency, or cross-service SQL. The clock contract separates event/valid time, assertion time, document time, system time, available time, and knowledge cutoff. Retrospective evidence may describe an earlier event but cannot enter an earlier knowledge cutoff. Forward state/transition edges remain distinct from retrospective/citation/revision/provenance relations. @@ -68,11 +68,13 @@ The clock contract separates event/valid time, assertion time, document time, sy Closed predecessor #441 is contained by #310. The invalid covariance/earlier-variance quantity is not exposed as autocorrelation; lagged Pearson correlation requires lagged covariance and both occasion-specific marginal variances. Temporal/state composition is owned by `longitudinal_core`. -Current head `440ac6902d86dce48fedd1229ac71ab8c133bdf0` adds a fail-closed contract for an irregular residual log-rate that is mathematically nonzero but smaller than binary64 can represent after division by an extreme positive event interval. RED `4d1031092388f6237d99fe29149c9fbccf453d1c` uses `earlier=1.0`, the next representable `later`, and `Δt=f64::MAX`; predecessor source returned `Ok(0.0)`, conflating nonrepresentable change with exact no-change. Repair `021130aa09584c56d77c91a2b090c34da4a484b9` rejects represented zero when residual magnitudes differ. Edge coverage `440ac6902d86dce48fedd1229ac71ab8c133bdf0` proves equal residual magnitudes still return exact zero. +Current head `bd7191cf176c9e68e450757294086429cd880b09` repairs a second extreme-value mean defect in within/between decomposition. RED `0544def0f7e39ab50e6de963ec4332ca6ccf01f4` uses one unit with scores `[f64::MAX, -f64::MAX, 4*min_subnormal]`; its representable binary64 mean is `min_subnormal`, while the predecessor max-scale normalization erased the low-order term. The repair cancels opposite-sign extremes before averaging retained same-sign mass and restores original sample-count weighting without pre-scaling. Same-sign means remain bounded and non-representable final means/residuals still fail closed. -Earlier numerical lineages remain active: CWC RED `9a706c3c0e9e0db68e88f89b94c64c13ea7fafd0` / repair `260413efb9d95039b5fbba41919cba8097fcf8b5`; known-truth RMSE overflow/precision repair ending at `312dbcd25a7246683d5596385571068d475fc4c3`; within/between stable-mean repair `6bf3661bf390e0de00e1bb83539e6d62ee06b85f`; stationary-variance fallback `(q * 0.5) / |a|`; and two-marginal lagged Pearson correlation with covariance-bound admission. +Earlier active numerical lineages include CWC RED `9a706c3c0e9e0db68e88f89b94c64c13ea7fafd0` / repair `260413efb9d95039b5fbba41919cba8097fcf8b5`, known-truth RMSE overflow/precision repair, stationary fallback `(q * 0.5) / |a|`, irregular-rate zero-underflow refusal, and two-marginal lagged Pearson correlation with represented covariance-bound admission. -The current head is mergeable but remains Draft. CodeQL PR ends as `startup_failure` before any job is materialized; Rust Foundation CI, Security Scan, Documentation Quality, SAST Semgrep, Scorecard and OSV are queued/pending. There is no qualifying current-head independent approval. No merge is authorized until current ruleset evidence passes. +The current head is mergeable but remains Draft. Exact-head CodeQL PR is `startup_failure`; Rust Foundation CI, Security Scan, Documentation Quality, SAST Semgrep, Scorecard and OSV are queued. There is no qualifying current-head independent approval. No merge is authorized until the live ruleset passes. + +The CWC and within/between unit-mean helpers now agree on the material extreme-cancellation behavior but are still separate implementations. Consolidation remains a maintainability target only after their full error/estimand semantics are shown equivalent; a reusable domain-neutral arithmetic primitive belongs in fast-mlsirm rather than being copied across TEPP contexts. ### #416 — Validation / Analysis Run consolidation @@ -80,11 +82,13 @@ Current head `0b7155cc238defb1e55129ff3000658f04b343cf` centralizes the leakage- ### #480 / #479 — contextual-orchestrator boundary -#480 removes TEPP-owned provider discovery/ranking and requires HTTPS `contextual-orchestrator/orchestrator/free` from an immutable owner release. contextual-orchestrator protected `main@212ff437dc297613289dba2e6064ade9942e07d8` has **zero GitHub releases**. Mutable branch state is not a released contract. The consumer remains deliberately fail-closed. +#480 removes TEPP-owned provider discovery/ranking and requires HTTPS `contextual-orchestrator/orchestrator/free` from an immutable owner release. contextual-orchestrator protected `main@212ff437dc297613289dba2e6064ade9942e07d8` has **zero GitHub releases**. Mutable branch state is not a released contract. The consumer remains deliberately fail-closed. Deployment identity must be bound to the selected immutable release and model-controlled execution must not receive a reusable long-lived gateway credential. ### fast-mlsirm owner handoff -fast-mlsirm protected `main@b5a3a0c1057d4b53d7a4bb18e0de69f630c2b45c`; generalized-mixed/dependence compiler #1714 remains Ready/mergeable at `92a3f2152033b61ca89661b5ba8a584842e8c3a9`. Immutable `v0.9.1` predates #1714. Exact #1714 CI is pending/queued and CodeQL PR is startup-failed. TEPP does not consume the new Published Language until a compatible immutable release and ACL/parity evidence exist. +fast-mlsirm protected `main@b5a3a0c1057d4b53d7a4bb18e0de69f630c2b45c`. Immutable `v0.9.1` predates the current owner work. + +Generalized-mixed/dependence Published Language remains unreleased. Reusable static covariance-to-correlation standardization is now independently represented by fast-mlsirm #1722 at `338dbb2d25f32b0e201102e7bf73076846fb57b3`, contract `fast_mlsirm.covariance_standardization@1.0.0`. Its current source/review findings are repaired, but CI is pending/queued and CodeQL PR is startup-failed; TEPP therefore does not consume that mutable PR head. Temporal/EventTime admission and state composition remain TEPP-owned. ### #437 — ADR identity @@ -92,14 +96,14 @@ Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/num ## External contract state -`context-graph-contracts` protected/default `develop@99cb5468ba3c15c5e79688f53dee74724fae2d13` has **14 open PRs, 2 open issues, and zero releases**. `enterprise-architecture-core` protected/default `develop@1c0fa8b15ceb9e72186274aeb255d6777eb84ef4` has **24 open PRs, 2 open issues, and zero releases**. Both remain read-only from this TEPP writer; open heads are candidate evidence rather than production contracts. +`context-graph-contracts` and `enterprise-architecture-core` remain read-only from this TEPP writer. Their open heads are candidate evidence rather than production contracts. Exact branch/count/release observations are refreshed each run and must not be promoted into deployable TEPP integration without a released version and conformance evidence. ## Gap register | ID | Gap | Maturity | Closure evidence | | --- | --- | --- | --- | | GAP-001 | PR authority fragmented across 131 open PRs | `release-blocking` | coherent landing vehicles, unique-evidence preservation, protected-main reduction | -| GAP-002 | multilingual span-grounded semantic/concept admission | `partial` | immutable offsets/layout, language profiles, concept dictionary, invariance/calibration, hostile-input tests | +| GAP-002 | multilingual span-grounded semantic/concept admission | `partial` | immutable offsets/layout, KO/EN/JA/ZH/VI/ES/DE/FR profiles, concept dictionary, invariance/calibration, hostile-input tests | | GAP-003 | shared-latent temporal topic estimator | `partial` | Rust CPU f64 likelihood/uncertainty, relation/time/membership effects, true recovery, fitted candidate-K | | GAP-004 | durable end-to-end Analysis Run | `partial` | idempotent lifecycle, persistence/recovery, estimator-bound artifacts, validation/promotion separation, Compose E2E | | GAP-005 | temporal psychometric composition/duplication | `partial` | released fast-mlsirm contracts, TEPP ACLs, temporal recovery, wrong-owner static kernels removed after parity | @@ -107,14 +111,15 @@ Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/num | GAP-007 | accelerator/memory evidence | `accepted-target` | real hardware, CPU-f64 parity, bounded OOM/fallback evidence | | GAP-008 | network/cluster buyer workflow | `partial` | known-truth recovery, uncertainty/stability, repeated consensus, exact-value export | | GAP-009 | production interpreter/verifier | `partial` | released contextual-orchestrator execution, evidence citations, independent verification, abstention/fallback | -| GAP-010 | accessible buyer UI | `accepted-target` | Figma/Storybook, keyboard/touch/error/empty states, exact-value provenance | +| GAP-010 | accessible buyer UI | `accepted-target` | Figma/Storybook, locale-specific CJK/text expansion/font fallback, keyboard/touch/loading/empty/error/permission states, exact-value provenance | | GAP-011 | operable multi-tenant release | `accepted-target` | OIDC/RLS/purpose controls, durable queue/storage, OTel/SLO, restore/load/migration, signed SBOM/provenance | | GAP-012 | paths obscure domain ownership | `active-refactor` | staged moves, ACLs, no cycles/cross-context persistence/shared-kernel creep | | GAP-013 | ADR identity collisions | `release-integrity` | unique repository-wide identity, deterministic duplicate detection, supersession lineage | | GAP-014 | current required-workflow startup/runner evidence unavailable | `external-control-risk` | central workflow repair, exact-current required workflows GREEN, no bypass | -| GAP-015 | contextual-orchestrator has no immutable released contract for current owner behavior | `release-blocking` | compatible immutable CO release, deployment provenance, safe gateway auth, exact TEPP ACL adoption | +| GAP-015 | contextual-orchestrator lacks immutable released contract for current owner behavior | `release-blocking` | compatible immutable CO release, deployment provenance, safe gateway auth, exact TEPP ACL adoption | | GAP-016 | hourly LLM path needs released owner-only routing/authentication | `active-repair` | #480 + released CO adoption + exact-head GREEN/review/main merge | | GAP-017 | dynamic evaluation item/rater/anchor drift monitoring | `blocked-external-design` | released/digest-pinned owner contracts, ACL conformance, no-anchor/no-linking refusal, evidence-gated temporal monitoring | +| GAP-018 | Longitudinal stable-mean logic remains duplicated | `active-refactor` | semantic-equivalence proof, one TEPP Longitudinal primitive or released fast-mlsirm generic owner contract, recovery parity | ## Release gate From d6b085399f4b5825288c16c0517a33965192eae6 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 3 Sep 2026 02:16:17 +0900 Subject: [PATCH 099/235] docs: record longitudinal instruction drift blocker --- docs/product-technical-gap-baseline.md | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 8ab311f49..221166146 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,7 +4,7 @@ **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-02T17:10:00Z +**Snapshot:** 2026-09-02T17:16:00Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` @@ -43,7 +43,7 @@ A planning document, mergeable branch, local test, predecessor-head result, queu | #460 | `dfab4eab5ff733731e565a9348072b8dab2e4912` | true | #416 `feat/copy-identity-analysis-run-gap-004@0b7155cc238defb1e55129ff3000658f04b343cf` | Fold child; typed cutoff equality and terminal-validation separation preserved. | | #458 | `08165e3b3c929b4ae77396689549f72723ff8ff5` | true | #416 `feat/copy-identity-analysis-run-gap-004@0b7155cc238defb1e55129ff3000658f04b343cf` | Fold child; typed cutoff equality and terminal-validation separation preserved. | | #416 | `0b7155cc238defb1e55129ff3000658f04b343cf` | true | `main@1bc02f580cf48e1d39da239f0e818453437c31c3` | Validation / Analysis Run landing candidate; availability cutoff precedes duplicate-identity admission. | -| #310 | `bd7191cf176c9e68e450757294086429cd880b09` | true | `main@1bc02f580cf48e1d39da239f0e818453437c31c3` | Longitudinal Modeling vehicle; subnormal unit means survive extreme cancellation without fail-open arithmetic. | +| #310 | `bd7191cf176c9e68e450757294086429cd880b09` | true | `main@1bc02f580cf48e1d39da239f0e818453437c31c3` | Longitudinal Modeling vehicle; subnormal unit means survive extreme cancellation; scientific docs still need stationary-fallback synchronization. | Exact-current-head evidence becomes stale after source mutation or any new commit. @@ -72,6 +72,8 @@ Current head `bd7191cf176c9e68e450757294086429cd880b09` repairs a second extreme Earlier active numerical lineages include CWC RED `9a706c3c0e9e0db68e88f89b94c64c13ea7fafd0` / repair `260413efb9d95039b5fbba41919cba8097fcf8b5`, known-truth RMSE overflow/precision repair, stationary fallback `(q * 0.5) / |a|`, irregular-rate zero-underflow refusal, and two-marginal lagged Pearson correlation with represented covariance-bound admission. +A docs-to-code review found `CLAUDE.md` still describes the `2a`-overflow fallback as `(q / a) * -0.5` and warns against forming `0.5 q`. That text predates the later RED evidence showing `q / a` can overflow while the final result remains representable and now contradicts the source contract above. This is an explicit merge blocker until the scientific authority text is safely repaired and documentation validation passes; it is not hidden by treating source tests as sufficient. + The current head is mergeable but remains Draft. Exact-head CodeQL PR is `startup_failure`; Rust Foundation CI, Security Scan, Documentation Quality, SAST Semgrep, Scorecard and OSV are queued. There is no qualifying current-head independent approval. No merge is authorized until the live ruleset passes. The CWC and within/between unit-mean helpers now agree on the material extreme-cancellation behavior but are still separate implementations. Consolidation remains a maintainability target only after their full error/estimand semantics are shown equivalent; a reusable domain-neutral arithmetic primitive belongs in fast-mlsirm rather than being copied across TEPP contexts. @@ -120,6 +122,7 @@ Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/num | GAP-016 | hourly LLM path needs released owner-only routing/authentication | `active-repair` | #480 + released CO adoption + exact-head GREEN/review/main merge | | GAP-017 | dynamic evaluation item/rater/anchor drift monitoring | `blocked-external-design` | released/digest-pinned owner contracts, ACL conformance, no-anchor/no-linking refusal, evidence-gated temporal monitoring | | GAP-018 | Longitudinal stable-mean logic remains duplicated | `active-refactor` | semantic-equivalence proof, one TEPP Longitudinal primitive or released fast-mlsirm generic owner contract, recovery parity | +| GAP-019 | Longitudinal scientific instructions contradict current stationary-overflow implementation | `release-integrity` | repair `CLAUDE.md` stationary fallback text, documentation fitness GREEN, exact-head review | ## Release gate From 2ee5194fb3f191907dd3ee0f0cc1cc8748e7f3dc Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 3 Sep 2026 02:36:24 +0900 Subject: [PATCH 100/235] docs(delivery): synchronize longitudinal authority repair --- docs/product-technical-gap-baseline.md | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 221166146..aa49769c8 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,7 +4,7 @@ **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-02T17:16:00Z +**Snapshot:** 2026-09-02T17:36:00Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` @@ -43,7 +43,7 @@ A planning document, mergeable branch, local test, predecessor-head result, queu | #460 | `dfab4eab5ff733731e565a9348072b8dab2e4912` | true | #416 `feat/copy-identity-analysis-run-gap-004@0b7155cc238defb1e55129ff3000658f04b343cf` | Fold child; typed cutoff equality and terminal-validation separation preserved. | | #458 | `08165e3b3c929b4ae77396689549f72723ff8ff5` | true | #416 `feat/copy-identity-analysis-run-gap-004@0b7155cc238defb1e55129ff3000658f04b343cf` | Fold child; typed cutoff equality and terminal-validation separation preserved. | | #416 | `0b7155cc238defb1e55129ff3000658f04b343cf` | true | `main@1bc02f580cf48e1d39da239f0e818453437c31c3` | Validation / Analysis Run landing candidate; availability cutoff precedes duplicate-identity admission. | -| #310 | `bd7191cf176c9e68e450757294086429cd880b09` | true | `main@1bc02f580cf48e1d39da239f0e818453437c31c3` | Longitudinal Modeling vehicle; subnormal unit means survive extreme cancellation; scientific docs still need stationary-fallback synchronization. | +| #310 | `9c962205dca26925c2e60d1e15ec4ce15681bbee` | true | `main@1bc02f580cf48e1d39da239f0e818453437c31c3` | Longitudinal Modeling vehicle; stationary-overflow guidance is source-synchronized test-first; hosted documentation/review evidence remains non-GREEN. | Exact-current-head evidence becomes stale after source mutation or any new commit. @@ -68,13 +68,13 @@ The clock contract separates event/valid time, assertion time, document time, sy Closed predecessor #441 is contained by #310. The invalid covariance/earlier-variance quantity is not exposed as autocorrelation; lagged Pearson correlation requires lagged covariance and both occasion-specific marginal variances. Temporal/state composition is owned by `longitudinal_core`. -Current head `bd7191cf176c9e68e450757294086429cd880b09` repairs a second extreme-value mean defect in within/between decomposition. RED `0544def0f7e39ab50e6de963ec4332ca6ccf01f4` uses one unit with scores `[f64::MAX, -f64::MAX, 4*min_subnormal]`; its representable binary64 mean is `min_subnormal`, while the predecessor max-scale normalization erased the low-order term. The repair cancels opposite-sign extremes before averaging retained same-sign mass and restores original sample-count weighting without pre-scaling. Same-sign means remain bounded and non-representable final means/residuals still fail closed. +Current head `9c962205dca26925c2e60d1e15ec4ce15681bbee` preserves the within/between subnormal-cancellation repair and closes the remaining stationary-overflow documentation drift. RED `9d8a82d78443cafc9b5064fc3bb35aa3f2052722` adds deterministic documentation fitness that rejects the retired `(q / a) * -0.5` overflow instruction and the retired warning against forming `0.5 q`, while requiring `(q * 0.5) / |a|`. Repair `9c962205dca26925c2e60d1e15ec4ce15681bbee` synchronizes `CLAUDE.md` with the production `recover_stationary_within_variance` contract. -Earlier active numerical lineages include CWC RED `9a706c3c0e9e0db68e88f89b94c64c13ea7fafd0` / repair `260413efb9d95039b5fbba41919cba8097fcf8b5`, known-truth RMSE overflow/precision repair, stationary fallback `(q * 0.5) / |a|`, irregular-rate zero-underflow refusal, and two-marginal lagged Pearson correlation with represented covariance-bound admission. +The underlying scientific reason is numerical, not stylistic: when finite stable `a` is so negative that `2a` overflows, ratio-first `q/a` can overflow or round on a different path even though `-q/(2a)` is representable; the current branch uses `(q * 0.5) / |a|`. In this overflow branch, `|a|` is already large enough that halving a minimum-subnormal `q` cannot erase a representable positive final stationary variance. The earlier double-rounding and minimum-subnormal regressions remain preserved on the same vehicle. -A docs-to-code review found `CLAUDE.md` still describes the `2a`-overflow fallback as `(q / a) * -0.5` and warns against forming `0.5 q`. That text predates the later RED evidence showing `q / a` can overflow while the final result remains representable and now contradicts the source contract above. This is an explicit merge blocker until the scientific authority text is safely repaired and documentation validation passes; it is not hidden by treating source tests as sufficient. +Earlier active numerical lineages include CWC RED `9a706c3c0e9e0db68e88f89b94c64c13ea7fafd0` / repair `260413efb9d95039b5fbba41919cba8097fcf8b5`, known-truth RMSE overflow/precision repair, irregular-rate zero-underflow refusal, and two-marginal lagged Pearson correlation with represented covariance-bound admission. Within/between RED `0544def0f7e39ab50e6de963ec4332ca6ccf01f4` continues to pin `[MAX, -MAX, 4*min_subnormal]` so opposite-sign cancellation cannot erase the representable low-order mean. -The current head is mergeable but remains Draft. Exact-head CodeQL PR is `startup_failure`; Rust Foundation CI, Security Scan, Documentation Quality, SAST Semgrep, Scorecard and OSV are queued. There is no qualifying current-head independent approval. No merge is authorized until the live ruleset passes. +The current head is mergeable but remains Draft. Exact-head CodeQL PR run `33661807608` is `startup_failure`; Rust Foundation CI `33661805492`, Documentation Quality `33661805528`, Security Scan `33661805381`, SAST Semgrep `33661805505`, Scorecard PR `33661805589` and OSV-Scanner PR `33661806280` are queued. There is no qualifying current-head independent approval. Source/document synchronization is repaired, but GAP-019 remains open as verification debt until exact-head documentation fitness/review and protected-main integration succeed. The CWC and within/between unit-mean helpers now agree on the material extreme-cancellation behavior but are still separate implementations. Consolidation remains a maintainability target only after their full error/estimand semantics are shown equivalent; a reusable domain-neutral arithmetic primitive belongs in fast-mlsirm rather than being copied across TEPP contexts. @@ -84,13 +84,13 @@ Current head `0b7155cc238defb1e55129ff3000658f04b343cf` centralizes the leakage- ### #480 / #479 — contextual-orchestrator boundary -#480 removes TEPP-owned provider discovery/ranking and requires HTTPS `contextual-orchestrator/orchestrator/free` from an immutable owner release. contextual-orchestrator protected `main@212ff437dc297613289dba2e6064ade9942e07d8` has **zero GitHub releases**. Mutable branch state is not a released contract. The consumer remains deliberately fail-closed. Deployment identity must be bound to the selected immutable release and model-controlled execution must not receive a reusable long-lived gateway credential. +#480 removes TEPP-owned provider discovery/ranking and requires HTTPS `contextual-orchestrator/orchestrator/free` from an immutable owner release. contextual-orchestrator protected `main@212ff437dc297613289dba2e6064ade9942e07d8` has **zero GitHub releases** at this snapshot. Mutable branch state is not a released contract. The consumer remains deliberately fail-closed. Deployment identity must be bound to the selected immutable release and model-controlled execution must not receive a reusable long-lived gateway credential. ### fast-mlsirm owner handoff fast-mlsirm protected `main@b5a3a0c1057d4b53d7a4bb18e0de69f630c2b45c`. Immutable `v0.9.1` predates the current owner work. -Generalized-mixed/dependence Published Language remains unreleased. Reusable static covariance-to-correlation standardization is now independently represented by fast-mlsirm #1722 at `338dbb2d25f32b0e201102e7bf73076846fb57b3`, contract `fast_mlsirm.covariance_standardization@1.0.0`. Its current source/review findings are repaired, but CI is pending/queued and CodeQL PR is startup-failed; TEPP therefore does not consume that mutable PR head. Temporal/EventTime admission and state composition remain TEPP-owned. +Generalized-mixed/dependence Published Language remains unreleased. Reusable static covariance-to-correlation standardization is independently represented by fast-mlsirm #1722 at `338dbb2d25f32b0e201102e7bf73076846fb57b3`, contract `fast_mlsirm.covariance_standardization@1.0.0`. Its current source/review findings were repaired at the prior snapshot, but CI/security evidence was non-GREEN and TEPP therefore does not consume that mutable PR head. Temporal/EventTime admission and state composition remain TEPP-owned. ### #437 — ADR identity @@ -122,7 +122,7 @@ Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/num | GAP-016 | hourly LLM path needs released owner-only routing/authentication | `active-repair` | #480 + released CO adoption + exact-head GREEN/review/main merge | | GAP-017 | dynamic evaluation item/rater/anchor drift monitoring | `blocked-external-design` | released/digest-pinned owner contracts, ACL conformance, no-anchor/no-linking refusal, evidence-gated temporal monitoring | | GAP-018 | Longitudinal stable-mean logic remains duplicated | `active-refactor` | semantic-equivalence proof, one TEPP Longitudinal primitive or released fast-mlsirm generic owner contract, recovery parity | -| GAP-019 | Longitudinal scientific instructions contradict current stationary-overflow implementation | `release-integrity` | repair `CLAUDE.md` stationary fallback text, documentation fitness GREEN, exact-head review | +| GAP-019 | Longitudinal scientific instructions contradict current stationary-overflow implementation | `verification-pending` | RED `9d8a82d...` + repair `9c962205...`; exact-head Documentation Quality/review GREEN and protected-main integration | ## Release gate From 32522004182e451a20dd83ceb5f7638507892dd7 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 3 Sep 2026 03:10:08 +0900 Subject: [PATCH 101/235] docs(gap): record lag-correlation representability repair --- docs/product-technical-gap-baseline.md | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index aa49769c8..224594458 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,7 +4,7 @@ **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-02T17:36:00Z +**Snapshot:** 2026-09-02T17:59:20Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` @@ -43,7 +43,7 @@ A planning document, mergeable branch, local test, predecessor-head result, queu | #460 | `dfab4eab5ff733731e565a9348072b8dab2e4912` | true | #416 `feat/copy-identity-analysis-run-gap-004@0b7155cc238defb1e55129ff3000658f04b343cf` | Fold child; typed cutoff equality and terminal-validation separation preserved. | | #458 | `08165e3b3c929b4ae77396689549f72723ff8ff5` | true | #416 `feat/copy-identity-analysis-run-gap-004@0b7155cc238defb1e55129ff3000658f04b343cf` | Fold child; typed cutoff equality and terminal-validation separation preserved. | | #416 | `0b7155cc238defb1e55129ff3000658f04b343cf` | true | `main@1bc02f580cf48e1d39da239f0e818453437c31c3` | Validation / Analysis Run landing candidate; availability cutoff precedes duplicate-identity admission. | -| #310 | `9c962205dca26925c2e60d1e15ec4ce15681bbee` | true | `main@1bc02f580cf48e1d39da239f0e818453437c31c3` | Longitudinal Modeling vehicle; stationary-overflow guidance is source-synchronized test-first; hosted documentation/review evidence remains non-GREEN. | +| #310 | `ea550a3a2f3419061736eaa12a74909acf5f90a9` | true | `main@1bc02f580cf48e1d39da239f0e818453437c31c3` | Longitudinal Modeling vehicle; nonzero lagged covariance may no longer underflow into a false exact-zero correlation; exact-head hosted verification is pending. | Exact-current-head evidence becomes stale after source mutation or any new commit. @@ -68,13 +68,11 @@ The clock contract separates event/valid time, assertion time, document time, sy Closed predecessor #441 is contained by #310. The invalid covariance/earlier-variance quantity is not exposed as autocorrelation; lagged Pearson correlation requires lagged covariance and both occasion-specific marginal variances. Temporal/state composition is owned by `longitudinal_core`. -Current head `9c962205dca26925c2e60d1e15ec4ce15681bbee` preserves the within/between subnormal-cancellation repair and closes the remaining stationary-overflow documentation drift. RED `9d8a82d78443cafc9b5064fc3bb35aa3f2052722` adds deterministic documentation fitness that rejects the retired `(q / a) * -0.5` overflow instruction and the retired warning against forming `0.5 q`, while requiring `(q * 0.5) / |a|`. Repair `9c962205dca26925c2e60d1e15ec4ce15681bbee` synchronizes `CLAUDE.md` with the production `recover_stationary_within_variance` contract. +Current head `ea550a3a2f3419061736eaa12a74909acf5f90a9` adds a fail-closed representability contract for lagged Pearson correlation. RED `c345ee7b8bdf642430669b7b0e1d7fc6873a84af` pins finite inputs `cov=min_subnormal`, `Var_t=Var_t+Δ=f64::MAX`: the covariance satisfies the exact binary64 Cauchy–Schwarz bound, but the true standardized magnitude is below the smallest representable binary64 and the predecessor returned `Ok(0.0)`, falsely converting a nonzero association into exact no-association. Repair `5785e07a352801c193d92dde03863d0697a2853a` rejects that representability collapse as `InvalidTemporalAssociationInput` while preserving genuine zero covariance as `Ok(0.0)`. Public-boundary commit `ea550a3a2f3419061736eaa12a74909acf5f90a9` carries the same regression through typed `EventTimeInterval` and documents the refusal contract. -The underlying scientific reason is numerical, not stylistic: when finite stable `a` is so negative that `2a` overflows, ratio-first `q/a` can overflow or round on a different path even though `-q/(2a)` is representable; the current branch uses `(q * 0.5) / |a|`. In this overflow branch, `|a|` is already large enough that halving a minimum-subnormal `q` cannot erase a representable positive final stationary variance. The earlier double-rounding and minimum-subnormal regressions remain preserved on the same vehicle. +The earlier stationary-overflow documentation repair remains intact. RED `9d8a82d78443cafc9b5064fc3bb35aa3f2052722` rejects the retired `(q / a) * -0.5` overflow instruction and requires `(q * 0.5) / |a|`; repair `9c962205dca26925c2e60d1e15ec4ce15681bbee` synchronizes `CLAUDE.md` with production `recover_stationary_within_variance` behavior. Earlier CWC, within/between, known-truth RMSE, irregular-rate zero-underflow, stationary-subnormal and exact covariance-bound lineages also remain on the same vehicle. -Earlier active numerical lineages include CWC RED `9a706c3c0e9e0db68e88f89b94c64c13ea7fafd0` / repair `260413efb9d95039b5fbba41919cba8097fcf8b5`, known-truth RMSE overflow/precision repair, irregular-rate zero-underflow refusal, and two-marginal lagged Pearson correlation with represented covariance-bound admission. Within/between RED `0544def0f7e39ab50e6de963ec4332ca6ccf01f4` continues to pin `[MAX, -MAX, 4*min_subnormal]` so opposite-sign cancellation cannot erase the representable low-order mean. - -The current head is mergeable but remains Draft. Exact-head CodeQL PR run `33661807608` is `startup_failure`; Rust Foundation CI `33661805492`, Documentation Quality `33661805528`, Security Scan `33661805381`, SAST Semgrep `33661805505`, Scorecard PR `33661805589` and OSV-Scanner PR `33661806280` are queued. There is no qualifying current-head independent approval. Source/document synchronization is repaired, but GAP-019 remains open as verification debt until exact-head documentation fitness/review and protected-main integration succeed. +The current head is mergeable but remains Draft. No workflow/status evidence has yet materialized for exact head `ea550a3a...`; predecessor-head queued/startup-failed runs do not transfer. There is no qualifying current-head independent approval. Source and public-boundary regression are repaired, but protected-main integration waits for fresh exact-head Rust/documentation/security/SAST/CodeQL evidence and review. The CWC and within/between unit-mean helpers now agree on the material extreme-cancellation behavior but are still separate implementations. Consolidation remains a maintainability target only after their full error/estimand semantics are shown equivalent; a reusable domain-neutral arithmetic primitive belongs in fast-mlsirm rather than being copied across TEPP contexts. @@ -90,7 +88,7 @@ Current head `0b7155cc238defb1e55129ff3000658f04b343cf` centralizes the leakage- fast-mlsirm protected `main@b5a3a0c1057d4b53d7a4bb18e0de69f630c2b45c`. Immutable `v0.9.1` predates the current owner work. -Generalized-mixed/dependence Published Language remains unreleased. Reusable static covariance-to-correlation standardization is independently represented by fast-mlsirm #1722 at `338dbb2d25f32b0e201102e7bf73076846fb57b3`, contract `fast_mlsirm.covariance_standardization@1.0.0`. Its current source/review findings were repaired at the prior snapshot, but CI/security evidence was non-GREEN and TEPP therefore does not consume that mutable PR head. Temporal/EventTime admission and state composition remain TEPP-owned. +Generalized-mixed/dependence Published Language remains unreleased. #1714 is open/Ready at `92a3f2152033b61ca89661b5ba8a584842e8c3a9`; its exact-head CodeQL PR is `startup_failure` and CI/security/SAST/CodeQL/OSV/Scorecard workflows are queued. Reusable static covariance-to-correlation standardization is independently represented by fast-mlsirm #1722 at `338dbb2d25f32b0e201102e7bf73076846fb57b3`. Neither mutable owner head is a TEPP production dependency. Temporal/EventTime admission and state composition remain TEPP-owned. ### #437 — ADR identity @@ -123,6 +121,7 @@ Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/num | GAP-017 | dynamic evaluation item/rater/anchor drift monitoring | `blocked-external-design` | released/digest-pinned owner contracts, ACL conformance, no-anchor/no-linking refusal, evidence-gated temporal monitoring | | GAP-018 | Longitudinal stable-mean logic remains duplicated | `active-refactor` | semantic-equivalence proof, one TEPP Longitudinal primitive or released fast-mlsirm generic owner contract, recovery parity | | GAP-019 | Longitudinal scientific instructions contradict current stationary-overflow implementation | `verification-pending` | RED `9d8a82d...` + repair `9c962205...`; exact-head Documentation Quality/review GREEN and protected-main integration | +| GAP-020 | Nonzero lagged covariance can be misreported as exact-zero correlation when the standardized magnitude is unrepresentable | `verification-pending` | RED `c345ee7b...` + repair `5785e07a...` + public contract `ea550a3a...`; exact-head Rust/documentation/review GREEN and protected-main integration | ## Release gate From 85c10ebe9c2660891ed510b2e0cf3aa9f13bc62c Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 3 Sep 2026 03:18:53 +0900 Subject: [PATCH 102/235] docs(queue): classify support-edge slice under Analysis Run --- docs/product-technical-gap-baseline.md | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 224594458..cfc4aa073 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,7 +4,7 @@ **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-02T17:59:20Z +**Snapshot:** 2026-09-02T18:17:00Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` @@ -21,14 +21,14 @@ A planning document, mergeable branch, local test, predecessor-head result, queu | Signal | Fresh evidence | Implication | | --- | ---: | --- | | Protected `main` | `1bc02f580cf48e1d39da239f0e818453437c31c3` | Capability claims remain bounded to this commit until main advances. | -| Open pull requests | **131** | WIP circuit breaker remains active. | -| Draft pull requests | **130** | Draft work must consolidate/repair rather than independently land. | +| Open pull requests | **132** | WIP circuit breaker remains active; #485 caused a fresh regression and was retargeted into #416 rather than accepted as an independent landing lane. | +| Draft pull requests | **131** | Draft work must consolidate/repair rather than independently land. | | Non-Draft pull requests | **1** | #480 is the only non-Draft PR and is not deployable without a compatible immutable contextual-orchestrator release. | | Open issues | **16** | ADR normalization, orchestration admission, evaluation drift and scientific recovery work remain open. | | GitHub releases | **0** | No TEPP open head is a released contract. | | Organization ruleset | `18156473` | One qualifying current-head approval, stale-review dismissal after push, resolved threads, unattributed-change approval where applicable, and central required workflows. | -#484 `summarizes_edge_v1` remains a #416 Analysis Run fold child. Its unique source/tests/doctoring must survive the shared-file fold; it is not closed merely to reduce queue count. +#484 `summarizes_edge_v1` and #485 `support_edge_v1` remain #416 Analysis Run fold children. Their unique source/tests/doctoring must survive the shared-file fold; neither is closed merely to reduce queue count. ## Current priority open pull-request evidence @@ -36,6 +36,7 @@ A planning document, mergeable branch, local test, predecessor-head result, queu | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | +| #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 `feat/copy-identity-analysis-run-gap-004@0b7155cc238defb1e55129ff3000658f04b343cf` | Analysis Run fold child after fresh WIP regression; preserve support-edge refusal/source/tests/doctoring and historical-cutoff evidence. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 `feat/copy-identity-analysis-run-gap-004@0b7155cc238defb1e55129ff3000658f04b343cf` | Analysis Run fold child; preserve profile-specific source/tests/doctoring. | | #483 | `847d96f913bb261803ac0bd751ad7e4f51324cee` | true | #416 `feat/copy-identity-analysis-run-gap-004@0b7155cc238defb1e55129ff3000658f04b343cf` | Analysis Run fold child; preserve unique evidence. | | #482 | `506dbae236a4484301b704b6c6a05b20faf0fe69` | true | #416 `feat/copy-identity-analysis-run-gap-004@0b7155cc238defb1e55129ff3000658f04b343cf` | Analysis Run fold child; preserve unique evidence. | @@ -72,13 +73,13 @@ Current head `ea550a3a2f3419061736eaa12a74909acf5f90a9` adds a fail-closed repre The earlier stationary-overflow documentation repair remains intact. RED `9d8a82d78443cafc9b5064fc3bb35aa3f2052722` rejects the retired `(q / a) * -0.5` overflow instruction and requires `(q * 0.5) / |a|`; repair `9c962205dca26925c2e60d1e15ec4ce15681bbee` synchronizes `CLAUDE.md` with production `recover_stationary_within_variance` behavior. Earlier CWC, within/between, known-truth RMSE, irregular-rate zero-underflow, stationary-subnormal and exact covariance-bound lineages also remain on the same vehicle. -The current head is mergeable but remains Draft. No workflow/status evidence has yet materialized for exact head `ea550a3a...`; predecessor-head queued/startup-failed runs do not transfer. There is no qualifying current-head independent approval. Source and public-boundary regression are repaired, but protected-main integration waits for fresh exact-head Rust/documentation/security/SAST/CodeQL evidence and review. +The current head is mergeable but remains Draft. Exact-head CodeQL PR run `33665256789` is `startup_failure`; Documentation Quality `33665255191`, SAST Semgrep `33665255137`, OSV-Scanner PR `33665255643`, Security Scan `33665255105`, Scorecard PR `33665255116`, and Rust Foundation CI `33665255109` are queued. There is no qualifying current-head independent approval. Source and public-boundary regression are repaired, but protected-main integration waits for fresh exact-head GREEN evidence and review. The CWC and within/between unit-mean helpers now agree on the material extreme-cancellation behavior but are still separate implementations. Consolidation remains a maintainability target only after their full error/estimand semantics are shown equivalent; a reusable domain-neutral arithmetic primitive belongs in fast-mlsirm rather than being copied across TEPP contexts. ### #416 — Validation / Analysis Run consolidation -Current head `0b7155cc238defb1e55129ff3000658f04b343cf` centralizes the leakage-safe invariant established by RED `ffee655404716bf8d33c898a3c1a87a543abe701`: availability filtering occurs before duplicate-identity admission. #458/#460/#482/#483/#484 remain fold children over shared Cargo/lib/lock/docs surfaces. Their unique evidence must reach a surviving #416 head before any child can be considered fully superseded. +Current head `0b7155cc238defb1e55129ff3000658f04b343cf` centralizes the leakage-safe invariant established by RED `ffee655404716bf8d33c898a3c1a87a543abe701`: availability filtering occurs before duplicate-identity admission. #458/#460/#482/#483/#484/#485 remain fold children over shared Cargo/lib/lock/docs surfaces. Their unique evidence must reach a surviving #416 head before any child can be considered fully superseded. #485 was opened as an independent main-targeting profile despite the active WIP circuit breaker; fresh file-surface verification showed it touches the same Analysis Run integration files, so it was repaired by non-force retargeting to #416. ### #480 / #479 — contextual-orchestrator boundary @@ -92,7 +93,7 @@ Generalized-mixed/dependence Published Language remains unreleased. #1714 is ope ### #437 — ADR identity -Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/numbered files, index/file mismatch and repeated Decision-status or Implementation-maturity authority must fail deterministic documentation fitness. Adapter/model micro-slice ADR numbers remain implementation lineage pending normalization through #435. +Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/numbered files, index/file mismatch and repeated Decision-status or Implementation-maturity authority must fail deterministic documentation fitness. Adapter/model micro-slice ADR numbers, including #485's ADR 0078, remain implementation lineage pending normalization through #435. ## External contract state @@ -102,7 +103,7 @@ Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/num | ID | Gap | Maturity | Closure evidence | | --- | --- | --- | --- | -| GAP-001 | PR authority fragmented across 131 open PRs | `release-blocking` | coherent landing vehicles, unique-evidence preservation, protected-main reduction | +| GAP-001 | PR authority fragmented across 132 open PRs | `release-blocking` | coherent landing vehicles, unique-evidence preservation, protected-main reduction | | GAP-002 | multilingual span-grounded semantic/concept admission | `partial` | immutable offsets/layout, KO/EN/JA/ZH/VI/ES/DE/FR profiles, concept dictionary, invariance/calibration, hostile-input tests | | GAP-003 | shared-latent temporal topic estimator | `partial` | Rust CPU f64 likelihood/uncertainty, relation/time/membership effects, true recovery, fitted candidate-K | | GAP-004 | durable end-to-end Analysis Run | `partial` | idempotent lifecycle, persistence/recovery, estimator-bound artifacts, validation/promotion separation, Compose E2E | From 97aca62cc73d58f9eb46b635de84e700a512f262 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 3 Sep 2026 04:05:13 +0900 Subject: [PATCH 103/235] docs(ddd): refresh Longitudinal and owner evidence --- docs/product-technical-gap-baseline.md | 23 +++++++++++++---------- 1 file changed, 13 insertions(+), 10 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index cfc4aa073..2cc830e30 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,7 +4,7 @@ **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-02T18:17:00Z +**Snapshot:** 2026-09-02T19:02:00Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` @@ -44,7 +44,7 @@ A planning document, mergeable branch, local test, predecessor-head result, queu | #460 | `dfab4eab5ff733731e565a9348072b8dab2e4912` | true | #416 `feat/copy-identity-analysis-run-gap-004@0b7155cc238defb1e55129ff3000658f04b343cf` | Fold child; typed cutoff equality and terminal-validation separation preserved. | | #458 | `08165e3b3c929b4ae77396689549f72723ff8ff5` | true | #416 `feat/copy-identity-analysis-run-gap-004@0b7155cc238defb1e55129ff3000658f04b343cf` | Fold child; typed cutoff equality and terminal-validation separation preserved. | | #416 | `0b7155cc238defb1e55129ff3000658f04b343cf` | true | `main@1bc02f580cf48e1d39da239f0e818453437c31c3` | Validation / Analysis Run landing candidate; availability cutoff precedes duplicate-identity admission. | -| #310 | `ea550a3a2f3419061736eaa12a74909acf5f90a9` | true | `main@1bc02f580cf48e1d39da239f0e818453437c31c3` | Longitudinal Modeling vehicle; nonzero lagged covariance may no longer underflow into a false exact-zero correlation; exact-head hosted verification is pending. | +| #310 | `7f0bea0841fb89a6ce9bdd5b9f10c0e4612f4270` | true | `main@1bc02f580cf48e1d39da239f0e818453437c31c3` | Longitudinal Modeling vehicle; one canonical irregular-rate function identity is re-exported through the stable facade; exact-head hosted verification is pending. | Exact-current-head evidence becomes stale after source mutation or any new commit. @@ -69,11 +69,13 @@ The clock contract separates event/valid time, assertion time, document time, sy Closed predecessor #441 is contained by #310. The invalid covariance/earlier-variance quantity is not exposed as autocorrelation; lagged Pearson correlation requires lagged covariance and both occasion-specific marginal variances. Temporal/state composition is owned by `longitudinal_core`. -Current head `ea550a3a2f3419061736eaa12a74909acf5f90a9` adds a fail-closed representability contract for lagged Pearson correlation. RED `c345ee7b8bdf642430669b7b0e1d7fc6873a84af` pins finite inputs `cov=min_subnormal`, `Var_t=Var_t+Δ=f64::MAX`: the covariance satisfies the exact binary64 Cauchy–Schwarz bound, but the true standardized magnitude is below the smallest representable binary64 and the predecessor returned `Ok(0.0)`, falsely converting a nonzero association into exact no-association. Repair `5785e07a352801c193d92dde03863d0697a2853a` rejects that representability collapse as `InvalidTemporalAssociationInput` while preserving genuine zero covariance as `Ok(0.0)`. Public-boundary commit `ea550a3a2f3419061736eaa12a74909acf5f90a9` carries the same regression through typed `EventTimeInterval` and documents the refusal contract. +The lagged-correlation representability repair remains intact. RED `c345ee7b8bdf642430669b7b0e1d7fc6873a84af` pins finite inputs `cov=min_subnormal`, `Var_t=Var_t+Δ=f64::MAX`: the covariance satisfies the exact binary64 Cauchy–Schwarz bound, but the true standardized magnitude is below the smallest representable binary64 and the predecessor returned `Ok(0.0)`, falsely converting a nonzero association into exact no-association. Repair `5785e07a352801c193d92dde03863d0697a2853a` rejects that representability collapse as `InvalidTemporalAssociationInput` while preserving genuine zero covariance as `Ok(0.0)`. + +The current exact head `7f0bea0841fb89a6ce9bdd5b9f10c0e4612f4270` also removes a redundant public wrapper layer around the canonical irregular-rate implementation. An initial test commit `5697221872650f0327cbdf6db0a5020a07fe39e4` over-specified canonical visibility as `pub(crate)`; before production mutation, RED refinement `4648638608436fb6c04315d96f59a6404e2e790b` corrected the contract to preserve re-exportable canonical `pub fn` identities while forbidding facade wrapper `pub fn` declarations. Repair `7f0bea0841fb89a6ce9bdd5b9f10c0e4612f4270` replaces the wrappers with direct `pub use` re-exports. `lib.rs` retains the same crate-public names through `stable_irregular_rate`, so the API remains compatible while one function identity owns the numerical behavior. The earlier stationary-overflow documentation repair remains intact. RED `9d8a82d78443cafc9b5064fc3bb35aa3f2052722` rejects the retired `(q / a) * -0.5` overflow instruction and requires `(q * 0.5) / |a|`; repair `9c962205dca26925c2e60d1e15ec4ce15681bbee` synchronizes `CLAUDE.md` with production `recover_stationary_within_variance` behavior. Earlier CWC, within/between, known-truth RMSE, irregular-rate zero-underflow, stationary-subnormal and exact covariance-bound lineages also remain on the same vehicle. -The current head is mergeable but remains Draft. Exact-head CodeQL PR run `33665256789` is `startup_failure`; Documentation Quality `33665255191`, SAST Semgrep `33665255137`, OSV-Scanner PR `33665255643`, Security Scan `33665255105`, Scorecard PR `33665255116`, and Rust Foundation CI `33665255109` are queued. There is no qualifying current-head independent approval. Source and public-boundary regression are repaired, but protected-main integration waits for fresh exact-head GREEN evidence and review. +The current head is mergeable but remains Draft. Exact-head CodeQL PR run `33670670642` is `startup_failure`; Documentation Quality `33670668067`, SAST Semgrep `33670668039`, OSV-Scanner PR `33670669157`, Security Scan `33670667891`, Scorecard PR `33670667957`, and Rust Foundation CI `33670667997` are queued. There is no qualifying current-head independent approval. Source repair is complete, but protected-main integration waits for fresh exact-head GREEN evidence and review. The CWC and within/between unit-mean helpers now agree on the material extreme-cancellation behavior but are still separate implementations. Consolidation remains a maintainability target only after their full error/estimand semantics are shown equivalent; a reusable domain-neutral arithmetic primitive belongs in fast-mlsirm rather than being copied across TEPP contexts. @@ -83,13 +85,13 @@ Current head `0b7155cc238defb1e55129ff3000658f04b343cf` centralizes the leakage- ### #480 / #479 — contextual-orchestrator boundary -#480 removes TEPP-owned provider discovery/ranking and requires HTTPS `contextual-orchestrator/orchestrator/free` from an immutable owner release. contextual-orchestrator protected `main@212ff437dc297613289dba2e6064ade9942e07d8` has **zero GitHub releases** at this snapshot. Mutable branch state is not a released contract. The consumer remains deliberately fail-closed. Deployment identity must be bound to the selected immutable release and model-controlled execution must not receive a reusable long-lived gateway credential. +#480 removes TEPP-owned provider discovery/ranking and requires HTTPS `contextual-orchestrator/orchestrator/free` from an immutable owner release. contextual-orchestrator protected `main@212ff437dc297613289dba2e6064ade9942e07d8` has **zero GitHub releases** at this snapshot. Mutable branch state is not a released contract. The consumer remains deliberately fail-closed. Owner issue #1023 remains open for authenticated release/deployment provenance and scoped/brokered authentication that does not expose a reusable long-lived gateway bearer token to model-controlled execution. ### fast-mlsirm owner handoff fast-mlsirm protected `main@b5a3a0c1057d4b53d7a4bb18e0de69f630c2b45c`. Immutable `v0.9.1` predates the current owner work. -Generalized-mixed/dependence Published Language remains unreleased. #1714 is open/Ready at `92a3f2152033b61ca89661b5ba8a584842e8c3a9`; its exact-head CodeQL PR is `startup_failure` and CI/security/SAST/CodeQL/OSV/Scorecard workflows are queued. Reusable static covariance-to-correlation standardization is independently represented by fast-mlsirm #1722 at `338dbb2d25f32b0e201102e7bf73076846fb57b3`. Neither mutable owner head is a TEPP production dependency. Temporal/EventTime admission and state composition remain TEPP-owned. +Generalized-mixed/dependence Published Language #1714 is open/Ready at `92a3f2152033b61ca89661b5ba8a584842e8c3a9`. Reusable static covariance-to-correlation standardization #1722 is open/Ready at `338dbb2d25f32b0e201102e7bf73076846fb57b3`. Dynamic evaluation criterion/item/run snapshots #1727 remain Draft at `17ac218a5c0a31f0082839603a8ffc64b4432534`; zero-anchor within-run work is explicit, while unsupported cross-version linking fails closed. None of these mutable owner heads is a TEPP production dependency. Temporal/EventTime admission and state composition remain TEPP-owned. ### #437 — ADR identity @@ -97,7 +99,7 @@ Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/num ## External contract state -`context-graph-contracts` and `enterprise-architecture-core` remain read-only from this TEPP writer. Their open heads are candidate evidence rather than production contracts. Exact branch/count/release observations are refreshed each run and must not be promoted into deployable TEPP integration without a released version and conformance evidence. +`context-graph-contracts` and `enterprise-architecture-core` remain read-only from this TEPP writer. Fresh state is CGC `develop@99cb5468ba3c15c5e79688f53dee74724fae2d13`, 14 open PR / 2 open issue / release 0, and EA Core `develop@1c0fa8b15ceb9e72186274aeb255d6777eb84ef4`, 24 open PR / 2 open issue / release 0. CGC #25 is still a Draft source-bound release-provenance prerequisite; EA #40 remains Draft/fail-closed against unreleased CGC evidence. Open heads are candidate evidence rather than production contracts. ## Gap register @@ -119,11 +121,12 @@ Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/num | GAP-014 | current required-workflow startup/runner evidence unavailable | `external-control-risk` | central workflow repair, exact-current required workflows GREEN, no bypass | | GAP-015 | contextual-orchestrator lacks immutable released contract for current owner behavior | `release-blocking` | compatible immutable CO release, deployment provenance, safe gateway auth, exact TEPP ACL adoption | | GAP-016 | hourly LLM path needs released owner-only routing/authentication | `active-repair` | #480 + released CO adoption + exact-head GREEN/review/main merge | -| GAP-017 | dynamic evaluation item/rater/anchor drift monitoring | `blocked-external-design` | released/digest-pinned owner contracts, ACL conformance, no-anchor/no-linking refusal, evidence-gated temporal monitoring | +| GAP-017 | dynamic evaluation item/rater/anchor drift monitoring | `owner-contract-active` | released/digest-pinned dynamic criterion/item/run contract, ACL conformance, no-anchor/no-linking refusal, evidence-gated temporal monitoring | | GAP-018 | Longitudinal stable-mean logic remains duplicated | `active-refactor` | semantic-equivalence proof, one TEPP Longitudinal primitive or released fast-mlsirm generic owner contract, recovery parity | | GAP-019 | Longitudinal scientific instructions contradict current stationary-overflow implementation | `verification-pending` | RED `9d8a82d...` + repair `9c962205...`; exact-head Documentation Quality/review GREEN and protected-main integration | -| GAP-020 | Nonzero lagged covariance can be misreported as exact-zero correlation when the standardized magnitude is unrepresentable | `verification-pending` | RED `c345ee7b...` + repair `5785e07a...` + public contract `ea550a3a...`; exact-head Rust/documentation/review GREEN and protected-main integration | +| GAP-020 | Nonzero lagged covariance can be misreported as exact-zero correlation when the standardized magnitude is unrepresentable | `verification-pending` | RED `c345ee7b...` + repair `5785e07a...`; exact-head Rust/documentation/review GREEN and protected-main integration | +| GAP-021 | Longitudinal irregular-rate facade duplicated public wrapper function identities over one canonical implementation | `verification-pending` | RED refinement `464863860...` + repair `7f0bea084...`; exact-head Rust/documentation/review GREEN and protected-main integration | ## Release gate -TEPP currently has no GitHub release. Release is permitted only after a coherent vertical reaches protected main with exact protected-head CI/security/recovery evidence, reproducible package + SBOM + provenance + rollback artifacts, current version/CHANGELOG, required migration/restore/load evidence, and released integration contracts where deployment depends on them. Queued/pending/startup-failed/skipped or predecessor-head evidence is not GREEN. +TEPP currently has no GitHub release. Release is permitted only after a coherent vertical reaches protected main with exact protected-head CI/security/recovery evidence, reproducible package + SBOM + provenance + rollback artifacts, current version/CHANGELOG, required migration/restore/load evidence, and released integration contracts where deployment depends on them. Queued/pending/startup-failed/skipped or predecessor-head evidence is not GREEN. \ No newline at end of file From 32a5ac1c2af784f7d5280e2ec07d20021caac4e0 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 3 Sep 2026 04:14:19 +0900 Subject: [PATCH 104/235] docs(ddd): record Longitudinal ownership repair --- docs/product-technical-gap-baseline.md | 45 +++++++++++++------------- 1 file changed, 23 insertions(+), 22 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 2cc830e30..3f97e9e77 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,7 +4,7 @@ **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-02T19:02:00Z +**Snapshot:** 2026-09-02T19:15:00Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` @@ -12,16 +12,14 @@ **Delivery authority:** issue [#175](https://github.com/ContextualWisdomLab/TEPP/issues/175), PR [#435](https://github.com/ContextualWisdomLab/TEPP/pull/435), and [`docs/delivery/pr-queue-authority-2026-09-01.md`](delivery/pr-queue-authority-2026-09-01.md). -**DDD authority:** [`docs/architecture/domain-context-map.md`](architecture/domain-context-map.md) and [`docs/architecture/temporal-dependence-composition.md`](architecture/temporal-dependence-composition.md). - ## Delivery truth -A planning document, mergeable branch, local test, predecessor-head result, queued/skipped check, ADR number, or LLM judgment does not make a capability shipped. Only protected-main integration plus current required evidence establishes delivery. +A planning document, mergeable branch, local/source inspection, predecessor-head result, queued/skipped check, ADR number, or LLM judgment does not make a capability shipped. Only protected-main integration plus current required evidence establishes delivery. | Signal | Fresh evidence | Implication | | --- | ---: | --- | | Protected `main` | `1bc02f580cf48e1d39da239f0e818453437c31c3` | Capability claims remain bounded to this commit until main advances. | -| Open pull requests | **132** | WIP circuit breaker remains active; #485 caused a fresh regression and was retargeted into #416 rather than accepted as an independent landing lane. | +| Open pull requests | **132** | WIP circuit breaker remains active; no independent micro-PR is justified while an existing bounded-context vehicle can own the work. | | Draft pull requests | **131** | Draft work must consolidate/repair rather than independently land. | | Non-Draft pull requests | **1** | #480 is the only non-Draft PR and is not deployable without a compatible immutable contextual-orchestrator release. | | Open issues | **16** | ADR normalization, orchestration admission, evaluation drift and scientific recovery work remain open. | @@ -36,7 +34,7 @@ A planning document, mergeable branch, local test, predecessor-head result, queu | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 `feat/copy-identity-analysis-run-gap-004@0b7155cc238defb1e55129ff3000658f04b343cf` | Analysis Run fold child after fresh WIP regression; preserve support-edge refusal/source/tests/doctoring and historical-cutoff evidence. | +| #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 `feat/copy-identity-analysis-run-gap-004@0b7155cc238defb1e55129ff3000658f04b343cf` | Analysis Run fold child; preserve support-edge refusal/source/tests/doctoring and historical-cutoff evidence. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 `feat/copy-identity-analysis-run-gap-004@0b7155cc238defb1e55129ff3000658f04b343cf` | Analysis Run fold child; preserve profile-specific source/tests/doctoring. | | #483 | `847d96f913bb261803ac0bd751ad7e4f51324cee` | true | #416 `feat/copy-identity-analysis-run-gap-004@0b7155cc238defb1e55129ff3000658f04b343cf` | Analysis Run fold child; preserve unique evidence. | | #482 | `506dbae236a4484301b704b6c6a05b20faf0fe69` | true | #416 `feat/copy-identity-analysis-run-gap-004@0b7155cc238defb1e55129ff3000658f04b343cf` | Analysis Run fold child; preserve unique evidence. | @@ -44,13 +42,17 @@ A planning document, mergeable branch, local test, predecessor-head result, queu | #460 | `dfab4eab5ff733731e565a9348072b8dab2e4912` | true | #416 `feat/copy-identity-analysis-run-gap-004@0b7155cc238defb1e55129ff3000658f04b343cf` | Fold child; typed cutoff equality and terminal-validation separation preserved. | | #458 | `08165e3b3c929b4ae77396689549f72723ff8ff5` | true | #416 `feat/copy-identity-analysis-run-gap-004@0b7155cc238defb1e55129ff3000658f04b343cf` | Fold child; typed cutoff equality and terminal-validation separation preserved. | | #416 | `0b7155cc238defb1e55129ff3000658f04b343cf` | true | `main@1bc02f580cf48e1d39da239f0e818453437c31c3` | Validation / Analysis Run landing candidate; availability cutoff precedes duplicate-identity admission. | -| #310 | `7f0bea0841fb89a6ce9bdd5b9f10c0e4612f4270` | true | `main@1bc02f580cf48e1d39da239f0e818453437c31c3` | Longitudinal Modeling vehicle; one canonical irregular-rate function identity is re-exported through the stable facade; exact-head hosted verification is pending. | +| #310 | `7fadc757987145cbcc39475b2bf3193e4a4fed59` | true | `main@1bc02f580cf48e1d39da239f0e818453437c31c3` | Longitudinal Modeling vehicle; canonical irregular-rate function identity and DDD ownership/topology repairs are source-complete; exact-head hosted verification is pending. | Exact-current-head evidence becomes stale after source mutation or any new commit. ## Domain ownership -TEPP owns temporal/event composition, irregular time, time-varying multilevel/cross-classified/multiple-membership semantics, longitudinal invariance/drift/alignment, leakage-safe knowledge cutoff, temporal recovery and projection policy. fast-mlsirm owns reusable static/generalized-mixed/dependence-aware psychometric specification and arithmetic, including covariance-to-correlation standardization and LSIRM/MLSIRM/DLSJM kernels. contextual-orchestrator owns provider/model routing and semantic LLM execution. Context Graph contracts are contract-only integration authority; EA Core owns enterprise-architecture decisions. No source copying, mutable sibling dependency, or cross-service SQL. +TEPP owns temporal/event composition, irregular time, time-varying multilevel/cross-classified/multiple-membership semantics, longitudinal invariance/drift/alignment, leakage-safe knowledge cutoff, temporal recovery and projection policy. `longitudinal_modeling` is the bounded context and `longitudinal_core` is its current Rust implementation path. + +`psychometric_core` is not the authority for new temporal/state composition. It retains existing measurement/legacy compatibility surfaces while explicit adapters are formed. fast-mlsirm owns reusable static/generalized-mixed/dependence-aware psychometric specification and arithmetic, including reusable covariance-to-correlation standardization and LSIRM/MLSIRM/DLSJM kernels. TEPP consumes only immutable released/versioned Published Language through an ACL; source copying and mutable sibling-head dependencies are prohibited. + +contextual-orchestrator owns provider/model routing and semantic LLM execution. Context Graph contracts are contract-only integration authority; EA Core owns enterprise-architecture decisions. No cross-service SQL. The clock contract separates event/valid time, assertion time, document time, system time, available time, and knowledge cutoff. Retrospective evidence may describe an earlier event but cannot enter an earlier knowledge cutoff. Forward state/transition edges remain distinct from retrospective/citation/revision/provenance relations. @@ -67,31 +69,29 @@ The clock contract separates event/valid time, assertion time, document time, sy ### #310 — Longitudinal Modeling -Closed predecessor #441 is contained by #310. The invalid covariance/earlier-variance quantity is not exposed as autocorrelation; lagged Pearson correlation requires lagged covariance and both occasion-specific marginal variances. Temporal/state composition is owned by `longitudinal_core`. +Closed predecessor #441 is contained by #310. The invalid covariance/earlier-variance quantity is not exposed as autocorrelation; lagged Pearson correlation requires lagged covariance and both occasion-specific marginal variances. The lagged-correlation representability RED `c345ee7b8bdf642430669b7b0e1d7fc6873a84af` plus repair `5785e07a352801c193d92dde03863d0697a2853a` fail closed when a nonzero covariance would collapse to exact-zero binary64 correlation, while genuine zero covariance remains zero. -The lagged-correlation representability repair remains intact. RED `c345ee7b8bdf642430669b7b0e1d7fc6873a84af` pins finite inputs `cov=min_subnormal`, `Var_t=Var_t+Δ=f64::MAX`: the covariance satisfies the exact binary64 Cauchy–Schwarz bound, but the true standardized magnitude is below the smallest representable binary64 and the predecessor returned `Ok(0.0)`, falsely converting a nonzero association into exact no-association. Repair `5785e07a352801c193d92dde03863d0697a2853a` rejects that representability collapse as `InvalidTemporalAssociationInput` while preserving genuine zero covariance as `Ok(0.0)`. +The irregular-rate facade repair remains intact: RED refinement `4648638608436fb6c04315d96f59a6404e2e790b` requires a facade re-export rather than wrapper functions; repair `7f0bea0841fb89a6ce9bdd5b9f10c0e4612f4270` uses direct `pub use` of the canonical private-module function identities. The public names remain stable while there is one numerical implementation. -The current exact head `7f0bea0841fb89a6ce9bdd5b9f10c0e4612f4270` also removes a redundant public wrapper layer around the canonical irregular-rate implementation. An initial test commit `5697221872650f0327cbdf6db0a5020a07fe39e4` over-specified canonical visibility as `pub(crate)`; before production mutation, RED refinement `4648638608436fb6c04315d96f59a6404e2e790b` corrected the contract to preserve re-exportable canonical `pub fn` identities while forbidding facade wrapper `pub fn` declarations. Repair `7f0bea0841fb89a6ce9bdd5b9f10c0e4612f4270` replaces the wrappers with direct `pub use` re-exports. `lib.rs` retains the same crate-public names through `stable_irregular_rate`, so the API remains compatible while one function identity owns the numerical behavior. +The newest DDD finding was the architecture authority itself. `ARCHITECTURE.md` still assigned longitudinal invariance/DSEM/continuous-time paths to `psychometric_core` and carried multiple duplicate giant `psychometric_core` implementation responsibility rows mixing event-time composition, static psychometric formulas and evidence notes. Test-first commit `fe5eb7457f80e7724412102800ceaf5b9f70ec50` requires a distinct `longitudinal_modeling` conceptual owner, exactly one `longitudinal_core` and one `psychometric_core` implementation row, no temporal-composition claims in the psychometric row, and an explicit released fast-mlsirm ACL boundary. Repair `7fadc757987145cbcc39475b2bf3193e4a4fed59` deduplicates the topology, moves TEPP temporal composition/recovery authority to Longitudinal Modeling/`longitudinal_core`, narrows `psychometric_core` to measurement/legacy compatibility, and moves equation-level evidence authority back to TRACEABILITY/doctoring/research/source tests rather than the responsibility table. -The earlier stationary-overflow documentation repair remains intact. RED `9d8a82d78443cafc9b5064fc3bb35aa3f2052722` rejects the retired `(q / a) * -0.5` overflow instruction and requires `(q * 0.5) / |a|`; repair `9c962205dca26925c2e60d1e15ec4ce15681bbee` synchronizes `CLAUDE.md` with production `recover_stationary_within_variance` behavior. Earlier CWC, within/between, known-truth RMSE, irregular-rate zero-underflow, stationary-subnormal and exact covariance-bound lineages also remain on the same vehicle. +The stationary-overflow documentation repair remains intact: RED `9d8a82d78443cafc9b5064fc3bb35aa3f2052722` rejects the retired `(q / a) * -0.5` instruction and repair `9c962205dca26925c2e60d1e15ec4ce15681bbee` synchronizes `CLAUDE.md` with `(q * 0.5) / |a|`. Earlier CWC, within/between, known-truth RMSE, irregular-rate zero-underflow, stationary-subnormal and exact covariance-bound lineages remain on the same vehicle. -The current head is mergeable but remains Draft. Exact-head CodeQL PR run `33670670642` is `startup_failure`; Documentation Quality `33670668067`, SAST Semgrep `33670668039`, OSV-Scanner PR `33670669157`, Security Scan `33670667891`, Scorecard PR `33670667957`, and Rust Foundation CI `33670667997` are queued. There is no qualifying current-head independent approval. Source repair is complete, but protected-main integration waits for fresh exact-head GREEN evidence and review. +Current exact head `7fadc757987145cbcc39475b2bf3193e4a4fed59` is mergeable but Draft. CodeQL PR run `33671827919` is `startup_failure`; Documentation Quality `33671826338`, SAST Semgrep `33671825921`, OSV-Scanner PR `33671826791`, Security Scan `33671825942`, Scorecard PR `33671825944`, and Rust Foundation CI `33671826035` are queued. There is no qualifying current-head independent approval. Source repair does not substitute for hosted GREEN. -The CWC and within/between unit-mean helpers now agree on the material extreme-cancellation behavior but are still separate implementations. Consolidation remains a maintainability target only after their full error/estimand semantics are shown equivalent; a reusable domain-neutral arithmetic primitive belongs in fast-mlsirm rather than being copied across TEPP contexts. +The CWC and within/between unit-mean helpers still have separate implementations. Consolidation remains a maintainability target only after their full error/estimand semantics are shown equivalent; a reusable domain-neutral arithmetic primitive belongs in fast-mlsirm rather than being copied across TEPP contexts. ### #416 — Validation / Analysis Run consolidation -Current head `0b7155cc238defb1e55129ff3000658f04b343cf` centralizes the leakage-safe invariant established by RED `ffee655404716bf8d33c898a3c1a87a543abe701`: availability filtering occurs before duplicate-identity admission. #458/#460/#482/#483/#484/#485 remain fold children over shared Cargo/lib/lock/docs surfaces. Their unique evidence must reach a surviving #416 head before any child can be considered fully superseded. #485 was opened as an independent main-targeting profile despite the active WIP circuit breaker; fresh file-surface verification showed it touches the same Analysis Run integration files, so it was repaired by non-force retargeting to #416. +Current head `0b7155cc238defb1e55129ff3000658f04b343cf` centralizes the leakage-safe invariant established by RED `ffee655404716bf8d33c898a3c1a87a543abe701`: availability filtering occurs before duplicate-identity admission. #458/#460/#482/#483/#484/#485 remain fold children over shared Cargo/lib/lock/docs surfaces. Their unique evidence must reach a surviving #416 head before any child can be considered fully superseded. -### #480 / #479 — contextual-orchestrator boundary +### #480 — contextual-orchestrator boundary -#480 removes TEPP-owned provider discovery/ranking and requires HTTPS `contextual-orchestrator/orchestrator/free` from an immutable owner release. contextual-orchestrator protected `main@212ff437dc297613289dba2e6064ade9942e07d8` has **zero GitHub releases** at this snapshot. Mutable branch state is not a released contract. The consumer remains deliberately fail-closed. Owner issue #1023 remains open for authenticated release/deployment provenance and scoped/brokered authentication that does not expose a reusable long-lived gateway bearer token to model-controlled execution. +#480 removes TEPP-owned provider discovery/ranking and requires HTTPS `contextual-orchestrator/orchestrator/free` from an immutable owner release. contextual-orchestrator protected `main@212ff437dc297613289dba2e6064ade9942e07d8` has zero GitHub releases at this snapshot. Mutable branch state is not a released contract. The consumer remains deliberately fail-closed. Owner issue #1023 remains open for authenticated release/deployment provenance and scoped/brokered authentication that does not expose a reusable long-lived gateway bearer token to model-controlled execution. ### fast-mlsirm owner handoff -fast-mlsirm protected `main@b5a3a0c1057d4b53d7a4bb18e0de69f630c2b45c`. Immutable `v0.9.1` predates the current owner work. - -Generalized-mixed/dependence Published Language #1714 is open/Ready at `92a3f2152033b61ca89661b5ba8a584842e8c3a9`. Reusable static covariance-to-correlation standardization #1722 is open/Ready at `338dbb2d25f32b0e201102e7bf73076846fb57b3`. Dynamic evaluation criterion/item/run snapshots #1727 remain Draft at `17ac218a5c0a31f0082839603a8ffc64b4432534`; zero-anchor within-run work is explicit, while unsupported cross-version linking fails closed. None of these mutable owner heads is a TEPP production dependency. Temporal/EventTime admission and state composition remain TEPP-owned. +fast-mlsirm protected `main@b5a3a0c1057d4b53d7a4bb18e0de69f630c2b45c`. Immutable `v0.9.1` predates current owner work. Generalized-mixed/dependence Published Language #1714 is open/Ready at `92a3f2152033b61ca89661b5ba8a584842e8c3a9`; reusable static covariance-to-correlation standardization #1722 is open/Ready at `338dbb2d25f32b0e201102e7bf73076846fb57b3`; dynamic evaluation criterion/item/run snapshots #1727 remain Draft at `17ac218a5c0a31f0082839603a8ffc64b4432534`. None of these mutable owner heads is a TEPP production dependency. ### #437 — ADR identity @@ -99,7 +99,7 @@ Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/num ## External contract state -`context-graph-contracts` and `enterprise-architecture-core` remain read-only from this TEPP writer. Fresh state is CGC `develop@99cb5468ba3c15c5e79688f53dee74724fae2d13`, 14 open PR / 2 open issue / release 0, and EA Core `develop@1c0fa8b15ceb9e72186274aeb255d6777eb84ef4`, 24 open PR / 2 open issue / release 0. CGC #25 is still a Draft source-bound release-provenance prerequisite; EA #40 remains Draft/fail-closed against unreleased CGC evidence. Open heads are candidate evidence rather than production contracts. +`context-graph-contracts` and `enterprise-architecture-core` remain read-only from this TEPP writer. Fresh state is CGC `develop@99cb5468ba3c15c5e79688f53dee74724fae2d13`, 14 open PR / 2 open issues / release 0, and EA Core `develop@1c0fa8b15ceb9e72186274aeb255d6777eb84ef4`, 24 open PR / 2 open issues / release 0. Open heads remain candidate evidence rather than production contracts. ## Gap register @@ -124,8 +124,9 @@ Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/num | GAP-017 | dynamic evaluation item/rater/anchor drift monitoring | `owner-contract-active` | released/digest-pinned dynamic criterion/item/run contract, ACL conformance, no-anchor/no-linking refusal, evidence-gated temporal monitoring | | GAP-018 | Longitudinal stable-mean logic remains duplicated | `active-refactor` | semantic-equivalence proof, one TEPP Longitudinal primitive or released fast-mlsirm generic owner contract, recovery parity | | GAP-019 | Longitudinal scientific instructions contradict current stationary-overflow implementation | `verification-pending` | RED `9d8a82d...` + repair `9c962205...`; exact-head Documentation Quality/review GREEN and protected-main integration | -| GAP-020 | Nonzero lagged covariance can be misreported as exact-zero correlation when the standardized magnitude is unrepresentable | `verification-pending` | RED `c345ee7b...` + repair `5785e07a...`; exact-head Rust/documentation/review GREEN and protected-main integration | +| GAP-020 | Nonzero lagged covariance can be misreported as exact-zero correlation when standardized magnitude is unrepresentable | `verification-pending` | RED `c345ee7b...` + repair `5785e07a...`; exact-head Rust/documentation/review GREEN and protected-main integration | | GAP-021 | Longitudinal irregular-rate facade duplicated public wrapper function identities over one canonical implementation | `verification-pending` | RED refinement `464863860...` + repair `7f0bea084...`; exact-head Rust/documentation/review GREEN and protected-main integration | +| GAP-022 | Architecture assigned Longitudinal Modeling semantics to `psychometric_core` and duplicated implementation responsibility rows | `verification-pending` | RED `fe5eb745...` + repair `7fadc757...`; exact-head documentation/quality review GREEN and protected-main integration | ## Release gate From 3e3bbbdeed977a7fd70688833ab16f70c2386b60 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 3 Sep 2026 04:19:11 +0900 Subject: [PATCH 105/235] docs(owner): refresh dynamic evaluation dependency state --- docs/product-technical-gap-baseline.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 3f97e9e77..3f59ebaab 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -91,7 +91,7 @@ Current head `0b7155cc238defb1e55129ff3000658f04b343cf` centralizes the leakage- ### fast-mlsirm owner handoff -fast-mlsirm protected `main@b5a3a0c1057d4b53d7a4bb18e0de69f630c2b45c`. Immutable `v0.9.1` predates current owner work. Generalized-mixed/dependence Published Language #1714 is open/Ready at `92a3f2152033b61ca89661b5ba8a584842e8c3a9`; reusable static covariance-to-correlation standardization #1722 is open/Ready at `338dbb2d25f32b0e201102e7bf73076846fb57b3`; dynamic evaluation criterion/item/run snapshots #1727 remain Draft at `17ac218a5c0a31f0082839603a8ffc64b4432534`. None of these mutable owner heads is a TEPP production dependency. +fast-mlsirm protected `main@b5a3a0c1057d4b53d7a4bb18e0de69f630c2b45c`. Immutable `v0.9.1` predates current owner work. Generalized-mixed/dependence Published Language #1714 is open/Ready at `92a3f2152033b61ca89661b5ba8a584842e8c3a9`; reusable static covariance-to-correlation standardization #1722 is open/Ready at `338dbb2d25f32b0e201102e7bf73076846fb57b3`; dynamic evaluation criterion/item/run snapshots #1727 remain Draft at `850c2e28dadea3bc5ae936e88bc47f2ece871c1a`. None of these mutable owner heads is a TEPP production dependency. ### #437 — ADR identity From ff52638fd43b75fa798695e5f67f8047894ff99c Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 3 Sep 2026 04:33:08 +0900 Subject: [PATCH 106/235] docs: refresh queue and longitudinal repair evidence --- docs/product-technical-gap-baseline.md | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 3f59ebaab..a59552325 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,7 +4,7 @@ **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-02T19:15:00Z +**Snapshot:** 2026-09-02T19:30:00Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` @@ -42,7 +42,7 @@ A planning document, mergeable branch, local/source inspection, predecessor-head | #460 | `dfab4eab5ff733731e565a9348072b8dab2e4912` | true | #416 `feat/copy-identity-analysis-run-gap-004@0b7155cc238defb1e55129ff3000658f04b343cf` | Fold child; typed cutoff equality and terminal-validation separation preserved. | | #458 | `08165e3b3c929b4ae77396689549f72723ff8ff5` | true | #416 `feat/copy-identity-analysis-run-gap-004@0b7155cc238defb1e55129ff3000658f04b343cf` | Fold child; typed cutoff equality and terminal-validation separation preserved. | | #416 | `0b7155cc238defb1e55129ff3000658f04b343cf` | true | `main@1bc02f580cf48e1d39da239f0e818453437c31c3` | Validation / Analysis Run landing candidate; availability cutoff precedes duplicate-identity admission. | -| #310 | `7fadc757987145cbcc39475b2bf3193e4a4fed59` | true | `main@1bc02f580cf48e1d39da239f0e818453437c31c3` | Longitudinal Modeling vehicle; canonical irregular-rate function identity and DDD ownership/topology repairs are source-complete; exact-head hosted verification is pending. | +| #310 | `7164c7ce4a6ada24524399b0031171730a16a883` | true | `main@1bc02f580cf48e1d39da239f0e818453437c31c3` | Longitudinal Modeling vehicle; subnormal `discreteDIFFUSIONstd` intermediate-underflow repair plus DDD ownership/topology repair are source-complete; exact-head hosted verification is pending. | Exact-current-head evidence becomes stale after source mutation or any new commit. @@ -71,13 +71,15 @@ The clock contract separates event/valid time, assertion time, document time, sy Closed predecessor #441 is contained by #310. The invalid covariance/earlier-variance quantity is not exposed as autocorrelation; lagged Pearson correlation requires lagged covariance and both occasion-specific marginal variances. The lagged-correlation representability RED `c345ee7b8bdf642430669b7b0e1d7fc6873a84af` plus repair `5785e07a352801c193d92dde03863d0697a2853a` fail closed when a nonzero covariance would collapse to exact-zero binary64 correlation, while genuine zero covariance remains zero. +The newest numerical repair is the research-candidate scalar `discreteDIFFUSIONstd = 1 - exp(2 a Δt)` path. The predecessor formed `aΔt` first and rejected a signed-zero intermediate. At `a=-0.5` and the minimum positive binary64 event interval, `aΔt` rounds to `-0.0` even though the target `2aΔt` is exactly the minimum negative subnormal and the final standardized ratio is the representable minimum positive subnormal. RED `d5107b19817556c4c902408b51ed2bb8c8181d2c` pins that final-result contract. Repair `7164c7ce4a6ada24524399b0031171730a16a883` doubles the event interval first while finite and then forms the single rounded rate product; when `2Δt` overflows, the large-interval path computes `aΔt` before the exact factor two. It never forms `2a` first, preserves the extreme-interval unit limit, and fails closed only when the target exponent/final ratio itself is non-representable. + The irregular-rate facade repair remains intact: RED refinement `4648638608436fb6c04315d96f59a6404e2e790b` requires a facade re-export rather than wrapper functions; repair `7f0bea0841fb89a6ce9bdd5b9f10c0e4612f4270` uses direct `pub use` of the canonical private-module function identities. The public names remain stable while there is one numerical implementation. -The newest DDD finding was the architecture authority itself. `ARCHITECTURE.md` still assigned longitudinal invariance/DSEM/continuous-time paths to `psychometric_core` and carried multiple duplicate giant `psychometric_core` implementation responsibility rows mixing event-time composition, static psychometric formulas and evidence notes. Test-first commit `fe5eb7457f80e7724412102800ceaf5b9f70ec50` requires a distinct `longitudinal_modeling` conceptual owner, exactly one `longitudinal_core` and one `psychometric_core` implementation row, no temporal-composition claims in the psychometric row, and an explicit released fast-mlsirm ACL boundary. Repair `7fadc757987145cbcc39475b2bf3193e4a4fed59` deduplicates the topology, moves TEPP temporal composition/recovery authority to Longitudinal Modeling/`longitudinal_core`, narrows `psychometric_core` to measurement/legacy compatibility, and moves equation-level evidence authority back to TRACEABILITY/doctoring/research/source tests rather than the responsibility table. +The DDD architecture repair remains intact. Test-first commit `fe5eb7457f80e7724412102800ceaf5b9f70ec50` requires a distinct `longitudinal_modeling` conceptual owner, exactly one `longitudinal_core` and one `psychometric_core` implementation row, no temporal-composition claims in the psychometric row, and an explicit released fast-mlsirm ACL boundary. Repair `7fadc757987145cbcc39475b2bf3193e4a4fed59` deduplicates the topology, moves TEPP temporal composition/recovery authority to Longitudinal Modeling/`longitudinal_core`, narrows `psychometric_core` to measurement/legacy compatibility, and leaves equation-level evidence to TRACEABILITY/doctoring/research/source tests. The stationary-overflow documentation repair remains intact: RED `9d8a82d78443cafc9b5064fc3bb35aa3f2052722` rejects the retired `(q / a) * -0.5` instruction and repair `9c962205dca26925c2e60d1e15ec4ce15681bbee` synchronizes `CLAUDE.md` with `(q * 0.5) / |a|`. Earlier CWC, within/between, known-truth RMSE, irregular-rate zero-underflow, stationary-subnormal and exact covariance-bound lineages remain on the same vehicle. -Current exact head `7fadc757987145cbcc39475b2bf3193e4a4fed59` is mergeable but Draft. CodeQL PR run `33671827919` is `startup_failure`; Documentation Quality `33671826338`, SAST Semgrep `33671825921`, OSV-Scanner PR `33671826791`, Security Scan `33671825942`, Scorecard PR `33671825944`, and Rust Foundation CI `33671826035` are queued. There is no qualifying current-head independent approval. Source repair does not substitute for hosted GREEN. +Current exact head `7164c7ce4a6ada24524399b0031171730a16a883` is mergeable but Draft. CodeQL PR run `33673579329` is `startup_failure`; Rust Foundation CI, Documentation Quality, Security Scan, SAST Semgrep, OSV-Scanner PR and Scorecard PR are queued. There is no qualifying current-head independent approval. Source repair does not substitute for hosted GREEN. The CWC and within/between unit-mean helpers still have separate implementations. Consolidation remains a maintainability target only after their full error/estimand semantics are shown equivalent; a reusable domain-neutral arithmetic primitive belongs in fast-mlsirm rather than being copied across TEPP contexts. @@ -87,11 +89,11 @@ Current head `0b7155cc238defb1e55129ff3000658f04b343cf` centralizes the leakage- ### #480 — contextual-orchestrator boundary -#480 removes TEPP-owned provider discovery/ranking and requires HTTPS `contextual-orchestrator/orchestrator/free` from an immutable owner release. contextual-orchestrator protected `main@212ff437dc297613289dba2e6064ade9942e07d8` has zero GitHub releases at this snapshot. Mutable branch state is not a released contract. The consumer remains deliberately fail-closed. Owner issue #1023 remains open for authenticated release/deployment provenance and scoped/brokered authentication that does not expose a reusable long-lived gateway bearer token to model-controlled execution. +#480 removes TEPP-owned provider discovery/ranking and requires HTTPS `contextual-orchestrator/orchestrator/free` from an immutable owner release. contextual-orchestrator protected `main@212ff437dc297613289dba2e6064ade9942e07d8` had zero GitHub releases at the preceding snapshot. Mutable branch state is not a released contract. The consumer remains deliberately fail-closed. Owner issue #1023 remains open for authenticated release/deployment provenance and scoped/brokered authentication that does not expose a reusable long-lived gateway bearer token to model-controlled execution. ### fast-mlsirm owner handoff -fast-mlsirm protected `main@b5a3a0c1057d4b53d7a4bb18e0de69f630c2b45c`. Immutable `v0.9.1` predates current owner work. Generalized-mixed/dependence Published Language #1714 is open/Ready at `92a3f2152033b61ca89661b5ba8a584842e8c3a9`; reusable static covariance-to-correlation standardization #1722 is open/Ready at `338dbb2d25f32b0e201102e7bf73076846fb57b3`; dynamic evaluation criterion/item/run snapshots #1727 remain Draft at `850c2e28dadea3bc5ae936e88bc47f2ece871c1a`. None of these mutable owner heads is a TEPP production dependency. +fast-mlsirm protected `main@b5a3a0c1057d4b53d7a4bb18e0de69f630c2b45c` at the preceding snapshot. Immutable `v0.9.1` predates current owner work. Generalized-mixed/dependence Published Language #1714 was open/Ready at `92a3f2152033b61ca89661b5ba8a584842e8c3a9`; reusable static covariance-to-correlation standardization #1722 was open/Ready at `338dbb2d25f32b0e201102e7bf73076846fb57b3`; dynamic evaluation criterion/item/run snapshots #1727 remained Draft at `850c2e28dadea3bc5ae936e88bc47f2ece871c1a`. None of these mutable owner heads is a TEPP production dependency. ### #437 — ADR identity @@ -99,7 +101,7 @@ Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/num ## External contract state -`context-graph-contracts` and `enterprise-architecture-core` remain read-only from this TEPP writer. Fresh state is CGC `develop@99cb5468ba3c15c5e79688f53dee74724fae2d13`, 14 open PR / 2 open issues / release 0, and EA Core `develop@1c0fa8b15ceb9e72186274aeb255d6777eb84ef4`, 24 open PR / 2 open issues / release 0. Open heads remain candidate evidence rather than production contracts. +`context-graph-contracts` and `enterprise-architecture-core` remain read-only from this TEPP writer. Their preceding snapshot had CGC `develop@99cb5468ba3c15c5e79688f53dee74724fae2d13`, 14 open PR / 2 open issues / release 0, and EA Core `develop@1c0fa8b15ceb9e72186274aeb255d6777eb84ef4`, 24 open PR / 2 open issues / release 0. Open heads remain candidate evidence rather than production contracts and must be re-read before adoption. ## Gap register @@ -127,7 +129,8 @@ Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/num | GAP-020 | Nonzero lagged covariance can be misreported as exact-zero correlation when standardized magnitude is unrepresentable | `verification-pending` | RED `c345ee7b...` + repair `5785e07a...`; exact-head Rust/documentation/review GREEN and protected-main integration | | GAP-021 | Longitudinal irregular-rate facade duplicated public wrapper function identities over one canonical implementation | `verification-pending` | RED refinement `464863860...` + repair `7f0bea084...`; exact-head Rust/documentation/review GREEN and protected-main integration | | GAP-022 | Architecture assigned Longitudinal Modeling semantics to `psychometric_core` and duplicated implementation responsibility rows | `verification-pending` | RED `fe5eb745...` + repair `7fadc757...`; exact-head documentation/quality review GREEN and protected-main integration | +| GAP-023 | `discreteDIFFUSIONstd` rejected a representable subnormal final ratio because `aΔt` underflowed before the required factor two | `verification-pending` | RED `d5107b198...` + repair `7164c7ce4...`; exact-head Rust/documentation/review GREEN and protected-main integration | ## Release gate -TEPP currently has no GitHub release. Release is permitted only after a coherent vertical reaches protected main with exact protected-head CI/security/recovery evidence, reproducible package + SBOM + provenance + rollback artifacts, current version/CHANGELOG, required migration/restore/load evidence, and released integration contracts where deployment depends on them. Queued/pending/startup-failed/skipped or predecessor-head evidence is not GREEN. \ No newline at end of file +TEPP currently has no GitHub release. Release is permitted only after a coherent vertical reaches protected main with exact protected-head CI/security/recovery evidence, reproducible package + SBOM + provenance + rollback artifacts, current version/CHANGELOG, required migration/restore/load evidence, and released integration contracts where deployment depends on them. Queued/pending/startup-failed/skipped or predecessor-head evidence is not GREEN. From 384134f7b3b656d36133fc2e0aa5313555969846 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 3 Sep 2026 05:08:14 +0900 Subject: [PATCH 107/235] docs(gap): sync released-orchestrator contributor authority --- docs/product-technical-gap-baseline.md | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index a59552325..80eae28d3 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,7 +4,7 @@ **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-02T19:30:00Z +**Snapshot:** 2026-09-02T20:06:00Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` @@ -38,7 +38,7 @@ A planning document, mergeable branch, local/source inspection, predecessor-head | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 `feat/copy-identity-analysis-run-gap-004@0b7155cc238defb1e55129ff3000658f04b343cf` | Analysis Run fold child; preserve profile-specific source/tests/doctoring. | | #483 | `847d96f913bb261803ac0bd751ad7e4f51324cee` | true | #416 `feat/copy-identity-analysis-run-gap-004@0b7155cc238defb1e55129ff3000658f04b343cf` | Analysis Run fold child; preserve unique evidence. | | #482 | `506dbae236a4484301b704b6c6a05b20faf0fe69` | true | #416 `feat/copy-identity-analysis-run-gap-004@0b7155cc238defb1e55129ff3000658f04b343cf` | Analysis Run fold child; preserve unique evidence. | -| #480 | `4475542750eda01afad0cf9ea8d563f508f63fd3` | false | `main@1bc02f580cf48e1d39da239f0e818453437c31c3` | Independent consumer-side LLM-governance repair; released CO plus deployment/auth provenance required. | +| #480 | `01f45a99392457334a4f6d3d659f992af739eeee` | false | `main@1bc02f580cf48e1d39da239f0e818453437c31c3` | Independent LLM-consumer governance repair; contributor guidance now obeys released-owner routing, but immutable CO deployment identity/auth provenance remains owner-blocked. | | #460 | `dfab4eab5ff733731e565a9348072b8dab2e4912` | true | #416 `feat/copy-identity-analysis-run-gap-004@0b7155cc238defb1e55129ff3000658f04b343cf` | Fold child; typed cutoff equality and terminal-validation separation preserved. | | #458 | `08165e3b3c929b4ae77396689549f72723ff8ff5` | true | #416 `feat/copy-identity-analysis-run-gap-004@0b7155cc238defb1e55129ff3000658f04b343cf` | Fold child; typed cutoff equality and terminal-validation separation preserved. | | #416 | `0b7155cc238defb1e55129ff3000658f04b343cf` | true | `main@1bc02f580cf48e1d39da239f0e818453437c31c3` | Validation / Analysis Run landing candidate; availability cutoff precedes duplicate-identity admission. | @@ -89,7 +89,9 @@ Current head `0b7155cc238defb1e55129ff3000658f04b343cf` centralizes the leakage- ### #480 — contextual-orchestrator boundary -#480 removes TEPP-owned provider discovery/ranking and requires HTTPS `contextual-orchestrator/orchestrator/free` from an immutable owner release. contextual-orchestrator protected `main@212ff437dc297613289dba2e6064ade9942e07d8` had zero GitHub releases at the preceding snapshot. Mutable branch state is not a released contract. The consumer remains deliberately fail-closed. Owner issue #1023 remains open for authenticated release/deployment provenance and scoped/brokered authentication that does not expose a reusable long-lived gateway bearer token to model-controlled execution. +#480 removes TEPP-owned provider discovery/ranking and requires HTTPS `contextual-orchestrator/orchestrator/free` from an immutable owner release. Fresh review found one remaining TEPP-side authority drift: `CONTRIBUTING.md` still told contributors to use `NVIDIA_NIM_API_KEY` directly. RED `4248b3351a2cdfd37666696daf189d4389f8bcb1` adds that guide to the canonical owner-policy fitness contract; repair `01f45a99392457334a4f6d3d659f992af739eeee` removes direct provider credential/routing guidance and records provider/model identity only as orchestrator-returned provenance. + +contextual-orchestrator protected `main@212ff437dc297613289dba2e6064ade9942e07d8` still has zero GitHub releases. Mutable branch state is not a released contract. Owner issue #1023 remains open for authenticated release/deployment provenance and scoped/ephemeral or brokered authentication that does not expose a reusable long-lived gateway bearer token to model-controlled execution. Exact-head #480 evidence is non-GREEN: CodeQL PR is `startup_failure`; Documentation Quality, Security Scan, Rust Foundation CI, OSV-Scanner PR and Scorecard PR are queued; SAST Semgrep is pending. The consumer remains deliberately fail-closed and has no qualifying independent current-head approval. ### fast-mlsirm owner handoff @@ -130,7 +132,8 @@ Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/num | GAP-021 | Longitudinal irregular-rate facade duplicated public wrapper function identities over one canonical implementation | `verification-pending` | RED refinement `464863860...` + repair `7f0bea084...`; exact-head Rust/documentation/review GREEN and protected-main integration | | GAP-022 | Architecture assigned Longitudinal Modeling semantics to `psychometric_core` and duplicated implementation responsibility rows | `verification-pending` | RED `fe5eb745...` + repair `7fadc757...`; exact-head documentation/quality review GREEN and protected-main integration | | GAP-023 | `discreteDIFFUSIONstd` rejected a representable subnormal final ratio because `aΔt` underflowed before the required factor two | `verification-pending` | RED `d5107b198...` + repair `7164c7ce4...`; exact-head Rust/documentation/review GREEN and protected-main integration | +| GAP-024 | Contributor guidance re-authorized a direct provider credential after canonical LLM ownership moved to contextual-orchestrator | `verification-pending` | RED `4248b335...` + repair `01f45a993...`; exact-head documentation/security/review GREEN, released CO adoption and protected-main integration | ## Release gate -TEPP currently has no GitHub release. Release is permitted only after a coherent vertical reaches protected main with exact protected-head CI/security/recovery evidence, reproducible package + SBOM + provenance + rollback artifacts, current version/CHANGELOG, required migration/restore/load evidence, and released integration contracts where deployment depends on them. Queued/pending/startup-failed/skipped or predecessor-head evidence is not GREEN. +TEPP currently has no GitHub release. Release is permitted only after a coherent vertical reaches protected main with exact protected-head CI/security/recovery evidence, reproducible package + SBOM + provenance + rollback artifacts, current version/CHANGELOG, required migration/restore/load evidence, and released integration contracts where deployment depends on them. Queued/pending/startup-failed/skipped or predecessor-head evidence is not GREEN. \ No newline at end of file From b1dbacf7576cb236106f1b3f5c247a821e98535b Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 3 Sep 2026 05:18:05 +0900 Subject: [PATCH 108/235] docs(gap): record repeated-unit CWC admission repair --- docs/product-technical-gap-baseline.md | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 80eae28d3..05933ebc1 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,7 +4,7 @@ **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-02T20:06:00Z +**Snapshot:** 2026-09-02T20:18:00Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` @@ -42,7 +42,7 @@ A planning document, mergeable branch, local/source inspection, predecessor-head | #460 | `dfab4eab5ff733731e565a9348072b8dab2e4912` | true | #416 `feat/copy-identity-analysis-run-gap-004@0b7155cc238defb1e55129ff3000658f04b343cf` | Fold child; typed cutoff equality and terminal-validation separation preserved. | | #458 | `08165e3b3c929b4ae77396689549f72723ff8ff5` | true | #416 `feat/copy-identity-analysis-run-gap-004@0b7155cc238defb1e55129ff3000658f04b343cf` | Fold child; typed cutoff equality and terminal-validation separation preserved. | | #416 | `0b7155cc238defb1e55129ff3000658f04b343cf` | true | `main@1bc02f580cf48e1d39da239f0e818453437c31c3` | Validation / Analysis Run landing candidate; availability cutoff precedes duplicate-identity admission. | -| #310 | `7164c7ce4a6ada24524399b0031171730a16a883` | true | `main@1bc02f580cf48e1d39da239f0e818453437c31c3` | Longitudinal Modeling vehicle; subnormal `discreteDIFFUSIONstd` intermediate-underflow repair plus DDD ownership/topology repair are source-complete; exact-head hosted verification is pending. | +| #310 | `4784b370c464c3de74661124c594b8b89b9b917e` | true | `main@1bc02f580cf48e1d39da239f0e818453437c31c3` | Longitudinal Modeling vehicle; repeated-unit CWC admission, subnormal diffusion standardisation and DDD ownership repairs are source-complete; exact-head hosted verification is pending. | Exact-current-head evidence becomes stale after source mutation or any new commit. @@ -60,6 +60,7 @@ The clock contract separates event/valid time, assertion time, document time, sy - Rasch remains distinct from generic 1PL; formulation-qualified 2PLM–5PLM, MIRT, ideal-point/GGUM, testlet/rater/facet/generalized-mixed identity is preserved. - Cross-classification and multiple membership remain distinct; weights are explicit, auditable, time-valid and observed-normalized or model-estimated according to formulation. +- A nominal unit identifier is not repeated-measures evidence: multilevel/within-unit temporal acceptance must preserve the actual number of units contributing repeated event-time observations and may not let singleton units satisfy a longitudinal unit floor. - TEPP composes time over the full released upstream candidate identity; auto-expansion never means auto-activation. - Supported temporal estimators require state/trajectory and claimed-structure recovery, bias/RMSE, interval coverage, convergence, uncertainty calibration and leakage-safe rolling-origin evidence. - CPU/GPU parity counts only when the relevant accelerator path actually runs. Monte Carlo decisions use simulation uncertainty rather than arbitrary pass percentages. @@ -71,7 +72,9 @@ The clock contract separates event/valid time, assertion time, document time, sy Closed predecessor #441 is contained by #310. The invalid covariance/earlier-variance quantity is not exposed as autocorrelation; lagged Pearson correlation requires lagged covariance and both occasion-specific marginal variances. The lagged-correlation representability RED `c345ee7b8bdf642430669b7b0e1d7fc6873a84af` plus repair `5785e07a352801c193d92dde03863d0697a2853a` fail closed when a nonzero covariance would collapse to exact-zero binary64 correlation, while genuine zero covariance remains zero. -The newest numerical repair is the research-candidate scalar `discreteDIFFUSIONstd = 1 - exp(2 a Δt)` path. The predecessor formed `aΔt` first and rejected a signed-zero intermediate. At `a=-0.5` and the minimum positive binary64 event interval, `aΔt` rounds to `-0.0` even though the target `2aΔt` is exactly the minimum negative subnormal and the final standardized ratio is the representable minimum positive subnormal. RED `d5107b19817556c4c902408b51ed2bb8c8181d2c` pins that final-result contract. Repair `7164c7ce4a6ada24524399b0031171730a16a883` doubles the event interval first while finite and then forms the single rounded rate product; when `2Δt` overflows, the large-interval path computes `aΔt` before the exact factor two. It never forms `2a` first, preserves the extreme-interval unit limit, and fails closed only when the target exponent/final ratio itself is non-representable. +Fresh CWC review exposed an atomistic-fallacy admission defect. `center_within_unit_event_lags` previously accepted `groups.len() >= 2` before singleton groups were skipped, allowing one unit with repeated occasions plus one singleton identifier to return longitudinal lag evidence from only one contributing unit. RED `671709bbc6cdf1090e16c1d8f6c9f2b4f8b2d831` requires both public centering and recovery to reject that fixture. Repair `4784b370c464c3de74661124c594b8b89b9b917e` counts only groups with at least two event-time observations toward the two-unit longitudinal floor; singleton groups may remain present but cannot satisfy repeated-measures evidence. Rustdoc and the old in-module singleton expectation now state the same contract. + +The preceding numerical repair is the research-candidate scalar `discreteDIFFUSIONstd = 1 - exp(2 a Δt)` path. The predecessor formed `aΔt` first and rejected a signed-zero intermediate. At `a=-0.5` and the minimum positive binary64 event interval, `aΔt` rounds to `-0.0` even though the target `2aΔt` is exactly the minimum negative subnormal and the final standardized ratio is the representable minimum positive subnormal. RED `d5107b19817556c4c902408b51ed2bb8c8181d2c` pins that final-result contract. Repair `7164c7ce4a6ada24524399b0031171730a16a883` doubles the event interval first while finite and then forms the single rounded rate product; when `2Δt` overflows, the large-interval path computes `aΔt` before the exact factor two. It never forms `2a` first, preserves the extreme-interval unit limit, and fails closed only when the target exponent/final ratio itself is non-representable. The irregular-rate facade repair remains intact: RED refinement `4648638608436fb6c04315d96f59a6404e2e790b` requires a facade re-export rather than wrapper functions; repair `7f0bea0841fb89a6ce9bdd5b9f10c0e4612f4270` uses direct `pub use` of the canonical private-module function identities. The public names remain stable while there is one numerical implementation. @@ -79,7 +82,7 @@ The DDD architecture repair remains intact. Test-first commit `fe5eb7457f80e7724 The stationary-overflow documentation repair remains intact: RED `9d8a82d78443cafc9b5064fc3bb35aa3f2052722` rejects the retired `(q / a) * -0.5` instruction and repair `9c962205dca26925c2e60d1e15ec4ce15681bbee` synchronizes `CLAUDE.md` with `(q * 0.5) / |a|`. Earlier CWC, within/between, known-truth RMSE, irregular-rate zero-underflow, stationary-subnormal and exact covariance-bound lineages remain on the same vehicle. -Current exact head `7164c7ce4a6ada24524399b0031171730a16a883` is mergeable but Draft. CodeQL PR run `33673579329` is `startup_failure`; Rust Foundation CI, Documentation Quality, Security Scan, SAST Semgrep, OSV-Scanner PR and Scorecard PR are queued. There is no qualifying current-head independent approval. Source repair does not substitute for hosted GREEN. +Current exact head `4784b370c464c3de74661124c594b8b89b9b917e` is mergeable but Draft. CodeQL PR run `33678257146` is `startup_failure`; Rust Foundation CI, Documentation Quality, Security Scan, SAST Semgrep, OSV-Scanner PR and Scorecard PR are queued. There is no qualifying current-head independent approval. Source repair does not substitute for hosted GREEN. The CWC and within/between unit-mean helpers still have separate implementations. Consolidation remains a maintainability target only after their full error/estimand semantics are shown equivalent; a reusable domain-neutral arithmetic primitive belongs in fast-mlsirm rather than being copied across TEPP contexts. @@ -95,7 +98,7 @@ contextual-orchestrator protected `main@212ff437dc297613289dba2e6064ade9942e07d8 ### fast-mlsirm owner handoff -fast-mlsirm protected `main@b5a3a0c1057d4b53d7a4bb18e0de69f630c2b45c` at the preceding snapshot. Immutable `v0.9.1` predates current owner work. Generalized-mixed/dependence Published Language #1714 was open/Ready at `92a3f2152033b61ca89661b5ba8a584842e8c3a9`; reusable static covariance-to-correlation standardization #1722 was open/Ready at `338dbb2d25f32b0e201102e7bf73076846fb57b3`; dynamic evaluation criterion/item/run snapshots #1727 remained Draft at `850c2e28dadea3bc5ae936e88bc47f2ece871c1a`. None of these mutable owner heads is a TEPP production dependency. +fast-mlsirm protected `main@b5a3a0c1057d4b53d7a4bb18e0de69f630c2b45c` at the current owner snapshot. Immutable `v0.9.1` predates current owner work. Generalized-mixed/dependence Published Language #1714 is open/Ready at `92a3f2152033b61ca89661b5ba8a584842e8c3a9`; current CI/security evidence remains non-passing. None of these mutable owner heads is a TEPP production dependency. ### #437 — ADR identity @@ -103,7 +106,7 @@ Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/num ## External contract state -`context-graph-contracts` and `enterprise-architecture-core` remain read-only from this TEPP writer. Their preceding snapshot had CGC `develop@99cb5468ba3c15c5e79688f53dee74724fae2d13`, 14 open PR / 2 open issues / release 0, and EA Core `develop@1c0fa8b15ceb9e72186274aeb255d6777eb84ef4`, 24 open PR / 2 open issues / release 0. Open heads remain candidate evidence rather than production contracts and must be re-read before adoption. +`context-graph-contracts` and `enterprise-architecture-core` remain read-only from this TEPP writer. Fresh state has CGC `develop@99cb5468ba3c15c5e79688f53dee74724fae2d13`, 14 open PR and release 0; EA Core `develop@1c0fa8b15ceb9e72186274aeb255d6777eb84ef4`, 24 open PR and release 0. Open heads remain candidate evidence rather than production contracts and must be re-read before adoption. ## Gap register @@ -133,6 +136,7 @@ Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/num | GAP-022 | Architecture assigned Longitudinal Modeling semantics to `psychometric_core` and duplicated implementation responsibility rows | `verification-pending` | RED `fe5eb745...` + repair `7fadc757...`; exact-head documentation/quality review GREEN and protected-main integration | | GAP-023 | `discreteDIFFUSIONstd` rejected a representable subnormal final ratio because `aΔt` underflowed before the required factor two | `verification-pending` | RED `d5107b198...` + repair `7164c7ce4...`; exact-head Rust/documentation/review GREEN and protected-main integration | | GAP-024 | Contributor guidance re-authorized a direct provider credential after canonical LLM ownership moved to contextual-orchestrator | `verification-pending` | RED `4248b335...` + repair `01f45a993...`; exact-head documentation/security/review GREEN, released CO adoption and protected-main integration | +| GAP-025 | A singleton unit could satisfy the nominal CWC unit floor while all longitudinal lag evidence came from one repeated unit | `verification-pending` | RED `671709bbc...` + repair `4784b370c...`; exact-head Rust/documentation/review GREEN and protected-main integration | ## Release gate From 807b4950f4086bea39d0bfab49b9d060254bc52b Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 3 Sep 2026 05:43:46 +0900 Subject: [PATCH 109/235] docs(gap): record cancelled-stationary standardisation repair --- docs/product-technical-gap-baseline.md | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 05933ebc1..03ab93d23 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,7 +4,7 @@ **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-02T20:18:00Z +**Snapshot:** 2026-09-02T20:42:00Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` @@ -42,7 +42,7 @@ A planning document, mergeable branch, local/source inspection, predecessor-head | #460 | `dfab4eab5ff733731e565a9348072b8dab2e4912` | true | #416 `feat/copy-identity-analysis-run-gap-004@0b7155cc238defb1e55129ff3000658f04b343cf` | Fold child; typed cutoff equality and terminal-validation separation preserved. | | #458 | `08165e3b3c929b4ae77396689549f72723ff8ff5` | true | #416 `feat/copy-identity-analysis-run-gap-004@0b7155cc238defb1e55129ff3000658f04b343cf` | Fold child; typed cutoff equality and terminal-validation separation preserved. | | #416 | `0b7155cc238defb1e55129ff3000658f04b343cf` | true | `main@1bc02f580cf48e1d39da239f0e818453437c31c3` | Validation / Analysis Run landing candidate; availability cutoff precedes duplicate-identity admission. | -| #310 | `4784b370c464c3de74661124c594b8b89b9b917e` | true | `main@1bc02f580cf48e1d39da239f0e818453437c31c3` | Longitudinal Modeling vehicle; repeated-unit CWC admission, subnormal diffusion standardisation and DDD ownership repairs are source-complete; exact-head hosted verification is pending. | +| #310 | `37b78ce15b93cb25e6307df445e58e3d3bf48954` | true | `main@1bc02f580cf48e1d39da239f0e818453437c31c3` | Longitudinal Modeling vehicle; standardized scalar maps no longer materialize a cancelled stationary-variance intermediate; exact-head hosted verification is pending. | Exact-current-head evidence becomes stale after source mutation or any new commit. @@ -72,7 +72,9 @@ The clock contract separates event/valid time, assertion time, document time, sy Closed predecessor #441 is contained by #310. The invalid covariance/earlier-variance quantity is not exposed as autocorrelation; lagged Pearson correlation requires lagged covariance and both occasion-specific marginal variances. The lagged-correlation representability RED `c345ee7b8bdf642430669b7b0e1d7fc6873a84af` plus repair `5785e07a352801c193d92dde03863d0697a2853a` fail closed when a nonzero covariance would collapse to exact-zero binary64 correlation, while genuine zero covariance remains zero. -Fresh CWC review exposed an atomistic-fallacy admission defect. `center_within_unit_event_lags` previously accepted `groups.len() >= 2` before singleton groups were skipped, allowing one unit with repeated occasions plus one singleton identifier to return longitudinal lag evidence from only one contributing unit. RED `671709bbc6cdf1090e16c1d8f6c9f2b4f8b2d831` requires both public centering and recovery to reject that fixture. Repair `4784b370c464c3de74661124c594b8b89b9b917e` counts only groups with at least two event-time observations toward the two-unit longitudinal floor; singleton groups may remain present but cannot satisfy repeated-measures evidence. Rustdoc and the old in-module singleton expectation now state the same contract. +Fresh review exposed a distinct standardized-map representability defect. `discreteDRIFTstd`, research-candidate `DIFFUSIONstd`, and research-candidate `discreteDIFFUSIONstd` materialized `p = q / (-2a)` as binary64 merely to prove stationarity, even though `p` cancels algebraically from those scalar standardized maps. Thus `q = min-subnormal, a=-1` rejected a representable `exp(-1)`/`-2a`/`1-exp(-2)` result because positive real `p` lay below binary64 range, while `q = MAX, a=-0.25` rejected finite standardized results because positive real `p` lay above binary64 range. RED `4a1f6c49847fd32c6129c9ceb7c46abd124b29ff` pins the drift cases and RED `96d8ed134a45aaaf31f76bed1d363859ad5946d0` pins both diffusion-standardisation cases. Repair `a4bc6230b414a3f47eba190ac5dabeb27446d3c2` separates finite/stable stationary-process admission from actual `p` materialization; `recover_stationary_within_variance` still requires representable `p` when `p` itself is requested. Repair `33f4b187f833cdf97dce3f4f9bcb1aa7afdf1aed` applies algebraic stationarity admission to `discreteDRIFTstd` and also refuses a nonzero stable transition that rounds to false `1.0`. Repair `26b03c328941851984c257b48efe6ffd08a24396` applies the same boundary to the diffusion candidates. PRD `c88810dc1f7b1291b5ced8f5d4ffd92eb9f524c3` and ADR `37b78ce15b93cb25e6307df445e58e3d3bf48954` record the distinction between positive real stationarity, an actually requested stationary-variance estimand, and a cancelled intermediate. + +Fresh CWC review previously exposed an atomistic-fallacy admission defect. `center_within_unit_event_lags` accepted `groups.len() >= 2` before singleton groups were skipped, allowing one unit with repeated occasions plus one singleton identifier to return longitudinal lag evidence from only one contributing unit. RED `671709bbc6cdf1090e16c1d8f6c9f2b4f8b2d831` requires both public centering and recovery to reject that fixture. Repair `4784b370c464c3de74661124c594b8b89b9b917e` counts only groups with at least two event-time observations toward the two-unit longitudinal floor; singleton groups may remain present but cannot satisfy repeated-measures evidence. Rustdoc and the old in-module singleton expectation state the same contract. The preceding numerical repair is the research-candidate scalar `discreteDIFFUSIONstd = 1 - exp(2 a Δt)` path. The predecessor formed `aΔt` first and rejected a signed-zero intermediate. At `a=-0.5` and the minimum positive binary64 event interval, `aΔt` rounds to `-0.0` even though the target `2aΔt` is exactly the minimum negative subnormal and the final standardized ratio is the representable minimum positive subnormal. RED `d5107b19817556c4c902408b51ed2bb8c8181d2c` pins that final-result contract. Repair `7164c7ce4a6ada24524399b0031171730a16a883` doubles the event interval first while finite and then forms the single rounded rate product; when `2Δt` overflows, the large-interval path computes `aΔt` before the exact factor two. It never forms `2a` first, preserves the extreme-interval unit limit, and fails closed only when the target exponent/final ratio itself is non-representable. @@ -82,7 +84,7 @@ The DDD architecture repair remains intact. Test-first commit `fe5eb7457f80e7724 The stationary-overflow documentation repair remains intact: RED `9d8a82d78443cafc9b5064fc3bb35aa3f2052722` rejects the retired `(q / a) * -0.5` instruction and repair `9c962205dca26925c2e60d1e15ec4ce15681bbee` synchronizes `CLAUDE.md` with `(q * 0.5) / |a|`. Earlier CWC, within/between, known-truth RMSE, irregular-rate zero-underflow, stationary-subnormal and exact covariance-bound lineages remain on the same vehicle. -Current exact head `4784b370c464c3de74661124c594b8b89b9b917e` is mergeable but Draft. CodeQL PR run `33678257146` is `startup_failure`; Rust Foundation CI, Documentation Quality, Security Scan, SAST Semgrep, OSV-Scanner PR and Scorecard PR are queued. There is no qualifying current-head independent approval. Source repair does not substitute for hosted GREEN. +Current exact head `37b78ce15b93cb25e6307df445e58e3d3bf48954` is mergeable but Draft. CodeQL PR run `33680645982` is `startup_failure`; Rust Foundation CI and Scorecard PR are pending; Documentation Quality, Security Scan, SAST Semgrep and OSV-Scanner PR are queued. There is no qualifying current-head independent approval. All visible review threads are resolved. Source repair does not substitute for hosted GREEN. The CWC and within/between unit-mean helpers still have separate implementations. Consolidation remains a maintainability target only after their full error/estimand semantics are shown equivalent; a reusable domain-neutral arithmetic primitive belongs in fast-mlsirm rather than being copied across TEPP contexts. @@ -137,7 +139,8 @@ Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/num | GAP-023 | `discreteDIFFUSIONstd` rejected a representable subnormal final ratio because `aΔt` underflowed before the required factor two | `verification-pending` | RED `d5107b198...` + repair `7164c7ce4...`; exact-head Rust/documentation/review GREEN and protected-main integration | | GAP-024 | Contributor guidance re-authorized a direct provider credential after canonical LLM ownership moved to contextual-orchestrator | `verification-pending` | RED `4248b335...` + repair `01f45a993...`; exact-head documentation/security/review GREEN, released CO adoption and protected-main integration | | GAP-025 | A singleton unit could satisfy the nominal CWC unit floor while all longitudinal lag evidence came from one repeated unit | `verification-pending` | RED `671709bbc...` + repair `4784b370c...`; exact-head Rust/documentation/review GREEN and protected-main integration | +| GAP-026 | Scalar standardized longitudinal maps rejected representable final values when a cancelled stationary-variance intermediate lay outside binary64 range | `verification-pending` | RED `4a1f6c49...` / `96d8ed13...` + repairs `a4bc6230...` / `33f4b187...` / `26b03c32...`; PRD/ADR sync and exact-head Rust/documentation/review GREEN plus protected-main integration | ## Release gate -TEPP currently has no GitHub release. Release is permitted only after a coherent vertical reaches protected main with exact protected-head CI/security/recovery evidence, reproducible package + SBOM + provenance + rollback artifacts, current version/CHANGELOG, required migration/restore/load evidence, and released integration contracts where deployment depends on them. Queued/pending/startup-failed/skipped or predecessor-head evidence is not GREEN. \ No newline at end of file +TEPP currently has no GitHub release. Release is permitted only after a coherent vertical reaches protected main with exact protected-head CI/security/recovery evidence, reproducible package + SBOM + provenance + rollback artifacts, current version/CHANGELOG, required migration/restore/load evidence, and released integration contracts where deployment depends on them. Queued/pending/startup-failed/skipped or predecessor-head evidence is not GREEN. From 2fdec2e330b9cc3727670e5765c37f435847fcbf Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 3 Sep 2026 05:47:22 +0900 Subject: [PATCH 110/235] docs(gap): record discrete diffusion endpoint repair --- docs/product-technical-gap-baseline.md | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 03ab93d23..c4b9304de 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,7 +4,7 @@ **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-02T20:42:00Z +**Snapshot:** 2026-09-02T20:47:00Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` @@ -42,7 +42,7 @@ A planning document, mergeable branch, local/source inspection, predecessor-head | #460 | `dfab4eab5ff733731e565a9348072b8dab2e4912` | true | #416 `feat/copy-identity-analysis-run-gap-004@0b7155cc238defb1e55129ff3000658f04b343cf` | Fold child; typed cutoff equality and terminal-validation separation preserved. | | #458 | `08165e3b3c929b4ae77396689549f72723ff8ff5` | true | #416 `feat/copy-identity-analysis-run-gap-004@0b7155cc238defb1e55129ff3000658f04b343cf` | Fold child; typed cutoff equality and terminal-validation separation preserved. | | #416 | `0b7155cc238defb1e55129ff3000658f04b343cf` | true | `main@1bc02f580cf48e1d39da239f0e818453437c31c3` | Validation / Analysis Run landing candidate; availability cutoff precedes duplicate-identity admission. | -| #310 | `37b78ce15b93cb25e6307df445e58e3d3bf48954` | true | `main@1bc02f580cf48e1d39da239f0e818453437c31c3` | Longitudinal Modeling vehicle; standardized scalar maps no longer materialize a cancelled stationary-variance intermediate; exact-head hosted verification is pending. | +| #310 | `c17e2ff87fa8ed6464ca07152770c149573d55a6` | true | `main@1bc02f580cf48e1d39da239f0e818453437c31c3` | Longitudinal Modeling vehicle; cancelled stationary intermediates no longer reject representable standardized maps and finite-interval diffusion candidates refuse false zero/one endpoints; exact-head hosted verification is pending. | Exact-current-head evidence becomes stale after source mutation or any new commit. @@ -72,11 +72,13 @@ The clock contract separates event/valid time, assertion time, document time, sy Closed predecessor #441 is contained by #310. The invalid covariance/earlier-variance quantity is not exposed as autocorrelation; lagged Pearson correlation requires lagged covariance and both occasion-specific marginal variances. The lagged-correlation representability RED `c345ee7b8bdf642430669b7b0e1d7fc6873a84af` plus repair `5785e07a352801c193d92dde03863d0697a2853a` fail closed when a nonzero covariance would collapse to exact-zero binary64 correlation, while genuine zero covariance remains zero. -Fresh review exposed a distinct standardized-map representability defect. `discreteDRIFTstd`, research-candidate `DIFFUSIONstd`, and research-candidate `discreteDIFFUSIONstd` materialized `p = q / (-2a)` as binary64 merely to prove stationarity, even though `p` cancels algebraically from those scalar standardized maps. Thus `q = min-subnormal, a=-1` rejected a representable `exp(-1)`/`-2a`/`1-exp(-2)` result because positive real `p` lay below binary64 range, while `q = MAX, a=-0.25` rejected finite standardized results because positive real `p` lay above binary64 range. RED `4a1f6c49847fd32c6129c9ceb7c46abd124b29ff` pins the drift cases and RED `96d8ed134a45aaaf31f76bed1d363859ad5946d0` pins both diffusion-standardisation cases. Repair `a4bc6230b414a3f47eba190ac5dabeb27446d3c2` separates finite/stable stationary-process admission from actual `p` materialization; `recover_stationary_within_variance` still requires representable `p` when `p` itself is requested. Repair `33f4b187f833cdf97dce3f4f9bcb1aa7afdf1aed` applies algebraic stationarity admission to `discreteDRIFTstd` and also refuses a nonzero stable transition that rounds to false `1.0`. Repair `26b03c328941851984c257b48efe6ffd08a24396` applies the same boundary to the diffusion candidates. PRD `c88810dc1f7b1291b5ced8f5d4ffd92eb9f524c3` and ADR `37b78ce15b93cb25e6307df445e58e3d3bf48954` record the distinction between positive real stationarity, an actually requested stationary-variance estimand, and a cancelled intermediate. +Fresh review exposed a standardized-map representability defect. `discreteDRIFTstd`, research-candidate `DIFFUSIONstd`, and research-candidate `discreteDIFFUSIONstd` materialized `p = q / (-2a)` as binary64 merely to prove stationarity, even though `p` cancels algebraically from those scalar standardized maps. Thus `q = min-subnormal, a=-1` rejected a representable `exp(-1)`/`-2a`/`1-exp(-2)` result because positive real `p` lay below binary64 range, while `q = MAX, a=-0.25` rejected finite standardized results because positive real `p` lay above binary64 range. RED `4a1f6c49847fd32c6129c9ceb7c46abd124b29ff` pins the drift cases and RED `96d8ed134a45aaaf31f76bed1d363859ad5946d0` pins both diffusion-standardisation cases. Repair `a4bc6230b414a3f47eba190ac5dabeb27446d3c2` separates finite/stable stationary-process admission from actual `p` materialization; `recover_stationary_within_variance` still requires representable `p` when `p` itself is requested. Repair `33f4b187f833cdf97dce3f4f9bcb1aa7afdf1aed` applies algebraic stationarity admission to `discreteDRIFTstd` and refuses a nonzero stable transition that rounds to false `1.0`. Repair `26b03c328941851984c257b48efe6ffd08a24396` applies the same stationarity boundary to the diffusion candidates. PRD `c88810dc1f7b1291b5ced8f5d4ffd92eb9f524c3` and ADR `37b78ce15b93cb25e6307df445e58e3d3bf48954` record the distinction between positive real stationarity, an actually requested stationary-variance estimand, and a cancelled intermediate. + +The same review exposed an opposite-edge endpoint defect in research-candidate `discreteDIFFUSIONstd = 1-exp(2aΔt)`. For finite stable `a` and finite positive `Δt`, the exact ratio is strictly inside `(0,1)`, but the predecessor returned exact `1.0` when the target exponent overflowed negative or `exp_m1` saturated. RED `a8de3c9f924bc6a942e385324d00ce4b6d30412b` pins both a huge finite event interval and a finite `2aΔt=-100` case as `InvalidTemporalTransformInput`. Repair `c17e2ff87fa8ed6464ca07152770c149573d55a6` rejects a non-finite target exponent and any final ratio `<=0` or `>=1`. The earlier minimum-positive-subnormal case remains accepted because its final ratio is a representable interior value rather than an endpoint. Fresh CWC review previously exposed an atomistic-fallacy admission defect. `center_within_unit_event_lags` accepted `groups.len() >= 2` before singleton groups were skipped, allowing one unit with repeated occasions plus one singleton identifier to return longitudinal lag evidence from only one contributing unit. RED `671709bbc6cdf1090e16c1d8f6c9f2b4f8b2d831` requires both public centering and recovery to reject that fixture. Repair `4784b370c464c3de74661124c594b8b89b9b917e` counts only groups with at least two event-time observations toward the two-unit longitudinal floor; singleton groups may remain present but cannot satisfy repeated-measures evidence. Rustdoc and the old in-module singleton expectation state the same contract. -The preceding numerical repair is the research-candidate scalar `discreteDIFFUSIONstd = 1 - exp(2 a Δt)` path. The predecessor formed `aΔt` first and rejected a signed-zero intermediate. At `a=-0.5` and the minimum positive binary64 event interval, `aΔt` rounds to `-0.0` even though the target `2aΔt` is exactly the minimum negative subnormal and the final standardized ratio is the representable minimum positive subnormal. RED `d5107b19817556c4c902408b51ed2bb8c8181d2c` pins that final-result contract. Repair `7164c7ce4a6ada24524399b0031171730a16a883` doubles the event interval first while finite and then forms the single rounded rate product; when `2Δt` overflows, the large-interval path computes `aΔt` before the exact factor two. It never forms `2a` first, preserves the extreme-interval unit limit, and fails closed only when the target exponent/final ratio itself is non-representable. +The preceding small-exponent repair remains on the research-candidate scalar discrete-diffusion path. RED `d5107b19817556c4c902408b51ed2bb8c8181d2c` pins `a=-0.5` and the minimum positive binary64 event interval, where the exact final ratio is the minimum positive subnormal even though `aΔt` alone rounds to signed zero. Repair `7164c7ce4a6ada24524399b0031171730a16a883` doubles the event interval first while finite and then forms the single rounded rate product; it avoids forming `2a` first. The later endpoint repair does not weaken this representable-interior contract. The irregular-rate facade repair remains intact: RED refinement `4648638608436fb6c04315d96f59a6404e2e790b` requires a facade re-export rather than wrapper functions; repair `7f0bea0841fb89a6ce9bdd5b9f10c0e4612f4270` uses direct `pub use` of the canonical private-module function identities. The public names remain stable while there is one numerical implementation. @@ -84,7 +86,7 @@ The DDD architecture repair remains intact. Test-first commit `fe5eb7457f80e7724 The stationary-overflow documentation repair remains intact: RED `9d8a82d78443cafc9b5064fc3bb35aa3f2052722` rejects the retired `(q / a) * -0.5` instruction and repair `9c962205dca26925c2e60d1e15ec4ce15681bbee` synchronizes `CLAUDE.md` with `(q * 0.5) / |a|`. Earlier CWC, within/between, known-truth RMSE, irregular-rate zero-underflow, stationary-subnormal and exact covariance-bound lineages remain on the same vehicle. -Current exact head `37b78ce15b93cb25e6307df445e58e3d3bf48954` is mergeable but Draft. CodeQL PR run `33680645982` is `startup_failure`; Rust Foundation CI and Scorecard PR are pending; Documentation Quality, Security Scan, SAST Semgrep and OSV-Scanner PR are queued. There is no qualifying current-head independent approval. All visible review threads are resolved. Source repair does not substitute for hosted GREEN. +Current exact head `c17e2ff87fa8ed6464ca07152770c149573d55a6` is mergeable but Draft. Every new source push invalidates predecessor workflow/review evidence; fresh exact-head hosted evidence is required before any GREEN claim or normal merge. There is no qualifying current-head independent approval at this snapshot. The CWC and within/between unit-mean helpers still have separate implementations. Consolidation remains a maintainability target only after their full error/estimand semantics are shown equivalent; a reusable domain-neutral arithmetic primitive belongs in fast-mlsirm rather than being copied across TEPP contexts. @@ -96,7 +98,7 @@ Current head `0b7155cc238defb1e55129ff3000658f04b343cf` centralizes the leakage- #480 removes TEPP-owned provider discovery/ranking and requires HTTPS `contextual-orchestrator/orchestrator/free` from an immutable owner release. Fresh review found one remaining TEPP-side authority drift: `CONTRIBUTING.md` still told contributors to use `NVIDIA_NIM_API_KEY` directly. RED `4248b3351a2cdfd37666696daf189d4389f8bcb1` adds that guide to the canonical owner-policy fitness contract; repair `01f45a99392457334a4f6d3d659f992af739eeee` removes direct provider credential/routing guidance and records provider/model identity only as orchestrator-returned provenance. -contextual-orchestrator protected `main@212ff437dc297613289dba2e6064ade9942e07d8` still has zero GitHub releases. Mutable branch state is not a released contract. Owner issue #1023 remains open for authenticated release/deployment provenance and scoped/ephemeral or brokered authentication that does not expose a reusable long-lived gateway bearer token to model-controlled execution. Exact-head #480 evidence is non-GREEN: CodeQL PR is `startup_failure`; Documentation Quality, Security Scan, Rust Foundation CI, OSV-Scanner PR and Scorecard PR are queued; SAST Semgrep is pending. The consumer remains deliberately fail-closed and has no qualifying independent current-head approval. +contextual-orchestrator protected `main@212ff437dc297613289dba2e6064ade9942e07d8` still has zero GitHub releases. Mutable branch state is not a released contract. Owner issue #1023 remains open for authenticated release/deployment provenance and scoped/ephemeral or brokered authentication that does not expose a reusable long-lived gateway bearer token to model-controlled execution. The consumer remains deliberately fail-closed and has no qualifying independent current-head approval. ### fast-mlsirm owner handoff @@ -140,6 +142,7 @@ Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/num | GAP-024 | Contributor guidance re-authorized a direct provider credential after canonical LLM ownership moved to contextual-orchestrator | `verification-pending` | RED `4248b335...` + repair `01f45a993...`; exact-head documentation/security/review GREEN, released CO adoption and protected-main integration | | GAP-025 | A singleton unit could satisfy the nominal CWC unit floor while all longitudinal lag evidence came from one repeated unit | `verification-pending` | RED `671709bbc...` + repair `4784b370c...`; exact-head Rust/documentation/review GREEN and protected-main integration | | GAP-026 | Scalar standardized longitudinal maps rejected representable final values when a cancelled stationary-variance intermediate lay outside binary64 range | `verification-pending` | RED `4a1f6c49...` / `96d8ed13...` + repairs `a4bc6230...` / `33f4b187...` / `26b03c32...`; PRD/ADR sync and exact-head Rust/documentation/review GREEN plus protected-main integration | +| GAP-027 | Finite-interval `discreteDIFFUSIONstd` could report exact unit diffusion after exponent overflow or `exp_m1` saturation erased a nonzero remainder | `verification-pending` | RED `a8de3c9f...` + repair `c17e2ff8...`; exact-head Rust/documentation/review GREEN and protected-main integration | ## Release gate From 3b4f7bb0208b91f388dfabac7979691a7f5f2992 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 3 Sep 2026 06:04:49 +0900 Subject: [PATCH 111/235] docs(delivery): record stationary variance underflow repair --- docs/product-technical-gap-baseline.md | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index c4b9304de..740fdc4cc 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,7 +4,7 @@ **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-02T20:47:00Z +**Snapshot:** 2026-09-02T21:04:00Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` @@ -42,7 +42,7 @@ A planning document, mergeable branch, local/source inspection, predecessor-head | #460 | `dfab4eab5ff733731e565a9348072b8dab2e4912` | true | #416 `feat/copy-identity-analysis-run-gap-004@0b7155cc238defb1e55129ff3000658f04b343cf` | Fold child; typed cutoff equality and terminal-validation separation preserved. | | #458 | `08165e3b3c929b4ae77396689549f72723ff8ff5` | true | #416 `feat/copy-identity-analysis-run-gap-004@0b7155cc238defb1e55129ff3000658f04b343cf` | Fold child; typed cutoff equality and terminal-validation separation preserved. | | #416 | `0b7155cc238defb1e55129ff3000658f04b343cf` | true | `main@1bc02f580cf48e1d39da239f0e818453437c31c3` | Validation / Analysis Run landing candidate; availability cutoff precedes duplicate-identity admission. | -| #310 | `c17e2ff87fa8ed6464ca07152770c149573d55a6` | true | `main@1bc02f580cf48e1d39da239f0e818453437c31c3` | Longitudinal Modeling vehicle; cancelled stationary intermediates no longer reject representable standardized maps and finite-interval diffusion candidates refuse false zero/one endpoints; exact-head hosted verification is pending. | +| #310 | `a0132b62cb30acfcb6aa0a6ab96b0d6d3c6b1d3c` | true | `main@1bc02f580cf48e1d39da239f0e818453437c31c3` | Longitudinal Modeling vehicle; actual stationary variance now refuses positive-real values that binary64 would misreport as zero, while standardized maps still avoid materializing cancelled `p`; exact-head hosted verification is pending. | Exact-current-head evidence becomes stale after source mutation or any new commit. @@ -72,9 +72,11 @@ The clock contract separates event/valid time, assertion time, document time, sy Closed predecessor #441 is contained by #310. The invalid covariance/earlier-variance quantity is not exposed as autocorrelation; lagged Pearson correlation requires lagged covariance and both occasion-specific marginal variances. The lagged-correlation representability RED `c345ee7b8bdf642430669b7b0e1d7fc6873a84af` plus repair `5785e07a352801c193d92dde03863d0697a2853a` fail closed when a nonzero covariance would collapse to exact-zero binary64 correlation, while genuine zero covariance remains zero. -Fresh review exposed a standardized-map representability defect. `discreteDRIFTstd`, research-candidate `DIFFUSIONstd`, and research-candidate `discreteDIFFUSIONstd` materialized `p = q / (-2a)` as binary64 merely to prove stationarity, even though `p` cancels algebraically from those scalar standardized maps. Thus `q = min-subnormal, a=-1` rejected a representable `exp(-1)`/`-2a`/`1-exp(-2)` result because positive real `p` lay below binary64 range, while `q = MAX, a=-0.25` rejected finite standardized results because positive real `p` lay above binary64 range. RED `4a1f6c49847fd32c6129c9ceb7c46abd124b29ff` pins the drift cases and RED `96d8ed134a45aaaf31f76bed1d363859ad5946d0` pins both diffusion-standardisation cases. Repair `a4bc6230b414a3f47eba190ac5dabeb27446d3c2` separates finite/stable stationary-process admission from actual `p` materialization; `recover_stationary_within_variance` still requires representable `p` when `p` itself is requested. Repair `33f4b187f833cdf97dce3f4f9bcb1aa7afdf1aed` applies algebraic stationarity admission to `discreteDRIFTstd` and refuses a nonzero stable transition that rounds to false `1.0`. Repair `26b03c328941851984c257b48efe6ffd08a24396` applies the same stationarity boundary to the diffusion candidates. PRD `c88810dc1f7b1291b5ced8f5d4ffd92eb9f524c3` and ADR `37b78ce15b93cb25e6307df445e58e3d3bf48954` record the distinction between positive real stationarity, an actually requested stationary-variance estimand, and a cancelled intermediate. +Fresh review exposed a standardized-map representability defect. `discreteDRIFTstd`, research-candidate `DIFFUSIONstd`, and research-candidate `discreteDIFFUSIONstd` materialized `p = q / (-2a)` as binary64 merely to prove stationarity, even though `p` cancels algebraically from those scalar standardized maps. Thus `q = min-subnormal, a=-1` rejected a representable `exp(-1)`/`-2a`/`1-exp(-2)` result because positive real `p` lay below binary64 range, while `q = MAX, a=-0.25` rejected finite standardized results because positive real `p` lay above binary64 range. RED `4a1f6c49847fd32c6129c9ceb7c46abd124b29ff` pins the drift cases and RED `96d8ed134a45aaaf31f76bed1d363859ad5946d0` pins both diffusion-standardisation cases. Repair `a4bc6230b414a3f47eba190ac5dabeb27446d3c2` separates finite/stable stationary-process admission from actual `p` materialization; standardized maps use this algebraic admission. Repair `33f4b187f833cdf97dce3f4f9bcb1aa7afdf1aed` applies it to `discreteDRIFTstd` and refuses a nonzero stable transition that rounds to false `1.0`. Repair `26b03c328941851984c257b48efe6ffd08a24396` applies the same boundary to the diffusion candidates. PRD `c88810dc1f7b1291b5ced8f5d4ffd92eb9f524c3` and ADR `37b78ce15b93cb25e6307df445e58e3d3bf48954` record the distinction between positive real stationarity, an actually requested stationary-variance estimand, and a cancelled intermediate. -The same review exposed an opposite-edge endpoint defect in research-candidate `discreteDIFFUSIONstd = 1-exp(2aΔt)`. For finite stable `a` and finite positive `Δt`, the exact ratio is strictly inside `(0,1)`, but the predecessor returned exact `1.0` when the target exponent overflowed negative or `exp_m1` saturated. RED `a8de3c9f924bc6a942e385324d00ce4b6d30412b` pins both a huge finite event interval and a finite `2aΔt=-100` case as `InvalidTemporalTransformInput`. Repair `c17e2ff87fa8ed6464ca07152770c149573d55a6` rejects a non-finite target exponent and any final ratio `<=0` or `>=1`. The earlier minimum-positive-subnormal case remains accepted because its final ratio is a representable interior value rather than an endpoint. +A subsequent materialization audit found the complementary actual-estimand defect. `recover_stationary_within_variance` returned `Ok(0.0)` when positive finite `q` and stable finite `a` imply strictly positive real `p` but `p` lies below binary64 range. RED `27d9fa39f5d4d31fde168f93014f32cea81448c8` pins `q=f64::from_bits(1), a=-1`. Repair `a0132b62cb30acfcb6aa0a6ab96b0d6d3c6b1d3c` keeps explicit `q==0 -> Ok(0.0)` but rejects a computed `stationary == 0.0` for positive `q` as `InvalidTemporalTransformInput`. Standardized maps are unaffected because they use the algebraic input validator rather than requesting `p`. + +The endpoint review exposed an opposite-edge defect in research-candidate `discreteDIFFUSIONstd = 1-exp(2aΔt)`. For finite stable `a` and finite positive `Δt`, the exact ratio is strictly inside `(0,1)`, but the predecessor returned exact `1.0` when the target exponent overflowed negative or `exp_m1` saturated. RED `a8de3c9f924bc6a942e385324d00ce4b6d30412b` pins both a huge finite event interval and a finite `2aΔt=-100` case as `InvalidTemporalTransformInput`. Repair `c17e2ff87fa8ed6464ca07152770c149573d55a6` rejects a non-finite target exponent and any final ratio `<=0` or `>=1`. The earlier minimum-positive-subnormal case remains accepted because its final ratio is a representable interior value rather than an endpoint. Fresh CWC review previously exposed an atomistic-fallacy admission defect. `center_within_unit_event_lags` accepted `groups.len() >= 2` before singleton groups were skipped, allowing one unit with repeated occasions plus one singleton identifier to return longitudinal lag evidence from only one contributing unit. RED `671709bbc6cdf1090e16c1d8f6c9f2b4f8b2d831` requires both public centering and recovery to reject that fixture. Repair `4784b370c464c3de74661124c594b8b89b9b917e` counts only groups with at least two event-time observations toward the two-unit longitudinal floor; singleton groups may remain present but cannot satisfy repeated-measures evidence. Rustdoc and the old in-module singleton expectation state the same contract. @@ -86,7 +88,7 @@ The DDD architecture repair remains intact. Test-first commit `fe5eb7457f80e7724 The stationary-overflow documentation repair remains intact: RED `9d8a82d78443cafc9b5064fc3bb35aa3f2052722` rejects the retired `(q / a) * -0.5` instruction and repair `9c962205dca26925c2e60d1e15ec4ce15681bbee` synchronizes `CLAUDE.md` with `(q * 0.5) / |a|`. Earlier CWC, within/between, known-truth RMSE, irregular-rate zero-underflow, stationary-subnormal and exact covariance-bound lineages remain on the same vehicle. -Current exact head `c17e2ff87fa8ed6464ca07152770c149573d55a6` is mergeable but Draft. Every new source push invalidates predecessor workflow/review evidence; fresh exact-head hosted evidence is required before any GREEN claim or normal merge. There is no qualifying current-head independent approval at this snapshot. +Current exact head `a0132b62cb30acfcb6aa0a6ab96b0d6d3c6b1d3c` is mergeable but Draft. Every new source push invalidates predecessor workflow/review evidence. CodeQL PR is `startup_failure`; Rust Foundation CI, Documentation Quality, Security Scan, SAST Semgrep, OSV-Scanner PR and Scorecard PR are queued. No qualifying independent current-head approval exists. The CWC and within/between unit-mean helpers still have separate implementations. Consolidation remains a maintainability target only after their full error/estimand semantics are shown equivalent; a reusable domain-neutral arithmetic primitive belongs in fast-mlsirm rather than being copied across TEPP contexts. @@ -110,7 +112,7 @@ Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/num ## External contract state -`context-graph-contracts` and `enterprise-architecture-core` remain read-only from this TEPP writer. Fresh state has CGC `develop@99cb5468ba3c15c5e79688f53dee74724fae2d13`, 14 open PR and release 0; EA Core `develop@1c0fa8b15ceb9e72186274aeb255d6777eb84ef4`, 24 open PR and release 0. Open heads remain candidate evidence rather than production contracts and must be re-read before adoption. +`context-graph-contracts` and `enterprise-architecture-core` remain read-only from this TEPP writer. Fresh state at the last verified owner snapshot had CGC `develop@99cb5468ba3c15c5e79688f53dee74724fae2d13`, 14 open PR and release 0; EA Core `develop@1c0fa8b15ceb9e72186274aeb255d6777eb84ef4`, 24 open PR and release 0. Open heads remain candidate evidence rather than production contracts and must be re-read before adoption. ## Gap register @@ -143,7 +145,8 @@ Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/num | GAP-025 | A singleton unit could satisfy the nominal CWC unit floor while all longitudinal lag evidence came from one repeated unit | `verification-pending` | RED `671709bbc...` + repair `4784b370c...`; exact-head Rust/documentation/review GREEN and protected-main integration | | GAP-026 | Scalar standardized longitudinal maps rejected representable final values when a cancelled stationary-variance intermediate lay outside binary64 range | `verification-pending` | RED `4a1f6c49...` / `96d8ed13...` + repairs `a4bc6230...` / `33f4b187...` / `26b03c32...`; PRD/ADR sync and exact-head Rust/documentation/review GREEN plus protected-main integration | | GAP-027 | Finite-interval `discreteDIFFUSIONstd` could report exact unit diffusion after exponent overflow or `exp_m1` saturation erased a nonzero remainder | `verification-pending` | RED `a8de3c9f...` + repair `c17e2ff8...`; exact-head Rust/documentation/review GREEN and protected-main integration | +| GAP-028 | Actual stationary variance `p` could be misreported as exact zero when positive real `p` lies below the binary64 range | `verification-pending` | RED `27d9fa39...` + repair `a0132b62...`; exact-head Rust/documentation/review GREEN and protected-main integration | ## Release gate -TEPP currently has no GitHub release. Release is permitted only after a coherent vertical reaches protected main with exact protected-head CI/security/recovery evidence, reproducible package + SBOM + provenance + rollback artifacts, current version/CHANGELOG, required migration/restore/load evidence, and released integration contracts where deployment depends on them. Queued/pending/startup-failed/skipped or predecessor-head evidence is not GREEN. +TEPP currently has no GitHub release. Release is permitted only after a coherent vertical reaches protected main with exact protected-head CI/security/recovery evidence, reproducible package + SBOM + provenance + rollback artifacts, current version/CHANGELOG, required migration/restore/load evidence, and released integration contracts where deployment depends on them. Queued/pending/startup-failed/skipped or predecessor-head evidence is not GREEN. \ No newline at end of file From a787642b3c1d0f352abde93f03fbe934f664a8ad Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 3 Sep 2026 07:04:18 +0900 Subject: [PATCH 112/235] docs(queue): classify PR 486 under longitudinal owner --- docs/product-technical-gap-baseline.md | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 740fdc4cc..5b70784e5 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,7 +4,7 @@ **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-02T21:04:00Z +**Snapshot:** 2026-09-02T22:02:18Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` @@ -19,14 +19,14 @@ A planning document, mergeable branch, local/source inspection, predecessor-head | Signal | Fresh evidence | Implication | | --- | ---: | --- | | Protected `main` | `1bc02f580cf48e1d39da239f0e818453437c31c3` | Capability claims remain bounded to this commit until main advances. | -| Open pull requests | **132** | WIP circuit breaker remains active; no independent micro-PR is justified while an existing bounded-context vehicle can own the work. | -| Draft pull requests | **131** | Draft work must consolidate/repair rather than independently land. | +| Open pull requests | **133** | WIP circuit breaker remains active; no independent micro-PR is justified while an existing bounded-context vehicle can own the work. | +| Draft pull requests | **132** | Draft work must consolidate/repair rather than independently land. | | Non-Draft pull requests | **1** | #480 is the only non-Draft PR and is not deployable without a compatible immutable contextual-orchestrator release. | | Open issues | **16** | ADR normalization, orchestration admission, evaluation drift and scientific recovery work remain open. | | GitHub releases | **0** | No TEPP open head is a released contract. | | Organization ruleset | `18156473` | One qualifying current-head approval, stale-review dismissal after push, resolved threads, unattributed-change approval where applicable, and central required workflows. | -#484 `summarizes_edge_v1` and #485 `support_edge_v1` remain #416 Analysis Run fold children. Their unique source/tests/doctoring must survive the shared-file fold; neither is closed merely to reduce queue count. +#484 `summarizes_edge_v1` and #485 `support_edge_v1` remain #416 Analysis Run fold children. #486 is a Longitudinal Modeling fold child retargeted non-destructively from `main` to #310 after fresh ownership review. Its unique Hamaker occasion-mean source/tests/research evidence must survive the fold, but the current `psychometric_core` temporal implementation is not canonical and must move to `longitudinal_core`. None of these children is closed merely to reduce queue count. ## Current priority open pull-request evidence @@ -34,6 +34,7 @@ A planning document, mergeable branch, local/source inspection, predecessor-head | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | +| #486 | `501d0e34f39672b4f30c7ef35255953ac60f5557` | true | #310 `agent/psychometric-discrete-drift-std-clean@a0132b62cb30acfcb6aa0a6ab96b0d6d3c6b1d3c` | Longitudinal fold child; preserve Hamaker occasion-mean source/tests/research, repair mixed provenance time format and missing APA 7 source, prove signed-zero event-time identity, replace naive occasion-mean summation, and move temporal composition out of `psychometric_core` before fold. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 `feat/copy-identity-analysis-run-gap-004@0b7155cc238defb1e55129ff3000658f04b343cf` | Analysis Run fold child; preserve support-edge refusal/source/tests/doctoring and historical-cutoff evidence. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 `feat/copy-identity-analysis-run-gap-004@0b7155cc238defb1e55129ff3000658f04b343cf` | Analysis Run fold child; preserve profile-specific source/tests/doctoring. | | #483 | `847d96f913bb261803ac0bd751ad7e4f51324cee` | true | #416 `feat/copy-identity-analysis-run-gap-004@0b7155cc238defb1e55129ff3000658f04b343cf` | Analysis Run fold child; preserve unique evidence. | @@ -42,7 +43,7 @@ A planning document, mergeable branch, local/source inspection, predecessor-head | #460 | `dfab4eab5ff733731e565a9348072b8dab2e4912` | true | #416 `feat/copy-identity-analysis-run-gap-004@0b7155cc238defb1e55129ff3000658f04b343cf` | Fold child; typed cutoff equality and terminal-validation separation preserved. | | #458 | `08165e3b3c929b4ae77396689549f72723ff8ff5` | true | #416 `feat/copy-identity-analysis-run-gap-004@0b7155cc238defb1e55129ff3000658f04b343cf` | Fold child; typed cutoff equality and terminal-validation separation preserved. | | #416 | `0b7155cc238defb1e55129ff3000658f04b343cf` | true | `main@1bc02f580cf48e1d39da239f0e818453437c31c3` | Validation / Analysis Run landing candidate; availability cutoff precedes duplicate-identity admission. | -| #310 | `a0132b62cb30acfcb6aa0a6ab96b0d6d3c6b1d3c` | true | `main@1bc02f580cf48e1d39da239f0e818453437c31c3` | Longitudinal Modeling vehicle; actual stationary variance now refuses positive-real values that binary64 would misreport as zero, while standardized maps still avoid materializing cancelled `p`; exact-head hosted verification is pending. | +| #310 | `a0132b62cb30acfcb6aa0a6ab96b0d6d3c6b1d3c` | true | `main@1bc02f580cf48e1d39da239f0e818453437c31c3` | Longitudinal Modeling vehicle; actual stationary variance now refuses positive-real values that binary64 would misreport as zero, while standardized maps still avoid materializing cancelled `p`; #486 is now a conflict-resolving fold child; exact-head hosted verification is pending. | Exact-current-head evidence becomes stale after source mutation or any new commit. @@ -90,6 +91,8 @@ The stationary-overflow documentation repair remains intact: RED `9d8a82d78443ca Current exact head `a0132b62cb30acfcb6aa0a6ab96b0d6d3c6b1d3c` is mergeable but Draft. Every new source push invalidates predecessor workflow/review evidence. CodeQL PR is `startup_failure`; Rust Foundation CI, Documentation Quality, Security Scan, SAST Semgrep, OSV-Scanner PR and Scorecard PR are queued. No qualifying independent current-head approval exists. +#486 is now a non-destructively retargeted fold child of this vehicle. Its current source is not yet owner-correct: it adds occasion-mean temporal composition under `psychometric_core`, groups occasion identity by raw `f64::to_bits()` so `-0.0` and `+0.0` become distinct despite numeric equality, and computes occasion means through naive summation that can overflow even when the final mean is representable. The fold must establish realistic REDs for the identity and intermediate-overflow cases, move the behavior into `longitudinal_core`, preserve the Hamaker/Voelkle research evidence, and resolve the two current documentation review findings before any child closure. + The CWC and within/between unit-mean helpers still have separate implementations. Consolidation remains a maintainability target only after their full error/estimand semantics are shown equivalent; a reusable domain-neutral arithmetic primitive belongs in fast-mlsirm rather than being copied across TEPP contexts. ### #416 — Validation / Analysis Run consolidation @@ -112,13 +115,13 @@ Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/num ## External contract state -`context-graph-contracts` and `enterprise-architecture-core` remain read-only from this TEPP writer. Fresh state at the last verified owner snapshot had CGC `develop@99cb5468ba3c15c5e79688f53dee74724fae2d13`, 14 open PR and release 0; EA Core `develop@1c0fa8b15ceb9e72186274aeb255d6777eb84ef4`, 24 open PR and release 0. Open heads remain candidate evidence rather than production contracts and must be re-read before adoption. +`context-graph-contracts` and `enterprise-architecture-core` remain read-only from this TEPP writer. Fresh state has CGC protected `develop@99cb5468ba3c15c5e79688f53dee74724fae2d13`, 14 open PR and release 0; EA Core protected `develop@1c0fa8b15ceb9e72186274aeb255d6777eb84ef4`, 24 open PR and release 0. CGC #25 is a Draft release-source-provenance prerequisite and EA #40 continues to fail closed on provisional/unreleased CGC identity. Open heads remain candidate evidence rather than production contracts and must be re-read before adoption. ## Gap register | ID | Gap | Maturity | Closure evidence | | --- | --- | --- | --- | -| GAP-001 | PR authority fragmented across 132 open PRs | `release-blocking` | coherent landing vehicles, unique-evidence preservation, protected-main reduction | +| GAP-001 | PR authority fragmented across 133 open PRs | `release-blocking` | coherent landing vehicles, unique-evidence preservation, protected-main reduction | | GAP-002 | multilingual span-grounded semantic/concept admission | `partial` | immutable offsets/layout, KO/EN/JA/ZH/VI/ES/DE/FR profiles, concept dictionary, invariance/calibration, hostile-input tests | | GAP-003 | shared-latent temporal topic estimator | `partial` | Rust CPU f64 likelihood/uncertainty, relation/time/membership effects, true recovery, fitted candidate-K | | GAP-004 | durable end-to-end Analysis Run | `partial` | idempotent lifecycle, persistence/recovery, estimator-bound artifacts, validation/promotion separation, Compose E2E | @@ -146,6 +149,7 @@ Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/num | GAP-026 | Scalar standardized longitudinal maps rejected representable final values when a cancelled stationary-variance intermediate lay outside binary64 range | `verification-pending` | RED `4a1f6c49...` / `96d8ed13...` + repairs `a4bc6230...` / `33f4b187...` / `26b03c32...`; PRD/ADR sync and exact-head Rust/documentation/review GREEN plus protected-main integration | | GAP-027 | Finite-interval `discreteDIFFUSIONstd` could report exact unit diffusion after exponent overflow or `exp_m1` saturation erased a nonzero remainder | `verification-pending` | RED `a8de3c9f...` + repair `c17e2ff8...`; exact-head Rust/documentation/review GREEN and protected-main integration | | GAP-028 | Actual stationary variance `p` could be misreported as exact zero when positive real `p` lies below the binary64 range | `verification-pending` | RED `27d9fa39...` + repair `a0132b62...`; exact-head Rust/documentation/review GREEN and protected-main integration | +| GAP-029 | Occasion-mean temporal composition was added as a new `psychometric_core` micro-slice with raw-bit event identity and naive mean summation | `active-repair` | #486 retargeted to #310; realistic signed-zero/overflow REDs; owner-correct `longitudinal_core` fold; APA 7/provenance repair; exact-head Rust/documentation/review GREEN and protected-main integration | ## Release gate From a37bc094870537d91c6b79337f5a3458e25b495c Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 3 Sep 2026 07:08:21 +0900 Subject: [PATCH 113/235] docs(queue): record all-open-PR draft state --- docs/product-technical-gap-baseline.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 5b70784e5..c4b21f02d 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,7 +4,7 @@ **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-02T22:02:18Z +**Snapshot:** 2026-09-02T22:06:23Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` @@ -20,8 +20,8 @@ A planning document, mergeable branch, local/source inspection, predecessor-head | --- | ---: | --- | | Protected `main` | `1bc02f580cf48e1d39da239f0e818453437c31c3` | Capability claims remain bounded to this commit until main advances. | | Open pull requests | **133** | WIP circuit breaker remains active; no independent micro-PR is justified while an existing bounded-context vehicle can own the work. | -| Draft pull requests | **132** | Draft work must consolidate/repair rather than independently land. | -| Non-Draft pull requests | **1** | #480 is the only non-Draft PR and is not deployable without a compatible immutable contextual-orchestrator release. | +| Draft pull requests | **133** | Every current open PR is Draft; work must consolidate/repair and reacquire exact-head evidence before any Ready transition. | +| Non-Draft pull requests | **0** | #480 was converted back to Draft because its own released-owner prerequisite is still unsatisfied. | | Open issues | **16** | ADR normalization, orchestration admission, evaluation drift and scientific recovery work remain open. | | GitHub releases | **0** | No TEPP open head is a released contract. | | Organization ruleset | `18156473` | One qualifying current-head approval, stale-review dismissal after push, resolved threads, unattributed-change approval where applicable, and central required workflows. | @@ -39,7 +39,7 @@ A planning document, mergeable branch, local/source inspection, predecessor-head | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 `feat/copy-identity-analysis-run-gap-004@0b7155cc238defb1e55129ff3000658f04b343cf` | Analysis Run fold child; preserve profile-specific source/tests/doctoring. | | #483 | `847d96f913bb261803ac0bd751ad7e4f51324cee` | true | #416 `feat/copy-identity-analysis-run-gap-004@0b7155cc238defb1e55129ff3000658f04b343cf` | Analysis Run fold child; preserve unique evidence. | | #482 | `506dbae236a4484301b704b6c6a05b20faf0fe69` | true | #416 `feat/copy-identity-analysis-run-gap-004@0b7155cc238defb1e55129ff3000658f04b343cf` | Analysis Run fold child; preserve unique evidence. | -| #480 | `01f45a99392457334a4f6d3d659f992af739eeee` | false | `main@1bc02f580cf48e1d39da239f0e818453437c31c3` | Independent LLM-consumer governance repair; contributor guidance now obeys released-owner routing, but immutable CO deployment identity/auth provenance remains owner-blocked. | +| #480 | `01f45a99392457334a4f6d3d659f992af739eeee` | true | `main@1bc02f580cf48e1d39da239f0e818453437c31c3` | Independent LLM-consumer governance repair; now correctly Draft/blocked-equivalent while immutable contextual-orchestrator deployment identity/auth provenance remains unavailable. | | #460 | `dfab4eab5ff733731e565a9348072b8dab2e4912` | true | #416 `feat/copy-identity-analysis-run-gap-004@0b7155cc238defb1e55129ff3000658f04b343cf` | Fold child; typed cutoff equality and terminal-validation separation preserved. | | #458 | `08165e3b3c929b4ae77396689549f72723ff8ff5` | true | #416 `feat/copy-identity-analysis-run-gap-004@0b7155cc238defb1e55129ff3000658f04b343cf` | Fold child; typed cutoff equality and terminal-validation separation preserved. | | #416 | `0b7155cc238defb1e55129ff3000658f04b343cf` | true | `main@1bc02f580cf48e1d39da239f0e818453437c31c3` | Validation / Analysis Run landing candidate; availability cutoff precedes duplicate-identity admission. | @@ -101,9 +101,9 @@ Current head `0b7155cc238defb1e55129ff3000658f04b343cf` centralizes the leakage- ### #480 — contextual-orchestrator boundary -#480 removes TEPP-owned provider discovery/ranking and requires HTTPS `contextual-orchestrator/orchestrator/free` from an immutable owner release. Fresh review found one remaining TEPP-side authority drift: `CONTRIBUTING.md` still told contributors to use `NVIDIA_NIM_API_KEY` directly. RED `4248b3351a2cdfd37666696daf189d4389f8bcb1` adds that guide to the canonical owner-policy fitness contract; repair `01f45a99392457334a4f6d3d659f992af739eeee` removes direct provider credential/routing guidance and records provider/model identity only as orchestrator-returned provenance. +#480 removes TEPP-owned provider discovery/ranking and requires HTTPS `contextual-orchestrator/orchestrator/free` from an immutable owner release. Fresh review found one remaining TEPP-side authority drift: `CONTRIBUTING.md` still told contributors to use `NVIDIA_NIM_API_KEY` directly. RED `4248b3351a2cdfd37666696daf189d4389f8bcb1` adds that guide to the canonical authority-sync contract; repair `01f45a99392457334a4f6d3d659f992af739eeee` removes direct provider credential/routing guidance and records provider/model identity only as orchestrator-returned provenance. -contextual-orchestrator protected `main@212ff437dc297613289dba2e6064ade9942e07d8` still has zero GitHub releases. Mutable branch state is not a released contract. Owner issue #1023 remains open for authenticated release/deployment provenance and scoped/ephemeral or brokered authentication that does not expose a reusable long-lived gateway bearer token to model-controlled execution. The consumer remains deliberately fail-closed and has no qualifying independent current-head approval. +contextual-orchestrator protected `main@212ff437dc297613289dba2e6064ade9942e07d8` still has zero GitHub releases. Mutable branch state is not a released contract. Owner issue #1023 remains open for authenticated release/deployment provenance and scoped/ephemeral or brokered authentication that does not expose a reusable long-lived gateway bearer token to model-controlled execution. #480 is therefore now explicitly Draft/blocked-equivalent as its own owner contract requires. Its source remains alive for later released-contract adoption; it was not closed or bypassed. ### fast-mlsirm owner handoff @@ -136,7 +136,7 @@ Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/num | GAP-013 | ADR identity collisions | `release-integrity` | unique repository-wide identity, deterministic duplicate detection, supersession lineage | | GAP-014 | current required-workflow startup/runner evidence unavailable | `external-control-risk` | central workflow repair, exact-current required workflows GREEN, no bypass | | GAP-015 | contextual-orchestrator lacks immutable released contract for current owner behavior | `release-blocking` | compatible immutable CO release, deployment provenance, safe gateway auth, exact TEPP ACL adoption | -| GAP-016 | hourly LLM path needs released owner-only routing/authentication | `active-repair` | #480 + released CO adoption + exact-head GREEN/review/main merge | +| GAP-016 | hourly LLM path needs released owner-only routing/authentication | `active-repair` | #480 Draft + released CO adoption + exact-head GREEN/review/main merge | | GAP-017 | dynamic evaluation item/rater/anchor drift monitoring | `owner-contract-active` | released/digest-pinned dynamic criterion/item/run contract, ACL conformance, no-anchor/no-linking refusal, evidence-gated temporal monitoring | | GAP-018 | Longitudinal stable-mean logic remains duplicated | `active-refactor` | semantic-equivalence proof, one TEPP Longitudinal primitive or released fast-mlsirm generic owner contract, recovery parity | | GAP-019 | Longitudinal scientific instructions contradict current stationary-overflow implementation | `verification-pending` | RED `9d8a82d...` + repair `9c962205...`; exact-head Documentation Quality/review GREEN and protected-main integration | From 4dd934d09f2ddf635d90eb85d3f10042aaff9669 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 3 Sep 2026 07:11:57 +0900 Subject: [PATCH 114/235] docs(queue): refresh longitudinal fold head --- docs/product-technical-gap-baseline.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index c4b21f02d..959936869 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,7 +4,7 @@ **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-02T22:06:23Z +**Snapshot:** 2026-09-02T22:10:57Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` @@ -34,7 +34,7 @@ A planning document, mergeable branch, local/source inspection, predecessor-head | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #486 | `501d0e34f39672b4f30c7ef35255953ac60f5557` | true | #310 `agent/psychometric-discrete-drift-std-clean@a0132b62cb30acfcb6aa0a6ab96b0d6d3c6b1d3c` | Longitudinal fold child; preserve Hamaker occasion-mean source/tests/research, repair mixed provenance time format and missing APA 7 source, prove signed-zero event-time identity, replace naive occasion-mean summation, and move temporal composition out of `psychometric_core` before fold. | +| #486 | `c451587e288ba119aebda67addee382106daf670` | true | #310 `agent/psychometric-discrete-drift-std-clean@a0132b62cb30acfcb6aa0a6ab96b0d6d3c6b1d3c` | Longitudinal fold child; Hamaker inline/APA 7 source repair is now on the current head and its review thread is resolved; preserve occasion-mean source/tests/research, repair mixed provenance time format, prove signed-zero event-time identity, replace naive occasion-mean summation, and move temporal composition out of `psychometric_core` before fold. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 `feat/copy-identity-analysis-run-gap-004@0b7155cc238defb1e55129ff3000658f04b343cf` | Analysis Run fold child; preserve support-edge refusal/source/tests/doctoring and historical-cutoff evidence. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 `feat/copy-identity-analysis-run-gap-004@0b7155cc238defb1e55129ff3000658f04b343cf` | Analysis Run fold child; preserve profile-specific source/tests/doctoring. | | #483 | `847d96f913bb261803ac0bd751ad7e4f51324cee` | true | #416 `feat/copy-identity-analysis-run-gap-004@0b7155cc238defb1e55129ff3000658f04b343cf` | Analysis Run fold child; preserve unique evidence. | @@ -91,7 +91,7 @@ The stationary-overflow documentation repair remains intact: RED `9d8a82d78443ca Current exact head `a0132b62cb30acfcb6aa0a6ab96b0d6d3c6b1d3c` is mergeable but Draft. Every new source push invalidates predecessor workflow/review evidence. CodeQL PR is `startup_failure`; Rust Foundation CI, Documentation Quality, Security Scan, SAST Semgrep, OSV-Scanner PR and Scorecard PR are queued. No qualifying independent current-head approval exists. -#486 is now a non-destructively retargeted fold child of this vehicle. Its current source is not yet owner-correct: it adds occasion-mean temporal composition under `psychometric_core`, groups occasion identity by raw `f64::to_bits()` so `-0.0` and `+0.0` become distinct despite numeric equality, and computes occasion means through naive summation that can overflow even when the final mean is representable. The fold must establish realistic REDs for the identity and intermediate-overflow cases, move the behavior into `longitudinal_core`, preserve the Hamaker/Voelkle research evidence, and resolve the two current documentation review findings before any child closure. +#486 is now a non-destructively retargeted fold child of this vehicle. Current child head `c451587e288ba119aebda67addee382106daf670` repaired the missing Hamaker inline/APA 7 citation and resolved that review thread. Its production source is not yet owner-correct: it adds occasion-mean temporal composition under `psychometric_core`, groups occasion identity by raw `f64::to_bits()` so `-0.0` and `+0.0` become distinct despite numeric equality, and computes occasion means through naive summation that can overflow even when the final mean is representable. The fold must establish realistic REDs for the identity and intermediate-overflow cases, move the behavior into `longitudinal_core`, preserve the Hamaker research evidence, and resolve the remaining mixed-timezone provenance review finding before child closure. The CWC and within/between unit-mean helpers still have separate implementations. Consolidation remains a maintainability target only after their full error/estimand semantics are shown equivalent; a reusable domain-neutral arithmetic primitive belongs in fast-mlsirm rather than being copied across TEPP contexts. @@ -149,7 +149,7 @@ Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/num | GAP-026 | Scalar standardized longitudinal maps rejected representable final values when a cancelled stationary-variance intermediate lay outside binary64 range | `verification-pending` | RED `4a1f6c49...` / `96d8ed13...` + repairs `a4bc6230...` / `33f4b187...` / `26b03c32...`; PRD/ADR sync and exact-head Rust/documentation/review GREEN plus protected-main integration | | GAP-027 | Finite-interval `discreteDIFFUSIONstd` could report exact unit diffusion after exponent overflow or `exp_m1` saturation erased a nonzero remainder | `verification-pending` | RED `a8de3c9f...` + repair `c17e2ff8...`; exact-head Rust/documentation/review GREEN and protected-main integration | | GAP-028 | Actual stationary variance `p` could be misreported as exact zero when positive real `p` lies below the binary64 range | `verification-pending` | RED `27d9fa39...` + repair `a0132b62...`; exact-head Rust/documentation/review GREEN and protected-main integration | -| GAP-029 | Occasion-mean temporal composition was added as a new `psychometric_core` micro-slice with raw-bit event identity and naive mean summation | `active-repair` | #486 retargeted to #310; realistic signed-zero/overflow REDs; owner-correct `longitudinal_core` fold; APA 7/provenance repair; exact-head Rust/documentation/review GREEN and protected-main integration | +| GAP-029 | Occasion-mean temporal composition was added as a new `psychometric_core` micro-slice with raw-bit event identity and naive mean summation | `active-repair` | #486 retargeted to #310; Hamaker citation repair `c451587e...`; realistic signed-zero/overflow REDs; owner-correct `longitudinal_core` fold; provenance repair; exact-head Rust/documentation/review GREEN and protected-main integration | ## Release gate From 38dc24d86448c6058a31c387fd5c0677515214f3 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 3 Sep 2026 08:09:11 +0900 Subject: [PATCH 115/235] docs(ddd): fold occasion-mean repair into gap authority --- docs/product-technical-gap-baseline.md | 115 +++++++++++-------------- 1 file changed, 51 insertions(+), 64 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 959936869..febe65f28 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,7 +4,7 @@ **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-02T22:10:57Z +**Snapshot:** 2026-09-02T23:07Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` @@ -19,39 +19,39 @@ A planning document, mergeable branch, local/source inspection, predecessor-head | Signal | Fresh evidence | Implication | | --- | ---: | --- | | Protected `main` | `1bc02f580cf48e1d39da239f0e818453437c31c3` | Capability claims remain bounded to this commit until main advances. | -| Open pull requests | **133** | WIP circuit breaker remains active; no independent micro-PR is justified while an existing bounded-context vehicle can own the work. | -| Draft pull requests | **133** | Every current open PR is Draft; work must consolidate/repair and reacquire exact-head evidence before any Ready transition. | -| Non-Draft pull requests | **0** | #480 was converted back to Draft because its own released-owner prerequisite is still unsatisfied. | -| Open issues | **16** | ADR normalization, orchestration admission, evaluation drift and scientific recovery work remain open. | +| Open pull requests | **133** | WIP circuit breaker remains active; consolidate into existing bounded-context vehicles. | +| Draft pull requests | **133** | Every current open PR is Draft. | +| Non-Draft pull requests | **0** | No current PR is eligible for normal merge without a deliberate Ready transition after exact-head evidence. | +| Open issues | **16** | ADR normalization, orchestration admission, evaluation drift, and scientific recovery remain open. | | GitHub releases | **0** | No TEPP open head is a released contract. | -| Organization ruleset | `18156473` | One qualifying current-head approval, stale-review dismissal after push, resolved threads, unattributed-change approval where applicable, and central required workflows. | +| Organization ruleset | `18156473` | One qualifying current-head approval, stale-review dismissal after push, resolved threads, extra approval for unattributed changes where applicable, and central required workflows. | -#484 `summarizes_edge_v1` and #485 `support_edge_v1` remain #416 Analysis Run fold children. #486 is a Longitudinal Modeling fold child retargeted non-destructively from `main` to #310 after fresh ownership review. Its unique Hamaker occasion-mean source/tests/research evidence must survive the fold, but the current `psychometric_core` temporal implementation is not canonical and must move to `longitudinal_core`. None of these children is closed merely to reduce queue count. +Ruleset `18156473` currently permits merge/squash and prohibits deletion/non-fast-forward updates on the default branch. Organization-admin bypass exists but is not normal delivery evidence and is not used by this writer. -## Current priority open pull-request evidence +## Current landing authority -#435 intentionally omits its own SHA from this file because embedding a branch head inside a file changed by that branch makes the file self-stale. +#435 intentionally omits its own branch SHA from this file because embedding a mutable self-head would make the file stale on every edit. | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #486 | `c451587e288ba119aebda67addee382106daf670` | true | #310 `agent/psychometric-discrete-drift-std-clean@a0132b62cb30acfcb6aa0a6ab96b0d6d3c6b1d3c` | Longitudinal fold child; Hamaker inline/APA 7 source repair is now on the current head and its review thread is resolved; preserve occasion-mean source/tests/research, repair mixed provenance time format, prove signed-zero event-time identity, replace naive occasion-mean summation, and move temporal composition out of `psychometric_core` before fold. | -| #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 `feat/copy-identity-analysis-run-gap-004@0b7155cc238defb1e55129ff3000658f04b343cf` | Analysis Run fold child; preserve support-edge refusal/source/tests/doctoring and historical-cutoff evidence. | -| #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 `feat/copy-identity-analysis-run-gap-004@0b7155cc238defb1e55129ff3000658f04b343cf` | Analysis Run fold child; preserve profile-specific source/tests/doctoring. | -| #483 | `847d96f913bb261803ac0bd751ad7e4f51324cee` | true | #416 `feat/copy-identity-analysis-run-gap-004@0b7155cc238defb1e55129ff3000658f04b343cf` | Analysis Run fold child; preserve unique evidence. | -| #482 | `506dbae236a4484301b704b6c6a05b20faf0fe69` | true | #416 `feat/copy-identity-analysis-run-gap-004@0b7155cc238defb1e55129ff3000658f04b343cf` | Analysis Run fold child; preserve unique evidence. | -| #480 | `01f45a99392457334a4f6d3d659f992af739eeee` | true | `main@1bc02f580cf48e1d39da239f0e818453437c31c3` | Independent LLM-consumer governance repair; now correctly Draft/blocked-equivalent while immutable contextual-orchestrator deployment identity/auth provenance remains unavailable. | -| #460 | `dfab4eab5ff733731e565a9348072b8dab2e4912` | true | #416 `feat/copy-identity-analysis-run-gap-004@0b7155cc238defb1e55129ff3000658f04b343cf` | Fold child; typed cutoff equality and terminal-validation separation preserved. | -| #458 | `08165e3b3c929b4ae77396689549f72723ff8ff5` | true | #416 `feat/copy-identity-analysis-run-gap-004@0b7155cc238defb1e55129ff3000658f04b343cf` | Fold child; typed cutoff equality and terminal-validation separation preserved. | -| #416 | `0b7155cc238defb1e55129ff3000658f04b343cf` | true | `main@1bc02f580cf48e1d39da239f0e818453437c31c3` | Validation / Analysis Run landing candidate; availability cutoff precedes duplicate-identity admission. | -| #310 | `a0132b62cb30acfcb6aa0a6ab96b0d6d3c6b1d3c` | true | `main@1bc02f580cf48e1d39da239f0e818453437c31c3` | Longitudinal Modeling vehicle; actual stationary variance now refuses positive-real values that binary64 would misreport as zero, while standardized maps still avoid materializing cancelled `p`; #486 is now a conflict-resolving fold child; exact-head hosted verification is pending. | - -Exact-current-head evidence becomes stale after source mutation or any new commit. +| #486 | `c451587e288ba119aebda67addee382106daf670` | true | #310 `agent/psychometric-discrete-drift-std-clean` | Longitudinal fold child. Its Hamaker source/doctoring remains evidence to inherit, but its `psychometric_core` temporal implementation is non-canonical. Do not close until every unique delta is verified on the surviving #310 head. | +| #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 `feat/copy-identity-analysis-run-gap-004` | Analysis Run fold child; preserve support-edge refusal/source/tests/doctoring and historical-cutoff evidence. | +| #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 `feat/copy-identity-analysis-run-gap-004` | Analysis Run fold child; preserve profile-specific source/tests/doctoring. | +| #483 | `847d96f913bb261803ac0bd751ad7e4f51324cee` | true | #416 `feat/copy-identity-analysis-run-gap-004` | Analysis Run fold child; preserve unique evidence. | +| #482 | `506dbae236a4484301b704b6c6a05b20faf0fe69` | true | #416 `feat/copy-identity-analysis-run-gap-004` | Analysis Run fold child; preserve unique evidence. | +| #480 | `01f45a99392457334a4f6d3d659f992af739eeee` | true | `main` | LLM-consumer governance repair; correctly Draft while immutable contextual-orchestrator release/deployment/auth provenance is unavailable. | +| #460 | `dfab4eab5ff733731e565a9348072b8dab2e4912` | true | #416 `feat/copy-identity-analysis-run-gap-004` | Fold child; typed cutoff equality and terminal-validation separation preserved. | +| #458 | `08165e3b3c929b4ae77396689549f72723ff8ff5` | true | #416 `feat/copy-identity-analysis-run-gap-004` | Fold child; typed cutoff equality and terminal-validation separation preserved. | +| #416 | `0b7155cc238defb1e55129ff3000658f04b343cf` | true | `main` | Validation / Analysis Run landing candidate; availability cutoff precedes duplicate-identity admission. | +| #310 | `7baff4c99473b1de035386e4a5055a4fe71edca0` | true | `main` | Longitudinal Modeling vehicle; owner-correct occasion-mean composition, signed-zero identity, representable-mean overflow repair, and Hamaker trace are now on the surviving branch; exact-head hosted verification remains non-passing. | + +Exact-head evidence becomes stale after any source push. ## Domain ownership -TEPP owns temporal/event composition, irregular time, time-varying multilevel/cross-classified/multiple-membership semantics, longitudinal invariance/drift/alignment, leakage-safe knowledge cutoff, temporal recovery and projection policy. `longitudinal_modeling` is the bounded context and `longitudinal_core` is its current Rust implementation path. +TEPP owns temporal/event composition, irregular time, time-varying multilevel/cross-classified/multiple-membership semantics, longitudinal invariance/drift/alignment, leakage-safe knowledge cutoff, temporal recovery, Validation Evidence, and Projection policy. `longitudinal_modeling` is the bounded context and `longitudinal_core` is its current Rust implementation path. -`psychometric_core` is not the authority for new temporal/state composition. It retains existing measurement/legacy compatibility surfaces while explicit adapters are formed. fast-mlsirm owns reusable static/generalized-mixed/dependence-aware psychometric specification and arithmetic, including reusable covariance-to-correlation standardization and LSIRM/MLSIRM/DLSJM kernels. TEPP consumes only immutable released/versioned Published Language through an ACL; source copying and mutable sibling-head dependencies are prohibited. +`psychometric_core` is not the authority for new temporal/state composition. It retains existing measurement/legacy compatibility surfaces while explicit adapters are formed. fast-mlsirm owns reusable static/generalized-mixed/dependence-aware psychometric specification and arithmetic. TEPP consumes only immutable released/versioned Published Language through an ACL; source copying and mutable sibling-head dependencies are prohibited. contextual-orchestrator owns provider/model routing and semantic LLM execution. Context Graph contracts are contract-only integration authority; EA Core owns enterprise-architecture decisions. No cross-service SQL. @@ -60,10 +60,12 @@ The clock contract separates event/valid time, assertion time, document time, sy ## Scientific invariants - Rasch remains distinct from generic 1PL; formulation-qualified 2PLM–5PLM, MIRT, ideal-point/GGUM, testlet/rater/facet/generalized-mixed identity is preserved. -- Cross-classification and multiple membership remain distinct; weights are explicit, auditable, time-valid and observed-normalized or model-estimated according to formulation. -- A nominal unit identifier is not repeated-measures evidence: multilevel/within-unit temporal acceptance must preserve the actual number of units contributing repeated event-time observations and may not let singleton units satisfy a longitudinal unit floor. +- Cross-classification and multiple membership remain distinct; weights are explicit, auditable, time-valid, and normalized or model-estimated according to the formulation. +- A nominal unit identifier is not repeated-measures evidence; singleton units cannot satisfy a longitudinal multilevel floor. +- Occasion-mean deviations `p_it = x_it - μ_t` are not CWC residuals, sample-wide grand-mean residuals, or RI-CLPM within-person effects. Numeric event time defines occasion identity, so `-0.0` and `+0.0` are one occasion. +- A representable final scientific estimand is not rejected solely because an avoidable intermediate binary64 operation overflows/underflows. A final false 0/1/non-finite boundary remains fail-closed where the mathematical estimand is interior/nonzero. - TEPP composes time over the full released upstream candidate identity; auto-expansion never means auto-activation. -- Supported temporal estimators require state/trajectory and claimed-structure recovery, bias/RMSE, interval coverage, convergence, uncertainty calibration and leakage-safe rolling-origin evidence. +- Supported temporal estimators require state/trajectory and claimed-structure recovery, bias/RMSE, interval coverage, convergence, uncertainty calibration, and leakage-safe rolling-origin evidence. - CPU/GPU parity counts only when the relevant accelerator path actually runs. Monte Carlo decisions use simulation uncertainty rather than arbitrary pass percentages. - Scientific failures are never hidden with skip/xfail/source rewriting/coverage exclusions. @@ -71,51 +73,36 @@ The clock contract separates event/valid time, assertion time, document time, sy ### #310 — Longitudinal Modeling -Closed predecessor #441 is contained by #310. The invalid covariance/earlier-variance quantity is not exposed as autocorrelation; lagged Pearson correlation requires lagged covariance and both occasion-specific marginal variances. The lagged-correlation representability RED `c345ee7b8bdf642430669b7b0e1d7fc6873a84af` plus repair `5785e07a352801c193d92dde03863d0697a2853a` fail closed when a nonzero covariance would collapse to exact-zero binary64 correlation, while genuine zero covariance remains zero. +#310 remains the canonical Longitudinal Modeling landing vehicle. Existing repair lineage covers lagged Pearson correlation with both marginal variances, stationary-variance materialization versus algebraically cancelled standardized maps, discrete-diffusion endpoint/subnormal representability, CWC atomistic admission, one irregular-rate authority, known-truth recovery, and DDD relocation from `psychometric_core` to `longitudinal_core`. -Fresh review exposed a standardized-map representability defect. `discreteDRIFTstd`, research-candidate `DIFFUSIONstd`, and research-candidate `discreteDIFFUSIONstd` materialized `p = q / (-2a)` as binary64 merely to prove stationarity, even though `p` cancels algebraically from those scalar standardized maps. Thus `q = min-subnormal, a=-1` rejected a representable `exp(-1)`/`-2a`/`1-exp(-2)` result because positive real `p` lay below binary64 range, while `q = MAX, a=-0.25` rejected finite standardized results because positive real `p` lay above binary64 range. RED `4a1f6c49847fd32c6129c9ceb7c46abd124b29ff` pins the drift cases and RED `96d8ed134a45aaaf31f76bed1d363859ad5946d0` pins both diffusion-standardisation cases. Repair `a4bc6230b414a3f47eba190ac5dabeb27446d3c2` separates finite/stable stationary-process admission from actual `p` materialization; standardized maps use this algebraic admission. Repair `33f4b187f833cdf97dce3f4f9bcb1aa7afdf1aed` applies it to `discreteDRIFTstd` and refuses a nonzero stable transition that rounds to false `1.0`. Repair `26b03c328941851984c257b48efe6ffd08a24396` applies the same boundary to the diffusion candidates. PRD `c88810dc1f7b1291b5ced8f5d4ffd92eb9f524c3` and ADR `37b78ce15b93cb25e6307df445e58e3d3bf48954` record the distinction between positive real stationarity, an actually requested stationary-variance estimand, and a cancelled intermediate. +The newest fold repairs #486's occasion-mean slice test-first: -A subsequent materialization audit found the complementary actual-estimand defect. `recover_stationary_within_variance` returned `Ok(0.0)` when positive finite `q` and stable finite `a` imply strictly positive real `p` but `p` lies below binary64 range. RED `27d9fa39f5d4d31fde168f93014f32cea81448c8` pins `q=f64::from_bits(1), a=-1`. Repair `a0132b62cb30acfcb6aa0a6ab96b0d6d3c6b1d3c` keeps explicit `q==0 -> Ok(0.0)` but rejects a computed `stationary == 0.0` for positive `q` as `InvalidTemporalTransformInput`. Standardized maps are unaffected because they use the algebraic input validator rather than requesting `p`. +- RED `75b0184d2f6341ef23cf14fc84398c68d8d95d22` requires numeric signed-zero occasion identity, rejects a duplicate unit hidden behind `-0.0`/`+0.0`, preserves the known exact scalar residual log-rate, and pins `[0.75·MAX, 0.75·MAX, -0.5·MAX]` as a representable occasion-mean case that naive same-sign partial summation would overflow. +- Repair `7fe9aaf2570ffb6ecff3d6a83b12a30865fc198b` implements occasion-mean event-time composition in `crates/longitudinal_core/src/occasion_mean.rs`. It canonicalizes numeric zero, requires at least two distinct units per occasion and at least two lag-contributing units, retains typed positive finite event intervals, cancels opposing magnitudes before bounded same-sign averaging, and reuses the existing Longitudinal exact-log-rate boundary. +- Export repair `b900e21301f1f5bb769464a4b76da9088cd669ab` publishes the boundary through `longitudinal_core`; `30771ff24cf85479eb5ed227789b59489ac7ead2` fixes the typed interval accessor in the regression contract. +- Research trace `7baff4c99473b1de035386e4a5055a4fe71edca0` adds `docs/research/occasion-mean-event-time-composition.md` with the Hamaker et al. (2015) estimand boundary and test trace, without the mixed `Z KST` provenance string present on #486. -The endpoint review exposed an opposite-edge defect in research-candidate `discreteDIFFUSIONstd = 1-exp(2aΔt)`. For finite stable `a` and finite positive `Δt`, the exact ratio is strictly inside `(0,1)`, but the predecessor returned exact `1.0` when the target exponent overflowed negative or `exp_m1` saturated. RED `a8de3c9f924bc6a942e385324d00ce4b6d30412b` pins both a huge finite event interval and a finite `2aΔt=-100` case as `InvalidTemporalTransformInput`. Repair `c17e2ff87fa8ed6464ca07152770c149573d55a6` rejects a non-finite target exponent and any final ratio `<=0` or `>=1`. The earlier minimum-positive-subnormal case remains accepted because its final ratio is a representable interior value rather than an endpoint. +At exact head `7baff4c99473b1de035386e4a5055a4fe71edca0`, CodeQL PR run `33693410413` is `startup_failure` with zero materialized jobs. Rust Foundation CI, Documentation Quality, Security Scan, SAST Semgrep, OSV-Scanner PR, and Scorecard PR are queued. No qualifying independent current-head approval exists. #310 stays Draft and is not merge-ready. -Fresh CWC review previously exposed an atomistic-fallacy admission defect. `center_within_unit_event_lags` accepted `groups.len() >= 2` before singleton groups were skipped, allowing one unit with repeated occasions plus one singleton identifier to return longitudinal lag evidence from only one contributing unit. RED `671709bbc6cdf1090e16c1d8f6c9f2b4f8b2d831` requires both public centering and recovery to reject that fixture. Repair `4784b370c464c3de74661124c594b8b89b9b917e` counts only groups with at least two event-time observations toward the two-unit longitudinal floor; singleton groups may remain present but cannot satisfy repeated-measures evidence. Rustdoc and the old in-module singleton expectation state the same contract. - -The preceding small-exponent repair remains on the research-candidate scalar discrete-diffusion path. RED `d5107b19817556c4c902408b51ed2bb8c8181d2c` pins `a=-0.5` and the minimum positive binary64 event interval, where the exact final ratio is the minimum positive subnormal even though `aΔt` alone rounds to signed zero. Repair `7164c7ce4a6ada24524399b0031171730a16a883` doubles the event interval first while finite and then forms the single rounded rate product; it avoids forming `2a` first. The later endpoint repair does not weaken this representable-interior contract. - -The irregular-rate facade repair remains intact: RED refinement `4648638608436fb6c04315d96f59a6404e2e790b` requires a facade re-export rather than wrapper functions; repair `7f0bea0841fb89a6ce9bdd5b9f10c0e4612f4270` uses direct `pub use` of the canonical private-module function identities. The public names remain stable while there is one numerical implementation. - -The DDD architecture repair remains intact. Test-first commit `fe5eb7457f80e7724412102800ceaf5b9f70ec50` requires a distinct `longitudinal_modeling` conceptual owner, exactly one `longitudinal_core` and one `psychometric_core` implementation row, no temporal-composition claims in the psychometric row, and an explicit released fast-mlsirm ACL boundary. Repair `7fadc757987145cbcc39475b2bf3193e4a4fed59` deduplicates the topology, moves TEPP temporal composition/recovery authority to Longitudinal Modeling/`longitudinal_core`, narrows `psychometric_core` to measurement/legacy compatibility, and leaves equation-level evidence to TRACEABILITY/doctoring/research/source tests. - -The stationary-overflow documentation repair remains intact: RED `9d8a82d78443cafc9b5064fc3bb35aa3f2052722` rejects the retired `(q / a) * -0.5` instruction and repair `9c962205dca26925c2e60d1e15ec4ce15681bbee` synchronizes `CLAUDE.md` with `(q * 0.5) / |a|`. Earlier CWC, within/between, known-truth RMSE, irregular-rate zero-underflow, stationary-subnormal and exact covariance-bound lineages remain on the same vehicle. - -Current exact head `a0132b62cb30acfcb6aa0a6ab96b0d6d3c6b1d3c` is mergeable but Draft. Every new source push invalidates predecessor workflow/review evidence. CodeQL PR is `startup_failure`; Rust Foundation CI, Documentation Quality, Security Scan, SAST Semgrep, OSV-Scanner PR and Scorecard PR are queued. No qualifying independent current-head approval exists. - -#486 is now a non-destructively retargeted fold child of this vehicle. Current child head `c451587e288ba119aebda67addee382106daf670` repaired the missing Hamaker inline/APA 7 citation and resolved that review thread. Its production source is not yet owner-correct: it adds occasion-mean temporal composition under `psychometric_core`, groups occasion identity by raw `f64::to_bits()` so `-0.0` and `+0.0` become distinct despite numeric equality, and computes occasion means through naive summation that can overflow even when the final mean is representable. The fold must establish realistic REDs for the identity and intermediate-overflow cases, move the behavior into `longitudinal_core`, preserve the Hamaker research evidence, and resolve the remaining mixed-timezone provenance review finding before child closure. - -The CWC and within/between unit-mean helpers still have separate implementations. Consolidation remains a maintainability target only after their full error/estimand semantics are shown equivalent; a reusable domain-neutral arithmetic primitive belongs in fast-mlsirm rather than being copied across TEPP contexts. +#486 remains open Draft and conflict-exposing beneath #310. Its wrong-owner implementation must not be independently landed. The child may be closed only after its remaining unique documentation/contract/TRACEABILITY delta is proven inherited by a surviving #310 head; the mixed `2026-09-03T06:07Z KST` provenance text remains a child repair finding rather than a reason for evidence-losing closure. ### #416 — Validation / Analysis Run consolidation -Current head `0b7155cc238defb1e55129ff3000658f04b343cf` centralizes the leakage-safe invariant established by RED `ffee655404716bf8d33c898a3c1a87a543abe701`: availability filtering occurs before duplicate-identity admission. #458/#460/#482/#483/#484/#485 remain fold children over shared Cargo/lib/lock/docs surfaces. Their unique evidence must reach a surviving #416 head before any child can be considered fully superseded. +#416 `0b7155cc238defb1e55129ff3000658f04b343cf` centralizes the leakage-safe invariant that availability filtering occurs before duplicate-identity admission. #458/#460/#482/#483/#484/#485 remain fold children over shared Cargo/lib/lock/docs surfaces. Their unique evidence must reach a surviving #416 head before any child can be considered fully superseded. ### #480 — contextual-orchestrator boundary -#480 removes TEPP-owned provider discovery/ranking and requires HTTPS `contextual-orchestrator/orchestrator/free` from an immutable owner release. Fresh review found one remaining TEPP-side authority drift: `CONTRIBUTING.md` still told contributors to use `NVIDIA_NIM_API_KEY` directly. RED `4248b3351a2cdfd37666696daf189d4389f8bcb1` adds that guide to the canonical authority-sync contract; repair `01f45a99392457334a4f6d3d659f992af739eeee` removes direct provider credential/routing guidance and records provider/model identity only as orchestrator-returned provenance. +#480 removes TEPP-owned provider discovery/ranking and requires the contextual-orchestrator owner contract. contextual-orchestrator currently has no immutable GitHub release for this consumer path, so #480 remains Draft/blocked-equivalent. Mutable owner `main` is not a released production contract. -contextual-orchestrator protected `main@212ff437dc297613289dba2e6064ade9942e07d8` still has zero GitHub releases. Mutable branch state is not a released contract. Owner issue #1023 remains open for authenticated release/deployment provenance and scoped/ephemeral or brokered authentication that does not expose a reusable long-lived gateway bearer token to model-controlled execution. #480 is therefore now explicitly Draft/blocked-equivalent as its own owner contract requires. Its source remains alive for later released-contract adoption; it was not closed or bypassed. +### Owner handoffs -### fast-mlsirm owner handoff +Reusable static/generalized-mixed/dependence psychometric arithmetic remains fast-mlsirm-owned. The currently released fast-mlsirm version must be compared with open owner work before any TEPP adoption; an open PR head is never dependency authority. -fast-mlsirm protected `main@b5a3a0c1057d4b53d7a4bb18e0de69f630c2b45c` at the current owner snapshot. Immutable `v0.9.1` predates current owner work. Generalized-mixed/dependence Published Language #1714 is open/Ready at `92a3f2152033b61ca89661b5ba8a584842e8c3a9`; current CI/security evidence remains non-passing. None of these mutable owner heads is a TEPP production dependency. +`context-graph-contracts` and `enterprise-architecture-core` remain read-only from this TEPP writer. Their open heads are candidate evidence only until immutable releases exist. ### #437 — ADR identity -Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/numbered files, index/file mismatch and repeated Decision-status or Implementation-maturity authority must fail deterministic documentation fitness. Adapter/model micro-slice ADR numbers, including #485's ADR 0078, remain implementation lineage pending normalization through #435. - -## External contract state - -`context-graph-contracts` and `enterprise-architecture-core` remain read-only from this TEPP writer. Fresh state has CGC protected `develop@99cb5468ba3c15c5e79688f53dee74724fae2d13`, 14 open PR and release 0; EA Core protected `develop@1c0fa8b15ceb9e72186274aeb255d6777eb84ef4`, 24 open PR and release 0. CGC #25 is a Draft release-source-provenance prerequisite and EA #40 continues to fail closed on provisional/unreleased CGC identity. Open heads remain candidate evidence rather than production contracts and must be re-read before adoption. +Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/numbered files, index/file mismatch, and repeated Decision-status or Implementation-maturity authority must fail deterministic documentation fitness. Branch-local micro-slice records do not mint independent architecture authority. ## Gap register @@ -139,18 +126,18 @@ Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/num | GAP-016 | hourly LLM path needs released owner-only routing/authentication | `active-repair` | #480 Draft + released CO adoption + exact-head GREEN/review/main merge | | GAP-017 | dynamic evaluation item/rater/anchor drift monitoring | `owner-contract-active` | released/digest-pinned dynamic criterion/item/run contract, ACL conformance, no-anchor/no-linking refusal, evidence-gated temporal monitoring | | GAP-018 | Longitudinal stable-mean logic remains duplicated | `active-refactor` | semantic-equivalence proof, one TEPP Longitudinal primitive or released fast-mlsirm generic owner contract, recovery parity | -| GAP-019 | Longitudinal scientific instructions contradict current stationary-overflow implementation | `verification-pending` | RED `9d8a82d...` + repair `9c962205...`; exact-head Documentation Quality/review GREEN and protected-main integration | +| GAP-019 | Longitudinal scientific instructions contradicted stationary-overflow implementation | `verification-pending` | RED `9d8a82d...` + repair `9c962205...`; exact-head Documentation Quality/review GREEN and protected-main integration | | GAP-020 | Nonzero lagged covariance can be misreported as exact-zero correlation when standardized magnitude is unrepresentable | `verification-pending` | RED `c345ee7b...` + repair `5785e07a...`; exact-head Rust/documentation/review GREEN and protected-main integration | -| GAP-021 | Longitudinal irregular-rate facade duplicated public wrapper function identities over one canonical implementation | `verification-pending` | RED refinement `464863860...` + repair `7f0bea084...`; exact-head Rust/documentation/review GREEN and protected-main integration | +| GAP-021 | Longitudinal irregular-rate facade duplicated public wrapper identities over one canonical implementation | `verification-pending` | RED `464863860...` + repair `7f0bea084...`; exact-head Rust/documentation/review GREEN and protected-main integration | | GAP-022 | Architecture assigned Longitudinal Modeling semantics to `psychometric_core` and duplicated implementation responsibility rows | `verification-pending` | RED `fe5eb745...` + repair `7fadc757...`; exact-head documentation/quality review GREEN and protected-main integration | | GAP-023 | `discreteDIFFUSIONstd` rejected a representable subnormal final ratio because `aΔt` underflowed before the required factor two | `verification-pending` | RED `d5107b198...` + repair `7164c7ce4...`; exact-head Rust/documentation/review GREEN and protected-main integration | -| GAP-024 | Contributor guidance re-authorized a direct provider credential after canonical LLM ownership moved to contextual-orchestrator | `verification-pending` | RED `4248b335...` + repair `01f45a993...`; exact-head documentation/security/review GREEN, released CO adoption and protected-main integration | -| GAP-025 | A singleton unit could satisfy the nominal CWC unit floor while all longitudinal lag evidence came from one repeated unit | `verification-pending` | RED `671709bbc...` + repair `4784b370c...`; exact-head Rust/documentation/review GREEN and protected-main integration | -| GAP-026 | Scalar standardized longitudinal maps rejected representable final values when a cancelled stationary-variance intermediate lay outside binary64 range | `verification-pending` | RED `4a1f6c49...` / `96d8ed13...` + repairs `a4bc6230...` / `33f4b187...` / `26b03c32...`; PRD/ADR sync and exact-head Rust/documentation/review GREEN plus protected-main integration | -| GAP-027 | Finite-interval `discreteDIFFUSIONstd` could report exact unit diffusion after exponent overflow or `exp_m1` saturation erased a nonzero remainder | `verification-pending` | RED `a8de3c9f...` + repair `c17e2ff8...`; exact-head Rust/documentation/review GREEN and protected-main integration | -| GAP-028 | Actual stationary variance `p` could be misreported as exact zero when positive real `p` lies below the binary64 range | `verification-pending` | RED `27d9fa39...` + repair `a0132b62...`; exact-head Rust/documentation/review GREEN and protected-main integration | -| GAP-029 | Occasion-mean temporal composition was added as a new `psychometric_core` micro-slice with raw-bit event identity and naive mean summation | `active-repair` | #486 retargeted to #310; Hamaker citation repair `c451587e...`; realistic signed-zero/overflow REDs; owner-correct `longitudinal_core` fold; provenance repair; exact-head Rust/documentation/review GREEN and protected-main integration | +| GAP-024 | Contributor guidance re-authorized a direct provider credential after LLM ownership moved to contextual-orchestrator | `verification-pending` | RED `4248b335...` + repair `01f45a993...`; released CO adoption, exact-head documentation/security/review GREEN, protected-main integration | +| GAP-025 | A singleton unit could satisfy the nominal CWC unit floor while all lag evidence came from one repeated unit | `verification-pending` | RED `671709bbc...` + repair `4784b370c...`; exact-head Rust/documentation/review GREEN and protected-main integration | +| GAP-026 | Scalar standardized longitudinal maps rejected representable finals when a cancelled stationary-variance intermediate lay outside binary64 range | `verification-pending` | RED `4a1f6c49...` / `96d8ed13...` + repairs `a4bc6230...` / `33f4b187...` / `26b03c32...`; exact-head GREEN and protected-main integration | +| GAP-027 | Finite-interval `discreteDIFFUSIONstd` could report exact unit diffusion after exponent overflow/saturation erased a nonzero remainder | `verification-pending` | RED `a8de3c9f...` + repair `c17e2ff8...`; exact-head GREEN and protected-main integration | +| GAP-028 | Actual stationary variance `p` could be misreported as exact zero when positive real `p` lies below binary64 range | `verification-pending` | RED `27d9fa39...` + repair `a0132b62...`; exact-head GREEN and protected-main integration | +| GAP-029 | Occasion-mean temporal composition arrived in the wrong bounded context with raw-bit event identity and naive mean summation | `active-fold` | RED `75b0184d...`; owner repair `7fe9aaf2...`; export/test repairs `b900e213...` / `30771ff2...`; research trace `7baff4c9...`; verify remaining #486 unique evidence inheritance; exact-head GREEN/review/main integration | ## Release gate -TEPP currently has no GitHub release. Release is permitted only after a coherent vertical reaches protected main with exact protected-head CI/security/recovery evidence, reproducible package + SBOM + provenance + rollback artifacts, current version/CHANGELOG, required migration/restore/load evidence, and released integration contracts where deployment depends on them. Queued/pending/startup-failed/skipped or predecessor-head evidence is not GREEN. \ No newline at end of file +TEPP currently has no GitHub release. Release is permitted only after a coherent vertical reaches protected main with exact protected-head CI/security/recovery evidence, reproducible package + SBOM + provenance + rollback artifacts, current version/CHANGELOG, required migration/restore/load evidence, and released integration contracts where deployment depends on them. Queued/pending/startup-failed/skipped or predecessor-head evidence is not GREEN. From 4b6c077a4b424a738fe09030bf49342714a9bf99 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 3 Sep 2026 08:20:02 +0900 Subject: [PATCH 116/235] docs(ddd): record permutation-stable occasion composition --- docs/product-technical-gap-baseline.md | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index febe65f28..5946d932c 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,7 +4,7 @@ **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-02T23:07Z +**Snapshot:** 2026-09-02T23:20Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` @@ -43,7 +43,7 @@ Ruleset `18156473` currently permits merge/squash and prohibits deletion/non-fas | #460 | `dfab4eab5ff733731e565a9348072b8dab2e4912` | true | #416 `feat/copy-identity-analysis-run-gap-004` | Fold child; typed cutoff equality and terminal-validation separation preserved. | | #458 | `08165e3b3c929b4ae77396689549f72723ff8ff5` | true | #416 `feat/copy-identity-analysis-run-gap-004` | Fold child; typed cutoff equality and terminal-validation separation preserved. | | #416 | `0b7155cc238defb1e55129ff3000658f04b343cf` | true | `main` | Validation / Analysis Run landing candidate; availability cutoff precedes duplicate-identity admission. | -| #310 | `7baff4c99473b1de035386e4a5055a4fe71edca0` | true | `main` | Longitudinal Modeling vehicle; owner-correct occasion-mean composition, signed-zero identity, representable-mean overflow repair, and Hamaker trace are now on the surviving branch; exact-head hosted verification remains non-passing. | +| #310 | `7269cd78b0e0843946677ee50fdc09847e19af83` | true | `main` | Longitudinal Modeling vehicle; owner-correct occasion composition now includes numeric signed-zero identity, representable-mean overflow repair, input-permutation bit stability, and Hamaker trace. Exact-head hosted verification remains non-passing. | Exact-head evidence becomes stale after any source push. @@ -63,6 +63,7 @@ The clock contract separates event/valid time, assertion time, document time, sy - Cross-classification and multiple membership remain distinct; weights are explicit, auditable, time-valid, and normalized or model-estimated according to the formulation. - A nominal unit identifier is not repeated-measures evidence; singleton units cannot satisfy a longitudinal multilevel floor. - Occasion-mean deviations `p_it = x_it - μ_t` are not CWC residuals, sample-wide grand-mean residuals, or RI-CLPM within-person effects. Numeric event time defines occasion identity, so `-0.0` and `+0.0` are one occasion. +- Row arrival order is not scientific evidence. For a fixed admitted occasion, the same scores must produce bit-identical occasion means and centered pairs under input permutation. - A representable final scientific estimand is not rejected solely because an avoidable intermediate binary64 operation overflows/underflows. A final false 0/1/non-finite boundary remains fail-closed where the mathematical estimand is interior/nonzero. - TEPP composes time over the full released upstream candidate identity; auto-expansion never means auto-activation. - Supported temporal estimators require state/trajectory and claimed-structure recovery, bias/RMSE, interval coverage, convergence, uncertainty calibration, and leakage-safe rolling-origin evidence. @@ -80,9 +81,10 @@ The newest fold repairs #486's occasion-mean slice test-first: - RED `75b0184d2f6341ef23cf14fc84398c68d8d95d22` requires numeric signed-zero occasion identity, rejects a duplicate unit hidden behind `-0.0`/`+0.0`, preserves the known exact scalar residual log-rate, and pins `[0.75·MAX, 0.75·MAX, -0.5·MAX]` as a representable occasion-mean case that naive same-sign partial summation would overflow. - Repair `7fe9aaf2570ffb6ecff3d6a83b12a30865fc198b` implements occasion-mean event-time composition in `crates/longitudinal_core/src/occasion_mean.rs`. It canonicalizes numeric zero, requires at least two distinct units per occasion and at least two lag-contributing units, retains typed positive finite event intervals, cancels opposing magnitudes before bounded same-sign averaging, and reuses the existing Longitudinal exact-log-rate boundary. - Export repair `b900e21301f1f5bb769464a4b76da9088cd669ab` publishes the boundary through `longitudinal_core`; `30771ff24cf85479eb5ed227789b59489ac7ead2` fixes the typed interval accessor in the regression contract. -- Research trace `7baff4c99473b1de035386e4a5055a4fe71edca0` adds `docs/research/occasion-mean-event-time-composition.md` with the Hamaker et al. (2015) estimand boundary and test trace, without the mixed `Z KST` provenance string present on #486. +- Determinism RED `8a59019ed3112a3e27dd0dcd1b6b86d8d45e5435` permutes one fixed same-sign occasion `{1, nextafter(1,+∞), MAX/2}` and requires bit-identical centered pairs. Repair `465d139dce6101c4958c8b0827b6ef5d674b54c2` orders same-sign values before incremental averaging so arrival order cannot change the scientific result. +- Research trace `7269cd78b0e0843946677ee50fdc09847e19af83` updates `docs/research/occasion-mean-event-time-composition.md` with both RED lineages, the Hamaker et al. (2015) estimand boundary, and the deterministic-order invariant without the mixed `Z KST` provenance string present on #486. -At exact head `7baff4c99473b1de035386e4a5055a4fe71edca0`, CodeQL PR run `33693410413` is `startup_failure` with zero materialized jobs. Rust Foundation CI, Documentation Quality, Security Scan, SAST Semgrep, OSV-Scanner PR, and Scorecard PR are queued. No qualifying independent current-head approval exists. #310 stays Draft and is not merge-ready. +At exact head `7269cd78b0e0843946677ee50fdc09847e19af83`, CodeQL PR run `33694429503` is `startup_failure` with zero materialized jobs. Rust Foundation CI, Documentation Quality, Security Scan, SAST Semgrep, OSV-Scanner PR, and Scorecard PR are queued. No qualifying independent current-head approval exists. #310 stays Draft and is not merge-ready. #486 remains open Draft and conflict-exposing beneath #310. Its wrong-owner implementation must not be independently landed. The child may be closed only after its remaining unique documentation/contract/TRACEABILITY delta is proven inherited by a surviving #310 head; the mixed `2026-09-03T06:07Z KST` provenance text remains a child repair finding rather than a reason for evidence-losing closure. @@ -136,7 +138,7 @@ Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/num | GAP-026 | Scalar standardized longitudinal maps rejected representable finals when a cancelled stationary-variance intermediate lay outside binary64 range | `verification-pending` | RED `4a1f6c49...` / `96d8ed13...` + repairs `a4bc6230...` / `33f4b187...` / `26b03c32...`; exact-head GREEN and protected-main integration | | GAP-027 | Finite-interval `discreteDIFFUSIONstd` could report exact unit diffusion after exponent overflow/saturation erased a nonzero remainder | `verification-pending` | RED `a8de3c9f...` + repair `c17e2ff8...`; exact-head GREEN and protected-main integration | | GAP-028 | Actual stationary variance `p` could be misreported as exact zero when positive real `p` lies below binary64 range | `verification-pending` | RED `27d9fa39...` + repair `a0132b62...`; exact-head GREEN and protected-main integration | -| GAP-029 | Occasion-mean temporal composition arrived in the wrong bounded context with raw-bit event identity and naive mean summation | `active-fold` | RED `75b0184d...`; owner repair `7fe9aaf2...`; export/test repairs `b900e213...` / `30771ff2...`; research trace `7baff4c9...`; verify remaining #486 unique evidence inheritance; exact-head GREEN/review/main integration | +| GAP-029 | Occasion-mean temporal composition arrived in the wrong bounded context with raw-bit event identity, naive mean summation, and input-order-dependent same-sign averaging | `active-fold` | RED `75b0184d...`; owner repair `7fe9aaf2...`; export/test repairs `b900e213...` / `30771ff2...`; determinism RED `8a59019e...` + repair `465d139d...`; research trace `7269cd78...`; verify remaining #486 unique evidence inheritance; exact-head GREEN/review/main integration | ## Release gate From ece54615539976cccfe2c27f55c64dfd7e8cbf6b Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 3 Sep 2026 10:17:02 +0900 Subject: [PATCH 117/235] docs(ddd): refresh queue and scientific gaps --- docs/product-technical-gap-baseline.md | 83 +++++++++++++------------- 1 file changed, 41 insertions(+), 42 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 5946d932c..ff00dbbc0 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,7 +4,7 @@ **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-02T23:20Z +**Snapshot:** 2026-09-03T01:15Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` @@ -19,31 +19,32 @@ A planning document, mergeable branch, local/source inspection, predecessor-head | Signal | Fresh evidence | Implication | | --- | ---: | --- | | Protected `main` | `1bc02f580cf48e1d39da239f0e818453437c31c3` | Capability claims remain bounded to this commit until main advances. | -| Open pull requests | **133** | WIP circuit breaker remains active; consolidate into existing bounded-context vehicles. | -| Draft pull requests | **133** | Every current open PR is Draft. | -| Non-Draft pull requests | **0** | No current PR is eligible for normal merge without a deliberate Ready transition after exact-head evidence. | +| Open pull requests | **134** | WIP circuit breaker remains active; consolidate into existing bounded-context vehicles. | +| Draft pull requests | **134** | Every current open PR is Draft. | +| Non-Draft pull requests | **0** | No PR is eligible for normal merge until it is deliberately made Ready after exact-head evidence. | | Open issues | **16** | ADR normalization, orchestration admission, evaluation drift, and scientific recovery remain open. | | GitHub releases | **0** | No TEPP open head is a released contract. | | Organization ruleset | `18156473` | One qualifying current-head approval, stale-review dismissal after push, resolved threads, extra approval for unattributed changes where applicable, and central required workflows. | -Ruleset `18156473` currently permits merge/squash and prohibits deletion/non-fast-forward updates on the default branch. Organization-admin bypass exists but is not normal delivery evidence and is not used by this writer. +Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward updates on the default branch. Organization-admin bypass is not normal delivery evidence and is not used by this writer. ## Current landing authority -#435 intentionally omits its own branch SHA from this file because embedding a mutable self-head would make the file stale on every edit. +#435 intentionally omits its own mutable branch SHA from this file. | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #486 | `c451587e288ba119aebda67addee382106daf670` | true | #310 `agent/psychometric-discrete-drift-std-clean` | Longitudinal fold child. Its Hamaker source/doctoring remains evidence to inherit, but its `psychometric_core` temporal implementation is non-canonical. Do not close until every unique delta is verified on the surviving #310 head. | -| #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 `feat/copy-identity-analysis-run-gap-004` | Analysis Run fold child; preserve support-edge refusal/source/tests/doctoring and historical-cutoff evidence. | -| #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 `feat/copy-identity-analysis-run-gap-004` | Analysis Run fold child; preserve profile-specific source/tests/doctoring. | -| #483 | `847d96f913bb261803ac0bd751ad7e4f51324cee` | true | #416 `feat/copy-identity-analysis-run-gap-004` | Analysis Run fold child; preserve unique evidence. | -| #482 | `506dbae236a4484301b704b6c6a05b20faf0fe69` | true | #416 `feat/copy-identity-analysis-run-gap-004` | Analysis Run fold child; preserve unique evidence. | -| #480 | `01f45a99392457334a4f6d3d659f992af739eeee` | true | `main` | LLM-consumer governance repair; correctly Draft while immutable contextual-orchestrator release/deployment/auth provenance is unavailable. | -| #460 | `dfab4eab5ff733731e565a9348072b8dab2e4912` | true | #416 `feat/copy-identity-analysis-run-gap-004` | Fold child; typed cutoff equality and terminal-validation separation preserved. | -| #458 | `08165e3b3c929b4ae77396689549f72723ff8ff5` | true | #416 `feat/copy-identity-analysis-run-gap-004` | Fold child; typed cutoff equality and terminal-validation separation preserved. | -| #416 | `0b7155cc238defb1e55129ff3000658f04b343cf` | true | `main` | Validation / Analysis Run landing candidate; availability cutoff precedes duplicate-identity admission. | -| #310 | `7269cd78b0e0843946677ee50fdc09847e19af83` | true | `main` | Longitudinal Modeling vehicle; owner-correct occasion composition now includes numeric signed-zero identity, representable-mean overflow repair, input-permutation bit stability, and Hamaker trace. Exact-head hosted verification remains non-passing. | +| #487 | `6b0c8de64f41bc11f8bf908e0f9cbe854c1e213c` | true | #416 `feat/copy-identity-analysis-run-gap-004` | Validation / Analysis Run fold child. Sparse observed relation classes are valid evidence; RED `a2892b6...`, repair `a6402015...`, predecessor-test correction `6b0c8de6...`. No child-head CI transfers to #416. | +| #486 | `c451587e288ba119aebda67addee382106daf670` | true | #310 `agent/psychometric-discrete-drift-std-clean@9def784a...` | Longitudinal fold child, non-force base refreshed to the current survivor. Preserve unique Hamaker source/doctoring; reject wrong-owner `psychometric_core` temporal implementation and mixed-timezone provenance. | +| #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | +| #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | +| #483 | `847d96f913bb261803ac0bd751ad7e4f51324cee` | true | #416 | Analysis Run fold child; preserve unique evidence. | +| #482 | `506dbae236a4484301b704b6c6a05b20faf0fe69` | true | #416 | Analysis Run fold child; preserve unique evidence. | +| #480 | `01f45a99392457334a4f6d3d659f992af739eeee` | true | `main` | contextual-orchestrator consumer repair; stays Draft while immutable CO release/deployment/auth provenance is unavailable. | +| #460 | `dfab4eab5ff733731e565a9348072b8dab2e4912` | true | #416 | Analysis Run fold child; typed cutoff equality and terminal-validation separation. | +| #458 | `08165e3b3c929b4ae77396689549f72723ff8ff5` | true | #416 | Analysis Run fold child; typed cutoff equality and terminal-validation separation. | +| #416 | `0b7155cc238defb1e55129ff3000658f04b343cf` | true | `main` | Validation / Analysis Run landing vehicle; availability cutoff precedes duplicate-identity admission. | +| #310 | `9def784a78bed0c3990f8366f1a7f64d9c64043b` | true | `main` | Longitudinal Modeling vehicle; owner-correct occasion composition and deterministic stable-mean arithmetic. Hosted exact-head verification remains non-passing. | Exact-head evidence becomes stale after any source push. @@ -51,7 +52,7 @@ Exact-head evidence becomes stale after any source push. TEPP owns temporal/event composition, irregular time, time-varying multilevel/cross-classified/multiple-membership semantics, longitudinal invariance/drift/alignment, leakage-safe knowledge cutoff, temporal recovery, Validation Evidence, and Projection policy. `longitudinal_modeling` is the bounded context and `longitudinal_core` is its current Rust implementation path. -`psychometric_core` is not the authority for new temporal/state composition. It retains existing measurement/legacy compatibility surfaces while explicit adapters are formed. fast-mlsirm owns reusable static/generalized-mixed/dependence-aware psychometric specification and arithmetic. TEPP consumes only immutable released/versioned Published Language through an ACL; source copying and mutable sibling-head dependencies are prohibited. +`psychometric_core` is not authority for new temporal/state composition. fast-mlsirm owns reusable static/generalized-mixed/dependence-aware psychometric specification and arithmetic. TEPP consumes only immutable released/versioned Published Language through an ACL; source copying and mutable sibling-head dependencies are prohibited. contextual-orchestrator owns provider/model routing and semantic LLM execution. Context Graph contracts are contract-only integration authority; EA Core owns enterprise-architecture decisions. No cross-service SQL. @@ -63,9 +64,10 @@ The clock contract separates event/valid time, assertion time, document time, sy - Cross-classification and multiple membership remain distinct; weights are explicit, auditable, time-valid, and normalized or model-estimated according to the formulation. - A nominal unit identifier is not repeated-measures evidence; singleton units cannot satisfy a longitudinal multilevel floor. - Occasion-mean deviations `p_it = x_it - μ_t` are not CWC residuals, sample-wide grand-mean residuals, or RI-CLPM within-person effects. Numeric event time defines occasion identity, so `-0.0` and `+0.0` are one occasion. -- Row arrival order is not scientific evidence. For a fixed admitted occasion, the same scores must produce bit-identical occasion means and centered pairs under input permutation. -- A representable final scientific estimand is not rejected solely because an avoidable intermediate binary64 operation overflows/underflows. A final false 0/1/non-finite boundary remains fail-closed where the mathematical estimand is interior/nonzero. -- TEPP composes time over the full released upstream candidate identity; auto-expansion never means auto-activation. +- Row arrival order is not scientific evidence. Fixed admitted observations must produce bit-identical means/centered results under permutation wherever the contract claims deterministic f64 reference behavior. +- A representable final scientific estimand is not rejected solely because an avoidable intermediate binary64 operation overflows/underflows. False exact 0/1/non-finite endpoints remain fail-closed when the mathematical estimand is interior/nonzero. +- Observed Allen support classes are data, not required design strata. A historical prediction census may truthfully have zero covered, partial-overlap, adjacent, or contradictory rows; absent classes remain explicit zero counts rather than invalidating the run. +- Historical-cutoff admission occurs before duplicate-identity checks. Future-unavailable evidence cannot change an earlier run's conflicts, counts, or terminal state. - Supported temporal estimators require state/trajectory and claimed-structure recovery, bias/RMSE, interval coverage, convergence, uncertainty calibration, and leakage-safe rolling-origin evidence. - CPU/GPU parity counts only when the relevant accelerator path actually runs. Monte Carlo decisions use simulation uncertainty rather than arbitrary pass percentages. - Scientific failures are never hidden with skip/xfail/source rewriting/coverage exclusions. @@ -74,33 +76,29 @@ The clock contract separates event/valid time, assertion time, document time, sy ### #310 — Longitudinal Modeling -#310 remains the canonical Longitudinal Modeling landing vehicle. Existing repair lineage covers lagged Pearson correlation with both marginal variances, stationary-variance materialization versus algebraically cancelled standardized maps, discrete-diffusion endpoint/subnormal representability, CWC atomistic admission, one irregular-rate authority, known-truth recovery, and DDD relocation from `psychometric_core` to `longitudinal_core`. +#310 remains the canonical Longitudinal Modeling landing vehicle. Its lineage covers lagged Pearson correlation with both marginal variances, stationary-variance materialization versus algebraically cancelled standardized maps, discrete-diffusion endpoint/subnormal representability, CWC atomistic admission, one irregular-rate authority, known-truth recovery, and DDD relocation from `psychometric_core` to `longitudinal_core`. -The newest fold repairs #486's occasion-mean slice test-first: +The #486 occasion-mean fold is owner-correct on #310: RED `75b0184d...`, owner repair `7fe9aaf2...`, export/test repairs `b900e213...` / `30771ff2...`, determinism RED `8a59019e...`, same-sign ordering repair `465d139d...`, same-panel/sparse successor regressions `b9e952bb...` / `aad56b50...`, ADR `04b3c26e...`, PRD `a221f494...`, and research trace `27aa78ee...`. Exact head `9def784a...` additionally canonicalizes the older CWC/irregular-residual same-sign mean path with `f64::total_cmp`. -- RED `75b0184d2f6341ef23cf14fc84398c68d8d95d22` requires numeric signed-zero occasion identity, rejects a duplicate unit hidden behind `-0.0`/`+0.0`, preserves the known exact scalar residual log-rate, and pins `[0.75·MAX, 0.75·MAX, -0.5·MAX]` as a representable occasion-mean case that naive same-sign partial summation would overflow. -- Repair `7fe9aaf2570ffb6ecff3d6a83b12a30865fc198b` implements occasion-mean event-time composition in `crates/longitudinal_core/src/occasion_mean.rs`. It canonicalizes numeric zero, requires at least two distinct units per occasion and at least two lag-contributing units, retains typed positive finite event intervals, cancels opposing magnitudes before bounded same-sign averaging, and reuses the existing Longitudinal exact-log-rate boundary. -- Export repair `b900e21301f1f5bb769464a4b76da9088cd669ab` publishes the boundary through `longitudinal_core`; `30771ff24cf85479eb5ed227789b59489ac7ead2` fixes the typed interval accessor in the regression contract. -- Determinism RED `8a59019ed3112a3e27dd0dcd1b6b86d8d45e5435` permutes one fixed same-sign occasion `{1, nextafter(1,+∞), MAX/2}` and requires bit-identical centered pairs. Repair `465d139dce6101c4958c8b0827b6ef5d674b54c2` orders same-sign values before incremental averaging so arrival order cannot change the scientific result. -- Research trace `7269cd78b0e0843946677ee50fdc09847e19af83` updates `docs/research/occasion-mean-event-time-composition.md` with both RED lineages, the Hamaker et al. (2015) estimand boundary, and the deterministic-order invariant without the mixed `Z KST` provenance string present on #486. +At `9def784a...`, CodeQL PR run `33699010954` is `startup_failure` with zero materialized jobs. Rust Foundation CI, Documentation Quality, Security Scan, SAST Semgrep, OSV-Scanner PR, and Scorecard PR are queued. #310 remains Draft and non-passing. -At exact head `7269cd78b0e0843946677ee50fdc09847e19af83`, CodeQL PR run `33694429503` is `startup_failure` with zero materialized jobs. Rust Foundation CI, Documentation Quality, Security Scan, SAST Semgrep, OSV-Scanner PR, and Scorecard PR are queued. No qualifying independent current-head approval exists. #310 stays Draft and is not merge-ready. - -#486 remains open Draft and conflict-exposing beneath #310. Its wrong-owner implementation must not be independently landed. The child may be closed only after its remaining unique documentation/contract/TRACEABILITY delta is proven inherited by a surviving #310 head; the mixed `2026-09-03T06:07Z KST` provenance text remains a child repair finding rather than a reason for evidence-losing closure. +#486 remains open Draft beneath the refreshed #310 base. It can close only after its remaining valid CHANGELOG/operational wording is either inherited owner-correctly or verified redundant; wrong-owner source and mixed `Z KST` provenance are intentionally rejected rather than copied. ### #416 — Validation / Analysis Run consolidation -#416 `0b7155cc238defb1e55129ff3000658f04b343cf` centralizes the leakage-safe invariant that availability filtering occurs before duplicate-identity admission. #458/#460/#482/#483/#484/#485 remain fold children over shared Cargo/lib/lock/docs surfaces. Their unique evidence must reach a surviving #416 head before any child can be considered fully superseded. +#416 `0b7155cc...` centralizes the leakage-safe invariant that availability filtering occurs before duplicate-identity admission. #458/#460/#482/#483/#484/#485/#487 are current fold children over shared Cargo/lib/lock/docs surfaces. Their unique evidence must reach a surviving #416 exact head before any child can be considered fully superseded. + +#487 exposed a scientific acceptance bug: the first implementation required all four Allen support classes and at least four assignments merely because the test fixture exercised those branches. RED `a2892b6...` requires covered-only and contradiction-only historical censuses to succeed with truthful zero counts. Repair `a6402015...` keeps only real invariants: nonempty admitted evidence, size bound, exact class sums, refusal-plus-covered conservation, cutoff-safe admission, digest/schema validation, and claim boundary. `6b0c8de6...` removes predecessor tests that encoded the rejected fixture-as-production rule. The child remains conflicted beneath #416 and has no materialized PR workflow run at this head, so it is not GREEN and does not transfer evidence to #416. ### #480 — contextual-orchestrator boundary -#480 removes TEPP-owned provider discovery/ranking and requires the contextual-orchestrator owner contract. contextual-orchestrator currently has no immutable GitHub release for this consumer path, so #480 remains Draft/blocked-equivalent. Mutable owner `main` is not a released production contract. +#480 removes TEPP-owned provider discovery/ranking and requires the contextual-orchestrator owner contract. contextual-orchestrator protected `main@212ff437dc297613289dba2e6064ade9942e07d8` still has no GitHub release. #480 remains Draft/blocked-equivalent; mutable owner `main` is not a released production contract. ### Owner handoffs -Reusable static/generalized-mixed/dependence psychometric arithmetic remains fast-mlsirm-owned. The currently released fast-mlsirm version must be compared with open owner work before any TEPP adoption; an open PR head is never dependency authority. +fast-mlsirm protected `main@b5a3a0c1057d4b53d7a4bb18e0de69f630c2b45c`; latest immutable release remains `v0.9.1` (2026-08-26). Open owner heads newer than that release are candidate evidence, not TEPP dependency authority. -`context-graph-contracts` and `enterprise-architecture-core` remain read-only from this TEPP writer. Their open heads are candidate evidence only until immutable releases exist. +`context-graph-contracts` remains read-only at protected `develop@99cb5468ba3c15c5e79688f53dee74724fae2d13` with no GitHub release. `enterprise-architecture-core` remains read-only at protected `develop@1c0fa8b15ceb9e72186274aeb255d6777eb84ef4` with no GitHub release. ### #437 — ADR identity @@ -110,7 +108,7 @@ Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/num | ID | Gap | Maturity | Closure evidence | | --- | --- | --- | --- | -| GAP-001 | PR authority fragmented across 133 open PRs | `release-blocking` | coherent landing vehicles, unique-evidence preservation, protected-main reduction | +| GAP-001 | PR authority fragmented across 134 open PRs | `release-blocking` | coherent landing vehicles, unique-evidence preservation, protected-main reduction | | GAP-002 | multilingual span-grounded semantic/concept admission | `partial` | immutable offsets/layout, KO/EN/JA/ZH/VI/ES/DE/FR profiles, concept dictionary, invariance/calibration, hostile-input tests | | GAP-003 | shared-latent temporal topic estimator | `partial` | Rust CPU f64 likelihood/uncertainty, relation/time/membership effects, true recovery, fitted candidate-K | | GAP-004 | durable end-to-end Analysis Run | `partial` | idempotent lifecycle, persistence/recovery, estimator-bound artifacts, validation/promotion separation, Compose E2E | @@ -128,17 +126,18 @@ Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/num | GAP-016 | hourly LLM path needs released owner-only routing/authentication | `active-repair` | #480 Draft + released CO adoption + exact-head GREEN/review/main merge | | GAP-017 | dynamic evaluation item/rater/anchor drift monitoring | `owner-contract-active` | released/digest-pinned dynamic criterion/item/run contract, ACL conformance, no-anchor/no-linking refusal, evidence-gated temporal monitoring | | GAP-018 | Longitudinal stable-mean logic remains duplicated | `active-refactor` | semantic-equivalence proof, one TEPP Longitudinal primitive or released fast-mlsirm generic owner contract, recovery parity | -| GAP-019 | Longitudinal scientific instructions contradicted stationary-overflow implementation | `verification-pending` | RED `9d8a82d...` + repair `9c962205...`; exact-head Documentation Quality/review GREEN and protected-main integration | +| GAP-019 | Longitudinal scientific instructions contradicted stationary-overflow implementation | `verification-pending` | RED `9d8a82d...` + repair `9c962205...`; exact-head documentation/review GREEN and protected-main integration | | GAP-020 | Nonzero lagged covariance can be misreported as exact-zero correlation when standardized magnitude is unrepresentable | `verification-pending` | RED `c345ee7b...` + repair `5785e07a...`; exact-head Rust/documentation/review GREEN and protected-main integration | | GAP-021 | Longitudinal irregular-rate facade duplicated public wrapper identities over one canonical implementation | `verification-pending` | RED `464863860...` + repair `7f0bea084...`; exact-head Rust/documentation/review GREEN and protected-main integration | -| GAP-022 | Architecture assigned Longitudinal Modeling semantics to `psychometric_core` and duplicated implementation responsibility rows | `verification-pending` | RED `fe5eb745...` + repair `7fadc757...`; exact-head documentation/quality review GREEN and protected-main integration | -| GAP-023 | `discreteDIFFUSIONstd` rejected a representable subnormal final ratio because `aΔt` underflowed before the required factor two | `verification-pending` | RED `d5107b198...` + repair `7164c7ce4...`; exact-head Rust/documentation/review GREEN and protected-main integration | -| GAP-024 | Contributor guidance re-authorized a direct provider credential after LLM ownership moved to contextual-orchestrator | `verification-pending` | RED `4248b335...` + repair `01f45a993...`; released CO adoption, exact-head documentation/security/review GREEN, protected-main integration | -| GAP-025 | A singleton unit could satisfy the nominal CWC unit floor while all lag evidence came from one repeated unit | `verification-pending` | RED `671709bbc...` + repair `4784b370c...`; exact-head Rust/documentation/review GREEN and protected-main integration | +| GAP-022 | Architecture assigned Longitudinal Modeling semantics to `psychometric_core` and duplicated implementation responsibility rows | `verification-pending` | RED `fe5eb745...` + repair `7fadc757...`; exact-head documentation/review GREEN and protected-main integration | +| GAP-023 | `discreteDIFFUSIONstd` rejected a representable subnormal final ratio because `aΔt` underflowed before the required factor two | `verification-pending` | RED `d5107b198...` + repair `7164c7ce4...`; exact-head GREEN and protected-main integration | +| GAP-024 | Contributor guidance re-authorized a direct provider credential after LLM ownership moved to contextual-orchestrator | `verification-pending` | RED `4248b335...` + repair `01f45a993...`; released CO adoption and exact-head GREEN/review/main merge | +| GAP-025 | A singleton unit could satisfy the nominal CWC unit floor while all lag evidence came from one repeated unit | `verification-pending` | RED `671709bbc...` + repair `4784b370c...`; exact-head GREEN and protected-main integration | | GAP-026 | Scalar standardized longitudinal maps rejected representable finals when a cancelled stationary-variance intermediate lay outside binary64 range | `verification-pending` | RED `4a1f6c49...` / `96d8ed13...` + repairs `a4bc6230...` / `33f4b187...` / `26b03c32...`; exact-head GREEN and protected-main integration | -| GAP-027 | Finite-interval `discreteDIFFUSIONstd` could report exact unit diffusion after exponent overflow/saturation erased a nonzero remainder | `verification-pending` | RED `a8de3c9f...` + repair `c17e2ff8...`; exact-head GREEN and protected-main integration | +| GAP-027 | Finite-interval `discreteDIFFUSIONstd` could report exact unit diffusion after exponent saturation erased a nonzero remainder | `verification-pending` | RED `a8de3c9f...` + repair `c17e2ff8...`; exact-head GREEN and protected-main integration | | GAP-028 | Actual stationary variance `p` could be misreported as exact zero when positive real `p` lies below binary64 range | `verification-pending` | RED `27d9fa39...` + repair `a0132b62...`; exact-head GREEN and protected-main integration | -| GAP-029 | Occasion-mean temporal composition arrived in the wrong bounded context with raw-bit event identity, naive mean summation, and input-order-dependent same-sign averaging | `active-fold` | RED `75b0184d...`; owner repair `7fe9aaf2...`; export/test repairs `b900e213...` / `30771ff2...`; determinism RED `8a59019e...` + repair `465d139d...`; research trace `7269cd78...`; verify remaining #486 unique evidence inheritance; exact-head GREEN/review/main integration | +| GAP-029 | Occasion-mean temporal composition arrived in the wrong bounded context with raw-bit event identity, naive mean summation, and order-dependent averaging | `active-fold` | owner-correct #310 lineage through `9def784a...`; verify remaining #486 unique evidence; exact-head GREEN/review/main integration | +| GAP-030 | Prediction-contradiction Analysis Run treated four observed relation classes as mandatory design strata | `active-fold` | RED `a2892b6...` + repair `a6402015...` + predecessor-test correction `6b0c8de6...`; fold unique evidence into #416; exact-survivor GREEN/review/main integration | ## Release gate From e4b2d8fc7ae57966bd63d678ce3a4b5f393256a7 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 3 Sep 2026 11:08:26 +0900 Subject: [PATCH 118/235] docs(ddd): refresh longitudinal numerical gap authority --- docs/product-technical-gap-baseline.md | 27 +++++++++++++++----------- 1 file changed, 16 insertions(+), 11 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index ff00dbbc0..6c1fb08d8 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,7 +4,7 @@ **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-03T01:15Z +**Snapshot:** 2026-09-03T02:07Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` @@ -35,7 +35,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | | #487 | `6b0c8de64f41bc11f8bf908e0f9cbe854c1e213c` | true | #416 `feat/copy-identity-analysis-run-gap-004` | Validation / Analysis Run fold child. Sparse observed relation classes are valid evidence; RED `a2892b6...`, repair `a6402015...`, predecessor-test correction `6b0c8de6...`. No child-head CI transfers to #416. | -| #486 | `c451587e288ba119aebda67addee382106daf670` | true | #310 `agent/psychometric-discrete-drift-std-clean@9def784a...` | Longitudinal fold child, non-force base refreshed to the current survivor. Preserve unique Hamaker source/doctoring; reject wrong-owner `psychometric_core` temporal implementation and mixed-timezone provenance. | +| #486 | `c451587e288ba119aebda67addee382106daf670` | true | #310 `agent/psychometric-discrete-drift-std-clean` | Longitudinal fold child. Preserve unique Hamaker source/doctoring; reject wrong-owner `psychometric_core` temporal implementation and mixed-timezone provenance. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | | #483 | `847d96f913bb261803ac0bd751ad7e4f51324cee` | true | #416 | Analysis Run fold child; preserve unique evidence. | @@ -44,7 +44,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | #460 | `dfab4eab5ff733731e565a9348072b8dab2e4912` | true | #416 | Analysis Run fold child; typed cutoff equality and terminal-validation separation. | | #458 | `08165e3b3c929b4ae77396689549f72723ff8ff5` | true | #416 | Analysis Run fold child; typed cutoff equality and terminal-validation separation. | | #416 | `0b7155cc238defb1e55129ff3000658f04b343cf` | true | `main` | Validation / Analysis Run landing vehicle; availability cutoff precedes duplicate-identity admission. | -| #310 | `9def784a78bed0c3990f8366f1a7f64d9c64043b` | true | `main` | Longitudinal Modeling vehicle; owner-correct occasion composition and deterministic stable-mean arithmetic. Hosted exact-head verification remains non-passing. | +| #310 | `b14eb6e863cce1b94b36e787ada2ec32c129cadf` | true | `main` | Longitudinal Modeling vehicle; CWC and occasion means preserve representable binary64 subnormal ties-to-even behavior. Hosted exact-head verification remains non-passing. | Exact-head evidence becomes stale after any source push. @@ -66,6 +66,7 @@ The clock contract separates event/valid time, assertion time, document time, sy - Occasion-mean deviations `p_it = x_it - μ_t` are not CWC residuals, sample-wide grand-mean residuals, or RI-CLPM within-person effects. Numeric event time defines occasion identity, so `-0.0` and `+0.0` are one occasion. - Row arrival order is not scientific evidence. Fixed admitted observations must produce bit-identical means/centered results under permutation wherever the contract claims deterministic f64 reference behavior. - A representable final scientific estimand is not rejected solely because an avoidable intermediate binary64 operation overflows/underflows. False exact 0/1/non-finite endpoints remain fail-closed when the mathematical estimand is interior/nonzero. +- Binary64 minimum-subnormal means follow IEEE ties-to-even at the public composition boundary; deterministic averaging must not introduce a second rounding that changes centered residual identity. - Observed Allen support classes are data, not required design strata. A historical prediction census may truthfully have zero covered, partial-overlap, adjacent, or contradictory rows; absent classes remain explicit zero counts rather than invalidating the run. - Historical-cutoff admission occurs before duplicate-identity checks. Future-unavailable evidence cannot change an earlier run's conflicts, counts, or terminal state. - Supported temporal estimators require state/trajectory and claimed-structure recovery, bias/RMSE, interval coverage, convergence, uncertainty calibration, and leakage-safe rolling-origin evidence. @@ -78,27 +79,29 @@ The clock contract separates event/valid time, assertion time, document time, sy #310 remains the canonical Longitudinal Modeling landing vehicle. Its lineage covers lagged Pearson correlation with both marginal variances, stationary-variance materialization versus algebraically cancelled standardized maps, discrete-diffusion endpoint/subnormal representability, CWC atomistic admission, one irregular-rate authority, known-truth recovery, and DDD relocation from `psychometric_core` to `longitudinal_core`. -The #486 occasion-mean fold is owner-correct on #310: RED `75b0184d...`, owner repair `7fe9aaf2...`, export/test repairs `b900e213...` / `30771ff2...`, determinism RED `8a59019e...`, same-sign ordering repair `465d139d...`, same-panel/sparse successor regressions `b9e952bb...` / `aad56b50...`, ADR `04b3c26e...`, PRD `a221f494...`, and research trace `27aa78ee...`. Exact head `9def784a...` additionally canonicalizes the older CWC/irregular-residual same-sign mean path with `f64::total_cmp`. +The #486 occasion-mean fold is owner-correct on #310: RED `75b0184d...`, owner repair `7fe9aaf2...`, export/test repairs `b900e213...` / `30771ff2...`, determinism RED `8a59019e...`, same-sign ordering repair `465d139d...`, same-panel/sparse successor regressions `b9e952bb...` / `aad56b50...`, ADR `04b3c26e...`, PRD `a221f494...`, research trace `27aa78ee...`, subnormal RED `9aff817f...`, source repair `40e057b8...`, and trace `a2e6ace7...`. -At `9def784a...`, CodeQL PR run `33699010954` is `startup_failure` with zero materialized jobs. Rust Foundation CI, Documentation Quality, Security Scan, SAST Semgrep, OSV-Scanner PR, and Scorecard PR are queued. #310 remains Draft and non-passing. +Fresh review then found the same binary64 double-rounding class in the CWC/irregular-residual mean primitive. `same_sign_mean` still used sorted incremental averaging. For scores `[from_bits(1), from_bits(2)]`, the exact mean is 1.5 minimum-subnormal ULPs and ties-to-even requires `from_bits(2)`; the predecessor returned `from_bits(1)`, changing centered residuals. RED `23476f45c506504babf16f33e6d61fdddef23b67` pins the public CWC contract. Causal repair `b14eb6e863cce1b94b36e787ada2ec32c129cadf` uses deterministic max-magnitude normalization plus compensated summation and one final scale-back in the existing Longitudinal mean primitive. -#486 remains open Draft beneath the refreshed #310 base. It can close only after its remaining valid CHANGELOG/operational wording is either inherited owner-correctly or verified redundant; wrong-owner source and mixed `Z KST` provenance are intentionally rejected rather than copied. +At `b14eb6e...`, CodeQL PR run `33706246475` is `startup_failure`. Rust Foundation CI, Documentation Quality, Security Scan, SAST Semgrep, OSV-Scanner PR, and Scorecard PR are queued. CodeRabbit status alone is not protected-branch GREEN; REST review history contains no `APPROVED` submission. #310 remains Draft and non-passing. + +#486 remains open Draft beneath #310. It can close only after its remaining valid CHANGELOG/operational wording is either inherited owner-correctly or verified redundant; wrong-owner source and mixed `Z KST` provenance are intentionally rejected rather than copied. ### #416 — Validation / Analysis Run consolidation #416 `0b7155cc...` centralizes the leakage-safe invariant that availability filtering occurs before duplicate-identity admission. #458/#460/#482/#483/#484/#485/#487 are current fold children over shared Cargo/lib/lock/docs surfaces. Their unique evidence must reach a surviving #416 exact head before any child can be considered fully superseded. -#487 exposed a scientific acceptance bug: the first implementation required all four Allen support classes and at least four assignments merely because the test fixture exercised those branches. RED `a2892b6...` requires covered-only and contradiction-only historical censuses to succeed with truthful zero counts. Repair `a6402015...` keeps only real invariants: nonempty admitted evidence, size bound, exact class sums, refusal-plus-covered conservation, cutoff-safe admission, digest/schema validation, and claim boundary. `6b0c8de6...` removes predecessor tests that encoded the rejected fixture-as-production rule. The child remains conflicted beneath #416 and has no materialized PR workflow run at this head, so it is not GREEN and does not transfer evidence to #416. +#487 exposed a scientific acceptance bug: the first implementation required all four Allen support classes and at least four assignments merely because the test fixture exercised those branches. RED `a2892b6...` requires covered-only and contradiction-only historical censuses to succeed with truthful zero counts. Repair `a6402015...` keeps only real invariants: nonempty admitted evidence, size bound, exact class sums, refusal-plus-covered conservation, cutoff-safe admission, digest/schema validation, and claim boundary. `6b0c8de6...` removes predecessor tests that encoded the rejected fixture-as-production rule. The child remains conflicted beneath #416 and does not transfer child-head evidence to #416. ### #480 — contextual-orchestrator boundary -#480 removes TEPP-owned provider discovery/ranking and requires the contextual-orchestrator owner contract. contextual-orchestrator protected `main@212ff437dc297613289dba2e6064ade9942e07d8` still has no GitHub release. #480 remains Draft/blocked-equivalent; mutable owner `main` is not a released production contract. +#480 removes TEPP-owned provider discovery/ranking and requires the contextual-orchestrator owner contract. The current CO protected main has no GitHub release in the latest verified owner sweep. #480 remains Draft/blocked-equivalent; mutable owner `main` is not a released production contract. ### Owner handoffs -fast-mlsirm protected `main@b5a3a0c1057d4b53d7a4bb18e0de69f630c2b45c`; latest immutable release remains `v0.9.1` (2026-08-26). Open owner heads newer than that release are candidate evidence, not TEPP dependency authority. +fast-mlsirm latest verified immutable release remains `v0.9.1` (2026-08-26). Open owner heads newer than that release are candidate evidence, not TEPP dependency authority. -`context-graph-contracts` remains read-only at protected `develop@99cb5468ba3c15c5e79688f53dee74724fae2d13` with no GitHub release. `enterprise-architecture-core` remains read-only at protected `develop@1c0fa8b15ceb9e72186274aeb255d6777eb84ef4` with no GitHub release. +Context Graph Contracts and Enterprise Architecture Core remain read-only owner dependencies until their relevant contracts are immutable releases. No sibling mutable head is promoted to TEPP production authority. ### #437 — ADR identity @@ -136,8 +139,10 @@ Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/num | GAP-026 | Scalar standardized longitudinal maps rejected representable finals when a cancelled stationary-variance intermediate lay outside binary64 range | `verification-pending` | RED `4a1f6c49...` / `96d8ed13...` + repairs `a4bc6230...` / `33f4b187...` / `26b03c32...`; exact-head GREEN and protected-main integration | | GAP-027 | Finite-interval `discreteDIFFUSIONstd` could report exact unit diffusion after exponent saturation erased a nonzero remainder | `verification-pending` | RED `a8de3c9f...` + repair `c17e2ff8...`; exact-head GREEN and protected-main integration | | GAP-028 | Actual stationary variance `p` could be misreported as exact zero when positive real `p` lies below binary64 range | `verification-pending` | RED `27d9fa39...` + repair `a0132b62...`; exact-head GREEN and protected-main integration | -| GAP-029 | Occasion-mean temporal composition arrived in the wrong bounded context with raw-bit event identity, naive mean summation, and order-dependent averaging | `active-fold` | owner-correct #310 lineage through `9def784a...`; verify remaining #486 unique evidence; exact-head GREEN/review/main integration | +| GAP-029 | Occasion-mean temporal composition arrived in the wrong bounded context with raw-bit event identity, naive mean summation, and order-dependent averaging | `active-fold` | owner-correct #310 lineage; verify remaining #486 unique evidence; exact-head GREEN/review/main integration | | GAP-030 | Prediction-contradiction Analysis Run treated four observed relation classes as mandatory design strata | `active-fold` | RED `a2892b6...` + repair `a6402015...` + predecessor-test correction `6b0c8de6...`; fold unique evidence into #416; exact-survivor GREEN/review/main integration | +| GAP-031 | Occasion-mean same-sign averaging double-rounded a representable minimum-subnormal ties-to-even mean | `verification-pending` | RED `9aff817f...` + repair `40e057b8...` + trace `a2e6ace7...`; exact-head GREEN and protected-main integration | +| GAP-032 | CWC/irregular-residual same-sign averaging retained the same minimum-subnormal double-rounding defect | `verification-pending` | RED `23476f45...` + repair `b14eb6e8...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | ## Release gate From 239b023f63148dd15cc824d0cdc2bf1f4d6d5728 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 3 Sep 2026 12:08:09 +0900 Subject: [PATCH 119/235] docs(delivery): trace exact-scale longitudinal mean repair --- docs/product-technical-gap-baseline.md | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 6c1fb08d8..2dde067f7 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,7 +4,7 @@ **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-03T02:07Z +**Snapshot:** 2026-09-03T03:04Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` @@ -44,7 +44,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | #460 | `dfab4eab5ff733731e565a9348072b8dab2e4912` | true | #416 | Analysis Run fold child; typed cutoff equality and terminal-validation separation. | | #458 | `08165e3b3c929b4ae77396689549f72723ff8ff5` | true | #416 | Analysis Run fold child; typed cutoff equality and terminal-validation separation. | | #416 | `0b7155cc238defb1e55129ff3000658f04b343cf` | true | `main` | Validation / Analysis Run landing vehicle; availability cutoff precedes duplicate-identity admission. | -| #310 | `b14eb6e863cce1b94b36e787ada2ec32c129cadf` | true | `main` | Longitudinal Modeling vehicle; CWC and occasion means preserve representable binary64 subnormal ties-to-even behavior. Hosted exact-head verification remains non-passing. | +| #310 | `dd53eff6ed939ae06b51d70959c06b2a36fade08` | true | `main` | Longitudinal Modeling vehicle; CWC and occasion means share one Longitudinal-local stable-mean authority with exact power-of-two normalization. Hosted exact-head verification remains non-passing. | Exact-head evidence becomes stale after any source push. @@ -66,7 +66,7 @@ The clock contract separates event/valid time, assertion time, document time, sy - Occasion-mean deviations `p_it = x_it - μ_t` are not CWC residuals, sample-wide grand-mean residuals, or RI-CLPM within-person effects. Numeric event time defines occasion identity, so `-0.0` and `+0.0` are one occasion. - Row arrival order is not scientific evidence. Fixed admitted observations must produce bit-identical means/centered results under permutation wherever the contract claims deterministic f64 reference behavior. - A representable final scientific estimand is not rejected solely because an avoidable intermediate binary64 operation overflows/underflows. False exact 0/1/non-finite endpoints remain fail-closed when the mathematical estimand is interior/nonzero. -- Binary64 minimum-subnormal means follow IEEE ties-to-even at the public composition boundary; deterministic averaging must not introduce a second rounding that changes centered residual identity. +- Binary64 minimum-subnormal means follow IEEE ties-to-even at the public composition boundary; deterministic averaging must not introduce a second rounding that changes centered residual identity. Normalization used for overflow safety must itself be exact enough not to introduce a non-power-of-two pre-rounding step. - Observed Allen support classes are data, not required design strata. A historical prediction census may truthfully have zero covered, partial-overlap, adjacent, or contradictory rows; absent classes remain explicit zero counts rather than invalidating the run. - Historical-cutoff admission occurs before duplicate-identity checks. Future-unavailable evidence cannot change an earlier run's conflicts, counts, or terminal state. - Supported temporal estimators require state/trajectory and claimed-structure recovery, bias/RMSE, interval coverage, convergence, uncertainty calibration, and leakage-safe rolling-origin evidence. @@ -81,11 +81,11 @@ The clock contract separates event/valid time, assertion time, document time, sy The #486 occasion-mean fold is owner-correct on #310: RED `75b0184d...`, owner repair `7fe9aaf2...`, export/test repairs `b900e213...` / `30771ff2...`, determinism RED `8a59019e...`, same-sign ordering repair `465d139d...`, same-panel/sparse successor regressions `b9e952bb...` / `aad56b50...`, ADR `04b3c26e...`, PRD `a221f494...`, research trace `27aa78ee...`, subnormal RED `9aff817f...`, source repair `40e057b8...`, and trace `a2e6ace7...`. -Fresh review then found the same binary64 double-rounding class in the CWC/irregular-residual mean primitive. `same_sign_mean` still used sorted incremental averaging. For scores `[from_bits(1), from_bits(2)]`, the exact mean is 1.5 minimum-subnormal ULPs and ties-to-even requires `from_bits(2)`; the predecessor returned `from_bits(1)`, changing centered residuals. RED `23476f45c506504babf16f33e6d61fdddef23b67` pins the public CWC contract. Causal repair `b14eb6e863cce1b94b36e787ada2ec32c129cadf` uses deterministic max-magnitude normalization plus compensated summation and one final scale-back in the existing Longitudinal mean primitive. +The earlier CWC RED `23476f45c506504babf16f33e6d61fdddef23b67` / repair `b14eb6e863cce1b94b36e787ada2ec32c129cadf` closed the sorted-incremental `[from_bits(1), from_bits(2)]` ties-to-even defect but still normalized same-sign values by an arbitrary maximum magnitude. Fresh review found the stricter `[from_bits(1), from_bits(14)]` case: the exact mean is 7.5 minimum-subnormal ULPs and must round to the even 8-ULP neighbour, while dividing first by a 14-ULP scale double-rounds to 7 ULPs. RED `b073f03f5e28c94226e7dcaa72e11b25233ccc65` pins both public CWC and occasion-mean composition paths. Repair `350b8d4e0fdb3f5d68cd22bdfffb3b879cea62f2` uses an exact power-of-two scale derived from the maximum magnitude before deterministic compensated summation. Consolidation `dd53eff6ed939ae06b51d70959c06b2a36fade08` removes the duplicate occasion-mean floating-point implementation and reuses the same Longitudinal-local `scaled_compensated_mean` authority while preserving the occasion API's payload-error mapping. -At `b14eb6e...`, CodeQL PR run `33706246475` is `startup_failure`. Rust Foundation CI, Documentation Quality, Security Scan, SAST Semgrep, OSV-Scanner PR, and Scorecard PR are queued. CodeRabbit status alone is not protected-branch GREEN; REST review history contains no `APPROVED` submission. #310 remains Draft and non-passing. +At `dd53eff6...`, CodeQL PR run `33709968354` is `startup_failure` with zero materialized jobs. Rust Foundation CI, OSV-Scanner PR, and Security Scan are queued; Documentation Quality, SAST Semgrep, and Scorecard PR are pending. CodeRabbit status alone is not protected-branch GREEN; fresh review history contains no `APPROVED` submission. #310 remains Draft and non-passing. -#486 remains open Draft beneath #310. It can close only after its remaining valid CHANGELOG/operational wording is either inherited owner-correctly or verified redundant; wrong-owner source and mixed `Z KST` provenance are intentionally rejected rather than copied. +#486 remains open Draft beneath the #310 branch. It can close only after its remaining valid CHANGELOG/operational wording is either inherited owner-correctly or verified redundant; wrong-owner source and mixed `Z KST` provenance are intentionally rejected rather than copied. ### #416 — Validation / Analysis Run consolidation @@ -143,7 +143,8 @@ Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/num | GAP-030 | Prediction-contradiction Analysis Run treated four observed relation classes as mandatory design strata | `active-fold` | RED `a2892b6...` + repair `a6402015...` + predecessor-test correction `6b0c8de6...`; fold unique evidence into #416; exact-survivor GREEN/review/main integration | | GAP-031 | Occasion-mean same-sign averaging double-rounded a representable minimum-subnormal ties-to-even mean | `verification-pending` | RED `9aff817f...` + repair `40e057b8...` + trace `a2e6ace7...`; exact-head GREEN and protected-main integration | | GAP-032 | CWC/irregular-residual same-sign averaging retained the same minimum-subnormal double-rounding defect | `verification-pending` | RED `23476f45...` + repair `b14eb6e8...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-033 | Arbitrary max-magnitude normalization introduced a second rounding and misrounded a 7.5-ULP subnormal mean to 7 ULPs | `verification-pending` | RED `b073f03f...` + exact-power-of-two repair `350b8d4e...` + Longitudinal mean-authority consolidation `dd53eff6...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | ## Release gate -TEPP currently has no GitHub release. Release is permitted only after a coherent vertical reaches protected main with exact protected-head CI/security/recovery evidence, reproducible package + SBOM + provenance + rollback artifacts, current version/CHANGELOG, required migration/restore/load evidence, and released integration contracts where deployment depends on them. Queued/pending/startup-failed/skipped or predecessor-head evidence is not GREEN. +TEPP currently has no GitHub release. Release is permitted only after a coherent vertical reaches protected main with exact protected-head CI/security/recovery evidence, reproducible package + SBOM + provenance + rollback artifacts, current version/CHANGELOG, required migration/restore/load evidence, and released integration contracts where deployment depends on them. Queued/pending/startup-failed/skipped or predecessor-head evidence is not GREEN. \ No newline at end of file From 137966184f3f34bafbe66e641698d6127ec6d65b Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 3 Sep 2026 12:33:56 +0900 Subject: [PATCH 120/235] docs(gap): trace mixed-sign longitudinal mean repair --- docs/product-technical-gap-baseline.md | 23 +++++++++++++---------- 1 file changed, 13 insertions(+), 10 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 2dde067f7..710cae56e 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,7 +4,7 @@ **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-03T03:04Z +**Snapshot:** 2026-09-03T03:31Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` @@ -44,7 +44,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | #460 | `dfab4eab5ff733731e565a9348072b8dab2e4912` | true | #416 | Analysis Run fold child; typed cutoff equality and terminal-validation separation. | | #458 | `08165e3b3c929b4ae77396689549f72723ff8ff5` | true | #416 | Analysis Run fold child; typed cutoff equality and terminal-validation separation. | | #416 | `0b7155cc238defb1e55129ff3000658f04b343cf` | true | `main` | Validation / Analysis Run landing vehicle; availability cutoff precedes duplicate-identity admission. | -| #310 | `dd53eff6ed939ae06b51d70959c06b2a36fade08` | true | `main` | Longitudinal Modeling vehicle; CWC and occasion means share one Longitudinal-local stable-mean authority with exact power-of-two normalization. Hosted exact-head verification remains non-passing. | +| #310 | `34fd059aa10c7538f3513b6fb994a9f2972ff5b1` | true | `main` | Longitudinal Modeling vehicle; mixed-sign retained-mean double rounding repaired and CWC/occasion public contracts share the same original-denominator numerical authority. Hosted exact-head verification remains non-passing. | Exact-head evidence becomes stale after any source push. @@ -66,7 +66,7 @@ The clock contract separates event/valid time, assertion time, document time, sy - Occasion-mean deviations `p_it = x_it - μ_t` are not CWC residuals, sample-wide grand-mean residuals, or RI-CLPM within-person effects. Numeric event time defines occasion identity, so `-0.0` and `+0.0` are one occasion. - Row arrival order is not scientific evidence. Fixed admitted observations must produce bit-identical means/centered results under permutation wherever the contract claims deterministic f64 reference behavior. - A representable final scientific estimand is not rejected solely because an avoidable intermediate binary64 operation overflows/underflows. False exact 0/1/non-finite endpoints remain fail-closed when the mathematical estimand is interior/nonzero. -- Binary64 minimum-subnormal means follow IEEE ties-to-even at the public composition boundary; deterministic averaging must not introduce a second rounding that changes centered residual identity. Normalization used for overflow safety must itself be exact enough not to introduce a non-power-of-two pre-rounding step. +- Binary64 minimum-subnormal means follow IEEE ties-to-even at the public composition boundary. Overflow-safe normalization must not add an avoidable earlier rounding step, and mixed-sign cancellation must apply the original sample-count denominator before rounding a retained-only mean. - Observed Allen support classes are data, not required design strata. A historical prediction census may truthfully have zero covered, partial-overlap, adjacent, or contradictory rows; absent classes remain explicit zero counts rather than invalidating the run. - Historical-cutoff admission occurs before duplicate-identity checks. Future-unavailable evidence cannot change an earlier run's conflicts, counts, or terminal state. - Supported temporal estimators require state/trajectory and claimed-structure recovery, bias/RMSE, interval coverage, convergence, uncertainty calibration, and leakage-safe rolling-origin evidence. @@ -77,13 +77,15 @@ The clock contract separates event/valid time, assertion time, document time, sy ### #310 — Longitudinal Modeling -#310 remains the canonical Longitudinal Modeling landing vehicle. Its lineage covers lagged Pearson correlation with both marginal variances, stationary-variance materialization versus algebraically cancelled standardized maps, discrete-diffusion endpoint/subnormal representability, CWC atomistic admission, one irregular-rate authority, known-truth recovery, and DDD relocation from `psychometric_core` to `longitudinal_core`. +#310 remains the canonical Longitudinal Modeling landing vehicle. Its lineage covers lagged Pearson correlation with both marginal variances, stationary-variance materialization versus algebraically cancelled standardized maps, discrete-diffusion endpoint/subnormal representability, CWC atomistic admission, one irregular-rate authority, occasion-mean composition, known-truth recovery, and DDD relocation from `psychometric_core` to `longitudinal_core`. The #486 occasion-mean fold is owner-correct on #310: RED `75b0184d...`, owner repair `7fe9aaf2...`, export/test repairs `b900e213...` / `30771ff2...`, determinism RED `8a59019e...`, same-sign ordering repair `465d139d...`, same-panel/sparse successor regressions `b9e952bb...` / `aad56b50...`, ADR `04b3c26e...`, PRD `a221f494...`, research trace `27aa78ee...`, subnormal RED `9aff817f...`, source repair `40e057b8...`, and trace `a2e6ace7...`. -The earlier CWC RED `23476f45c506504babf16f33e6d61fdddef23b67` / repair `b14eb6e863cce1b94b36e787ada2ec32c129cadf` closed the sorted-incremental `[from_bits(1), from_bits(2)]` ties-to-even defect but still normalized same-sign values by an arbitrary maximum magnitude. Fresh review found the stricter `[from_bits(1), from_bits(14)]` case: the exact mean is 7.5 minimum-subnormal ULPs and must round to the even 8-ULP neighbour, while dividing first by a 14-ULP scale double-rounds to 7 ULPs. RED `b073f03f5e28c94226e7dcaa72e11b25233ccc65` pins both public CWC and occasion-mean composition paths. Repair `350b8d4e0fdb3f5d68cd22bdfffb3b879cea62f2` uses an exact power-of-two scale derived from the maximum magnitude before deterministic compensated summation. Consolidation `dd53eff6ed939ae06b51d70959c06b2a36fade08` removes the duplicate occasion-mean floating-point implementation and reuses the same Longitudinal-local `scaled_compensated_mean` authority while preserving the occasion API's payload-error mapping. +The earlier CWC RED `23476f45c506504babf16f33e6d61fdddef23b67` / repair `b14eb6e863cce1b94b36e787ada2ec32c129cadf` closed the sorted-incremental `[from_bits(1), from_bits(2)]` ties-to-even defect. RED `b073f03f5e28c94226e7dcaa72e11b25233ccc65` then exposed arbitrary max-magnitude normalization at `[from_bits(1), from_bits(14)]`; repair `350b8d4e0fdb3f5d68cd22bdfffb3b879cea62f2` switched to an exact power-of-two scale and `dd53eff6ed939ae06b51d70959c06b2a36fade08` consolidated CWC and occasion means onto one Longitudinal-local primitive. -At `dd53eff6...`, CodeQL PR run `33709968354` is `startup_failure` with zero materialized jobs. Rust Foundation CI, OSV-Scanner PR, and Security Scan are queued; Documentation Quality, SAST Semgrep, and Scorecard PR are pending. CodeRabbit status alone is not protected-branch GREEN; fresh review history contains no `APPROVED` submission. #310 remains Draft and non-passing. +Fresh review then found a separate mixed-sign double-rounding boundary. For minimum-subnormal ULP `u`, `[-20u, -20u, 9u]` has exact mean `-31u/3` and must round once to `-10u`. The predecessor cancelled signs, rounded the surviving `[-11u, -20u]` mean to `-16u`, then weighted that rounded intermediate by `2/3`, yielding `-11u`. RED `ae5e61f9a829adbfed2ea13c5705d4b85d80b0d6` pins the correct value through public CWC. Causal repair `39469067aca2fa93e2fa4c914848f7cec8031811` applies the original sample-count denominator directly inside the shared normalized compensated sum. Contract hardening `201f3900960278cb87d2e6b28176ac0d23e51954` exercises the same boundary through public occasion-mean composition. Research trace `34fd059aa10c7538f3513b6fb994a9f2972ff5b1` makes the documented algorithm code-current. + +At exact head `34fd059a...`, Documentation Quality, SAST Semgrep, Rust Foundation CI, Security Scan, Scorecard PR, and OSV-Scanner PR are queued. Commit check-runs do not currently materialize a CodeQL check for this head. Fresh review submissions contain no qualifying `APPROVED`. #310 therefore remains Draft and non-passing; predecessor-head evidence is not inherited. #486 remains open Draft beneath the #310 branch. It can close only after its remaining valid CHANGELOG/operational wording is either inherited owner-correctly or verified redundant; wrong-owner source and mixed `Z KST` provenance are intentionally rejected rather than copied. @@ -95,11 +97,11 @@ At `dd53eff6...`, CodeQL PR run `33709968354` is `startup_failure` with zero mat ### #480 — contextual-orchestrator boundary -#480 removes TEPP-owned provider discovery/ranking and requires the contextual-orchestrator owner contract. The current CO protected main has no GitHub release in the latest verified owner sweep. #480 remains Draft/blocked-equivalent; mutable owner `main` is not a released production contract. +#480 removes TEPP-owned provider discovery/ranking and requires the contextual-orchestrator owner contract. Fresh owner evidence is protected `contextual-orchestrator/main@394bf4ed84947c95698979e376ed12103de007b5` with zero GitHub releases. #480 remains Draft/blocked-equivalent; mutable owner `main` is not a released production contract. ### Owner handoffs -fast-mlsirm latest verified immutable release remains `v0.9.1` (2026-08-26). Open owner heads newer than that release are candidate evidence, not TEPP dependency authority. +fast-mlsirm protected main remains `b5a3a0c1057d4b53d7a4bb18e0de69f630c2b45c`; latest verified immutable release remains `v0.9.1` (2026-08-26). Open owner heads newer than that release are candidate evidence, not TEPP dependency authority. Context Graph Contracts and Enterprise Architecture Core remain read-only owner dependencies until their relevant contracts are immutable releases. No sibling mutable head is promoted to TEPP production authority. @@ -128,7 +130,7 @@ Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/num | GAP-015 | contextual-orchestrator lacks immutable released contract for current owner behavior | `release-blocking` | compatible immutable CO release, deployment provenance, safe gateway auth, exact TEPP ACL adoption | | GAP-016 | hourly LLM path needs released owner-only routing/authentication | `active-repair` | #480 Draft + released CO adoption + exact-head GREEN/review/main merge | | GAP-017 | dynamic evaluation item/rater/anchor drift monitoring | `owner-contract-active` | released/digest-pinned dynamic criterion/item/run contract, ACL conformance, no-anchor/no-linking refusal, evidence-gated temporal monitoring | -| GAP-018 | Longitudinal stable-mean logic remains duplicated | `active-refactor` | semantic-equivalence proof, one TEPP Longitudinal primitive or released fast-mlsirm generic owner contract, recovery parity | +| GAP-018 | Longitudinal stable-mean logic remains duplicated outside the now-shared CWC/occasion primitive | `active-refactor` | semantic-equivalence proof for remaining decomposition/recovery means, one TEPP Longitudinal primitive where semantics match or released fast-mlsirm generic owner contract, recovery parity | | GAP-019 | Longitudinal scientific instructions contradicted stationary-overflow implementation | `verification-pending` | RED `9d8a82d...` + repair `9c962205...`; exact-head documentation/review GREEN and protected-main integration | | GAP-020 | Nonzero lagged covariance can be misreported as exact-zero correlation when standardized magnitude is unrepresentable | `verification-pending` | RED `c345ee7b...` + repair `5785e07a...`; exact-head Rust/documentation/review GREEN and protected-main integration | | GAP-021 | Longitudinal irregular-rate facade duplicated public wrapper identities over one canonical implementation | `verification-pending` | RED `464863860...` + repair `7f0bea084...`; exact-head Rust/documentation/review GREEN and protected-main integration | @@ -144,7 +146,8 @@ Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/num | GAP-031 | Occasion-mean same-sign averaging double-rounded a representable minimum-subnormal ties-to-even mean | `verification-pending` | RED `9aff817f...` + repair `40e057b8...` + trace `a2e6ace7...`; exact-head GREEN and protected-main integration | | GAP-032 | CWC/irregular-residual same-sign averaging retained the same minimum-subnormal double-rounding defect | `verification-pending` | RED `23476f45...` + repair `b14eb6e8...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-033 | Arbitrary max-magnitude normalization introduced a second rounding and misrounded a 7.5-ULP subnormal mean to 7 ULPs | `verification-pending` | RED `b073f03f...` + exact-power-of-two repair `350b8d4e...` + Longitudinal mean-authority consolidation `dd53eff6...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-034 | Mixed-sign cancellation rounded a retained-only mean before restoring the original denominator, moving a representable subnormal mean by one ULP | `verification-pending` | RED `ae5e61f9...` + causal repair `39469067...` + occasion public-contract hardening `201f3900...` + research trace `34fd059a...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | ## Release gate -TEPP currently has no GitHub release. Release is permitted only after a coherent vertical reaches protected main with exact protected-head CI/security/recovery evidence, reproducible package + SBOM + provenance + rollback artifacts, current version/CHANGELOG, required migration/restore/load evidence, and released integration contracts where deployment depends on them. Queued/pending/startup-failed/skipped or predecessor-head evidence is not GREEN. \ No newline at end of file +TEPP currently has no GitHub release. Release is permitted only after a coherent vertical reaches protected main with exact protected-head CI/security/recovery evidence, reproducible package + SBOM + provenance + rollback artifacts, current version/CHANGELOG, required migration/restore/load evidence, and released integration contracts where deployment depends on them. Queued/pending/startup-failed/skipped or predecessor-head evidence is not GREEN. From cecd8a864561a9c4cab1804679550d9de4d6b8a9 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 3 Sep 2026 12:44:07 +0900 Subject: [PATCH 121/235] docs(gap): refresh orchestrator owner evidence --- docs/product-technical-gap-baseline.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 710cae56e..696c4213e 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,7 +4,7 @@ **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-03T03:31Z +**Snapshot:** 2026-09-03T03:42Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` @@ -97,7 +97,7 @@ At exact head `34fd059a...`, Documentation Quality, SAST Semgrep, Rust Foundatio ### #480 — contextual-orchestrator boundary -#480 removes TEPP-owned provider discovery/ranking and requires the contextual-orchestrator owner contract. Fresh owner evidence is protected `contextual-orchestrator/main@394bf4ed84947c95698979e376ed12103de007b5` with zero GitHub releases. #480 remains Draft/blocked-equivalent; mutable owner `main` is not a released production contract. +#480 removes TEPP-owned provider discovery/ranking and requires the contextual-orchestrator owner contract. Fresh owner evidence is protected `contextual-orchestrator/main@f4e5fc67dfcb7ddb1afb004a06417e915afb9826` with zero GitHub releases. That owner main now contains the hourly OpenCode contract repair that removes repository-authored elapsed-time caps and pins model-backed execution to `orchestrator/free`, but it is still mutable unreleased evidence. #480 remains Draft/blocked-equivalent; mutable owner `main` is not a released production contract. ### Owner handoffs @@ -150,4 +150,4 @@ Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/num ## Release gate -TEPP currently has no GitHub release. Release is permitted only after a coherent vertical reaches protected main with exact protected-head CI/security/recovery evidence, reproducible package + SBOM + provenance + rollback artifacts, current version/CHANGELOG, required migration/restore/load evidence, and released integration contracts where deployment depends on them. Queued/pending/startup-failed/skipped or predecessor-head evidence is not GREEN. +TEPP currently has no GitHub release. Release is permitted only after a coherent vertical reaches protected main with exact protected-head CI/security/recovery evidence, reproducible package + SBOM + provenance + rollback artifacts, current version/CHANGELOG, required migration/restore/load evidence, and released integration contracts where deployment depends on them. Queued/pending/startup-failed/skipped or predecessor-head evidence is not GREEN. \ No newline at end of file From a4d20d7c6328442ca4519d0c5340d732dc800bde Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 3 Sep 2026 13:00:52 +0900 Subject: [PATCH 122/235] docs(ddd): record decomposition mean authority repair --- docs/product-technical-gap-baseline.md | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 696c4213e..4ae81382c 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,7 +4,7 @@ **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-03T03:42Z +**Snapshot:** 2026-09-03T03:56Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` @@ -44,7 +44,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | #460 | `dfab4eab5ff733731e565a9348072b8dab2e4912` | true | #416 | Analysis Run fold child; typed cutoff equality and terminal-validation separation. | | #458 | `08165e3b3c929b4ae77396689549f72723ff8ff5` | true | #416 | Analysis Run fold child; typed cutoff equality and terminal-validation separation. | | #416 | `0b7155cc238defb1e55129ff3000658f04b343cf` | true | `main` | Validation / Analysis Run landing vehicle; availability cutoff precedes duplicate-identity admission. | -| #310 | `34fd059aa10c7538f3513b6fb994a9f2972ff5b1` | true | `main` | Longitudinal Modeling vehicle; mixed-sign retained-mean double rounding repaired and CWC/occasion public contracts share the same original-denominator numerical authority. Hosted exact-head verification remains non-passing. | +| #310 | `a1aef11e8e38f34ac4d6cdfb4c61b099c04e69e6` | true | `main` | Longitudinal Modeling vehicle; CWC, occasion-mean, and within/between decomposition now share one Longitudinal-local stable-mean authority. Hosted exact-head verification remains non-passing. | Exact-head evidence becomes stale after any source push. @@ -77,15 +77,17 @@ The clock contract separates event/valid time, assertion time, document time, sy ### #310 — Longitudinal Modeling -#310 remains the canonical Longitudinal Modeling landing vehicle. Its lineage covers lagged Pearson correlation with both marginal variances, stationary-variance materialization versus algebraically cancelled standardized maps, discrete-diffusion endpoint/subnormal representability, CWC atomistic admission, one irregular-rate authority, occasion-mean composition, known-truth recovery, and DDD relocation from `psychometric_core` to `longitudinal_core`. +#310 remains the canonical Longitudinal Modeling landing vehicle. Its lineage covers lagged Pearson correlation with both marginal variances, stationary-variance materialization versus algebraically cancelled standardized maps, discrete-diffusion endpoint/subnormal representability, CWC atomistic admission, one irregular-rate authority, occasion-mean composition, known-truth recovery, within/between decomposition, and DDD relocation from `psychometric_core` to `longitudinal_core`. The #486 occasion-mean fold is owner-correct on #310: RED `75b0184d...`, owner repair `7fe9aaf2...`, export/test repairs `b900e213...` / `30771ff2...`, determinism RED `8a59019e...`, same-sign ordering repair `465d139d...`, same-panel/sparse successor regressions `b9e952bb...` / `aad56b50...`, ADR `04b3c26e...`, PRD `a221f494...`, research trace `27aa78ee...`, subnormal RED `9aff817f...`, source repair `40e057b8...`, and trace `a2e6ace7...`. The earlier CWC RED `23476f45c506504babf16f33e6d61fdddef23b67` / repair `b14eb6e863cce1b94b36e787ada2ec32c129cadf` closed the sorted-incremental `[from_bits(1), from_bits(2)]` ties-to-even defect. RED `b073f03f5e28c94226e7dcaa72e11b25233ccc65` then exposed arbitrary max-magnitude normalization at `[from_bits(1), from_bits(14)]`; repair `350b8d4e0fdb3f5d68cd22bdfffb3b879cea62f2` switched to an exact power-of-two scale and `dd53eff6ed939ae06b51d70959c06b2a36fade08` consolidated CWC and occasion means onto one Longitudinal-local primitive. -Fresh review then found a separate mixed-sign double-rounding boundary. For minimum-subnormal ULP `u`, `[-20u, -20u, 9u]` has exact mean `-31u/3` and must round once to `-10u`. The predecessor cancelled signs, rounded the surviving `[-11u, -20u]` mean to `-16u`, then weighted that rounded intermediate by `2/3`, yielding `-11u`. RED `ae5e61f9a829adbfed2ea13c5705d4b85d80b0d6` pins the correct value through public CWC. Causal repair `39469067aca2fa93e2fa4c914848f7cec8031811` applies the original sample-count denominator directly inside the shared normalized compensated sum. Contract hardening `201f3900960278cb87d2e6b28176ac0d23e51954` exercises the same boundary through public occasion-mean composition. Research trace `34fd059aa10c7538f3513b6fb994a9f2972ff5b1` makes the documented algorithm code-current. +Fresh review then found a separate mixed-sign double-rounding boundary. For minimum-subnormal ULP `u`, `[-20u, -20u, 9u]` has exact mean `-31u/3` and must round once to `-10u`. The predecessor cancelled signs, rounded the surviving `[-11u, -20u]` mean to `-16u`, then weighted that rounded intermediate by `2/3`, yielding `-11u`. RED `ae5e61f9a829adbfed2ea13c5705d4b85d80b0d6` pins the correct value through public CWC. Causal repair `39469067aca2fa93e2fa4c914848f7cec8031811` applies the original sample-count denominator directly inside the shared normalized compensated sum. Contract hardening `201f3900960278cb87d2e6b28176ac0d23e51954` exercises the same boundary through public occasion-mean composition. Research trace `34fd059aa10c7538f3513b6fb994a9f2972ff5b1` makes that algorithm code-current. -At exact head `34fd059a...`, Documentation Quality, SAST Semgrep, Rust Foundation CI, Security Scan, Scorecard PR, and OSV-Scanner PR are queued. Commit check-runs do not currently materialize a CodeQL check for this head. Fresh review submissions contain no qualifying `APPROVED`. #310 therefore remains Draft and non-passing; predecessor-head evidence is not inherited. +GAP-018 review then found that `decompose_within_between` still maintained a shadow running/cancellation mean after CWC and occasion composition had one numerical authority. For minimum positive binary64 subnormal ULP `u`, unit scores `[u, 2u]` have exact mean `1.5u`, which ties-to-even must represent as `2u`; the predecessor recurrence rounded the half-ULP update away and returned `u`, shifting public within residuals from `[-u, 0]` to `[0, u]`. RED `7dc87aa8ad4de4a73a502646c5667d01656e9dbd` pins the public decomposition result. Causal repair `97c8ad35d1a1a483d8feb2d617e5fbc035c5ead9` removes the decomposition-only arithmetic and delegates to the existing Longitudinal-local `scaled_compensated_mean`. Research trace `a1aef11e8e38f34ac4d6cdfb4c61b099c04e69e6` records the exact API/test/module lineage. + +At exact #310 head `a1aef11...`, current-head check runs have materialized but remain queued, including Rust/format-test-rustdoc/dependency, production coverage, and live PostgreSQL integration lanes. Fresh formal reviews contain no qualifying `APPROVED`. #310 therefore remains Draft and non-passing; predecessor-head evidence is not inherited. #486 remains open Draft beneath the #310 branch. It can close only after its remaining valid CHANGELOG/operational wording is either inherited owner-correctly or verified redundant; wrong-owner source and mixed `Z KST` provenance are intentionally rejected rather than copied. @@ -97,7 +99,7 @@ At exact head `34fd059a...`, Documentation Quality, SAST Semgrep, Rust Foundatio ### #480 — contextual-orchestrator boundary -#480 removes TEPP-owned provider discovery/ranking and requires the contextual-orchestrator owner contract. Fresh owner evidence is protected `contextual-orchestrator/main@f4e5fc67dfcb7ddb1afb004a06417e915afb9826` with zero GitHub releases. That owner main now contains the hourly OpenCode contract repair that removes repository-authored elapsed-time caps and pins model-backed execution to `orchestrator/free`, but it is still mutable unreleased evidence. #480 remains Draft/blocked-equivalent; mutable owner `main` is not a released production contract. +#480 removes TEPP-owned provider discovery/ranking and requires the contextual-orchestrator owner contract. Fresh owner evidence is protected `contextual-orchestrator/main@f4e5fc67dfcb7ddb1afb004a06417e915afb9826` with zero GitHub releases. That owner main contains the hourly OpenCode contract repair that removes repository-authored elapsed-time caps and pins model-backed execution to `orchestrator/free`, but it is still mutable unreleased evidence. #480 remains Draft/blocked-equivalent; mutable owner `main` is not a released production contract. ### Owner handoffs @@ -130,7 +132,7 @@ Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/num | GAP-015 | contextual-orchestrator lacks immutable released contract for current owner behavior | `release-blocking` | compatible immutable CO release, deployment provenance, safe gateway auth, exact TEPP ACL adoption | | GAP-016 | hourly LLM path needs released owner-only routing/authentication | `active-repair` | #480 Draft + released CO adoption + exact-head GREEN/review/main merge | | GAP-017 | dynamic evaluation item/rater/anchor drift monitoring | `owner-contract-active` | released/digest-pinned dynamic criterion/item/run contract, ACL conformance, no-anchor/no-linking refusal, evidence-gated temporal monitoring | -| GAP-018 | Longitudinal stable-mean logic remains duplicated outside the now-shared CWC/occasion primitive | `active-refactor` | semantic-equivalence proof for remaining decomposition/recovery means, one TEPP Longitudinal primitive where semantics match or released fast-mlsirm generic owner contract, recovery parity | +| GAP-018 | Longitudinal stable-mean logic had a separate decomposition implementation after CWC/occasion consolidation | `verification-pending` | RED `7dc87aa8...` + causal repair `97c8ad35...` + trace `a1aef11e...`; scan remaining Longitudinal means, exact-head GREEN/review/main integration | | GAP-019 | Longitudinal scientific instructions contradicted stationary-overflow implementation | `verification-pending` | RED `9d8a82d...` + repair `9c962205...`; exact-head documentation/review GREEN and protected-main integration | | GAP-020 | Nonzero lagged covariance can be misreported as exact-zero correlation when standardized magnitude is unrepresentable | `verification-pending` | RED `c345ee7b...` + repair `5785e07a...`; exact-head Rust/documentation/review GREEN and protected-main integration | | GAP-021 | Longitudinal irregular-rate facade duplicated public wrapper identities over one canonical implementation | `verification-pending` | RED `464863860...` + repair `7f0bea084...`; exact-head Rust/documentation/review GREEN and protected-main integration | @@ -147,6 +149,7 @@ Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/num | GAP-032 | CWC/irregular-residual same-sign averaging retained the same minimum-subnormal double-rounding defect | `verification-pending` | RED `23476f45...` + repair `b14eb6e8...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-033 | Arbitrary max-magnitude normalization introduced a second rounding and misrounded a 7.5-ULP subnormal mean to 7 ULPs | `verification-pending` | RED `b073f03f...` + exact-power-of-two repair `350b8d4e...` + Longitudinal mean-authority consolidation `dd53eff6...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-034 | Mixed-sign cancellation rounded a retained-only mean before restoring the original denominator, moving a representable subnormal mean by one ULP | `verification-pending` | RED `ae5e61f9...` + causal repair `39469067...` + occasion public-contract hardening `201f3900...` + research trace `34fd059a...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-035 | Within/between decomposition shadow running mean misrounded the representable `[1 ULP, 2 ULP]` unit mean and shifted residuals by one ULP | `verification-pending` | RED `7dc87aa8...` + causal repair `97c8ad35...` + research trace `a1aef11e...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | ## Release gate From 9af1f43e1a6a167325236596aadc95ba6938212f Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 3 Sep 2026 14:10:16 +0900 Subject: [PATCH 123/235] docs(delivery): track false-perfect RMSE gap --- docs/product-technical-gap-baseline.md | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 4ae81382c..f6db435fa 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,7 +4,7 @@ **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-03T03:56Z +**Snapshot:** 2026-09-03T05:08Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` @@ -44,7 +44,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | #460 | `dfab4eab5ff733731e565a9348072b8dab2e4912` | true | #416 | Analysis Run fold child; typed cutoff equality and terminal-validation separation. | | #458 | `08165e3b3c929b4ae77396689549f72723ff8ff5` | true | #416 | Analysis Run fold child; typed cutoff equality and terminal-validation separation. | | #416 | `0b7155cc238defb1e55129ff3000658f04b343cf` | true | `main` | Validation / Analysis Run landing vehicle; availability cutoff precedes duplicate-identity admission. | -| #310 | `a1aef11e8e38f34ac4d6cdfb4c61b099c04e69e6` | true | `main` | Longitudinal Modeling vehicle; CWC, occasion-mean, and within/between decomposition now share one Longitudinal-local stable-mean authority. Hosted exact-head verification remains non-passing. | +| #310 | `bfaa69c4f372c264fc2c4baa8c37bb0e07482216` | true | `main` | Longitudinal Modeling vehicle; current repair prevents nonzero known-truth component RMSE from underflowing to false perfect recovery. Exact-head verification remains non-passing. | Exact-head evidence becomes stale after any source push. @@ -54,7 +54,7 @@ TEPP owns temporal/event composition, irregular time, time-varying multilevel/cr `psychometric_core` is not authority for new temporal/state composition. fast-mlsirm owns reusable static/generalized-mixed/dependence-aware psychometric specification and arithmetic. TEPP consumes only immutable released/versioned Published Language through an ACL; source copying and mutable sibling-head dependencies are prohibited. -contextual-orchestrator owns provider/model routing and semantic LLM execution. Context Graph contracts are contract-only integration authority; EA Core owns enterprise-architecture decisions. No cross-service SQL. +contextual-orchestrator owns provider/model routing and semantic LLM execution. Semantic LLM work and model-backed Actions must use a released/versioned contextual-orchestrator contract; Actions use `orchestrator/free` through the gateway credential and must not select providers/models/groups or consume direct provider keys. Context Graph contracts are contract-only integration authority; EA Core owns enterprise-architecture decisions. No cross-service SQL. The clock contract separates event/valid time, assertion time, document time, system time, available time, and knowledge cutoff. Retrospective evidence may describe an earlier event but cannot enter an earlier knowledge cutoff. Forward state/transition edges remain distinct from retrospective/citation/revision/provenance relations. @@ -66,6 +66,7 @@ The clock contract separates event/valid time, assertion time, document time, sy - Occasion-mean deviations `p_it = x_it - μ_t` are not CWC residuals, sample-wide grand-mean residuals, or RI-CLPM within-person effects. Numeric event time defines occasion identity, so `-0.0` and `+0.0` are one occasion. - Row arrival order is not scientific evidence. Fixed admitted observations must produce bit-identical means/centered results under permutation wherever the contract claims deterministic f64 reference behavior. - A representable final scientific estimand is not rejected solely because an avoidable intermediate binary64 operation overflows/underflows. False exact 0/1/non-finite endpoints remain fail-closed when the mathematical estimand is interior/nonzero. +- A mathematically nonzero scientific error metric must not be promoted to exact perfect recovery merely because its final binary64 representation underflows to zero. - Binary64 minimum-subnormal means follow IEEE ties-to-even at the public composition boundary. Overflow-safe normalization must not add an avoidable earlier rounding step, and mixed-sign cancellation must apply the original sample-count denominator before rounding a retained-only mean. - Observed Allen support classes are data, not required design strata. A historical prediction census may truthfully have zero covered, partial-overlap, adjacent, or contradictory rows; absent classes remain explicit zero counts rather than invalidating the run. - Historical-cutoff admission occurs before duplicate-identity checks. Future-unavailable evidence cannot change an earlier run's conflicts, counts, or terminal state. @@ -81,13 +82,11 @@ The clock contract separates event/valid time, assertion time, document time, sy The #486 occasion-mean fold is owner-correct on #310: RED `75b0184d...`, owner repair `7fe9aaf2...`, export/test repairs `b900e213...` / `30771ff2...`, determinism RED `8a59019e...`, same-sign ordering repair `465d139d...`, same-panel/sparse successor regressions `b9e952bb...` / `aad56b50...`, ADR `04b3c26e...`, PRD `a221f494...`, research trace `27aa78ee...`, subnormal RED `9aff817f...`, source repair `40e057b8...`, and trace `a2e6ace7...`. -The earlier CWC RED `23476f45c506504babf16f33e6d61fdddef23b67` / repair `b14eb6e863cce1b94b36e787ada2ec32c129cadf` closed the sorted-incremental `[from_bits(1), from_bits(2)]` ties-to-even defect. RED `b073f03f5e28c94226e7dcaa72e11b25233ccc65` then exposed arbitrary max-magnitude normalization at `[from_bits(1), from_bits(14)]`; repair `350b8d4e0fdb3f5d68cd22bdfffb3b879cea62f2` switched to an exact power-of-two scale and `dd53eff6ed939ae06b51d70959c06b2a36fade08` consolidated CWC and occasion means onto one Longitudinal-local primitive. +The CWC/occasion/decomposition mean lineage remains one Longitudinal-local authority. CWC RED `23476f45...` / repair `b14eb6e8...` closed the `[1 ULP, 2 ULP]` ties-to-even defect; `b073f03f...` / `350b8d4e...` changed arbitrary normalization to an exact power-of-two scale; `dd53eff6...` consolidated CWC and occasion means; mixed-sign RED `ae5e61f9...` / repair `39469067...` plus `201f3900...` and trace `34fd059a...` removed retained-mean double rounding; decomposition RED `7dc87aa8...` / repair `97c8ad35...` and trace `a1aef11e...` removed the remaining shadow running mean. -Fresh review then found a separate mixed-sign double-rounding boundary. For minimum-subnormal ULP `u`, `[-20u, -20u, 9u]` has exact mean `-31u/3` and must round once to `-10u`. The predecessor cancelled signs, rounded the surviving `[-11u, -20u]` mean to `-16u`, then weighted that rounded intermediate by `2/3`, yielding `-11u`. RED `ae5e61f9a829adbfed2ea13c5705d4b85d80b0d6` pins the correct value through public CWC. Causal repair `39469067aca2fa93e2fa4c914848f7cec8031811` applies the original sample-count denominator directly inside the shared normalized compensated sum. Contract hardening `201f3900960278cb87d2e6b28176ac0d23e51954` exercises the same boundary through public occasion-mean composition. Research trace `34fd059aa10c7538f3513b6fb994a9f2972ff5b1` makes that algorithm code-current. +Fresh review found a separate known-truth recovery defect. For minimum positive subnormal ULP `u`, five identity-matched component rows with one residual `u` and four exact-zero residuals have mathematical RMSE `u / sqrt(5) > 0`, but the final binary64 product rounds to exact zero. The predecessor accepted any finite final RMSE and therefore reported false perfect recovery. RED `496583c6b62cbe0ad1be0e65b51f01d7f72acd5a` drives the public `component_root_mean_square_error` API. Causal repair `a82b383b5940126a0139180d66729d2e6aa4baf7` preserves the existing exact-zero `scale == 0` path but fails closed when a later RMSE rounds to zero after a nonzero residual scale exists. Research trace `bfaa69c4f372c264fc2c4baa8c37bb0e07482216` records the API/test/module/acceptance lineage in `docs/research/longitudinal-within-between.md`. -GAP-018 review then found that `decompose_within_between` still maintained a shadow running/cancellation mean after CWC and occasion composition had one numerical authority. For minimum positive binary64 subnormal ULP `u`, unit scores `[u, 2u]` have exact mean `1.5u`, which ties-to-even must represent as `2u`; the predecessor recurrence rounded the half-ULP update away and returned `u`, shifting public within residuals from `[-u, 0]` to `[0, u]`. RED `7dc87aa8ad4de4a73a502646c5667d01656e9dbd` pins the public decomposition result. Causal repair `97c8ad35d1a1a483d8feb2d617e5fbc035c5ead9` removes the decomposition-only arithmetic and delegates to the existing Longitudinal-local `scaled_compensated_mean`. Research trace `a1aef11e8e38f34ac4d6cdfb4c61b099c04e69e6` records the exact API/test/module lineage. - -At exact #310 head `a1aef11...`, current-head check runs have materialized but remain queued, including Rust/format-test-rustdoc/dependency, production coverage, and live PostgreSQL integration lanes. Fresh formal reviews contain no qualifying `APPROVED`. #310 therefore remains Draft and non-passing; predecessor-head evidence is not inherited. +At exact #310 head `bfaa69c4...`, 20 check-runs have materialized. Rust Foundation CI, Documentation Quality, Security Scan, SAST Semgrep, OSV-Scanner PR, and Scorecard PR remain queued; fresh formal reviews contain no qualifying `APPROVED`, while review threads are resolved. #310 therefore remains Draft and non-passing; predecessor-head evidence is not inherited. #486 remains open Draft beneath the #310 branch. It can close only after its remaining valid CHANGELOG/operational wording is either inherited owner-correctly or verified redundant; wrong-owner source and mixed `Z KST` provenance are intentionally rejected rather than copied. @@ -99,11 +98,11 @@ At exact #310 head `a1aef11...`, current-head check runs have materialized but r ### #480 — contextual-orchestrator boundary -#480 removes TEPP-owned provider discovery/ranking and requires the contextual-orchestrator owner contract. Fresh owner evidence is protected `contextual-orchestrator/main@f4e5fc67dfcb7ddb1afb004a06417e915afb9826` with zero GitHub releases. That owner main contains the hourly OpenCode contract repair that removes repository-authored elapsed-time caps and pins model-backed execution to `orchestrator/free`, but it is still mutable unreleased evidence. #480 remains Draft/blocked-equivalent; mutable owner `main` is not a released production contract. +#480 removes TEPP-owned provider discovery/ranking and requires the contextual-orchestrator owner contract. Its branch-local `AGENTS.md` already replaces the protected-main direct-NVIDIA-key guidance with released contextual-orchestrator-only routing and `orchestrator/free` for model-backed Actions. The consumer remains Draft until the owner provides an immutable compatible release plus authenticated deployment identity/schema/artifact provenance and safe scoped/brokered gateway authentication. Mutable owner main is evidence, not a production contract. ### Owner handoffs -fast-mlsirm protected main remains `b5a3a0c1057d4b53d7a4bb18e0de69f630c2b45c`; latest verified immutable release remains `v0.9.1` (2026-08-26). Open owner heads newer than that release are candidate evidence, not TEPP dependency authority. +fast-mlsirm protected main and latest immutable release must be revalidated before any dependency bump. Open owner heads newer than the latest release are candidate evidence, not TEPP dependency authority. Context Graph Contracts and Enterprise Architecture Core remain read-only owner dependencies until their relevant contracts are immutable releases. No sibling mutable head is promoted to TEPP production authority. @@ -150,6 +149,7 @@ Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/num | GAP-033 | Arbitrary max-magnitude normalization introduced a second rounding and misrounded a 7.5-ULP subnormal mean to 7 ULPs | `verification-pending` | RED `b073f03f...` + exact-power-of-two repair `350b8d4e...` + Longitudinal mean-authority consolidation `dd53eff6...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-034 | Mixed-sign cancellation rounded a retained-only mean before restoring the original denominator, moving a representable subnormal mean by one ULP | `verification-pending` | RED `ae5e61f9...` + causal repair `39469067...` + occasion public-contract hardening `201f3900...` + research trace `34fd059a...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-035 | Within/between decomposition shadow running mean misrounded the representable `[1 ULP, 2 ULP]` unit mean and shifted residuals by one ULP | `verification-pending` | RED `7dc87aa8...` + causal repair `97c8ad35...` + research trace `a1aef11e...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-036 | Known-truth component RMSE could underflow a mathematically nonzero recovery error to exact zero and falsely report perfect recovery | `verification-pending` | RED `496583c6...` + causal repair `a82b383b...` + research trace `bfaa69c4...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | ## Release gate From 53a714c27083e5fbdacc2acf7560f8c89f9be77a Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 3 Sep 2026 15:16:45 +0900 Subject: [PATCH 124/235] docs(gap): trace false-perfect correlation repair --- docs/product-technical-gap-baseline.md | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index f6db435fa..f9fc29433 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,7 +4,7 @@ **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-03T05:08Z +**Snapshot:** 2026-09-03T06:15Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` @@ -35,7 +35,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | | #487 | `6b0c8de64f41bc11f8bf908e0f9cbe854c1e213c` | true | #416 `feat/copy-identity-analysis-run-gap-004` | Validation / Analysis Run fold child. Sparse observed relation classes are valid evidence; RED `a2892b6...`, repair `a6402015...`, predecessor-test correction `6b0c8de6...`. No child-head CI transfers to #416. | -| #486 | `c451587e288ba119aebda67addee382106daf670` | true | #310 `agent/psychometric-discrete-drift-std-clean` | Longitudinal fold child. Preserve unique Hamaker source/doctoring; reject wrong-owner `psychometric_core` temporal implementation and mixed-timezone provenance. | +| #486 | `c451587e288ba119aebda67addee382106daf670` | true | #310 `agent/psychometric-discrete-drift-std-clean` | Longitudinal fold child. Valid Hamaker/operational release wording is preserved owner-correctly in #310 `CHANGELOG.d`; canonical root CHANGELOG assembly remains pending. Wrong-owner temporal source and mixed-timezone provenance are rejected. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | | #483 | `847d96f913bb261803ac0bd751ad7e4f51324cee` | true | #416 | Analysis Run fold child; preserve unique evidence. | @@ -44,7 +44,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | #460 | `dfab4eab5ff733731e565a9348072b8dab2e4912` | true | #416 | Analysis Run fold child; typed cutoff equality and terminal-validation separation. | | #458 | `08165e3b3c929b4ae77396689549f72723ff8ff5` | true | #416 | Analysis Run fold child; typed cutoff equality and terminal-validation separation. | | #416 | `0b7155cc238defb1e55129ff3000658f04b343cf` | true | `main` | Validation / Analysis Run landing vehicle; availability cutoff precedes duplicate-identity admission. | -| #310 | `bfaa69c4f372c264fc2c4baa8c37bb0e07482216` | true | `main` | Longitudinal Modeling vehicle; current repair prevents nonzero known-truth component RMSE from underflowing to false perfect recovery. Exact-head verification remains non-passing. | +| #310 | `919435109d59469383e23aca4d18104f8a02daf0` | true | `main` | Longitudinal Modeling vehicle; current repair prevents a strict-interior exact covariance from being rounded into a false perfect `±1` correlation. Exact-head verification remains non-passing until current gates and review complete. | Exact-head evidence becomes stale after any source push. @@ -67,6 +67,7 @@ The clock contract separates event/valid time, assertion time, document time, sy - Row arrival order is not scientific evidence. Fixed admitted observations must produce bit-identical means/centered results under permutation wherever the contract claims deterministic f64 reference behavior. - A representable final scientific estimand is not rejected solely because an avoidable intermediate binary64 operation overflows/underflows. False exact 0/1/non-finite endpoints remain fail-closed when the mathematical estimand is interior/nonzero. - A mathematically nonzero scientific error metric must not be promoted to exact perfect recovery merely because its final binary64 representation underflows to zero. +- A strict-interior exact binary64 covariance must not be promoted to exact `±1` correlation merely because rounded square roots/divisions reach the endpoint. Only the exact represented Cauchy–Schwarz boundary authorizes a perfect-correlation claim. - Binary64 minimum-subnormal means follow IEEE ties-to-even at the public composition boundary. Overflow-safe normalization must not add an avoidable earlier rounding step, and mixed-sign cancellation must apply the original sample-count denominator before rounding a retained-only mean. - Observed Allen support classes are data, not required design strata. A historical prediction census may truthfully have zero covered, partial-overlap, adjacent, or contradictory rows; absent classes remain explicit zero counts rather than invalidating the run. - Historical-cutoff admission occurs before duplicate-identity checks. Future-unavailable evidence cannot change an earlier run's conflicts, counts, or terminal state. @@ -80,15 +81,17 @@ The clock contract separates event/valid time, assertion time, document time, sy #310 remains the canonical Longitudinal Modeling landing vehicle. Its lineage covers lagged Pearson correlation with both marginal variances, stationary-variance materialization versus algebraically cancelled standardized maps, discrete-diffusion endpoint/subnormal representability, CWC atomistic admission, one irregular-rate authority, occasion-mean composition, known-truth recovery, within/between decomposition, and DDD relocation from `psychometric_core` to `longitudinal_core`. -The #486 occasion-mean fold is owner-correct on #310: RED `75b0184d...`, owner repair `7fe9aaf2...`, export/test repairs `b900e213...` / `30771ff2...`, determinism RED `8a59019e...`, same-sign ordering repair `465d139d...`, same-panel/sparse successor regressions `b9e952bb...` / `aad56b50...`, ADR `04b3c26e...`, PRD `a221f494...`, research trace `27aa78ee...`, subnormal RED `9aff817f...`, source repair `40e057b8...`, and trace `a2e6ace7...`. +The #486 occasion-mean fold is owner-correct on #310: RED `75b0184d...`, owner repair `7fe9aaf2...`, export/test repairs `b900e213...` / `30771ff2...`, determinism RED `8a59019e...`, same-sign ordering repair `465d139d...`, same-panel/sparse successor regressions `b9e952bb...` / `aad56b50...`, ADR `04b3c26e...`, PRD `a221f494...`, research trace `27aa78ee...`, subnormal RED `9aff817f...`, source repair `40e057b8...`, and trace `a2e6ace7...`. Commit `db335d904ccc43dd0af7982c34df83008c968ef6` additionally preserves the child's valid operational release delta in `CHANGELOG.d/longitudinal-occasion-mean-event-time.md` under the correct owner. Root `CHANGELOG.md` assembly is still required before #486 can satisfy verified-successor closure. The CWC/occasion/decomposition mean lineage remains one Longitudinal-local authority. CWC RED `23476f45...` / repair `b14eb6e8...` closed the `[1 ULP, 2 ULP]` ties-to-even defect; `b073f03f...` / `350b8d4e...` changed arbitrary normalization to an exact power-of-two scale; `dd53eff6...` consolidated CWC and occasion means; mixed-sign RED `ae5e61f9...` / repair `39469067...` plus `201f3900...` and trace `34fd059a...` removed retained-mean double rounding; decomposition RED `7dc87aa8...` / repair `97c8ad35...` and trace `a1aef11e...` removed the remaining shadow running mean. -Fresh review found a separate known-truth recovery defect. For minimum positive subnormal ULP `u`, five identity-matched component rows with one residual `u` and four exact-zero residuals have mathematical RMSE `u / sqrt(5) > 0`, but the final binary64 product rounds to exact zero. The predecessor accepted any finite final RMSE and therefore reported false perfect recovery. RED `496583c6b62cbe0ad1be0e65b51f01d7f72acd5a` drives the public `component_root_mean_square_error` API. Causal repair `a82b383b5940126a0139180d66729d2e6aa4baf7` preserves the existing exact-zero `scale == 0` path but fails closed when a later RMSE rounds to zero after a nonzero residual scale exists. Research trace `bfaa69c4f372c264fc2c4baa8c37bb0e07482216` records the API/test/module/acceptance lineage in `docs/research/longitudinal-within-between.md`. +Known-truth component RMSE has a separate fail-closed repair. For minimum positive subnormal ULP `u`, five identity-matched component rows with one residual `u` and four exact-zero residuals have mathematical RMSE `u / sqrt(5) > 0`, but the final binary64 product rounds to exact zero. RED `496583c6b62cbe0ad1be0e65b51f01d7f72acd5a` drives the public API; causal repair `a82b383b5940126a0139180d66729d2e6aa4baf7` preserves exact perfect recovery only on the pre-existing `scale == 0` path and rejects a later rounded zero after nonzero residual scale. Trace `bfaa69c4...` records the boundary. -At exact #310 head `bfaa69c4...`, 20 check-runs have materialized. Rust Foundation CI, Documentation Quality, Security Scan, SAST Semgrep, OSV-Scanner PR, and Scorecard PR remain queued; fresh formal reviews contain no qualifying `APPROVED`, while review threads are resolved. #310 therefore remains Draft and non-passing; predecessor-head evidence is not inherited. +Fresh exact-binary association review found another endpoint defect. With earlier variance `f64::from_bits(4_607_182_418_800_016_408)`, later variance `f64::from_bits(4_607_182_418_800_016_427)`, and covariance magnitude `f64::from_bits(4_607_182_418_800_016_417)`, exact `Cov²` is strictly below the exact product of the two represented marginal variances, yet rounded square roots/divisions produce exact `±1.0`. RED `683b28eeeda3ad72ac11f5317c5aea54f34e0692` fixes both signs through the public `recover_event_time_lagged_correlation` API. Causal repair `9eeb373df2cd333fe7543df2197ea0cc0c492780` extends the existing exact integer-significand/power-of-two covariance comparison to return both admissibility and exact-boundary identity, and rejects rounded `±1` unless that exact relation is on the Cauchy–Schwarz boundary. Public rustdoc `d21c0a2d...` and research trace/current head `919435109d59469383e23aca4d18104f8a02daf0` synchronize the scientific contract. -#486 remains open Draft beneath the #310 branch. It can close only after its remaining valid CHANGELOG/operational wording is either inherited owner-correctly or verified redundant; wrong-owner source and mixed `Z KST` provenance are intentionally rejected rather than copied. +At exact #310 head `919435109d...`, predecessor workflow/review evidence is stale by definition. Current-head Rust/documentation/security/coverage workflows and a qualifying independent approval must complete before the Draft can become a normal merge candidate; queued, pending, startup-failed, skipped, or predecessor-head evidence is not GREEN. + +#486 remains open Draft beneath the #310 branch. Its valid Hamaker scientific evidence and operational release wording are preserved owner-correctly; wrong-owner source, raw signed-zero bit identity, naive `sum/count`, mixed `Z KST` provenance, and unsupported claims are intentionally rejected rather than copied. Close still requires canonical root CHANGELOG assembly or exact evidence that the repository's release process treats the preserved fragment as the final canonical record. ### #416 — Validation / Analysis Run consolidation @@ -142,7 +145,7 @@ Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/num | GAP-026 | Scalar standardized longitudinal maps rejected representable finals when a cancelled stationary-variance intermediate lay outside binary64 range | `verification-pending` | RED `4a1f6c49...` / `96d8ed13...` + repairs `a4bc6230...` / `33f4b187...` / `26b03c32...`; exact-head GREEN and protected-main integration | | GAP-027 | Finite-interval `discreteDIFFUSIONstd` could report exact unit diffusion after exponent saturation erased a nonzero remainder | `verification-pending` | RED `a8de3c9f...` + repair `c17e2ff8...`; exact-head GREEN and protected-main integration | | GAP-028 | Actual stationary variance `p` could be misreported as exact zero when positive real `p` lies below binary64 range | `verification-pending` | RED `27d9fa39...` + repair `a0132b62...`; exact-head GREEN and protected-main integration | -| GAP-029 | Occasion-mean temporal composition arrived in the wrong bounded context with raw-bit event identity, naive mean summation, and order-dependent averaging | `active-fold` | owner-correct #310 lineage; verify remaining #486 unique evidence; exact-head GREEN/review/main integration | +| GAP-029 | Occasion-mean temporal composition arrived in the wrong bounded context with raw-bit event identity, naive mean summation, and order-dependent averaging | `active-fold` | owner-correct #310 lineage + release fragment `db335d90...`; canonical root CHANGELOG assembly, exact-head GREEN/review/main integration | | GAP-030 | Prediction-contradiction Analysis Run treated four observed relation classes as mandatory design strata | `active-fold` | RED `a2892b6...` + repair `a6402015...` + predecessor-test correction `6b0c8de6...`; fold unique evidence into #416; exact-survivor GREEN/review/main integration | | GAP-031 | Occasion-mean same-sign averaging double-rounded a representable minimum-subnormal ties-to-even mean | `verification-pending` | RED `9aff817f...` + repair `40e057b8...` + trace `a2e6ace7...`; exact-head GREEN and protected-main integration | | GAP-032 | CWC/irregular-residual same-sign averaging retained the same minimum-subnormal double-rounding defect | `verification-pending` | RED `23476f45...` + repair `b14eb6e8...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | @@ -150,6 +153,7 @@ Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/num | GAP-034 | Mixed-sign cancellation rounded a retained-only mean before restoring the original denominator, moving a representable subnormal mean by one ULP | `verification-pending` | RED `ae5e61f9...` + causal repair `39469067...` + occasion public-contract hardening `201f3900...` + research trace `34fd059a...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-035 | Within/between decomposition shadow running mean misrounded the representable `[1 ULP, 2 ULP]` unit mean and shifted residuals by one ULP | `verification-pending` | RED `7dc87aa8...` + causal repair `97c8ad35...` + research trace `a1aef11e...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-036 | Known-truth component RMSE could underflow a mathematically nonzero recovery error to exact zero and falsely report perfect recovery | `verification-pending` | RED `496583c6...` + causal repair `a82b383b...` + research trace `bfaa69c4...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-037 | Strict-interior lagged covariance could round to false exact `±1` correlation after exact covariance-bound admission | `verification-pending` | RED `683b28ee...` + causal repair `9eeb373d...` + public rustdoc `d21c0a2d...` + research trace `91943510...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | ## Release gate From 1c60375debf3cc9b43d3297af84745a6e4eb246f Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 3 Sep 2026 15:33:36 +0900 Subject: [PATCH 125/235] docs(gap): record exact-boundary correlation endpoint repair --- docs/product-technical-gap-baseline.md | 30 ++++++++++++++------------ 1 file changed, 16 insertions(+), 14 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index f9fc29433..003b488ea 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,7 +4,7 @@ **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-03T06:15Z +**Snapshot:** 2026-09-03T06:27Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` @@ -19,8 +19,8 @@ A planning document, mergeable branch, local/source inspection, predecessor-head | Signal | Fresh evidence | Implication | | --- | ---: | --- | | Protected `main` | `1bc02f580cf48e1d39da239f0e818453437c31c3` | Capability claims remain bounded to this commit until main advances. | -| Open pull requests | **134** | WIP circuit breaker remains active; consolidate into existing bounded-context vehicles. | -| Draft pull requests | **134** | Every current open PR is Draft. | +| Open pull requests | **133** | WIP circuit breaker remains active; consolidate into existing bounded-context vehicles. | +| Draft pull requests | **133** | Every current open PR is Draft. | | Non-Draft pull requests | **0** | No PR is eligible for normal merge until it is deliberately made Ready after exact-head evidence. | | Open issues | **16** | ADR normalization, orchestration admission, evaluation drift, and scientific recovery remain open. | | GitHub releases | **0** | No TEPP open head is a released contract. | @@ -35,7 +35,6 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | | #487 | `6b0c8de64f41bc11f8bf908e0f9cbe854c1e213c` | true | #416 `feat/copy-identity-analysis-run-gap-004` | Validation / Analysis Run fold child. Sparse observed relation classes are valid evidence; RED `a2892b6...`, repair `a6402015...`, predecessor-test correction `6b0c8de6...`. No child-head CI transfers to #416. | -| #486 | `c451587e288ba119aebda67addee382106daf670` | true | #310 `agent/psychometric-discrete-drift-std-clean` | Longitudinal fold child. Valid Hamaker/operational release wording is preserved owner-correctly in #310 `CHANGELOG.d`; canonical root CHANGELOG assembly remains pending. Wrong-owner temporal source and mixed-timezone provenance are rejected. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | | #483 | `847d96f913bb261803ac0bd751ad7e4f51324cee` | true | #416 | Analysis Run fold child; preserve unique evidence. | @@ -44,7 +43,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | #460 | `dfab4eab5ff733731e565a9348072b8dab2e4912` | true | #416 | Analysis Run fold child; typed cutoff equality and terminal-validation separation. | | #458 | `08165e3b3c929b4ae77396689549f72723ff8ff5` | true | #416 | Analysis Run fold child; typed cutoff equality and terminal-validation separation. | | #416 | `0b7155cc238defb1e55129ff3000658f04b343cf` | true | `main` | Validation / Analysis Run landing vehicle; availability cutoff precedes duplicate-identity admission. | -| #310 | `919435109d59469383e23aca4d18104f8a02daf0` | true | `main` | Longitudinal Modeling vehicle; current repair prevents a strict-interior exact covariance from being rounded into a false perfect `±1` correlation. Exact-head verification remains non-passing until current gates and review complete. | +| #310 | `be5123d50ad9edf22232b51d3819328a37063352` | true | `main` | Longitudinal Modeling vehicle; exact covariance-bound authority now prevents both false perfect endpoints from strict-interior inputs and false interior endpoints from exact perfect inputs. Exact-head verification remains non-passing until current gates and review complete. | Exact-head evidence becomes stale after any source push. @@ -67,7 +66,7 @@ The clock contract separates event/valid time, assertion time, document time, sy - Row arrival order is not scientific evidence. Fixed admitted observations must produce bit-identical means/centered results under permutation wherever the contract claims deterministic f64 reference behavior. - A representable final scientific estimand is not rejected solely because an avoidable intermediate binary64 operation overflows/underflows. False exact 0/1/non-finite endpoints remain fail-closed when the mathematical estimand is interior/nonzero. - A mathematically nonzero scientific error metric must not be promoted to exact perfect recovery merely because its final binary64 representation underflows to zero. -- A strict-interior exact binary64 covariance must not be promoted to exact `±1` correlation merely because rounded square roots/divisions reach the endpoint. Only the exact represented Cauchy–Schwarz boundary authorizes a perfect-correlation claim. +- A strict-interior exact binary64 covariance must not be promoted to exact `±1` correlation merely because rounded square roots/divisions reach the endpoint. Conversely, an exact represented Cauchy–Schwarz boundary must not be weakened to an interior coefficient merely because rounded square roots/divisions fall one ULP below `1`. - Binary64 minimum-subnormal means follow IEEE ties-to-even at the public composition boundary. Overflow-safe normalization must not add an avoidable earlier rounding step, and mixed-sign cancellation must apply the original sample-count denominator before rounding a retained-only mean. - Observed Allen support classes are data, not required design strata. A historical prediction census may truthfully have zero covered, partial-overlap, adjacent, or contradictory rows; absent classes remain explicit zero counts rather than invalidating the run. - Historical-cutoff admission occurs before duplicate-identity checks. Future-unavailable evidence cannot change an earlier run's conflicts, counts, or terminal state. @@ -81,17 +80,19 @@ The clock contract separates event/valid time, assertion time, document time, sy #310 remains the canonical Longitudinal Modeling landing vehicle. Its lineage covers lagged Pearson correlation with both marginal variances, stationary-variance materialization versus algebraically cancelled standardized maps, discrete-diffusion endpoint/subnormal representability, CWC atomistic admission, one irregular-rate authority, occasion-mean composition, known-truth recovery, within/between decomposition, and DDD relocation from `psychometric_core` to `longitudinal_core`. -The #486 occasion-mean fold is owner-correct on #310: RED `75b0184d...`, owner repair `7fe9aaf2...`, export/test repairs `b900e213...` / `30771ff2...`, determinism RED `8a59019e...`, same-sign ordering repair `465d139d...`, same-panel/sparse successor regressions `b9e952bb...` / `aad56b50...`, ADR `04b3c26e...`, PRD `a221f494...`, research trace `27aa78ee...`, subnormal RED `9aff817f...`, source repair `40e057b8...`, and trace `a2e6ace7...`. Commit `db335d904ccc43dd0af7982c34df83008c968ef6` additionally preserves the child's valid operational release delta in `CHANGELOG.d/longitudinal-occasion-mean-event-time.md` under the correct owner. Root `CHANGELOG.md` assembly is still required before #486 can satisfy verified-successor closure. +The #486 occasion-mean fold is owner-correct on #310: RED `75b0184d...`, owner repair `7fe9aaf2...`, export/test repairs `b900e213...` / `30771ff2...`, determinism RED `8a59019e...`, same-sign ordering repair `465d139d...`, same-panel/sparse successor regressions `b9e952bb...` / `aad56b50...`, ADR `04b3c26e...`, PRD `a221f494...`, research trace `27aa78ee...`, subnormal RED `9aff817f...`, source repair `40e057b8...`, and trace `a2e6ace7...`. Commit `db335d904ccc43dd0af7982c34df83008c968ef6` preserves the child's valid operational release delta in `CHANGELOG.d/longitudinal-occasion-mean-event-time.md` under the correct owner. Repository precedent verifies `CHANGELOG.d` as a valid non-destructive stacked-consolidation release-note carrier, and #486 was closed as a verified successor after all valid scientific/test/contract/docs/release-note deltas were checked on #310; invalid wrong-owner/weaker deltas were intentionally not copied. The CWC/occasion/decomposition mean lineage remains one Longitudinal-local authority. CWC RED `23476f45...` / repair `b14eb6e8...` closed the `[1 ULP, 2 ULP]` ties-to-even defect; `b073f03f...` / `350b8d4e...` changed arbitrary normalization to an exact power-of-two scale; `dd53eff6...` consolidated CWC and occasion means; mixed-sign RED `ae5e61f9...` / repair `39469067...` plus `201f3900...` and trace `34fd059a...` removed retained-mean double rounding; decomposition RED `7dc87aa8...` / repair `97c8ad35...` and trace `a1aef11e...` removed the remaining shadow running mean. Known-truth component RMSE has a separate fail-closed repair. For minimum positive subnormal ULP `u`, five identity-matched component rows with one residual `u` and four exact-zero residuals have mathematical RMSE `u / sqrt(5) > 0`, but the final binary64 product rounds to exact zero. RED `496583c6b62cbe0ad1be0e65b51f01d7f72acd5a` drives the public API; causal repair `a82b383b5940126a0139180d66729d2e6aa4baf7` preserves exact perfect recovery only on the pre-existing `scale == 0` path and rejects a later rounded zero after nonzero residual scale. Trace `bfaa69c4...` records the boundary. -Fresh exact-binary association review found another endpoint defect. With earlier variance `f64::from_bits(4_607_182_418_800_016_408)`, later variance `f64::from_bits(4_607_182_418_800_016_427)`, and covariance magnitude `f64::from_bits(4_607_182_418_800_016_417)`, exact `Cov²` is strictly below the exact product of the two represented marginal variances, yet rounded square roots/divisions produce exact `±1.0`. RED `683b28eeeda3ad72ac11f5317c5aea54f34e0692` fixes both signs through the public `recover_event_time_lagged_correlation` API. Causal repair `9eeb373df2cd333fe7543df2197ea0cc0c492780` extends the existing exact integer-significand/power-of-two covariance comparison to return both admissibility and exact-boundary identity, and rejects rounded `±1` unless that exact relation is on the Cauchy–Schwarz boundary. Public rustdoc `d21c0a2d...` and research trace/current head `919435109d59469383e23aca4d18104f8a02daf0` synchronize the scientific contract. +Exact-binary association review found two endpoint defects in opposite directions. First, with earlier variance `f64::from_bits(4_607_182_418_800_016_408)`, later variance `f64::from_bits(4_607_182_418_800_016_427)`, and covariance magnitude `f64::from_bits(4_607_182_418_800_016_417)`, exact `Cov²` is strictly below the exact product of the two represented marginal variances, yet rounded square roots/divisions produce exact `±1.0`. RED `683b28eeeda3ad72ac11f5317c5aea54f34e0692` fixes both signs through the public `recover_event_time_lagged_correlation` API. Causal repair `9eeb373df2cd333fe7543df2197ea0cc0c492780` extends the exact integer-significand/power-of-two covariance comparison to distinguish strict interior from exact boundary and rejects rounded `±1` for strict-interior inputs. -At exact #310 head `919435109d...`, predecessor workflow/review evidence is stale by definition. Current-head Rust/documentation/security/coverage workflows and a qualifying independent approval must complete before the Draft can become a normal merge candidate; queued, pending, startup-failed, skipped, or predecessor-head evidence is not GREEN. +Second, exact-boundary inputs can round the other way. `Var_t = 2`, `Var_{t+Δ} = 8`, and `|Cov| = 4` satisfy exact represented `Cov² = Var_t Var_{t+Δ}`, but the predecessor square-root/division path returns `0x1.fffffffffffffp-1` for the positive coefficient. RED `c25000901eb429a43817552f8b76cf4aae04e522` fixes both signs; causal repair `d06259ec1e036558d8d2f775c266b2b9db4e42c4` returns the exact signed endpoint when the exact integer relation is on the boundary and uses rounded standardization only for strict-interior coefficients. Research trace/current #310 head `be5123d50ad9edf22232b51d3819328a37063352` synchronizes the contract. -#486 remains open Draft beneath the #310 branch. Its valid Hamaker scientific evidence and operational release wording are preserved owner-correctly; wrong-owner source, raw signed-zero bit identity, naive `sum/count`, mixed `Z KST` provenance, and unsupported claims are intentionally rejected rather than copied. Close still requires canonical root CHANGELOG assembly or exact evidence that the repository's release process treats the preserved fragment as the final canonical record. +At exact #310 head `be5123d50ad9edf22232b51d3819328a37063352`, predecessor workflow/review evidence is stale by definition. Current-head Rust/documentation/security/coverage workflows and a qualifying independent approval must complete before the Draft can become a normal merge candidate; queued, pending, startup-failed, skipped, or predecessor-head evidence is not GREEN. + +#486 is closed as a verified-successor consolidation, not a PR-count-only close. No child-head CI/review evidence transfers to #310. ### #416 — Validation / Analysis Run consolidation @@ -117,7 +118,7 @@ Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/num | ID | Gap | Maturity | Closure evidence | | --- | --- | --- | --- | -| GAP-001 | PR authority fragmented across 134 open PRs | `release-blocking` | coherent landing vehicles, unique-evidence preservation, protected-main reduction | +| GAP-001 | PR authority fragmented across 133 open PRs | `release-blocking` | coherent landing vehicles, unique-evidence preservation, protected-main reduction | | GAP-002 | multilingual span-grounded semantic/concept admission | `partial` | immutable offsets/layout, KO/EN/JA/ZH/VI/ES/DE/FR profiles, concept dictionary, invariance/calibration, hostile-input tests | | GAP-003 | shared-latent temporal topic estimator | `partial` | Rust CPU f64 likelihood/uncertainty, relation/time/membership effects, true recovery, fitted candidate-K | | GAP-004 | durable end-to-end Analysis Run | `partial` | idempotent lifecycle, persistence/recovery, estimator-bound artifacts, validation/promotion separation, Compose E2E | @@ -145,7 +146,7 @@ Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/num | GAP-026 | Scalar standardized longitudinal maps rejected representable finals when a cancelled stationary-variance intermediate lay outside binary64 range | `verification-pending` | RED `4a1f6c49...` / `96d8ed13...` + repairs `a4bc6230...` / `33f4b187...` / `26b03c32...`; exact-head GREEN and protected-main integration | | GAP-027 | Finite-interval `discreteDIFFUSIONstd` could report exact unit diffusion after exponent saturation erased a nonzero remainder | `verification-pending` | RED `a8de3c9f...` + repair `c17e2ff8...`; exact-head GREEN and protected-main integration | | GAP-028 | Actual stationary variance `p` could be misreported as exact zero when positive real `p` lies below binary64 range | `verification-pending` | RED `27d9fa39...` + repair `a0132b62...`; exact-head GREEN and protected-main integration | -| GAP-029 | Occasion-mean temporal composition arrived in the wrong bounded context with raw-bit event identity, naive mean summation, and order-dependent averaging | `active-fold` | owner-correct #310 lineage + release fragment `db335d90...`; canonical root CHANGELOG assembly, exact-head GREEN/review/main integration | +| GAP-029 | Occasion-mean temporal composition arrived in the wrong bounded context with raw-bit event identity, naive mean summation, and order-dependent averaging | `verification-pending` | verified-successor #486 closure into owner-correct #310 lineage + release fragment `db335d90...`; exact-head GREEN/review/main integration | | GAP-030 | Prediction-contradiction Analysis Run treated four observed relation classes as mandatory design strata | `active-fold` | RED `a2892b6...` + repair `a6402015...` + predecessor-test correction `6b0c8de6...`; fold unique evidence into #416; exact-survivor GREEN/review/main integration | | GAP-031 | Occasion-mean same-sign averaging double-rounded a representable minimum-subnormal ties-to-even mean | `verification-pending` | RED `9aff817f...` + repair `40e057b8...` + trace `a2e6ace7...`; exact-head GREEN and protected-main integration | | GAP-032 | CWC/irregular-residual same-sign averaging retained the same minimum-subnormal double-rounding defect | `verification-pending` | RED `23476f45...` + repair `b14eb6e8...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | @@ -153,8 +154,9 @@ Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/num | GAP-034 | Mixed-sign cancellation rounded a retained-only mean before restoring the original denominator, moving a representable subnormal mean by one ULP | `verification-pending` | RED `ae5e61f9...` + causal repair `39469067...` + occasion public-contract hardening `201f3900...` + research trace `34fd059a...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-035 | Within/between decomposition shadow running mean misrounded the representable `[1 ULP, 2 ULP]` unit mean and shifted residuals by one ULP | `verification-pending` | RED `7dc87aa8...` + causal repair `97c8ad35...` + research trace `a1aef11e...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-036 | Known-truth component RMSE could underflow a mathematically nonzero recovery error to exact zero and falsely report perfect recovery | `verification-pending` | RED `496583c6...` + causal repair `a82b383b...` + research trace `bfaa69c4...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-037 | Strict-interior lagged covariance could round to false exact `±1` correlation after exact covariance-bound admission | `verification-pending` | RED `683b28ee...` + causal repair `9eeb373d...` + public rustdoc `d21c0a2d...` + research trace `91943510...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-037 | Strict-interior lagged covariance could round to false exact `±1` correlation after exact covariance-bound admission | `verification-pending` | RED `683b28ee...` + causal repair `9eeb373d...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-038 | Exact Cauchy–Schwarz boundary covariance could round one ULP below `±1` and weaken a perfect represented association | `verification-pending` | RED `c2500090...` + causal repair `d06259ec...` + research trace `be5123d5...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | ## Release gate -TEPP currently has no GitHub release. Release is permitted only after a coherent vertical reaches protected main with exact protected-head CI/security/recovery evidence, reproducible package + SBOM + provenance + rollback artifacts, current version/CHANGELOG, required migration/restore/load evidence, and released integration contracts where deployment depends on them. Queued/pending/startup-failed/skipped or predecessor-head evidence is not GREEN. \ No newline at end of file +TEPP currently has no GitHub release. Release is permitted only after a coherent vertical reaches protected main with exact protected-head CI/security/recovery evidence, reproducible package + SBOM + provenance + rollback artifacts, current version/CHANGELOG, required migration/restore/load evidence, and released integration contracts where deployment depends on them. Queued/pending/startup-failed/skipped or predecessor-head evidence is not GREEN. From cad036cd3e075effd7beaa2ca5152cff5ec734a3 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 3 Sep 2026 16:07:13 +0900 Subject: [PATCH 126/235] docs(ddd): trace canonical zero association gap --- docs/product-technical-gap-baseline.md | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 003b488ea..e3fe8ef39 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,7 +4,7 @@ **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-03T06:27Z +**Snapshot:** 2026-09-03T07:05Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` @@ -43,7 +43,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | #460 | `dfab4eab5ff733731e565a9348072b8dab2e4912` | true | #416 | Analysis Run fold child; typed cutoff equality and terminal-validation separation. | | #458 | `08165e3b3c929b4ae77396689549f72723ff8ff5` | true | #416 | Analysis Run fold child; typed cutoff equality and terminal-validation separation. | | #416 | `0b7155cc238defb1e55129ff3000658f04b343cf` | true | `main` | Validation / Analysis Run landing vehicle; availability cutoff precedes duplicate-identity admission. | -| #310 | `be5123d50ad9edf22232b51d3819328a37063352` | true | `main` | Longitudinal Modeling vehicle; exact covariance-bound authority now prevents both false perfect endpoints from strict-interior inputs and false interior endpoints from exact perfect inputs. Exact-head verification remains non-passing until current gates and review complete. | +| #310 | `b56e1d160debde3b656f3ec71780fadb03d2fe85` | true | `main` | Longitudinal Modeling vehicle; exact covariance endpoint authority plus canonical public `+0.0` no-association encoding. Exact-head verification remains non-passing until current gates and review complete. | Exact-head evidence becomes stale after any source push. @@ -67,6 +67,7 @@ The clock contract separates event/valid time, assertion time, document time, sy - A representable final scientific estimand is not rejected solely because an avoidable intermediate binary64 operation overflows/underflows. False exact 0/1/non-finite endpoints remain fail-closed when the mathematical estimand is interior/nonzero. - A mathematically nonzero scientific error metric must not be promoted to exact perfect recovery merely because its final binary64 representation underflows to zero. - A strict-interior exact binary64 covariance must not be promoted to exact `±1` correlation merely because rounded square roots/divisions reach the endpoint. Conversely, an exact represented Cauchy–Schwarz boundary must not be weakened to an interior coefficient merely because rounded square roots/divisions fall one ULP below `1`. +- Exact zero covariance has one public no-association encoding. IEEE `-0.0` is not directional scientific evidence and is canonicalized to `+0.0` at the Temporal Association projection boundary after validation. - Binary64 minimum-subnormal means follow IEEE ties-to-even at the public composition boundary. Overflow-safe normalization must not add an avoidable earlier rounding step, and mixed-sign cancellation must apply the original sample-count denominator before rounding a retained-only mean. - Observed Allen support classes are data, not required design strata. A historical prediction census may truthfully have zero covered, partial-overlap, adjacent, or contradictory rows; absent classes remain explicit zero counts rather than invalidating the run. - Historical-cutoff admission occurs before duplicate-identity checks. Future-unavailable evidence cannot change an earlier run's conflicts, counts, or terminal state. @@ -88,9 +89,11 @@ Known-truth component RMSE has a separate fail-closed repair. For minimum positi Exact-binary association review found two endpoint defects in opposite directions. First, with earlier variance `f64::from_bits(4_607_182_418_800_016_408)`, later variance `f64::from_bits(4_607_182_418_800_016_427)`, and covariance magnitude `f64::from_bits(4_607_182_418_800_016_417)`, exact `Cov²` is strictly below the exact product of the two represented marginal variances, yet rounded square roots/divisions produce exact `±1.0`. RED `683b28eeeda3ad72ac11f5317c5aea54f34e0692` fixes both signs through the public `recover_event_time_lagged_correlation` API. Causal repair `9eeb373df2cd333fe7543df2197ea0cc0c492780` extends the exact integer-significand/power-of-two covariance comparison to distinguish strict interior from exact boundary and rejects rounded `±1` for strict-interior inputs. -Second, exact-boundary inputs can round the other way. `Var_t = 2`, `Var_{t+Δ} = 8`, and `|Cov| = 4` satisfy exact represented `Cov² = Var_t Var_{t+Δ}`, but the predecessor square-root/division path returns `0x1.fffffffffffffp-1` for the positive coefficient. RED `c25000901eb429a43817552f8b76cf4aae04e522` fixes both signs; causal repair `d06259ec1e036558d8d2f775c266b2b9db4e42c4` returns the exact signed endpoint when the exact integer relation is on the boundary and uses rounded standardization only for strict-interior coefficients. Research trace/current #310 head `be5123d50ad9edf22232b51d3819328a37063352` synchronizes the contract. +Second, exact-boundary inputs can round the other way. `Var_t = 2`, `Var_{t+Δ} = 8`, and `|Cov| = 4` satisfy exact represented `Cov² = Var_t Var_{t+Δ}`, but the predecessor square-root/division path returns `0x1.fffffffffffffp-1` for the positive coefficient. RED `c25000901eb429a43817552f8b76cf4aae04e522` fixes both signs; causal repair `d06259ec1e036558d8d2f775c266b2b9db4e42c4` returns the exact signed endpoint when the exact integer relation is on the boundary and uses rounded standardization only for strict-interior coefficients. -At exact #310 head `be5123d50ad9edf22232b51d3819328a37063352`, predecessor workflow/review evidence is stale by definition. Current-head Rust/documentation/security/coverage workflows and a qualifying independent approval must complete before the Draft can become a normal merge candidate; queued, pending, startup-failed, skipped, or predecessor-head evidence is not GREEN. +A third endpoint identity defect existed at exact zero. A supplied `-0.0` lagged covariance is the same exact no-association estimand as `+0.0`, but the private numeric path could preserve the negative IEEE sign bit into the public return value. RED `e15d053100c17ac46b48cc04ad61440d0185e729` requires both signs to project to public `+0.0`; causal repair `fc61f7bdb2fd8c67719c41a9ce9ef6436beab38a` canonicalizes only the validated zero result at `temporal_association.rs`, preserving private numerical validation/error precedence. Research trace/current #310 head `b56e1d160debde3b656f3ec71780fadb03d2fe85` synchronizes the API/test/module boundary. + +At exact #310 head `b56e1d160debde3b656f3ec71780fadb03d2fe85`, predecessor workflow/review evidence is stale by definition. Current-head Rust/documentation/security/coverage workflows and a qualifying independent approval must complete before the Draft can become a normal merge candidate; queued, pending, startup-failed, skipped, or predecessor-head evidence is not GREEN. #486 is closed as a verified-successor consolidation, not a PR-count-only close. No child-head CI/review evidence transfers to #310. @@ -156,6 +159,7 @@ Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/num | GAP-036 | Known-truth component RMSE could underflow a mathematically nonzero recovery error to exact zero and falsely report perfect recovery | `verification-pending` | RED `496583c6...` + causal repair `a82b383b...` + research trace `bfaa69c4...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-037 | Strict-interior lagged covariance could round to false exact `±1` correlation after exact covariance-bound admission | `verification-pending` | RED `683b28ee...` + causal repair `9eeb373d...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-038 | Exact Cauchy–Schwarz boundary covariance could round one ULP below `±1` and weaken a perfect represented association | `verification-pending` | RED `c2500090...` + causal repair `d06259ec...` + research trace `be5123d5...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-039 | Exact zero lagged covariance could leak IEEE `-0.0` through the public Temporal Association projection and create a bit-distinct directional-looking no-association value | `verification-pending` | RED `e15d0531...` + causal repair `fc61f7bd...` + research trace `b56e1d16...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | ## Release gate From 208468a5c9ba26a4d7cdb2c4f657bc83a71c0980 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 3 Sep 2026 17:05:09 +0900 Subject: [PATCH 127/235] docs(ddd): record canonical within-residual zero identity --- docs/product-technical-gap-baseline.md | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index e3fe8ef39..c6eb7bc83 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,7 +4,7 @@ **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-03T07:05Z +**Snapshot:** 2026-09-03T08:02Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` @@ -43,7 +43,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | #460 | `dfab4eab5ff733731e565a9348072b8dab2e4912` | true | #416 | Analysis Run fold child; typed cutoff equality and terminal-validation separation. | | #458 | `08165e3b3c929b4ae77396689549f72723ff8ff5` | true | #416 | Analysis Run fold child; typed cutoff equality and terminal-validation separation. | | #416 | `0b7155cc238defb1e55129ff3000658f04b343cf` | true | `main` | Validation / Analysis Run landing vehicle; availability cutoff precedes duplicate-identity admission. | -| #310 | `b56e1d160debde3b656f3ec71780fadb03d2fe85` | true | `main` | Longitudinal Modeling vehicle; exact covariance endpoint authority plus canonical public `+0.0` no-association encoding. Exact-head verification remains non-passing until current gates and review complete. | +| #310 | `ecb909143145b2021a89827cb071315f99c03fb5` | true | `main` | Longitudinal Modeling vehicle; exact scientific zero endpoints have canonical public identities, including exact-zero within residuals. Exact-head verification remains non-passing until current gates and review complete. | Exact-head evidence becomes stale after any source push. @@ -68,6 +68,7 @@ The clock contract separates event/valid time, assertion time, document time, sy - A mathematically nonzero scientific error metric must not be promoted to exact perfect recovery merely because its final binary64 representation underflows to zero. - A strict-interior exact binary64 covariance must not be promoted to exact `±1` correlation merely because rounded square roots/divisions reach the endpoint. Conversely, an exact represented Cauchy–Schwarz boundary must not be weakened to an interior coefficient merely because rounded square roots/divisions fall one ULP below `1`. - Exact zero covariance has one public no-association encoding. IEEE `-0.0` is not directional scientific evidence and is canonicalized to `+0.0` at the Temporal Association projection boundary after validation. +- Exact zero within-person deviation has one public decomposition encoding. IEEE `-0.0` does not denote negative within-person change and is canonicalized to `+0.0` only at the validated public residual projection boundary; private numerical intermediates may retain signed zero. - Binary64 minimum-subnormal means follow IEEE ties-to-even at the public composition boundary. Overflow-safe normalization must not add an avoidable earlier rounding step, and mixed-sign cancellation must apply the original sample-count denominator before rounding a retained-only mean. - Observed Allen support classes are data, not required design strata. A historical prediction census may truthfully have zero covered, partial-overlap, adjacent, or contradictory rows; absent classes remain explicit zero counts rather than invalidating the run. - Historical-cutoff admission occurs before duplicate-identity checks. Future-unavailable evidence cannot change an earlier run's conflicts, counts, or terminal state. @@ -91,9 +92,11 @@ Exact-binary association review found two endpoint defects in opposite direction Second, exact-boundary inputs can round the other way. `Var_t = 2`, `Var_{t+Δ} = 8`, and `|Cov| = 4` satisfy exact represented `Cov² = Var_t Var_{t+Δ}`, but the predecessor square-root/division path returns `0x1.fffffffffffffp-1` for the positive coefficient. RED `c25000901eb429a43817552f8b76cf4aae04e522` fixes both signs; causal repair `d06259ec1e036558d8d2f775c266b2b9db4e42c4` returns the exact signed endpoint when the exact integer relation is on the boundary and uses rounded standardization only for strict-interior coefficients. -A third endpoint identity defect existed at exact zero. A supplied `-0.0` lagged covariance is the same exact no-association estimand as `+0.0`, but the private numeric path could preserve the negative IEEE sign bit into the public return value. RED `e15d053100c17ac46b48cc04ad61440d0185e729` requires both signs to project to public `+0.0`; causal repair `fc61f7bdb2fd8c67719c41a9ce9ef6436beab38a` canonicalizes only the validated zero result at `temporal_association.rs`, preserving private numerical validation/error precedence. Research trace/current #310 head `b56e1d160debde3b656f3ec71780fadb03d2fe85` synchronizes the API/test/module boundary. +A third endpoint identity defect existed at exact zero. A supplied `-0.0` lagged covariance is the same exact no-association estimand as `+0.0`, but the private numeric path could preserve the negative IEEE sign bit into the public return value. RED `e15d053100c17ac46b48cc04ad61440d0185e729` requires both signs to project to public `+0.0`; causal repair `fc61f7bdb2fd8c67719c41a9ce9ef6436beab38a` canonicalizes only the validated zero result at `temporal_association.rs`, preserving private numerical validation/error precedence. Research trace `b56e1d160debde3b656f3ec71780fadb03d2fe85` synchronizes the API/test/module boundary. -At exact #310 head `b56e1d160debde3b656f3ec71780fadb03d2fe85`, predecessor workflow/review evidence is stale by definition. Current-head Rust/documentation/security/coverage workflows and a qualifying independent approval must complete before the Draft can become a normal merge candidate; queued, pending, startup-failed, skipped, or predecessor-head evidence is not GREEN. +Fresh decomposition review found the same semantic class at a different public estimand. A `-0.0` score minus a canonical `+0.0` unit mean can produce a bit-distinct `-0.0` within residual even though exact zero deviation has no direction. RED `aeb008a38bc333ba0f1bec0651739e361426e66d` drives public `decompose_within_between`; causal repair `a9a70baa5c2a40ec8bf3fc77748bc3a5eaf92cd8` canonicalizes only validated exact-zero within residuals at `decompose.rs`, and research trace/current #310 head `ecb909143145b2021a89827cb071315f99c03fb5` records the API/test/module/IEEE-754 boundary in `docs/research/longitudinal-within-between.md`. + +At exact #310 head `ecb909143145b2021a89827cb071315f99c03fb5`, predecessor workflow/review evidence is stale by definition. Current-head Rust/documentation/security/coverage workflows are queued and the formal review history contains no qualifying independent `APPROVED` submission. Queued, pending, startup-failed, skipped, or predecessor-head evidence is not GREEN. #486 is closed as a verified-successor consolidation, not a PR-count-only close. No child-head CI/review evidence transfers to #310. @@ -160,7 +163,8 @@ Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/num | GAP-037 | Strict-interior lagged covariance could round to false exact `±1` correlation after exact covariance-bound admission | `verification-pending` | RED `683b28ee...` + causal repair `9eeb373d...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-038 | Exact Cauchy–Schwarz boundary covariance could round one ULP below `±1` and weaken a perfect represented association | `verification-pending` | RED `c2500090...` + causal repair `d06259ec...` + research trace `be5123d5...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-039 | Exact zero lagged covariance could leak IEEE `-0.0` through the public Temporal Association projection and create a bit-distinct directional-looking no-association value | `verification-pending` | RED `e15d0531...` + causal repair `fc61f7bd...` + research trace `b56e1d16...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-040 | Exact zero within-person deviation could leak IEEE `-0.0` through public within/between decomposition and create two bit-distinct identities for one no-deviation estimand | `verification-pending` | RED `aeb008a3...` + causal repair `a9a70baa...` + research trace/current #310 `ecb90914...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | ## Release gate -TEPP currently has no GitHub release. Release is permitted only after a coherent vertical reaches protected main with exact protected-head CI/security/recovery evidence, reproducible package + SBOM + provenance + rollback artifacts, current version/CHANGELOG, required migration/restore/load evidence, and released integration contracts where deployment depends on them. Queued/pending/startup-failed/skipped or predecessor-head evidence is not GREEN. +TEPP currently has no GitHub release. Release is permitted only after a coherent vertical reaches protected main with exact protected-head CI/security/recovery evidence, reproducible package + SBOM + provenance + rollback artifacts, current version/CHANGELOG, required migration/restore/load evidence, and released integration contracts where deployment depends on them. Queued/pending/startup-failed/skipped or predecessor-head evidence is not GREEN. \ No newline at end of file From 7fc4ad95bbb3c0b52510fffbdaa0e3078e782c6e Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 3 Sep 2026 18:08:00 +0900 Subject: [PATCH 128/235] docs(ddd): track irregular-rate false-zero mean --- docs/product-technical-gap-baseline.md | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index c6eb7bc83..678e914a5 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,7 +4,7 @@ **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-03T08:02Z +**Snapshot:** 2026-09-03T09:06Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` @@ -43,7 +43,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | #460 | `dfab4eab5ff733731e565a9348072b8dab2e4912` | true | #416 | Analysis Run fold child; typed cutoff equality and terminal-validation separation. | | #458 | `08165e3b3c929b4ae77396689549f72723ff8ff5` | true | #416 | Analysis Run fold child; typed cutoff equality and terminal-validation separation. | | #416 | `0b7155cc238defb1e55129ff3000658f04b343cf` | true | `main` | Validation / Analysis Run landing vehicle; availability cutoff precedes duplicate-identity admission. | -| #310 | `ecb909143145b2021a89827cb071315f99c03fb5` | true | `main` | Longitudinal Modeling vehicle; exact scientific zero endpoints have canonical public identities, including exact-zero within residuals. Exact-head verification remains non-passing until current gates and review complete. | +| #310 | `0280aba07f5c726e162468a3ee275f187416c094` | true | `main` | Longitudinal Modeling vehicle; nonzero irregular-rate means now fail closed if their final binary64 mean would become exact no-change. Exact-head verification remains non-passing until current gates and review complete. | Exact-head evidence becomes stale after any source push. @@ -66,6 +66,7 @@ The clock contract separates event/valid time, assertion time, document time, sy - Row arrival order is not scientific evidence. Fixed admitted observations must produce bit-identical means/centered results under permutation wherever the contract claims deterministic f64 reference behavior. - A representable final scientific estimand is not rejected solely because an avoidable intermediate binary64 operation overflows/underflows. False exact 0/1/non-finite endpoints remain fail-closed when the mathematical estimand is interior/nonzero. - A mathematically nonzero scientific error metric must not be promoted to exact perfect recovery merely because its final binary64 representation underflows to zero. +- A mathematically nonzero one-sign temporal-rate mean must not be promoted to exact no-change merely because its final binary64 representation underflows to zero. All-zero inputs and exact mixed-sign cancellation remain exact zero. - A strict-interior exact binary64 covariance must not be promoted to exact `±1` correlation merely because rounded square roots/divisions reach the endpoint. Conversely, an exact represented Cauchy–Schwarz boundary must not be weakened to an interior coefficient merely because rounded square roots/divisions fall one ULP below `1`. - Exact zero covariance has one public no-association encoding. IEEE `-0.0` is not directional scientific evidence and is canonicalized to `+0.0` at the Temporal Association projection boundary after validation. - Exact zero within-person deviation has one public decomposition encoding. IEEE `-0.0` does not denote negative within-person change and is canonicalized to `+0.0` only at the validated public residual projection boundary; private numerical intermediates may retain signed zero. @@ -84,7 +85,7 @@ The clock contract separates event/valid time, assertion time, document time, sy The #486 occasion-mean fold is owner-correct on #310: RED `75b0184d...`, owner repair `7fe9aaf2...`, export/test repairs `b900e213...` / `30771ff2...`, determinism RED `8a59019e...`, same-sign ordering repair `465d139d...`, same-panel/sparse successor regressions `b9e952bb...` / `aad56b50...`, ADR `04b3c26e...`, PRD `a221f494...`, research trace `27aa78ee...`, subnormal RED `9aff817f...`, source repair `40e057b8...`, and trace `a2e6ace7...`. Commit `db335d904ccc43dd0af7982c34df83008c968ef6` preserves the child's valid operational release delta in `CHANGELOG.d/longitudinal-occasion-mean-event-time.md` under the correct owner. Repository precedent verifies `CHANGELOG.d` as a valid non-destructive stacked-consolidation release-note carrier, and #486 was closed as a verified successor after all valid scientific/test/contract/docs/release-note deltas were checked on #310; invalid wrong-owner/weaker deltas were intentionally not copied. -The CWC/occasion/decomposition mean lineage remains one Longitudinal-local authority. CWC RED `23476f45...` / repair `b14eb6e8...` closed the `[1 ULP, 2 ULP]` ties-to-even defect; `b073f03f...` / `350b8d4e...` changed arbitrary normalization to an exact power-of-two scale; `dd53eff6...` consolidated CWC and occasion means; mixed-sign RED `ae5e61f9...` / repair `39469067...` plus `201f3900...` and trace `34fd059a...` removed retained-mean double rounding; decomposition RED `7dc87aa8...` / repair `97c8ad35...` and trace `a1aef11e...` removed the remaining shadow running mean. +The CWC/occasion/decomposition/irregular-rate mean lineage remains one Longitudinal-local authority. CWC RED `23476f45...` / repair `b14eb6e8...` closed the `[1 ULP, 2 ULP]` ties-to-even defect; `b073f03f...` / `350b8d4e...` changed arbitrary normalization to an exact power-of-two scale; `dd53eff6...` consolidated CWC and occasion means; mixed-sign RED `ae5e61f9...` / repair `39469067...` plus `201f3900...` and trace `34fd059a...` removed retained-mean double rounding; decomposition RED `7dc87aa8...` / repair `97c8ad35...` and trace `a1aef11e...` removed the remaining shadow running mean. Mean-level underflow RED `96f1c334...` now proves that individually representable temporal rates can still have a mathematically nonzero aggregate mean below binary64's range; repair `ae5081d8...` rejects only that one-sign false-zero endpoint, while exact all-zero input and exact mixed-sign cancellation remain zero. Research trace/current #310 head `0280aba0...` documents the public boundary. Known-truth component RMSE has a separate fail-closed repair. For minimum positive subnormal ULP `u`, five identity-matched component rows with one residual `u` and four exact-zero residuals have mathematical RMSE `u / sqrt(5) > 0`, but the final binary64 product rounds to exact zero. RED `496583c6b62cbe0ad1be0e65b51f01d7f72acd5a` drives the public API; causal repair `a82b383b5940126a0139180d66729d2e6aa4baf7` preserves exact perfect recovery only on the pre-existing `scale == 0` path and rejects a later rounded zero after nonzero residual scale. Trace `bfaa69c4...` records the boundary. @@ -94,9 +95,9 @@ Second, exact-boundary inputs can round the other way. `Var_t = 2`, `Var_{t+Δ} A third endpoint identity defect existed at exact zero. A supplied `-0.0` lagged covariance is the same exact no-association estimand as `+0.0`, but the private numeric path could preserve the negative IEEE sign bit into the public return value. RED `e15d053100c17ac46b48cc04ad61440d0185e729` requires both signs to project to public `+0.0`; causal repair `fc61f7bdb2fd8c67719c41a9ce9ef6436beab38a` canonicalizes only the validated zero result at `temporal_association.rs`, preserving private numerical validation/error precedence. Research trace `b56e1d160debde3b656f3ec71780fadb03d2fe85` synchronizes the API/test/module boundary. -Fresh decomposition review found the same semantic class at a different public estimand. A `-0.0` score minus a canonical `+0.0` unit mean can produce a bit-distinct `-0.0` within residual even though exact zero deviation has no direction. RED `aeb008a38bc333ba0f1bec0651739e361426e66d` drives public `decompose_within_between`; causal repair `a9a70baa5c2a40ec8bf3fc77748bc3a5eaf92cd8` canonicalizes only validated exact-zero within residuals at `decompose.rs`, and research trace/current #310 head `ecb909143145b2021a89827cb071315f99c03fb5` records the API/test/module/IEEE-754 boundary in `docs/research/longitudinal-within-between.md`. +Fresh decomposition review found the same semantic class at a different public estimand. A `-0.0` score minus a canonical `+0.0` unit mean can produce a bit-distinct `-0.0` within residual even though exact zero deviation has no direction. RED `aeb008a38bc333ba0f1bec0651739e361426e66d` drives public `decompose_within_between`; causal repair `a9a70baa5c2a40ec8bf3fc77748bc3a5eaf92cd8` canonicalizes only validated exact-zero within residuals at `decompose.rs`, and research trace `ecb909143145b2021a89827cb071315f99c03fb5` records the API/test/module/IEEE-754 boundary in `docs/research/longitudinal-within-between.md`. -At exact #310 head `ecb909143145b2021a89827cb071315f99c03fb5`, predecessor workflow/review evidence is stale by definition. Current-head Rust/documentation/security/coverage workflows are queued and the formal review history contains no qualifying independent `APPROVED` submission. Queued, pending, startup-failed, skipped, or predecessor-head evidence is not GREEN. +At exact #310 head `0280aba07f5c726e162468a3ee275f187416c094`, predecessor workflow/review evidence is stale by definition. Current-head Rust/documentation/security/coverage workflows are queued/pending and the formal review history must contain a qualifying independent current-head `APPROVED` submission before Ready/merge. Queued, pending, startup-failed, skipped, or predecessor-head evidence is not GREEN. #486 is closed as a verified-successor consolidation, not a PR-count-only close. No child-head CI/review evidence transfers to #310. @@ -163,7 +164,8 @@ Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/num | GAP-037 | Strict-interior lagged covariance could round to false exact `±1` correlation after exact covariance-bound admission | `verification-pending` | RED `683b28ee...` + causal repair `9eeb373d...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-038 | Exact Cauchy–Schwarz boundary covariance could round one ULP below `±1` and weaken a perfect represented association | `verification-pending` | RED `c2500090...` + causal repair `d06259ec...` + research trace `be5123d5...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-039 | Exact zero lagged covariance could leak IEEE `-0.0` through the public Temporal Association projection and create a bit-distinct directional-looking no-association value | `verification-pending` | RED `e15d0531...` + causal repair `fc61f7bd...` + research trace `b56e1d16...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-040 | Exact zero within-person deviation could leak IEEE `-0.0` through public within/between decomposition and create two bit-distinct identities for one no-deviation estimand | `verification-pending` | RED `aeb008a3...` + causal repair `a9a70baa...` + research trace/current #310 `ecb90914...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-040 | Exact zero within-person deviation could leak IEEE `-0.0` through public within/between decomposition and create two bit-distinct identities for one no-deviation estimand | `verification-pending` | RED `aeb008a3...` + causal repair `a9a70baa...` + research trace `ecb90914...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-041 | Individually representable irregular residual log-rates could have a mathematically nonzero one-sign mean that underflowed to exact zero and falsely reported no temporal change | `verification-pending` | RED `96f1c334...` + causal repair `ae5081d8...` + research trace/current #310 `0280aba0...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | ## Release gate From 51a8f5c50811e0a2087d86d11055c6e8e60fc818 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 3 Sep 2026 19:34:59 +0900 Subject: [PATCH 129/235] docs(ddd): refresh TEPP queue and GAP-042 --- docs/product-technical-gap-baseline.md | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 678e914a5..6c2fb4a67 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,7 +4,7 @@ **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-03T09:06Z +**Snapshot:** 2026-09-03T10:32Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` @@ -34,7 +34,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #487 | `6b0c8de64f41bc11f8bf908e0f9cbe854c1e213c` | true | #416 `feat/copy-identity-analysis-run-gap-004` | Validation / Analysis Run fold child. Sparse observed relation classes are valid evidence; RED `a2892b6...`, repair `a6402015...`, predecessor-test correction `6b0c8de6...`. No child-head CI transfers to #416. | +| #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 `feat/copy-identity-analysis-run-gap-004` | Validation / Analysis Run fold child. Sparse observed relation classes are valid evidence; RED `a2892b6...`, repair `a6402015...`, predecessor-test correction `6b0c8de6...`; ADR 0079 is repaired to `Proposed` at `e07b2ff...`. No child-head CI transfers to #416. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | | #483 | `847d96f913bb261803ac0bd751ad7e4f51324cee` | true | #416 | Analysis Run fold child; preserve unique evidence. | @@ -43,7 +43,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | #460 | `dfab4eab5ff733731e565a9348072b8dab2e4912` | true | #416 | Analysis Run fold child; typed cutoff equality and terminal-validation separation. | | #458 | `08165e3b3c929b4ae77396689549f72723ff8ff5` | true | #416 | Analysis Run fold child; typed cutoff equality and terminal-validation separation. | | #416 | `0b7155cc238defb1e55129ff3000658f04b343cf` | true | `main` | Validation / Analysis Run landing vehicle; availability cutoff precedes duplicate-identity admission. | -| #310 | `0280aba07f5c726e162468a3ee275f187416c094` | true | `main` | Longitudinal Modeling vehicle; nonzero irregular-rate means now fail closed if their final binary64 mean would become exact no-change. Exact-head verification remains non-passing until current gates and review complete. | +| #310 | `0a19f8e2be9e537a2995728e5938489c66c632d3` | true | `main` | Longitudinal Modeling vehicle; adjacent-float power-of-two growth no longer nearly doubles the represented log-rate through ratio-first rounding. Exact-head verification remains non-passing until current gates and review complete. | Exact-head evidence becomes stale after any source push. @@ -67,6 +67,7 @@ The clock contract separates event/valid time, assertion time, document time, sy - A representable final scientific estimand is not rejected solely because an avoidable intermediate binary64 operation overflows/underflows. False exact 0/1/non-finite endpoints remain fail-closed when the mathematical estimand is interior/nonzero. - A mathematically nonzero scientific error metric must not be promoted to exact perfect recovery merely because its final binary64 representation underflows to zero. - A mathematically nonzero one-sign temporal-rate mean must not be promoted to exact no-change merely because its final binary64 representation underflows to zero. All-zero inputs and exact mixed-sign cancellation remain exact zero. +- A temporal log-rate over represented endpoint magnitudes must not be materially changed by avoidable ratio-first rounding. Nearby values use exact-difference/`ln_1p` evaluation before event-time division; extreme-scale fallbacks remain fail-closed or log-domain as appropriate. - A strict-interior exact binary64 covariance must not be promoted to exact `±1` correlation merely because rounded square roots/divisions reach the endpoint. Conversely, an exact represented Cauchy–Schwarz boundary must not be weakened to an interior coefficient merely because rounded square roots/divisions fall one ULP below `1`. - Exact zero covariance has one public no-association encoding. IEEE `-0.0` is not directional scientific evidence and is canonicalized to `+0.0` at the Temporal Association projection boundary after validation. - Exact zero within-person deviation has one public decomposition encoding. IEEE `-0.0` does not denote negative within-person change and is canonicalized to `+0.0` only at the validated public residual projection boundary; private numerical intermediates may retain signed zero. @@ -85,7 +86,9 @@ The clock contract separates event/valid time, assertion time, document time, sy The #486 occasion-mean fold is owner-correct on #310: RED `75b0184d...`, owner repair `7fe9aaf2...`, export/test repairs `b900e213...` / `30771ff2...`, determinism RED `8a59019e...`, same-sign ordering repair `465d139d...`, same-panel/sparse successor regressions `b9e952bb...` / `aad56b50...`, ADR `04b3c26e...`, PRD `a221f494...`, research trace `27aa78ee...`, subnormal RED `9aff817f...`, source repair `40e057b8...`, and trace `a2e6ace7...`. Commit `db335d904ccc43dd0af7982c34df83008c968ef6` preserves the child's valid operational release delta in `CHANGELOG.d/longitudinal-occasion-mean-event-time.md` under the correct owner. Repository precedent verifies `CHANGELOG.d` as a valid non-destructive stacked-consolidation release-note carrier, and #486 was closed as a verified successor after all valid scientific/test/contract/docs/release-note deltas were checked on #310; invalid wrong-owner/weaker deltas were intentionally not copied. -The CWC/occasion/decomposition/irregular-rate mean lineage remains one Longitudinal-local authority. CWC RED `23476f45...` / repair `b14eb6e8...` closed the `[1 ULP, 2 ULP]` ties-to-even defect; `b073f03f...` / `350b8d4e...` changed arbitrary normalization to an exact power-of-two scale; `dd53eff6...` consolidated CWC and occasion means; mixed-sign RED `ae5e61f9...` / repair `39469067...` plus `201f3900...` and trace `34fd059a...` removed retained-mean double rounding; decomposition RED `7dc87aa8...` / repair `97c8ad35...` and trace `a1aef11e...` removed the remaining shadow running mean. Mean-level underflow RED `96f1c334...` now proves that individually representable temporal rates can still have a mathematically nonzero aggregate mean below binary64's range; repair `ae5081d8...` rejects only that one-sign false-zero endpoint, while exact all-zero input and exact mixed-sign cancellation remain zero. Research trace/current #310 head `0280aba0...` documents the public boundary. +The CWC/occasion/decomposition/irregular-rate mean lineage remains one Longitudinal-local authority. CWC RED `23476f45...` / repair `b14eb6e8...` closed the `[1 ULP, 2 ULP]` ties-to-even defect; `b073f03f...` / `350b8d4e...` changed arbitrary normalization to an exact power-of-two scale; `dd53eff6...` consolidated CWC and occasion means; mixed-sign RED `ae5e61f9...` / repair `39469067...` plus `201f3900...` and trace `34fd059a...` removed retained-mean double rounding; decomposition RED `7dc87aa8...` / repair `97c8ad35...` and trace `a1aef11e...` removed the remaining shadow running mean. Mean-level underflow RED `96f1c334...` proves that individually representable temporal rates can still have a mathematically nonzero aggregate mean below binary64's range; repair `ae5081d8...` rejects only that one-sign false-zero endpoint, while exact all-zero input and exact mixed-sign cancellation remain zero. + +Fresh individual-rate review found a separate quotient-rounding defect. For the represented value immediately below `2.0` followed by `2.0`, the previous finite-ratio-first path rounded `later / earlier` before `ln`, making the recovered log-rate almost twice the correctly rounded logarithm of the represented endpoint ratio. Public RED `766ddc7a3d95102450d663f06d2c577306964d79` fixes the adjacent-float power-of-two fixture. Causal repair `16f21d9a223fb34d52f24d148c7cad9b385e1d91` uses exact represented differences plus `ln_1p` within the factor-two neighborhood and preserves direct-ratio/log-domain fallbacks for extreme scales. Research trace/current #310 head `0a19f8e2be9e537a2995728e5938489c66c632d3` records the estimator, test, API, and IEEE-754 boundary. Known-truth component RMSE has a separate fail-closed repair. For minimum positive subnormal ULP `u`, five identity-matched component rows with one residual `u` and four exact-zero residuals have mathematical RMSE `u / sqrt(5) > 0`, but the final binary64 product rounds to exact zero. RED `496583c6b62cbe0ad1be0e65b51f01d7f72acd5a` drives the public API; causal repair `a82b383b5940126a0139180d66729d2e6aa4baf7` preserves exact perfect recovery only on the pre-existing `scale == 0` path and rejects a later rounded zero after nonzero residual scale. Trace `bfaa69c4...` records the boundary. @@ -97,7 +100,7 @@ A third endpoint identity defect existed at exact zero. A supplied `-0.0` lagged Fresh decomposition review found the same semantic class at a different public estimand. A `-0.0` score minus a canonical `+0.0` unit mean can produce a bit-distinct `-0.0` within residual even though exact zero deviation has no direction. RED `aeb008a38bc333ba0f1bec0651739e361426e66d` drives public `decompose_within_between`; causal repair `a9a70baa5c2a40ec8bf3fc77748bc3a5eaf92cd8` canonicalizes only validated exact-zero within residuals at `decompose.rs`, and research trace `ecb909143145b2021a89827cb071315f99c03fb5` records the API/test/module/IEEE-754 boundary in `docs/research/longitudinal-within-between.md`. -At exact #310 head `0280aba07f5c726e162468a3ee275f187416c094`, predecessor workflow/review evidence is stale by definition. Current-head Rust/documentation/security/coverage workflows are queued/pending and the formal review history must contain a qualifying independent current-head `APPROVED` submission before Ready/merge. Queued, pending, startup-failed, skipped, or predecessor-head evidence is not GREEN. +At exact #310 head `0a19f8e2be9e537a2995728e5938489c66c632d3`, predecessor workflow/review evidence is stale by definition. Current-head Rust/documentation/security/coverage workflows and a qualifying independent current-head `APPROVED` submission are required before Ready/merge. Queued, pending, startup-failed, skipped, or predecessor-head evidence is not GREEN. #486 is closed as a verified-successor consolidation, not a PR-count-only close. No child-head CI/review evidence transfers to #310. @@ -105,7 +108,7 @@ At exact #310 head `0280aba07f5c726e162468a3ee275f187416c094`, predecessor workf #416 `0b7155cc...` centralizes the leakage-safe invariant that availability filtering occurs before duplicate-identity admission. #458/#460/#482/#483/#484/#485/#487 are current fold children over shared Cargo/lib/lock/docs surfaces. Their unique evidence must reach a surviving #416 exact head before any child can be considered fully superseded. -#487 exposed a scientific acceptance bug: the first implementation required all four Allen support classes and at least four assignments merely because the test fixture exercised those branches. RED `a2892b6...` requires covered-only and contradiction-only historical censuses to succeed with truthful zero counts. Repair `a6402015...` keeps only real invariants: nonempty admitted evidence, size bound, exact class sums, refusal-plus-covered conservation, cutoff-safe admission, digest/schema validation, and claim boundary. `6b0c8de6...` removes predecessor tests that encoded the rejected fixture-as-production rule. The child remains conflicted beneath #416 and does not transfer child-head evidence to #416. +#487 exposed a scientific acceptance bug: the first implementation required all four Allen support classes and at least four assignments merely because the test fixture exercised those branches. RED `a2892b6...` requires covered-only and contradiction-only historical censuses to succeed with truthful zero counts. Repair `a6402015...` keeps only real invariants: nonempty admitted evidence, size bound, exact class sums, refusal-plus-covered conservation, cutoff-safe admission, digest/schema validation, and claim boundary. `6b0c8de6...` removes predecessor tests that encoded the rejected fixture-as-production rule. Fresh docs-to-code repair `e07b2ff9...` makes branch-local ADR 0079 `Proposed` under the existing canonical ADR lineage and removes the contradictory mixed-four-class prerequisite. The child remains conflicted beneath #416 and does not transfer child-head evidence to #416. ### #480 — contextual-orchestrator boundary @@ -154,7 +157,7 @@ Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/num | GAP-027 | Finite-interval `discreteDIFFUSIONstd` could report exact unit diffusion after exponent saturation erased a nonzero remainder | `verification-pending` | RED `a8de3c9f...` + repair `c17e2ff8...`; exact-head GREEN and protected-main integration | | GAP-028 | Actual stationary variance `p` could be misreported as exact zero when positive real `p` lies below binary64 range | `verification-pending` | RED `27d9fa39...` + repair `a0132b62...`; exact-head GREEN and protected-main integration | | GAP-029 | Occasion-mean temporal composition arrived in the wrong bounded context with raw-bit event identity, naive mean summation, and order-dependent averaging | `verification-pending` | verified-successor #486 closure into owner-correct #310 lineage + release fragment `db335d90...`; exact-head GREEN/review/main integration | -| GAP-030 | Prediction-contradiction Analysis Run treated four observed relation classes as mandatory design strata | `active-fold` | RED `a2892b6...` + repair `a6402015...` + predecessor-test correction `6b0c8de6...`; fold unique evidence into #416; exact-survivor GREEN/review/main integration | +| GAP-030 | Prediction-contradiction Analysis Run treated four observed relation classes as mandatory design strata and documented that branch-local rule as accepted architecture | `active-fold` | RED `a2892b6...` + repair `a6402015...` + predecessor-test correction `6b0c8de6...` + Proposed-ADR repair `e07b2ff9...`; fold unique evidence into #416; exact-survivor GREEN/review/main integration | | GAP-031 | Occasion-mean same-sign averaging double-rounded a representable minimum-subnormal ties-to-even mean | `verification-pending` | RED `9aff817f...` + repair `40e057b8...` + trace `a2e6ace7...`; exact-head GREEN and protected-main integration | | GAP-032 | CWC/irregular-residual same-sign averaging retained the same minimum-subnormal double-rounding defect | `verification-pending` | RED `23476f45...` + repair `b14eb6e8...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-033 | Arbitrary max-magnitude normalization introduced a second rounding and misrounded a 7.5-ULP subnormal mean to 7 ULPs | `verification-pending` | RED `b073f03f...` + exact-power-of-two repair `350b8d4e...` + Longitudinal mean-authority consolidation `dd53eff6...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | @@ -165,7 +168,8 @@ Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/num | GAP-038 | Exact Cauchy–Schwarz boundary covariance could round one ULP below `±1` and weaken a perfect represented association | `verification-pending` | RED `c2500090...` + causal repair `d06259ec...` + research trace `be5123d5...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-039 | Exact zero lagged covariance could leak IEEE `-0.0` through the public Temporal Association projection and create a bit-distinct directional-looking no-association value | `verification-pending` | RED `e15d0531...` + causal repair `fc61f7bd...` + research trace `b56e1d16...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-040 | Exact zero within-person deviation could leak IEEE `-0.0` through public within/between decomposition and create two bit-distinct identities for one no-deviation estimand | `verification-pending` | RED `aeb008a3...` + causal repair `a9a70baa...` + research trace `ecb90914...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-041 | Individually representable irregular residual log-rates could have a mathematically nonzero one-sign mean that underflowed to exact zero and falsely reported no temporal change | `verification-pending` | RED `96f1c334...` + causal repair `ae5081d8...` + research trace/current #310 `0280aba0...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-041 | Individually representable irregular residual log-rates could have a mathematically nonzero one-sign mean that underflowed to exact zero and falsely reported no temporal change | `verification-pending` | RED `96f1c334...` + causal repair `ae5081d8...` + research trace `0280aba0...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-042 | Ratio-first logarithm could nearly double an adjacent-float power-of-two irregular residual growth rate before event-time scaling | `verification-pending` | public RED `766ddc7a...` + causal `ln_1p` repair `16f21d9a...` + research trace/current #310 `0a19f8e2...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | ## Release gate From ef5bf1a7477c173b51feb915fc6f41921442c1cd Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 3 Sep 2026 20:10:50 +0900 Subject: [PATCH 130/235] docs(product): register RMSE denominator identity gap --- docs/product-technical-gap-baseline.md | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 6c2fb4a67..c8d4dd878 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,7 +4,7 @@ **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-03T10:32Z +**Snapshot:** 2026-09-03T11:09Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` @@ -43,7 +43,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | #460 | `dfab4eab5ff733731e565a9348072b8dab2e4912` | true | #416 | Analysis Run fold child; typed cutoff equality and terminal-validation separation. | | #458 | `08165e3b3c929b4ae77396689549f72723ff8ff5` | true | #416 | Analysis Run fold child; typed cutoff equality and terminal-validation separation. | | #416 | `0b7155cc238defb1e55129ff3000658f04b343cf` | true | `main` | Validation / Analysis Run landing vehicle; availability cutoff precedes duplicate-identity admission. | -| #310 | `0a19f8e2be9e537a2995728e5938489c66c632d3` | true | `main` | Longitudinal Modeling vehicle; adjacent-float power-of-two growth no longer nearly doubles the represented log-rate through ratio-first rounding. Exact-head verification remains non-passing until current gates and review complete. | +| #310 | `be0f21e9826bf18f8e4bd67e319495fc4b1be4d9` | true | `main` | Longitudinal Modeling vehicle; known-truth RMSE now refuses duplicate component identities that would silently reweight its recovery denominator. Exact-head verification remains non-passing until current gates and review complete. | Exact-head evidence becomes stale after any source push. @@ -66,6 +66,7 @@ The clock contract separates event/valid time, assertion time, document time, sy - Row arrival order is not scientific evidence. Fixed admitted observations must produce bit-identical means/centered results under permutation wherever the contract claims deterministic f64 reference behavior. - A representable final scientific estimand is not rejected solely because an avoidable intermediate binary64 operation overflows/underflows. False exact 0/1/non-finite endpoints remain fail-closed when the mathematical estimand is interior/nonzero. - A mathematically nonzero scientific error metric must not be promoted to exact perfect recovery merely because its final binary64 representation underflows to zero. +- Known-truth recovery denominators are defined by unique scientific component identity. Duplicate `(unit, occasion, level)` rows are not implicit weights and must fail closed unless a separately named weighted contract explicitly owns the weighting rule. - A mathematically nonzero one-sign temporal-rate mean must not be promoted to exact no-change merely because its final binary64 representation underflows to zero. All-zero inputs and exact mixed-sign cancellation remain exact zero. - A temporal log-rate over represented endpoint magnitudes must not be materially changed by avoidable ratio-first rounding. Nearby values use exact-difference/`ln_1p` evaluation before event-time division; extreme-scale fallbacks remain fail-closed or log-domain as appropriate. - A strict-interior exact binary64 covariance must not be promoted to exact `±1` correlation merely because rounded square roots/divisions reach the endpoint. Conversely, an exact represented Cauchy–Schwarz boundary must not be weakened to an interior coefficient merely because rounded square roots/divisions fall one ULP below `1`. @@ -88,9 +89,11 @@ The #486 occasion-mean fold is owner-correct on #310: RED `75b0184d...`, owner r The CWC/occasion/decomposition/irregular-rate mean lineage remains one Longitudinal-local authority. CWC RED `23476f45...` / repair `b14eb6e8...` closed the `[1 ULP, 2 ULP]` ties-to-even defect; `b073f03f...` / `350b8d4e...` changed arbitrary normalization to an exact power-of-two scale; `dd53eff6...` consolidated CWC and occasion means; mixed-sign RED `ae5e61f9...` / repair `39469067...` plus `201f3900...` and trace `34fd059a...` removed retained-mean double rounding; decomposition RED `7dc87aa8...` / repair `97c8ad35...` and trace `a1aef11e...` removed the remaining shadow running mean. Mean-level underflow RED `96f1c334...` proves that individually representable temporal rates can still have a mathematically nonzero aggregate mean below binary64's range; repair `ae5081d8...` rejects only that one-sign false-zero endpoint, while exact all-zero input and exact mixed-sign cancellation remain zero. -Fresh individual-rate review found a separate quotient-rounding defect. For the represented value immediately below `2.0` followed by `2.0`, the previous finite-ratio-first path rounded `later / earlier` before `ln`, making the recovered log-rate almost twice the correctly rounded logarithm of the represented endpoint ratio. Public RED `766ddc7a3d95102450d663f06d2c577306964d79` fixes the adjacent-float power-of-two fixture. Causal repair `16f21d9a223fb34d52f24d148c7cad9b385e1d91` uses exact represented differences plus `ln_1p` within the factor-two neighborhood and preserves direct-ratio/log-domain fallbacks for extreme scales. Research trace/current #310 head `0a19f8e2be9e537a2995728e5938489c66c632d3` records the estimator, test, API, and IEEE-754 boundary. +Individual-rate review also found a quotient-rounding defect. For the represented value immediately below `2.0` followed by `2.0`, the previous finite-ratio-first path rounded `later / earlier` before `ln`, making the recovered log-rate almost twice the correctly rounded logarithm of the represented endpoint ratio. Public RED `766ddc7a3d95102450d663f06d2c577306964d79` fixes the adjacent-float power-of-two fixture. Causal repair `16f21d9a223fb34d52f24d148c7cad9b385e1d91` uses exact represented differences plus `ln_1p` within the factor-two neighborhood and preserves direct-ratio/log-domain fallbacks for extreme scales. -Known-truth component RMSE has a separate fail-closed repair. For minimum positive subnormal ULP `u`, five identity-matched component rows with one residual `u` and four exact-zero residuals have mathematical RMSE `u / sqrt(5) > 0`, but the final binary64 product rounds to exact zero. RED `496583c6b62cbe0ad1be0e65b51f01d7f72acd5a` drives the public API; causal repair `a82b383b5940126a0139180d66729d2e6aa4baf7` preserves exact perfect recovery only on the pre-existing `scale == 0` path and rejects a later rounded zero after nonzero residual scale. Trace `bfaa69c4...` records the boundary. +Known-truth component RMSE has two separate fail-closed repairs. First, for minimum positive subnormal ULP `u`, five identity-matched component rows with one residual `u` and four exact-zero residuals have mathematical RMSE `u / sqrt(5) > 0`, but the final binary64 product rounds to exact zero. RED `496583c6b62cbe0ad1be0e65b51f01d7f72acd5a` drives the public API; causal repair `a82b383b5940126a0139180d66729d2e6aa4baf7` preserves exact perfect recovery only on the pre-existing `scale == 0` path and rejects a later rounded zero after nonzero residual scale. + +Second, fresh recovery-denominator review found that pairwise identity equality did not make the identity set unique. Repeating an already-matched component silently changed `n` in the RMSE denominator and therefore acted as an undocumented weight. Public RED `698f12f5b2f7a3c194e9d1d3f00c5aeaf10591f8` duplicates the same zero-error `(unit, occasion, between)` target while another unique target has nonzero error and requires fail-closed admission. Causal repair `2fae4cb2e7df2845270bd27192000ca370fb05ad` records unique `(unit, occasion, level)` identities before residual accumulation. Research trace `04e9b52d36812a202fe4717e92593221f7bdeb55` defines the performance-unit/denominator invariant, and `be0f21e9826bf18f8e4bd67e319495fc4b1be4d9` adds the release fragment. Existing overflow-safe accumulation, identity alignment, finite-input checks, exact-zero perfect recovery, and nonzero-underflow refusal remain intact. Exact-binary association review found two endpoint defects in opposite directions. First, with earlier variance `f64::from_bits(4_607_182_418_800_016_408)`, later variance `f64::from_bits(4_607_182_418_800_016_427)`, and covariance magnitude `f64::from_bits(4_607_182_418_800_016_417)`, exact `Cov²` is strictly below the exact product of the two represented marginal variances, yet rounded square roots/divisions produce exact `±1.0`. RED `683b28eeeda3ad72ac11f5317c5aea54f34e0692` fixes both signs through the public `recover_event_time_lagged_correlation` API. Causal repair `9eeb373df2cd333fe7543df2197ea0cc0c492780` extends the exact integer-significand/power-of-two covariance comparison to distinguish strict interior from exact boundary and rejects rounded `±1` for strict-interior inputs. @@ -100,7 +103,7 @@ A third endpoint identity defect existed at exact zero. A supplied `-0.0` lagged Fresh decomposition review found the same semantic class at a different public estimand. A `-0.0` score minus a canonical `+0.0` unit mean can produce a bit-distinct `-0.0` within residual even though exact zero deviation has no direction. RED `aeb008a38bc333ba0f1bec0651739e361426e66d` drives public `decompose_within_between`; causal repair `a9a70baa5c2a40ec8bf3fc77748bc3a5eaf92cd8` canonicalizes only validated exact-zero within residuals at `decompose.rs`, and research trace `ecb909143145b2021a89827cb071315f99c03fb5` records the API/test/module/IEEE-754 boundary in `docs/research/longitudinal-within-between.md`. -At exact #310 head `0a19f8e2be9e537a2995728e5938489c66c632d3`, predecessor workflow/review evidence is stale by definition. Current-head Rust/documentation/security/coverage workflows and a qualifying independent current-head `APPROVED` submission are required before Ready/merge. Queued, pending, startup-failed, skipped, or predecessor-head evidence is not GREEN. +At exact #310 head `be0f21e9826bf18f8e4bd67e319495fc4b1be4d9`, predecessor workflow/review evidence is stale by definition. Current-head Rust/documentation/security/coverage workflows and a qualifying independent current-head `APPROVED` submission are required before Ready/merge. Queued, pending, startup-failed, skipped, or predecessor-head evidence is not GREEN. #486 is closed as a verified-successor consolidation, not a PR-count-only close. No child-head CI/review evidence transfers to #310. @@ -169,7 +172,8 @@ Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/num | GAP-039 | Exact zero lagged covariance could leak IEEE `-0.0` through the public Temporal Association projection and create a bit-distinct directional-looking no-association value | `verification-pending` | RED `e15d0531...` + causal repair `fc61f7bd...` + research trace `b56e1d16...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-040 | Exact zero within-person deviation could leak IEEE `-0.0` through public within/between decomposition and create two bit-distinct identities for one no-deviation estimand | `verification-pending` | RED `aeb008a3...` + causal repair `a9a70baa...` + research trace `ecb90914...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-041 | Individually representable irregular residual log-rates could have a mathematically nonzero one-sign mean that underflowed to exact zero and falsely reported no temporal change | `verification-pending` | RED `96f1c334...` + causal repair `ae5081d8...` + research trace `0280aba0...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-042 | Ratio-first logarithm could nearly double an adjacent-float power-of-two irregular residual growth rate before event-time scaling | `verification-pending` | public RED `766ddc7a...` + causal `ln_1p` repair `16f21d9a...` + research trace/current #310 `0a19f8e2...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-042 | Ratio-first logarithm could nearly double an adjacent-float power-of-two irregular residual growth rate before event-time scaling | `verification-pending` | public RED `766ddc7a...` + causal `ln_1p` repair `16f21d9a...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-043 | Duplicate known-truth component identities could silently reweight RMSE recovery evidence by changing the denominator without adding a new scientific target | `verification-pending` | public RED `698f12f5...` + causal uniqueness repair `2fae4cb2...` + research trace `04e9b52d...` + release fragment/current #310 `be0f21e9...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | ## Release gate From 251b4d2c97afe8a79d58c274774ff4cfce23c075 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 3 Sep 2026 21:08:53 +0900 Subject: [PATCH 131/235] docs(gaps): trace deterministic RMSE identity order --- docs/product-technical-gap-baseline.md | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index c8d4dd878..700093f32 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,7 +4,7 @@ **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-03T11:09Z +**Snapshot:** 2026-09-03T12:08Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` @@ -43,7 +43,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | #460 | `dfab4eab5ff733731e565a9348072b8dab2e4912` | true | #416 | Analysis Run fold child; typed cutoff equality and terminal-validation separation. | | #458 | `08165e3b3c929b4ae77396689549f72723ff8ff5` | true | #416 | Analysis Run fold child; typed cutoff equality and terminal-validation separation. | | #416 | `0b7155cc238defb1e55129ff3000658f04b343cf` | true | `main` | Validation / Analysis Run landing vehicle; availability cutoff precedes duplicate-identity admission. | -| #310 | `be0f21e9826bf18f8e4bd67e319495fc4b1be4d9` | true | `main` | Longitudinal Modeling vehicle; known-truth RMSE now refuses duplicate component identities that would silently reweight its recovery denominator. Exact-head verification remains non-passing until current gates and review complete. | +| #310 | `464df01e9268f13ba8e135f72d0fb62beead3e04` | true | `main` | Longitudinal Modeling vehicle; known-truth RMSE now aligns and accumulates by canonical component identity so serialization order cannot change admission or deterministic CPU `f64` recovery. Exact-head verification remains non-passing until current gates and review complete. | Exact-head evidence becomes stale after any source push. @@ -64,6 +64,7 @@ The clock contract separates event/valid time, assertion time, document time, sy - A nominal unit identifier is not repeated-measures evidence; singleton units cannot satisfy a longitudinal multilevel floor. - Occasion-mean deviations `p_it = x_it - μ_t` are not CWC residuals, sample-wide grand-mean residuals, or RI-CLPM within-person effects. Numeric event time defines occasion identity, so `-0.0` and `+0.0` are one occasion. - Row arrival order is not scientific evidence. Fixed admitted observations must produce bit-identical means/centered results under permutation wherever the contract claims deterministic f64 reference behavior. +- Known-truth component recovery aligns truth and recovered values by unique `(unit, occasion, level)` identity and accumulates in canonical identity order. A permutation of either slice must preserve the same deterministic CPU `f64` result. - A representable final scientific estimand is not rejected solely because an avoidable intermediate binary64 operation overflows/underflows. False exact 0/1/non-finite endpoints remain fail-closed when the mathematical estimand is interior/nonzero. - A mathematically nonzero scientific error metric must not be promoted to exact perfect recovery merely because its final binary64 representation underflows to zero. - Known-truth recovery denominators are defined by unique scientific component identity. Duplicate `(unit, occasion, level)` rows are not implicit weights and must fail closed unless a separately named weighted contract explicitly owns the weighting rule. @@ -91,9 +92,13 @@ The CWC/occasion/decomposition/irregular-rate mean lineage remains one Longitudi Individual-rate review also found a quotient-rounding defect. For the represented value immediately below `2.0` followed by `2.0`, the previous finite-ratio-first path rounded `later / earlier` before `ln`, making the recovered log-rate almost twice the correctly rounded logarithm of the represented endpoint ratio. Public RED `766ddc7a3d95102450d663f06d2c577306964d79` fixes the adjacent-float power-of-two fixture. Causal repair `16f21d9a223fb34d52f24d148c7cad9b385e1d91` uses exact represented differences plus `ln_1p` within the factor-two neighborhood and preserves direct-ratio/log-domain fallbacks for extreme scales. -Known-truth component RMSE has two separate fail-closed repairs. First, for minimum positive subnormal ULP `u`, five identity-matched component rows with one residual `u` and four exact-zero residuals have mathematical RMSE `u / sqrt(5) > 0`, but the final binary64 product rounds to exact zero. RED `496583c6b62cbe0ad1be0e65b51f01d7f72acd5a` drives the public API; causal repair `a82b383b5940126a0139180d66729d2e6aa4baf7` preserves exact perfect recovery only on the pre-existing `scale == 0` path and rejects a later rounded zero after nonzero residual scale. +Known-truth component RMSE now has four linked identity/numerical boundaries. First, for minimum positive subnormal ULP `u`, five identity-matched component rows with one residual `u` and four exact-zero residuals have mathematical RMSE `u / sqrt(5) > 0`, but the final binary64 product rounds to exact zero. RED `496583c6b62cbe0ad1be0e65b51f01d7f72acd5a` drives the public API; causal repair `a82b383b5940126a0139180d66729d2e6aa4baf7` preserves exact perfect recovery only on the pre-existing `scale == 0` path and rejects a later rounded zero after nonzero residual scale. -Second, fresh recovery-denominator review found that pairwise identity equality did not make the identity set unique. Repeating an already-matched component silently changed `n` in the RMSE denominator and therefore acted as an undocumented weight. Public RED `698f12f5b2f7a3c194e9d1d3f00c5aeaf10591f8` duplicates the same zero-error `(unit, occasion, between)` target while another unique target has nonzero error and requires fail-closed admission. Causal repair `2fae4cb2e7df2845270bd27192000ca370fb05ad` records unique `(unit, occasion, level)` identities before residual accumulation. Research trace `04e9b52d36812a202fe4717e92593221f7bdeb55` defines the performance-unit/denominator invariant, and `be0f21e9826bf18f8e4bd67e319495fc4b1be4d9` adds the release fragment. Existing overflow-safe accumulation, identity alignment, finite-input checks, exact-zero perfect recovery, and nonzero-underflow refusal remain intact. +Second, repeating an already-matched component silently changed `n` in the RMSE denominator and therefore acted as an undocumented weight. Public RED `698f12f5b2f7a3c194e9d1d3f00c5aeaf10591f8` requires duplicate scientific identity to fail closed; uniqueness repair `2fae4cb2e7df2845270bd27192000ca370fb05ad` prevents duplicate denominator weighting. + +Third, the predecessor still used pairwise slice position to align truth and recovered values. Public RED `8ad72ac91cbddd5ce6432fc70630bad6ce7072ce` permutes recovered rows while preserving the same unique identity-value pairs and requires the same perfect-recovery result. Initial identity-alignment repair `2dd9537e04dd2048559ba707fecd2404db5a2a31` indexes recovered values by `(unit, occasion, level)` rather than serialization position. + +Fourth, that initial repair still accumulated residuals in caller-provided truth order. Because scaled binary64 sum-of-squares addition is not associative, the same scientific identity-value set could differ by one last-bit RMSE under a truth-row permutation. RED `5fb93c40eddbd9e7920196ef09594457b8ac72d3` fixes a residual set containing `1`, `1e-100`, `3`, and the representable value immediately below `1`. Causal repair `025dce7fd98cfb4f94ea790cacd555b744095377` admits both slices into unique identity maps, sorts the scientific identity tuple, and accumulates only in canonical order. Edge coverage `976ce7d710125717ff2f8daeb943d54278c4acde` separately exercises truth-side duplication while recovered identities remain unique. Research trace `1106c005060c667e892f62ae8763e6b0cc478f0a` records the full denominator/alignment/deterministic-order lineage, and current release fragment/head `464df01e9268f13ba8e135f72d0fb62beead3e04` records the buyer-visible recovery correction. Overflow-safe accumulation, finite-input checks, exact-zero perfect recovery, and nonzero-underflow refusal remain intact. Exact-binary association review found two endpoint defects in opposite directions. First, with earlier variance `f64::from_bits(4_607_182_418_800_016_408)`, later variance `f64::from_bits(4_607_182_418_800_016_427)`, and covariance magnitude `f64::from_bits(4_607_182_418_800_016_417)`, exact `Cov²` is strictly below the exact product of the two represented marginal variances, yet rounded square roots/divisions produce exact `±1.0`. RED `683b28eeeda3ad72ac11f5317c5aea54f34e0692` fixes both signs through the public `recover_event_time_lagged_correlation` API. Causal repair `9eeb373df2cd333fe7543df2197ea0cc0c492780` extends the exact integer-significand/power-of-two covariance comparison to distinguish strict interior from exact boundary and rejects rounded `±1` for strict-interior inputs. @@ -103,7 +108,7 @@ A third endpoint identity defect existed at exact zero. A supplied `-0.0` lagged Fresh decomposition review found the same semantic class at a different public estimand. A `-0.0` score minus a canonical `+0.0` unit mean can produce a bit-distinct `-0.0` within residual even though exact zero deviation has no direction. RED `aeb008a38bc333ba0f1bec0651739e361426e66d` drives public `decompose_within_between`; causal repair `a9a70baa5c2a40ec8bf3fc77748bc3a5eaf92cd8` canonicalizes only validated exact-zero within residuals at `decompose.rs`, and research trace `ecb909143145b2021a89827cb071315f99c03fb5` records the API/test/module/IEEE-754 boundary in `docs/research/longitudinal-within-between.md`. -At exact #310 head `be0f21e9826bf18f8e4bd67e319495fc4b1be4d9`, predecessor workflow/review evidence is stale by definition. Current-head Rust/documentation/security/coverage workflows and a qualifying independent current-head `APPROVED` submission are required before Ready/merge. Queued, pending, startup-failed, skipped, or predecessor-head evidence is not GREEN. +At exact #310 head `464df01e9268f13ba8e135f72d0fb62beead3e04`, predecessor workflow/review evidence is stale by definition. Current-head Rust/documentation/security/coverage workflows and a qualifying independent current-head `APPROVED` submission are required before Ready/merge. Queued, pending, startup-failed, skipped, or predecessor-head evidence is not GREEN. #486 is closed as a verified-successor consolidation, not a PR-count-only close. No child-head CI/review evidence transfers to #310. @@ -173,7 +178,8 @@ Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/num | GAP-040 | Exact zero within-person deviation could leak IEEE `-0.0` through public within/between decomposition and create two bit-distinct identities for one no-deviation estimand | `verification-pending` | RED `aeb008a3...` + causal repair `a9a70baa...` + research trace `ecb90914...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-041 | Individually representable irregular residual log-rates could have a mathematically nonzero one-sign mean that underflowed to exact zero and falsely reported no temporal change | `verification-pending` | RED `96f1c334...` + causal repair `ae5081d8...` + research trace `0280aba0...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-042 | Ratio-first logarithm could nearly double an adjacent-float power-of-two irregular residual growth rate before event-time scaling | `verification-pending` | public RED `766ddc7a...` + causal `ln_1p` repair `16f21d9a...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-043 | Duplicate known-truth component identities could silently reweight RMSE recovery evidence by changing the denominator without adding a new scientific target | `verification-pending` | public RED `698f12f5...` + causal uniqueness repair `2fae4cb2...` + research trace `04e9b52d...` + release fragment/current #310 `be0f21e9...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-043 | Duplicate known-truth component identities could silently reweight RMSE recovery evidence by changing the denominator without adding a new scientific target | `verification-pending` | public RED `698f12f5...` + causal uniqueness repair `2fae4cb2...` + research trace `1106c005...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-044 | Known-truth component RMSE alignment and deterministic binary64 accumulation depended on serialization row order rather than scientific component identity | `verification-pending` | cross-slice RED `8ad72ac9...` + identity-alignment repair `2dd9537e...` + truth-order rounding RED `5fb93c40...` + canonical-order repair `025dce7f...` + edge coverage `976ce7d7...` + research trace/current #310 `1106c005...` / `464df01e...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | ## Release gate From 86276708ae92d46fee646841f06b718871bde6c6 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 3 Sep 2026 22:10:22 +0900 Subject: [PATCH 132/235] docs(gap): add Validation Evidence bias overflow repair --- docs/product-technical-gap-baseline.md | 23 +++++++++++++++++------ 1 file changed, 17 insertions(+), 6 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 700093f32..62bcf5320 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,7 +4,7 @@ **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-03T12:08Z +**Snapshot:** 2026-09-03T13:08Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` @@ -19,8 +19,8 @@ A planning document, mergeable branch, local/source inspection, predecessor-head | Signal | Fresh evidence | Implication | | --- | ---: | --- | | Protected `main` | `1bc02f580cf48e1d39da239f0e818453437c31c3` | Capability claims remain bounded to this commit until main advances. | -| Open pull requests | **133** | WIP circuit breaker remains active; consolidate into existing bounded-context vehicles. | -| Draft pull requests | **133** | Every current open PR is Draft. | +| Open pull requests | **134** | WIP circuit breaker remains active; consolidate into existing bounded-context vehicles. | +| Draft pull requests | **134** | Every current open PR is Draft. | | Non-Draft pull requests | **0** | No PR is eligible for normal merge until it is deliberately made Ready after exact-head evidence. | | Open issues | **16** | ADR normalization, orchestration admission, evaluation drift, and scientific recovery remain open. | | GitHub releases | **0** | No TEPP open head is a released contract. | @@ -34,6 +34,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | +| #488 | `859e66b4ab5e61613d9c62f51d1e27430475616a` | true | `main` | Validation Evidence numerical repair. RED `c5ec42e4...` proves raw residual summation can reject a representable `f64::MAX` mean bias; repair `7499042f...` uses scale-normalized deterministic compensated mean, `e379d164...` reinforces zero/underflow/variance-overflow branches, and `311bef6e...` doctors the current scientific/IEEE trace. Exact-head hosted gates and independent review remain required. | | #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 `feat/copy-identity-analysis-run-gap-004` | Validation / Analysis Run fold child. Sparse observed relation classes are valid evidence; RED `a2892b6...`, repair `a6402015...`, predecessor-test correction `6b0c8de6...`; ADR 0079 is repaired to `Proposed` at `e07b2ff...`. No child-head CI transfers to #416. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | @@ -42,7 +43,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | #480 | `01f45a99392457334a4f6d3d659f992af739eeee` | true | `main` | contextual-orchestrator consumer repair; stays Draft while immutable CO release/deployment/auth provenance is unavailable. | | #460 | `dfab4eab5ff733731e565a9348072b8dab2e4912` | true | #416 | Analysis Run fold child; typed cutoff equality and terminal-validation separation. | | #458 | `08165e3b3c929b4ae77396689549f72723ff8ff5` | true | #416 | Analysis Run fold child; typed cutoff equality and terminal-validation separation. | -| #416 | `0b7155cc238defb1e55129ff3000658f04b343cf` | true | `main` | Validation / Analysis Run landing vehicle; availability cutoff precedes duplicate-identity admission. | +| #416 | `aa730c63563eb4a33048d822b581036c8487bd47` | true | `main` | Validation / Analysis Run landing vehicle. Generic cutoff-before-identity repair remains in ancestry; six current-head follow-up commits canonicalize episode/cutoff fixtures and harden bounded artifact/profile tests. | | #310 | `464df01e9268f13ba8e135f72d0fb62beead3e04` | true | `main` | Longitudinal Modeling vehicle; known-truth RMSE now aligns and accumulates by canonical component identity so serialization order cannot change admission or deterministic CPU `f64` recovery. Exact-head verification remains non-passing until current gates and review complete. | Exact-head evidence becomes stale after any source push. @@ -66,6 +67,7 @@ The clock contract separates event/valid time, assertion time, document time, sy - Row arrival order is not scientific evidence. Fixed admitted observations must produce bit-identical means/centered results under permutation wherever the contract claims deterministic f64 reference behavior. - Known-truth component recovery aligns truth and recovered values by unique `(unit, occasion, level)` identity and accumulates in canonical identity order. A permutation of either slice must preserve the same deterministic CPU `f64` result. - A representable final scientific estimand is not rejected solely because an avoidable intermediate binary64 operation overflows/underflows. False exact 0/1/non-finite endpoints remain fail-closed when the mathematical estimand is interior/nonzero. +- Mean signed bias is a Validation Evidence performance measure over admitted recovery units. A representable bias must not fail solely because a raw residual sum overflows; exact cancellation remains zero, while a mathematically nonzero bias below binary64 range fails closed rather than becoming false zero. - A mathematically nonzero scientific error metric must not be promoted to exact perfect recovery merely because its final binary64 representation underflows to zero. - Known-truth recovery denominators are defined by unique scientific component identity. Duplicate `(unit, occasion, level)` rows are not implicit weights and must fail closed unless a separately named weighted contract explicitly owns the weighting rule. - A mathematically nonzero one-sign temporal-rate mean must not be promoted to exact no-change merely because its final binary64 representation underflows to zero. All-zero inputs and exact mixed-sign cancellation remain exact zero. @@ -112,9 +114,17 @@ At exact #310 head `464df01e9268f13ba8e135f72d0fb62beead3e04`, predecessor workf #486 is closed as a verified-successor consolidation, not a PR-count-only close. No child-head CI/review evidence transfers to #310. +### #488 — Validation Evidence bias arithmetic + +Protected-main `validation_core::mean_bias` defines bias correctly as `mean(recovered − truth)` but implemented the mean as a raw residual sum followed by division. Two finite `f64::MAX` residuals therefore overflowed the intermediate sum even though the final mean bias is representable as `f64::MAX`; `bias_standard_error` inherited the same failure and rejected a constant extreme bias whose sampling variance is exactly zero. + +Public RED `c5ec42e40307f3645c18b0d73114b73e01745a20` fixes that recovery contract. Causal repair `7499042f7451b2e3d5e9f83843aeea82c4f5ff06` validates each signed residual, normalizes by the maximum magnitude, sums normalized residuals deterministically with compensated arithmetic, divides by the recovery count, and restores scale once. Exact cancellation remains canonical zero; a represented nonzero normalized mean that becomes zero only at final scale-back fails closed. Coverage reinforcement `e379d164c66abb2efa8918422b4e6cf7fe8e0cf0` exercises all-zero, exact cancellation, nonzero subnormal underflow, and finite-square variance-sum overflow. Research trace `311bef6eb1d5d063a195f079597bfc09a31289ed` and release fragment/current head `859e66b4ab5e61613d9c62f51d1e27430475616a` keep method and buyer-visible evidence attached to the source. + +This belongs to TEPP Validation Evidence because it repairs the generic recovery metric already owned by `validation_core`. It does not move Longitudinal composition or create a second psychometric estimator authority. The remaining sample-variance squared-deviation representability and generic RMSE numerical limitations are separate future findings. + ### #416 — Validation / Analysis Run consolidation -#416 `0b7155cc...` centralizes the leakage-safe invariant that availability filtering occurs before duplicate-identity admission. #458/#460/#482/#483/#484/#485/#487 are current fold children over shared Cargo/lib/lock/docs surfaces. Their unique evidence must reach a surviving #416 exact head before any child can be considered fully superseded. +#416 exact head is `aa730c63563eb4a33048d822b581036c8487bd47`. The generic cutoff-before-identity repair `0b7155cc...` remains in its ancestry; six newer commits canonicalize episode/cutoff fixtures and harden bounded artifact/profile tests without transferring child-head CI. #458/#460/#482/#483/#484/#485/#487 remain current fold children over shared Cargo/lib/lock/docs surfaces. Their unique evidence must reach a surviving #416 exact head before any child can be considered fully superseded. #487 exposed a scientific acceptance bug: the first implementation required all four Allen support classes and at least four assignments merely because the test fixture exercised those branches. RED `a2892b6...` requires covered-only and contradiction-only historical censuses to succeed with truthful zero counts. Repair `a6402015...` keeps only real invariants: nonempty admitted evidence, size bound, exact class sums, refusal-plus-covered conservation, cutoff-safe admission, digest/schema validation, and claim boundary. `6b0c8de6...` removes predecessor tests that encoded the rejected fixture-as-production rule. Fresh docs-to-code repair `e07b2ff9...` makes branch-local ADR 0079 `Proposed` under the existing canonical ADR lineage and removes the contradictory mixed-four-class prerequisite. The child remains conflicted beneath #416 and does not transfer child-head evidence to #416. @@ -136,7 +146,7 @@ Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/num | ID | Gap | Maturity | Closure evidence | | --- | --- | --- | --- | -| GAP-001 | PR authority fragmented across 133 open PRs | `release-blocking` | coherent landing vehicles, unique-evidence preservation, protected-main reduction | +| GAP-001 | PR authority fragmented across 134 open PRs | `release-blocking` | coherent landing vehicles, unique-evidence preservation, protected-main reduction | | GAP-002 | multilingual span-grounded semantic/concept admission | `partial` | immutable offsets/layout, KO/EN/JA/ZH/VI/ES/DE/FR profiles, concept dictionary, invariance/calibration, hostile-input tests | | GAP-003 | shared-latent temporal topic estimator | `partial` | Rust CPU f64 likelihood/uncertainty, relation/time/membership effects, true recovery, fitted candidate-K | | GAP-004 | durable end-to-end Analysis Run | `partial` | idempotent lifecycle, persistence/recovery, estimator-bound artifacts, validation/promotion separation, Compose E2E | @@ -180,6 +190,7 @@ Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/num | GAP-042 | Ratio-first logarithm could nearly double an adjacent-float power-of-two irregular residual growth rate before event-time scaling | `verification-pending` | public RED `766ddc7a...` + causal `ln_1p` repair `16f21d9a...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-043 | Duplicate known-truth component identities could silently reweight RMSE recovery evidence by changing the denominator without adding a new scientific target | `verification-pending` | public RED `698f12f5...` + causal uniqueness repair `2fae4cb2...` + research trace `1106c005...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-044 | Known-truth component RMSE alignment and deterministic binary64 accumulation depended on serialization row order rather than scientific component identity | `verification-pending` | cross-slice RED `8ad72ac9...` + identity-alignment repair `2dd9537e...` + truth-order rounding RED `5fb93c40...` + canonical-order repair `025dce7f...` + edge coverage `976ce7d7...` + research trace/current #310 `1106c005...` / `464df01e...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing, and constant extreme bias could therefore lose its exact-zero SE | `verification-pending` | public RED `c5ec42e4...` + scaled compensated-mean repair `7499042f...` + coverage reinforcement `e379d164...` + research trace `311bef6e...` + current #488 `859e66b4...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | ## Release gate From 45fa6d4876a3da30dfaa4cc62c83118142e039f6 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 3 Sep 2026 22:19:10 +0900 Subject: [PATCH 133/235] docs(gap): add bias standard-error overflow repair --- docs/product-technical-gap-baseline.md | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 62bcf5320..b495aac84 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,7 +4,7 @@ **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-03T13:08Z +**Snapshot:** 2026-09-03T13:18Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` @@ -34,7 +34,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `859e66b4ab5e61613d9c62f51d1e27430475616a` | true | `main` | Validation Evidence numerical repair. RED `c5ec42e4...` proves raw residual summation can reject a representable `f64::MAX` mean bias; repair `7499042f...` uses scale-normalized deterministic compensated mean, `e379d164...` reinforces zero/underflow/variance-overflow branches, and `311bef6e...` doctors the current scientific/IEEE trace. Exact-head hosted gates and independent review remain required. | +| #488 | `956c9c98931cb22a445f22ec674eb48d598c7d5c` | true | `main` | Validation Evidence numerical repair. Mean-bias RED `c5ec42e4...` / repair `7499042f...` removes avoidable raw residual-sum overflow; bias-SE RED `7de0ef90...` / repair `cad23162...` removes avoidable raw squared-deviation/variance overflow and supplies a scaled direct SEM path. Exact-head hosted gates and independent review remain required. | | #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 `feat/copy-identity-analysis-run-gap-004` | Validation / Analysis Run fold child. Sparse observed relation classes are valid evidence; RED `a2892b6...`, repair `a6402015...`, predecessor-test correction `6b0c8de6...`; ADR 0079 is repaired to `Proposed` at `e07b2ff...`. No child-head CI transfers to #416. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | @@ -68,6 +68,7 @@ The clock contract separates event/valid time, assertion time, document time, sy - Known-truth component recovery aligns truth and recovered values by unique `(unit, occasion, level)` identity and accumulates in canonical identity order. A permutation of either slice must preserve the same deterministic CPU `f64` result. - A representable final scientific estimand is not rejected solely because an avoidable intermediate binary64 operation overflows/underflows. False exact 0/1/non-finite endpoints remain fail-closed when the mathematical estimand is interior/nonzero. - Mean signed bias is a Validation Evidence performance measure over admitted recovery units. A representable bias must not fail solely because a raw residual sum overflows; exact cancellation remains zero, while a mathematically nonzero bias below binary64 range fails closed rather than becoming false zero. +- Bias standard error is formed from the same admitted signed differences. A representable SEM must not fail solely because raw squared deviations, their sum, or an intermediate sample variance overflows; scaling is applied before squaring and the SEM is formed directly. - A mathematically nonzero scientific error metric must not be promoted to exact perfect recovery merely because its final binary64 representation underflows to zero. - Known-truth recovery denominators are defined by unique scientific component identity. Duplicate `(unit, occasion, level)` rows are not implicit weights and must fail closed unless a separately named weighted contract explicitly owns the weighting rule. - A mathematically nonzero one-sign temporal-rate mean must not be promoted to exact no-change merely because its final binary64 representation underflows to zero. All-zero inputs and exact mixed-sign cancellation remain exact zero. @@ -116,11 +117,13 @@ At exact #310 head `464df01e9268f13ba8e135f72d0fb62beead3e04`, predecessor workf ### #488 — Validation Evidence bias arithmetic -Protected-main `validation_core::mean_bias` defines bias correctly as `mean(recovered − truth)` but implemented the mean as a raw residual sum followed by division. Two finite `f64::MAX` residuals therefore overflowed the intermediate sum even though the final mean bias is representable as `f64::MAX`; `bias_standard_error` inherited the same failure and rejected a constant extreme bias whose sampling variance is exactly zero. +Protected-main `validation_core::mean_bias` defines bias correctly as `mean(recovered − truth)` but implemented the mean as a raw residual sum followed by division. Two finite `f64::MAX` residuals therefore overflowed the intermediate sum even though the final mean bias is representable as `f64::MAX`; `bias_standard_error` inherited the same mean failure and rejected a constant extreme bias whose sampling variance is exactly zero. -Public RED `c5ec42e40307f3645c18b0d73114b73e01745a20` fixes that recovery contract. Causal repair `7499042f7451b2e3d5e9f83843aeea82c4f5ff06` validates each signed residual, normalizes by the maximum magnitude, sums normalized residuals deterministically with compensated arithmetic, divides by the recovery count, and restores scale once. Exact cancellation remains canonical zero; a represented nonzero normalized mean that becomes zero only at final scale-back fails closed. Coverage reinforcement `e379d164c66abb2efa8918422b4e6cf7fe8e0cf0` exercises all-zero, exact cancellation, nonzero subnormal underflow, and finite-square variance-sum overflow. Research trace `311bef6eb1d5d063a195f079597bfc09a31289ed` and release fragment/current head `859e66b4ab5e61613d9c62f51d1e27430475616a` keep method and buyer-visible evidence attached to the source. +Public RED `c5ec42e40307f3645c18b0d73114b73e01745a20` fixes that recovery contract. Causal repair `7499042f7451b2e3d5e9f83843aeea82c4f5ff06` validates each signed residual, normalizes by the maximum magnitude, sums normalized residuals deterministically with compensated arithmetic, divides by the recovery count, and restores scale once. Exact cancellation remains canonical zero; a represented nonzero normalized mean that becomes zero only at final scale-back fails closed. -This belongs to TEPP Validation Evidence because it repairs the generic recovery metric already owned by `validation_core`. It does not move Longitudinal composition or create a second psychometric estimator authority. The remaining sample-variance squared-deviation representability and generic RMSE numerical limitations are separate future findings. +Review of the repaired SE path exposed a second avoidable overflow. Public RED `7de0ef90944925ae7b232a8280f5bf9096df6502` uses `[1e154, -1e154, 0]`, whose raw squared-deviation sum overflows even though the final SEM is finite. Repair `cad231620679d8f912bded36c654446032b45e57` scales deviations before squaring and forms the SEM directly; if direct subtraction from the finite mean overflows it re-expresses the same deviations in a normalized scale. `8a6cc346...` and `28d96c23...` harden the public/unit oracle without requiring incidental last-bit equality. Research trace `1f22ef675d632b15378da982ace2182de3fdbab0` and release fragment/current head `956c9c98931cb22a445f22ec674eb48d598c7d5c` keep the complete scientific and buyer-visible lineage attached to the source. + +This belongs to TEPP Validation Evidence because it repairs the generic recovery metrics already owned by `validation_core`. It does not move Longitudinal composition or create a second psychometric estimator authority. Generic RMSE numerical limitations remain a separate future finding. ### #416 — Validation / Analysis Run consolidation @@ -190,7 +193,8 @@ Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/num | GAP-042 | Ratio-first logarithm could nearly double an adjacent-float power-of-two irregular residual growth rate before event-time scaling | `verification-pending` | public RED `766ddc7a...` + causal `ln_1p` repair `16f21d9a...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-043 | Duplicate known-truth component identities could silently reweight RMSE recovery evidence by changing the denominator without adding a new scientific target | `verification-pending` | public RED `698f12f5...` + causal uniqueness repair `2fae4cb2...` + research trace `1106c005...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-044 | Known-truth component RMSE alignment and deterministic binary64 accumulation depended on serialization row order rather than scientific component identity | `verification-pending` | cross-slice RED `8ad72ac9...` + identity-alignment repair `2dd9537e...` + truth-order rounding RED `5fb93c40...` + canonical-order repair `025dce7f...` + edge coverage `976ce7d7...` + research trace/current #310 `1106c005...` / `464df01e...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing, and constant extreme bias could therefore lose its exact-zero SE | `verification-pending` | public RED `c5ec42e4...` + scaled compensated-mean repair `7499042f...` + coverage reinforcement `e379d164...` + research trace `311bef6e...` + current #488 `859e66b4...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | public RED `c5ec42e4...` + scaled compensated-mean repair `7499042f...` + research trace `1f22ef67...` + current #488 `956c9c98...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-046 | Bias standard error could reject a representable SEM because raw squared deviations, their sum, or an intermediate sample variance overflowed | `verification-pending` | public RED `7de0ef90...` + scaled direct-SEM repair `cad23162...` + oracle/edge reinforcement `8a6cc346...` / `28d96c23...` + research trace/current #488 `1f22ef67...` / `956c9c98...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | ## Release gate From 41441ebe30c8198fed406fe5221b1a6c4ac7db97 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 3 Sep 2026 22:42:48 +0900 Subject: [PATCH 134/235] docs(gap): track validation RMSE representability --- docs/product-technical-gap-baseline.md | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index b495aac84..8169cdf37 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,7 +4,7 @@ **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-03T13:18Z +**Snapshot:** 2026-09-03T13:36Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` @@ -34,7 +34,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `956c9c98931cb22a445f22ec674eb48d598c7d5c` | true | `main` | Validation Evidence numerical repair. Mean-bias RED `c5ec42e4...` / repair `7499042f...` removes avoidable raw residual-sum overflow; bias-SE RED `7de0ef90...` / repair `cad23162...` removes avoidable raw squared-deviation/variance overflow and supplies a scaled direct SEM path. Exact-head hosted gates and independent review remain required. | +| #488 | `36e7b71f8c50c38fc7e34931be170bf8b73d2deb` | true | `main` | Validation Evidence numerical repair. Bias mean/SEM and generic RMSE/RMSE-SE now scale before avoidable overflow/underflow intermediates, preserve representable extreme/subnormal results, and fail closed on nonzero-to-false-zero endpoints. Shared deterministic scalar accumulation is private to `validation_core`; exact-head hosted gates and independent review remain required. | | #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 `feat/copy-identity-analysis-run-gap-004` | Validation / Analysis Run fold child. Sparse observed relation classes are valid evidence; RED `a2892b6...`, repair `a6402015...`, predecessor-test correction `6b0c8de6...`; ADR 0079 is repaired to `Proposed` at `e07b2ff...`. No child-head CI transfers to #416. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | @@ -69,6 +69,8 @@ The clock contract separates event/valid time, assertion time, document time, sy - A representable final scientific estimand is not rejected solely because an avoidable intermediate binary64 operation overflows/underflows. False exact 0/1/non-finite endpoints remain fail-closed when the mathematical estimand is interior/nonzero. - Mean signed bias is a Validation Evidence performance measure over admitted recovery units. A representable bias must not fail solely because a raw residual sum overflows; exact cancellation remains zero, while a mathematically nonzero bias below binary64 range fails closed rather than becoming false zero. - Bias standard error is formed from the same admitted signed differences. A representable SEM must not fail solely because raw squared deviations, their sum, or an intermediate sample variance overflows; scaling is applied before squaring and the SEM is formed directly. +- Generic Validation Evidence RMSE and its delta-method standard error normalize finite residual magnitudes before squaring. A representable extreme or minimum-subnormal RMSE must survive avoidable intermediate overflow/underflow, while a mathematically nonzero final RMSE or SE below the binary64 range fails closed rather than becoming false perfect recovery. +- Bias and RMSE may share a private deterministic scalar accumulator inside `validation_core`, but metric-specific normalization, denominator, uncertainty, and fail-closed semantics remain in their bounded modules; this support primitive is not a second psychometric estimator authority. - A mathematically nonzero scientific error metric must not be promoted to exact perfect recovery merely because its final binary64 representation underflows to zero. - Known-truth recovery denominators are defined by unique scientific component identity. Duplicate `(unit, occasion, level)` rows are not implicit weights and must fail closed unless a separately named weighted contract explicitly owns the weighting rule. - A mathematically nonzero one-sign temporal-rate mean must not be promoted to exact no-change merely because its final binary64 representation underflows to zero. All-zero inputs and exact mixed-sign cancellation remain exact zero. @@ -115,15 +117,19 @@ At exact #310 head `464df01e9268f13ba8e135f72d0fb62beead3e04`, predecessor workf #486 is closed as a verified-successor consolidation, not a PR-count-only close. No child-head CI/review evidence transfers to #310. -### #488 — Validation Evidence bias arithmetic +### #488 — Validation Evidence recovery arithmetic Protected-main `validation_core::mean_bias` defines bias correctly as `mean(recovered − truth)` but implemented the mean as a raw residual sum followed by division. Two finite `f64::MAX` residuals therefore overflowed the intermediate sum even though the final mean bias is representable as `f64::MAX`; `bias_standard_error` inherited the same mean failure and rejected a constant extreme bias whose sampling variance is exactly zero. Public RED `c5ec42e40307f3645c18b0d73114b73e01745a20` fixes that recovery contract. Causal repair `7499042f7451b2e3d5e9f83843aeea82c4f5ff06` validates each signed residual, normalizes by the maximum magnitude, sums normalized residuals deterministically with compensated arithmetic, divides by the recovery count, and restores scale once. Exact cancellation remains canonical zero; a represented nonzero normalized mean that becomes zero only at final scale-back fails closed. -Review of the repaired SE path exposed a second avoidable overflow. Public RED `7de0ef90944925ae7b232a8280f5bf9096df6502` uses `[1e154, -1e154, 0]`, whose raw squared-deviation sum overflows even though the final SEM is finite. Repair `cad231620679d8f912bded36c654446032b45e57` scales deviations before squaring and forms the SEM directly; if direct subtraction from the finite mean overflows it re-expresses the same deviations in a normalized scale. `8a6cc346...` and `28d96c23...` harden the public/unit oracle without requiring incidental last-bit equality. Research trace `1f22ef675d632b15378da982ace2182de3fdbab0` and release fragment/current head `956c9c98931cb22a445f22ec674eb48d598c7d5c` keep the complete scientific and buyer-visible lineage attached to the source. +Review of the repaired SE path exposed a second avoidable overflow. Public RED `7de0ef90944925ae7b232a8280f5bf9096df6502` uses `[1e154, -1e154, 0]`, whose raw squared-deviation sum overflows even though the final SEM is finite. Repair `cad231620679d8f912bded36c654446032b45e57` scales deviations before squaring and forms the SEM directly; if direct subtraction from the finite mean overflows it re-expresses the same deviations in a normalized scale. `8a6cc346...` and `28d96c23...` harden the public/unit oracle without requiring incidental last-bit equality. -This belongs to TEPP Validation Evidence because it repairs the generic recovery metrics already owned by `validation_core`. It does not move Longitudinal composition or create a second psychometric estimator authority. Generic RMSE numerical limitations remain a separate future finding. +Generic RMSE had the same class of avoidable intermediate at a different estimand. Protected main squared every finite absolute residual before normalization, so constant `f64::MAX` residuals were rejected even though their RMSE is exactly representable as `f64::MAX`; minimum-subnormal residuals could instead square to zero before the mean and falsely report perfect recovery. Public RED `dd41ff5323cbc6aa3f2da8a0fb6af540e38c582e` requires constant `f64::MAX` residuals to return RMSE `f64::MAX` and RMSE SE `0.0`. Boundary RED `f4e19991bfe7b83cdce767a7214193c9e53e0b2b` requires a single minimum-subnormal residual among two observations to retain the representable minimum-subnormal RMSE and a corresponding four-observation half-ULP result to fail closed rather than round to false zero. Repair `6b182107376b9b7dec66570d21a1ea6b002266f3` normalizes residuals before squaring, computes RMSE and squared-residual variation in the normalized domain, and restores residual scale only after the square root/delta-method ratio. + +Research trace `5e341eec1e150ca8bb670259de7b9f6eaeb61dd3` records the bias and RMSE numerical contracts and current IEEE/ISO floating-point authority. Release fragments keep bias and RMSE changes independently visible. Refactor lineage `856393c0...` → `cbf50501...` → `c4d1234b...` → current #488 `36e7b71f8c50c38fc7e34931be170bf8b73d2deb` removes duplicate compensated-sum helpers by keeping one private `validation_core::numeric` accumulator while leaving each metric's scale, denominator, uncertainty, and fail-closed policy with its own module. + +This belongs to TEPP Validation Evidence because it repairs generic recovery metrics already owned by `validation_core`. It does not move Longitudinal composition or create a second psychometric estimator authority, and no mutable fast-mlsirm source is copied or consumed. ### #416 — Validation / Analysis Run consolidation @@ -193,8 +199,9 @@ Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/num | GAP-042 | Ratio-first logarithm could nearly double an adjacent-float power-of-two irregular residual growth rate before event-time scaling | `verification-pending` | public RED `766ddc7a...` + causal `ln_1p` repair `16f21d9a...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-043 | Duplicate known-truth component identities could silently reweight RMSE recovery evidence by changing the denominator without adding a new scientific target | `verification-pending` | public RED `698f12f5...` + causal uniqueness repair `2fae4cb2...` + research trace `1106c005...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-044 | Known-truth component RMSE alignment and deterministic binary64 accumulation depended on serialization row order rather than scientific component identity | `verification-pending` | cross-slice RED `8ad72ac9...` + identity-alignment repair `2dd9537e...` + truth-order rounding RED `5fb93c40...` + canonical-order repair `025dce7f...` + edge coverage `976ce7d7...` + research trace/current #310 `1106c005...` / `464df01e...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | public RED `c5ec42e4...` + scaled compensated-mean repair `7499042f...` + research trace `1f22ef67...` + current #488 `956c9c98...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-046 | Bias standard error could reject a representable SEM because raw squared deviations, their sum, or an intermediate sample variance overflowed | `verification-pending` | public RED `7de0ef90...` + scaled direct-SEM repair `cad23162...` + oracle/edge reinforcement `8a6cc346...` / `28d96c23...` + research trace/current #488 `1f22ef67...` / `956c9c98...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | public RED `c5ec42e4...` + scaled compensated-mean repair `7499042f...` + research trace `5e341eec...` + current #488 `36e7b71f...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-046 | Bias standard error could reject a representable SEM because raw squared deviations, their sum, or an intermediate sample variance overflowed | `verification-pending` | public RED `7de0ef90...` + scaled direct-SEM repair `cad23162...` + oracle/edge reinforcement `8a6cc346...` / `28d96c23...` + research trace `5e341eec...` + current #488 `36e7b71f...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-047 | Generic Validation Evidence RMSE/RMSE-SE could reject representable extreme recovery or collapse a representable/nonzero subnormal error to false perfect recovery because residuals were squared before scale normalization | `verification-pending` | public extreme RED `dd41ff53...` + subnormal boundary RED `f4e19991...` + causal scaled RMSE/RMSE-SE repair `6b182107...` + shared-private-accumulator refactor/current #488 `36e7b71f...` + research trace `5e341eec...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | ## Release gate From 1fe2cac1fb263353d34a8c9705cbb0312fed39c1 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 3 Sep 2026 23:11:31 +0900 Subject: [PATCH 135/235] docs(gap): track cancellation-safe Validation bias --- docs/product-technical-gap-baseline.md | 25 ++++++++++++++----------- 1 file changed, 14 insertions(+), 11 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 8169cdf37..b07f2e5ab 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,7 +4,7 @@ **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-03T13:36Z +**Snapshot:** 2026-09-03T14:07Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` @@ -34,7 +34,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `36e7b71f8c50c38fc7e34931be170bf8b73d2deb` | true | `main` | Validation Evidence numerical repair. Bias mean/SEM and generic RMSE/RMSE-SE now scale before avoidable overflow/underflow intermediates, preserve representable extreme/subnormal results, and fail closed on nonzero-to-false-zero endpoints. Shared deterministic scalar accumulation is private to `validation_core`; exact-head hosted gates and independent review remain required. | +| #488 | `b5cef5eb72311f11b9d9ed16b2e2a1f9957370b7` | true | `main` | Validation Evidence numerical repair. Bias mean now cancels opposite-sign represented residuals before scale reduction so extreme cancellation cannot erase a representable subnormal bias; bias SEM and generic RMSE/RMSE-SE retain their overflow/subnormal repairs. Exact-head hosted gates and independent review remain required. | | #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 `feat/copy-identity-analysis-run-gap-004` | Validation / Analysis Run fold child. Sparse observed relation classes are valid evidence; RED `a2892b6...`, repair `a6402015...`, predecessor-test correction `6b0c8de6...`; ADR 0079 is repaired to `Proposed` at `e07b2ff...`. No child-head CI transfers to #416. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | @@ -67,10 +67,10 @@ The clock contract separates event/valid time, assertion time, document time, sy - Row arrival order is not scientific evidence. Fixed admitted observations must produce bit-identical means/centered results under permutation wherever the contract claims deterministic f64 reference behavior. - Known-truth component recovery aligns truth and recovered values by unique `(unit, occasion, level)` identity and accumulates in canonical identity order. A permutation of either slice must preserve the same deterministic CPU `f64` result. - A representable final scientific estimand is not rejected solely because an avoidable intermediate binary64 operation overflows/underflows. False exact 0/1/non-finite endpoints remain fail-closed when the mathematical estimand is interior/nonzero. -- Mean signed bias is a Validation Evidence performance measure over admitted recovery units. A representable bias must not fail solely because a raw residual sum overflows; exact cancellation remains zero, while a mathematically nonzero bias below binary64 range fails closed rather than becoming false zero. +- Mean signed bias is a Validation Evidence performance measure over admitted recovery units. Opposite-sign represented residuals cancel before scale reduction; a representable low-order bias must survive cancellation of unrelated extreme terms. Exact cancellation remains zero, while a mathematically nonzero bias below binary64 range fails closed rather than becoming false zero. - Bias standard error is formed from the same admitted signed differences. A representable SEM must not fail solely because raw squared deviations, their sum, or an intermediate sample variance overflows; scaling is applied before squaring and the SEM is formed directly. - Generic Validation Evidence RMSE and its delta-method standard error normalize finite residual magnitudes before squaring. A representable extreme or minimum-subnormal RMSE must survive avoidable intermediate overflow/underflow, while a mathematically nonzero final RMSE or SE below the binary64 range fails closed rather than becoming false perfect recovery. -- Bias and RMSE may share a private deterministic scalar accumulator inside `validation_core`, but metric-specific normalization, denominator, uncertainty, and fail-closed semantics remain in their bounded modules; this support primitive is not a second psychometric estimator authority. +- Bias and RMSE may share a private deterministic scalar accumulator inside `validation_core`, but metric-specific cancellation/normalization, denominator, uncertainty, and fail-closed semantics remain in their bounded modules; this support primitive is not a second psychometric estimator authority. - A mathematically nonzero scientific error metric must not be promoted to exact perfect recovery merely because its final binary64 representation underflows to zero. - Known-truth recovery denominators are defined by unique scientific component identity. Duplicate `(unit, occasion, level)` rows are not implicit weights and must fail closed unless a separately named weighted contract explicitly owns the weighting rule. - A mathematically nonzero one-sign temporal-rate mean must not be promoted to exact no-change merely because its final binary64 representation underflows to zero. All-zero inputs and exact mixed-sign cancellation remain exact zero. @@ -121,13 +121,15 @@ At exact #310 head `464df01e9268f13ba8e135f72d0fb62beead3e04`, predecessor workf Protected-main `validation_core::mean_bias` defines bias correctly as `mean(recovered − truth)` but implemented the mean as a raw residual sum followed by division. Two finite `f64::MAX` residuals therefore overflowed the intermediate sum even though the final mean bias is representable as `f64::MAX`; `bias_standard_error` inherited the same mean failure and rejected a constant extreme bias whose sampling variance is exactly zero. -Public RED `c5ec42e40307f3645c18b0d73114b73e01745a20` fixes that recovery contract. Causal repair `7499042f7451b2e3d5e9f83843aeea82c4f5ff06` validates each signed residual, normalizes by the maximum magnitude, sums normalized residuals deterministically with compensated arithmetic, divides by the recovery count, and restores scale once. Exact cancellation remains canonical zero; a represented nonzero normalized mean that becomes zero only at final scale-back fails closed. +Public RED `c5ec42e40307f3645c18b0d73114b73e01745a20` fixes that recovery contract. Initial repair `7499042f7451b2e3d5e9f83843aeea82c4f5ff06` normalizes before deterministic compensated summation, divides by the recovery count, and restores scale once. -Review of the repaired SE path exposed a second avoidable overflow. Public RED `7de0ef90944925ae7b232a8280f5bf9096df6502` uses `[1e154, -1e154, 0]`, whose raw squared-deviation sum overflows even though the final SEM is finite. Repair `cad231620679d8f912bded36c654446032b45e57` scales deviations before squaring and forms the SEM directly; if direct subtraction from the finite mean overflows it re-expresses the same deviations in a normalized scale. `8a6cc346...` and `28d96c23...` harden the public/unit oracle without requiring incidental last-bit equality. +Fresh review of that repair found a distinct mixed-sign false-zero boundary. Let `u = f64::from_bits(1)`. Residuals `[f64::MAX, 2u, 2u, -f64::MAX]` have exact sum `4u` and representable mean `u`, but max-magnitude normalization divided each `2u` into zero before the two extremes cancelled. Public RED `b60847500e9e7f3866f446302964627de009961c` drives the public `mean_bias` contract. Causal repair `227921d99676a420c94df402fc29153718ae8d2c` partitions residuals by sign and cancels opposing represented magnitudes before scale reduction, then exact-power-of-two normalizes the remaining one-sign mass while keeping the original recovery denominator. Hardening `77dcf38c9d356b0c72454b335944f5bdb2be52e3` adds the negative mirror, mixed-sign transport permutation, and full-range exact cancellation. This preserves representable low-order bias without reclassifying true cancellation or an unrepresentable one-sign mean. + +Review of the repaired SE path exposed a second avoidable overflow. Public RED `7de0ef90944925ae7b232a8280f5bf9096df6502` uses `[1e154, -1e154, 0]`, whose raw squared-deviation sum overflows even though the final SEM is finite. Repair `cad231620679d8f912bded36c654446032b45e57` scales deviations before squaring and forms the SEM directly; if direct subtraction from the finite mean overflows it re-expresses the same deviations in a normalized scale. `8a6cc346...` and `28d96c23...` harden the public/unit oracle without requiring incidental last-bit equality. The SE mean-centering step consumes the same cancellation-safe bias mean. Generic RMSE had the same class of avoidable intermediate at a different estimand. Protected main squared every finite absolute residual before normalization, so constant `f64::MAX` residuals were rejected even though their RMSE is exactly representable as `f64::MAX`; minimum-subnormal residuals could instead square to zero before the mean and falsely report perfect recovery. Public RED `dd41ff5323cbc6aa3f2da8a0fb6af540e38c582e` requires constant `f64::MAX` residuals to return RMSE `f64::MAX` and RMSE SE `0.0`. Boundary RED `f4e19991bfe7b83cdce767a7214193c9e53e0b2b` requires a single minimum-subnormal residual among two observations to retain the representable minimum-subnormal RMSE and a corresponding four-observation half-ULP result to fail closed rather than round to false zero. Repair `6b182107376b9b7dec66570d21a1ea6b002266f3` normalizes residuals before squaring, computes RMSE and squared-residual variation in the normalized domain, and restores residual scale only after the square root/delta-method ratio. -Research trace `5e341eec1e150ca8bb670259de7b9f6eaeb61dd3` records the bias and RMSE numerical contracts and current IEEE/ISO floating-point authority. Release fragments keep bias and RMSE changes independently visible. Refactor lineage `856393c0...` → `cbf50501...` → `c4d1234b...` → current #488 `36e7b71f8c50c38fc7e34931be170bf8b73d2deb` removes duplicate compensated-sum helpers by keeping one private `validation_core::numeric` accumulator while leaving each metric's scale, denominator, uncertainty, and fail-closed policy with its own module. +Research trace/current #488 `b5cef5eb72311f11b9d9ed16b2e2a1f9957370b7` records the bias cancellation and RMSE numerical contracts with current IEEE/ISO floating-point authority; bias release wording is current through `da0953d96a4cbfd328c2b03b7da8516417725357`. Refactor lineage `856393c0...` → `cbf50501...` → `c4d1234b...` → `36e7b71f...` keeps one private `validation_core::numeric` scalar accumulator while leaving bias cancellation/scale/denominator/uncertainty and RMSE-specific policy with their own modules. This belongs to TEPP Validation Evidence because it repairs generic recovery metrics already owned by `validation_core`. It does not move Longitudinal composition or create a second psychometric estimator authority, and no mutable fast-mlsirm source is copied or consumed. @@ -199,10 +201,11 @@ Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/num | GAP-042 | Ratio-first logarithm could nearly double an adjacent-float power-of-two irregular residual growth rate before event-time scaling | `verification-pending` | public RED `766ddc7a...` + causal `ln_1p` repair `16f21d9a...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-043 | Duplicate known-truth component identities could silently reweight RMSE recovery evidence by changing the denominator without adding a new scientific target | `verification-pending` | public RED `698f12f5...` + causal uniqueness repair `2fae4cb2...` + research trace `1106c005...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-044 | Known-truth component RMSE alignment and deterministic binary64 accumulation depended on serialization row order rather than scientific component identity | `verification-pending` | cross-slice RED `8ad72ac9...` + identity-alignment repair `2dd9537e...` + truth-order rounding RED `5fb93c40...` + canonical-order repair `025dce7f...` + edge coverage `976ce7d7...` + research trace/current #310 `1106c005...` / `464df01e...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | public RED `c5ec42e4...` + scaled compensated-mean repair `7499042f...` + research trace `5e341eec...` + current #488 `36e7b71f...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-046 | Bias standard error could reject a representable SEM because raw squared deviations, their sum, or an intermediate sample variance overflowed | `verification-pending` | public RED `7de0ef90...` + scaled direct-SEM repair `cad23162...` + oracle/edge reinforcement `8a6cc346...` / `28d96c23...` + research trace `5e341eec...` + current #488 `36e7b71f...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-047 | Generic Validation Evidence RMSE/RMSE-SE could reject representable extreme recovery or collapse a representable/nonzero subnormal error to false perfect recovery because residuals were squared before scale normalization | `verification-pending` | public extreme RED `dd41ff53...` + subnormal boundary RED `f4e19991...` + causal scaled RMSE/RMSE-SE repair `6b182107...` + shared-private-accumulator refactor/current #488 `36e7b71f...` + research trace `5e341eec...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | public RED `c5ec42e4...` + initial scaled compensated-mean repair `7499042f...` + current #488 `b5cef5eb...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-046 | Bias standard error could reject a representable SEM because raw squared deviations, their sum, or an intermediate sample variance overflowed | `verification-pending` | public RED `7de0ef90...` + scaled direct-SEM repair `cad23162...` + oracle/edge reinforcement `8a6cc346...` / `28d96c23...` + research/current #488 `b5cef5eb...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-047 | Generic Validation Evidence RMSE/RMSE-SE could reject representable extreme recovery or collapse a representable/nonzero subnormal error to false perfect recovery because residuals were squared before scale normalization | `verification-pending` | public extreme RED `dd41ff53...` + subnormal boundary RED `f4e19991...` + causal scaled RMSE/RMSE-SE repair `6b182107...` + shared-private-accumulator refactor `36e7b71f...` + research/current #488 `b5cef5eb...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-048 | Validation Evidence mean signed bias could erase a representable subnormal residual contribution by normalizing to an unrelated extreme magnitude before mixed-sign cancellation | `verification-pending` | public RED `b6084750...` + cancellation-first/power-of-two repair `227921d9...` + permutation/exact-cancellation hardening `77dcf38c...` + research/current #488 `b5cef5eb...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | ## Release gate -TEPP currently has no GitHub release. Release is permitted only after a coherent vertical reaches protected main with exact protected-head CI/security/recovery evidence, reproducible package + SBOM + provenance + rollback artifacts, current version/CHANGELOG, required migration/restore/load evidence, and released integration contracts where deployment depends on them. Queued/pending/startup-failed/skipped or predecessor-head evidence is not GREEN. \ No newline at end of file +TEPP currently has no GitHub release. Release is permitted only after a coherent vertical reaches protected main with exact protected-head CI/security/recovery evidence, reproducible package + SBOM + provenance + rollback artifacts, current version/CHANGELOG, required migration/restore/load evidence, and released integration contracts where deployment depends on them. Queued/pending/startup-failed/skipped or predecessor-head evidence is not GREEN. From 00063cd8ee14a45110afbf1d05a9aa892ecba864 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 4 Sep 2026 00:24:20 +0900 Subject: [PATCH 136/235] docs(ddd): record stable between recovery identity --- docs/product-technical-gap-baseline.md | 36 +++++++++++++++----------- 1 file changed, 21 insertions(+), 15 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index b07f2e5ab..94ca6cc40 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,7 +4,7 @@ **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-03T14:07Z +**Snapshot:** 2026-09-03T15:14Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` @@ -34,7 +34,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `b5cef5eb72311f11b9d9ed16b2e2a1f9957370b7` | true | `main` | Validation Evidence numerical repair. Bias mean now cancels opposite-sign represented residuals before scale reduction so extreme cancellation cannot erase a representable subnormal bias; bias SEM and generic RMSE/RMSE-SE retain their overflow/subnormal repairs. Exact-head hosted gates and independent review remain required. | +| #488 | `0cb415cfbe38a45dacac7b829905561e8a8acd68` | true | `main` | Validation Evidence numerical repair. Bias/RMSE and their uncertainty paths retain representable extreme/subnormal evidence; Monte Carlo mean/sample-SD/SE now avoid Welford product overflow and false-zero uncertainty. Exact-head hosted gates and independent review remain required. | | #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 `feat/copy-identity-analysis-run-gap-004` | Validation / Analysis Run fold child. Sparse observed relation classes are valid evidence; RED `a2892b6...`, repair `a6402015...`, predecessor-test correction `6b0c8de6...`; ADR 0079 is repaired to `Proposed` at `e07b2ff...`. No child-head CI transfers to #416. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | @@ -44,7 +44,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | #460 | `dfab4eab5ff733731e565a9348072b8dab2e4912` | true | #416 | Analysis Run fold child; typed cutoff equality and terminal-validation separation. | | #458 | `08165e3b3c929b4ae77396689549f72723ff8ff5` | true | #416 | Analysis Run fold child; typed cutoff equality and terminal-validation separation. | | #416 | `aa730c63563eb4a33048d822b581036c8487bd47` | true | `main` | Validation / Analysis Run landing vehicle. Generic cutoff-before-identity repair remains in ancestry; six current-head follow-up commits canonicalize episode/cutoff fixtures and harden bounded artifact/profile tests. | -| #310 | `464df01e9268f13ba8e135f72d0fb62beead3e04` | true | `main` | Longitudinal Modeling vehicle; known-truth RMSE now aligns and accumulates by canonical component identity so serialization order cannot change admission or deterministic CPU `f64` recovery. Exact-head verification remains non-passing until current gates and review complete. | +| #310 | `c6680450152b1e0a2c9abb553772d74a23923335` | true | `main` | Longitudinal Modeling vehicle. Stable `Between` recovery is unit-level with canonical occasion `0`; nonzero occasion aliases fail closed, while `Within` retains actual occasion identity. Exact-head verification remains non-passing until current gates and review complete. | Exact-head evidence becomes stale after any source push. @@ -65,14 +65,15 @@ The clock contract separates event/valid time, assertion time, document time, sy - A nominal unit identifier is not repeated-measures evidence; singleton units cannot satisfy a longitudinal multilevel floor. - Occasion-mean deviations `p_it = x_it - μ_t` are not CWC residuals, sample-wide grand-mean residuals, or RI-CLPM within-person effects. Numeric event time defines occasion identity, so `-0.0` and `+0.0` are one occasion. - Row arrival order is not scientific evidence. Fixed admitted observations must produce bit-identical means/centered results under permutation wherever the contract claims deterministic f64 reference behavior. -- Known-truth component recovery aligns truth and recovered values by unique `(unit, occasion, level)` identity and accumulates in canonical identity order. A permutation of either slice must preserve the same deterministic CPU `f64` result. +- Known-truth component recovery follows bounded-context identity: stable `Between` is unit-level and uses canonical `occasion_index = 0`; `Within` retains actual `(unit, occasion)` identity. Duplicate identities or stable-Between occasion aliases are not weights. Admitted identities accumulate in canonical order, so slice permutation preserves deterministic CPU `f64` recovery. - A representable final scientific estimand is not rejected solely because an avoidable intermediate binary64 operation overflows/underflows. False exact 0/1/non-finite endpoints remain fail-closed when the mathematical estimand is interior/nonzero. - Mean signed bias is a Validation Evidence performance measure over admitted recovery units. Opposite-sign represented residuals cancel before scale reduction; a representable low-order bias must survive cancellation of unrelated extreme terms. Exact cancellation remains zero, while a mathematically nonzero bias below binary64 range fails closed rather than becoming false zero. - Bias standard error is formed from the same admitted signed differences. A representable SEM must not fail solely because raw squared deviations, their sum, or an intermediate sample variance overflows; scaling is applied before squaring and the SEM is formed directly. - Generic Validation Evidence RMSE and its delta-method standard error normalize finite residual magnitudes before squaring. A representable extreme or minimum-subnormal RMSE must survive avoidable intermediate overflow/underflow, while a mathematically nonzero final RMSE or SE below the binary64 range fails closed rather than becoming false perfect recovery. +- Monte Carlo mean/sample-SD/SE preserve representable uncertainty across full-range and subnormal replication values. Avoidable raw-product/Welford overflow or final false-zero uncertainty is not accepted as scientific evidence. - Bias and RMSE may share a private deterministic scalar accumulator inside `validation_core`, but metric-specific cancellation/normalization, denominator, uncertainty, and fail-closed semantics remain in their bounded modules; this support primitive is not a second psychometric estimator authority. - A mathematically nonzero scientific error metric must not be promoted to exact perfect recovery merely because its final binary64 representation underflows to zero. -- Known-truth recovery denominators are defined by unique scientific component identity. Duplicate `(unit, occasion, level)` rows are not implicit weights and must fail closed unless a separately named weighted contract explicitly owns the weighting rule. +- Known-truth recovery denominators are defined by unique scientific component identity. Duplicate rows and stable-Between occasion aliases are not implicit weights and must fail closed unless a separately named weighted contract explicitly owns the weighting rule. - A mathematically nonzero one-sign temporal-rate mean must not be promoted to exact no-change merely because its final binary64 representation underflows to zero. All-zero inputs and exact mixed-sign cancellation remain exact zero. - A temporal log-rate over represented endpoint magnitudes must not be materially changed by avoidable ratio-first rounding. Nearby values use exact-difference/`ln_1p` evaluation before event-time division; extreme-scale fallbacks remain fail-closed or log-domain as appropriate. - A strict-interior exact binary64 covariance must not be promoted to exact `±1` correlation merely because rounded square roots/divisions reach the endpoint. Conversely, an exact represented Cauchy–Schwarz boundary must not be weakened to an interior coefficient merely because rounded square roots/divisions fall one ULP below `1`. @@ -97,13 +98,15 @@ The CWC/occasion/decomposition/irregular-rate mean lineage remains one Longitudi Individual-rate review also found a quotient-rounding defect. For the represented value immediately below `2.0` followed by `2.0`, the previous finite-ratio-first path rounded `later / earlier` before `ln`, making the recovered log-rate almost twice the correctly rounded logarithm of the represented endpoint ratio. Public RED `766ddc7a3d95102450d663f06d2c577306964d79` fixes the adjacent-float power-of-two fixture. Causal repair `16f21d9a223fb34d52f24d148c7cad9b385e1d91` uses exact represented differences plus `ln_1p` within the factor-two neighborhood and preserves direct-ratio/log-domain fallbacks for extreme scales. -Known-truth component RMSE now has four linked identity/numerical boundaries. First, for minimum positive subnormal ULP `u`, five identity-matched component rows with one residual `u` and four exact-zero residuals have mathematical RMSE `u / sqrt(5) > 0`, but the final binary64 product rounds to exact zero. RED `496583c6b62cbe0ad1be0e65b51f01d7f72acd5a` drives the public API; causal repair `a82b383b5940126a0139180d66729d2e6aa4baf7` preserves exact perfect recovery only on the pre-existing `scale == 0` path and rejects a later rounded zero after nonzero residual scale. +Known-truth component RMSE now has five linked identity/numerical boundaries. First, for minimum positive subnormal ULP `u`, five identity-matched component rows with one residual `u` and four exact-zero residuals have mathematical RMSE `u / sqrt(5) > 0`, but the final binary64 product rounds to exact zero. RED `496583c6b62cbe0ad1be0e65b51f01d7f72acd5a` drives the public API; causal repair `a82b383b5940126a0139180d66729d2e6aa4baf7` preserves exact perfect recovery only on the pre-existing `scale == 0` path and rejects a later rounded zero after nonzero residual scale. Second, repeating an already-matched component silently changed `n` in the RMSE denominator and therefore acted as an undocumented weight. Public RED `698f12f5b2f7a3c194e9d1d3f00c5aeaf10591f8` requires duplicate scientific identity to fail closed; uniqueness repair `2fae4cb2e7df2845270bd27192000ca370fb05ad` prevents duplicate denominator weighting. Third, the predecessor still used pairwise slice position to align truth and recovered values. Public RED `8ad72ac91cbddd5ce6432fc70630bad6ce7072ce` permutes recovered rows while preserving the same unique identity-value pairs and requires the same perfect-recovery result. Initial identity-alignment repair `2dd9537e04dd2048559ba707fecd2404db5a2a31` indexes recovered values by `(unit, occasion, level)` rather than serialization position. -Fourth, that initial repair still accumulated residuals in caller-provided truth order. Because scaled binary64 sum-of-squares addition is not associative, the same scientific identity-value set could differ by one last-bit RMSE under a truth-row permutation. RED `5fb93c40eddbd9e7920196ef09594457b8ac72d3` fixes a residual set containing `1`, `1e-100`, `3`, and the representable value immediately below `1`. Causal repair `025dce7fd98cfb4f94ea790cacd555b744095377` admits both slices into unique identity maps, sorts the scientific identity tuple, and accumulates only in canonical order. Edge coverage `976ce7d710125717ff2f8daeb943d54278c4acde` separately exercises truth-side duplication while recovered identities remain unique. Research trace `1106c005060c667e892f62ae8763e6b0cc478f0a` records the full denominator/alignment/deterministic-order lineage, and current release fragment/head `464df01e9268f13ba8e135f72d0fb62beead3e04` records the buyer-visible recovery correction. Overflow-safe accumulation, finite-input checks, exact-zero perfect recovery, and nonzero-underflow refusal remain intact. +Fourth, that initial repair still accumulated residuals in caller-provided truth order. Because scaled binary64 sum-of-squares addition is not associative, the same scientific identity-value set could differ by one last-bit RMSE under a truth-row permutation. RED `5fb93c40eddbd9e7920196ef09594457b8ac72d3` fixes a residual set containing `1`, `1e-100`, `3`, and the representable value immediately below `1`. Causal repair `025dce7fd98cfb4f94ea790cacd555b744095377` admits both slices into unique identity maps, sorts the scientific identity tuple, and accumulates only in canonical order. Edge coverage `976ce7d710125717ff2f8daeb943d54278c4acde` separately exercises truth-side duplication while recovered identities remain unique. + +Fifth, the generic tuple still treated `Between` as if it were occasion-specific. Decomposition emits one stable `Between` component per unit using canonical `occasion_index = 0`, but predecessor RMSE admission accepted the same stable unit component again under another occasion and let that alias change the denominator. Public RED `0a03041c5c1c2152fe90f86204edf2c957cebbfe` fixes this through `component_root_mean_square_error`; fixture repair `53563e975dd10e4f18218880cca2bb4cd79d0e73` removes the same invalid assumption from the older permutation regression; causal repair `ec2c1219127e834d89051415f1de8e1cb48507aa` validates stable-Between occasion `0` before either identity-map insertion while leaving `Within` occasion-specific. Research trace `c9cb68d30ea81bf15ec1326e74e94679f80287d5` records the full denominator/alignment/stable-level identity lineage, and current release fragment/head `c6680450152b1e0a2c9abb553772d74a23923335` records the buyer-visible correction. `occasion_index = 0` is TEPP's canonical carrier for a unit-level stable component, not a claim that the between-person construct occurs at substantive occasion zero. Exact-binary association review found two endpoint defects in opposite directions. First, with earlier variance `f64::from_bits(4_607_182_418_800_016_408)`, later variance `f64::from_bits(4_607_182_418_800_016_427)`, and covariance magnitude `f64::from_bits(4_607_182_418_800_016_417)`, exact `Cov²` is strictly below the exact product of the two represented marginal variances, yet rounded square roots/divisions produce exact `±1.0`. RED `683b28eeeda3ad72ac11f5317c5aea54f34e0692` fixes both signs through the public `recover_event_time_lagged_correlation` API. Causal repair `9eeb373df2cd333fe7543df2197ea0cc0c492780` extends the exact integer-significand/power-of-two covariance comparison to distinguish strict interior from exact boundary and rejects rounded `±1` for strict-interior inputs. @@ -113,7 +116,7 @@ A third endpoint identity defect existed at exact zero. A supplied `-0.0` lagged Fresh decomposition review found the same semantic class at a different public estimand. A `-0.0` score minus a canonical `+0.0` unit mean can produce a bit-distinct `-0.0` within residual even though exact zero deviation has no direction. RED `aeb008a38bc333ba0f1bec0651739e361426e66d` drives public `decompose_within_between`; causal repair `a9a70baa5c2a40ec8bf3fc77748bc3a5eaf92cd8` canonicalizes only validated exact-zero within residuals at `decompose.rs`, and research trace `ecb909143145b2021a89827cb071315f99c03fb5` records the API/test/module/IEEE-754 boundary in `docs/research/longitudinal-within-between.md`. -At exact #310 head `464df01e9268f13ba8e135f72d0fb62beead3e04`, predecessor workflow/review evidence is stale by definition. Current-head Rust/documentation/security/coverage workflows and a qualifying independent current-head `APPROVED` submission are required before Ready/merge. Queued, pending, startup-failed, skipped, or predecessor-head evidence is not GREEN. +At exact #310 head `c6680450152b1e0a2c9abb553772d74a23923335`, predecessor workflow/review evidence is stale by definition. Current-head Rust/documentation/security/coverage workflows and a qualifying independent current-head `APPROVED` submission are required before Ready/merge. Queued, pending, startup-failed, skipped, or predecessor-head evidence is not GREEN. #486 is closed as a verified-successor consolidation, not a PR-count-only close. No child-head CI/review evidence transfers to #310. @@ -129,7 +132,9 @@ Review of the repaired SE path exposed a second avoidable overflow. Public RED ` Generic RMSE had the same class of avoidable intermediate at a different estimand. Protected main squared every finite absolute residual before normalization, so constant `f64::MAX` residuals were rejected even though their RMSE is exactly representable as `f64::MAX`; minimum-subnormal residuals could instead square to zero before the mean and falsely report perfect recovery. Public RED `dd41ff5323cbc6aa3f2da8a0fb6af540e38c582e` requires constant `f64::MAX` residuals to return RMSE `f64::MAX` and RMSE SE `0.0`. Boundary RED `f4e19991bfe7b83cdce767a7214193c9e53e0b2b` requires a single minimum-subnormal residual among two observations to retain the representable minimum-subnormal RMSE and a corresponding four-observation half-ULP result to fail closed rather than round to false zero. Repair `6b182107376b9b7dec66570d21a1ea6b002266f3` normalizes residuals before squaring, computes RMSE and squared-residual variation in the normalized domain, and restores residual scale only after the square root/delta-method ratio. -Research trace/current #488 `b5cef5eb72311f11b9d9ed16b2e2a1f9957370b7` records the bias cancellation and RMSE numerical contracts with current IEEE/ISO floating-point authority; bias release wording is current through `da0953d96a4cbfd328c2b03b7da8516417725357`. Refactor lineage `856393c0...` → `cbf50501...` → `c4d1234b...` → `36e7b71f...` keeps one private `validation_core::numeric` scalar accumulator while leaving bias cancellation/scale/denominator/uncertainty and RMSE-specific policy with their own modules. +Monte Carlo summary had a related but distinct uncertainty failure. `summarize_replications` sorted the samples but still used Welford `delta * delta2`; `[f64::MAX, 0, 0, -f64::MAX]` therefore overflowed an intermediate even though the exact mean is `0`, sample SD is `f64::MAX * sqrt(2/3)`, and SE is representable. Conversely, nonzero subnormal simulation uncertainty could collapse to exact zero. Public RED `41faba0d184e9f0a3067f6df74c74f74798fa839`; causal repair `91b4a93d160efa68942fcb8a38fddab10fb97caf` uses the deterministic represented mean, scales deviations before squaring, restores sample-SD scale once, and fails closed if nonzero SD projects to exact-zero SE. + +Research trace `bd0343d924f6f54c3784bef4b5490de4b23e2bef` records the generic recovery and Monte Carlo numerical contracts with Morris, White, & Crowther (2019) and current IEEE/ISO floating-point authority. Bias release wording is current through `da0953d96a4cbfd328c2b03b7da8516417725357`; Monte Carlo release wording and current #488 head are `0cb415cfbe38a45dacac7b829905561e8a8acd68`. Private `validation_core::numeric` support remains deterministic scalar arithmetic; metric-specific cancellation/scale/denominator/uncertainty/refusal policy remains with each Validation Evidence metric module. This belongs to TEPP Validation Evidence because it repairs generic recovery metrics already owned by `validation_core`. It does not move Longitudinal composition or create a second psychometric estimator authority, and no mutable fast-mlsirm source is copied or consumed. @@ -199,12 +204,13 @@ Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/num | GAP-040 | Exact zero within-person deviation could leak IEEE `-0.0` through public within/between decomposition and create two bit-distinct identities for one no-deviation estimand | `verification-pending` | RED `aeb008a3...` + causal repair `a9a70baa...` + research trace `ecb90914...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-041 | Individually representable irregular residual log-rates could have a mathematically nonzero one-sign mean that underflowed to exact zero and falsely reported no temporal change | `verification-pending` | RED `96f1c334...` + causal repair `ae5081d8...` + research trace `0280aba0...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-042 | Ratio-first logarithm could nearly double an adjacent-float power-of-two irregular residual growth rate before event-time scaling | `verification-pending` | public RED `766ddc7a...` + causal `ln_1p` repair `16f21d9a...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-043 | Duplicate known-truth component identities could silently reweight RMSE recovery evidence by changing the denominator without adding a new scientific target | `verification-pending` | public RED `698f12f5...` + causal uniqueness repair `2fae4cb2...` + research trace `1106c005...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-044 | Known-truth component RMSE alignment and deterministic binary64 accumulation depended on serialization row order rather than scientific component identity | `verification-pending` | cross-slice RED `8ad72ac9...` + identity-alignment repair `2dd9537e...` + truth-order rounding RED `5fb93c40...` + canonical-order repair `025dce7f...` + edge coverage `976ce7d7...` + research trace/current #310 `1106c005...` / `464df01e...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | public RED `c5ec42e4...` + initial scaled compensated-mean repair `7499042f...` + current #488 `b5cef5eb...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-046 | Bias standard error could reject a representable SEM because raw squared deviations, their sum, or an intermediate sample variance overflowed | `verification-pending` | public RED `7de0ef90...` + scaled direct-SEM repair `cad23162...` + oracle/edge reinforcement `8a6cc346...` / `28d96c23...` + research/current #488 `b5cef5eb...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-047 | Generic Validation Evidence RMSE/RMSE-SE could reject representable extreme recovery or collapse a representable/nonzero subnormal error to false perfect recovery because residuals were squared before scale normalization | `verification-pending` | public extreme RED `dd41ff53...` + subnormal boundary RED `f4e19991...` + causal scaled RMSE/RMSE-SE repair `6b182107...` + shared-private-accumulator refactor `36e7b71f...` + research/current #488 `b5cef5eb...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-048 | Validation Evidence mean signed bias could erase a representable subnormal residual contribution by normalizing to an unrelated extreme magnitude before mixed-sign cancellation | `verification-pending` | public RED `b6084750...` + cancellation-first/power-of-two repair `227921d9...` + permutation/exact-cancellation hardening `77dcf38c...` + research/current #488 `b5cef5eb...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-043 | Duplicate known-truth component identities could silently reweight RMSE recovery evidence by changing the denominator without adding a new scientific target | `verification-pending` | public RED `698f12f5...` + causal uniqueness repair `2fae4cb2...` + current research trace `c9cb68d3...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-044 | Known-truth component RMSE alignment and deterministic binary64 accumulation depended on serialization row order rather than scientific component identity | `verification-pending` | cross-slice RED `8ad72ac9...` + identity-alignment repair `2dd9537e...` + truth-order rounding RED `5fb93c40...` + canonical-order repair `025dce7f...` + edge coverage `976ce7d7...` + current research trace/head `c9cb68d3...` / `c6680450...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | public RED `c5ec42e4...` + initial scaled compensated-mean repair `7499042f...` + current #488 `0cb415cf...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-046 | Bias standard error could reject a representable SEM because raw squared deviations, their sum, or an intermediate sample variance overflowed | `verification-pending` | public RED `7de0ef90...` + scaled direct-SEM repair `cad23162...` + oracle/edge reinforcement `8a6cc346...` / `28d96c23...` + research/current #488 `bd0343d9...` / `0cb415cf...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-047 | Generic Validation Evidence RMSE/RMSE-SE could reject representable extreme recovery or collapse a representable/nonzero subnormal error to false perfect recovery because residuals were squared before scale normalization | `verification-pending` | public extreme RED `dd41ff53...` + subnormal boundary RED `f4e19991...` + causal scaled RMSE/RMSE-SE repair `6b182107...` + research/current #488 `bd0343d9...` / `0cb415cf...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-048 | Validation Evidence mean signed bias could erase a representable subnormal residual contribution by normalizing to an unrelated extreme magnitude before mixed-sign cancellation | `verification-pending` | public RED `b6084750...` + cancellation-first/power-of-two repair `227921d9...` + permutation/exact-cancellation hardening `77dcf38c...` + research/current #488 `bd0343d9...` / `0cb415cf...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-049 | Stable `Between` recovery could be aliased across occasion indices, duplicating one unit-level scientific target and silently changing the RMSE denominator | `verification-pending` | public RED `0a03041c...` + owner-valid fixture repair `53563e97...` + causal admission repair `ec2c1219...` + research trace `c9cb68d3...` + current #310 `c6680450...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | ## Release gate From f2db580a20dd7befc194b640747c6184859d8c55 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 4 Sep 2026 00:42:43 +0900 Subject: [PATCH 137/235] docs(ddd): refresh Validation Evidence queue authority --- docs/product-technical-gap-baseline.md | 114 ++++++++++--------------- 1 file changed, 46 insertions(+), 68 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 94ca6cc40..5d0179bda 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,7 +4,7 @@ **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-03T15:14Z +**Snapshot:** 2026-09-03T15:36Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` @@ -34,8 +34,8 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `0cb415cfbe38a45dacac7b829905561e8a8acd68` | true | `main` | Validation Evidence numerical repair. Bias/RMSE and their uncertainty paths retain representable extreme/subnormal evidence; Monte Carlo mean/sample-SD/SE now avoid Welford product overflow and false-zero uncertainty. Exact-head hosted gates and independent review remain required. | -| #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 `feat/copy-identity-analysis-run-gap-004` | Validation / Analysis Run fold child. Sparse observed relation classes are valid evidence; RED `a2892b6...`, repair `a6402015...`, predecessor-test correction `6b0c8de6...`; ADR 0079 is repaired to `Proposed` at `e07b2ff...`. No child-head CI transfers to #416. | +| #488 | `7de6847149c1928e0232f095023f8446fc2d4e70` | true | `main` | Validation Evidence numerical repair. Bias/RMSE and their uncertainty paths retain representable extreme/subnormal evidence; Monte Carlo mean/sample-SD/SE avoid Welford product overflow and false-zero uncertainty; `k = 0` SE-aware acceptance is now exact-recovery before scale reduction. Exact-head hosted gates and independent review remain required. | +| #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 `feat/copy-identity-analysis-run-gap-004` | Validation / Analysis Run fold child. Sparse observed relation classes are valid evidence; RED `a2892b6...`, repair `a6402015...`, predecessor-test correction `6b0c8de6...`; ADR 0079 is `Proposed`. No child-head CI transfers to #416. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | | #483 | `847d96f913bb261803ac0bd751ad7e4f51324cee` | true | #416 | Analysis Run fold child; preserve unique evidence. | @@ -43,7 +43,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | #480 | `01f45a99392457334a4f6d3d659f992af739eeee` | true | `main` | contextual-orchestrator consumer repair; stays Draft while immutable CO release/deployment/auth provenance is unavailable. | | #460 | `dfab4eab5ff733731e565a9348072b8dab2e4912` | true | #416 | Analysis Run fold child; typed cutoff equality and terminal-validation separation. | | #458 | `08165e3b3c929b4ae77396689549f72723ff8ff5` | true | #416 | Analysis Run fold child; typed cutoff equality and terminal-validation separation. | -| #416 | `aa730c63563eb4a33048d822b581036c8487bd47` | true | `main` | Validation / Analysis Run landing vehicle. Generic cutoff-before-identity repair remains in ancestry; six current-head follow-up commits canonicalize episode/cutoff fixtures and harden bounded artifact/profile tests. | +| #416 | `aa730c63563eb4a33048d822b581036c8487bd47` | true | `main` | Validation / Analysis Run landing vehicle. Generic cutoff-before-identity repair remains in ancestry; current-head follow-ups canonicalize episode/cutoff fixtures and harden bounded artifact/profile tests. | | #310 | `c6680450152b1e0a2c9abb553772d74a23923335` | true | `main` | Longitudinal Modeling vehicle. Stable `Between` recovery is unit-level with canonical occasion `0`; nonzero occasion aliases fail closed, while `Within` retains actual occasion identity. Exact-head verification remains non-passing until current gates and review complete. | Exact-head evidence becomes stale after any source push. @@ -64,21 +64,22 @@ The clock contract separates event/valid time, assertion time, document time, sy - Cross-classification and multiple membership remain distinct; weights are explicit, auditable, time-valid, and normalized or model-estimated according to the formulation. - A nominal unit identifier is not repeated-measures evidence; singleton units cannot satisfy a longitudinal multilevel floor. - Occasion-mean deviations `p_it = x_it - μ_t` are not CWC residuals, sample-wide grand-mean residuals, or RI-CLPM within-person effects. Numeric event time defines occasion identity, so `-0.0` and `+0.0` are one occasion. -- Row arrival order is not scientific evidence. Fixed admitted observations must produce bit-identical means/centered results under permutation wherever the contract claims deterministic f64 reference behavior. -- Known-truth component recovery follows bounded-context identity: stable `Between` is unit-level and uses canonical `occasion_index = 0`; `Within` retains actual `(unit, occasion)` identity. Duplicate identities or stable-Between occasion aliases are not weights. Admitted identities accumulate in canonical order, so slice permutation preserves deterministic CPU `f64` recovery. +- Row arrival order is not scientific evidence. Fixed admitted observations must produce bit-identical means/centered results under permutation wherever the contract claims deterministic CPU `f64` reference behavior. +- Known-truth component recovery follows bounded-context identity: stable `Between` is unit-level and uses canonical `occasion_index = 0`; `Within` retains actual `(unit, occasion)` identity. Duplicate identities or stable-Between occasion aliases are not weights. Admitted identities accumulate in canonical order. - A representable final scientific estimand is not rejected solely because an avoidable intermediate binary64 operation overflows/underflows. False exact 0/1/non-finite endpoints remain fail-closed when the mathematical estimand is interior/nonzero. -- Mean signed bias is a Validation Evidence performance measure over admitted recovery units. Opposite-sign represented residuals cancel before scale reduction; a representable low-order bias must survive cancellation of unrelated extreme terms. Exact cancellation remains zero, while a mathematically nonzero bias below binary64 range fails closed rather than becoming false zero. -- Bias standard error is formed from the same admitted signed differences. A representable SEM must not fail solely because raw squared deviations, their sum, or an intermediate sample variance overflows; scaling is applied before squaring and the SEM is formed directly. -- Generic Validation Evidence RMSE and its delta-method standard error normalize finite residual magnitudes before squaring. A representable extreme or minimum-subnormal RMSE must survive avoidable intermediate overflow/underflow, while a mathematically nonzero final RMSE or SE below the binary64 range fails closed rather than becoming false perfect recovery. +- Mean signed bias is a Validation Evidence performance measure over admitted recovery units. Opposite-sign represented residuals cancel before scale reduction; a representable low-order bias must survive cancellation of unrelated extreme terms. Exact cancellation remains zero, while a mathematically nonzero bias below binary64 range fails closed. +- Bias standard error is formed from the same admitted signed differences. A representable SEM must not fail solely because raw squared deviations, their sum, or an intermediate sample variance overflows. +- Generic Validation Evidence RMSE and its delta-method standard error normalize finite residual magnitudes before squaring. A representable extreme or minimum-subnormal RMSE must survive avoidable intermediate overflow/underflow, while a mathematically nonzero final RMSE or SE below the binary64 range fails closed. - Monte Carlo mean/sample-SD/SE preserve representable uncertainty across full-range and subnormal replication values. Avoidable raw-product/Welford overflow or final false-zero uncertainty is not accepted as scientific evidence. -- Bias and RMSE may share a private deterministic scalar accumulator inside `validation_core`, but metric-specific cancellation/normalization, denominator, uncertainty, and fail-closed semantics remain in their bounded modules; this support primitive is not a second psychometric estimator authority. +- SE-aware acceptance is the declared rule `|estimate - target| <= k * SE`. For `k = 0`, the bound is exactly zero and exact recovery is evaluated before scale reduction; a large finite SE cannot erase a nonzero residual into acceptance. +- Bias, RMSE, and Monte Carlo may share private deterministic scalar support inside `validation_core`, but metric-specific cancellation/normalization, denominator, uncertainty, and fail-closed semantics remain with their bounded modules; support primitives are not second psychometric estimator authorities. - A mathematically nonzero scientific error metric must not be promoted to exact perfect recovery merely because its final binary64 representation underflows to zero. -- Known-truth recovery denominators are defined by unique scientific component identity. Duplicate rows and stable-Between occasion aliases are not implicit weights and must fail closed unless a separately named weighted contract explicitly owns the weighting rule. +- Known-truth recovery denominators are defined by unique scientific component identity. Duplicate rows and stable-Between occasion aliases are not implicit weights unless a separately named weighted contract explicitly owns weighting. - A mathematically nonzero one-sign temporal-rate mean must not be promoted to exact no-change merely because its final binary64 representation underflows to zero. All-zero inputs and exact mixed-sign cancellation remain exact zero. - A temporal log-rate over represented endpoint magnitudes must not be materially changed by avoidable ratio-first rounding. Nearby values use exact-difference/`ln_1p` evaluation before event-time division; extreme-scale fallbacks remain fail-closed or log-domain as appropriate. -- A strict-interior exact binary64 covariance must not be promoted to exact `±1` correlation merely because rounded square roots/divisions reach the endpoint. Conversely, an exact represented Cauchy–Schwarz boundary must not be weakened to an interior coefficient merely because rounded square roots/divisions fall one ULP below `1`. -- Exact zero covariance has one public no-association encoding. IEEE `-0.0` is not directional scientific evidence and is canonicalized to `+0.0` at the Temporal Association projection boundary after validation. -- Exact zero within-person deviation has one public decomposition encoding. IEEE `-0.0` does not denote negative within-person change and is canonicalized to `+0.0` only at the validated public residual projection boundary; private numerical intermediates may retain signed zero. +- A strict-interior exact binary64 covariance must not be promoted to exact `±1` correlation merely because rounded square roots/divisions reach the endpoint. Conversely, an exact represented Cauchy–Schwarz boundary must not be weakened to an interior coefficient by rounded standardization. +- Exact zero covariance has one public no-association encoding. IEEE `-0.0` is not directional scientific evidence and is canonicalized to `+0.0` at the validated Temporal Association projection boundary. +- Exact zero within-person deviation has one public decomposition encoding. IEEE `-0.0` does not denote negative within-person change and is canonicalized only at the validated public residual projection boundary; private numerical intermediates may retain signed zero. - Binary64 minimum-subnormal means follow IEEE ties-to-even at the public composition boundary. Overflow-safe normalization must not add an avoidable earlier rounding step, and mixed-sign cancellation must apply the original sample-count denominator before rounding a retained-only mean. - Observed Allen support classes are data, not required design strata. A historical prediction census may truthfully have zero covered, partial-overlap, adjacent, or contradictory rows; absent classes remain explicit zero counts rather than invalidating the run. - Historical-cutoff admission occurs before duplicate-identity checks. Future-unavailable evidence cannot change an earlier run's conflicts, counts, or terminal state. @@ -90,63 +91,39 @@ The clock contract separates event/valid time, assertion time, document time, sy ### #310 — Longitudinal Modeling -#310 remains the canonical Longitudinal Modeling landing vehicle. Its lineage covers lagged Pearson correlation with both marginal variances, stationary-variance materialization versus algebraically cancelled standardized maps, discrete-diffusion endpoint/subnormal representability, CWC atomistic admission, one irregular-rate authority, occasion-mean composition, known-truth recovery, within/between decomposition, and DDD relocation from `psychometric_core` to `longitudinal_core`. +#310 remains the canonical Longitudinal Modeling landing vehicle at `c6680450152b1e0a2c9abb553772d74a23923335`. It retains lagged Pearson association with both marginal variances, stationary/discrete drift-diffusion standardization, CWC, irregular-rate and occasion-mean composition, within/between decomposition, and known-truth component recovery under the owner-correct `longitudinal_core` boundary. -The #486 occasion-mean fold is owner-correct on #310: RED `75b0184d...`, owner repair `7fe9aaf2...`, export/test repairs `b900e213...` / `30771ff2...`, determinism RED `8a59019e...`, same-sign ordering repair `465d139d...`, same-panel/sparse successor regressions `b9e952bb...` / `aad56b50...`, ADR `04b3c26e...`, PRD `a221f494...`, research trace `27aa78ee...`, subnormal RED `9aff817f...`, source repair `40e057b8...`, and trace `a2e6ace7...`. Commit `db335d904ccc43dd0af7982c34df83008c968ef6` preserves the child's valid operational release delta in `CHANGELOG.d/longitudinal-occasion-mean-event-time.md` under the correct owner. Repository precedent verifies `CHANGELOG.d` as a valid non-destructive stacked-consolidation release-note carrier, and #486 was closed as a verified successor after all valid scientific/test/contract/docs/release-note deltas were checked on #310; invalid wrong-owner/weaker deltas were intentionally not copied. +The #486 occasion-mean fold is verified-successor consolidation: valid source/tests/contracts/research/release-note deltas are inherited by #310, including `CHANGELOG.d/longitudinal-occasion-mean-event-time.md`; wrong-owner temporal source, raw-bit signed-zero identity, naive averaging, and unsupported provenance were intentionally not inherited. No child-head CI/review evidence transfers. -The CWC/occasion/decomposition/irregular-rate mean lineage remains one Longitudinal-local authority. CWC RED `23476f45...` / repair `b14eb6e8...` closed the `[1 ULP, 2 ULP]` ties-to-even defect; `b073f03f...` / `350b8d4e...` changed arbitrary normalization to an exact power-of-two scale; `dd53eff6...` consolidated CWC and occasion means; mixed-sign RED `ae5e61f9...` / repair `39469067...` plus `201f3900...` and trace `34fd059a...` removed retained-mean double rounding; decomposition RED `7dc87aa8...` / repair `97c8ad35...` and trace `a1aef11e...` removed the remaining shadow running mean. Mean-level underflow RED `96f1c334...` proves that individually representable temporal rates can still have a mathematically nonzero aggregate mean below binary64's range; repair `ae5081d8...` rejects only that one-sign false-zero endpoint, while exact all-zero input and exact mixed-sign cancellation remain zero. +Longitudinal stable means share one deterministic, overflow-safe authority. RED/repair lineages `23476f45...`→`b14eb6e8...`, `b073f03f...`→`350b8d4e...`, `ae5e61f9...`→`39469067...`, `7dc87aa8...`→`97c8ad35...`, and `96f1c334...`→`ae5081d8...` cover ties-to-even, exact power-of-two normalization, mixed-sign cancellation, decomposition shadow-mean removal, and one-sign false-zero mean refusal. Adjacent-float log-rate RED `766ddc7a...` and repair `16f21d9a...` remove quotient-first rounding through represented difference/`ln_1p` evaluation. -Individual-rate review also found a quotient-rounding defect. For the represented value immediately below `2.0` followed by `2.0`, the previous finite-ratio-first path rounded `later / earlier` before `ln`, making the recovered log-rate almost twice the correctly rounded logarithm of the represented endpoint ratio. Public RED `766ddc7a3d95102450d663f06d2c577306964d79` fixes the adjacent-float power-of-two fixture. Causal repair `16f21d9a223fb34d52f24d148c7cad9b385e1d91` uses exact represented differences plus `ln_1p` within the factor-two neighborhood and preserves direct-ratio/log-domain fallbacks for extreme scales. +Known-truth component RMSE has bounded identity and numerical admission: nonzero error cannot underflow to false perfect recovery (`496583c6...`→`a82b383b...`); duplicate identities cannot reweight the denominator (`698f12f5...`→`2fae4cb2...`); truth/recovered rows align by identity rather than position (`8ad72ac9...`→`2dd9537e...`); residual accumulation is canonical-order deterministic (`5fb93c40...`→`025dce7f...`, edge `976ce7d7...`); and stable `Between` is unit-level with canonical occasion `0` (`0a03041c...`, fixture `53563e97...`, repair `ec2c1219...`, trace `c9cb68d3...`). -Known-truth component RMSE now has five linked identity/numerical boundaries. First, for minimum positive subnormal ULP `u`, five identity-matched component rows with one residual `u` and four exact-zero residuals have mathematical RMSE `u / sqrt(5) > 0`, but the final binary64 product rounds to exact zero. RED `496583c6b62cbe0ad1be0e65b51f01d7f72acd5a` drives the public API; causal repair `a82b383b5940126a0139180d66729d2e6aa4baf7` preserves exact perfect recovery only on the pre-existing `scale == 0` path and rejects a later rounded zero after nonzero residual scale. +Lagged-correlation endpoint contracts reject strict-interior covariance that rounds to false `±1` (`683b28ee...`→`9eeb373d...`), return exact `±1` for exact represented Cauchy–Schwarz boundaries (`c2500090...`→`d06259ec...`), and canonicalize validated exact-zero no-association to public `+0.0` (`e15d0531...`→`fc61f7bd...`). Exact-zero within residuals likewise canonicalize only at the public decomposition projection (`aeb008a3...`→`a9a70baa...`). -Second, repeating an already-matched component silently changed `n` in the RMSE denominator and therefore acted as an undocumented weight. Public RED `698f12f5b2f7a3c194e9d1d3f00c5aeaf10591f8` requires duplicate scientific identity to fail closed; uniqueness repair `2fae4cb2e7df2845270bd27192000ca370fb05ad` prevents duplicate denominator weighting. - -Third, the predecessor still used pairwise slice position to align truth and recovered values. Public RED `8ad72ac91cbddd5ce6432fc70630bad6ce7072ce` permutes recovered rows while preserving the same unique identity-value pairs and requires the same perfect-recovery result. Initial identity-alignment repair `2dd9537e04dd2048559ba707fecd2404db5a2a31` indexes recovered values by `(unit, occasion, level)` rather than serialization position. - -Fourth, that initial repair still accumulated residuals in caller-provided truth order. Because scaled binary64 sum-of-squares addition is not associative, the same scientific identity-value set could differ by one last-bit RMSE under a truth-row permutation. RED `5fb93c40eddbd9e7920196ef09594457b8ac72d3` fixes a residual set containing `1`, `1e-100`, `3`, and the representable value immediately below `1`. Causal repair `025dce7fd98cfb4f94ea790cacd555b744095377` admits both slices into unique identity maps, sorts the scientific identity tuple, and accumulates only in canonical order. Edge coverage `976ce7d710125717ff2f8daeb943d54278c4acde` separately exercises truth-side duplication while recovered identities remain unique. - -Fifth, the generic tuple still treated `Between` as if it were occasion-specific. Decomposition emits one stable `Between` component per unit using canonical `occasion_index = 0`, but predecessor RMSE admission accepted the same stable unit component again under another occasion and let that alias change the denominator. Public RED `0a03041c5c1c2152fe90f86204edf2c957cebbfe` fixes this through `component_root_mean_square_error`; fixture repair `53563e975dd10e4f18218880cca2bb4cd79d0e73` removes the same invalid assumption from the older permutation regression; causal repair `ec2c1219127e834d89051415f1de8e1cb48507aa` validates stable-Between occasion `0` before either identity-map insertion while leaving `Within` occasion-specific. Research trace `c9cb68d30ea81bf15ec1326e74e94679f80287d5` records the full denominator/alignment/stable-level identity lineage, and current release fragment/head `c6680450152b1e0a2c9abb553772d74a23923335` records the buyer-visible correction. `occasion_index = 0` is TEPP's canonical carrier for a unit-level stable component, not a claim that the between-person construct occurs at substantive occasion zero. - -Exact-binary association review found two endpoint defects in opposite directions. First, with earlier variance `f64::from_bits(4_607_182_418_800_016_408)`, later variance `f64::from_bits(4_607_182_418_800_016_427)`, and covariance magnitude `f64::from_bits(4_607_182_418_800_016_417)`, exact `Cov²` is strictly below the exact product of the two represented marginal variances, yet rounded square roots/divisions produce exact `±1.0`. RED `683b28eeeda3ad72ac11f5317c5aea54f34e0692` fixes both signs through the public `recover_event_time_lagged_correlation` API. Causal repair `9eeb373df2cd333fe7543df2197ea0cc0c492780` extends the exact integer-significand/power-of-two covariance comparison to distinguish strict interior from exact boundary and rejects rounded `±1` for strict-interior inputs. - -Second, exact-boundary inputs can round the other way. `Var_t = 2`, `Var_{t+Δ} = 8`, and `|Cov| = 4` satisfy exact represented `Cov² = Var_t Var_{t+Δ}`, but the predecessor square-root/division path returns `0x1.fffffffffffffp-1` for the positive coefficient. RED `c25000901eb429a43817552f8b76cf4aae04e522` fixes both signs; causal repair `d06259ec1e036558d8d2f775c266b2b9db4e42c4` returns the exact signed endpoint when the exact integer relation is on the boundary and uses rounded standardization only for strict-interior coefficients. - -A third endpoint identity defect existed at exact zero. A supplied `-0.0` lagged covariance is the same exact no-association estimand as `+0.0`, but the private numeric path could preserve the negative IEEE sign bit into the public return value. RED `e15d053100c17ac46b48cc04ad61440d0185e729` requires both signs to project to public `+0.0`; causal repair `fc61f7bdb2fd8c67719c41a9ce9ef6436beab38a` canonicalizes only the validated zero result at `temporal_association.rs`, preserving private numerical validation/error precedence. Research trace `b56e1d160debde3b656f3ec71780fadb03d2fe85` synchronizes the API/test/module boundary. - -Fresh decomposition review found the same semantic class at a different public estimand. A `-0.0` score minus a canonical `+0.0` unit mean can produce a bit-distinct `-0.0` within residual even though exact zero deviation has no direction. RED `aeb008a38bc333ba0f1bec0651739e361426e66d` drives public `decompose_within_between`; causal repair `a9a70baa5c2a40ec8bf3fc77748bc3a5eaf92cd8` canonicalizes only validated exact-zero within residuals at `decompose.rs`, and research trace `ecb909143145b2021a89827cb071315f99c03fb5` records the API/test/module/IEEE-754 boundary in `docs/research/longitudinal-within-between.md`. - -At exact #310 head `c6680450152b1e0a2c9abb553772d74a23923335`, predecessor workflow/review evidence is stale by definition. Current-head Rust/documentation/security/coverage workflows and a qualifying independent current-head `APPROVED` submission are required before Ready/merge. Queued, pending, startup-failed, skipped, or predecessor-head evidence is not GREEN. - -#486 is closed as a verified-successor consolidation, not a PR-count-only close. No child-head CI/review evidence transfers to #310. +Current #310 exact-head workflows and a qualifying independent current-head approval remain required before Ready/merge. Queued, pending, startup-failed, skipped, or predecessor-head evidence is not GREEN. ### #488 — Validation Evidence recovery arithmetic -Protected-main `validation_core::mean_bias` defines bias correctly as `mean(recovered − truth)` but implemented the mean as a raw residual sum followed by division. Two finite `f64::MAX` residuals therefore overflowed the intermediate sum even though the final mean bias is representable as `f64::MAX`; `bias_standard_error` inherited the same mean failure and rejected a constant extreme bias whose sampling variance is exactly zero. - -Public RED `c5ec42e40307f3645c18b0d73114b73e01745a20` fixes that recovery contract. Initial repair `7499042f7451b2e3d5e9f83843aeea82c4f5ff06` normalizes before deterministic compensated summation, divides by the recovery count, and restores scale once. - -Fresh review of that repair found a distinct mixed-sign false-zero boundary. Let `u = f64::from_bits(1)`. Residuals `[f64::MAX, 2u, 2u, -f64::MAX]` have exact sum `4u` and representable mean `u`, but max-magnitude normalization divided each `2u` into zero before the two extremes cancelled. Public RED `b60847500e9e7f3866f446302964627de009961c` drives the public `mean_bias` contract. Causal repair `227921d99676a420c94df402fc29153718ae8d2c` partitions residuals by sign and cancels opposing represented magnitudes before scale reduction, then exact-power-of-two normalizes the remaining one-sign mass while keeping the original recovery denominator. Hardening `77dcf38c9d356b0c72454b335944f5bdb2be52e3` adds the negative mirror, mixed-sign transport permutation, and full-range exact cancellation. This preserves representable low-order bias without reclassifying true cancellation or an unrepresentable one-sign mean. - -Review of the repaired SE path exposed a second avoidable overflow. Public RED `7de0ef90944925ae7b232a8280f5bf9096df6502` uses `[1e154, -1e154, 0]`, whose raw squared-deviation sum overflows even though the final SEM is finite. Repair `cad231620679d8f912bded36c654446032b45e57` scales deviations before squaring and forms the SEM directly; if direct subtraction from the finite mean overflows it re-expresses the same deviations in a normalized scale. `8a6cc346...` and `28d96c23...` harden the public/unit oracle without requiring incidental last-bit equality. The SE mean-centering step consumes the same cancellation-safe bias mean. +#488 is the generic Validation Evidence landing vehicle at exact head `7de6847149c1928e0232f095023f8446fc2d4e70`. It remains distinct from Longitudinal Modeling and does not consume mutable fast-mlsirm source. -Generic RMSE had the same class of avoidable intermediate at a different estimand. Protected main squared every finite absolute residual before normalization, so constant `f64::MAX` residuals were rejected even though their RMSE is exactly representable as `f64::MAX`; minimum-subnormal residuals could instead square to zero before the mean and falsely report perfect recovery. Public RED `dd41ff5323cbc6aa3f2da8a0fb6af540e38c582e` requires constant `f64::MAX` residuals to return RMSE `f64::MAX` and RMSE SE `0.0`. Boundary RED `f4e19991bfe7b83cdce767a7214193c9e53e0b2b` requires a single minimum-subnormal residual among two observations to retain the representable minimum-subnormal RMSE and a corresponding four-observation half-ULP result to fail closed rather than round to false zero. Repair `6b182107376b9b7dec66570d21a1ea6b002266f3` normalizes residuals before squaring, computes RMSE and squared-residual variation in the normalized domain, and restores residual scale only after the square root/delta-method ratio. +Mean signed bias no longer depends on a raw finite sum that can overflow before division (`c5ec42e4...`→`7499042f...`). Full-range mixed-sign cancellation preserves representable low-order bias before scale reduction (`b6084750...`→`227921d9...`, hardening `77dcf38c...`). Bias SEM scales deviations before squaring and forms the final SEM without avoidable variance overflow (`7de0ef90...`→`cad23162...`, edges `8a6cc346...`/`28d96c23...`). -Monte Carlo summary had a related but distinct uncertainty failure. `summarize_replications` sorted the samples but still used Welford `delta * delta2`; `[f64::MAX, 0, 0, -f64::MAX]` therefore overflowed an intermediate even though the exact mean is `0`, sample SD is `f64::MAX * sqrt(2/3)`, and SE is representable. Conversely, nonzero subnormal simulation uncertainty could collapse to exact zero. Public RED `41faba0d184e9f0a3067f6df74c74f74798fa839`; causal repair `91b4a93d160efa68942fcb8a38fddab10fb97caf` uses the deterministic represented mean, scales deviations before squaring, restores sample-SD scale once, and fails closed if nonzero SD projects to exact-zero SE. +Generic RMSE/RMSE-SE normalize residual magnitudes before squaring so representable extremes/subnormals survive while false-perfect final underflow fails closed (`dd41ff53...`, `f4e19991...`→`6b182107...`). Monte Carlo summaries replace Welford raw deviation products with deterministic represented mean plus scaled deviation squares, preserving representable sample SD/SE and refusing nonzero uncertainty that projects to exact zero (`41faba0d...`→`91b4a93d...`). -Research trace `bd0343d924f6f54c3784bef4b5490de4b23e2bef` records the generic recovery and Monte Carlo numerical contracts with Morris, White, & Crowther (2019) and current IEEE/ISO floating-point authority. Bias release wording is current through `da0953d96a4cbfd328c2b03b7da8516417725357`; Monte Carlo release wording and current #488 head are `0cb415cfbe38a45dacac7b829905561e8a8acd68`. Private `validation_core::numeric` support remains deterministic scalar arithmetic; metric-specific cancellation/scale/denominator/uncertainty/refusal policy remains with each Validation Evidence metric module. +Fresh acceptance review found a separate endpoint defect. The declared gate is `|estimate - target| <= k * SE`; for `k = 0`, the tolerance is exactly zero. With `estimate = f64::from_bits(1)`, `target = 0`, `SE = f64::MAX`, predecessor scale reduction erased the nonzero minimum-subnormal residual and falsely accepted exact recovery. Public RED `bd8a7c8a6d93ec262f5634cec199265521308dfd` covers both residual signs and exact equality. Causal repair `00ef2d90580e01494370e48ef68afbe4d0819ba8` routes `k == 0.0` through exact comparison before scale reduction; the positive-`k` overflow-safe path is unchanged. Research trace `27f5a6ed3b15928f2c313e115ddaf346dcf24fc3`; release fragment/current head `7de6847149c1928e0232f095023f8446fc2d4e70`. -This belongs to TEPP Validation Evidence because it repairs generic recovery metrics already owned by `validation_core`. It does not move Longitudinal composition or create a second psychometric estimator authority, and no mutable fast-mlsirm source is copied or consumed. +Morris, White, and Crowther (2019) remain the simulation performance-measure/Monte Carlo uncertainty methodology trace; IEEE/ISO/IEC 60559-2020 remains the published floating-point authority used for these binary64 regressions. Exact-head hosted Rust/documentation/security/supply-chain/100%-coverage gates and a qualifying independent current-head review remain required. ### #416 — Validation / Analysis Run consolidation -#416 exact head is `aa730c63563eb4a33048d822b581036c8487bd47`. The generic cutoff-before-identity repair `0b7155cc...` remains in its ancestry; six newer commits canonicalize episode/cutoff fixtures and harden bounded artifact/profile tests without transferring child-head CI. #458/#460/#482/#483/#484/#485/#487 remain current fold children over shared Cargo/lib/lock/docs surfaces. Their unique evidence must reach a surviving #416 exact head before any child can be considered fully superseded. +#416 exact head is `aa730c63563eb4a33048d822b581036c8487bd47`. Generic cutoff-before-identity repair `0b7155cc...` remains in ancestry; current follow-ups canonicalize episode/cutoff fixtures and harden bounded artifact/profile tests. #458/#460/#482/#483/#484/#485/#487 remain fold children over shared surfaces until every unique source/test/fixture/contract/doctoring delta is inherited by a conflict-resolving survivor. Child-head CI never transfers to #416. -#487 exposed a scientific acceptance bug: the first implementation required all four Allen support classes and at least four assignments merely because the test fixture exercised those branches. RED `a2892b6...` requires covered-only and contradiction-only historical censuses to succeed with truthful zero counts. Repair `a6402015...` keeps only real invariants: nonempty admitted evidence, size bound, exact class sums, refusal-plus-covered conservation, cutoff-safe admission, digest/schema validation, and claim boundary. `6b0c8de6...` removes predecessor tests that encoded the rejected fixture-as-production rule. Fresh docs-to-code repair `e07b2ff9...` makes branch-local ADR 0079 `Proposed` under the existing canonical ADR lineage and removes the contradictory mixed-four-class prerequisite. The child remains conflicted beneath #416 and does not transfer child-head evidence to #416. +#487's RED `a2892b6...`, repair `a6402015...`, predecessor-test correction `6b0c8de6...`, and `Proposed` ADR repair `e07b2ff9...` establish that observed Allen relation classes are data, not mandatory production design strata. ### #480 — contextual-orchestrator boundary -#480 removes TEPP-owned provider discovery/ranking and requires the contextual-orchestrator owner contract. Its branch-local `AGENTS.md` already replaces the protected-main direct-NVIDIA-key guidance with released contextual-orchestrator-only routing and `orchestrator/free` for model-backed Actions. The consumer remains Draft until the owner provides an immutable compatible release plus authenticated deployment identity/schema/artifact provenance and safe scoped/brokered gateway authentication. Mutable owner main is evidence, not a production contract. +#480 removes TEPP-owned provider discovery/ranking and requires a released contextual-orchestrator owner contract. Branch-local guidance uses `orchestrator/free` for model-backed Actions and refuses direct provider selection. The consumer remains Draft until an immutable compatible release plus deployment/auth/schema/artifact provenance exists. Mutable owner main is evidence, not a production contract. ### Owner handoffs @@ -179,7 +156,7 @@ Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/num | GAP-015 | contextual-orchestrator lacks immutable released contract for current owner behavior | `release-blocking` | compatible immutable CO release, deployment provenance, safe gateway auth, exact TEPP ACL adoption | | GAP-016 | hourly LLM path needs released owner-only routing/authentication | `active-repair` | #480 Draft + released CO adoption + exact-head GREEN/review/main merge | | GAP-017 | dynamic evaluation item/rater/anchor drift monitoring | `owner-contract-active` | released/digest-pinned dynamic criterion/item/run contract, ACL conformance, no-anchor/no-linking refusal, evidence-gated temporal monitoring | -| GAP-018 | Longitudinal stable-mean logic had a separate decomposition implementation after CWC/occasion consolidation | `verification-pending` | RED `7dc87aa8...` + causal repair `97c8ad35...` + trace `a1aef11e...`; scan remaining Longitudinal means, exact-head GREEN/review/main integration | +| GAP-018 | Longitudinal stable-mean logic had a separate decomposition implementation after CWC/occasion consolidation | `verification-pending` | RED `7dc87aa8...` + repair `97c8ad35...` + trace `a1aef11e...`; scan remaining Longitudinal means, exact-head GREEN/review/main integration | | GAP-019 | Longitudinal scientific instructions contradicted stationary-overflow implementation | `verification-pending` | RED `9d8a82d...` + repair `9c962205...`; exact-head documentation/review GREEN and protected-main integration | | GAP-020 | Nonzero lagged covariance can be misreported as exact-zero correlation when standardized magnitude is unrepresentable | `verification-pending` | RED `c345ee7b...` + repair `5785e07a...`; exact-head Rust/documentation/review GREEN and protected-main integration | | GAP-021 | Longitudinal irregular-rate facade duplicated public wrapper identities over one canonical implementation | `verification-pending` | RED `464863860...` + repair `7f0bea084...`; exact-head Rust/documentation/review GREEN and protected-main integration | @@ -195,22 +172,23 @@ Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/num | GAP-031 | Occasion-mean same-sign averaging double-rounded a representable minimum-subnormal ties-to-even mean | `verification-pending` | RED `9aff817f...` + repair `40e057b8...` + trace `a2e6ace7...`; exact-head GREEN and protected-main integration | | GAP-032 | CWC/irregular-residual same-sign averaging retained the same minimum-subnormal double-rounding defect | `verification-pending` | RED `23476f45...` + repair `b14eb6e8...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-033 | Arbitrary max-magnitude normalization introduced a second rounding and misrounded a 7.5-ULP subnormal mean to 7 ULPs | `verification-pending` | RED `b073f03f...` + exact-power-of-two repair `350b8d4e...` + Longitudinal mean-authority consolidation `dd53eff6...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-034 | Mixed-sign cancellation rounded a retained-only mean before restoring the original denominator, moving a representable subnormal mean by one ULP | `verification-pending` | RED `ae5e61f9...` + causal repair `39469067...` + occasion public-contract hardening `201f3900...` + research trace `34fd059a...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-035 | Within/between decomposition shadow running mean misrounded the representable `[1 ULP, 2 ULP]` unit mean and shifted residuals by one ULP | `verification-pending` | RED `7dc87aa8...` + causal repair `97c8ad35...` + research trace `a1aef11e...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-036 | Known-truth component RMSE could underflow a mathematically nonzero recovery error to exact zero and falsely report perfect recovery | `verification-pending` | RED `496583c6...` + causal repair `a82b383b...` + research trace `bfaa69c4...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-037 | Strict-interior lagged covariance could round to false exact `±1` correlation after exact covariance-bound admission | `verification-pending` | RED `683b28ee...` + causal repair `9eeb373d...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-038 | Exact Cauchy–Schwarz boundary covariance could round one ULP below `±1` and weaken a perfect represented association | `verification-pending` | RED `c2500090...` + causal repair `d06259ec...` + research trace `be5123d5...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-039 | Exact zero lagged covariance could leak IEEE `-0.0` through the public Temporal Association projection and create a bit-distinct directional-looking no-association value | `verification-pending` | RED `e15d0531...` + causal repair `fc61f7bd...` + research trace `b56e1d16...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-040 | Exact zero within-person deviation could leak IEEE `-0.0` through public within/between decomposition and create two bit-distinct identities for one no-deviation estimand | `verification-pending` | RED `aeb008a3...` + causal repair `a9a70baa...` + research trace `ecb90914...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-041 | Individually representable irregular residual log-rates could have a mathematically nonzero one-sign mean that underflowed to exact zero and falsely reported no temporal change | `verification-pending` | RED `96f1c334...` + causal repair `ae5081d8...` + research trace `0280aba0...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-034 | Mixed-sign cancellation rounded a retained-only mean before restoring the original denominator, moving a representable subnormal mean by one ULP | `verification-pending` | RED `ae5e61f9...` + repair `39469067...` + occasion contract `201f3900...` + trace `34fd059a...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-035 | Within/between decomposition shadow running mean misrounded the representable `[1 ULP, 2 ULP]` unit mean and shifted residuals by one ULP | `verification-pending` | RED `7dc87aa8...` + repair `97c8ad35...` + trace `a1aef11e...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-036 | Known-truth component RMSE could underflow a mathematically nonzero recovery error to exact zero and falsely report perfect recovery | `verification-pending` | RED `496583c6...` + repair `a82b383b...` + trace `bfaa69c4...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-037 | Strict-interior lagged covariance could round to false exact `±1` correlation after exact covariance-bound admission | `verification-pending` | RED `683b28ee...` + repair `9eeb373d...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-038 | Exact Cauchy–Schwarz boundary covariance could round one ULP below `±1` and weaken a perfect represented association | `verification-pending` | RED `c2500090...` + repair `d06259ec...` + trace `be5123d5...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-039 | Exact zero lagged covariance could leak IEEE `-0.0` through the public Temporal Association projection and create a bit-distinct directional-looking no-association value | `verification-pending` | RED `e15d0531...` + repair `fc61f7bd...` + trace `b56e1d16...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-040 | Exact zero within-person deviation could leak IEEE `-0.0` through public within/between decomposition and create two bit-distinct identities for one no-deviation estimand | `verification-pending` | RED `aeb008a3...` + repair `a9a70baa...` + trace `ecb90914...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-041 | Individually representable irregular residual log-rates could have a mathematically nonzero one-sign mean that underflowed to exact zero and falsely reported no temporal change | `verification-pending` | RED `96f1c334...` + repair `ae5081d8...` + trace `0280aba0...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-042 | Ratio-first logarithm could nearly double an adjacent-float power-of-two irregular residual growth rate before event-time scaling | `verification-pending` | public RED `766ddc7a...` + causal `ln_1p` repair `16f21d9a...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-043 | Duplicate known-truth component identities could silently reweight RMSE recovery evidence by changing the denominator without adding a new scientific target | `verification-pending` | public RED `698f12f5...` + causal uniqueness repair `2fae4cb2...` + current research trace `c9cb68d3...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-044 | Known-truth component RMSE alignment and deterministic binary64 accumulation depended on serialization row order rather than scientific component identity | `verification-pending` | cross-slice RED `8ad72ac9...` + identity-alignment repair `2dd9537e...` + truth-order rounding RED `5fb93c40...` + canonical-order repair `025dce7f...` + edge coverage `976ce7d7...` + current research trace/head `c9cb68d3...` / `c6680450...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | public RED `c5ec42e4...` + initial scaled compensated-mean repair `7499042f...` + current #488 `0cb415cf...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-046 | Bias standard error could reject a representable SEM because raw squared deviations, their sum, or an intermediate sample variance overflowed | `verification-pending` | public RED `7de0ef90...` + scaled direct-SEM repair `cad23162...` + oracle/edge reinforcement `8a6cc346...` / `28d96c23...` + research/current #488 `bd0343d9...` / `0cb415cf...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-047 | Generic Validation Evidence RMSE/RMSE-SE could reject representable extreme recovery or collapse a representable/nonzero subnormal error to false perfect recovery because residuals were squared before scale normalization | `verification-pending` | public extreme RED `dd41ff53...` + subnormal boundary RED `f4e19991...` + causal scaled RMSE/RMSE-SE repair `6b182107...` + research/current #488 `bd0343d9...` / `0cb415cf...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-048 | Validation Evidence mean signed bias could erase a representable subnormal residual contribution by normalizing to an unrelated extreme magnitude before mixed-sign cancellation | `verification-pending` | public RED `b6084750...` + cancellation-first/power-of-two repair `227921d9...` + permutation/exact-cancellation hardening `77dcf38c...` + research/current #488 `bd0343d9...` / `0cb415cf...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-049 | Stable `Between` recovery could be aliased across occasion indices, duplicating one unit-level scientific target and silently changing the RMSE denominator | `verification-pending` | public RED `0a03041c...` + owner-valid fixture repair `53563e97...` + causal admission repair `ec2c1219...` + research trace `c9cb68d3...` + current #310 `c6680450...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-043 | Duplicate known-truth component identities could silently reweight RMSE recovery evidence by changing the denominator without adding a new scientific target | `verification-pending` | public RED `698f12f5...` + uniqueness repair `2fae4cb2...` + current trace `c9cb68d3...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-044 | Known-truth component RMSE alignment and deterministic binary64 accumulation depended on serialization row order rather than scientific component identity | `verification-pending` | cross-slice RED `8ad72ac9...` + alignment repair `2dd9537e...` + rounding RED `5fb93c40...` + canonical-order repair `025dce7f...` + edge `976ce7d7...` + current #310 `c6680450...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | public RED `c5ec42e4...` + scaled repair `7499042f...` + current #488 `7de68471...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-046 | Bias standard error could reject a representable SEM because raw squared deviations, their sum, or an intermediate sample variance overflowed | `verification-pending` | public RED `7de0ef90...` + scaled direct-SEM repair `cad23162...` + edges `8a6cc346...` / `28d96c23...` + current #488 `7de68471...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-047 | Generic Validation Evidence RMSE/RMSE-SE could reject representable extreme recovery or collapse a representable/nonzero subnormal error to false perfect recovery because residuals were squared before scale normalization | `verification-pending` | extreme RED `dd41ff53...` + subnormal RED `f4e19991...` + repair `6b182107...` + current #488 `7de68471...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-048 | Validation Evidence mean signed bias could erase a representable subnormal residual contribution by normalizing to an unrelated extreme magnitude before mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...` + hardening `77dcf38c...` + current #488 `7de68471...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-049 | Stable `Between` recovery could be aliased across occasion indices, duplicating one unit-level scientific target and silently changing the RMSE denominator | `verification-pending` | RED `0a03041c...` + fixture repair `53563e97...` + admission repair `ec2c1219...` + trace `c9cb68d3...` + current #310 `c6680450...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-050 | Zero-multiplier SE-aware acceptance could scale a nonzero residual to exact zero and falsely accept exact recovery when a large finite SE dominated normalization | `verification-pending` | public RED `bd8a7c8a...` + causal repair `00ef2d90...` + research trace `27f5a6ed...` + current #488 `7de68471...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | ## Release gate From fc1834e7862576020fecfc4c4035f69168187f7e Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 4 Sep 2026 00:53:26 +0900 Subject: [PATCH 138/235] docs(ddd): add exact-recovery identity gap --- docs/product-technical-gap-baseline.md | 22 +++++++++++++--------- 1 file changed, 13 insertions(+), 9 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 5d0179bda..d962c282d 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,7 +4,7 @@ **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-03T15:36Z +**Snapshot:** 2026-09-03T15:50Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` @@ -34,7 +34,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `7de6847149c1928e0232f095023f8446fc2d4e70` | true | `main` | Validation Evidence numerical repair. Bias/RMSE and their uncertainty paths retain representable extreme/subnormal evidence; Monte Carlo mean/sample-SD/SE avoid Welford product overflow and false-zero uncertainty; `k = 0` SE-aware acceptance is now exact-recovery before scale reduction. Exact-head hosted gates and independent review remain required. | +| #488 | `71380b22409c60d21d9f296dcc588bc40a272600` | true | `main` | Validation Evidence numerical repair. Bias/RMSE/Monte Carlo retain representable extreme/subnormal evidence; zero-multiplier SE-aware acceptance is exact-recovery before scale reduction; signed IEEE zeros are one numeric exact-recovery value rather than two total-order identities. Exact-head hosted gates and independent review remain required. | | #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 `feat/copy-identity-analysis-run-gap-004` | Validation / Analysis Run fold child. Sparse observed relation classes are valid evidence; RED `a2892b6...`, repair `a6402015...`, predecessor-test correction `6b0c8de6...`; ADR 0079 is `Proposed`. No child-head CI transfers to #416. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | @@ -72,6 +72,7 @@ The clock contract separates event/valid time, assertion time, document time, sy - Generic Validation Evidence RMSE and its delta-method standard error normalize finite residual magnitudes before squaring. A representable extreme or minimum-subnormal RMSE must survive avoidable intermediate overflow/underflow, while a mathematically nonzero final RMSE or SE below the binary64 range fails closed. - Monte Carlo mean/sample-SD/SE preserve representable uncertainty across full-range and subnormal replication values. Avoidable raw-product/Welford overflow or final false-zero uncertainty is not accepted as scientific evidence. - SE-aware acceptance is the declared rule `|estimate - target| <= k * SE`. For `k = 0`, the bound is exactly zero and exact recovery is evaluated before scale reduction; a large finite SE cannot erase a nonzero residual into acceptance. +- Exact-recovery acceptance is finite numeric equality, not IEEE total-order identity. `-0.0` and `+0.0` therefore produce one zero-error decision while nonzero finite residuals remain distinct; this does not require blanket signed-zero canonicalization in private numerical intermediates. - Bias, RMSE, and Monte Carlo may share private deterministic scalar support inside `validation_core`, but metric-specific cancellation/normalization, denominator, uncertainty, and fail-closed semantics remain with their bounded modules; support primitives are not second psychometric estimator authorities. - A mathematically nonzero scientific error metric must not be promoted to exact perfect recovery merely because its final binary64 representation underflows to zero. - Known-truth recovery denominators are defined by unique scientific component identity. Duplicate rows and stable-Between occasion aliases are not implicit weights unless a separately named weighted contract explicitly owns weighting. @@ -105,13 +106,15 @@ Current #310 exact-head workflows and a qualifying independent current-head appr ### #488 — Validation Evidence recovery arithmetic -#488 is the generic Validation Evidence landing vehicle at exact head `7de6847149c1928e0232f095023f8446fc2d4e70`. It remains distinct from Longitudinal Modeling and does not consume mutable fast-mlsirm source. +#488 is the generic Validation Evidence landing vehicle at exact head `71380b22409c60d21d9f296dcc588bc40a272600`. It remains distinct from Longitudinal Modeling and does not consume mutable fast-mlsirm source. Mean signed bias no longer depends on a raw finite sum that can overflow before division (`c5ec42e4...`→`7499042f...`). Full-range mixed-sign cancellation preserves representable low-order bias before scale reduction (`b6084750...`→`227921d9...`, hardening `77dcf38c...`). Bias SEM scales deviations before squaring and forms the final SEM without avoidable variance overflow (`7de0ef90...`→`cad23162...`, edges `8a6cc346...`/`28d96c23...`). Generic RMSE/RMSE-SE normalize residual magnitudes before squaring so representable extremes/subnormals survive while false-perfect final underflow fails closed (`dd41ff53...`, `f4e19991...`→`6b182107...`). Monte Carlo summaries replace Welford raw deviation products with deterministic represented mean plus scaled deviation squares, preserving representable sample SD/SE and refusing nonzero uncertainty that projects to exact zero (`41faba0d...`→`91b4a93d...`). -Fresh acceptance review found a separate endpoint defect. The declared gate is `|estimate - target| <= k * SE`; for `k = 0`, the tolerance is exactly zero. With `estimate = f64::from_bits(1)`, `target = 0`, `SE = f64::MAX`, predecessor scale reduction erased the nonzero minimum-subnormal residual and falsely accepted exact recovery. Public RED `bd8a7c8a6d93ec262f5634cec199265521308dfd` covers both residual signs and exact equality. Causal repair `00ef2d90580e01494370e48ef68afbe4d0819ba8` routes `k == 0.0` through exact comparison before scale reduction; the positive-`k` overflow-safe path is unchanged. Research trace `27f5a6ed3b15928f2c313e115ddaf346dcf24fc3`; release fragment/current head `7de6847149c1928e0232f095023f8446fc2d4e70`. +The declared acceptance gate is `|estimate - target| <= k * SE`. For `k = 0`, the tolerance is exactly zero. With `estimate = f64::from_bits(1)`, `target = 0`, `SE = f64::MAX`, predecessor scale reduction erased a nonzero minimum-subnormal residual and falsely accepted exact recovery. Public RED `bd8a7c8a6d93ec262f5634cec199265521308dfd`; causal repair `00ef2d90580e01494370e48ef68afbe4d0819ba8` routes the zero multiplier through exact comparison before scale reduction. + +Fresh review then found the exact branch itself used `f64::total_cmp`, which distinguishes `-0.0` and `+0.0` even though the scientific rule treats both as exact zero residual. Public RED `379e65258c5675ae9fee6d84d369803f1e8a1ae3` covers both the `k = 0` and `SE = 0` exact-recovery paths. Causal repair `55876e60b5ae553bcc4c1c41a793861b3d7e9cc8` uses finite numeric equality in that branch only. Research trace `c45a76cfe78f3b6eb6b9854648c769d86d371c0f`; release fragment/current head `71380b22409c60d21d9f296dcc588bc40a272600`. Morris, White, and Crowther (2019) remain the simulation performance-measure/Monte Carlo uncertainty methodology trace; IEEE/ISO/IEC 60559-2020 remains the published floating-point authority used for these binary64 regressions. Exact-head hosted Rust/documentation/security/supply-chain/100%-coverage gates and a qualifying independent current-head review remain required. @@ -183,12 +186,13 @@ Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/num | GAP-042 | Ratio-first logarithm could nearly double an adjacent-float power-of-two irregular residual growth rate before event-time scaling | `verification-pending` | public RED `766ddc7a...` + causal `ln_1p` repair `16f21d9a...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-043 | Duplicate known-truth component identities could silently reweight RMSE recovery evidence by changing the denominator without adding a new scientific target | `verification-pending` | public RED `698f12f5...` + uniqueness repair `2fae4cb2...` + current trace `c9cb68d3...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-044 | Known-truth component RMSE alignment and deterministic binary64 accumulation depended on serialization row order rather than scientific component identity | `verification-pending` | cross-slice RED `8ad72ac9...` + alignment repair `2dd9537e...` + rounding RED `5fb93c40...` + canonical-order repair `025dce7f...` + edge `976ce7d7...` + current #310 `c6680450...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | public RED `c5ec42e4...` + scaled repair `7499042f...` + current #488 `7de68471...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-046 | Bias standard error could reject a representable SEM because raw squared deviations, their sum, or an intermediate sample variance overflowed | `verification-pending` | public RED `7de0ef90...` + scaled direct-SEM repair `cad23162...` + edges `8a6cc346...` / `28d96c23...` + current #488 `7de68471...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-047 | Generic Validation Evidence RMSE/RMSE-SE could reject representable extreme recovery or collapse a representable/nonzero subnormal error to false perfect recovery because residuals were squared before scale normalization | `verification-pending` | extreme RED `dd41ff53...` + subnormal RED `f4e19991...` + repair `6b182107...` + current #488 `7de68471...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-048 | Validation Evidence mean signed bias could erase a representable subnormal residual contribution by normalizing to an unrelated extreme magnitude before mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...` + hardening `77dcf38c...` + current #488 `7de68471...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | public RED `c5ec42e4...` + scaled repair `7499042f...` + current #488 `71380b22...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-046 | Bias standard error could reject a representable SEM because raw squared deviations, their sum, or an intermediate sample variance overflowed | `verification-pending` | public RED `7de0ef90...` + scaled direct-SEM repair `cad23162...` + edges `8a6cc346...` / `28d96c23...` + current #488 `71380b22...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-047 | Generic Validation Evidence RMSE/RMSE-SE could reject representable extreme recovery or collapse a representable/nonzero subnormal error to false perfect recovery because residuals were squared before scale normalization | `verification-pending` | extreme RED `dd41ff53...` + subnormal RED `f4e19991...` + repair `6b182107...` + current #488 `71380b22...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-048 | Validation Evidence mean signed bias could erase a representable subnormal residual contribution by normalizing to an unrelated extreme magnitude before mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...` + hardening `77dcf38c...` + current #488 `71380b22...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-049 | Stable `Between` recovery could be aliased across occasion indices, duplicating one unit-level scientific target and silently changing the RMSE denominator | `verification-pending` | RED `0a03041c...` + fixture repair `53563e97...` + admission repair `ec2c1219...` + trace `c9cb68d3...` + current #310 `c6680450...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-050 | Zero-multiplier SE-aware acceptance could scale a nonzero residual to exact zero and falsely accept exact recovery when a large finite SE dominated normalization | `verification-pending` | public RED `bd8a7c8a...` + causal repair `00ef2d90...` + research trace `27f5a6ed...` + current #488 `7de68471...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-050 | Zero-multiplier SE-aware acceptance could scale a nonzero residual to exact zero and falsely accept exact recovery when a large finite SE dominated normalization | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...` + current research `c45a76cf...` + current #488 `71380b22...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-051 | Exact-recovery SE acceptance used IEEE total ordering and therefore treated `-0.0` and `+0.0` as different scientific recovery values | `verification-pending` | signed-zero RED `379e6525...` + numeric-equality repair `55876e60...` + research `c45a76cf...` + current #488 `71380b22...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | ## Release gate From a8a701008ce342d6abc88dc597c93f3ef8e721de Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 4 Sep 2026 01:07:17 +0900 Subject: [PATCH 139/235] docs(ddd): track Wilson coverage endpoint gap --- docs/product-technical-gap-baseline.md | 26 +++++++++++++++----------- 1 file changed, 15 insertions(+), 11 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index d962c282d..a4639e74e 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,7 +4,7 @@ **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-03T15:50Z +**Snapshot:** 2026-09-03T16:05Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` @@ -34,7 +34,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `71380b22409c60d21d9f296dcc588bc40a272600` | true | `main` | Validation Evidence numerical repair. Bias/RMSE/Monte Carlo retain representable extreme/subnormal evidence; zero-multiplier SE-aware acceptance is exact-recovery before scale reduction; signed IEEE zeros are one numeric exact-recovery value rather than two total-order identities. Exact-head hosted gates and independent review remain required. | +| #488 | `0299dda58cff0ceea2ac5d9ce0e9b5066cb092bc` | true | `main` | Validation Evidence numerical repair. Bias/RMSE/Monte Carlo retain representable extreme/subnormal evidence; zero-multiplier SE-aware acceptance is exact-recovery before scale reduction; signed IEEE zeros are one numeric exact-recovery value; all-covered Wilson lower endpoints avoid center-minus-margin cancellation. Exact-head hosted gates and independent review remain required. | | #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 `feat/copy-identity-analysis-run-gap-004` | Validation / Analysis Run fold child. Sparse observed relation classes are valid evidence; RED `a2892b6...`, repair `a6402015...`, predecessor-test correction `6b0c8de6...`; ADR 0079 is `Proposed`. No child-head CI transfers to #416. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | @@ -73,6 +73,7 @@ The clock contract separates event/valid time, assertion time, document time, sy - Monte Carlo mean/sample-SD/SE preserve representable uncertainty across full-range and subnormal replication values. Avoidable raw-product/Welford overflow or final false-zero uncertainty is not accepted as scientific evidence. - SE-aware acceptance is the declared rule `|estimate - target| <= k * SE`. For `k = 0`, the bound is exactly zero and exact recovery is evaluated before scale reduction; a large finite SE cannot erase a nonzero residual into acceptance. - Exact-recovery acceptance is finite numeric equality, not IEEE total-order identity. `-0.0` and `+0.0` therefore produce one zero-error decision while nonzero finite residuals remain distinct; this does not require blanket signed-zero canonicalization in private numerical intermediates. +- Wilson interval coverage evidence must preserve representable endpoints. For an all-covered sample, the lower score endpoint is evaluated as `n / (n + z²)` so generic center-minus-margin cancellation cannot promote a positive representable lower bound to exact zero. - Bias, RMSE, and Monte Carlo may share private deterministic scalar support inside `validation_core`, but metric-specific cancellation/normalization, denominator, uncertainty, and fail-closed semantics remain with their bounded modules; support primitives are not second psychometric estimator authorities. - A mathematically nonzero scientific error metric must not be promoted to exact perfect recovery merely because its final binary64 representation underflows to zero. - Known-truth recovery denominators are defined by unique scientific component identity. Duplicate rows and stable-Between occasion aliases are not implicit weights unless a separately named weighted contract explicitly owns weighting. @@ -106,7 +107,7 @@ Current #310 exact-head workflows and a qualifying independent current-head appr ### #488 — Validation Evidence recovery arithmetic -#488 is the generic Validation Evidence landing vehicle at exact head `71380b22409c60d21d9f296dcc588bc40a272600`. It remains distinct from Longitudinal Modeling and does not consume mutable fast-mlsirm source. +#488 is the generic Validation Evidence landing vehicle at exact head `0299dda58cff0ceea2ac5d9ce0e9b5066cb092bc`. It remains distinct from Longitudinal Modeling and does not consume mutable fast-mlsirm source. Mean signed bias no longer depends on a raw finite sum that can overflow before division (`c5ec42e4...`→`7499042f...`). Full-range mixed-sign cancellation preserves representable low-order bias before scale reduction (`b6084750...`→`227921d9...`, hardening `77dcf38c...`). Bias SEM scales deviations before squaring and forms the final SEM without avoidable variance overflow (`7de0ef90...`→`cad23162...`, edges `8a6cc346...`/`28d96c23...`). @@ -114,9 +115,11 @@ Generic RMSE/RMSE-SE normalize residual magnitudes before squaring so representa The declared acceptance gate is `|estimate - target| <= k * SE`. For `k = 0`, the tolerance is exactly zero. With `estimate = f64::from_bits(1)`, `target = 0`, `SE = f64::MAX`, predecessor scale reduction erased a nonzero minimum-subnormal residual and falsely accepted exact recovery. Public RED `bd8a7c8a6d93ec262f5634cec199265521308dfd`; causal repair `00ef2d90580e01494370e48ef68afbe4d0819ba8` routes the zero multiplier through exact comparison before scale reduction. -Fresh review then found the exact branch itself used `f64::total_cmp`, which distinguishes `-0.0` and `+0.0` even though the scientific rule treats both as exact zero residual. Public RED `379e65258c5675ae9fee6d84d369803f1e8a1ae3` covers both the `k = 0` and `SE = 0` exact-recovery paths. Causal repair `55876e60b5ae553bcc4c1c41a793861b3d7e9cc8` uses finite numeric equality in that branch only. Research trace `c45a76cfe78f3b6eb6b9854648c769d86d371c0f`; release fragment/current head `71380b22409c60d21d9f296dcc588bc40a272600`. +Fresh review then found the exact branch itself used `f64::total_cmp`, which distinguishes `-0.0` and `+0.0` even though the scientific rule treats both as exact zero residual. Public RED `379e65258c5675ae9fee6d84d369803f1e8a1ae3` covers both the `k = 0` and `SE = 0` exact-recovery paths. Causal repair `55876e60b5ae553bcc4c1c41a793861b3d7e9cc8` uses finite numeric equality in that branch only. Research trace `c45a76cfe78f3b6eb6b9854648c769d86d371c0f`. -Morris, White, and Crowther (2019) remain the simulation performance-measure/Monte Carlo uncertainty methodology trace; IEEE/ISO/IEC 60559-2020 remains the published floating-point authority used for these binary64 regressions. Exact-head hosted Rust/documentation/security/supply-chain/100%-coverage gates and a qualifying independent current-head review remain required. +All-covered Wilson coverage exposed another representability defect. With one covered replication and finite `z = 1e154`, `z² = 1e308` remains finite and the all-covered lower score endpoint `n / (n + z²)` is about `1e-308`, still representable. The predecessor generic center-minus-margin form cancelled to exact zero. Public RED `f84e5918acc81ca8bf3708f3cce2004c67675b78`; causal repair `fe9b9c8a5b94a01cd8416efd613503569b98ac1a`; research trace `ff64f9a36fe9e7c926b84bd00ee3fa29b8662784`; release fragment/current head `0299dda58cff0ceea2ac5d9ce0e9b5066cb092bc`. + +Morris, White, and Crowther (2019) remain the simulation performance-measure/Monte Carlo uncertainty methodology trace; Wilson (1927) remains the primary score-interval reference; IEEE/ISO/IEC 60559-2020 remains the published floating-point authority used for these binary64 regressions. Exact-head hosted Rust/documentation/security/supply-chain/100%-coverage gates and a qualifying independent current-head review remain required. ### #416 — Validation / Analysis Run consolidation @@ -186,13 +189,14 @@ Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/num | GAP-042 | Ratio-first logarithm could nearly double an adjacent-float power-of-two irregular residual growth rate before event-time scaling | `verification-pending` | public RED `766ddc7a...` + causal `ln_1p` repair `16f21d9a...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-043 | Duplicate known-truth component identities could silently reweight RMSE recovery evidence by changing the denominator without adding a new scientific target | `verification-pending` | public RED `698f12f5...` + uniqueness repair `2fae4cb2...` + current trace `c9cb68d3...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-044 | Known-truth component RMSE alignment and deterministic binary64 accumulation depended on serialization row order rather than scientific component identity | `verification-pending` | cross-slice RED `8ad72ac9...` + alignment repair `2dd9537e...` + rounding RED `5fb93c40...` + canonical-order repair `025dce7f...` + edge `976ce7d7...` + current #310 `c6680450...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | public RED `c5ec42e4...` + scaled repair `7499042f...` + current #488 `71380b22...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-046 | Bias standard error could reject a representable SEM because raw squared deviations, their sum, or an intermediate sample variance overflowed | `verification-pending` | public RED `7de0ef90...` + scaled direct-SEM repair `cad23162...` + edges `8a6cc346...` / `28d96c23...` + current #488 `71380b22...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-047 | Generic Validation Evidence RMSE/RMSE-SE could reject representable extreme recovery or collapse a representable/nonzero subnormal error to false perfect recovery because residuals were squared before scale normalization | `verification-pending` | extreme RED `dd41ff53...` + subnormal RED `f4e19991...` + repair `6b182107...` + current #488 `71380b22...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-048 | Validation Evidence mean signed bias could erase a representable subnormal residual contribution by normalizing to an unrelated extreme magnitude before mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...` + hardening `77dcf38c...` + current #488 `71380b22...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | public RED `c5ec42e4...` + scaled repair `7499042f...` + current #488 `0299dda5...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-046 | Bias standard error could reject a representable SEM because raw squared deviations, their sum, or an intermediate sample variance overflowed | `verification-pending` | public RED `7de0ef90...` + scaled direct-SEM repair `cad23162...` + edges `8a6cc346...` / `28d96c23...` + current #488 `0299dda5...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-047 | Generic Validation Evidence RMSE/RMSE-SE could reject representable extreme recovery or collapse a representable/nonzero subnormal error to false perfect recovery because residuals were squared before scale normalization | `verification-pending` | extreme RED `dd41ff53...` + subnormal RED `f4e19991...` + repair `6b182107...` + current #488 `0299dda5...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-048 | Validation Evidence mean signed bias could erase a representable subnormal residual contribution by normalizing to an unrelated extreme magnitude before mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...` + hardening `77dcf38c...` + current #488 `0299dda5...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-049 | Stable `Between` recovery could be aliased across occasion indices, duplicating one unit-level scientific target and silently changing the RMSE denominator | `verification-pending` | RED `0a03041c...` + fixture repair `53563e97...` + admission repair `ec2c1219...` + trace `c9cb68d3...` + current #310 `c6680450...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-050 | Zero-multiplier SE-aware acceptance could scale a nonzero residual to exact zero and falsely accept exact recovery when a large finite SE dominated normalization | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...` + current research `c45a76cf...` + current #488 `71380b22...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-051 | Exact-recovery SE acceptance used IEEE total ordering and therefore treated `-0.0` and `+0.0` as different scientific recovery values | `verification-pending` | signed-zero RED `379e6525...` + numeric-equality repair `55876e60...` + research `c45a76cf...` + current #488 `71380b22...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-050 | Zero-multiplier SE-aware acceptance could scale a nonzero residual to exact zero and falsely accept exact recovery when a large finite SE dominated normalization | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...` + current research `c45a76cf...` + current #488 `0299dda5...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-051 | Exact-recovery SE acceptance used IEEE total ordering and therefore treated `-0.0` and `+0.0` as different scientific recovery values | `verification-pending` | signed-zero RED `379e6525...` + numeric-equality repair `55876e60...` + research `c45a76cf...` + current #488 `0299dda5...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-052 | All-covered Wilson score coverage could cancel a positive binary64-representable lower endpoint to exact zero by subtracting nearly equal center and margin terms | `verification-pending` | public RED `f84e5918...` + exact all-covered endpoint repair `fe9b9c8a...` + research `ff64f9a3...` + current #488 `0299dda5...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | ## Release gate From e34496ab54b28730c08d0259bc533d4dc06c5130 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 4 Sep 2026 02:05:21 +0900 Subject: [PATCH 140/235] docs(ddd): track strict-interior Wilson evidence gap --- docs/product-technical-gap-baseline.md | 27 ++++++++++++++------------ 1 file changed, 15 insertions(+), 12 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index a4639e74e..848dae248 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,7 +4,7 @@ **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-03T16:05Z +**Snapshot:** 2026-09-03T17:03Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` @@ -34,7 +34,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `0299dda58cff0ceea2ac5d9ce0e9b5066cb092bc` | true | `main` | Validation Evidence numerical repair. Bias/RMSE/Monte Carlo retain representable extreme/subnormal evidence; zero-multiplier SE-aware acceptance is exact-recovery before scale reduction; signed IEEE zeros are one numeric exact-recovery value; all-covered Wilson lower endpoints avoid center-minus-margin cancellation. Exact-head hosted gates and independent review remain required. | +| #488 | `5db4888366ae4d61661c54b70fd0ab55a608dba4` | true | `main` | Validation Evidence numerical repair. Bias/RMSE/Monte Carlo retain representable extreme/subnormal evidence; zero-multiplier SE-aware acceptance is exact-recovery before scale reduction; signed IEEE zeros are one numeric exact-recovery value; all-covered and strict-interior Wilson lower endpoints avoid center-minus-margin cancellation when a positive representable bound would otherwise collapse to zero. Exact-head hosted gates and independent review remain required. | | #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 `feat/copy-identity-analysis-run-gap-004` | Validation / Analysis Run fold child. Sparse observed relation classes are valid evidence; RED `a2892b6...`, repair `a6402015...`, predecessor-test correction `6b0c8de6...`; ADR 0079 is `Proposed`. No child-head CI transfers to #416. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | @@ -73,7 +73,7 @@ The clock contract separates event/valid time, assertion time, document time, sy - Monte Carlo mean/sample-SD/SE preserve representable uncertainty across full-range and subnormal replication values. Avoidable raw-product/Welford overflow or final false-zero uncertainty is not accepted as scientific evidence. - SE-aware acceptance is the declared rule `|estimate - target| <= k * SE`. For `k = 0`, the bound is exactly zero and exact recovery is evaluated before scale reduction; a large finite SE cannot erase a nonzero residual into acceptance. - Exact-recovery acceptance is finite numeric equality, not IEEE total-order identity. `-0.0` and `+0.0` therefore produce one zero-error decision while nonzero finite residuals remain distinct; this does not require blanket signed-zero canonicalization in private numerical intermediates. -- Wilson interval coverage evidence must preserve representable endpoints. For an all-covered sample, the lower score endpoint is evaluated as `n / (n + z²)` so generic center-minus-margin cancellation cannot promote a positive representable lower bound to exact zero. +- Wilson interval coverage evidence must preserve representable endpoints. All-covered lower bounds use `n / (n + z²)`. Strict-interior lower bounds use an algebraically rationalized, `z²`-normalized root when generic center-minus-margin evaluation collapses a positive representable endpoint to exact zero. - Bias, RMSE, and Monte Carlo may share private deterministic scalar support inside `validation_core`, but metric-specific cancellation/normalization, denominator, uncertainty, and fail-closed semantics remain with their bounded modules; support primitives are not second psychometric estimator authorities. - A mathematically nonzero scientific error metric must not be promoted to exact perfect recovery merely because its final binary64 representation underflows to zero. - Known-truth recovery denominators are defined by unique scientific component identity. Duplicate rows and stable-Between occasion aliases are not implicit weights unless a separately named weighted contract explicitly owns weighting. @@ -107,7 +107,7 @@ Current #310 exact-head workflows and a qualifying independent current-head appr ### #488 — Validation Evidence recovery arithmetic -#488 is the generic Validation Evidence landing vehicle at exact head `0299dda58cff0ceea2ac5d9ce0e9b5066cb092bc`. It remains distinct from Longitudinal Modeling and does not consume mutable fast-mlsirm source. +#488 is the generic Validation Evidence landing vehicle at exact head `5db4888366ae4d61661c54b70fd0ab55a608dba4`. It remains distinct from Longitudinal Modeling and does not consume mutable fast-mlsirm source. Mean signed bias no longer depends on a raw finite sum that can overflow before division (`c5ec42e4...`→`7499042f...`). Full-range mixed-sign cancellation preserves representable low-order bias before scale reduction (`b6084750...`→`227921d9...`, hardening `77dcf38c...`). Bias SEM scales deviations before squaring and forms the final SEM without avoidable variance overflow (`7de0ef90...`→`cad23162...`, edges `8a6cc346...`/`28d96c23...`). @@ -117,7 +117,9 @@ The declared acceptance gate is `|estimate - target| <= k * SE`. For `k = 0`, th Fresh review then found the exact branch itself used `f64::total_cmp`, which distinguishes `-0.0` and `+0.0` even though the scientific rule treats both as exact zero residual. Public RED `379e65258c5675ae9fee6d84d369803f1e8a1ae3` covers both the `k = 0` and `SE = 0` exact-recovery paths. Causal repair `55876e60b5ae553bcc4c1c41a793861b3d7e9cc8` uses finite numeric equality in that branch only. Research trace `c45a76cfe78f3b6eb6b9854648c769d86d371c0f`. -All-covered Wilson coverage exposed another representability defect. With one covered replication and finite `z = 1e154`, `z² = 1e308` remains finite and the all-covered lower score endpoint `n / (n + z²)` is about `1e-308`, still representable. The predecessor generic center-minus-margin form cancelled to exact zero. Public RED `f84e5918acc81ca8bf3708f3cce2004c67675b78`; causal repair `fe9b9c8a5b94a01cd8416efd613503569b98ac1a`; research trace `ff64f9a36fe9e7c926b84bd00ee3fa29b8662784`; release fragment/current head `0299dda58cff0ceea2ac5d9ce0e9b5066cb092bc`. +All-covered Wilson coverage exposed another representability defect. With one covered replication and finite `z = 1e154`, `z² = 1e308` remains finite and the all-covered lower score endpoint `n / (n + z²)` is about `1e-308`, still representable. The predecessor generic center-minus-margin form cancelled to exact zero. Public RED `f84e5918acc81ca8bf3708f3cce2004c67675b78`; causal repair `fe9b9c8a5b94a01cd8416efd613503569b98ac1a`. + +Strict-interior Wilson coverage retained the same failure after the endpoint repair. With `n = 2`, one covered replication (`p̂ = 0.5`), and finite `z = 1e154`, the generic center and margin both round to `2.5e307`, collapsing the lower endpoint to exact zero even though the rationalized Wilson root is about `5e-309` and representable. Public RED `9d45f482854037d96d5dff38964fd3844335a39b`; causal repair `4f259f6e5c98ade2e4a34125430de872f32c1589`; release trace `2875ac5fe28cccbe8aab65baf0ace0d247cc52d3`; research/current #488 `5db4888366ae4d61661c54b70fd0ab55a608dba4`. Morris, White, and Crowther (2019) remain the simulation performance-measure/Monte Carlo uncertainty methodology trace; Wilson (1927) remains the primary score-interval reference; IEEE/ISO/IEC 60559-2020 remains the published floating-point authority used for these binary64 regressions. Exact-head hosted Rust/documentation/security/supply-chain/100%-coverage gates and a qualifying independent current-head review remain required. @@ -189,14 +191,15 @@ Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/num | GAP-042 | Ratio-first logarithm could nearly double an adjacent-float power-of-two irregular residual growth rate before event-time scaling | `verification-pending` | public RED `766ddc7a...` + causal `ln_1p` repair `16f21d9a...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-043 | Duplicate known-truth component identities could silently reweight RMSE recovery evidence by changing the denominator without adding a new scientific target | `verification-pending` | public RED `698f12f5...` + uniqueness repair `2fae4cb2...` + current trace `c9cb68d3...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-044 | Known-truth component RMSE alignment and deterministic binary64 accumulation depended on serialization row order rather than scientific component identity | `verification-pending` | cross-slice RED `8ad72ac9...` + alignment repair `2dd9537e...` + rounding RED `5fb93c40...` + canonical-order repair `025dce7f...` + edge `976ce7d7...` + current #310 `c6680450...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | public RED `c5ec42e4...` + scaled repair `7499042f...` + current #488 `0299dda5...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-046 | Bias standard error could reject a representable SEM because raw squared deviations, their sum, or an intermediate sample variance overflowed | `verification-pending` | public RED `7de0ef90...` + scaled direct-SEM repair `cad23162...` + edges `8a6cc346...` / `28d96c23...` + current #488 `0299dda5...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-047 | Generic Validation Evidence RMSE/RMSE-SE could reject representable extreme recovery or collapse a representable/nonzero subnormal error to false perfect recovery because residuals were squared before scale normalization | `verification-pending` | extreme RED `dd41ff53...` + subnormal RED `f4e19991...` + repair `6b182107...` + current #488 `0299dda5...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-048 | Validation Evidence mean signed bias could erase a representable subnormal residual contribution by normalizing to an unrelated extreme magnitude before mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...` + hardening `77dcf38c...` + current #488 `0299dda5...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | public RED `c5ec42e4...` + scaled repair `7499042f...` + current #488 `5db48883...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-046 | Bias standard error could reject a representable SEM because raw squared deviations, their sum, or an intermediate sample variance overflowed | `verification-pending` | public RED `7de0ef90...` + scaled direct-SEM repair `cad23162...` + edges `8a6cc346...` / `28d96c23...` + current #488 `5db48883...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-047 | Generic Validation Evidence RMSE/RMSE-SE could reject representable extreme recovery or collapse a representable/nonzero subnormal error to false perfect recovery because residuals were squared before scale normalization | `verification-pending` | extreme RED `dd41ff53...` + subnormal RED `f4e19991...` + repair `6b182107...` + current #488 `5db48883...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-048 | Validation Evidence mean signed bias could erase a representable subnormal residual contribution by normalizing to an unrelated extreme magnitude before mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...` + hardening `77dcf38c...` + current #488 `5db48883...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-049 | Stable `Between` recovery could be aliased across occasion indices, duplicating one unit-level scientific target and silently changing the RMSE denominator | `verification-pending` | RED `0a03041c...` + fixture repair `53563e97...` + admission repair `ec2c1219...` + trace `c9cb68d3...` + current #310 `c6680450...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-050 | Zero-multiplier SE-aware acceptance could scale a nonzero residual to exact zero and falsely accept exact recovery when a large finite SE dominated normalization | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...` + current research `c45a76cf...` + current #488 `0299dda5...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-051 | Exact-recovery SE acceptance used IEEE total ordering and therefore treated `-0.0` and `+0.0` as different scientific recovery values | `verification-pending` | signed-zero RED `379e6525...` + numeric-equality repair `55876e60...` + research `c45a76cf...` + current #488 `0299dda5...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-052 | All-covered Wilson score coverage could cancel a positive binary64-representable lower endpoint to exact zero by subtracting nearly equal center and margin terms | `verification-pending` | public RED `f84e5918...` + exact all-covered endpoint repair `fe9b9c8a...` + research `ff64f9a3...` + current #488 `0299dda5...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-050 | Zero-multiplier SE-aware acceptance could scale a nonzero residual to exact zero and falsely accept exact recovery when a large finite SE dominated normalization | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...` + current research `c45a76cf...` + current #488 `5db48883...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-051 | Exact-recovery SE acceptance used IEEE total ordering and therefore treated `-0.0` and `+0.0` as different scientific recovery values | `verification-pending` | signed-zero RED `379e6525...` + numeric-equality repair `55876e60...` + research `c45a76cf...` + current #488 `5db48883...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-052 | All-covered Wilson score coverage could cancel a positive binary64-representable lower endpoint to exact zero by subtracting nearly equal center and margin terms | `verification-pending` | public RED `f84e5918...` + exact all-covered endpoint repair `fe9b9c8a...` + current #488 `5db48883...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-053 | Strict-interior Wilson score coverage could cancel a positive binary64-representable lower endpoint to exact zero even after the all-covered endpoint specialization | `verification-pending` | public RED `9d45f482...` + rationalized lower-root repair `4f259f6e...` + release trace `2875ac5f...` + research/current #488 `5db48883...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | ## Release gate From 9badbe9aaaed797b80f5600c1e99b9839ea17ba0 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 4 Sep 2026 03:08:27 +0900 Subject: [PATCH 141/235] docs(ddd): track Wilson false-one upper endpoint --- docs/product-technical-gap-baseline.md | 31 ++++++++++++++------------ 1 file changed, 17 insertions(+), 14 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 848dae248..a7efc7b03 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,7 +4,7 @@ **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-03T17:03Z +**Snapshot:** 2026-09-03T18:08Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` @@ -34,7 +34,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `5db4888366ae4d61661c54b70fd0ab55a608dba4` | true | `main` | Validation Evidence numerical repair. Bias/RMSE/Monte Carlo retain representable extreme/subnormal evidence; zero-multiplier SE-aware acceptance is exact-recovery before scale reduction; signed IEEE zeros are one numeric exact-recovery value; all-covered and strict-interior Wilson lower endpoints avoid center-minus-margin cancellation when a positive representable bound would otherwise collapse to zero. Exact-head hosted gates and independent review remain required. | +| #488 | `5189b7c2bad59eee4e36f1e5ef0d40957b1d411b` | true | `main` | Validation Evidence numerical repair. Bias/RMSE/Monte Carlo retain representable extreme/subnormal evidence; zero-multiplier SE-aware acceptance is exact-recovery before scale reduction; signed IEEE zeros are one numeric exact-recovery value; Wilson lower and upper endpoints use algebraically equivalent stable forms only when direct binary64 evaluation would falsely promote an interior endpoint to exact 0/1. Exact-head hosted gates and independent review remain required. | | #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 `feat/copy-identity-analysis-run-gap-004` | Validation / Analysis Run fold child. Sparse observed relation classes are valid evidence; RED `a2892b6...`, repair `a6402015...`, predecessor-test correction `6b0c8de6...`; ADR 0079 is `Proposed`. No child-head CI transfers to #416. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | @@ -73,7 +73,7 @@ The clock contract separates event/valid time, assertion time, document time, sy - Monte Carlo mean/sample-SD/SE preserve representable uncertainty across full-range and subnormal replication values. Avoidable raw-product/Welford overflow or final false-zero uncertainty is not accepted as scientific evidence. - SE-aware acceptance is the declared rule `|estimate - target| <= k * SE`. For `k = 0`, the bound is exactly zero and exact recovery is evaluated before scale reduction; a large finite SE cannot erase a nonzero residual into acceptance. - Exact-recovery acceptance is finite numeric equality, not IEEE total-order identity. `-0.0` and `+0.0` therefore produce one zero-error decision while nonzero finite residuals remain distinct; this does not require blanket signed-zero canonicalization in private numerical intermediates. -- Wilson interval coverage evidence must preserve representable endpoints. All-covered lower bounds use `n / (n + z²)`. Strict-interior lower bounds use an algebraically rationalized, `z²`-normalized root when generic center-minus-margin evaluation collapses a positive representable endpoint to exact zero. +- Wilson interval coverage evidence must preserve representable endpoints. All-covered lower bounds use `n / (n + z²)`. Strict-interior lower bounds use an algebraically rationalized, `z²`-normalized root when generic center-minus-margin evaluation collapses a positive representable endpoint to exact zero. If direct `center + margin` rounds an upper endpoint to exact one while uncovered mass is nonzero, the complementary uncovered lower root is evaluated with the same stable representation and subtracted from one. - Bias, RMSE, and Monte Carlo may share private deterministic scalar support inside `validation_core`, but metric-specific cancellation/normalization, denominator, uncertainty, and fail-closed semantics remain with their bounded modules; support primitives are not second psychometric estimator authorities. - A mathematically nonzero scientific error metric must not be promoted to exact perfect recovery merely because its final binary64 representation underflows to zero. - Known-truth recovery denominators are defined by unique scientific component identity. Duplicate rows and stable-Between occasion aliases are not implicit weights unless a separately named weighted contract explicitly owns weighting. @@ -107,7 +107,7 @@ Current #310 exact-head workflows and a qualifying independent current-head appr ### #488 — Validation Evidence recovery arithmetic -#488 is the generic Validation Evidence landing vehicle at exact head `5db4888366ae4d61661c54b70fd0ab55a608dba4`. It remains distinct from Longitudinal Modeling and does not consume mutable fast-mlsirm source. +#488 is the generic Validation Evidence landing vehicle at exact head `5189b7c2bad59eee4e36f1e5ef0d40957b1d411b`. It remains distinct from Longitudinal Modeling and does not consume mutable fast-mlsirm source. Mean signed bias no longer depends on a raw finite sum that can overflow before division (`c5ec42e4...`→`7499042f...`). Full-range mixed-sign cancellation preserves representable low-order bias before scale reduction (`b6084750...`→`227921d9...`, hardening `77dcf38c...`). Bias SEM scales deviations before squaring and forms the final SEM without avoidable variance overflow (`7de0ef90...`→`cad23162...`, edges `8a6cc346...`/`28d96c23...`). @@ -119,9 +119,11 @@ Fresh review then found the exact branch itself used `f64::total_cmp`, which dis All-covered Wilson coverage exposed another representability defect. With one covered replication and finite `z = 1e154`, `z² = 1e308` remains finite and the all-covered lower score endpoint `n / (n + z²)` is about `1e-308`, still representable. The predecessor generic center-minus-margin form cancelled to exact zero. Public RED `f84e5918acc81ca8bf3708f3cce2004c67675b78`; causal repair `fe9b9c8a5b94a01cd8416efd613503569b98ac1a`. -Strict-interior Wilson coverage retained the same failure after the endpoint repair. With `n = 2`, one covered replication (`p̂ = 0.5`), and finite `z = 1e154`, the generic center and margin both round to `2.5e307`, collapsing the lower endpoint to exact zero even though the rationalized Wilson root is about `5e-309` and representable. Public RED `9d45f482854037d96d5dff38964fd3844335a39b`; causal repair `4f259f6e5c98ade2e4a34125430de872f32c1589`; release trace `2875ac5fe28cccbe8aab65baf0ace0d247cc52d3`; research/current #488 `5db4888366ae4d61661c54b70fd0ab55a608dba4`. +Strict-interior Wilson coverage retained the same lower-endpoint failure. With `n = 2`, one covered replication (`p̂ = 0.5`), and finite `z = 1e154`, the generic center and margin both round to `2.5e307`, collapsing the lower endpoint to exact zero even though the rationalized Wilson root is about `5e-309` and representable. Public RED `9d45f482854037d96d5dff38964fd3844335a39b`; causal repair `4f259f6e5c98ade2e4a34125430de872f32c1589`. -Morris, White, and Crowther (2019) remain the simulation performance-measure/Monte Carlo uncertainty methodology trace; Wilson (1927) remains the primary score-interval reference; IEEE/ISO/IEC 60559-2020 remains the published floating-point authority used for these binary64 regressions. Exact-head hosted Rust/documentation/security/supply-chain/100%-coverage gates and a qualifying independent current-head review remain required. +The complementary upper endpoint had the dual failure. With two uncovered replications and `z = 2^27`, the represented all-uncovered upper endpoint correctly rounds to `next_down(1.0)`, but the predecessor `center + margin` numerator and denominator rounded equal and returned exact `1.0`. Public RED `c070da269aa257fc9c9fa9eae17231a51ec63b74`; strict-interior expansion `344081bfd98ee9bc70a3bf8fdebc795a9090e692` reproduces the same false-one boundary with one covered replication out of eight and `z = 2^28`. Causal repair `9a2fdd05c2994f51f6c72030fe39e695ba5a876d` evaluates the rationalized positive lower root for the complementary uncovered proportion only when the direct upper path has reached exact one while uncovered mass remains. Changelog `c68076f565822ef9dd1e7c540d966cc29bf54191`; research/current #488 `5189b7c2bad59eee4e36f1e5ef0d40957b1d411b`. + +Morris, White, and Crowther (2019) remain the simulation performance-measure/Monte Carlo uncertainty methodology trace; Wilson (1927) remains the primary score-interval reference; IEEE/ISO/IEC 60559-2020 remains the active published floating-point authority used for these binary64 regressions. Exact-head hosted Rust/documentation/security/supply-chain/100%-coverage gates and a qualifying independent current-head review remain required. ### #416 — Validation / Analysis Run consolidation @@ -191,15 +193,16 @@ Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/num | GAP-042 | Ratio-first logarithm could nearly double an adjacent-float power-of-two irregular residual growth rate before event-time scaling | `verification-pending` | public RED `766ddc7a...` + causal `ln_1p` repair `16f21d9a...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-043 | Duplicate known-truth component identities could silently reweight RMSE recovery evidence by changing the denominator without adding a new scientific target | `verification-pending` | public RED `698f12f5...` + uniqueness repair `2fae4cb2...` + current trace `c9cb68d3...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-044 | Known-truth component RMSE alignment and deterministic binary64 accumulation depended on serialization row order rather than scientific component identity | `verification-pending` | cross-slice RED `8ad72ac9...` + alignment repair `2dd9537e...` + rounding RED `5fb93c40...` + canonical-order repair `025dce7f...` + edge `976ce7d7...` + current #310 `c6680450...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | public RED `c5ec42e4...` + scaled repair `7499042f...` + current #488 `5db48883...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-046 | Bias standard error could reject a representable SEM because raw squared deviations, their sum, or an intermediate sample variance overflowed | `verification-pending` | public RED `7de0ef90...` + scaled direct-SEM repair `cad23162...` + edges `8a6cc346...` / `28d96c23...` + current #488 `5db48883...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-047 | Generic Validation Evidence RMSE/RMSE-SE could reject representable extreme recovery or collapse a representable/nonzero subnormal error to false perfect recovery because residuals were squared before scale normalization | `verification-pending` | extreme RED `dd41ff53...` + subnormal RED `f4e19991...` + repair `6b182107...` + current #488 `5db48883...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-048 | Validation Evidence mean signed bias could erase a representable subnormal residual contribution by normalizing to an unrelated extreme magnitude before mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...` + hardening `77dcf38c...` + current #488 `5db48883...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | public RED `c5ec42e4...` + scaled repair `7499042f...` + current #488 `5189b7c2...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-046 | Bias standard error could reject a representable SEM because raw squared deviations, their sum, or an intermediate sample variance overflowed | `verification-pending` | public RED `7de0ef90...` + scaled direct-SEM repair `cad23162...` + edges `8a6cc346...` / `28d96c23...` + current #488 `5189b7c2...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-047 | Generic Validation Evidence RMSE/RMSE-SE could reject representable extreme recovery or collapse a representable/nonzero subnormal error to false perfect recovery because residuals were squared before scale normalization | `verification-pending` | extreme RED `dd41ff53...` + subnormal RED `f4e19991...` + repair `6b182107...` + current #488 `5189b7c2...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-048 | Validation Evidence mean signed bias could erase a representable subnormal residual contribution by normalizing to an unrelated extreme magnitude before mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...` + hardening `77dcf38c...` + current #488 `5189b7c2...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-049 | Stable `Between` recovery could be aliased across occasion indices, duplicating one unit-level scientific target and silently changing the RMSE denominator | `verification-pending` | RED `0a03041c...` + fixture repair `53563e97...` + admission repair `ec2c1219...` + trace `c9cb68d3...` + current #310 `c6680450...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-050 | Zero-multiplier SE-aware acceptance could scale a nonzero residual to exact zero and falsely accept exact recovery when a large finite SE dominated normalization | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...` + current research `c45a76cf...` + current #488 `5db48883...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-051 | Exact-recovery SE acceptance used IEEE total ordering and therefore treated `-0.0` and `+0.0` as different scientific recovery values | `verification-pending` | signed-zero RED `379e6525...` + numeric-equality repair `55876e60...` + research `c45a76cf...` + current #488 `5db48883...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-052 | All-covered Wilson score coverage could cancel a positive binary64-representable lower endpoint to exact zero by subtracting nearly equal center and margin terms | `verification-pending` | public RED `f84e5918...` + exact all-covered endpoint repair `fe9b9c8a...` + current #488 `5db48883...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-053 | Strict-interior Wilson score coverage could cancel a positive binary64-representable lower endpoint to exact zero even after the all-covered endpoint specialization | `verification-pending` | public RED `9d45f482...` + rationalized lower-root repair `4f259f6e...` + release trace `2875ac5f...` + research/current #488 `5db48883...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-050 | Zero-multiplier SE-aware acceptance could scale a nonzero residual to exact zero and falsely accept exact recovery when a large finite SE dominated normalization | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...` + current research `c45a76cf...` + current #488 `5189b7c2...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-051 | Exact-recovery SE acceptance used IEEE total ordering and therefore treated `-0.0` and `+0.0` as different scientific recovery values | `verification-pending` | signed-zero RED `379e6525...` + numeric-equality repair `55876e60...` + research `c45a76cf...` + current #488 `5189b7c2...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-052 | All-covered Wilson score coverage could cancel a positive binary64-representable lower endpoint to exact zero by subtracting nearly equal center and margin terms | `verification-pending` | public RED `f84e5918...` + exact all-covered endpoint repair `fe9b9c8a...` + current #488 `5189b7c2...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-053 | Strict-interior Wilson score coverage could cancel a positive binary64-representable lower endpoint to exact zero even after the all-covered endpoint specialization | `verification-pending` | public RED `9d45f482...` + rationalized lower-root repair `4f259f6e...` + release trace `2875ac5f...` + research/current #488 `5189b7c2...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-054 | Wilson score coverage could falsely promote an all-uncovered or strict-interior upper endpoint to exact `1.0` when `center + margin` and the denominator rounded to the same binary64 value | `verification-pending` | all-uncovered RED `c070da26...` + strict-interior RED expansion `344081bf...` + complementary rationalized repair `9a2fdd05...` + changelog `c68076f5...` + research/current #488 `5189b7c2...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | ## Release gate From ff7f8eb2bd948e281ae3be05fc4ce34b84ad736d Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 4 Sep 2026 04:06:29 +0900 Subject: [PATCH 142/235] docs(gap): record Wilson nonzero cancellation residue --- docs/product-technical-gap-baseline.md | 35 ++++++++++++++------------ 1 file changed, 19 insertions(+), 16 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index a7efc7b03..a940942b6 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,7 +4,7 @@ **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-03T18:08Z +**Snapshot:** 2026-09-03T19:01Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` @@ -34,7 +34,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `5189b7c2bad59eee4e36f1e5ef0d40957b1d411b` | true | `main` | Validation Evidence numerical repair. Bias/RMSE/Monte Carlo retain representable extreme/subnormal evidence; zero-multiplier SE-aware acceptance is exact-recovery before scale reduction; signed IEEE zeros are one numeric exact-recovery value; Wilson lower and upper endpoints use algebraically equivalent stable forms only when direct binary64 evaluation would falsely promote an interior endpoint to exact 0/1. Exact-head hosted gates and independent review remain required. | +| #488 | `51558008cf611eab6280c3b8e1793c0bd9bd4553` | true | `main` | Validation Evidence numerical repair. Bias/RMSE/Monte Carlo retain representable extreme/subnormal evidence; zero-multiplier SE-aware acceptance is exact-recovery before scale reduction; signed IEEE zeros are one numeric exact-recovery value. Every nonzero strict-interior Wilson lower endpoint now uses one algebraically rationalized positive root with a scale-aware binary64 evaluation, so both exact-zero collapse and nonzero cancellation residue are excluded. Complementary upper repair remains conditional on false exact one. Exact-head hosted gates and independent review remain required. | | #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 `feat/copy-identity-analysis-run-gap-004` | Validation / Analysis Run fold child. Sparse observed relation classes are valid evidence; RED `a2892b6...`, repair `a6402015...`, predecessor-test correction `6b0c8de6...`; ADR 0079 is `Proposed`. No child-head CI transfers to #416. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | @@ -66,14 +66,14 @@ The clock contract separates event/valid time, assertion time, document time, sy - Occasion-mean deviations `p_it = x_it - μ_t` are not CWC residuals, sample-wide grand-mean residuals, or RI-CLPM within-person effects. Numeric event time defines occasion identity, so `-0.0` and `+0.0` are one occasion. - Row arrival order is not scientific evidence. Fixed admitted observations must produce bit-identical means/centered results under permutation wherever the contract claims deterministic CPU `f64` reference behavior. - Known-truth component recovery follows bounded-context identity: stable `Between` is unit-level and uses canonical `occasion_index = 0`; `Within` retains actual `(unit, occasion)` identity. Duplicate identities or stable-Between occasion aliases are not weights. Admitted identities accumulate in canonical order. -- A representable final scientific estimand is not rejected solely because an avoidable intermediate binary64 operation overflows/underflows. False exact 0/1/non-finite endpoints remain fail-closed when the mathematical estimand is interior/nonzero. +- A representable final scientific estimand is not rejected solely because an avoidable intermediate binary64 operation overflows/underflows. False exact 0/1/non-finite endpoints and cancellation residues are not accepted when an algebraically equivalent stable form preserves the represented estimand. - Mean signed bias is a Validation Evidence performance measure over admitted recovery units. Opposite-sign represented residuals cancel before scale reduction; a representable low-order bias must survive cancellation of unrelated extreme terms. Exact cancellation remains zero, while a mathematically nonzero bias below binary64 range fails closed. - Bias standard error is formed from the same admitted signed differences. A representable SEM must not fail solely because raw squared deviations, their sum, or an intermediate sample variance overflows. - Generic Validation Evidence RMSE and its delta-method standard error normalize finite residual magnitudes before squaring. A representable extreme or minimum-subnormal RMSE must survive avoidable intermediate overflow/underflow, while a mathematically nonzero final RMSE or SE below the binary64 range fails closed. - Monte Carlo mean/sample-SD/SE preserve representable uncertainty across full-range and subnormal replication values. Avoidable raw-product/Welford overflow or final false-zero uncertainty is not accepted as scientific evidence. - SE-aware acceptance is the declared rule `|estimate - target| <= k * SE`. For `k = 0`, the bound is exactly zero and exact recovery is evaluated before scale reduction; a large finite SE cannot erase a nonzero residual into acceptance. - Exact-recovery acceptance is finite numeric equality, not IEEE total-order identity. `-0.0` and `+0.0` therefore produce one zero-error decision while nonzero finite residuals remain distinct; this does not require blanket signed-zero canonicalization in private numerical intermediates. -- Wilson interval coverage evidence must preserve representable endpoints. All-covered lower bounds use `n / (n + z²)`. Strict-interior lower bounds use an algebraically rationalized, `z²`-normalized root when generic center-minus-margin evaluation collapses a positive representable endpoint to exact zero. If direct `center + margin` rounds an upper endpoint to exact one while uncovered mass is nonzero, the complementary uncovered lower root is evaluated with the same stable representation and subtracted from one. +- Wilson interval coverage evidence must preserve representable endpoints. All-covered lower bounds use `n / (n + z²)`. Every nonzero strict-interior lower bound uses the algebraically rationalized positive root; the implementation evaluates it on natural scale for `z² < 1` and on `z²`-normalized scale for `z² >= 1`. Thus neither exact-zero collapse nor a nonzero `center - margin` cancellation residue is accepted as the endpoint. If direct `center + margin` rounds an upper endpoint to exact one while uncovered mass is nonzero, the complementary uncovered lower root is evaluated with the same stable representation and subtracted from one. - Bias, RMSE, and Monte Carlo may share private deterministic scalar support inside `validation_core`, but metric-specific cancellation/normalization, denominator, uncertainty, and fail-closed semantics remain with their bounded modules; support primitives are not second psychometric estimator authorities. - A mathematically nonzero scientific error metric must not be promoted to exact perfect recovery merely because its final binary64 representation underflows to zero. - Known-truth recovery denominators are defined by unique scientific component identity. Duplicate rows and stable-Between occasion aliases are not implicit weights unless a separately named weighted contract explicitly owns weighting. @@ -107,7 +107,7 @@ Current #310 exact-head workflows and a qualifying independent current-head appr ### #488 — Validation Evidence recovery arithmetic -#488 is the generic Validation Evidence landing vehicle at exact head `5189b7c2bad59eee4e36f1e5ef0d40957b1d411b`. It remains distinct from Longitudinal Modeling and does not consume mutable fast-mlsirm source. +#488 is the generic Validation Evidence landing vehicle at exact head `51558008cf611eab6280c3b8e1793c0bd9bd4553`. It remains distinct from Longitudinal Modeling and does not consume mutable fast-mlsirm source. Mean signed bias no longer depends on a raw finite sum that can overflow before division (`c5ec42e4...`→`7499042f...`). Full-range mixed-sign cancellation preserves representable low-order bias before scale reduction (`b6084750...`→`227921d9...`, hardening `77dcf38c...`). Bias SEM scales deviations before squaring and forms the final SEM without avoidable variance overflow (`7de0ef90...`→`cad23162...`, edges `8a6cc346...`/`28d96c23...`). @@ -119,9 +119,11 @@ Fresh review then found the exact branch itself used `f64::total_cmp`, which dis All-covered Wilson coverage exposed another representability defect. With one covered replication and finite `z = 1e154`, `z² = 1e308` remains finite and the all-covered lower score endpoint `n / (n + z²)` is about `1e-308`, still representable. The predecessor generic center-minus-margin form cancelled to exact zero. Public RED `f84e5918acc81ca8bf3708f3cce2004c67675b78`; causal repair `fe9b9c8a5b94a01cd8416efd613503569b98ac1a`. -Strict-interior Wilson coverage retained the same lower-endpoint failure. With `n = 2`, one covered replication (`p̂ = 0.5`), and finite `z = 1e154`, the generic center and margin both round to `2.5e307`, collapsing the lower endpoint to exact zero even though the rationalized Wilson root is about `5e-309` and representable. Public RED `9d45f482854037d96d5dff38964fd3844335a39b`; causal repair `4f259f6e5c98ade2e4a34125430de872f32c1589`. +Strict-interior Wilson coverage retained the same exact-zero lower-endpoint failure. With `n = 2`, one covered replication (`p̂ = 0.5`), and finite `z = 1e154`, the generic center and margin both round to `2.5e307`, collapsing the lower endpoint to exact zero even though the rationalized Wilson root is about `5e-309` and representable. Public RED `9d45f482854037d96d5dff38964fd3844335a39b`; initial rationalized repair `4f259f6e5c98ade2e4a34125430de872f32c1589`. -The complementary upper endpoint had the dual failure. With two uncovered replications and `z = 2^27`, the represented all-uncovered upper endpoint correctly rounds to `next_down(1.0)`, but the predecessor `center + margin` numerator and denominator rounded equal and returned exact `1.0`. Public RED `c070da269aa257fc9c9fa9eae17231a51ec63b74`; strict-interior expansion `344081bfd98ee9bc70a3bf8fdebc795a9090e692` reproduces the same false-one boundary with one covered replication out of eight and `z = 2^28`. Causal repair `9a2fdd05c2994f51f6c72030fe39e695ba5a876d` evaluates the rationalized positive lower root for the complementary uncovered proportion only when the direct upper path has reached exact one while uncovered mass remains. Changelog `c68076f565822ef9dd1e7c540d966cc29bf54191`; research/current #488 `5189b7c2bad59eee4e36f1e5ef0d40957b1d411b`. +The exact-zero fallback was still insufficient because catastrophic cancellation can leave a nonzero floating-point residue. With `n = 3`, one covered replication (`p̂ = 1/3`), and `z = 1e11`, binary64 `center - margin` leaves `262144`, producing a lower endpoint near `7.86432e-17`; the algebraically equivalent rationalized endpoint is near `3.3333333333333333e-23`, exactly 2,359,296 times smaller. Public RED `1a24fac71569334b0c0185d013574ec5ccdcc58d`; causal repair `f7e20ddc59399f2e014a3ac91809bb57ba73460f` makes the rationalized positive lower root authoritative for every nonzero strict-interior lower endpoint. It uses natural scale when `z² < 1` and `z²`-normalized scale otherwise. Small-`z` edge/oracle reinforcement `39e5e087cba22d6df85b9ad5901cda0194e3da93`; changelog `2dbdf330af21ea6263fd5d03eb6cb8defa867254`; research/current #488 `51558008cf611eab6280c3b8e1793c0bd9bd4553`. + +The complementary upper endpoint had the dual false-one failure. With two uncovered replications and `z = 2^27`, the represented all-uncovered upper endpoint correctly rounds to `next_down(1.0)`, but the predecessor `center + margin` numerator and denominator rounded equal and returned exact `1.0`. Public RED `c070da269aa257fc9c9fa9eae17231a51ec63b74`; strict-interior expansion `344081bfd98ee9bc70a3bf8fdebc795a9090e692` reproduces the same false-one boundary with one covered replication out of eight and `z = 2^28`. Causal repair `9a2fdd05c2994f51f6c72030fe39e695ba5a876d` evaluates the rationalized positive lower root for the complementary uncovered proportion only when the direct upper path has reached exact one while uncovered mass remains. Morris, White, and Crowther (2019) remain the simulation performance-measure/Monte Carlo uncertainty methodology trace; Wilson (1927) remains the primary score-interval reference; IEEE/ISO/IEC 60559-2020 remains the active published floating-point authority used for these binary64 regressions. Exact-head hosted Rust/documentation/security/supply-chain/100%-coverage gates and a qualifying independent current-head review remain required. @@ -193,16 +195,17 @@ Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/num | GAP-042 | Ratio-first logarithm could nearly double an adjacent-float power-of-two irregular residual growth rate before event-time scaling | `verification-pending` | public RED `766ddc7a...` + causal `ln_1p` repair `16f21d9a...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-043 | Duplicate known-truth component identities could silently reweight RMSE recovery evidence by changing the denominator without adding a new scientific target | `verification-pending` | public RED `698f12f5...` + uniqueness repair `2fae4cb2...` + current trace `c9cb68d3...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-044 | Known-truth component RMSE alignment and deterministic binary64 accumulation depended on serialization row order rather than scientific component identity | `verification-pending` | cross-slice RED `8ad72ac9...` + alignment repair `2dd9537e...` + rounding RED `5fb93c40...` + canonical-order repair `025dce7f...` + edge `976ce7d7...` + current #310 `c6680450...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | public RED `c5ec42e4...` + scaled repair `7499042f...` + current #488 `5189b7c2...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-046 | Bias standard error could reject a representable SEM because raw squared deviations, their sum, or an intermediate sample variance overflowed | `verification-pending` | public RED `7de0ef90...` + scaled direct-SEM repair `cad23162...` + edges `8a6cc346...` / `28d96c23...` + current #488 `5189b7c2...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-047 | Generic Validation Evidence RMSE/RMSE-SE could reject representable extreme recovery or collapse a representable/nonzero subnormal error to false perfect recovery because residuals were squared before scale normalization | `verification-pending` | extreme RED `dd41ff53...` + subnormal RED `f4e19991...` + repair `6b182107...` + current #488 `5189b7c2...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-048 | Validation Evidence mean signed bias could erase a representable subnormal residual contribution by normalizing to an unrelated extreme magnitude before mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...` + hardening `77dcf38c...` + current #488 `5189b7c2...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | public RED `c5ec42e4...` + scaled repair `7499042f...` + current #488 `51558008...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-046 | Bias standard error could reject a representable SEM because raw squared deviations, their sum, or an intermediate sample variance overflowed | `verification-pending` | public RED `7de0ef90...` + scaled direct-SEM repair `cad23162...` + edges `8a6cc346...` / `28d96c23...` + current #488 `51558008...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-047 | Generic Validation Evidence RMSE/RMSE-SE could reject representable extreme recovery or collapse a representable/nonzero subnormal error to false perfect recovery because residuals were squared before scale normalization | `verification-pending` | extreme RED `dd41ff53...` + subnormal RED `f4e19991...` + repair `6b182107...` + current #488 `51558008...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-048 | Validation Evidence mean signed bias could erase a representable subnormal residual contribution by normalizing to an unrelated extreme magnitude before mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...` + hardening `77dcf38c...` + current #488 `51558008...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-049 | Stable `Between` recovery could be aliased across occasion indices, duplicating one unit-level scientific target and silently changing the RMSE denominator | `verification-pending` | RED `0a03041c...` + fixture repair `53563e97...` + admission repair `ec2c1219...` + trace `c9cb68d3...` + current #310 `c6680450...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-050 | Zero-multiplier SE-aware acceptance could scale a nonzero residual to exact zero and falsely accept exact recovery when a large finite SE dominated normalization | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...` + current research `c45a76cf...` + current #488 `5189b7c2...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-051 | Exact-recovery SE acceptance used IEEE total ordering and therefore treated `-0.0` and `+0.0` as different scientific recovery values | `verification-pending` | signed-zero RED `379e6525...` + numeric-equality repair `55876e60...` + research `c45a76cf...` + current #488 `5189b7c2...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-052 | All-covered Wilson score coverage could cancel a positive binary64-representable lower endpoint to exact zero by subtracting nearly equal center and margin terms | `verification-pending` | public RED `f84e5918...` + exact all-covered endpoint repair `fe9b9c8a...` + current #488 `5189b7c2...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-053 | Strict-interior Wilson score coverage could cancel a positive binary64-representable lower endpoint to exact zero even after the all-covered endpoint specialization | `verification-pending` | public RED `9d45f482...` + rationalized lower-root repair `4f259f6e...` + release trace `2875ac5f...` + research/current #488 `5189b7c2...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-054 | Wilson score coverage could falsely promote an all-uncovered or strict-interior upper endpoint to exact `1.0` when `center + margin` and the denominator rounded to the same binary64 value | `verification-pending` | all-uncovered RED `c070da26...` + strict-interior RED expansion `344081bf...` + complementary rationalized repair `9a2fdd05...` + changelog `c68076f5...` + research/current #488 `5189b7c2...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-050 | Zero-multiplier SE-aware acceptance could scale a nonzero residual to exact zero and falsely accept exact recovery when a large finite SE dominated normalization | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...` + current research `c45a76cf...` + current #488 `51558008...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-051 | Exact-recovery SE acceptance used IEEE total ordering and therefore treated `-0.0` and `+0.0` as different scientific recovery values | `verification-pending` | signed-zero RED `379e6525...` + numeric-equality repair `55876e60...` + research `c45a76cf...` + current #488 `51558008...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-052 | All-covered Wilson score coverage could cancel a positive binary64-representable lower endpoint to exact zero by subtracting nearly equal center and margin terms | `verification-pending` | public RED `f84e5918...` + exact all-covered endpoint repair `fe9b9c8a...` + current #488 `51558008...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-053 | Strict-interior Wilson score coverage could cancel a positive binary64-representable lower endpoint to exact zero even after the all-covered endpoint specialization | `verification-pending` | public RED `9d45f482...` + initial rationalized lower-root repair `4f259f6e...` + current #488 `51558008...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-054 | Wilson score coverage could falsely promote an all-uncovered or strict-interior upper endpoint to exact `1.0` when `center + margin` and the denominator rounded to the same binary64 value | `verification-pending` | all-uncovered RED `c070da26...` + strict-interior RED expansion `344081bf...` + complementary rationalized repair `9a2fdd05...` + current #488 `51558008...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-055 | Strict-interior Wilson score coverage could accept a nonzero `center - margin` cancellation residue as the scientific lower endpoint, overstating a representable endpoint by orders of magnitude even though the subtraction did not collapse to zero | `verification-pending` | public RED `1a24fac7...` + scale-aware rationalized-lower repair `f7e20ddc...` + small-`z` reinforcement `39e5e087...` + changelog `2dbdf330...` + research/current #488 `51558008...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | ## Release gate From cd754af631ad544a7e799e4c8a842ab884a33aa7 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 4 Sep 2026 05:11:01 +0900 Subject: [PATCH 143/235] docs(product): add validation report evidence gap --- docs/product-technical-gap-baseline.md | 36 ++++++++++++++------------ 1 file changed, 20 insertions(+), 16 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index a940942b6..f00bcc3c9 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,7 +4,7 @@ **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-03T19:01Z +**Snapshot:** 2026-09-03T20:08Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` @@ -34,7 +34,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `51558008cf611eab6280c3b8e1793c0bd9bd4553` | true | `main` | Validation Evidence numerical repair. Bias/RMSE/Monte Carlo retain representable extreme/subnormal evidence; zero-multiplier SE-aware acceptance is exact-recovery before scale reduction; signed IEEE zeros are one numeric exact-recovery value. Every nonzero strict-interior Wilson lower endpoint now uses one algebraically rationalized positive root with a scale-aware binary64 evaluation, so both exact-zero collapse and nonzero cancellation residue are excluded. Complementary upper repair remains conditional on false exact one. Exact-head hosted gates and independent review remain required. | +| #488 | `91712f7521fded895d50d97080a307ceb96cf6b8` | true | `main` | Validation Evidence numerical/artifact repair. Bias/RMSE/Monte Carlo retain representable extreme/subnormal evidence; zero-multiplier SE-aware acceptance is exact-recovery before scale reduction; signed IEEE zeros are one numeric exact-recovery value. Wilson endpoints use stable represented roots where direct evaluation loses the estimand. `ValidationReport` now enforces metric domains and Wilson coherence on explicit validation plus serde ingress/egress, so finite but scientifically impossible tuples cannot become durable evidence. Exact-head hosted gates and independent review remain required. | | #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 `feat/copy-identity-analysis-run-gap-004` | Validation / Analysis Run fold child. Sparse observed relation classes are valid evidence; RED `a2892b6...`, repair `a6402015...`, predecessor-test correction `6b0c8de6...`; ADR 0079 is `Proposed`. No child-head CI transfers to #416. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | @@ -74,6 +74,7 @@ The clock contract separates event/valid time, assertion time, document time, sy - SE-aware acceptance is the declared rule `|estimate - target| <= k * SE`. For `k = 0`, the bound is exactly zero and exact recovery is evaluated before scale reduction; a large finite SE cannot erase a nonzero residual into acceptance. - Exact-recovery acceptance is finite numeric equality, not IEEE total-order identity. `-0.0` and `+0.0` therefore produce one zero-error decision while nonzero finite residuals remain distinct; this does not require blanket signed-zero canonicalization in private numerical intermediates. - Wilson interval coverage evidence must preserve representable endpoints. All-covered lower bounds use `n / (n + z²)`. Every nonzero strict-interior lower bound uses the algebraically rationalized positive root; the implementation evaluates it on natural scale for `z² < 1` and on `z²`-normalized scale for `z² >= 1`. Thus neither exact-zero collapse nor a nonzero `center - margin` cancellation residue is accepted as the endpoint. If direct `center + margin` rounds an upper endpoint to exact one while uncovered mass is nonzero, the complementary uncovered lower root is evaluated with the same stable representation and subtracted from one. +- Durable `ValidationReport` evidence must preserve the producing metrics' scientific domains, not merely binary64 finiteness. RMSE/SE fields are nonnegative, probability/accuracy fields remain in `[0,1]`, Wilson endpoints are ordered and contain the paired empirical coverage, and the same invariants apply to explicit validation plus direct serde ingress/egress. - Bias, RMSE, and Monte Carlo may share private deterministic scalar support inside `validation_core`, but metric-specific cancellation/normalization, denominator, uncertainty, and fail-closed semantics remain with their bounded modules; support primitives are not second psychometric estimator authorities. - A mathematically nonzero scientific error metric must not be promoted to exact perfect recovery merely because its final binary64 representation underflows to zero. - Known-truth recovery denominators are defined by unique scientific component identity. Duplicate rows and stable-Between occasion aliases are not implicit weights unless a separately named weighted contract explicitly owns weighting. @@ -107,7 +108,7 @@ Current #310 exact-head workflows and a qualifying independent current-head appr ### #488 — Validation Evidence recovery arithmetic -#488 is the generic Validation Evidence landing vehicle at exact head `51558008cf611eab6280c3b8e1793c0bd9bd4553`. It remains distinct from Longitudinal Modeling and does not consume mutable fast-mlsirm source. +#488 is the generic Validation Evidence landing vehicle at exact head `91712f7521fded895d50d97080a307ceb96cf6b8`. It remains distinct from Longitudinal Modeling and does not consume mutable fast-mlsirm source. Mean signed bias no longer depends on a raw finite sum that can overflow before division (`c5ec42e4...`→`7499042f...`). Full-range mixed-sign cancellation preserves representable low-order bias before scale reduction (`b6084750...`→`227921d9...`, hardening `77dcf38c...`). Bias SEM scales deviations before squaring and forms the final SEM without avoidable variance overflow (`7de0ef90...`→`cad23162...`, edges `8a6cc346...`/`28d96c23...`). @@ -121,11 +122,13 @@ All-covered Wilson coverage exposed another representability defect. With one co Strict-interior Wilson coverage retained the same exact-zero lower-endpoint failure. With `n = 2`, one covered replication (`p̂ = 0.5`), and finite `z = 1e154`, the generic center and margin both round to `2.5e307`, collapsing the lower endpoint to exact zero even though the rationalized Wilson root is about `5e-309` and representable. Public RED `9d45f482854037d96d5dff38964fd3844335a39b`; initial rationalized repair `4f259f6e5c98ade2e4a34125430de872f32c1589`. -The exact-zero fallback was still insufficient because catastrophic cancellation can leave a nonzero floating-point residue. With `n = 3`, one covered replication (`p̂ = 1/3`), and `z = 1e11`, binary64 `center - margin` leaves `262144`, producing a lower endpoint near `7.86432e-17`; the algebraically equivalent rationalized endpoint is near `3.3333333333333333e-23`, exactly 2,359,296 times smaller. Public RED `1a24fac71569334b0c0185d013574ec5ccdcc58d`; causal repair `f7e20ddc59399f2e014a3ac91809bb57ba73460f` makes the rationalized positive lower root authoritative for every nonzero strict-interior lower endpoint. It uses natural scale when `z² < 1` and `z²`-normalized scale otherwise. Small-`z` edge/oracle reinforcement `39e5e087cba22d6df85b9ad5901cda0194e3da93`; changelog `2dbdf330af21ea6263fd5d03eb6cb8defa867254`; research/current #488 `51558008cf611eab6280c3b8e1793c0bd9bd4553`. +The exact-zero fallback was still insufficient because catastrophic cancellation can leave a nonzero floating-point residue. With `n = 3`, one covered replication (`p̂ = 1/3`), and `z = 1e11`, binary64 `center - margin` leaves `262144`, producing a lower endpoint near `7.86432e-17`; the algebraically equivalent rationalized endpoint is near `3.3333333333333333e-23`, exactly 2,359,296 times smaller. Public RED `1a24fac71569334b0c0185d013574ec5ccdcc58d`; causal repair `f7e20ddc59399f2e014a3ac91809bb57ba73460f` makes the rationalized positive lower root authoritative for every nonzero strict-interior lower endpoint. It uses natural scale when `z² < 1` and `z²`-normalized scale otherwise. Small-`z` edge/oracle reinforcement `39e5e087cba22d6df85b9ad5901cda0194e3da93`. The complementary upper endpoint had the dual false-one failure. With two uncovered replications and `z = 2^27`, the represented all-uncovered upper endpoint correctly rounds to `next_down(1.0)`, but the predecessor `center + margin` numerator and denominator rounded equal and returned exact `1.0`. Public RED `c070da269aa257fc9c9fa9eae17231a51ec63b74`; strict-interior expansion `344081bfd98ee9bc70a3bf8fdebc795a9090e692` reproduces the same false-one boundary with one covered replication out of eight and `z = 2^28`. Causal repair `9a2fdd05c2994f51f6c72030fe39e695ba5a876d` evaluates the rationalized positive lower root for the complementary uncovered proportion only when the direct upper path has reached exact one while uncovered mass remains. -Morris, White, and Crowther (2019) remain the simulation performance-measure/Monte Carlo uncertainty methodology trace; Wilson (1927) remains the primary score-interval reference; IEEE/ISO/IEC 60559-2020 remains the active published floating-point authority used for these binary64 regressions. Exact-head hosted Rust/documentation/security/supply-chain/100%-coverage gates and a qualifying independent current-head review remain required. +Durable report admission then exposed a separate Validation Evidence defect: finite scalar representation was treated as sufficient scientific validity. Public RED `e9414e6f7b824c2dc508f335d355b97b7e399b9` rejects negative RMSE/SE, out-of-domain probabilities, inverted Wilson bounds, and coverage outside its paired Wilson interval; repair `28924b0d82bc2d4663f5ba1317cc0c3d94a4833b` enforces those invariants. Serde ingress RED `6d190cd783a00f8ce917e37b63ae87053a929ae1` and repair `f70a6fc0e58c2ae419c3b3bac322db5f35efe538` close deserialization bypass. Direct-serde egress RED `fb28f959297a50cf50e26ea14dc9bfb5ee10ea89` and repair `f7e58ccdb1864ce775ef6797f7fd88596dff1269` close alternate serialization. Changelog `5339d539...`; research/current #488 `91712f75...`. + +Morris, White, and Crowther (2019) remain the simulation performance-measure/Monte Carlo uncertainty methodology trace; Wilson (1927) remains the primary score-interval reference. AERA/APA/NCME (2014) remains the current published testing-standards edition while revision is underway, and ISO/IEC 25012:2008 remains current after its 2025 review as structured-data-quality support. Exact-head hosted Rust/documentation/security/supply-chain/100%-coverage gates and a qualifying independent current-head review remain required. ### #416 — Validation / Analysis Run consolidation @@ -195,18 +198,19 @@ Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/num | GAP-042 | Ratio-first logarithm could nearly double an adjacent-float power-of-two irregular residual growth rate before event-time scaling | `verification-pending` | public RED `766ddc7a...` + causal `ln_1p` repair `16f21d9a...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-043 | Duplicate known-truth component identities could silently reweight RMSE recovery evidence by changing the denominator without adding a new scientific target | `verification-pending` | public RED `698f12f5...` + uniqueness repair `2fae4cb2...` + current trace `c9cb68d3...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-044 | Known-truth component RMSE alignment and deterministic binary64 accumulation depended on serialization row order rather than scientific component identity | `verification-pending` | cross-slice RED `8ad72ac9...` + alignment repair `2dd9537e...` + rounding RED `5fb93c40...` + canonical-order repair `025dce7f...` + edge `976ce7d7...` + current #310 `c6680450...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | public RED `c5ec42e4...` + scaled repair `7499042f...` + current #488 `51558008...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-046 | Bias standard error could reject a representable SEM because raw squared deviations, their sum, or an intermediate sample variance overflowed | `verification-pending` | public RED `7de0ef90...` + scaled direct-SEM repair `cad23162...` + edges `8a6cc346...` / `28d96c23...` + current #488 `51558008...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-047 | Generic Validation Evidence RMSE/RMSE-SE could reject representable extreme recovery or collapse a representable/nonzero subnormal error to false perfect recovery because residuals were squared before scale normalization | `verification-pending` | extreme RED `dd41ff53...` + subnormal RED `f4e19991...` + repair `6b182107...` + current #488 `51558008...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-048 | Validation Evidence mean signed bias could erase a representable subnormal residual contribution by normalizing to an unrelated extreme magnitude before mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...` + hardening `77dcf38c...` + current #488 `51558008...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | public RED `c5ec42e4...` + scaled repair `7499042f...` + current #488 `91712f75...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-046 | Bias standard error could reject a representable SEM because raw squared deviations, their sum, or an intermediate sample variance overflowed | `verification-pending` | public RED `7de0ef90...` + scaled direct-SEM repair `cad23162...` + edges `8a6cc346...` / `28d96c23...` + current #488 `91712f75...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-047 | Generic Validation Evidence RMSE/RMSE-SE could reject representable extreme recovery or collapse a representable/nonzero subnormal error to false perfect recovery because residuals were squared before scale normalization | `verification-pending` | extreme RED `dd41ff53...` + subnormal RED `f4e19991...` + repair `6b182107...` + current #488 `91712f75...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-048 | Validation Evidence mean signed bias could erase a representable subnormal residual contribution by normalizing to an unrelated extreme magnitude before mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...` + hardening `77dcf38c...` + current #488 `91712f75...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-049 | Stable `Between` recovery could be aliased across occasion indices, duplicating one unit-level scientific target and silently changing the RMSE denominator | `verification-pending` | RED `0a03041c...` + fixture repair `53563e97...` + admission repair `ec2c1219...` + trace `c9cb68d3...` + current #310 `c6680450...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-050 | Zero-multiplier SE-aware acceptance could scale a nonzero residual to exact zero and falsely accept exact recovery when a large finite SE dominated normalization | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...` + current research `c45a76cf...` + current #488 `51558008...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-051 | Exact-recovery SE acceptance used IEEE total ordering and therefore treated `-0.0` and `+0.0` as different scientific recovery values | `verification-pending` | signed-zero RED `379e6525...` + numeric-equality repair `55876e60...` + research `c45a76cf...` + current #488 `51558008...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-052 | All-covered Wilson score coverage could cancel a positive binary64-representable lower endpoint to exact zero by subtracting nearly equal center and margin terms | `verification-pending` | public RED `f84e5918...` + exact all-covered endpoint repair `fe9b9c8a...` + current #488 `51558008...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-053 | Strict-interior Wilson score coverage could cancel a positive binary64-representable lower endpoint to exact zero even after the all-covered endpoint specialization | `verification-pending` | public RED `9d45f482...` + initial rationalized lower-root repair `4f259f6e...` + current #488 `51558008...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-054 | Wilson score coverage could falsely promote an all-uncovered or strict-interior upper endpoint to exact `1.0` when `center + margin` and the denominator rounded to the same binary64 value | `verification-pending` | all-uncovered RED `c070da26...` + strict-interior RED expansion `344081bf...` + complementary rationalized repair `9a2fdd05...` + current #488 `51558008...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-055 | Strict-interior Wilson score coverage could accept a nonzero `center - margin` cancellation residue as the scientific lower endpoint, overstating a representable endpoint by orders of magnitude even though the subtraction did not collapse to zero | `verification-pending` | public RED `1a24fac7...` + scale-aware rationalized-lower repair `f7e20ddc...` + small-`z` reinforcement `39e5e087...` + changelog `2dbdf330...` + research/current #488 `51558008...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-050 | Zero-multiplier SE-aware acceptance could scale a nonzero residual to exact zero and falsely accept exact recovery when a large finite SE dominated normalization | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...` + current research `c45a76cf...` + current #488 `91712f75...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-051 | Exact-recovery SE acceptance used IEEE total ordering and therefore treated `-0.0` and `+0.0` as different scientific recovery values | `verification-pending` | signed-zero RED `379e6525...` + numeric-equality repair `55876e60...` + research `c45a76cf...` + current #488 `91712f75...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-052 | All-covered Wilson score coverage could cancel a positive binary64-representable lower endpoint to exact zero by subtracting nearly equal center and margin terms | `verification-pending` | public RED `f84e5918...` + exact all-covered endpoint repair `fe9b9c8a...` + current #488 `91712f75...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-053 | Strict-interior Wilson score coverage could cancel a positive binary64-representable lower endpoint to exact zero even after the all-covered endpoint specialization | `verification-pending` | public RED `9d45f482...` + initial rationalized lower-root repair `4f259f6e...` + current #488 `91712f75...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-054 | Wilson score coverage could falsely promote an all-uncovered or strict-interior upper endpoint to exact `1.0` when `center + margin` and the denominator rounded to the same binary64 value | `verification-pending` | all-uncovered RED `c070da26...` + strict-interior RED expansion `344081bf...` + complementary rationalized repair `9a2fdd05...` + current #488 `91712f75...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-055 | Strict-interior Wilson score coverage could accept a nonzero `center - margin` cancellation residue as the scientific lower endpoint, overstating a representable endpoint by orders of magnitude even though the subtraction did not collapse to zero | `verification-pending` | public RED `1a24fac7...` + scale-aware rationalized-lower repair `f7e20ddc...` + small-`z` reinforcement `39e5e087...` + current #488 `91712f75...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-056 | `ValidationReport` treated binary64 finiteness as sufficient artifact validity, allowing impossible metric domains/Wilson relationships and serde wire bypasses into durable Validation Evidence | `verification-pending` | domain RED `e9414e6f...` + invariant repair `28924b0d...` + ingress RED/repair `6d190cd7...`/`f70a6fc0...` + direct-egress RED/repair `fb28f959...`/`f7e58ccd...` + changelog `5339d539...` + research/current #488 `91712f75...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | ## Release gate -TEPP currently has no GitHub release. Release is permitted only after a coherent vertical reaches protected main with exact protected-head CI/security/recovery evidence, reproducible package + SBOM + provenance + rollback artifacts, current version/CHANGELOG, required migration/restore/load evidence, and released integration contracts where deployment depends on them. Queued/pending/startup-failed/skipped or predecessor-head evidence is not GREEN. +TEPP currently has no GitHub release. Release is permitted only after a coherent vertical reaches protected main with exact protected-head CI/security/recovery evidence, reproducible package + SBOM + provenance + rollback artifacts, current version/CHANGELOG, required migration/restore/load evidence, and released integration contracts where deployment depends on them. Queued/pending/startup-failed/skipped or predecessor-head evidence is not GREEN. \ No newline at end of file From 69a9907795bf67bce61f9203505af430fe1ac7b8 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 4 Sep 2026 05:16:08 +0900 Subject: [PATCH 144/235] docs(product): extend durable validation artifact gap --- docs/product-technical-gap-baseline.md | 32 +++++++++++++------------- 1 file changed, 16 insertions(+), 16 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index f00bcc3c9..810a4421d 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,7 +4,7 @@ **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-03T20:08Z +**Snapshot:** 2026-09-03T20:14Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` @@ -34,7 +34,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `91712f7521fded895d50d97080a307ceb96cf6b8` | true | `main` | Validation Evidence numerical/artifact repair. Bias/RMSE/Monte Carlo retain representable extreme/subnormal evidence; zero-multiplier SE-aware acceptance is exact-recovery before scale reduction; signed IEEE zeros are one numeric exact-recovery value. Wilson endpoints use stable represented roots where direct evaluation loses the estimand. `ValidationReport` now enforces metric domains and Wilson coherence on explicit validation plus serde ingress/egress, so finite but scientifically impossible tuples cannot become durable evidence. Exact-head hosted gates and independent review remain required. | +| #488 | `bbba97653b613440aff4b17ffb5212e10edc6ea2` | true | `main` | Validation Evidence numerical/artifact repair. Bias/RMSE/Monte Carlo retain representable extreme/subnormal evidence; zero-multiplier SE-aware acceptance is exact-recovery before scale reduction; signed IEEE zeros are one numeric exact-recovery value. Wilson endpoints use stable represented roots where direct evaluation loses the estimand. `ValidationReport` enforces metric domains and Wilson coherence on explicit validation plus serde ingress/egress, and standalone `MonteCarloSummary` direct serde egress now applies its existing validator. Exact-head hosted gates and independent review remain required. | | #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 `feat/copy-identity-analysis-run-gap-004` | Validation / Analysis Run fold child. Sparse observed relation classes are valid evidence; RED `a2892b6...`, repair `a6402015...`, predecessor-test correction `6b0c8de6...`; ADR 0079 is `Proposed`. No child-head CI transfers to #416. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | @@ -74,7 +74,7 @@ The clock contract separates event/valid time, assertion time, document time, sy - SE-aware acceptance is the declared rule `|estimate - target| <= k * SE`. For `k = 0`, the bound is exactly zero and exact recovery is evaluated before scale reduction; a large finite SE cannot erase a nonzero residual into acceptance. - Exact-recovery acceptance is finite numeric equality, not IEEE total-order identity. `-0.0` and `+0.0` therefore produce one zero-error decision while nonzero finite residuals remain distinct; this does not require blanket signed-zero canonicalization in private numerical intermediates. - Wilson interval coverage evidence must preserve representable endpoints. All-covered lower bounds use `n / (n + z²)`. Every nonzero strict-interior lower bound uses the algebraically rationalized positive root; the implementation evaluates it on natural scale for `z² < 1` and on `z²`-normalized scale for `z² >= 1`. Thus neither exact-zero collapse nor a nonzero `center - margin` cancellation residue is accepted as the endpoint. If direct `center + margin` rounds an upper endpoint to exact one while uncovered mass is nonzero, the complementary uncovered lower root is evaluated with the same stable representation and subtracted from one. -- Durable `ValidationReport` evidence must preserve the producing metrics' scientific domains, not merely binary64 finiteness. RMSE/SE fields are nonnegative, probability/accuracy fields remain in `[0,1]`, Wilson endpoints are ordered and contain the paired empirical coverage, and the same invariants apply to explicit validation plus direct serde ingress/egress. +- Durable Validation Evidence must preserve producing-metric invariants at every supported wire boundary, not merely binary64 finiteness. `ValidationReport` enforces nonnegative error/SE fields, probability/accuracy domains, Wilson ordering and containment on explicit validation plus serde ingress/egress; `MonteCarloSummary` applies its existing count/finiteness/nonnegative-uncertainty/percentile-order contract to direct serialization as well as ingress. - Bias, RMSE, and Monte Carlo may share private deterministic scalar support inside `validation_core`, but metric-specific cancellation/normalization, denominator, uncertainty, and fail-closed semantics remain with their bounded modules; support primitives are not second psychometric estimator authorities. - A mathematically nonzero scientific error metric must not be promoted to exact perfect recovery merely because its final binary64 representation underflows to zero. - Known-truth recovery denominators are defined by unique scientific component identity. Duplicate rows and stable-Between occasion aliases are not implicit weights unless a separately named weighted contract explicitly owns weighting. @@ -108,7 +108,7 @@ Current #310 exact-head workflows and a qualifying independent current-head appr ### #488 — Validation Evidence recovery arithmetic -#488 is the generic Validation Evidence landing vehicle at exact head `91712f7521fded895d50d97080a307ceb96cf6b8`. It remains distinct from Longitudinal Modeling and does not consume mutable fast-mlsirm source. +#488 is the generic Validation Evidence landing vehicle at exact head `bbba97653b613440aff4b17ffb5212e10edc6ea2`. It remains distinct from Longitudinal Modeling and does not consume mutable fast-mlsirm source. Mean signed bias no longer depends on a raw finite sum that can overflow before division (`c5ec42e4...`→`7499042f...`). Full-range mixed-sign cancellation preserves representable low-order bias before scale reduction (`b6084750...`→`227921d9...`, hardening `77dcf38c...`). Bias SEM scales deviations before squaring and forms the final SEM without avoidable variance overflow (`7de0ef90...`→`cad23162...`, edges `8a6cc346...`/`28d96c23...`). @@ -126,7 +126,7 @@ The exact-zero fallback was still insufficient because catastrophic cancellation The complementary upper endpoint had the dual false-one failure. With two uncovered replications and `z = 2^27`, the represented all-uncovered upper endpoint correctly rounds to `next_down(1.0)`, but the predecessor `center + margin` numerator and denominator rounded equal and returned exact `1.0`. Public RED `c070da269aa257fc9c9fa9eae17231a51ec63b74`; strict-interior expansion `344081bfd98ee9bc70a3bf8fdebc795a9090e692` reproduces the same false-one boundary with one covered replication out of eight and `z = 2^28`. Causal repair `9a2fdd05c2994f51f6c72030fe39e695ba5a876d` evaluates the rationalized positive lower root for the complementary uncovered proportion only when the direct upper path has reached exact one while uncovered mass remains. -Durable report admission then exposed a separate Validation Evidence defect: finite scalar representation was treated as sufficient scientific validity. Public RED `e9414e6f7b824c2dc508f335d355b97b7e399b9` rejects negative RMSE/SE, out-of-domain probabilities, inverted Wilson bounds, and coverage outside its paired Wilson interval; repair `28924b0d82bc2d4663f5ba1317cc0c3d94a4833b` enforces those invariants. Serde ingress RED `6d190cd783a00f8ce917e37b63ae87053a929ae1` and repair `f70a6fc0e58c2ae419c3b3bac322db5f35efe538` close deserialization bypass. Direct-serde egress RED `fb28f959297a50cf50e26ea14dc9bfb5ee10ea89` and repair `f7e58ccdb1864ce775ef6797f7fd88596dff1269` close alternate serialization. Changelog `5339d539...`; research/current #488 `91712f75...`. +Durable artifact admission exposed a separate Validation Evidence defect: finite scalar representation was treated as sufficient report validity. Public RED `e9414e6f7b824c2dc508f335d355b97b7e399b9` rejects negative RMSE/SE, out-of-domain probabilities, inverted Wilson bounds, and coverage outside its paired Wilson interval; repair `28924b0d82bc2d4663f5ba1317cc0c3d94a4833b` enforces those invariants. Serde ingress RED/repair `6d190cd783a00f8ce917e37b63ae87053a929ae1`/`f70a6fc0e58c2ae419c3b3bac322db5f35efe538` close deserialization bypass, while direct-report egress RED/repair `fb28f959297a50cf50e26ea14dc9bfb5ee10ea89`/`f7e58ccdb1864ce775ef6797f7fd88596dff1269` close alternate serialization. Standalone `MonteCarloSummary` retained the same egress bypass despite an existing validator; RED `b5a8ae1fbd1344b09a9fbb3c65a3c6d0cdc38c28`, repair `18374c35061fb0b98bfe09079d4967baef7697b4`. Changelog `0d03efa1...`; research/current #488 `bbba9765...`. Morris, White, and Crowther (2019) remain the simulation performance-measure/Monte Carlo uncertainty methodology trace; Wilson (1927) remains the primary score-interval reference. AERA/APA/NCME (2014) remains the current published testing-standards edition while revision is underway, and ISO/IEC 25012:2008 remains current after its 2025 review as structured-data-quality support. Exact-head hosted Rust/documentation/security/supply-chain/100%-coverage gates and a qualifying independent current-head review remain required. @@ -198,18 +198,18 @@ Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/num | GAP-042 | Ratio-first logarithm could nearly double an adjacent-float power-of-two irregular residual growth rate before event-time scaling | `verification-pending` | public RED `766ddc7a...` + causal `ln_1p` repair `16f21d9a...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-043 | Duplicate known-truth component identities could silently reweight RMSE recovery evidence by changing the denominator without adding a new scientific target | `verification-pending` | public RED `698f12f5...` + uniqueness repair `2fae4cb2...` + current trace `c9cb68d3...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-044 | Known-truth component RMSE alignment and deterministic binary64 accumulation depended on serialization row order rather than scientific component identity | `verification-pending` | cross-slice RED `8ad72ac9...` + alignment repair `2dd9537e...` + rounding RED `5fb93c40...` + canonical-order repair `025dce7f...` + edge `976ce7d7...` + current #310 `c6680450...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | public RED `c5ec42e4...` + scaled repair `7499042f...` + current #488 `91712f75...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-046 | Bias standard error could reject a representable SEM because raw squared deviations, their sum, or an intermediate sample variance overflowed | `verification-pending` | public RED `7de0ef90...` + scaled direct-SEM repair `cad23162...` + edges `8a6cc346...` / `28d96c23...` + current #488 `91712f75...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-047 | Generic Validation Evidence RMSE/RMSE-SE could reject representable extreme recovery or collapse a representable/nonzero subnormal error to false perfect recovery because residuals were squared before scale normalization | `verification-pending` | extreme RED `dd41ff53...` + subnormal RED `f4e19991...` + repair `6b182107...` + current #488 `91712f75...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-048 | Validation Evidence mean signed bias could erase a representable subnormal residual contribution by normalizing to an unrelated extreme magnitude before mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...` + hardening `77dcf38c...` + current #488 `91712f75...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | public RED `c5ec42e4...` + scaled repair `7499042f...` + current #488 `bbba9765...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-046 | Bias standard error could reject a representable SEM because raw squared deviations, their sum, or an intermediate sample variance overflowed | `verification-pending` | public RED `7de0ef90...` + scaled direct-SEM repair `cad23162...` + edges `8a6cc346...` / `28d96c23...` + current #488 `bbba9765...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-047 | Generic Validation Evidence RMSE/RMSE-SE could reject representable extreme recovery or collapse a representable/nonzero subnormal error to false perfect recovery because residuals were squared before scale normalization | `verification-pending` | extreme RED `dd41ff53...` + subnormal RED `f4e19991...` + repair `6b182107...` + current #488 `bbba9765...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-048 | Validation Evidence mean signed bias could erase a representable subnormal residual contribution by normalizing to an unrelated extreme magnitude before mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...` + hardening `77dcf38c...` + current #488 `bbba9765...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-049 | Stable `Between` recovery could be aliased across occasion indices, duplicating one unit-level scientific target and silently changing the RMSE denominator | `verification-pending` | RED `0a03041c...` + fixture repair `53563e97...` + admission repair `ec2c1219...` + trace `c9cb68d3...` + current #310 `c6680450...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-050 | Zero-multiplier SE-aware acceptance could scale a nonzero residual to exact zero and falsely accept exact recovery when a large finite SE dominated normalization | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...` + current research `c45a76cf...` + current #488 `91712f75...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-051 | Exact-recovery SE acceptance used IEEE total ordering and therefore treated `-0.0` and `+0.0` as different scientific recovery values | `verification-pending` | signed-zero RED `379e6525...` + numeric-equality repair `55876e60...` + research `c45a76cf...` + current #488 `91712f75...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-052 | All-covered Wilson score coverage could cancel a positive binary64-representable lower endpoint to exact zero by subtracting nearly equal center and margin terms | `verification-pending` | public RED `f84e5918...` + exact all-covered endpoint repair `fe9b9c8a...` + current #488 `91712f75...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-053 | Strict-interior Wilson score coverage could cancel a positive binary64-representable lower endpoint to exact zero even after the all-covered endpoint specialization | `verification-pending` | public RED `9d45f482...` + initial rationalized lower-root repair `4f259f6e...` + current #488 `91712f75...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-054 | Wilson score coverage could falsely promote an all-uncovered or strict-interior upper endpoint to exact `1.0` when `center + margin` and the denominator rounded to the same binary64 value | `verification-pending` | all-uncovered RED `c070da26...` + strict-interior RED expansion `344081bf...` + complementary rationalized repair `9a2fdd05...` + current #488 `91712f75...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-055 | Strict-interior Wilson score coverage could accept a nonzero `center - margin` cancellation residue as the scientific lower endpoint, overstating a representable endpoint by orders of magnitude even though the subtraction did not collapse to zero | `verification-pending` | public RED `1a24fac7...` + scale-aware rationalized-lower repair `f7e20ddc...` + small-`z` reinforcement `39e5e087...` + current #488 `91712f75...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-056 | `ValidationReport` treated binary64 finiteness as sufficient artifact validity, allowing impossible metric domains/Wilson relationships and serde wire bypasses into durable Validation Evidence | `verification-pending` | domain RED `e9414e6f...` + invariant repair `28924b0d...` + ingress RED/repair `6d190cd7...`/`f70a6fc0...` + direct-egress RED/repair `fb28f959...`/`f7e58ccd...` + changelog `5339d539...` + research/current #488 `91712f75...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-050 | Zero-multiplier SE-aware acceptance could scale a nonzero residual to exact zero and falsely accept exact recovery when a large finite SE dominated normalization | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...` + current research `c45a76cf...` + current #488 `bbba9765...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-051 | Exact-recovery SE acceptance used IEEE total ordering and therefore treated `-0.0` and `+0.0` as different scientific recovery values | `verification-pending` | signed-zero RED `379e6525...` + numeric-equality repair `55876e60...` + research `c45a76cf...` + current #488 `bbba9765...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-052 | All-covered Wilson score coverage could cancel a positive binary64-representable lower endpoint to exact zero by subtracting nearly equal center and margin terms | `verification-pending` | public RED `f84e5918...` + exact all-covered endpoint repair `fe9b9c8a...` + current #488 `bbba9765...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-053 | Strict-interior Wilson score coverage could cancel a positive binary64-representable lower endpoint to exact zero even after the all-covered endpoint specialization | `verification-pending` | public RED `9d45f482...` + initial rationalized lower-root repair `4f259f6e...` + current #488 `bbba9765...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-054 | Wilson score coverage could falsely promote an all-uncovered or strict-interior upper endpoint to exact `1.0` when `center + margin` and the denominator rounded to the same binary64 value | `verification-pending` | all-uncovered RED `c070da26...` + strict-interior RED expansion `344081bf...` + complementary rationalized repair `9a2fdd05...` + current #488 `bbba9765...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-055 | Strict-interior Wilson score coverage could accept a nonzero `center - margin` cancellation residue as the scientific lower endpoint, overstating a representable endpoint by orders of magnitude even though the subtraction did not collapse to zero | `verification-pending` | public RED `1a24fac7...` + scale-aware rationalized-lower repair `f7e20ddc...` + small-`z` reinforcement `39e5e087...` + current #488 `bbba9765...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-056 | Durable Validation Evidence artifacts could accept impossible finite report fields/cross-field relationships or bypass validation through direct serde ingress/egress, including standalone Monte Carlo summary egress | `verification-pending` | report domain RED/repair `e9414e6f...`/`28924b0d...` + ingress RED/repair `6d190cd7...`/`f70a6fc0...` + report direct-egress RED/repair `fb28f959...`/`f7e58ccd...` + Monte Carlo direct-egress RED/repair `b5a8ae1f...`/`18374c35...` + changelog `0d03efa1...` + research/current #488 `bbba9765...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | ## Release gate From d3776456a3f4729f85a9af51b8dcb361c59ff3f6 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 4 Sep 2026 05:22:45 +0900 Subject: [PATCH 145/235] docs(product): close validation projection bypasses --- docs/product-technical-gap-baseline.md | 32 +++++++++++++------------- 1 file changed, 16 insertions(+), 16 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 810a4421d..0deb7e046 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,7 +4,7 @@ **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-03T20:14Z +**Snapshot:** 2026-09-03T20:21Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` @@ -34,7 +34,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `bbba97653b613440aff4b17ffb5212e10edc6ea2` | true | `main` | Validation Evidence numerical/artifact repair. Bias/RMSE/Monte Carlo retain representable extreme/subnormal evidence; zero-multiplier SE-aware acceptance is exact-recovery before scale reduction; signed IEEE zeros are one numeric exact-recovery value. Wilson endpoints use stable represented roots where direct evaluation loses the estimand. `ValidationReport` enforces metric domains and Wilson coherence on explicit validation plus serde ingress/egress, and standalone `MonteCarloSummary` direct serde egress now applies its existing validator. Exact-head hosted gates and independent review remain required. | +| #488 | `60166eafe34cd411b7379f0ceedd0dfd6380632f` | true | `main` | Validation Evidence numerical/artifact repair. Bias/RMSE/Monte Carlo retain representable extreme/subnormal evidence; zero-multiplier SE-aware acceptance is exact-recovery before scale reduction; signed IEEE zeros are one numeric exact-recovery value. Wilson endpoints use stable represented roots where direct evaluation loses the estimand. `ValidationReport` enforces metric domains and Wilson coherence on explicit validation, serde ingress/egress, and human-readable projection; standalone `MonteCarloSummary` direct serde egress applies its existing validator. Exact-head hosted gates and independent review remain required. | | #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 `feat/copy-identity-analysis-run-gap-004` | Validation / Analysis Run fold child. Sparse observed relation classes are valid evidence; RED `a2892b6...`, repair `a6402015...`, predecessor-test correction `6b0c8de6...`; ADR 0079 is `Proposed`. No child-head CI transfers to #416. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | @@ -74,7 +74,7 @@ The clock contract separates event/valid time, assertion time, document time, sy - SE-aware acceptance is the declared rule `|estimate - target| <= k * SE`. For `k = 0`, the bound is exactly zero and exact recovery is evaluated before scale reduction; a large finite SE cannot erase a nonzero residual into acceptance. - Exact-recovery acceptance is finite numeric equality, not IEEE total-order identity. `-0.0` and `+0.0` therefore produce one zero-error decision while nonzero finite residuals remain distinct; this does not require blanket signed-zero canonicalization in private numerical intermediates. - Wilson interval coverage evidence must preserve representable endpoints. All-covered lower bounds use `n / (n + z²)`. Every nonzero strict-interior lower bound uses the algebraically rationalized positive root; the implementation evaluates it on natural scale for `z² < 1` and on `z²`-normalized scale for `z² >= 1`. Thus neither exact-zero collapse nor a nonzero `center - margin` cancellation residue is accepted as the endpoint. If direct `center + margin` rounds an upper endpoint to exact one while uncovered mass is nonzero, the complementary uncovered lower root is evaluated with the same stable representation and subtracted from one. -- Durable Validation Evidence must preserve producing-metric invariants at every supported wire boundary, not merely binary64 finiteness. `ValidationReport` enforces nonnegative error/SE fields, probability/accuracy domains, Wilson ordering and containment on explicit validation plus serde ingress/egress; `MonteCarloSummary` applies its existing count/finiteness/nonnegative-uncertainty/percentile-order contract to direct serialization as well as ingress. +- Durable and human-facing Validation Evidence must preserve producing-metric invariants at every supported projection boundary, not merely binary64 finiteness. `ValidationReport` enforces nonnegative error/SE fields, probability/accuracy domains, Wilson ordering and containment on explicit validation, JSON/serde ingress and egress, and human-readable summary projection; `MonteCarloSummary` applies its existing count/finiteness/nonnegative-uncertainty/percentile-order contract to direct serialization as well as ingress. - Bias, RMSE, and Monte Carlo may share private deterministic scalar support inside `validation_core`, but metric-specific cancellation/normalization, denominator, uncertainty, and fail-closed semantics remain with their bounded modules; support primitives are not second psychometric estimator authorities. - A mathematically nonzero scientific error metric must not be promoted to exact perfect recovery merely because its final binary64 representation underflows to zero. - Known-truth recovery denominators are defined by unique scientific component identity. Duplicate rows and stable-Between occasion aliases are not implicit weights unless a separately named weighted contract explicitly owns weighting. @@ -108,7 +108,7 @@ Current #310 exact-head workflows and a qualifying independent current-head appr ### #488 — Validation Evidence recovery arithmetic -#488 is the generic Validation Evidence landing vehicle at exact head `bbba97653b613440aff4b17ffb5212e10edc6ea2`. It remains distinct from Longitudinal Modeling and does not consume mutable fast-mlsirm source. +#488 is the generic Validation Evidence landing vehicle at exact head `60166eafe34cd411b7379f0ceedd0dfd6380632f`. It remains distinct from Longitudinal Modeling and does not consume mutable fast-mlsirm source. Mean signed bias no longer depends on a raw finite sum that can overflow before division (`c5ec42e4...`→`7499042f...`). Full-range mixed-sign cancellation preserves representable low-order bias before scale reduction (`b6084750...`→`227921d9...`, hardening `77dcf38c...`). Bias SEM scales deviations before squaring and forms the final SEM without avoidable variance overflow (`7de0ef90...`→`cad23162...`, edges `8a6cc346...`/`28d96c23...`). @@ -126,7 +126,7 @@ The exact-zero fallback was still insufficient because catastrophic cancellation The complementary upper endpoint had the dual false-one failure. With two uncovered replications and `z = 2^27`, the represented all-uncovered upper endpoint correctly rounds to `next_down(1.0)`, but the predecessor `center + margin` numerator and denominator rounded equal and returned exact `1.0`. Public RED `c070da269aa257fc9c9fa9eae17231a51ec63b74`; strict-interior expansion `344081bfd98ee9bc70a3bf8fdebc795a9090e692` reproduces the same false-one boundary with one covered replication out of eight and `z = 2^28`. Causal repair `9a2fdd05c2994f51f6c72030fe39e695ba5a876d` evaluates the rationalized positive lower root for the complementary uncovered proportion only when the direct upper path has reached exact one while uncovered mass remains. -Durable artifact admission exposed a separate Validation Evidence defect: finite scalar representation was treated as sufficient report validity. Public RED `e9414e6f7b824c2dc508f335d355b97b7e399b9` rejects negative RMSE/SE, out-of-domain probabilities, inverted Wilson bounds, and coverage outside its paired Wilson interval; repair `28924b0d82bc2d4663f5ba1317cc0c3d94a4833b` enforces those invariants. Serde ingress RED/repair `6d190cd783a00f8ce917e37b63ae87053a929ae1`/`f70a6fc0e58c2ae419c3b3bac322db5f35efe538` close deserialization bypass, while direct-report egress RED/repair `fb28f959297a50cf50e26ea14dc9bfb5ee10ea89`/`f7e58ccdb1864ce775ef6797f7fd88596dff1269` close alternate serialization. Standalone `MonteCarloSummary` retained the same egress bypass despite an existing validator; RED `b5a8ae1fbd1344b09a9fbb3c65a3c6d0cdc38c28`, repair `18374c35061fb0b98bfe09079d4967baef7697b4`. Changelog `0d03efa1...`; research/current #488 `bbba9765...`. +Durable/human-facing artifact admission exposed a separate Validation Evidence defect: finite scalar representation was treated as sufficient report validity. Public RED `e9414e6f7b824c2dc508f335d355b97b7e399b9` rejects negative RMSE/SE, out-of-domain probabilities, inverted Wilson bounds, and coverage outside its paired Wilson interval; repair `28924b0d82bc2d4663f5ba1317cc0c3d94a4833b` enforces those invariants. Serde ingress RED/repair `6d190cd783a00f8ce917e37b63ae87053a929ae1`/`f70a6fc0e58c2ae419c3b3bac322db5f35efe538` close deserialization bypass, while direct-report egress RED/repair `fb28f959297a50cf50e26ea14dc9bfb5ee10ea89`/`f7e58ccdb1864ce775ef6797f7fd88596dff1269` close alternate serialization. Standalone `MonteCarloSummary` retained the same egress bypass despite an existing validator; RED `b5a8ae1fbd1344b09a9fbb3c65a3c6d0cdc38c28`, repair `18374c35061fb0b98bfe09079d4967baef7697b4`. Human summary projection was a final bypass: RED `541273f10d2085680073fb8ca9dc72d3cbe1e62b` and repair `53607f8033ee03b409c8fce4ee464797e8cb7be1` make it return `Result` and validate first. Changelog `d1f1b85a...`; research/current #488 `60166eaf...`. Morris, White, and Crowther (2019) remain the simulation performance-measure/Monte Carlo uncertainty methodology trace; Wilson (1927) remains the primary score-interval reference. AERA/APA/NCME (2014) remains the current published testing-standards edition while revision is underway, and ISO/IEC 25012:2008 remains current after its 2025 review as structured-data-quality support. Exact-head hosted Rust/documentation/security/supply-chain/100%-coverage gates and a qualifying independent current-head review remain required. @@ -198,18 +198,18 @@ Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/num | GAP-042 | Ratio-first logarithm could nearly double an adjacent-float power-of-two irregular residual growth rate before event-time scaling | `verification-pending` | public RED `766ddc7a...` + causal `ln_1p` repair `16f21d9a...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-043 | Duplicate known-truth component identities could silently reweight RMSE recovery evidence by changing the denominator without adding a new scientific target | `verification-pending` | public RED `698f12f5...` + uniqueness repair `2fae4cb2...` + current trace `c9cb68d3...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-044 | Known-truth component RMSE alignment and deterministic binary64 accumulation depended on serialization row order rather than scientific component identity | `verification-pending` | cross-slice RED `8ad72ac9...` + alignment repair `2dd9537e...` + rounding RED `5fb93c40...` + canonical-order repair `025dce7f...` + edge `976ce7d7...` + current #310 `c6680450...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | public RED `c5ec42e4...` + scaled repair `7499042f...` + current #488 `bbba9765...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-046 | Bias standard error could reject a representable SEM because raw squared deviations, their sum, or an intermediate sample variance overflowed | `verification-pending` | public RED `7de0ef90...` + scaled direct-SEM repair `cad23162...` + edges `8a6cc346...` / `28d96c23...` + current #488 `bbba9765...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-047 | Generic Validation Evidence RMSE/RMSE-SE could reject representable extreme recovery or collapse a representable/nonzero subnormal error to false perfect recovery because residuals were squared before scale normalization | `verification-pending` | extreme RED `dd41ff53...` + subnormal RED `f4e19991...` + repair `6b182107...` + current #488 `bbba9765...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-048 | Validation Evidence mean signed bias could erase a representable subnormal residual contribution by normalizing to an unrelated extreme magnitude before mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...` + hardening `77dcf38c...` + current #488 `bbba9765...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | public RED `c5ec42e4...` + scaled repair `7499042f...` + current #488 `60166eaf...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-046 | Bias standard error could reject a representable SEM because raw squared deviations, their sum, or an intermediate sample variance overflowed | `verification-pending` | public RED `7de0ef90...` + scaled direct-SEM repair `cad23162...` + edges `8a6cc346...` / `28d96c23...` + current #488 `60166eaf...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-047 | Generic Validation Evidence RMSE/RMSE-SE could reject representable extreme recovery or collapse a representable/nonzero subnormal error to false perfect recovery because residuals were squared before scale normalization | `verification-pending` | extreme RED `dd41ff53...` + subnormal RED `f4e19991...` + repair `6b182107...` + current #488 `60166eaf...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-048 | Validation Evidence mean signed bias could erase a representable subnormal residual contribution by normalizing to an unrelated extreme magnitude before mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...` + hardening `77dcf38c...` + current #488 `60166eaf...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-049 | Stable `Between` recovery could be aliased across occasion indices, duplicating one unit-level scientific target and silently changing the RMSE denominator | `verification-pending` | RED `0a03041c...` + fixture repair `53563e97...` + admission repair `ec2c1219...` + trace `c9cb68d3...` + current #310 `c6680450...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-050 | Zero-multiplier SE-aware acceptance could scale a nonzero residual to exact zero and falsely accept exact recovery when a large finite SE dominated normalization | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...` + current research `c45a76cf...` + current #488 `bbba9765...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-051 | Exact-recovery SE acceptance used IEEE total ordering and therefore treated `-0.0` and `+0.0` as different scientific recovery values | `verification-pending` | signed-zero RED `379e6525...` + numeric-equality repair `55876e60...` + research `c45a76cf...` + current #488 `bbba9765...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-052 | All-covered Wilson score coverage could cancel a positive binary64-representable lower endpoint to exact zero by subtracting nearly equal center and margin terms | `verification-pending` | public RED `f84e5918...` + exact all-covered endpoint repair `fe9b9c8a...` + current #488 `bbba9765...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-053 | Strict-interior Wilson score coverage could cancel a positive binary64-representable lower endpoint to exact zero even after the all-covered endpoint specialization | `verification-pending` | public RED `9d45f482...` + initial rationalized lower-root repair `4f259f6e...` + current #488 `bbba9765...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-054 | Wilson score coverage could falsely promote an all-uncovered or strict-interior upper endpoint to exact `1.0` when `center + margin` and the denominator rounded to the same binary64 value | `verification-pending` | all-uncovered RED `c070da26...` + strict-interior RED expansion `344081bf...` + complementary rationalized repair `9a2fdd05...` + current #488 `bbba9765...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-055 | Strict-interior Wilson score coverage could accept a nonzero `center - margin` cancellation residue as the scientific lower endpoint, overstating a representable endpoint by orders of magnitude even though the subtraction did not collapse to zero | `verification-pending` | public RED `1a24fac7...` + scale-aware rationalized-lower repair `f7e20ddc...` + small-`z` reinforcement `39e5e087...` + current #488 `bbba9765...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-056 | Durable Validation Evidence artifacts could accept impossible finite report fields/cross-field relationships or bypass validation through direct serde ingress/egress, including standalone Monte Carlo summary egress | `verification-pending` | report domain RED/repair `e9414e6f...`/`28924b0d...` + ingress RED/repair `6d190cd7...`/`f70a6fc0...` + report direct-egress RED/repair `fb28f959...`/`f7e58ccd...` + Monte Carlo direct-egress RED/repair `b5a8ae1f...`/`18374c35...` + changelog `0d03efa1...` + research/current #488 `bbba9765...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-050 | Zero-multiplier SE-aware acceptance could scale a nonzero residual to exact zero and falsely accept exact recovery when a large finite SE dominated normalization | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...` + current research `c45a76cf...` + current #488 `60166eaf...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-051 | Exact-recovery SE acceptance used IEEE total ordering and therefore treated `-0.0` and `+0.0` as different scientific recovery values | `verification-pending` | signed-zero RED `379e6525...` + numeric-equality repair `55876e60...` + research `c45a76cf...` + current #488 `60166eaf...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-052 | All-covered Wilson score coverage could cancel a positive binary64-representable lower endpoint to exact zero by subtracting nearly equal center and margin terms | `verification-pending` | public RED `f84e5918...` + exact all-covered endpoint repair `fe9b9c8a...` + current #488 `60166eaf...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-053 | Strict-interior Wilson score coverage could cancel a positive binary64-representable lower endpoint to exact zero even after the all-covered endpoint specialization | `verification-pending` | public RED `9d45f482...` + initial rationalized lower-root repair `4f259f6e...` + current #488 `60166eaf...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-054 | Wilson score coverage could falsely promote an all-uncovered or strict-interior upper endpoint to exact `1.0` when `center + margin` and the denominator rounded to the same binary64 value | `verification-pending` | all-uncovered RED `c070da26...` + strict-interior RED expansion `344081bf...` + complementary rationalized repair `9a2fdd05...` + current #488 `60166eaf...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-055 | Strict-interior Wilson score coverage could accept a nonzero `center - margin` cancellation residue as the scientific lower endpoint, overstating a representable endpoint by orders of magnitude even though the subtraction did not collapse to zero | `verification-pending` | public RED `1a24fac7...` + scale-aware rationalized-lower repair `f7e20ddc...` + small-`z` reinforcement `39e5e087...` + current #488 `60166eaf...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-056 | Durable or human-facing Validation Evidence could accept impossible finite report fields/cross-field relationships or bypass validation through serde/human projections, including standalone Monte Carlo summary egress | `verification-pending` | report domain RED/repair `e9414e6f...`/`28924b0d...` + ingress RED/repair `6d190cd7...`/`f70a6fc0...` + report direct-egress RED/repair `fb28f959...`/`f7e58ccd...` + Monte Carlo direct-egress RED/repair `b5a8ae1f...`/`18374c35...` + human projection RED/repair `541273f1...`/`53607f80...` + changelog `d1f1b85a...` + research/current #488 `60166eaf...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | ## Release gate From a9a9386621000e8be47bd2c22683077d0ac26274 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 4 Sep 2026 05:36:05 +0900 Subject: [PATCH 146/235] docs(ddd): trace RMSE summary domain gap --- docs/product-technical-gap-baseline.md | 35 ++++++++++++++------------ 1 file changed, 19 insertions(+), 16 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 0deb7e046..f357c0758 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,7 +4,7 @@ **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-03T20:21Z +**Snapshot:** 2026-09-03T20:34Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` @@ -34,7 +34,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `60166eafe34cd411b7379f0ceedd0dfd6380632f` | true | `main` | Validation Evidence numerical/artifact repair. Bias/RMSE/Monte Carlo retain representable extreme/subnormal evidence; zero-multiplier SE-aware acceptance is exact-recovery before scale reduction; signed IEEE zeros are one numeric exact-recovery value. Wilson endpoints use stable represented roots where direct evaluation loses the estimand. `ValidationReport` enforces metric domains and Wilson coherence on explicit validation, serde ingress/egress, and human-readable projection; standalone `MonteCarloSummary` direct serde egress applies its existing validator. Exact-head hosted gates and independent review remain required. | +| #488 | `0ba16c080b4bea12873aacb252c49497d34a2162` | true | `main` | Validation Evidence numerical/artifact repair. Bias/RMSE/Monte Carlo retain representable extreme/subnormal evidence; zero-multiplier SE-aware acceptance is exact-recovery before scale reduction; signed IEEE zeros are one numeric exact-recovery value. Wilson endpoints use stable represented roots where direct evaluation loses the estimand. `ValidationReport` enforces metric domains and Wilson coherence on explicit validation, serde ingress/egress, and human-readable projection. A generic `MonteCarloSummary` remains sign-neutral, but the `monte_carlo_rmse` embedding additionally requires nonnegative mean and percentile endpoints because RMSE replications cannot be negative. Exact-head hosted gates and independent review remain required. | | #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 `feat/copy-identity-analysis-run-gap-004` | Validation / Analysis Run fold child. Sparse observed relation classes are valid evidence; RED `a2892b6...`, repair `a6402015...`, predecessor-test correction `6b0c8de6...`; ADR 0079 is `Proposed`. No child-head CI transfers to #416. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | @@ -74,7 +74,7 @@ The clock contract separates event/valid time, assertion time, document time, sy - SE-aware acceptance is the declared rule `|estimate - target| <= k * SE`. For `k = 0`, the bound is exactly zero and exact recovery is evaluated before scale reduction; a large finite SE cannot erase a nonzero residual into acceptance. - Exact-recovery acceptance is finite numeric equality, not IEEE total-order identity. `-0.0` and `+0.0` therefore produce one zero-error decision while nonzero finite residuals remain distinct; this does not require blanket signed-zero canonicalization in private numerical intermediates. - Wilson interval coverage evidence must preserve representable endpoints. All-covered lower bounds use `n / (n + z²)`. Every nonzero strict-interior lower bound uses the algebraically rationalized positive root; the implementation evaluates it on natural scale for `z² < 1` and on `z²`-normalized scale for `z² >= 1`. Thus neither exact-zero collapse nor a nonzero `center - margin` cancellation residue is accepted as the endpoint. If direct `center + margin` rounds an upper endpoint to exact one while uncovered mass is nonzero, the complementary uncovered lower root is evaluated with the same stable representation and subtracted from one. -- Durable and human-facing Validation Evidence must preserve producing-metric invariants at every supported projection boundary, not merely binary64 finiteness. `ValidationReport` enforces nonnegative error/SE fields, probability/accuracy domains, Wilson ordering and containment on explicit validation, JSON/serde ingress and egress, and human-readable summary projection; `MonteCarloSummary` applies its existing count/finiteness/nonnegative-uncertainty/percentile-order contract to direct serialization as well as ingress. +- Durable and human-facing Validation Evidence must preserve producing-metric invariants at every supported projection boundary, not merely binary64 finiteness. `ValidationReport` enforces nonnegative error/SE fields, probability/accuracy domains, Wilson ordering and containment on explicit validation, JSON/serde ingress and egress, and human-readable summary projection. `MonteCarloSummary` remains generic and sign-neutral; when embedded as `ValidationReport::monte_carlo_rmse`, its mean and percentile endpoints are additionally nonnegative because each RMSE replication is nonnegative. Direct `MonteCarloSummary` serialization still applies its generic count/finiteness/nonnegative-uncertainty/percentile-order contract. - Bias, RMSE, and Monte Carlo may share private deterministic scalar support inside `validation_core`, but metric-specific cancellation/normalization, denominator, uncertainty, and fail-closed semantics remain with their bounded modules; support primitives are not second psychometric estimator authorities. - A mathematically nonzero scientific error metric must not be promoted to exact perfect recovery merely because its final binary64 representation underflows to zero. - Known-truth recovery denominators are defined by unique scientific component identity. Duplicate rows and stable-Between occasion aliases are not implicit weights unless a separately named weighted contract explicitly owns weighting. @@ -108,7 +108,7 @@ Current #310 exact-head workflows and a qualifying independent current-head appr ### #488 — Validation Evidence recovery arithmetic -#488 is the generic Validation Evidence landing vehicle at exact head `60166eafe34cd411b7379f0ceedd0dfd6380632f`. It remains distinct from Longitudinal Modeling and does not consume mutable fast-mlsirm source. +#488 is the generic Validation Evidence landing vehicle at exact head `0ba16c080b4bea12873aacb252c49497d34a2162`. It remains distinct from Longitudinal Modeling and does not consume mutable fast-mlsirm source. Mean signed bias no longer depends on a raw finite sum that can overflow before division (`c5ec42e4...`→`7499042f...`). Full-range mixed-sign cancellation preserves representable low-order bias before scale reduction (`b6084750...`→`227921d9...`, hardening `77dcf38c...`). Bias SEM scales deviations before squaring and forms the final SEM without avoidable variance overflow (`7de0ef90...`→`cad23162...`, edges `8a6cc346...`/`28d96c23...`). @@ -126,7 +126,9 @@ The exact-zero fallback was still insufficient because catastrophic cancellation The complementary upper endpoint had the dual false-one failure. With two uncovered replications and `z = 2^27`, the represented all-uncovered upper endpoint correctly rounds to `next_down(1.0)`, but the predecessor `center + margin` numerator and denominator rounded equal and returned exact `1.0`. Public RED `c070da269aa257fc9c9fa9eae17231a51ec63b74`; strict-interior expansion `344081bfd98ee9bc70a3bf8fdebc795a9090e692` reproduces the same false-one boundary with one covered replication out of eight and `z = 2^28`. Causal repair `9a2fdd05c2994f51f6c72030fe39e695ba5a876d` evaluates the rationalized positive lower root for the complementary uncovered proportion only when the direct upper path has reached exact one while uncovered mass remains. -Durable/human-facing artifact admission exposed a separate Validation Evidence defect: finite scalar representation was treated as sufficient report validity. Public RED `e9414e6f7b824c2dc508f335d355b97b7e399b9` rejects negative RMSE/SE, out-of-domain probabilities, inverted Wilson bounds, and coverage outside its paired Wilson interval; repair `28924b0d82bc2d4663f5ba1317cc0c3d94a4833b` enforces those invariants. Serde ingress RED/repair `6d190cd783a00f8ce917e37b63ae87053a929ae1`/`f70a6fc0e58c2ae419c3b3bac322db5f35efe538` close deserialization bypass, while direct-report egress RED/repair `fb28f959297a50cf50e26ea14dc9bfb5ee10ea89`/`f7e58ccdb1864ce775ef6797f7fd88596dff1269` close alternate serialization. Standalone `MonteCarloSummary` retained the same egress bypass despite an existing validator; RED `b5a8ae1fbd1344b09a9fbb3c65a3c6d0cdc38c28`, repair `18374c35061fb0b98bfe09079d4967baef7697b4`. Human summary projection was a final bypass: RED `541273f10d2085680073fb8ca9dc72d3cbe1e62b` and repair `53607f8033ee03b409c8fce4ee464797e8cb7be1` make it return `Result` and validate first. Changelog `d1f1b85a...`; research/current #488 `60166eaf...`. +Durable/human-facing artifact admission exposed a separate Validation Evidence defect: finite scalar representation was treated as sufficient report validity. Public RED `e9414e6f7b824c2dc508f335d355b97b7e399b9` rejects negative RMSE/SE, out-of-domain probabilities, inverted Wilson bounds, and coverage outside its paired Wilson interval; repair `28924b0d82bc2d4663f5ba1317cc0c3d94a4833b` enforces those invariants. Serde ingress RED/repair `6d190cd783a00f8ce917e37b63ae87053a929ae1`/`f70a6fc0e58c2ae419c3b3bac322db5f35efe538` close deserialization bypass, while direct-report egress RED/repair `fb28f959297a50cf50e26ea14dc9bfb5ee10ea89`/`f7e58ccdb1864ce775ef6797f7fd88596dff1269` close alternate serialization. Standalone `MonteCarloSummary` retained the same egress bypass despite an existing validator; RED `b5a8ae1fbd1344b09a9fbb3c65a3c6d0cdc38c28`, repair `18374c35061fb0b98bfe09079d4967baef7697b4`. Human summary projection was a final bypass: RED `541273f10d2085680073fb8ca9dc72d3cbe1e62b` and repair `53607f8033ee03b409c8fce4ee464797e8cb7be1` make it return `Result` and validate first. + +The nested RMSE summary then exposed a narrower semantic admission bug. `MonteCarloSummary` must remain sign-neutral because it can summarize signed bias, but `ValidationReport::monte_carlo_rmse` gives the same structure RMSE-specific semantics. A negative mean or percentile endpoint is therefore impossible RMSE evidence even when the generic summary is structurally valid. Public RED `3cd6e41ddeffbb41e0a6179a65bc3dd9b60f41d8`; causal report-boundary repair `0090259d01ee00ad0de35ba0c4c9cb7a37c0b13c`; changelog `d2631d1b0047ba8dbf78058272ea6c00d9b0c9a3`; research/current #488 `0ba16c080b4bea12873aacb252c49497d34a2162`. Morris, White, and Crowther (2019) remain the simulation performance-measure/Monte Carlo uncertainty methodology trace; Wilson (1927) remains the primary score-interval reference. AERA/APA/NCME (2014) remains the current published testing-standards edition while revision is underway, and ISO/IEC 25012:2008 remains current after its 2025 review as structured-data-quality support. Exact-head hosted Rust/documentation/security/supply-chain/100%-coverage gates and a qualifying independent current-head review remain required. @@ -198,18 +200,19 @@ Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/num | GAP-042 | Ratio-first logarithm could nearly double an adjacent-float power-of-two irregular residual growth rate before event-time scaling | `verification-pending` | public RED `766ddc7a...` + causal `ln_1p` repair `16f21d9a...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-043 | Duplicate known-truth component identities could silently reweight RMSE recovery evidence by changing the denominator without adding a new scientific target | `verification-pending` | public RED `698f12f5...` + uniqueness repair `2fae4cb2...` + current trace `c9cb68d3...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-044 | Known-truth component RMSE alignment and deterministic binary64 accumulation depended on serialization row order rather than scientific component identity | `verification-pending` | cross-slice RED `8ad72ac9...` + alignment repair `2dd9537e...` + rounding RED `5fb93c40...` + canonical-order repair `025dce7f...` + edge `976ce7d7...` + current #310 `c6680450...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | public RED `c5ec42e4...` + scaled repair `7499042f...` + current #488 `60166eaf...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-046 | Bias standard error could reject a representable SEM because raw squared deviations, their sum, or an intermediate sample variance overflowed | `verification-pending` | public RED `7de0ef90...` + scaled direct-SEM repair `cad23162...` + edges `8a6cc346...` / `28d96c23...` + current #488 `60166eaf...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-047 | Generic Validation Evidence RMSE/RMSE-SE could reject representable extreme recovery or collapse a representable/nonzero subnormal error to false perfect recovery because residuals were squared before scale normalization | `verification-pending` | extreme RED `dd41ff53...` + subnormal RED `f4e19991...` + repair `6b182107...` + current #488 `60166eaf...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-048 | Validation Evidence mean signed bias could erase a representable subnormal residual contribution by normalizing to an unrelated extreme magnitude before mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...` + hardening `77dcf38c...` + current #488 `60166eaf...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | public RED `c5ec42e4...` + scaled repair `7499042f...` + current #488 `0ba16c08...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-046 | Bias standard error could reject a representable SEM because raw squared deviations, their sum, or an intermediate sample variance overflowed | `verification-pending` | public RED `7de0ef90...` + scaled direct-SEM repair `cad23162...` + edges `8a6cc346...` / `28d96c23...` + current #488 `0ba16c08...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-047 | Generic Validation Evidence RMSE/RMSE-SE could reject representable extreme recovery or collapse a representable/nonzero subnormal error to false perfect recovery because residuals were squared before scale normalization | `verification-pending` | extreme RED `dd41ff53...` + subnormal RED `f4e19991...` + repair `6b182107...` + current #488 `0ba16c08...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-048 | Validation Evidence mean signed bias could erase a representable subnormal residual contribution by normalizing to an unrelated extreme magnitude before mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...` + hardening `77dcf38c...` + current #488 `0ba16c08...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-049 | Stable `Between` recovery could be aliased across occasion indices, duplicating one unit-level scientific target and silently changing the RMSE denominator | `verification-pending` | RED `0a03041c...` + fixture repair `53563e97...` + admission repair `ec2c1219...` + trace `c9cb68d3...` + current #310 `c6680450...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-050 | Zero-multiplier SE-aware acceptance could scale a nonzero residual to exact zero and falsely accept exact recovery when a large finite SE dominated normalization | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...` + current research `c45a76cf...` + current #488 `60166eaf...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-051 | Exact-recovery SE acceptance used IEEE total ordering and therefore treated `-0.0` and `+0.0` as different scientific recovery values | `verification-pending` | signed-zero RED `379e6525...` + numeric-equality repair `55876e60...` + research `c45a76cf...` + current #488 `60166eaf...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-052 | All-covered Wilson score coverage could cancel a positive binary64-representable lower endpoint to exact zero by subtracting nearly equal center and margin terms | `verification-pending` | public RED `f84e5918...` + exact all-covered endpoint repair `fe9b9c8a...` + current #488 `60166eaf...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-053 | Strict-interior Wilson score coverage could cancel a positive binary64-representable lower endpoint to exact zero even after the all-covered endpoint specialization | `verification-pending` | public RED `9d45f482...` + initial rationalized lower-root repair `4f259f6e...` + current #488 `60166eaf...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-054 | Wilson score coverage could falsely promote an all-uncovered or strict-interior upper endpoint to exact `1.0` when `center + margin` and the denominator rounded to the same binary64 value | `verification-pending` | all-uncovered RED `c070da26...` + strict-interior RED expansion `344081bf...` + complementary rationalized repair `9a2fdd05...` + current #488 `60166eaf...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-055 | Strict-interior Wilson score coverage could accept a nonzero `center - margin` cancellation residue as the scientific lower endpoint, overstating a representable endpoint by orders of magnitude even though the subtraction did not collapse to zero | `verification-pending` | public RED `1a24fac7...` + scale-aware rationalized-lower repair `f7e20ddc...` + small-`z` reinforcement `39e5e087...` + current #488 `60166eaf...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-056 | Durable or human-facing Validation Evidence could accept impossible finite report fields/cross-field relationships or bypass validation through serde/human projections, including standalone Monte Carlo summary egress | `verification-pending` | report domain RED/repair `e9414e6f...`/`28924b0d...` + ingress RED/repair `6d190cd7...`/`f70a6fc0...` + report direct-egress RED/repair `fb28f959...`/`f7e58ccd...` + Monte Carlo direct-egress RED/repair `b5a8ae1f...`/`18374c35...` + human projection RED/repair `541273f1...`/`53607f80...` + changelog `d1f1b85a...` + research/current #488 `60166eaf...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-050 | Zero-multiplier SE-aware acceptance could scale a nonzero residual to exact zero and falsely accept exact recovery when a large finite SE dominated normalization | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...` + current research `c45a76cf...` + current #488 `0ba16c08...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-051 | Exact-recovery SE acceptance used IEEE total ordering and therefore treated `-0.0` and `+0.0` as different scientific recovery values | `verification-pending` | signed-zero RED `379e6525...` + numeric-equality repair `55876e60...` + research `c45a76cf...` + current #488 `0ba16c08...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-052 | All-covered Wilson score coverage could cancel a positive binary64-representable lower endpoint to exact zero by subtracting nearly equal center and margin terms | `verification-pending` | public RED `f84e5918...` + exact all-covered endpoint repair `fe9b9c8a...` + current #488 `0ba16c08...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-053 | Strict-interior Wilson score coverage could cancel a positive binary64-representable lower endpoint to exact zero even after the all-covered endpoint specialization | `verification-pending` | public RED `9d45f482...` + initial rationalized lower-root repair `4f259f6e...` + current #488 `0ba16c08...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-054 | Wilson score coverage could falsely promote an all-uncovered or strict-interior upper endpoint to exact `1.0` when `center + margin` and the denominator rounded to the same binary64 value | `verification-pending` | all-uncovered RED `c070da26...` + strict-interior RED expansion `344081bf...` + complementary rationalized repair `9a2fdd05...` + current #488 `0ba16c08...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-055 | Strict-interior Wilson score coverage could accept a nonzero `center - margin` cancellation residue as the scientific lower endpoint, overstating a representable endpoint by orders of magnitude even though the subtraction did not collapse to zero | `verification-pending` | public RED `1a24fac7...` + scale-aware rationalized-lower repair `f7e20ddc...` + small-`z` reinforcement `39e5e087...` + current #488 `0ba16c08...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-056 | Durable or human-facing Validation Evidence could accept impossible finite report fields/cross-field relationships or bypass validation through serde/human projections, including standalone Monte Carlo summary egress | `verification-pending` | report domain RED/repair `e9414e6f...`/`28924b0d...` + ingress RED/repair `6d190cd7...`/`f70a6fc0...` + report direct-egress RED/repair `fb28f959...`/`f7e58ccd...` + Monte Carlo direct-egress RED/repair `b5a8ae1f...`/`18374c35...` + human projection RED/repair `541273f1...`/`53607f80...` + current #488 `0ba16c08...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-057 | `ValidationReport::monte_carlo_rmse` could admit a structurally valid generic Monte Carlo summary whose negative mean or percentile values are impossible for RMSE, allowing signed-metric semantics to leak into RMSE-specific Validation Evidence | `verification-pending` | public RED `3cd6e41d...` + report-boundary repair `0090259d...` + changelog `d2631d1b...` + research/current #488 `0ba16c08...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | ## Release gate From 166036fb0db46e3a045e12067fb04ec365667831 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 4 Sep 2026 06:18:50 +0900 Subject: [PATCH 147/235] docs(ddd): trace Monte Carlo uncertainty coherence --- docs/product-technical-gap-baseline.md | 39 ++++++++++++++------------ 1 file changed, 21 insertions(+), 18 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index f357c0758..dc401dd42 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,7 +4,7 @@ **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-03T20:34Z +**Snapshot:** 2026-09-03T21:00Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` @@ -34,7 +34,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `0ba16c080b4bea12873aacb252c49497d34a2162` | true | `main` | Validation Evidence numerical/artifact repair. Bias/RMSE/Monte Carlo retain representable extreme/subnormal evidence; zero-multiplier SE-aware acceptance is exact-recovery before scale reduction; signed IEEE zeros are one numeric exact-recovery value. Wilson endpoints use stable represented roots where direct evaluation loses the estimand. `ValidationReport` enforces metric domains and Wilson coherence on explicit validation, serde ingress/egress, and human-readable projection. A generic `MonteCarloSummary` remains sign-neutral, but the `monte_carlo_rmse` embedding additionally requires nonnegative mean and percentile endpoints because RMSE replications cannot be negative. Exact-head hosted gates and independent review remain required. | +| #488 | `bc77b7081a8967e9f38a89c34fa4d68c737238c7` | true | `main` | Validation Evidence numerical/artifact repair. Bias/RMSE/Monte Carlo retain representable extreme/subnormal evidence; zero-multiplier SE-aware acceptance is exact-recovery before scale reduction; signed IEEE zeros are one numeric exact-recovery value. Wilson endpoints use stable represented roots where direct evaluation loses the estimand. `ValidationReport` enforces metric domains and Wilson coherence on explicit validation, serde ingress/egress, and human-readable projection. A generic `MonteCarloSummary` remains sign-neutral, but its durable uncertainty fields now reject impossible finite combinations: false-zero SE with nonzero SD, multi-replication SE at least as large as a positive SD, and nonzero singleton spread/SE. The `monte_carlo_rmse` embedding additionally requires nonnegative mean and percentile endpoints because RMSE replications cannot be negative. Exact-head hosted gates and independent review remain required. | | #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 `feat/copy-identity-analysis-run-gap-004` | Validation / Analysis Run fold child. Sparse observed relation classes are valid evidence; RED `a2892b6...`, repair `a6402015...`, predecessor-test correction `6b0c8de6...`; ADR 0079 is `Proposed`. No child-head CI transfers to #416. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | @@ -70,11 +70,11 @@ The clock contract separates event/valid time, assertion time, document time, sy - Mean signed bias is a Validation Evidence performance measure over admitted recovery units. Opposite-sign represented residuals cancel before scale reduction; a representable low-order bias must survive cancellation of unrelated extreme terms. Exact cancellation remains zero, while a mathematically nonzero bias below binary64 range fails closed. - Bias standard error is formed from the same admitted signed differences. A representable SEM must not fail solely because raw squared deviations, their sum, or an intermediate sample variance overflows. - Generic Validation Evidence RMSE and its delta-method standard error normalize finite residual magnitudes before squaring. A representable extreme or minimum-subnormal RMSE must survive avoidable intermediate overflow/underflow, while a mathematically nonzero final RMSE or SE below the binary64 range fails closed. -- Monte Carlo mean/sample-SD/SE preserve representable uncertainty across full-range and subnormal replication values. Avoidable raw-product/Welford overflow or final false-zero uncertainty is not accepted as scientific evidence. +- Monte Carlo mean/sample-SD/SE preserve representable uncertainty across full-range and subnormal replication values. Avoidable raw-product/Welford overflow or final false-zero uncertainty is not accepted as scientific evidence. Durable `MonteCarloSummary` admission also rejects finite uncertainty combinations that cannot be a standard error of the represented replication mean: nonzero SD with zero SE, `n > 1` with positive `SE >= SD`, and nonzero SD/SE for the canonical singleton summary. The canonical producer still computes `SE = SD / sqrt(n)`; external payload admission deliberately does not require cross-language bit-for-bit equality with that binary64 calculation. - SE-aware acceptance is the declared rule `|estimate - target| <= k * SE`. For `k = 0`, the bound is exactly zero and exact recovery is evaluated before scale reduction; a large finite SE cannot erase a nonzero residual into acceptance. - Exact-recovery acceptance is finite numeric equality, not IEEE total-order identity. `-0.0` and `+0.0` therefore produce one zero-error decision while nonzero finite residuals remain distinct; this does not require blanket signed-zero canonicalization in private numerical intermediates. - Wilson interval coverage evidence must preserve representable endpoints. All-covered lower bounds use `n / (n + z²)`. Every nonzero strict-interior lower bound uses the algebraically rationalized positive root; the implementation evaluates it on natural scale for `z² < 1` and on `z²`-normalized scale for `z² >= 1`. Thus neither exact-zero collapse nor a nonzero `center - margin` cancellation residue is accepted as the endpoint. If direct `center + margin` rounds an upper endpoint to exact one while uncovered mass is nonzero, the complementary uncovered lower root is evaluated with the same stable representation and subtracted from one. -- Durable and human-facing Validation Evidence must preserve producing-metric invariants at every supported projection boundary, not merely binary64 finiteness. `ValidationReport` enforces nonnegative error/SE fields, probability/accuracy domains, Wilson ordering and containment on explicit validation, JSON/serde ingress and egress, and human-readable summary projection. `MonteCarloSummary` remains generic and sign-neutral; when embedded as `ValidationReport::monte_carlo_rmse`, its mean and percentile endpoints are additionally nonnegative because each RMSE replication is nonnegative. Direct `MonteCarloSummary` serialization still applies its generic count/finiteness/nonnegative-uncertainty/percentile-order contract. +- Durable and human-facing Validation Evidence must preserve producing-metric invariants at every supported projection boundary, not merely binary64 finiteness. `ValidationReport` enforces nonnegative error/SE fields, probability/accuracy domains, Wilson ordering and containment on explicit validation, JSON/serde ingress and egress, and human-readable summary projection. `MonteCarloSummary` remains generic and sign-neutral; when embedded as `ValidationReport::monte_carlo_rmse`, its mean and percentile endpoints are additionally nonnegative because each RMSE replication is nonnegative. Direct `MonteCarloSummary` serialization applies count/finiteness/nonnegative-uncertainty/percentile-order plus the impossible-SE coherence rules above. - Bias, RMSE, and Monte Carlo may share private deterministic scalar support inside `validation_core`, but metric-specific cancellation/normalization, denominator, uncertainty, and fail-closed semantics remain with their bounded modules; support primitives are not second psychometric estimator authorities. - A mathematically nonzero scientific error metric must not be promoted to exact perfect recovery merely because its final binary64 representation underflows to zero. - Known-truth recovery denominators are defined by unique scientific component identity. Duplicate rows and stable-Between occasion aliases are not implicit weights unless a separately named weighted contract explicitly owns weighting. @@ -108,7 +108,7 @@ Current #310 exact-head workflows and a qualifying independent current-head appr ### #488 — Validation Evidence recovery arithmetic -#488 is the generic Validation Evidence landing vehicle at exact head `0ba16c080b4bea12873aacb252c49497d34a2162`. It remains distinct from Longitudinal Modeling and does not consume mutable fast-mlsirm source. +#488 is the generic Validation Evidence landing vehicle at exact head `bc77b7081a8967e9f38a89c34fa4d68c737238c7`. It remains distinct from Longitudinal Modeling and does not consume mutable fast-mlsirm source. Mean signed bias no longer depends on a raw finite sum that can overflow before division (`c5ec42e4...`→`7499042f...`). Full-range mixed-sign cancellation preserves representable low-order bias before scale reduction (`b6084750...`→`227921d9...`, hardening `77dcf38c...`). Bias SEM scales deviations before squaring and forms the final SEM without avoidable variance overflow (`7de0ef90...`→`cad23162...`, edges `8a6cc346...`/`28d96c23...`). @@ -128,7 +128,9 @@ The complementary upper endpoint had the dual false-one failure. With two uncove Durable/human-facing artifact admission exposed a separate Validation Evidence defect: finite scalar representation was treated as sufficient report validity. Public RED `e9414e6f7b824c2dc508f335d355b97b7e399b9` rejects negative RMSE/SE, out-of-domain probabilities, inverted Wilson bounds, and coverage outside its paired Wilson interval; repair `28924b0d82bc2d4663f5ba1317cc0c3d94a4833b` enforces those invariants. Serde ingress RED/repair `6d190cd783a00f8ce917e37b63ae87053a929ae1`/`f70a6fc0e58c2ae419c3b3bac322db5f35efe538` close deserialization bypass, while direct-report egress RED/repair `fb28f959297a50cf50e26ea14dc9bfb5ee10ea89`/`f7e58ccdb1864ce775ef6797f7fd88596dff1269` close alternate serialization. Standalone `MonteCarloSummary` retained the same egress bypass despite an existing validator; RED `b5a8ae1fbd1344b09a9fbb3c65a3c6d0cdc38c28`, repair `18374c35061fb0b98bfe09079d4967baef7697b4`. Human summary projection was a final bypass: RED `541273f10d2085680073fb8ca9dc72d3cbe1e62b` and repair `53607f8033ee03b409c8fce4ee464797e8cb7be1` make it return `Result` and validate first. -The nested RMSE summary then exposed a narrower semantic admission bug. `MonteCarloSummary` must remain sign-neutral because it can summarize signed bias, but `ValidationReport::monte_carlo_rmse` gives the same structure RMSE-specific semantics. A negative mean or percentile endpoint is therefore impossible RMSE evidence even when the generic summary is structurally valid. Public RED `3cd6e41ddeffbb41e0a6179a65bc3dd9b60f41d8`; causal report-boundary repair `0090259d01ee00ad0de35ba0c4c9cb7a37c0b13c`; changelog `d2631d1b0047ba8dbf78058272ea6c00d9b0c9a3`; research/current #488 `0ba16c080b4bea12873aacb252c49497d34a2162`. +The nested RMSE summary then exposed a narrower semantic admission bug. `MonteCarloSummary` must remain sign-neutral because it can summarize signed bias, but `ValidationReport::monte_carlo_rmse` gives the same structure RMSE-specific semantics. A negative mean or percentile endpoint is therefore impossible RMSE evidence even when the generic summary is structurally valid. Public RED `3cd6e41ddeffbb41e0a6179a65bc3dd9b60f41d8`; causal report-boundary repair `0090259d01ee00ad0de35ba0c4c9cb7a37c0b13c`; changelog `d2631d1b0047ba8dbf78058272ea6c00d9b0c9a3`; research predecessor `0ba16c080b4bea12873aacb252c49497d34a2162`. + +Fresh generic-carrier review found an independent durable-uncertainty admission gap. `summarize_replications` already computes `SE = SD / sqrt(n)`, but an externally constructed/deserialized `MonteCarloSummary` previously needed only finite nonnegative SD/SE. That admitted impossible evidence such as `n = 4, SD = 0.5, SE = 0.5`, nonzero SD with exact-zero SE, or a singleton with nonzero spread. Isolating RED `e2d0c057d39b7786dbd96528d4e259775c6c2e01`; causal repair `0e973b566ec969d0fea8b7403bf09602cdebd4a3`; edge contract `858368c8fda0d7a33f95b821eba2c5b80dc65cfd`; changelog `aaf60b83c9fabad4211df04f1a51b06c7297e8d3`; research/current #488 `bc77b7081a8967e9f38a89c34fa4d68c737238c7`. The admission boundary rejects scientifically impossible uncertainty without making a serialized interoperability contract depend on exact cross-language binary64 reproduction of `SD / sqrt(n)`. Morris, White, and Crowther (2019) remain the simulation performance-measure/Monte Carlo uncertainty methodology trace; Wilson (1927) remains the primary score-interval reference. AERA/APA/NCME (2014) remains the current published testing-standards edition while revision is underway, and ISO/IEC 25012:2008 remains current after its 2025 review as structured-data-quality support. Exact-head hosted Rust/documentation/security/supply-chain/100%-coverage gates and a qualifying independent current-head review remain required. @@ -200,19 +202,20 @@ Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/num | GAP-042 | Ratio-first logarithm could nearly double an adjacent-float power-of-two irregular residual growth rate before event-time scaling | `verification-pending` | public RED `766ddc7a...` + causal `ln_1p` repair `16f21d9a...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-043 | Duplicate known-truth component identities could silently reweight RMSE recovery evidence by changing the denominator without adding a new scientific target | `verification-pending` | public RED `698f12f5...` + uniqueness repair `2fae4cb2...` + current trace `c9cb68d3...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-044 | Known-truth component RMSE alignment and deterministic binary64 accumulation depended on serialization row order rather than scientific component identity | `verification-pending` | cross-slice RED `8ad72ac9...` + alignment repair `2dd9537e...` + rounding RED `5fb93c40...` + canonical-order repair `025dce7f...` + edge `976ce7d7...` + current #310 `c6680450...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | public RED `c5ec42e4...` + scaled repair `7499042f...` + current #488 `0ba16c08...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-046 | Bias standard error could reject a representable SEM because raw squared deviations, their sum, or an intermediate sample variance overflowed | `verification-pending` | public RED `7de0ef90...` + scaled direct-SEM repair `cad23162...` + edges `8a6cc346...` / `28d96c23...` + current #488 `0ba16c08...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-047 | Generic Validation Evidence RMSE/RMSE-SE could reject representable extreme recovery or collapse a representable/nonzero subnormal error to false perfect recovery because residuals were squared before scale normalization | `verification-pending` | extreme RED `dd41ff53...` + subnormal RED `f4e19991...` + repair `6b182107...` + current #488 `0ba16c08...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-048 | Validation Evidence mean signed bias could erase a representable subnormal residual contribution by normalizing to an unrelated extreme magnitude before mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...` + hardening `77dcf38c...` + current #488 `0ba16c08...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | public RED `c5ec42e4...` + scaled repair `7499042f...` + current #488 `bc77b708...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-046 | Bias standard error could reject a representable SEM because raw squared deviations, their sum, or an intermediate sample variance overflowed | `verification-pending` | public RED `7de0ef90...` + scaled direct-SEM repair `cad23162...` + edges `8a6cc346...` / `28d96c23...` + current #488 `bc77b708...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-047 | Generic Validation Evidence RMSE/RMSE-SE could reject representable extreme recovery or collapse a representable/nonzero subnormal error to false perfect recovery because residuals were squared before scale normalization | `verification-pending` | extreme RED `dd41ff53...` + subnormal RED `f4e19991...` + repair `6b182107...` + current #488 `bc77b708...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-048 | Validation Evidence mean signed bias could erase a representable subnormal residual contribution by normalizing to an unrelated extreme magnitude before mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...` + hardening `77dcf38c...` + current #488 `bc77b708...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-049 | Stable `Between` recovery could be aliased across occasion indices, duplicating one unit-level scientific target and silently changing the RMSE denominator | `verification-pending` | RED `0a03041c...` + fixture repair `53563e97...` + admission repair `ec2c1219...` + trace `c9cb68d3...` + current #310 `c6680450...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-050 | Zero-multiplier SE-aware acceptance could scale a nonzero residual to exact zero and falsely accept exact recovery when a large finite SE dominated normalization | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...` + current research `c45a76cf...` + current #488 `0ba16c08...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-051 | Exact-recovery SE acceptance used IEEE total ordering and therefore treated `-0.0` and `+0.0` as different scientific recovery values | `verification-pending` | signed-zero RED `379e6525...` + numeric-equality repair `55876e60...` + research `c45a76cf...` + current #488 `0ba16c08...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-052 | All-covered Wilson score coverage could cancel a positive binary64-representable lower endpoint to exact zero by subtracting nearly equal center and margin terms | `verification-pending` | public RED `f84e5918...` + exact all-covered endpoint repair `fe9b9c8a...` + current #488 `0ba16c08...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-053 | Strict-interior Wilson score coverage could cancel a positive binary64-representable lower endpoint to exact zero even after the all-covered endpoint specialization | `verification-pending` | public RED `9d45f482...` + initial rationalized lower-root repair `4f259f6e...` + current #488 `0ba16c08...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-054 | Wilson score coverage could falsely promote an all-uncovered or strict-interior upper endpoint to exact `1.0` when `center + margin` and the denominator rounded to the same binary64 value | `verification-pending` | all-uncovered RED `c070da26...` + strict-interior RED expansion `344081bf...` + complementary rationalized repair `9a2fdd05...` + current #488 `0ba16c08...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-055 | Strict-interior Wilson score coverage could accept a nonzero `center - margin` cancellation residue as the scientific lower endpoint, overstating a representable endpoint by orders of magnitude even though the subtraction did not collapse to zero | `verification-pending` | public RED `1a24fac7...` + scale-aware rationalized-lower repair `f7e20ddc...` + small-`z` reinforcement `39e5e087...` + current #488 `0ba16c08...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-056 | Durable or human-facing Validation Evidence could accept impossible finite report fields/cross-field relationships or bypass validation through serde/human projections, including standalone Monte Carlo summary egress | `verification-pending` | report domain RED/repair `e9414e6f...`/`28924b0d...` + ingress RED/repair `6d190cd7...`/`f70a6fc0...` + report direct-egress RED/repair `fb28f959...`/`f7e58ccd...` + Monte Carlo direct-egress RED/repair `b5a8ae1f...`/`18374c35...` + human projection RED/repair `541273f1...`/`53607f80...` + current #488 `0ba16c08...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-057 | `ValidationReport::monte_carlo_rmse` could admit a structurally valid generic Monte Carlo summary whose negative mean or percentile values are impossible for RMSE, allowing signed-metric semantics to leak into RMSE-specific Validation Evidence | `verification-pending` | public RED `3cd6e41d...` + report-boundary repair `0090259d...` + changelog `d2631d1b...` + research/current #488 `0ba16c08...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-050 | Zero-multiplier SE-aware acceptance could scale a nonzero residual to exact zero and falsely accept exact recovery when a large finite SE dominated normalization | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...` + current research `c45a76cf...` + current #488 `bc77b708...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-051 | Exact-recovery SE acceptance used IEEE total ordering and therefore treated `-0.0` and `+0.0` as different scientific recovery values | `verification-pending` | signed-zero RED `379e6525...` + numeric-equality repair `55876e60...` + research `c45a76cf...` + current #488 `bc77b708...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-052 | All-covered Wilson score coverage could cancel a positive binary64-representable lower endpoint to exact zero by subtracting nearly equal center and margin terms | `verification-pending` | public RED `f84e5918...` + exact all-covered endpoint repair `fe9b9c8a...` + current #488 `bc77b708...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-053 | Strict-interior Wilson score coverage could cancel a positive binary64-representable lower endpoint to exact zero even after the all-covered endpoint specialization | `verification-pending` | public RED `9d45f482...` + initial rationalized lower-root repair `4f259f6e...` + current #488 `bc77b708...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-054 | Wilson score coverage could falsely promote an all-uncovered or strict-interior upper endpoint to exact `1.0` when `center + margin` and the denominator rounded to the same binary64 value | `verification-pending` | all-uncovered RED `c070da26...` + strict-interior RED expansion `344081bf...` + complementary rationalized repair `9a2fdd05...` + current #488 `bc77b708...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-055 | Strict-interior Wilson score coverage could accept a nonzero `center - margin` cancellation residue as the scientific lower endpoint, overstating a representable endpoint by orders of magnitude even though the subtraction did not collapse to zero | `verification-pending` | public RED `1a24fac7...` + scale-aware rationalized-lower repair `f7e20ddc...` + small-`z` reinforcement `39e5e087...` + current #488 `bc77b708...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-056 | Durable or human-facing Validation Evidence could accept impossible finite report fields/cross-field relationships or bypass validation through serde/human projections, including standalone Monte Carlo summary egress | `verification-pending` | report domain RED/repair `e9414e6f...`/`28924b0d...` + ingress RED/repair `6d190cd7...`/`f70a6fc0...` + report direct-egress RED/repair `fb28f959...`/`f7e58ccd...` + Monte Carlo direct-egress RED/repair `b5a8ae1f...`/`18374c35...` + human projection RED/repair `541273f1...`/`53607f80...` + current #488 `bc77b708...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-057 | `ValidationReport::monte_carlo_rmse` could admit a structurally valid generic Monte Carlo summary whose negative mean or percentile values are impossible for RMSE, allowing signed-metric semantics to leak into RMSE-specific Validation Evidence | `verification-pending` | public RED `3cd6e41d...` + report-boundary repair `0090259d...` + changelog `d2631d1b...` + current #488 `bc77b708...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-058 | Durable generic Monte Carlo summaries could admit finite but impossible uncertainty relationships because SD, SE, and replication count were validated independently | `verification-pending` | isolating RED `e2d0c057...` + causal repair `0e973b56...` + edge contract `858368c8...` + changelog `aaf60b83...` + research/current #488 `bc77b708...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | ## Release gate From 5615ad3ef4fe566f99a6c4ae0907346d56816be6 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 4 Sep 2026 06:51:21 +0900 Subject: [PATCH 148/235] docs(ddd): add Monte Carlo SEM coherence gap --- docs/product-technical-gap-baseline.md | 41 ++++++++++++++------------ 1 file changed, 22 insertions(+), 19 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index dc401dd42..3e09c5882 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,7 +4,7 @@ **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-03T21:00Z +**Snapshot:** 2026-09-03T21:45Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` @@ -34,7 +34,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `bc77b7081a8967e9f38a89c34fa4d68c737238c7` | true | `main` | Validation Evidence numerical/artifact repair. Bias/RMSE/Monte Carlo retain representable extreme/subnormal evidence; zero-multiplier SE-aware acceptance is exact-recovery before scale reduction; signed IEEE zeros are one numeric exact-recovery value. Wilson endpoints use stable represented roots where direct evaluation loses the estimand. `ValidationReport` enforces metric domains and Wilson coherence on explicit validation, serde ingress/egress, and human-readable projection. A generic `MonteCarloSummary` remains sign-neutral, but its durable uncertainty fields now reject impossible finite combinations: false-zero SE with nonzero SD, multi-replication SE at least as large as a positive SD, and nonzero singleton spread/SE. The `monte_carlo_rmse` embedding additionally requires nonnegative mean and percentile endpoints because RMSE replications cannot be negative. Exact-head hosted gates and independent review remain required. | +| #488 | `f674183b55e1855cef45561be6d38d9935c62b50` | true | `main` | Validation Evidence numerical/artifact repair. Bias/RMSE/Monte Carlo retain representable extreme/subnormal evidence; zero-multiplier SE-aware acceptance is exact-recovery before scale reduction; signed IEEE zeros are one numeric exact-recovery value. Wilson endpoints use stable represented roots where direct evaluation loses the estimand. `ValidationReport` enforces metric domains and Wilson coherence on explicit validation, serde ingress/egress, and human-readable projection. A generic `MonteCarloSummary` remains sign-neutral, but its durable uncertainty now requires positive-spread `SE` to agree with the represented `SD / sqrt(n)` relationship within a small binary64 relative tolerance, zero spread to carry zero SE, and singleton summaries to carry zero spread/SE. The `monte_carlo_rmse` embedding additionally requires nonnegative mean and percentile endpoints because RMSE replications cannot be negative. Exact-head hosted gates and independent review remain required. | | #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 `feat/copy-identity-analysis-run-gap-004` | Validation / Analysis Run fold child. Sparse observed relation classes are valid evidence; RED `a2892b6...`, repair `a6402015...`, predecessor-test correction `6b0c8de6...`; ADR 0079 is `Proposed`. No child-head CI transfers to #416. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | @@ -70,11 +70,11 @@ The clock contract separates event/valid time, assertion time, document time, sy - Mean signed bias is a Validation Evidence performance measure over admitted recovery units. Opposite-sign represented residuals cancel before scale reduction; a representable low-order bias must survive cancellation of unrelated extreme terms. Exact cancellation remains zero, while a mathematically nonzero bias below binary64 range fails closed. - Bias standard error is formed from the same admitted signed differences. A representable SEM must not fail solely because raw squared deviations, their sum, or an intermediate sample variance overflows. - Generic Validation Evidence RMSE and its delta-method standard error normalize finite residual magnitudes before squaring. A representable extreme or minimum-subnormal RMSE must survive avoidable intermediate overflow/underflow, while a mathematically nonzero final RMSE or SE below the binary64 range fails closed. -- Monte Carlo mean/sample-SD/SE preserve representable uncertainty across full-range and subnormal replication values. Avoidable raw-product/Welford overflow or final false-zero uncertainty is not accepted as scientific evidence. Durable `MonteCarloSummary` admission also rejects finite uncertainty combinations that cannot be a standard error of the represented replication mean: nonzero SD with zero SE, `n > 1` with positive `SE >= SD`, and nonzero SD/SE for the canonical singleton summary. The canonical producer still computes `SE = SD / sqrt(n)`; external payload admission deliberately does not require cross-language bit-for-bit equality with that binary64 calculation. +- Monte Carlo mean/sample-SD/SE preserve representable uncertainty across full-range and subnormal replication values. Avoidable raw-product/Welford overflow or final false-zero uncertainty is not accepted as scientific evidence. Durable `MonteCarloSummary` admission requires zero SD to carry zero SE and positive SD to carry a positive SE coherent with `SD / sqrt(n)` within a small relative binary64 tolerance; singleton summaries require zero spread/SE. The tolerance prevents bit-pattern equality from becoming an interoperability requirement while still rejecting materially understated or overstated uncertainty. - SE-aware acceptance is the declared rule `|estimate - target| <= k * SE`. For `k = 0`, the bound is exactly zero and exact recovery is evaluated before scale reduction; a large finite SE cannot erase a nonzero residual into acceptance. - Exact-recovery acceptance is finite numeric equality, not IEEE total-order identity. `-0.0` and `+0.0` therefore produce one zero-error decision while nonzero finite residuals remain distinct; this does not require blanket signed-zero canonicalization in private numerical intermediates. - Wilson interval coverage evidence must preserve representable endpoints. All-covered lower bounds use `n / (n + z²)`. Every nonzero strict-interior lower bound uses the algebraically rationalized positive root; the implementation evaluates it on natural scale for `z² < 1` and on `z²`-normalized scale for `z² >= 1`. Thus neither exact-zero collapse nor a nonzero `center - margin` cancellation residue is accepted as the endpoint. If direct `center + margin` rounds an upper endpoint to exact one while uncovered mass is nonzero, the complementary uncovered lower root is evaluated with the same stable representation and subtracted from one. -- Durable and human-facing Validation Evidence must preserve producing-metric invariants at every supported projection boundary, not merely binary64 finiteness. `ValidationReport` enforces nonnegative error/SE fields, probability/accuracy domains, Wilson ordering and containment on explicit validation, JSON/serde ingress and egress, and human-readable summary projection. `MonteCarloSummary` remains generic and sign-neutral; when embedded as `ValidationReport::monte_carlo_rmse`, its mean and percentile endpoints are additionally nonnegative because each RMSE replication is nonnegative. Direct `MonteCarloSummary` serialization applies count/finiteness/nonnegative-uncertainty/percentile-order plus the impossible-SE coherence rules above. +- Durable and human-facing Validation Evidence must preserve producing-metric invariants at every supported projection boundary, not merely binary64 finiteness. `ValidationReport` enforces nonnegative error/SE fields, probability/accuracy domains, Wilson ordering and containment on explicit validation, JSON/serde ingress and egress, and human-readable summary projection. `MonteCarloSummary` remains generic and sign-neutral; when embedded as `ValidationReport::monte_carlo_rmse`, its mean and percentile endpoints are additionally nonnegative because each RMSE replication is nonnegative. Direct `MonteCarloSummary` serialization applies count/finiteness/nonnegative-uncertainty/percentile-order plus the canonical SEM-coherence rules above. - Bias, RMSE, and Monte Carlo may share private deterministic scalar support inside `validation_core`, but metric-specific cancellation/normalization, denominator, uncertainty, and fail-closed semantics remain with their bounded modules; support primitives are not second psychometric estimator authorities. - A mathematically nonzero scientific error metric must not be promoted to exact perfect recovery merely because its final binary64 representation underflows to zero. - Known-truth recovery denominators are defined by unique scientific component identity. Duplicate rows and stable-Between occasion aliases are not implicit weights unless a separately named weighted contract explicitly owns weighting. @@ -108,7 +108,7 @@ Current #310 exact-head workflows and a qualifying independent current-head appr ### #488 — Validation Evidence recovery arithmetic -#488 is the generic Validation Evidence landing vehicle at exact head `bc77b7081a8967e9f38a89c34fa4d68c737238c7`. It remains distinct from Longitudinal Modeling and does not consume mutable fast-mlsirm source. +#488 is the generic Validation Evidence landing vehicle at exact head `f674183b55e1855cef45561be6d38d9935c62b50`. It remains distinct from Longitudinal Modeling and does not consume mutable fast-mlsirm source. Mean signed bias no longer depends on a raw finite sum that can overflow before division (`c5ec42e4...`→`7499042f...`). Full-range mixed-sign cancellation preserves representable low-order bias before scale reduction (`b6084750...`→`227921d9...`, hardening `77dcf38c...`). Bias SEM scales deviations before squaring and forms the final SEM without avoidable variance overflow (`7de0ef90...`→`cad23162...`, edges `8a6cc346...`/`28d96c23...`). @@ -130,7 +130,9 @@ Durable/human-facing artifact admission exposed a separate Validation Evidence d The nested RMSE summary then exposed a narrower semantic admission bug. `MonteCarloSummary` must remain sign-neutral because it can summarize signed bias, but `ValidationReport::monte_carlo_rmse` gives the same structure RMSE-specific semantics. A negative mean or percentile endpoint is therefore impossible RMSE evidence even when the generic summary is structurally valid. Public RED `3cd6e41ddeffbb41e0a6179a65bc3dd9b60f41d8`; causal report-boundary repair `0090259d01ee00ad0de35ba0c4c9cb7a37c0b13c`; changelog `d2631d1b0047ba8dbf78058272ea6c00d9b0c9a3`; research predecessor `0ba16c080b4bea12873aacb252c49497d34a2162`. -Fresh generic-carrier review found an independent durable-uncertainty admission gap. `summarize_replications` already computes `SE = SD / sqrt(n)`, but an externally constructed/deserialized `MonteCarloSummary` previously needed only finite nonnegative SD/SE. That admitted impossible evidence such as `n = 4, SD = 0.5, SE = 0.5`, nonzero SD with exact-zero SE, or a singleton with nonzero spread. Isolating RED `e2d0c057d39b7786dbd96528d4e259775c6c2e01`; causal repair `0e973b566ec969d0fea8b7403bf09602cdebd4a3`; edge contract `858368c8fda0d7a33f95b821eba2c5b80dc65cfd`; changelog `aaf60b83c9fabad4211df04f1a51b06c7297e8d3`; research/current #488 `bc77b7081a8967e9f38a89c34fa4d68c737238c7`. The admission boundary rejects scientifically impossible uncertainty without making a serialized interoperability contract depend on exact cross-language binary64 reproduction of `SD / sqrt(n)`. +Generic-carrier review first found that externally constructed/deserialized `MonteCarloSummary` values could encode impossible coarse relationships: `n = 4, SD = 0.5, SE = 0.5`, positive SD with exact-zero SE, or a singleton with nonzero spread. Isolating RED `e2d0c057d39b7786dbd96528d4e259775c6c2e01`; initial repair `0e973b566ec969d0fea8b7403bf09602cdebd4a3`; edge contract `858368c8fda0d7a33f95b821eba2c5b80dc65cfd`. + +A second review then showed that the inequality-only repair still admitted materially understated positive uncertainty. With `n = 4` and `SD = 0.5`, the summary contract implies `SE = 0.25`, but `SE = 0.2` was still accepted. Canonical-coherence RED `0a4c242fbd1c5b2f35e71a1ca1665ca9f7861338`; causal repair `9b53076a53032441623ff487a006ec6d20812030` validates the represented `SD / sqrt(n)` relationship and also closes zero-spread/positive-SE admission; cross-language tolerance regression `141246cfef7c44b327f7bfbeb22bc51279c6b9f0` admits the adjacent binary64 SE rather than requiring bit-pattern equality. Changelog `24a48acc5502bf1b773067c772ea7ca7e5722a2d`; research/current #488 `f674183b55e1855cef45561be6d38d9935c62b50`. Morris, White, and Crowther (2019) remain the simulation performance-measure/Monte Carlo uncertainty methodology trace; Wilson (1927) remains the primary score-interval reference. AERA/APA/NCME (2014) remains the current published testing-standards edition while revision is underway, and ISO/IEC 25012:2008 remains current after its 2025 review as structured-data-quality support. Exact-head hosted Rust/documentation/security/supply-chain/100%-coverage gates and a qualifying independent current-head review remain required. @@ -202,20 +204,21 @@ Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/num | GAP-042 | Ratio-first logarithm could nearly double an adjacent-float power-of-two irregular residual growth rate before event-time scaling | `verification-pending` | public RED `766ddc7a...` + causal `ln_1p` repair `16f21d9a...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-043 | Duplicate known-truth component identities could silently reweight RMSE recovery evidence by changing the denominator without adding a new scientific target | `verification-pending` | public RED `698f12f5...` + uniqueness repair `2fae4cb2...` + current trace `c9cb68d3...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-044 | Known-truth component RMSE alignment and deterministic binary64 accumulation depended on serialization row order rather than scientific component identity | `verification-pending` | cross-slice RED `8ad72ac9...` + alignment repair `2dd9537e...` + rounding RED `5fb93c40...` + canonical-order repair `025dce7f...` + edge `976ce7d7...` + current #310 `c6680450...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | public RED `c5ec42e4...` + scaled repair `7499042f...` + current #488 `bc77b708...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-046 | Bias standard error could reject a representable SEM because raw squared deviations, their sum, or an intermediate sample variance overflowed | `verification-pending` | public RED `7de0ef90...` + scaled direct-SEM repair `cad23162...` + edges `8a6cc346...` / `28d96c23...` + current #488 `bc77b708...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-047 | Generic Validation Evidence RMSE/RMSE-SE could reject representable extreme recovery or collapse a representable/nonzero subnormal error to false perfect recovery because residuals were squared before scale normalization | `verification-pending` | extreme RED `dd41ff53...` + subnormal RED `f4e19991...` + repair `6b182107...` + current #488 `bc77b708...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-048 | Validation Evidence mean signed bias could erase a representable subnormal residual contribution by normalizing to an unrelated extreme magnitude before mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...` + hardening `77dcf38c...` + current #488 `bc77b708...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | public RED `c5ec42e4...` + scaled repair `7499042f...` + current #488 `f674183b...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-046 | Bias standard error could reject a representable SEM because raw squared deviations, their sum, or an intermediate sample variance overflowed | `verification-pending` | public RED `7de0ef90...` + scaled direct-SEM repair `cad23162...` + edges `8a6cc346...` / `28d96c23...` + current #488 `f674183b...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-047 | Generic Validation Evidence RMSE/RMSE-SE could reject representable extreme recovery or collapse a representable/nonzero subnormal error to false perfect recovery because residuals were squared before scale normalization | `verification-pending` | extreme RED `dd41ff53...` + subnormal RED `f4e19991...` + repair `6b182107...` + current #488 `f674183b...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-048 | Validation Evidence mean signed bias could erase a representable subnormal residual contribution by normalizing to an unrelated extreme magnitude before mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...` + hardening `77dcf38c...` + current #488 `f674183b...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-049 | Stable `Between` recovery could be aliased across occasion indices, duplicating one unit-level scientific target and silently changing the RMSE denominator | `verification-pending` | RED `0a03041c...` + fixture repair `53563e97...` + admission repair `ec2c1219...` + trace `c9cb68d3...` + current #310 `c6680450...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-050 | Zero-multiplier SE-aware acceptance could scale a nonzero residual to exact zero and falsely accept exact recovery when a large finite SE dominated normalization | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...` + current research `c45a76cf...` + current #488 `bc77b708...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-051 | Exact-recovery SE acceptance used IEEE total ordering and therefore treated `-0.0` and `+0.0` as different scientific recovery values | `verification-pending` | signed-zero RED `379e6525...` + numeric-equality repair `55876e60...` + research `c45a76cf...` + current #488 `bc77b708...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-052 | All-covered Wilson score coverage could cancel a positive binary64-representable lower endpoint to exact zero by subtracting nearly equal center and margin terms | `verification-pending` | public RED `f84e5918...` + exact all-covered endpoint repair `fe9b9c8a...` + current #488 `bc77b708...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-053 | Strict-interior Wilson score coverage could cancel a positive binary64-representable lower endpoint to exact zero even after the all-covered endpoint specialization | `verification-pending` | public RED `9d45f482...` + initial rationalized lower-root repair `4f259f6e...` + current #488 `bc77b708...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-054 | Wilson score coverage could falsely promote an all-uncovered or strict-interior upper endpoint to exact `1.0` when `center + margin` and the denominator rounded to the same binary64 value | `verification-pending` | all-uncovered RED `c070da26...` + strict-interior RED expansion `344081bf...` + complementary rationalized repair `9a2fdd05...` + current #488 `bc77b708...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-055 | Strict-interior Wilson score coverage could accept a nonzero `center - margin` cancellation residue as the scientific lower endpoint, overstating a representable endpoint by orders of magnitude even though the subtraction did not collapse to zero | `verification-pending` | public RED `1a24fac7...` + scale-aware rationalized-lower repair `f7e20ddc...` + small-`z` reinforcement `39e5e087...` + current #488 `bc77b708...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-056 | Durable or human-facing Validation Evidence could accept impossible finite report fields/cross-field relationships or bypass validation through serde/human projections, including standalone Monte Carlo summary egress | `verification-pending` | report domain RED/repair `e9414e6f...`/`28924b0d...` + ingress RED/repair `6d190cd7...`/`f70a6fc0...` + report direct-egress RED/repair `fb28f959...`/`f7e58ccd...` + Monte Carlo direct-egress RED/repair `b5a8ae1f...`/`18374c35...` + human projection RED/repair `541273f1...`/`53607f80...` + current #488 `bc77b708...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-057 | `ValidationReport::monte_carlo_rmse` could admit a structurally valid generic Monte Carlo summary whose negative mean or percentile values are impossible for RMSE, allowing signed-metric semantics to leak into RMSE-specific Validation Evidence | `verification-pending` | public RED `3cd6e41d...` + report-boundary repair `0090259d...` + changelog `d2631d1b...` + current #488 `bc77b708...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-058 | Durable generic Monte Carlo summaries could admit finite but impossible uncertainty relationships because SD, SE, and replication count were validated independently | `verification-pending` | isolating RED `e2d0c057...` + causal repair `0e973b56...` + edge contract `858368c8...` + changelog `aaf60b83...` + research/current #488 `bc77b708...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-050 | Zero-multiplier SE-aware acceptance could scale a nonzero residual to exact zero and falsely accept exact recovery when a large finite SE dominated normalization | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...` + current research `c45a76cf...` + current #488 `f674183b...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-051 | Exact-recovery SE acceptance used IEEE total ordering and therefore treated `-0.0` and `+0.0` as different scientific recovery values | `verification-pending` | signed-zero RED `379e6525...` + numeric-equality repair `55876e60...` + research `c45a76cf...` + current #488 `f674183b...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-052 | All-covered Wilson score coverage could cancel a positive binary64-representable lower endpoint to exact zero by subtracting nearly equal center and margin terms | `verification-pending` | public RED `f84e5918...` + exact all-covered endpoint repair `fe9b9c8a...` + current #488 `f674183b...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-053 | Strict-interior Wilson score coverage could cancel a positive binary64-representable lower endpoint to exact zero even after the all-covered endpoint specialization | `verification-pending` | public RED `9d45f482...` + initial rationalized lower-root repair `4f259f6e...` + current #488 `f674183b...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-054 | Wilson score coverage could falsely promote an all-uncovered or strict-interior upper endpoint to exact `1.0` when `center + margin` and the denominator rounded to the same binary64 value | `verification-pending` | all-uncovered RED `c070da26...` + strict-interior RED expansion `344081bf...` + complementary rationalized repair `9a2fdd05...` + current #488 `f674183b...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-055 | Strict-interior Wilson score coverage could accept a nonzero `center - margin` cancellation residue as the scientific lower endpoint, overstating a representable endpoint by orders of magnitude even though the subtraction did not collapse to zero | `verification-pending` | public RED `1a24fac7...` + scale-aware rationalized-lower repair `f7e20ddc...` + small-`z` reinforcement `39e5e087...` + current #488 `f674183b...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-056 | Durable or human-facing Validation Evidence could accept impossible finite report fields/cross-field relationships or bypass validation through serde/human projections, including standalone Monte Carlo summary egress | `verification-pending` | report domain RED/repair `e9414e6f...`/`28924b0d...` + ingress RED/repair `6d190cd7...`/`f70a6fc0...` + report direct-egress RED/repair `fb28f959...`/`f7e58ccd...` + Monte Carlo direct-egress RED/repair `b5a8ae1f...`/`18374c35...` + human projection RED/repair `541273f1...`/`53607f80...` + current #488 `f674183b...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-057 | `ValidationReport::monte_carlo_rmse` could admit a structurally valid generic Monte Carlo summary whose negative mean or percentile values are impossible for RMSE, allowing signed-metric semantics to leak into RMSE-specific Validation Evidence | `verification-pending` | public RED `3cd6e41d...` + report-boundary repair `0090259d...` + changelog `d2631d1b...` + current #488 `f674183b...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-058 | Durable generic Monte Carlo summaries could admit finite but impossible coarse uncertainty relationships because SD, SE, and replication count were validated independently | `verification-pending` | isolating RED `e2d0c057...` + inequality repair `0e973b56...` + edge contract `858368c8...` + current #488 `f674183b...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-059 | Durable generic Monte Carlo summaries could still materially understate or overstate positive Monte Carlo uncertainty after coarse inequality checks because `SE` was not required to agree with the represented `SD / sqrt(n)` relationship | `verification-pending` | canonical-coherence RED `0a4c242f...` + causal repair `9b53076a...` + adjacent-binary64 tolerance regression `141246cf...` + changelog `24a48acc...` + research/current #488 `f674183b...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | ## Release gate From ab46a6a932d7e9eb8ecb8198b5f9f37364ee91ce Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 4 Sep 2026 07:06:57 +0900 Subject: [PATCH 149/235] docs(gap): trace zero-mean RMSE summary admission --- docs/product-technical-gap-baseline.md | 41 ++++++++++++++------------ 1 file changed, 22 insertions(+), 19 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 3e09c5882..47f40a7e9 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,7 +4,7 @@ **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-03T21:45Z +**Snapshot:** 2026-09-03T22:04Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` @@ -34,7 +34,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `f674183b55e1855cef45561be6d38d9935c62b50` | true | `main` | Validation Evidence numerical/artifact repair. Bias/RMSE/Monte Carlo retain representable extreme/subnormal evidence; zero-multiplier SE-aware acceptance is exact-recovery before scale reduction; signed IEEE zeros are one numeric exact-recovery value. Wilson endpoints use stable represented roots where direct evaluation loses the estimand. `ValidationReport` enforces metric domains and Wilson coherence on explicit validation, serde ingress/egress, and human-readable projection. A generic `MonteCarloSummary` remains sign-neutral, but its durable uncertainty now requires positive-spread `SE` to agree with the represented `SD / sqrt(n)` relationship within a small binary64 relative tolerance, zero spread to carry zero SE, and singleton summaries to carry zero spread/SE. The `monte_carlo_rmse` embedding additionally requires nonnegative mean and percentile endpoints because RMSE replications cannot be negative. Exact-head hosted gates and independent review remain required. | +| #488 | `70c3e18961e881dbdebb84a9e117b5f2be1cec31` | true | `main` | Validation Evidence numerical/artifact repair. Bias/RMSE/Monte Carlo retain representable extreme/subnormal evidence; zero-multiplier SE-aware acceptance is exact-recovery before scale reduction; signed IEEE zeros are one numeric exact-recovery value. Wilson endpoints use stable represented roots where direct evaluation loses the estimand. `ValidationReport` enforces metric domains and Wilson coherence on explicit validation, serde ingress/egress, and human-readable projection. A generic `MonteCarloSummary` remains sign-neutral, but its durable uncertainty requires positive-spread `SE` to agree with represented `SD / sqrt(n)` within a small binary64 relative tolerance, zero spread to carry zero SE, and singleton summaries to carry zero spread/SE. The `monte_carlo_rmse` embedding additionally requires nonnegative mean and percentile endpoints; exact-zero mean requires zero spread, zero SE, and zero percentile endpoints because every retained RMSE replication is nonnegative. Exact-head hosted gates and independent review remain required. | | #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 `feat/copy-identity-analysis-run-gap-004` | Validation / Analysis Run fold child. Sparse observed relation classes are valid evidence; RED `a2892b6...`, repair `a6402015...`, predecessor-test correction `6b0c8de6...`; ADR 0079 is `Proposed`. No child-head CI transfers to #416. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | @@ -74,7 +74,7 @@ The clock contract separates event/valid time, assertion time, document time, sy - SE-aware acceptance is the declared rule `|estimate - target| <= k * SE`. For `k = 0`, the bound is exactly zero and exact recovery is evaluated before scale reduction; a large finite SE cannot erase a nonzero residual into acceptance. - Exact-recovery acceptance is finite numeric equality, not IEEE total-order identity. `-0.0` and `+0.0` therefore produce one zero-error decision while nonzero finite residuals remain distinct; this does not require blanket signed-zero canonicalization in private numerical intermediates. - Wilson interval coverage evidence must preserve representable endpoints. All-covered lower bounds use `n / (n + z²)`. Every nonzero strict-interior lower bound uses the algebraically rationalized positive root; the implementation evaluates it on natural scale for `z² < 1` and on `z²`-normalized scale for `z² >= 1`. Thus neither exact-zero collapse nor a nonzero `center - margin` cancellation residue is accepted as the endpoint. If direct `center + margin` rounds an upper endpoint to exact one while uncovered mass is nonzero, the complementary uncovered lower root is evaluated with the same stable representation and subtracted from one. -- Durable and human-facing Validation Evidence must preserve producing-metric invariants at every supported projection boundary, not merely binary64 finiteness. `ValidationReport` enforces nonnegative error/SE fields, probability/accuracy domains, Wilson ordering and containment on explicit validation, JSON/serde ingress and egress, and human-readable summary projection. `MonteCarloSummary` remains generic and sign-neutral; when embedded as `ValidationReport::monte_carlo_rmse`, its mean and percentile endpoints are additionally nonnegative because each RMSE replication is nonnegative. Direct `MonteCarloSummary` serialization applies count/finiteness/nonnegative-uncertainty/percentile-order plus the canonical SEM-coherence rules above. +- Durable and human-facing Validation Evidence must preserve producing-metric invariants at every supported projection boundary, not merely binary64 finiteness. `ValidationReport` enforces nonnegative error/SE fields, probability/accuracy domains, Wilson ordering and containment on explicit validation, JSON/serde ingress and egress, and human-readable summary projection. `MonteCarloSummary` remains generic and sign-neutral; when embedded as `ValidationReport::monte_carlo_rmse`, its mean and percentile endpoints are nonnegative because each RMSE replication is nonnegative, and exact-zero mean requires zero spread, SE, and empirical percentile endpoints. Direct `MonteCarloSummary` serialization applies count/finiteness/nonnegative-uncertainty/percentile-order plus the canonical SEM-coherence rules above. - Bias, RMSE, and Monte Carlo may share private deterministic scalar support inside `validation_core`, but metric-specific cancellation/normalization, denominator, uncertainty, and fail-closed semantics remain with their bounded modules; support primitives are not second psychometric estimator authorities. - A mathematically nonzero scientific error metric must not be promoted to exact perfect recovery merely because its final binary64 representation underflows to zero. - Known-truth recovery denominators are defined by unique scientific component identity. Duplicate rows and stable-Between occasion aliases are not implicit weights unless a separately named weighted contract explicitly owns weighting. @@ -108,7 +108,7 @@ Current #310 exact-head workflows and a qualifying independent current-head appr ### #488 — Validation Evidence recovery arithmetic -#488 is the generic Validation Evidence landing vehicle at exact head `f674183b55e1855cef45561be6d38d9935c62b50`. It remains distinct from Longitudinal Modeling and does not consume mutable fast-mlsirm source. +#488 is the generic Validation Evidence landing vehicle at exact head `70c3e18961e881dbdebb84a9e117b5f2be1cec31`. It remains distinct from Longitudinal Modeling and does not consume mutable fast-mlsirm source. Mean signed bias no longer depends on a raw finite sum that can overflow before division (`c5ec42e4...`→`7499042f...`). Full-range mixed-sign cancellation preserves representable low-order bias before scale reduction (`b6084750...`→`227921d9...`, hardening `77dcf38c...`). Bias SEM scales deviations before squaring and forms the final SEM without avoidable variance overflow (`7de0ef90...`→`cad23162...`, edges `8a6cc346...`/`28d96c23...`). @@ -132,7 +132,9 @@ The nested RMSE summary then exposed a narrower semantic admission bug. `MonteCa Generic-carrier review first found that externally constructed/deserialized `MonteCarloSummary` values could encode impossible coarse relationships: `n = 4, SD = 0.5, SE = 0.5`, positive SD with exact-zero SE, or a singleton with nonzero spread. Isolating RED `e2d0c057d39b7786dbd96528d4e259775c6c2e01`; initial repair `0e973b566ec969d0fea8b7403bf09602cdebd4a3`; edge contract `858368c8fda0d7a33f95b821eba2c5b80dc65cfd`. -A second review then showed that the inequality-only repair still admitted materially understated positive uncertainty. With `n = 4` and `SD = 0.5`, the summary contract implies `SE = 0.25`, but `SE = 0.2` was still accepted. Canonical-coherence RED `0a4c242fbd1c5b2f35e71a1ca1665ca9f7861338`; causal repair `9b53076a53032441623ff487a006ec6d20812030` validates the represented `SD / sqrt(n)` relationship and also closes zero-spread/positive-SE admission; cross-language tolerance regression `141246cfef7c44b327f7bfbeb22bc51279c6b9f0` admits the adjacent binary64 SE rather than requiring bit-pattern equality. Changelog `24a48acc5502bf1b773067c772ea7ca7e5722a2d`; research/current #488 `f674183b55e1855cef45561be6d38d9935c62b50`. +A second review then showed that the inequality-only repair still admitted materially understated positive uncertainty. With `n = 4` and `SD = 0.5`, the summary contract implies `SE = 0.25`, but `SE = 0.2` was still accepted. Canonical-coherence RED `0a4c242fbd1c5b2f35e71a1ca1665ca9f7861338`; causal repair `9b53076a53032441623ff487a006ec6d20812030` validates the represented `SD / sqrt(n)` relationship and also closes zero-spread/positive-SE admission; cross-language tolerance regression `141246cfef7c44b327f7bfbeb22bc51279c6b9f0` admits the adjacent binary64 SE rather than requiring bit-pattern equality. Changelog `24a48acc5502bf1b773067c772ea7ca7e5722a2d`; research predecessor `f674183b55e1855cef45561be6d38d9935c62b50`. + +Typed RMSE admission still had one necessary invariant missing after nonnegative-domain enforcement. Because every retained RMSE replication is nonnegative, an exact-zero Monte Carlo RMSE mean implies every retained RMSE is exactly zero. Predecessor `ValidationReport` nevertheless admitted a zero mean with positive SD/SE or positive empirical percentile support. Public RED `a17dfe1bd9d845356b757ec98e930b5d927eab8f`; causal report-boundary repair `d17d803415333f79bf6291efed9206a630979adf`; release note `42be85748c4e4136c54fd1f918dfa89533376451`; signed-zero/perfect-recovery edge contract `944fa96e89e31123e97f95f6909835026c0bd6fa`; research/current #488 `70c3e18961e881dbdebb84a9e117b5f2be1cec31`. The same repair corrected the report round-trip fixture from approximate `SE = 0.003` to canonical `0.01 / sqrt(10)`, which is required by the generic SEM-coherence contract introduced on the predecessor head. Morris, White, and Crowther (2019) remain the simulation performance-measure/Monte Carlo uncertainty methodology trace; Wilson (1927) remains the primary score-interval reference. AERA/APA/NCME (2014) remains the current published testing-standards edition while revision is underway, and ISO/IEC 25012:2008 remains current after its 2025 review as structured-data-quality support. Exact-head hosted Rust/documentation/security/supply-chain/100%-coverage gates and a qualifying independent current-head review remain required. @@ -204,21 +206,22 @@ Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/num | GAP-042 | Ratio-first logarithm could nearly double an adjacent-float power-of-two irregular residual growth rate before event-time scaling | `verification-pending` | public RED `766ddc7a...` + causal `ln_1p` repair `16f21d9a...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-043 | Duplicate known-truth component identities could silently reweight RMSE recovery evidence by changing the denominator without adding a new scientific target | `verification-pending` | public RED `698f12f5...` + uniqueness repair `2fae4cb2...` + current trace `c9cb68d3...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-044 | Known-truth component RMSE alignment and deterministic binary64 accumulation depended on serialization row order rather than scientific component identity | `verification-pending` | cross-slice RED `8ad72ac9...` + alignment repair `2dd9537e...` + rounding RED `5fb93c40...` + canonical-order repair `025dce7f...` + edge `976ce7d7...` + current #310 `c6680450...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | public RED `c5ec42e4...` + scaled repair `7499042f...` + current #488 `f674183b...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-046 | Bias standard error could reject a representable SEM because raw squared deviations, their sum, or an intermediate sample variance overflowed | `verification-pending` | public RED `7de0ef90...` + scaled direct-SEM repair `cad23162...` + edges `8a6cc346...` / `28d96c23...` + current #488 `f674183b...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-047 | Generic Validation Evidence RMSE/RMSE-SE could reject representable extreme recovery or collapse a representable/nonzero subnormal error to false perfect recovery because residuals were squared before scale normalization | `verification-pending` | extreme RED `dd41ff53...` + subnormal RED `f4e19991...` + repair `6b182107...` + current #488 `f674183b...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-048 | Validation Evidence mean signed bias could erase a representable subnormal residual contribution by normalizing to an unrelated extreme magnitude before mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...` + hardening `77dcf38c...` + current #488 `f674183b...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | public RED `c5ec42e4...` + scaled repair `7499042f...` + current #488 `70c3e189...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-046 | Bias standard error could reject a representable SEM because raw squared deviations, their sum, or an intermediate sample variance overflowed | `verification-pending` | public RED `7de0ef90...` + scaled direct-SEM repair `cad23162...` + edges `8a6cc346...` / `28d96c23...` + current #488 `70c3e189...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-047 | Generic Validation Evidence RMSE/RMSE-SE could reject representable extreme recovery or collapse a representable/nonzero subnormal error to false perfect recovery because residuals were squared before scale normalization | `verification-pending` | extreme RED `dd41ff53...` + subnormal RED `f4e19991...` + repair `6b182107...` + current #488 `70c3e189...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-048 | Validation Evidence mean signed bias could erase a representable subnormal residual contribution by normalizing to an unrelated extreme magnitude before mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...` + hardening `77dcf38c...` + current #488 `70c3e189...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-049 | Stable `Between` recovery could be aliased across occasion indices, duplicating one unit-level scientific target and silently changing the RMSE denominator | `verification-pending` | RED `0a03041c...` + fixture repair `53563e97...` + admission repair `ec2c1219...` + trace `c9cb68d3...` + current #310 `c6680450...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-050 | Zero-multiplier SE-aware acceptance could scale a nonzero residual to exact zero and falsely accept exact recovery when a large finite SE dominated normalization | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...` + current research `c45a76cf...` + current #488 `f674183b...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-051 | Exact-recovery SE acceptance used IEEE total ordering and therefore treated `-0.0` and `+0.0` as different scientific recovery values | `verification-pending` | signed-zero RED `379e6525...` + numeric-equality repair `55876e60...` + research `c45a76cf...` + current #488 `f674183b...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-052 | All-covered Wilson score coverage could cancel a positive binary64-representable lower endpoint to exact zero by subtracting nearly equal center and margin terms | `verification-pending` | public RED `f84e5918...` + exact all-covered endpoint repair `fe9b9c8a...` + current #488 `f674183b...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-053 | Strict-interior Wilson score coverage could cancel a positive binary64-representable lower endpoint to exact zero even after the all-covered endpoint specialization | `verification-pending` | public RED `9d45f482...` + initial rationalized lower-root repair `4f259f6e...` + current #488 `f674183b...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-054 | Wilson score coverage could falsely promote an all-uncovered or strict-interior upper endpoint to exact `1.0` when `center + margin` and the denominator rounded to the same binary64 value | `verification-pending` | all-uncovered RED `c070da26...` + strict-interior RED expansion `344081bf...` + complementary rationalized repair `9a2fdd05...` + current #488 `f674183b...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-055 | Strict-interior Wilson score coverage could accept a nonzero `center - margin` cancellation residue as the scientific lower endpoint, overstating a representable endpoint by orders of magnitude even though the subtraction did not collapse to zero | `verification-pending` | public RED `1a24fac7...` + scale-aware rationalized-lower repair `f7e20ddc...` + small-`z` reinforcement `39e5e087...` + current #488 `f674183b...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-056 | Durable or human-facing Validation Evidence could accept impossible finite report fields/cross-field relationships or bypass validation through serde/human projections, including standalone Monte Carlo summary egress | `verification-pending` | report domain RED/repair `e9414e6f...`/`28924b0d...` + ingress RED/repair `6d190cd7...`/`f70a6fc0...` + report direct-egress RED/repair `fb28f959...`/`f7e58ccd...` + Monte Carlo direct-egress RED/repair `b5a8ae1f...`/`18374c35...` + human projection RED/repair `541273f1...`/`53607f80...` + current #488 `f674183b...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-057 | `ValidationReport::monte_carlo_rmse` could admit a structurally valid generic Monte Carlo summary whose negative mean or percentile values are impossible for RMSE, allowing signed-metric semantics to leak into RMSE-specific Validation Evidence | `verification-pending` | public RED `3cd6e41d...` + report-boundary repair `0090259d...` + changelog `d2631d1b...` + current #488 `f674183b...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-058 | Durable generic Monte Carlo summaries could admit finite but impossible coarse uncertainty relationships because SD, SE, and replication count were validated independently | `verification-pending` | isolating RED `e2d0c057...` + inequality repair `0e973b56...` + edge contract `858368c8...` + current #488 `f674183b...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-059 | Durable generic Monte Carlo summaries could still materially understate or overstate positive Monte Carlo uncertainty after coarse inequality checks because `SE` was not required to agree with the represented `SD / sqrt(n)` relationship | `verification-pending` | canonical-coherence RED `0a4c242f...` + causal repair `9b53076a...` + adjacent-binary64 tolerance regression `141246cf...` + changelog `24a48acc...` + research/current #488 `f674183b...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-050 | Zero-multiplier SE-aware acceptance could scale a nonzero residual to exact zero and falsely accept exact recovery when a large finite SE dominated normalization | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...` + current research `c45a76cf...` + current #488 `70c3e189...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-051 | Exact-recovery SE acceptance used IEEE total ordering and therefore treated `-0.0` and `+0.0` as different scientific recovery values | `verification-pending` | signed-zero RED `379e6525...` + numeric-equality repair `55876e60...` + research `c45a76cf...` + current #488 `70c3e189...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-052 | All-covered Wilson score coverage could cancel a positive binary64-representable lower endpoint to exact zero by subtracting nearly equal center and margin terms | `verification-pending` | public RED `f84e5918...` + exact all-covered endpoint repair `fe9b9c8a...` + current #488 `70c3e189...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-053 | Strict-interior Wilson score coverage could cancel a positive binary64-representable lower endpoint to exact zero even after the all-covered endpoint specialization | `verification-pending` | public RED `9d45f482...` + initial rationalized lower-root repair `4f259f6e...` + current #488 `70c3e189...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-054 | Wilson score coverage could falsely promote an all-uncovered or strict-interior upper endpoint to exact `1.0` when `center + margin` and the denominator rounded to the same binary64 value | `verification-pending` | all-uncovered RED `c070da26...` + strict-interior RED expansion `344081bf...` + complementary rationalized repair `9a2fdd05...` + current #488 `70c3e189...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-055 | Strict-interior Wilson score coverage could accept a nonzero `center - margin` cancellation residue as the scientific lower endpoint, overstating a representable endpoint by orders of magnitude even though the subtraction did not collapse to zero | `verification-pending` | public RED `1a24fac7...` + scale-aware rationalized-lower repair `f7e20ddc...` + small-`z` reinforcement `39e5e087...` + current #488 `70c3e189...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-056 | Durable or human-facing Validation Evidence could accept impossible finite report fields/cross-field relationships or bypass validation through serde/human projections, including standalone Monte Carlo summary egress | `verification-pending` | report domain RED/repair `e9414e6f...`/`28924b0d...` + ingress RED/repair `6d190cd7...`/`f70a6fc0...` + report direct-egress RED/repair `fb28f959...`/`f7e58ccd...` + Monte Carlo direct-egress RED/repair `b5a8ae1f...`/`18374c35...` + human projection RED/repair `541273f1...`/`53607f80...` + current #488 `70c3e189...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-057 | `ValidationReport::monte_carlo_rmse` could admit a structurally valid generic Monte Carlo summary whose negative mean or percentile values are impossible for RMSE, allowing signed-metric semantics to leak into RMSE-specific Validation Evidence | `verification-pending` | public RED `3cd6e41d...` + report-boundary repair `0090259d...` + changelog `d2631d1b...` + current #488 `70c3e189...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-058 | Durable generic Monte Carlo summaries could admit finite but impossible coarse uncertainty relationships because SD, SE, and replication count were validated independently | `verification-pending` | isolating RED `e2d0c057...` + inequality repair `0e973b56...` + edge contract `858368c8...` + current #488 `70c3e189...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-059 | Durable generic Monte Carlo summaries could still materially understate or overstate positive Monte Carlo uncertainty after coarse inequality checks because `SE` was not required to agree with the represented `SD / sqrt(n)` relationship | `verification-pending` | canonical-coherence RED `0a4c242f...` + causal repair `9b53076a...` + adjacent-binary64 tolerance regression `141246cf...` + changelog `24a48acc...` + current #488 `70c3e189...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-060 | `ValidationReport::monte_carlo_rmse` could admit exact-zero mean together with positive spread, SE, or percentile support, contradicting perfect recovery for a nonnegative replication metric | `verification-pending` | public RED `a17dfe1b...` + report-boundary repair `d17d8034...` + release note `42be8574...` + signed-zero/perfect-recovery edge `944fa96e...` + research/current #488 `70c3e189...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | ## Release gate From eca229225089a62e4cf6a176c6d63aafa212d358 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 4 Sep 2026 08:13:30 +0900 Subject: [PATCH 150/235] docs(gap): trace validation coherence repairs --- docs/product-technical-gap-baseline.md | 52 +++++++++++++++----------- 1 file changed, 30 insertions(+), 22 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 47f40a7e9..6b49d8bb1 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,7 +4,7 @@ **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-03T22:04Z +**Snapshot:** 2026-09-03T23:10Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` @@ -34,7 +34,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `70c3e18961e881dbdebb84a9e117b5f2be1cec31` | true | `main` | Validation Evidence numerical/artifact repair. Bias/RMSE/Monte Carlo retain representable extreme/subnormal evidence; zero-multiplier SE-aware acceptance is exact-recovery before scale reduction; signed IEEE zeros are one numeric exact-recovery value. Wilson endpoints use stable represented roots where direct evaluation loses the estimand. `ValidationReport` enforces metric domains and Wilson coherence on explicit validation, serde ingress/egress, and human-readable projection. A generic `MonteCarloSummary` remains sign-neutral, but its durable uncertainty requires positive-spread `SE` to agree with represented `SD / sqrt(n)` within a small binary64 relative tolerance, zero spread to carry zero SE, and singleton summaries to carry zero spread/SE. The `monte_carlo_rmse` embedding additionally requires nonnegative mean and percentile endpoints; exact-zero mean requires zero spread, zero SE, and zero percentile endpoints because every retained RMSE replication is nonnegative. Exact-head hosted gates and independent review remain required. | +| #488 | `6c549e36398508ab8ee273f5395ef7bb80ae0363` | true | `main` | Validation Evidence numerical/artifact repair. Bias/RMSE/Monte Carlo retain representable extreme/subnormal evidence; zero-multiplier SE-aware acceptance is exact-recovery before scale reduction; signed IEEE zeros are one numeric exact-recovery value. Wilson endpoints use stable represented roots where direct evaluation loses the estimand. `ValidationReport` enforces metric domains and cross-field coherence on explicit validation, serde ingress/egress, and human-readable projection: exact-zero point RMSE requires exact-zero point RMSE SE. Generic `MonteCarloSummary` remains sign-neutral, requires represented `SD / sqrt(n)` coherence for positive spread, and requires zero-spread empirical percentile support to be degenerate at the represented mean. `match_count` owns a decision contract distinct from residual projection, so an unrepresentable absolute residual can still be a deterministic mismatch for every finite tolerance. The `monte_carlo_rmse` embedding additionally requires nonnegative mean/percentiles and exact-zero mean to carry zero spread/SE/support. Exact-head hosted gates and independent review remain required. | | #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 `feat/copy-identity-analysis-run-gap-004` | Validation / Analysis Run fold child. Sparse observed relation classes are valid evidence; RED `a2892b6...`, repair `a6402015...`, predecessor-test correction `6b0c8de6...`; ADR 0079 is `Proposed`. No child-head CI transfers to #416. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | @@ -69,12 +69,13 @@ The clock contract separates event/valid time, assertion time, document time, sy - A representable final scientific estimand is not rejected solely because an avoidable intermediate binary64 operation overflows/underflows. False exact 0/1/non-finite endpoints and cancellation residues are not accepted when an algebraically equivalent stable form preserves the represented estimand. - Mean signed bias is a Validation Evidence performance measure over admitted recovery units. Opposite-sign represented residuals cancel before scale reduction; a representable low-order bias must survive cancellation of unrelated extreme terms. Exact cancellation remains zero, while a mathematically nonzero bias below binary64 range fails closed. - Bias standard error is formed from the same admitted signed differences. A representable SEM must not fail solely because raw squared deviations, their sum, or an intermediate sample variance overflows. -- Generic Validation Evidence RMSE and its delta-method standard error normalize finite residual magnitudes before squaring. A representable extreme or minimum-subnormal RMSE must survive avoidable intermediate overflow/underflow, while a mathematically nonzero final RMSE or SE below the binary64 range fails closed. -- Monte Carlo mean/sample-SD/SE preserve representable uncertainty across full-range and subnormal replication values. Avoidable raw-product/Welford overflow or final false-zero uncertainty is not accepted as scientific evidence. Durable `MonteCarloSummary` admission requires zero SD to carry zero SE and positive SD to carry a positive SE coherent with `SD / sqrt(n)` within a small relative binary64 tolerance; singleton summaries require zero spread/SE. The tolerance prevents bit-pattern equality from becoming an interoperability requirement while still rejecting materially understated or overstated uncertainty. +- Generic Validation Evidence RMSE and its delta-method standard error normalize finite residual magnitudes before squaring. A representable extreme or minimum-subnormal RMSE must survive avoidable intermediate overflow/underflow, while a mathematically nonzero final RMSE or SE below the binary64 range fails closed. Exact-zero point RMSE denotes exact perfect recovery under this contract and therefore requires exact-zero point RMSE standard error; positive RMSE with zero SE remains valid when squared residuals have exactly zero sample spread. +- Monte Carlo mean/sample-SD/SE preserve representable uncertainty across full-range and subnormal replication values. Avoidable raw-product/Welford overflow or final false-zero uncertainty is not accepted as scientific evidence. Durable `MonteCarloSummary` admission requires zero SD to carry zero SE and empirical percentile endpoints equal to the represented mean; positive SD requires a positive SE coherent with `SD / sqrt(n)` within a small relative binary64 tolerance. Singleton summaries require zero spread/SE and degenerate support. The tolerance prevents bit-pattern equality from becoming an interoperability requirement while still rejecting materially understated or overstated uncertainty. - SE-aware acceptance is the declared rule `|estimate - target| <= k * SE`. For `k = 0`, the bound is exactly zero and exact recovery is evaluated before scale reduction; a large finite SE cannot erase a nonzero residual into acceptance. - Exact-recovery acceptance is finite numeric equality, not IEEE total-order identity. `-0.0` and `+0.0` therefore produce one zero-error decision while nonzero finite residuals remain distinct; this does not require blanket signed-zero canonicalization in private numerical intermediates. +- `match_count` is a finite-threshold decision and does not require materializing every residual magnitude. If subtraction of two finite endpoints overflows, the real absolute residual exceeds `f64::MAX` and therefore every admitted finite tolerance, so the pair is a deterministic mismatch. `absolute_residuals` remains fail-closed when the residual value itself is requested. - Wilson interval coverage evidence must preserve representable endpoints. All-covered lower bounds use `n / (n + z²)`. Every nonzero strict-interior lower bound uses the algebraically rationalized positive root; the implementation evaluates it on natural scale for `z² < 1` and on `z²`-normalized scale for `z² >= 1`. Thus neither exact-zero collapse nor a nonzero `center - margin` cancellation residue is accepted as the endpoint. If direct `center + margin` rounds an upper endpoint to exact one while uncovered mass is nonzero, the complementary uncovered lower root is evaluated with the same stable representation and subtracted from one. -- Durable and human-facing Validation Evidence must preserve producing-metric invariants at every supported projection boundary, not merely binary64 finiteness. `ValidationReport` enforces nonnegative error/SE fields, probability/accuracy domains, Wilson ordering and containment on explicit validation, JSON/serde ingress and egress, and human-readable summary projection. `MonteCarloSummary` remains generic and sign-neutral; when embedded as `ValidationReport::monte_carlo_rmse`, its mean and percentile endpoints are nonnegative because each RMSE replication is nonnegative, and exact-zero mean requires zero spread, SE, and empirical percentile endpoints. Direct `MonteCarloSummary` serialization applies count/finiteness/nonnegative-uncertainty/percentile-order plus the canonical SEM-coherence rules above. +- Durable and human-facing Validation Evidence must preserve producing-metric invariants at every supported projection boundary, not merely binary64 finiteness. `ValidationReport` enforces nonnegative error/SE fields, point RMSE/SE exact-recovery coherence, probability/accuracy domains, Wilson ordering and containment on explicit validation, JSON/serde ingress and egress, and human-readable summary projection. `MonteCarloSummary` remains generic and sign-neutral; when embedded as `ValidationReport::monte_carlo_rmse`, its mean and percentile endpoints are nonnegative because each RMSE replication is nonnegative, and exact-zero mean requires zero spread, SE, and empirical percentile endpoints. Direct `MonteCarloSummary` serialization applies count/finiteness/nonnegative-uncertainty/percentile-order, zero-spread support, and canonical SEM-coherence rules. - Bias, RMSE, and Monte Carlo may share private deterministic scalar support inside `validation_core`, but metric-specific cancellation/normalization, denominator, uncertainty, and fail-closed semantics remain with their bounded modules; support primitives are not second psychometric estimator authorities. - A mathematically nonzero scientific error metric must not be promoted to exact perfect recovery merely because its final binary64 representation underflows to zero. - Known-truth recovery denominators are defined by unique scientific component identity. Duplicate rows and stable-Between occasion aliases are not implicit weights unless a separately named weighted contract explicitly owns weighting. @@ -108,7 +109,7 @@ Current #310 exact-head workflows and a qualifying independent current-head appr ### #488 — Validation Evidence recovery arithmetic -#488 is the generic Validation Evidence landing vehicle at exact head `70c3e18961e881dbdebb84a9e117b5f2be1cec31`. It remains distinct from Longitudinal Modeling and does not consume mutable fast-mlsirm source. +#488 is the generic Validation Evidence landing vehicle at exact head `6c549e36398508ab8ee273f5395ef7bb80ae0363`. It remains distinct from Longitudinal Modeling and does not consume mutable fast-mlsirm source. Mean signed bias no longer depends on a raw finite sum that can overflow before division (`c5ec42e4...`→`7499042f...`). Full-range mixed-sign cancellation preserves representable low-order bias before scale reduction (`b6084750...`→`227921d9...`, hardening `77dcf38c...`). Bias SEM scales deviations before squaring and forms the final SEM without avoidable variance overflow (`7de0ef90...`→`cad23162...`, edges `8a6cc346...`/`28d96c23...`). @@ -134,7 +135,11 @@ Generic-carrier review first found that externally constructed/deserialized `Mon A second review then showed that the inequality-only repair still admitted materially understated positive uncertainty. With `n = 4` and `SD = 0.5`, the summary contract implies `SE = 0.25`, but `SE = 0.2` was still accepted. Canonical-coherence RED `0a4c242fbd1c5b2f35e71a1ca1665ca9f7861338`; causal repair `9b53076a53032441623ff487a006ec6d20812030` validates the represented `SD / sqrt(n)` relationship and also closes zero-spread/positive-SE admission; cross-language tolerance regression `141246cfef7c44b327f7bfbeb22bc51279c6b9f0` admits the adjacent binary64 SE rather than requiring bit-pattern equality. Changelog `24a48acc5502bf1b773067c772ea7ca7e5722a2d`; research predecessor `f674183b55e1855cef45561be6d38d9935c62b50`. -Typed RMSE admission still had one necessary invariant missing after nonnegative-domain enforcement. Because every retained RMSE replication is nonnegative, an exact-zero Monte Carlo RMSE mean implies every retained RMSE is exactly zero. Predecessor `ValidationReport` nevertheless admitted a zero mean with positive SD/SE or positive empirical percentile support. Public RED `a17dfe1bd9d845356b757ec98e930b5d927eab8f`; causal report-boundary repair `d17d803415333f79bf6291efed9206a630979adf`; release note `42be85748c4e4136c54fd1f918dfa89533376451`; signed-zero/perfect-recovery edge contract `944fa96e89e31123e97f95f6909835026c0bd6fa`; research/current #488 `70c3e18961e881dbdebb84a9e117b5f2be1cec31`. The same repair corrected the report round-trip fixture from approximate `SE = 0.003` to canonical `0.01 / sqrt(10)`, which is required by the generic SEM-coherence contract introduced on the predecessor head. +Typed RMSE admission still had one necessary invariant missing after nonnegative-domain enforcement. Because every retained RMSE replication is nonnegative, an exact-zero Monte Carlo RMSE mean implies every retained RMSE is exactly zero. Predecessor `ValidationReport` nevertheless admitted a zero mean with positive SD/SE or positive empirical percentile support. Public RED `a17dfe1bd9d845356b757ec98e930b5d927eab8f`; causal report-boundary repair `d17d803415333f79bf6291efed9206a630979adf`; release note `42be85748c4e4136c54fd1f918dfa89533376451`; signed-zero/perfect-recovery edge contract `944fa96e89e31123e97f95f6909835026c0bd6fa`. + +Concurrent branch work then closed two additional Validation Evidence holes without crossing owner boundaries. A generic Monte Carlo summary with exact-zero sample SD previously could retain percentile endpoints away from its represented mean; RED `ce21941a64c9e54c1ff7dd5914581966708215b8` and repair `d0f5c14559831bc9032c6489a8013ac23686f894` bind zero spread to zero SE and degenerate empirical support. Separately, `match_count` previously depended on materializing an absolute residual even though threshold classification remains decidable when subtraction of finite opposite-sign extremes overflows: RED `d023ecdb9d32e1474c08af16eb7df25c3dc84fc1`, causal decision/projection separation `5040ff96ce2845b2f633781667be8c71039aae7a`, documentation trace `9067d3ca61532b03706f725e8accca8e8d4ac083`. + +Point-report review found one further typed coherence hole. `ValidationReport` independently admitted finite nonnegative `rmse` and `rmse_standard_error`, so exact-zero RMSE could be paired with a positive point RMSE SE even though the canonical squared-residual producer returns exact zero SE for exact recovery. Public RED `f7b018c5f10d11c7cc21a3430242e37c2d7a1056`; causal admission repair `4c5999186141dafd8d6293d5da66ab8e19693f5c`; changelog `6ae5b254669868162428fc5c85538e9f5052ac6c`; research/current #488 `6c549e36398508ab8ee273f5395ef7bb80ae0363`. The repair deliberately does not require every positive RMSE to have positive SE because equal nonzero residual magnitudes can yield exactly zero squared-residual spread. Morris, White, and Crowther (2019) remain the simulation performance-measure/Monte Carlo uncertainty methodology trace; Wilson (1927) remains the primary score-interval reference. AERA/APA/NCME (2014) remains the current published testing-standards edition while revision is underway, and ISO/IEC 25012:2008 remains current after its 2025 review as structured-data-quality support. Exact-head hosted Rust/documentation/security/supply-chain/100%-coverage gates and a qualifying independent current-head review remain required. @@ -206,22 +211,25 @@ Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/num | GAP-042 | Ratio-first logarithm could nearly double an adjacent-float power-of-two irregular residual growth rate before event-time scaling | `verification-pending` | public RED `766ddc7a...` + causal `ln_1p` repair `16f21d9a...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-043 | Duplicate known-truth component identities could silently reweight RMSE recovery evidence by changing the denominator without adding a new scientific target | `verification-pending` | public RED `698f12f5...` + uniqueness repair `2fae4cb2...` + current trace `c9cb68d3...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-044 | Known-truth component RMSE alignment and deterministic binary64 accumulation depended on serialization row order rather than scientific component identity | `verification-pending` | cross-slice RED `8ad72ac9...` + alignment repair `2dd9537e...` + rounding RED `5fb93c40...` + canonical-order repair `025dce7f...` + edge `976ce7d7...` + current #310 `c6680450...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | public RED `c5ec42e4...` + scaled repair `7499042f...` + current #488 `70c3e189...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-046 | Bias standard error could reject a representable SEM because raw squared deviations, their sum, or an intermediate sample variance overflowed | `verification-pending` | public RED `7de0ef90...` + scaled direct-SEM repair `cad23162...` + edges `8a6cc346...` / `28d96c23...` + current #488 `70c3e189...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-047 | Generic Validation Evidence RMSE/RMSE-SE could reject representable extreme recovery or collapse a representable/nonzero subnormal error to false perfect recovery because residuals were squared before scale normalization | `verification-pending` | extreme RED `dd41ff53...` + subnormal RED `f4e19991...` + repair `6b182107...` + current #488 `70c3e189...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-048 | Validation Evidence mean signed bias could erase a representable subnormal residual contribution by normalizing to an unrelated extreme magnitude before mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...` + hardening `77dcf38c...` + current #488 `70c3e189...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | public RED `c5ec42e4...` + scaled repair `7499042f...` + current #488 `6c549e36...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-046 | Bias standard error could reject a representable SEM because raw squared deviations, their sum, or an intermediate sample variance overflowed | `verification-pending` | public RED `7de0ef90...` + scaled direct-SEM repair `cad23162...` + edges `8a6cc346...` / `28d96c23...` + current #488 `6c549e36...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-047 | Generic Validation Evidence RMSE/RMSE-SE could reject representable extreme recovery or collapse a representable/nonzero subnormal error to false perfect recovery because residuals were squared before scale normalization | `verification-pending` | extreme RED `dd41ff53...` + subnormal RED `f4e19991...` + repair `6b182107...` + current #488 `6c549e36...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-048 | Validation Evidence mean signed bias could erase a representable subnormal residual contribution by normalizing to an unrelated extreme magnitude before mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...` + hardening `77dcf38c...` + current #488 `6c549e36...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-049 | Stable `Between` recovery could be aliased across occasion indices, duplicating one unit-level scientific target and silently changing the RMSE denominator | `verification-pending` | RED `0a03041c...` + fixture repair `53563e97...` + admission repair `ec2c1219...` + trace `c9cb68d3...` + current #310 `c6680450...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-050 | Zero-multiplier SE-aware acceptance could scale a nonzero residual to exact zero and falsely accept exact recovery when a large finite SE dominated normalization | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...` + current research `c45a76cf...` + current #488 `70c3e189...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-051 | Exact-recovery SE acceptance used IEEE total ordering and therefore treated `-0.0` and `+0.0` as different scientific recovery values | `verification-pending` | signed-zero RED `379e6525...` + numeric-equality repair `55876e60...` + research `c45a76cf...` + current #488 `70c3e189...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-052 | All-covered Wilson score coverage could cancel a positive binary64-representable lower endpoint to exact zero by subtracting nearly equal center and margin terms | `verification-pending` | public RED `f84e5918...` + exact all-covered endpoint repair `fe9b9c8a...` + current #488 `70c3e189...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-053 | Strict-interior Wilson score coverage could cancel a positive binary64-representable lower endpoint to exact zero even after the all-covered endpoint specialization | `verification-pending` | public RED `9d45f482...` + initial rationalized lower-root repair `4f259f6e...` + current #488 `70c3e189...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-054 | Wilson score coverage could falsely promote an all-uncovered or strict-interior upper endpoint to exact `1.0` when `center + margin` and the denominator rounded to the same binary64 value | `verification-pending` | all-uncovered RED `c070da26...` + strict-interior RED expansion `344081bf...` + complementary rationalized repair `9a2fdd05...` + current #488 `70c3e189...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-055 | Strict-interior Wilson score coverage could accept a nonzero `center - margin` cancellation residue as the scientific lower endpoint, overstating a representable endpoint by orders of magnitude even though the subtraction did not collapse to zero | `verification-pending` | public RED `1a24fac7...` + scale-aware rationalized-lower repair `f7e20ddc...` + small-`z` reinforcement `39e5e087...` + current #488 `70c3e189...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-056 | Durable or human-facing Validation Evidence could accept impossible finite report fields/cross-field relationships or bypass validation through serde/human projections, including standalone Monte Carlo summary egress | `verification-pending` | report domain RED/repair `e9414e6f...`/`28924b0d...` + ingress RED/repair `6d190cd7...`/`f70a6fc0...` + report direct-egress RED/repair `fb28f959...`/`f7e58ccd...` + Monte Carlo direct-egress RED/repair `b5a8ae1f...`/`18374c35...` + human projection RED/repair `541273f1...`/`53607f80...` + current #488 `70c3e189...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-057 | `ValidationReport::monte_carlo_rmse` could admit a structurally valid generic Monte Carlo summary whose negative mean or percentile values are impossible for RMSE, allowing signed-metric semantics to leak into RMSE-specific Validation Evidence | `verification-pending` | public RED `3cd6e41d...` + report-boundary repair `0090259d...` + changelog `d2631d1b...` + current #488 `70c3e189...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-058 | Durable generic Monte Carlo summaries could admit finite but impossible coarse uncertainty relationships because SD, SE, and replication count were validated independently | `verification-pending` | isolating RED `e2d0c057...` + inequality repair `0e973b56...` + edge contract `858368c8...` + current #488 `70c3e189...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-059 | Durable generic Monte Carlo summaries could still materially understate or overstate positive Monte Carlo uncertainty after coarse inequality checks because `SE` was not required to agree with the represented `SD / sqrt(n)` relationship | `verification-pending` | canonical-coherence RED `0a4c242f...` + causal repair `9b53076a...` + adjacent-binary64 tolerance regression `141246cf...` + changelog `24a48acc...` + current #488 `70c3e189...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-060 | `ValidationReport::monte_carlo_rmse` could admit exact-zero mean together with positive spread, SE, or percentile support, contradicting perfect recovery for a nonnegative replication metric | `verification-pending` | public RED `a17dfe1b...` + report-boundary repair `d17d8034...` + release note `42be8574...` + signed-zero/perfect-recovery edge `944fa96e...` + research/current #488 `70c3e189...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-050 | Zero-multiplier SE-aware acceptance could scale a nonzero residual to exact zero and falsely accept exact recovery when a large finite SE dominated normalization | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...` + current research `c45a76cf...` + current #488 `6c549e36...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-051 | Exact-recovery SE acceptance used IEEE total ordering and therefore treated `-0.0` and `+0.0` as different scientific recovery values | `verification-pending` | signed-zero RED `379e6525...` + numeric-equality repair `55876e60...` + research `c45a76cf...` + current #488 `6c549e36...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-052 | All-covered Wilson score coverage could cancel a positive binary64-representable lower endpoint to exact zero by subtracting nearly equal center and margin terms | `verification-pending` | public RED `f84e5918...` + exact all-covered endpoint repair `fe9b9c8a...` + current #488 `6c549e36...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-053 | Strict-interior Wilson score coverage could cancel a positive binary64-representable lower endpoint to exact zero even after the all-covered endpoint specialization | `verification-pending` | public RED `9d45f482...` + initial rationalized lower-root repair `4f259f6e...` + current #488 `6c549e36...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-054 | Wilson score coverage could falsely promote an all-uncovered or strict-interior upper endpoint to exact `1.0` when `center + margin` and the denominator rounded to the same binary64 value | `verification-pending` | all-uncovered RED `c070da26...` + strict-interior RED expansion `344081bf...` + complementary rationalized repair `9a2fdd05...` + current #488 `6c549e36...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-055 | Strict-interior Wilson score coverage could accept a nonzero `center - margin` cancellation residue as the scientific lower endpoint, overstating a representable endpoint by orders of magnitude even though the subtraction did not collapse to zero | `verification-pending` | public RED `1a24fac7...` + scale-aware rationalized-lower repair `f7e20ddc...` + small-`z` reinforcement `39e5e087...` + current #488 `6c549e36...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-056 | Durable or human-facing Validation Evidence could accept impossible finite report fields/cross-field relationships or bypass validation through serde/human projections, including standalone Monte Carlo summary egress | `verification-pending` | report domain RED/repair `e9414e6f...`/`28924b0d...` + ingress RED/repair `6d190cd7...`/`f70a6fc0...` + report direct-egress RED/repair `fb28f959...`/`f7e58ccd...` + Monte Carlo direct-egress RED/repair `b5a8ae1f...`/`18374c35...` + human projection RED/repair `541273f1...`/`53607f80...` + current #488 `6c549e36...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-057 | `ValidationReport::monte_carlo_rmse` could admit a structurally valid generic Monte Carlo summary whose negative mean or percentile values are impossible for RMSE, allowing signed-metric semantics to leak into RMSE-specific Validation Evidence | `verification-pending` | public RED `3cd6e41d...` + report-boundary repair `0090259d...` + changelog `d2631d1b...` + current #488 `6c549e36...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-058 | Durable generic Monte Carlo summaries could admit finite but impossible coarse uncertainty relationships because SD, SE, and replication count were validated independently | `verification-pending` | isolating RED `e2d0c057...` + inequality repair `0e973b56...` + edge contract `858368c8...` + current #488 `6c549e36...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-059 | Durable generic Monte Carlo summaries could still materially understate or overstate positive Monte Carlo uncertainty after coarse inequality checks because `SE` was not required to agree with the represented `SD / sqrt(n)` relationship | `verification-pending` | canonical-coherence RED `0a4c242f...` + causal repair `9b53076a...` + adjacent-binary64 tolerance regression `141246cf...` + changelog `24a48acc...` + current #488 `6c549e36...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-060 | `ValidationReport::monte_carlo_rmse` could admit exact-zero mean together with positive spread, SE, or percentile support, contradicting perfect recovery for a nonnegative replication metric | `verification-pending` | public RED `a17dfe1b...` + report-boundary repair `d17d8034...` + release note `42be8574...` + signed-zero/perfect-recovery edge `944fa96e...` + current #488 `6c549e36...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-061 | Durable generic Monte Carlo summaries could claim exact-zero sample spread while retaining empirical percentile support away from the represented mean | `verification-pending` | public RED `ce21941a...` + support-coherence repair `d0f5c145...` + documentation/change trace `9067d3ca...` + current #488 `6c549e36...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-062 | Finite-tolerance match classification could fail because it attempted to materialize an unrepresentable absolute residual even though the pair is deterministically outside every finite tolerance | `verification-pending` | decision/projection RED `d023ecdb...` + causal separation `5040ff96...` + documentation/change trace `9067d3ca...` + current #488 `6c549e36...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-063 | `ValidationReport` could admit exact-zero point RMSE together with positive RMSE standard error, contradicting the canonical squared-residual estimator's exact-perfect-recovery state | `verification-pending` | public RED `f7b018c5...` + report-boundary repair `4c599918...` + changelog `6ae5b254...` + research/current #488 `6c549e36...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | ## Release gate From 7be6568c2c01676a35bc0dcc1d40d2da2c86e229 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 4 Sep 2026 09:09:42 +0900 Subject: [PATCH 151/235] docs(ddd): refresh Validation Evidence gap authority --- docs/product-technical-gap-baseline.md | 53 ++++++++++++++------------ 1 file changed, 28 insertions(+), 25 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 6b49d8bb1..9fad8372f 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,7 +4,7 @@ **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-03T23:10Z +**Snapshot:** 2026-09-04T00:04Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` @@ -34,7 +34,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `6c549e36398508ab8ee273f5395ef7bb80ae0363` | true | `main` | Validation Evidence numerical/artifact repair. Bias/RMSE/Monte Carlo retain representable extreme/subnormal evidence; zero-multiplier SE-aware acceptance is exact-recovery before scale reduction; signed IEEE zeros are one numeric exact-recovery value. Wilson endpoints use stable represented roots where direct evaluation loses the estimand. `ValidationReport` enforces metric domains and cross-field coherence on explicit validation, serde ingress/egress, and human-readable projection: exact-zero point RMSE requires exact-zero point RMSE SE. Generic `MonteCarloSummary` remains sign-neutral, requires represented `SD / sqrt(n)` coherence for positive spread, and requires zero-spread empirical percentile support to be degenerate at the represented mean. `match_count` owns a decision contract distinct from residual projection, so an unrepresentable absolute residual can still be a deterministic mismatch for every finite tolerance. The `monte_carlo_rmse` embedding additionally requires nonnegative mean/percentiles and exact-zero mean to carry zero spread/SE/support. Exact-head hosted gates and independent review remain required. | +| #488 | `f68c2dea13dddc998c000a20737677555b52cb7e` | true | `main` | Validation Evidence numerical/artifact repair. Bias/RMSE/Monte Carlo retain representable extreme/subnormal evidence; zero-multiplier SE-aware acceptance is exact-recovery before scale reduction; signed IEEE zeros are one numeric exact-recovery value. Wilson endpoints use stable represented roots where direct evaluation loses the estimand. `ValidationReport` enforces metric domains and cross-field coherence on explicit validation, serde ingress/egress, and human-readable projection: exact-zero point RMSE requires exact-zero point RMSE SE, and positive point RMSE admits only delta-method standard error within the squared-residual support bound `SE(RMSE) <= RMSE / 2` plus a small binary64 tolerance. Generic `MonteCarloSummary` remains sign-neutral, requires represented `SD / sqrt(n)` coherence for positive spread, and requires zero-spread empirical percentile support to be degenerate at the represented mean. `match_count` owns a decision contract distinct from residual projection, so an unrepresentable absolute residual can still be a deterministic mismatch for every finite tolerance. The `monte_carlo_rmse` embedding additionally requires nonnegative mean/percentiles and exact-zero mean to carry zero spread/SE/support. Exact-head hosted gates and independent review remain required. | | #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 `feat/copy-identity-analysis-run-gap-004` | Validation / Analysis Run fold child. Sparse observed relation classes are valid evidence; RED `a2892b6...`, repair `a6402015...`, predecessor-test correction `6b0c8de6...`; ADR 0079 is `Proposed`. No child-head CI transfers to #416. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | @@ -69,13 +69,13 @@ The clock contract separates event/valid time, assertion time, document time, sy - A representable final scientific estimand is not rejected solely because an avoidable intermediate binary64 operation overflows/underflows. False exact 0/1/non-finite endpoints and cancellation residues are not accepted when an algebraically equivalent stable form preserves the represented estimand. - Mean signed bias is a Validation Evidence performance measure over admitted recovery units. Opposite-sign represented residuals cancel before scale reduction; a representable low-order bias must survive cancellation of unrelated extreme terms. Exact cancellation remains zero, while a mathematically nonzero bias below binary64 range fails closed. - Bias standard error is formed from the same admitted signed differences. A representable SEM must not fail solely because raw squared deviations, their sum, or an intermediate sample variance overflows. -- Generic Validation Evidence RMSE and its delta-method standard error normalize finite residual magnitudes before squaring. A representable extreme or minimum-subnormal RMSE must survive avoidable intermediate overflow/underflow, while a mathematically nonzero final RMSE or SE below the binary64 range fails closed. Exact-zero point RMSE denotes exact perfect recovery under this contract and therefore requires exact-zero point RMSE standard error; positive RMSE with zero SE remains valid when squared residuals have exactly zero sample spread. +- Generic Validation Evidence RMSE and its delta-method standard error normalize finite residual magnitudes before squaring. A representable extreme or minimum-subnormal RMSE must survive avoidable intermediate overflow/underflow, while a mathematically nonzero final RMSE or SE below the binary64 range fails closed. Exact-zero point RMSE denotes exact perfect recovery and therefore requires exact-zero point RMSE standard error. For positive RMSE, the declared squared-residual delta-method producer satisfies `SE(RMSE) <= RMSE / 2`; durable admission enforces that support bound with a small relative binary64 tolerance. Positive RMSE with zero SE remains valid when squared residuals have exactly zero sample spread. - Monte Carlo mean/sample-SD/SE preserve representable uncertainty across full-range and subnormal replication values. Avoidable raw-product/Welford overflow or final false-zero uncertainty is not accepted as scientific evidence. Durable `MonteCarloSummary` admission requires zero SD to carry zero SE and empirical percentile endpoints equal to the represented mean; positive SD requires a positive SE coherent with `SD / sqrt(n)` within a small relative binary64 tolerance. Singleton summaries require zero spread/SE and degenerate support. The tolerance prevents bit-pattern equality from becoming an interoperability requirement while still rejecting materially understated or overstated uncertainty. - SE-aware acceptance is the declared rule `|estimate - target| <= k * SE`. For `k = 0`, the bound is exactly zero and exact recovery is evaluated before scale reduction; a large finite SE cannot erase a nonzero residual into acceptance. - Exact-recovery acceptance is finite numeric equality, not IEEE total-order identity. `-0.0` and `+0.0` therefore produce one zero-error decision while nonzero finite residuals remain distinct; this does not require blanket signed-zero canonicalization in private numerical intermediates. - `match_count` is a finite-threshold decision and does not require materializing every residual magnitude. If subtraction of two finite endpoints overflows, the real absolute residual exceeds `f64::MAX` and therefore every admitted finite tolerance, so the pair is a deterministic mismatch. `absolute_residuals` remains fail-closed when the residual value itself is requested. - Wilson interval coverage evidence must preserve representable endpoints. All-covered lower bounds use `n / (n + z²)`. Every nonzero strict-interior lower bound uses the algebraically rationalized positive root; the implementation evaluates it on natural scale for `z² < 1` and on `z²`-normalized scale for `z² >= 1`. Thus neither exact-zero collapse nor a nonzero `center - margin` cancellation residue is accepted as the endpoint. If direct `center + margin` rounds an upper endpoint to exact one while uncovered mass is nonzero, the complementary uncovered lower root is evaluated with the same stable representation and subtracted from one. -- Durable and human-facing Validation Evidence must preserve producing-metric invariants at every supported projection boundary, not merely binary64 finiteness. `ValidationReport` enforces nonnegative error/SE fields, point RMSE/SE exact-recovery coherence, probability/accuracy domains, Wilson ordering and containment on explicit validation, JSON/serde ingress and egress, and human-readable summary projection. `MonteCarloSummary` remains generic and sign-neutral; when embedded as `ValidationReport::monte_carlo_rmse`, its mean and percentile endpoints are nonnegative because each RMSE replication is nonnegative, and exact-zero mean requires zero spread, SE, and empirical percentile endpoints. Direct `MonteCarloSummary` serialization applies count/finiteness/nonnegative-uncertainty/percentile-order, zero-spread support, and canonical SEM-coherence rules. +- Durable and human-facing Validation Evidence must preserve producing-metric invariants at every supported projection boundary, not merely binary64 finiteness. `ValidationReport` enforces nonnegative error/SE fields, point RMSE/SE squared-residual support, probability/accuracy domains, Wilson ordering and containment on explicit validation, JSON/serde ingress and egress, and human-readable summary projection. `MonteCarloSummary` remains generic and sign-neutral; when embedded as `ValidationReport::monte_carlo_rmse`, its mean and percentile endpoints are nonnegative because each RMSE replication is nonnegative, and exact-zero mean requires zero spread, SE, and empirical percentile endpoints. Direct `MonteCarloSummary` serialization applies count/finiteness/nonnegative-uncertainty/percentile-order, zero-spread support, and canonical SEM-coherence rules. - Bias, RMSE, and Monte Carlo may share private deterministic scalar support inside `validation_core`, but metric-specific cancellation/normalization, denominator, uncertainty, and fail-closed semantics remain with their bounded modules; support primitives are not second psychometric estimator authorities. - A mathematically nonzero scientific error metric must not be promoted to exact perfect recovery merely because its final binary64 representation underflows to zero. - Known-truth recovery denominators are defined by unique scientific component identity. Duplicate rows and stable-Between occasion aliases are not implicit weights unless a separately named weighted contract explicitly owns weighting. @@ -109,7 +109,7 @@ Current #310 exact-head workflows and a qualifying independent current-head appr ### #488 — Validation Evidence recovery arithmetic -#488 is the generic Validation Evidence landing vehicle at exact head `6c549e36398508ab8ee273f5395ef7bb80ae0363`. It remains distinct from Longitudinal Modeling and does not consume mutable fast-mlsirm source. +#488 is the generic Validation Evidence landing vehicle at exact head `f68c2dea13dddc998c000a20737677555b52cb7e`. It remains distinct from Longitudinal Modeling and does not consume mutable fast-mlsirm source. Mean signed bias no longer depends on a raw finite sum that can overflow before division (`c5ec42e4...`→`7499042f...`). Full-range mixed-sign cancellation preserves representable low-order bias before scale reduction (`b6084750...`→`227921d9...`, hardening `77dcf38c...`). Bias SEM scales deviations before squaring and forms the final SEM without avoidable variance overflow (`7de0ef90...`→`cad23162...`, edges `8a6cc346...`/`28d96c23...`). @@ -139,9 +139,11 @@ Typed RMSE admission still had one necessary invariant missing after nonnegative Concurrent branch work then closed two additional Validation Evidence holes without crossing owner boundaries. A generic Monte Carlo summary with exact-zero sample SD previously could retain percentile endpoints away from its represented mean; RED `ce21941a64c9e54c1ff7dd5914581966708215b8` and repair `d0f5c14559831bc9032c6489a8013ac23686f894` bind zero spread to zero SE and degenerate empirical support. Separately, `match_count` previously depended on materializing an absolute residual even though threshold classification remains decidable when subtraction of finite opposite-sign extremes overflows: RED `d023ecdb9d32e1474c08af16eb7df25c3dc84fc1`, causal decision/projection separation `5040ff96ce2845b2f633781667be8c71039aae7a`, documentation trace `9067d3ca61532b03706f725e8accca8e8d4ac083`. -Point-report review found one further typed coherence hole. `ValidationReport` independently admitted finite nonnegative `rmse` and `rmse_standard_error`, so exact-zero RMSE could be paired with a positive point RMSE SE even though the canonical squared-residual producer returns exact zero SE for exact recovery. Public RED `f7b018c5f10d11c7cc21a3430242e37c2d7a1056`; causal admission repair `4c5999186141dafd8d6293d5da66ab8e19693f5c`; changelog `6ae5b254669868162428fc5c85538e9f5052ac6c`; research/current #488 `6c549e36398508ab8ee273f5395ef7bb80ae0363`. The repair deliberately does not require every positive RMSE to have positive SE because equal nonzero residual magnitudes can yield exactly zero squared-residual spread. +Point-report review first closed exact-perfect coherence: `ValidationReport` independently admitted finite nonnegative `rmse` and `rmse_standard_error`, so exact-zero RMSE could be paired with a positive point RMSE SE even though the canonical squared-residual producer returns exact zero SE for exact recovery. Public RED `f7b018c5f10d11c7cc21a3430242e37c2d7a1056`; causal admission repair `4c5999186141dafd8d6293d5da66ab8e19693f5c`; changelog `6ae5b254669868162428fc5c85538e9f5052ac6c`. -Morris, White, and Crowther (2019) remain the simulation performance-measure/Monte Carlo uncertainty methodology trace; Wilson (1927) remains the primary score-interval reference. AERA/APA/NCME (2014) remains the current published testing-standards edition while revision is underway, and ISO/IEC 25012:2008 remains current after its 2025 review as structured-data-quality support. Exact-head hosted Rust/documentation/security/supply-chain/100%-coverage gates and a qualifying independent current-head review remain required. +The same producer yields a broader support bound. For `x_i = r_i^2 >= 0` with mean `m = RMSE^2`, `sum(x_i^2) <= (sum x_i)^2` implies sample `sd(x) <= sqrt(n) * m`; therefore the declared delta-method `SE(RMSE) = sd(x) / (2 * RMSE * sqrt(n))` satisfies `SE(RMSE) <= RMSE / 2`. Residual magnitudes `[0,1]` attain the boundary. Public RED `a2aca5b077665433aad0e5531d53360b599b64b3` proves the predecessor admitted `(rmse=0.2, rmse_standard_error=0.11)`; causal report-boundary repair `32f094029732e2333b35ad3a11521c4c3d956798` enforces the ratio with `64*EPSILON` tolerance; release trace `7b61c107d1bc6391651ce2341e6ad27c2cada17a`; research/current #488 `f68c2dea13dddc998c000a20737677555b52cb7e`. Positive RMSE with zero SE remains admissible when squared residuals are exactly constant. + +Morris, White, and Crowther (2019) remain the simulation performance-measure/Monte Carlo uncertainty methodology trace; Wilson (1927) remains the primary score-interval reference. AERA/APA/NCME (2014) remains the current published testing-standards edition while revision is underway, and AERA publishes a current Standards task-force roster dated 2026-08-31. Exact-head hosted Rust/documentation/security/supply-chain/100%-coverage gates and a qualifying independent current-head review remain required. ### #416 — Validation / Analysis Run consolidation @@ -211,25 +213,26 @@ Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/num | GAP-042 | Ratio-first logarithm could nearly double an adjacent-float power-of-two irregular residual growth rate before event-time scaling | `verification-pending` | public RED `766ddc7a...` + causal `ln_1p` repair `16f21d9a...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-043 | Duplicate known-truth component identities could silently reweight RMSE recovery evidence by changing the denominator without adding a new scientific target | `verification-pending` | public RED `698f12f5...` + uniqueness repair `2fae4cb2...` + current trace `c9cb68d3...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-044 | Known-truth component RMSE alignment and deterministic binary64 accumulation depended on serialization row order rather than scientific component identity | `verification-pending` | cross-slice RED `8ad72ac9...` + alignment repair `2dd9537e...` + rounding RED `5fb93c40...` + canonical-order repair `025dce7f...` + edge `976ce7d7...` + current #310 `c6680450...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | public RED `c5ec42e4...` + scaled repair `7499042f...` + current #488 `6c549e36...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-046 | Bias standard error could reject a representable SEM because raw squared deviations, their sum, or an intermediate sample variance overflowed | `verification-pending` | public RED `7de0ef90...` + scaled direct-SEM repair `cad23162...` + edges `8a6cc346...` / `28d96c23...` + current #488 `6c549e36...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-047 | Generic Validation Evidence RMSE/RMSE-SE could reject representable extreme recovery or collapse a representable/nonzero subnormal error to false perfect recovery because residuals were squared before scale normalization | `verification-pending` | extreme RED `dd41ff53...` + subnormal RED `f4e19991...` + repair `6b182107...` + current #488 `6c549e36...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-048 | Validation Evidence mean signed bias could erase a representable subnormal residual contribution by normalizing to an unrelated extreme magnitude before mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...` + hardening `77dcf38c...` + current #488 `6c549e36...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | public RED `c5ec42e4...` + scaled repair `7499042f...` + current #488 `f68c2dea...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-046 | Bias standard error could reject a representable SEM because raw squared deviations, their sum, or an intermediate sample variance overflowed | `verification-pending` | public RED `7de0ef90...` + scaled direct-SEM repair `cad23162...` + edges `8a6cc346...` / `28d96c23...` + current #488 `f68c2dea...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-047 | Generic Validation Evidence RMSE/RMSE-SE could reject representable extreme recovery or collapse a representable/nonzero subnormal error to false perfect recovery because residuals were squared before scale normalization | `verification-pending` | extreme RED `dd41ff53...` + subnormal RED `f4e19991...` + repair `6b182107...` + current #488 `f68c2dea...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-048 | Validation Evidence mean signed bias could erase a representable subnormal residual contribution by normalizing to an unrelated extreme magnitude before mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...` + hardening `77dcf38c...` + current #488 `f68c2dea...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-049 | Stable `Between` recovery could be aliased across occasion indices, duplicating one unit-level scientific target and silently changing the RMSE denominator | `verification-pending` | RED `0a03041c...` + fixture repair `53563e97...` + admission repair `ec2c1219...` + trace `c9cb68d3...` + current #310 `c6680450...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-050 | Zero-multiplier SE-aware acceptance could scale a nonzero residual to exact zero and falsely accept exact recovery when a large finite SE dominated normalization | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...` + current research `c45a76cf...` + current #488 `6c549e36...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-051 | Exact-recovery SE acceptance used IEEE total ordering and therefore treated `-0.0` and `+0.0` as different scientific recovery values | `verification-pending` | signed-zero RED `379e6525...` + numeric-equality repair `55876e60...` + research `c45a76cf...` + current #488 `6c549e36...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-052 | All-covered Wilson score coverage could cancel a positive binary64-representable lower endpoint to exact zero by subtracting nearly equal center and margin terms | `verification-pending` | public RED `f84e5918...` + exact all-covered endpoint repair `fe9b9c8a...` + current #488 `6c549e36...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-053 | Strict-interior Wilson score coverage could cancel a positive binary64-representable lower endpoint to exact zero even after the all-covered endpoint specialization | `verification-pending` | public RED `9d45f482...` + initial rationalized lower-root repair `4f259f6e...` + current #488 `6c549e36...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-054 | Wilson score coverage could falsely promote an all-uncovered or strict-interior upper endpoint to exact `1.0` when `center + margin` and the denominator rounded to the same binary64 value | `verification-pending` | all-uncovered RED `c070da26...` + strict-interior RED expansion `344081bf...` + complementary rationalized repair `9a2fdd05...` + current #488 `6c549e36...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-055 | Strict-interior Wilson score coverage could accept a nonzero `center - margin` cancellation residue as the scientific lower endpoint, overstating a representable endpoint by orders of magnitude even though the subtraction did not collapse to zero | `verification-pending` | public RED `1a24fac7...` + scale-aware rationalized-lower repair `f7e20ddc...` + small-`z` reinforcement `39e5e087...` + current #488 `6c549e36...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-056 | Durable or human-facing Validation Evidence could accept impossible finite report fields/cross-field relationships or bypass validation through serde/human projections, including standalone Monte Carlo summary egress | `verification-pending` | report domain RED/repair `e9414e6f...`/`28924b0d...` + ingress RED/repair `6d190cd7...`/`f70a6fc0...` + report direct-egress RED/repair `fb28f959...`/`f7e58ccd...` + Monte Carlo direct-egress RED/repair `b5a8ae1f...`/`18374c35...` + human projection RED/repair `541273f1...`/`53607f80...` + current #488 `6c549e36...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-057 | `ValidationReport::monte_carlo_rmse` could admit a structurally valid generic Monte Carlo summary whose negative mean or percentile values are impossible for RMSE, allowing signed-metric semantics to leak into RMSE-specific Validation Evidence | `verification-pending` | public RED `3cd6e41d...` + report-boundary repair `0090259d...` + changelog `d2631d1b...` + current #488 `6c549e36...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-058 | Durable generic Monte Carlo summaries could admit finite but impossible coarse uncertainty relationships because SD, SE, and replication count were validated independently | `verification-pending` | isolating RED `e2d0c057...` + inequality repair `0e973b56...` + edge contract `858368c8...` + current #488 `6c549e36...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-059 | Durable generic Monte Carlo summaries could still materially understate or overstate positive Monte Carlo uncertainty after coarse inequality checks because `SE` was not required to agree with the represented `SD / sqrt(n)` relationship | `verification-pending` | canonical-coherence RED `0a4c242f...` + causal repair `9b53076a...` + adjacent-binary64 tolerance regression `141246cf...` + changelog `24a48acc...` + current #488 `6c549e36...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-060 | `ValidationReport::monte_carlo_rmse` could admit exact-zero mean together with positive spread, SE, or percentile support, contradicting perfect recovery for a nonnegative replication metric | `verification-pending` | public RED `a17dfe1b...` + report-boundary repair `d17d8034...` + release note `42be8574...` + signed-zero/perfect-recovery edge `944fa96e...` + current #488 `6c549e36...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-061 | Durable generic Monte Carlo summaries could claim exact-zero sample spread while retaining empirical percentile support away from the represented mean | `verification-pending` | public RED `ce21941a...` + support-coherence repair `d0f5c145...` + documentation/change trace `9067d3ca...` + current #488 `6c549e36...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-062 | Finite-tolerance match classification could fail because it attempted to materialize an unrepresentable absolute residual even though the pair is deterministically outside every finite tolerance | `verification-pending` | decision/projection RED `d023ecdb...` + causal separation `5040ff96...` + documentation/change trace `9067d3ca...` + current #488 `6c549e36...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-063 | `ValidationReport` could admit exact-zero point RMSE together with positive RMSE standard error, contradicting the canonical squared-residual estimator's exact-perfect-recovery state | `verification-pending` | public RED `f7b018c5...` + report-boundary repair `4c599918...` + changelog `6ae5b254...` + research/current #488 `6c549e36...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-050 | Zero-multiplier SE-aware acceptance could scale a nonzero residual to exact zero and falsely accept exact recovery when a large finite SE dominated normalization | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...` + current research `c45a76cf...` + current #488 `f68c2dea...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-051 | Exact-recovery SE acceptance used IEEE total ordering and therefore treated `-0.0` and `+0.0` as different scientific recovery values | `verification-pending` | signed-zero RED `379e6525...` + numeric-equality repair `55876e60...` + research `c45a76cf...` + current #488 `f68c2dea...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-052 | All-covered Wilson score coverage could cancel a positive binary64-representable lower endpoint to exact zero by subtracting nearly equal center and margin terms | `verification-pending` | public RED `f84e5918...` + exact all-covered endpoint repair `fe9b9c8a...` + current #488 `f68c2dea...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-053 | Strict-interior Wilson score coverage could cancel a positive binary64-representable lower endpoint to exact zero even after the all-covered endpoint specialization | `verification-pending` | public RED `9d45f482...` + initial rationalized lower-root repair `4f259f6e...` + current #488 `f68c2dea...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-054 | Wilson score coverage could falsely promote an all-uncovered or strict-interior upper endpoint to exact `1.0` when `center + margin` and the denominator rounded to the same binary64 value | `verification-pending` | all-uncovered RED `c070da26...` + strict-interior RED expansion `344081bf...` + complementary rationalized repair `9a2fdd05...` + current #488 `f68c2dea...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-055 | Strict-interior Wilson score coverage could accept a nonzero `center - margin` cancellation residue as the scientific lower endpoint, overstating a representable endpoint by orders of magnitude even though the subtraction did not collapse to zero | `verification-pending` | public RED `1a24fac7...` + scale-aware rationalized-lower repair `f7e20ddc...` + small-`z` reinforcement `39e5e087...` + current #488 `f68c2dea...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-056 | Durable or human-facing Validation Evidence could accept impossible finite report fields/cross-field relationships or bypass validation through serde/human projections, including standalone Monte Carlo summary egress | `verification-pending` | report domain RED/repair `e9414e6f...`/`28924b0d...` + ingress RED/repair `6d190cd7...`/`f70a6fc0...` + report direct-egress RED/repair `fb28f959...`/`f7e58ccd...` + Monte Carlo direct-egress RED/repair `b5a8ae1f...`/`18374c35...` + human projection RED/repair `541273f1...`/`53607f80...` + current #488 `f68c2dea...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-057 | `ValidationReport::monte_carlo_rmse` could admit a structurally valid generic Monte Carlo summary whose negative mean or percentile values are impossible for RMSE, allowing signed-metric semantics to leak into RMSE-specific Validation Evidence | `verification-pending` | public RED `3cd6e41d...` + report-boundary repair `0090259d...` + changelog `d2631d1b...` + current #488 `f68c2dea...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-058 | Durable generic Monte Carlo summaries could admit finite but impossible coarse uncertainty relationships because SD, SE, and replication count were validated independently | `verification-pending` | isolating RED `e2d0c057...` + inequality repair `0e973b56...` + edge contract `858368c8...` + current #488 `f68c2dea...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-059 | Durable generic Monte Carlo summaries could still materially understate or overstate positive Monte Carlo uncertainty after coarse inequality checks because `SE` was not required to agree with the represented `SD / sqrt(n)` relationship | `verification-pending` | canonical-coherence RED `0a4c242f...` + causal repair `9b53076a...` + adjacent-binary64 tolerance regression `141246cf...` + changelog `24a48acc...` + current #488 `f68c2dea...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-060 | `ValidationReport::monte_carlo_rmse` could admit exact-zero mean together with positive spread, SE, or percentile support, contradicting perfect recovery for a nonnegative replication metric | `verification-pending` | public RED `a17dfe1b...` + report-boundary repair `d17d8034...` + release note `42be8574...` + signed-zero/perfect-recovery edge `944fa96e...` + current #488 `f68c2dea...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-061 | Durable generic Monte Carlo summaries could claim exact-zero sample spread while retaining empirical percentile support away from the represented mean | `verification-pending` | public RED `ce21941a...` + support-coherence repair `d0f5c145...` + documentation/change trace `9067d3ca...` + current #488 `f68c2dea...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-062 | Finite-tolerance match classification could fail because it attempted to materialize an unrepresentable absolute residual even though the pair is deterministically outside every finite tolerance | `verification-pending` | decision/projection RED `d023ecdb...` + causal separation `5040ff96...` + documentation/change trace `9067d3ca...` + current #488 `f68c2dea...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-063 | `ValidationReport` could admit exact-zero point RMSE together with positive RMSE standard error, contradicting the canonical squared-residual estimator's exact-perfect-recovery state | `verification-pending` | public RED `f7b018c5...` + report-boundary repair `4c599918...` + changelog `6ae5b254...` + research/current #488 `f68c2dea...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-064 | `ValidationReport` could admit positive point RMSE with RMSE standard error above the maximum support of the declared squared-residual delta-method producer | `verification-pending` | public RED `a2aca5b0...` + support-bound repair `32f09402...` + changelog `7b61c107...` + research/current #488 `f68c2dea...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | ## Release gate From df145e348b9d27cc5719f68a2abdb90716d0c668 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 4 Sep 2026 10:06:50 +0900 Subject: [PATCH 152/235] docs(ddd): add Monte Carlo RMSE support gap --- docs/product-technical-gap-baseline.md | 53 ++++++++++++++------------ 1 file changed, 28 insertions(+), 25 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 9fad8372f..27054c22c 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,7 +4,7 @@ **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-04T00:04Z +**Snapshot:** 2026-09-04T01:01Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` @@ -34,7 +34,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `f68c2dea13dddc998c000a20737677555b52cb7e` | true | `main` | Validation Evidence numerical/artifact repair. Bias/RMSE/Monte Carlo retain representable extreme/subnormal evidence; zero-multiplier SE-aware acceptance is exact-recovery before scale reduction; signed IEEE zeros are one numeric exact-recovery value. Wilson endpoints use stable represented roots where direct evaluation loses the estimand. `ValidationReport` enforces metric domains and cross-field coherence on explicit validation, serde ingress/egress, and human-readable projection: exact-zero point RMSE requires exact-zero point RMSE SE, and positive point RMSE admits only delta-method standard error within the squared-residual support bound `SE(RMSE) <= RMSE / 2` plus a small binary64 tolerance. Generic `MonteCarloSummary` remains sign-neutral, requires represented `SD / sqrt(n)` coherence for positive spread, and requires zero-spread empirical percentile support to be degenerate at the represented mean. `match_count` owns a decision contract distinct from residual projection, so an unrepresentable absolute residual can still be a deterministic mismatch for every finite tolerance. The `monte_carlo_rmse` embedding additionally requires nonnegative mean/percentiles and exact-zero mean to carry zero spread/SE/support. Exact-head hosted gates and independent review remain required. | +| #488 | `9f9ffc3ff1d730228719fea977613153136fd720` | true | `main` | Validation Evidence numerical/artifact repair. Bias/RMSE/Monte Carlo retain representable extreme/subnormal evidence; zero-multiplier SE-aware acceptance is exact-recovery before scale reduction; signed IEEE zeros are one numeric exact-recovery value. Wilson endpoints use stable represented roots where direct evaluation loses the estimand. `ValidationReport` enforces metric domains and cross-field coherence on explicit validation, serde ingress/egress, and human-readable projection: exact-zero point RMSE requires exact-zero point RMSE SE, and positive point RMSE admits only delta-method standard error within the squared-residual support bound `SE(RMSE) <= RMSE / 2` plus a small binary64 tolerance. Generic `MonteCarloSummary` remains sign-neutral, requires represented `SD / sqrt(n)` coherence for positive spread, and requires zero-spread empirical percentile support to be degenerate at the represented mean. `match_count` owns a decision contract distinct from residual projection, so an unrepresentable absolute residual can still be a deterministic mismatch for every finite tolerance. The `monte_carlo_rmse` embedding additionally requires nonnegative mean/percentiles; exact-zero mean carries zero spread/SE/support, while positive mean must satisfy the nonnegative-replication support bound `SE(mean) <= mean` within the same small binary64 tolerance. Exact-head hosted gates and independent review remain required. | | #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 `feat/copy-identity-analysis-run-gap-004` | Validation / Analysis Run fold child. Sparse observed relation classes are valid evidence; RED `a2892b6...`, repair `a6402015...`, predecessor-test correction `6b0c8de6...`; ADR 0079 is `Proposed`. No child-head CI transfers to #416. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | @@ -70,12 +70,12 @@ The clock contract separates event/valid time, assertion time, document time, sy - Mean signed bias is a Validation Evidence performance measure over admitted recovery units. Opposite-sign represented residuals cancel before scale reduction; a representable low-order bias must survive cancellation of unrelated extreme terms. Exact cancellation remains zero, while a mathematically nonzero bias below binary64 range fails closed. - Bias standard error is formed from the same admitted signed differences. A representable SEM must not fail solely because raw squared deviations, their sum, or an intermediate sample variance overflows. - Generic Validation Evidence RMSE and its delta-method standard error normalize finite residual magnitudes before squaring. A representable extreme or minimum-subnormal RMSE must survive avoidable intermediate overflow/underflow, while a mathematically nonzero final RMSE or SE below the binary64 range fails closed. Exact-zero point RMSE denotes exact perfect recovery and therefore requires exact-zero point RMSE standard error. For positive RMSE, the declared squared-residual delta-method producer satisfies `SE(RMSE) <= RMSE / 2`; durable admission enforces that support bound with a small relative binary64 tolerance. Positive RMSE with zero SE remains valid when squared residuals have exactly zero sample spread. -- Monte Carlo mean/sample-SD/SE preserve representable uncertainty across full-range and subnormal replication values. Avoidable raw-product/Welford overflow or final false-zero uncertainty is not accepted as scientific evidence. Durable `MonteCarloSummary` admission requires zero SD to carry zero SE and empirical percentile endpoints equal to the represented mean; positive SD requires a positive SE coherent with `SD / sqrt(n)` within a small relative binary64 tolerance. Singleton summaries require zero spread/SE and degenerate support. The tolerance prevents bit-pattern equality from becoming an interoperability requirement while still rejecting materially understated or overstated uncertainty. +- Monte Carlo mean/sample-SD/SE preserve representable uncertainty across full-range and subnormal replication values. Avoidable raw-product/Welford overflow or final false-zero uncertainty is not accepted as scientific evidence. Durable `MonteCarloSummary` admission requires zero SD to carry zero SE and empirical percentile endpoints equal to the represented mean; positive SD requires a positive SE coherent with `SD / sqrt(n)` within a small relative binary64 tolerance. Singleton summaries require zero spread/SE and degenerate support. The tolerance prevents bit-pattern equality from becoming an interoperability requirement while still rejecting materially understated or overstated uncertainty. When the generic carrier occupies `ValidationReport::monte_carlo_rmse`, every retained replication is nonnegative; with mean `m`, sample support implies `SD <= sqrt(n) * m` and therefore `SE(mean) <= m`. Durable typed admission enforces that additional bound without imposing it on signed metrics such as bias. - SE-aware acceptance is the declared rule `|estimate - target| <= k * SE`. For `k = 0`, the bound is exactly zero and exact recovery is evaluated before scale reduction; a large finite SE cannot erase a nonzero residual into acceptance. - Exact-recovery acceptance is finite numeric equality, not IEEE total-order identity. `-0.0` and `+0.0` therefore produce one zero-error decision while nonzero finite residuals remain distinct; this does not require blanket signed-zero canonicalization in private numerical intermediates. - `match_count` is a finite-threshold decision and does not require materializing every residual magnitude. If subtraction of two finite endpoints overflows, the real absolute residual exceeds `f64::MAX` and therefore every admitted finite tolerance, so the pair is a deterministic mismatch. `absolute_residuals` remains fail-closed when the residual value itself is requested. - Wilson interval coverage evidence must preserve representable endpoints. All-covered lower bounds use `n / (n + z²)`. Every nonzero strict-interior lower bound uses the algebraically rationalized positive root; the implementation evaluates it on natural scale for `z² < 1` and on `z²`-normalized scale for `z² >= 1`. Thus neither exact-zero collapse nor a nonzero `center - margin` cancellation residue is accepted as the endpoint. If direct `center + margin` rounds an upper endpoint to exact one while uncovered mass is nonzero, the complementary uncovered lower root is evaluated with the same stable representation and subtracted from one. -- Durable and human-facing Validation Evidence must preserve producing-metric invariants at every supported projection boundary, not merely binary64 finiteness. `ValidationReport` enforces nonnegative error/SE fields, point RMSE/SE squared-residual support, probability/accuracy domains, Wilson ordering and containment on explicit validation, JSON/serde ingress and egress, and human-readable summary projection. `MonteCarloSummary` remains generic and sign-neutral; when embedded as `ValidationReport::monte_carlo_rmse`, its mean and percentile endpoints are nonnegative because each RMSE replication is nonnegative, and exact-zero mean requires zero spread, SE, and empirical percentile endpoints. Direct `MonteCarloSummary` serialization applies count/finiteness/nonnegative-uncertainty/percentile-order, zero-spread support, and canonical SEM-coherence rules. +- Durable and human-facing Validation Evidence must preserve producing-metric invariants at every supported projection boundary, not merely binary64 finiteness. `ValidationReport` enforces nonnegative error/SE fields, point RMSE/SE squared-residual support, probability/accuracy domains, Wilson ordering and containment on explicit validation, JSON/serde ingress and egress, and human-readable summary projection. `MonteCarloSummary` remains generic and sign-neutral; when embedded as `ValidationReport::monte_carlo_rmse`, its mean and percentile endpoints are nonnegative because each RMSE replication is nonnegative, exact-zero mean requires zero spread, SE, and empirical percentile endpoints, and positive mean requires Monte Carlo mean SE not to exceed the mean under nonnegative sample support. Direct `MonteCarloSummary` serialization applies count/finiteness/nonnegative-uncertainty/percentile-order, zero-spread support, and canonical SEM-coherence rules. - Bias, RMSE, and Monte Carlo may share private deterministic scalar support inside `validation_core`, but metric-specific cancellation/normalization, denominator, uncertainty, and fail-closed semantics remain with their bounded modules; support primitives are not second psychometric estimator authorities. - A mathematically nonzero scientific error metric must not be promoted to exact perfect recovery merely because its final binary64 representation underflows to zero. - Known-truth recovery denominators are defined by unique scientific component identity. Duplicate rows and stable-Between occasion aliases are not implicit weights unless a separately named weighted contract explicitly owns weighting. @@ -109,7 +109,7 @@ Current #310 exact-head workflows and a qualifying independent current-head appr ### #488 — Validation Evidence recovery arithmetic -#488 is the generic Validation Evidence landing vehicle at exact head `f68c2dea13dddc998c000a20737677555b52cb7e`. It remains distinct from Longitudinal Modeling and does not consume mutable fast-mlsirm source. +#488 is the generic Validation Evidence landing vehicle at exact head `9f9ffc3ff1d730228719fea977613153136fd720`. It remains distinct from Longitudinal Modeling and does not consume mutable fast-mlsirm source. Mean signed bias no longer depends on a raw finite sum that can overflow before division (`c5ec42e4...`→`7499042f...`). Full-range mixed-sign cancellation preserves representable low-order bias before scale reduction (`b6084750...`→`227921d9...`, hardening `77dcf38c...`). Bias SEM scales deviations before squaring and forms the final SEM without avoidable variance overflow (`7de0ef90...`→`cad23162...`, edges `8a6cc346...`/`28d96c23...`). @@ -141,7 +141,9 @@ Concurrent branch work then closed two additional Validation Evidence holes with Point-report review first closed exact-perfect coherence: `ValidationReport` independently admitted finite nonnegative `rmse` and `rmse_standard_error`, so exact-zero RMSE could be paired with a positive point RMSE SE even though the canonical squared-residual producer returns exact zero SE for exact recovery. Public RED `f7b018c5f10d11c7cc21a3430242e37c2d7a1056`; causal admission repair `4c5999186141dafd8d6293d5da66ab8e19693f5c`; changelog `6ae5b254669868162428fc5c85538e9f5052ac6c`. -The same producer yields a broader support bound. For `x_i = r_i^2 >= 0` with mean `m = RMSE^2`, `sum(x_i^2) <= (sum x_i)^2` implies sample `sd(x) <= sqrt(n) * m`; therefore the declared delta-method `SE(RMSE) = sd(x) / (2 * RMSE * sqrt(n))` satisfies `SE(RMSE) <= RMSE / 2`. Residual magnitudes `[0,1]` attain the boundary. Public RED `a2aca5b077665433aad0e5531d53360b599b64b3` proves the predecessor admitted `(rmse=0.2, rmse_standard_error=0.11)`; causal report-boundary repair `32f094029732e2333b35ad3a11521c4c3d956798` enforces the ratio with `64*EPSILON` tolerance; release trace `7b61c107d1bc6391651ce2341e6ad27c2cada17a`; research/current #488 `f68c2dea13dddc998c000a20737677555b52cb7e`. Positive RMSE with zero SE remains admissible when squared residuals are exactly constant. +The same producer yields a broader support bound. For `x_i = r_i^2 >= 0` with mean `m = RMSE^2`, `sum(x_i^2) <= (sum x_i)^2` implies sample `sd(x) <= sqrt(n) * m`; therefore the declared delta-method `SE(RMSE) = sd(x) / (2 * RMSE * sqrt(n))` satisfies `SE(RMSE) <= RMSE / 2`. Residual magnitudes `[0,1]` attain the boundary. Public RED `a2aca5b077665433aad0e5531d53360b599b64b3` proves the predecessor admitted `(rmse=0.2, rmse_standard_error=0.11)`; causal report-boundary repair `32f094029732e2333b35ad3a11521c4c3d956798` enforces the ratio with `64*EPSILON` tolerance; release trace `7b61c107d1bc6391651ce2341e6ad27c2cada17a`; research predecessor `f68c2dea13dddc998c000a20737677555b52cb7e`. Positive RMSE with zero SE remains admissible when squared residuals are exactly constant. + +Positive Monte Carlo RMSE summaries have a related but distinct support invariant. If the retained replication values are `x_i >= 0` with sample mean `m`, then `SD <= sqrt(n) * m`, so the stored Monte Carlo `SE(mean)=SD/sqrt(n)` cannot exceed `m`. The boundary is attainable at `[0,0,0,4]`, which gives `(n=4, mean=1, SD=2, SE=1)`. A generic-valid `(n=4, mean=1, SD=3, SE=1.5)` summary therefore cannot represent RMSE replications. Stale zero-mean fixture repair `e201a2f46953152255345a7b3abc35f05ea9e33c`; public RED `43a7dec1dbc848435ca099aea80db46c8cbd97e5`; causal typed-admission repair `2f78954eb21a08c316d0d6b70f659685fb283a0b`; changelog `4ce54959a5c70ccae8212a6494d346ceef0ff35f`; research/current #488 `9f9ffc3ff1d730228719fea977613153136fd720`. Morris, White, and Crowther (2019) remain the simulation performance-measure/Monte Carlo uncertainty methodology trace; Wilson (1927) remains the primary score-interval reference. AERA/APA/NCME (2014) remains the current published testing-standards edition while revision is underway, and AERA publishes a current Standards task-force roster dated 2026-08-31. Exact-head hosted Rust/documentation/security/supply-chain/100%-coverage gates and a qualifying independent current-head review remain required. @@ -213,26 +215,27 @@ Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/num | GAP-042 | Ratio-first logarithm could nearly double an adjacent-float power-of-two irregular residual growth rate before event-time scaling | `verification-pending` | public RED `766ddc7a...` + causal `ln_1p` repair `16f21d9a...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-043 | Duplicate known-truth component identities could silently reweight RMSE recovery evidence by changing the denominator without adding a new scientific target | `verification-pending` | public RED `698f12f5...` + uniqueness repair `2fae4cb2...` + current trace `c9cb68d3...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-044 | Known-truth component RMSE alignment and deterministic binary64 accumulation depended on serialization row order rather than scientific component identity | `verification-pending` | cross-slice RED `8ad72ac9...` + alignment repair `2dd9537e...` + rounding RED `5fb93c40...` + canonical-order repair `025dce7f...` + edge `976ce7d7...` + current #310 `c6680450...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | public RED `c5ec42e4...` + scaled repair `7499042f...` + current #488 `f68c2dea...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-046 | Bias standard error could reject a representable SEM because raw squared deviations, their sum, or an intermediate sample variance overflowed | `verification-pending` | public RED `7de0ef90...` + scaled direct-SEM repair `cad23162...` + edges `8a6cc346...` / `28d96c23...` + current #488 `f68c2dea...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-047 | Generic Validation Evidence RMSE/RMSE-SE could reject representable extreme recovery or collapse a representable/nonzero subnormal error to false perfect recovery because residuals were squared before scale normalization | `verification-pending` | extreme RED `dd41ff53...` + subnormal RED `f4e19991...` + repair `6b182107...` + current #488 `f68c2dea...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-048 | Validation Evidence mean signed bias could erase a representable subnormal residual contribution by normalizing to an unrelated extreme magnitude before mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...` + hardening `77dcf38c...` + current #488 `f68c2dea...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | public RED `c5ec42e4...` + scaled repair `7499042f...` + current #488 `9f9ffc3f...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-046 | Bias standard error could reject a representable SEM because raw squared deviations, their sum, or an intermediate sample variance overflowed | `verification-pending` | public RED `7de0ef90...` + scaled direct-SEM repair `cad23162...` + edges `8a6cc346...` / `28d96c23...` + current #488 `9f9ffc3f...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-047 | Generic Validation Evidence RMSE/RMSE-SE could reject representable extreme recovery or collapse a representable/nonzero subnormal error to false perfect recovery because residuals were squared before scale normalization | `verification-pending` | extreme RED `dd41ff53...` + subnormal RED `f4e19991...` + repair `6b182107...` + current #488 `9f9ffc3f...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-048 | Validation Evidence mean signed bias could erase a representable subnormal residual contribution by normalizing to an unrelated extreme magnitude before mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...` + hardening `77dcf38c...` + current #488 `9f9ffc3f...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-049 | Stable `Between` recovery could be aliased across occasion indices, duplicating one unit-level scientific target and silently changing the RMSE denominator | `verification-pending` | RED `0a03041c...` + fixture repair `53563e97...` + admission repair `ec2c1219...` + trace `c9cb68d3...` + current #310 `c6680450...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-050 | Zero-multiplier SE-aware acceptance could scale a nonzero residual to exact zero and falsely accept exact recovery when a large finite SE dominated normalization | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...` + current research `c45a76cf...` + current #488 `f68c2dea...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-051 | Exact-recovery SE acceptance used IEEE total ordering and therefore treated `-0.0` and `+0.0` as different scientific recovery values | `verification-pending` | signed-zero RED `379e6525...` + numeric-equality repair `55876e60...` + research `c45a76cf...` + current #488 `f68c2dea...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-052 | All-covered Wilson score coverage could cancel a positive binary64-representable lower endpoint to exact zero by subtracting nearly equal center and margin terms | `verification-pending` | public RED `f84e5918...` + exact all-covered endpoint repair `fe9b9c8a...` + current #488 `f68c2dea...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-053 | Strict-interior Wilson score coverage could cancel a positive binary64-representable lower endpoint to exact zero even after the all-covered endpoint specialization | `verification-pending` | public RED `9d45f482...` + initial rationalized lower-root repair `4f259f6e...` + current #488 `f68c2dea...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-054 | Wilson score coverage could falsely promote an all-uncovered or strict-interior upper endpoint to exact `1.0` when `center + margin` and the denominator rounded to the same binary64 value | `verification-pending` | all-uncovered RED `c070da26...` + strict-interior RED expansion `344081bf...` + complementary rationalized repair `9a2fdd05...` + current #488 `f68c2dea...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-055 | Strict-interior Wilson score coverage could accept a nonzero `center - margin` cancellation residue as the scientific lower endpoint, overstating a representable endpoint by orders of magnitude even though the subtraction did not collapse to zero | `verification-pending` | public RED `1a24fac7...` + scale-aware rationalized-lower repair `f7e20ddc...` + small-`z` reinforcement `39e5e087...` + current #488 `f68c2dea...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-056 | Durable or human-facing Validation Evidence could accept impossible finite report fields/cross-field relationships or bypass validation through serde/human projections, including standalone Monte Carlo summary egress | `verification-pending` | report domain RED/repair `e9414e6f...`/`28924b0d...` + ingress RED/repair `6d190cd7...`/`f70a6fc0...` + report direct-egress RED/repair `fb28f959...`/`f7e58ccd...` + Monte Carlo direct-egress RED/repair `b5a8ae1f...`/`18374c35...` + human projection RED/repair `541273f1...`/`53607f80...` + current #488 `f68c2dea...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-057 | `ValidationReport::monte_carlo_rmse` could admit a structurally valid generic Monte Carlo summary whose negative mean or percentile values are impossible for RMSE, allowing signed-metric semantics to leak into RMSE-specific Validation Evidence | `verification-pending` | public RED `3cd6e41d...` + report-boundary repair `0090259d...` + changelog `d2631d1b...` + current #488 `f68c2dea...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-058 | Durable generic Monte Carlo summaries could admit finite but impossible coarse uncertainty relationships because SD, SE, and replication count were validated independently | `verification-pending` | isolating RED `e2d0c057...` + inequality repair `0e973b56...` + edge contract `858368c8...` + current #488 `f68c2dea...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-059 | Durable generic Monte Carlo summaries could still materially understate or overstate positive Monte Carlo uncertainty after coarse inequality checks because `SE` was not required to agree with the represented `SD / sqrt(n)` relationship | `verification-pending` | canonical-coherence RED `0a4c242f...` + causal repair `9b53076a...` + adjacent-binary64 tolerance regression `141246cf...` + changelog `24a48acc...` + current #488 `f68c2dea...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-060 | `ValidationReport::monte_carlo_rmse` could admit exact-zero mean together with positive spread, SE, or percentile support, contradicting perfect recovery for a nonnegative replication metric | `verification-pending` | public RED `a17dfe1b...` + report-boundary repair `d17d8034...` + release note `42be8574...` + signed-zero/perfect-recovery edge `944fa96e...` + current #488 `f68c2dea...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-061 | Durable generic Monte Carlo summaries could claim exact-zero sample spread while retaining empirical percentile support away from the represented mean | `verification-pending` | public RED `ce21941a...` + support-coherence repair `d0f5c145...` + documentation/change trace `9067d3ca...` + current #488 `f68c2dea...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-062 | Finite-tolerance match classification could fail because it attempted to materialize an unrepresentable absolute residual even though the pair is deterministically outside every finite tolerance | `verification-pending` | decision/projection RED `d023ecdb...` + causal separation `5040ff96...` + documentation/change trace `9067d3ca...` + current #488 `f68c2dea...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-063 | `ValidationReport` could admit exact-zero point RMSE together with positive RMSE standard error, contradicting the canonical squared-residual estimator's exact-perfect-recovery state | `verification-pending` | public RED `f7b018c5...` + report-boundary repair `4c599918...` + changelog `6ae5b254...` + research/current #488 `f68c2dea...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-064 | `ValidationReport` could admit positive point RMSE with RMSE standard error above the maximum support of the declared squared-residual delta-method producer | `verification-pending` | public RED `a2aca5b0...` + support-bound repair `32f09402...` + changelog `7b61c107...` + research/current #488 `f68c2dea...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-050 | Zero-multiplier SE-aware acceptance could scale a nonzero residual to exact zero and falsely accept exact recovery when a large finite SE dominated normalization | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...` + current research `c45a76cf...` + current #488 `9f9ffc3f...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-051 | Exact-recovery SE acceptance used IEEE total ordering and therefore treated `-0.0` and `+0.0` as different scientific recovery values | `verification-pending` | signed-zero RED `379e6525...` + numeric-equality repair `55876e60...` + research `c45a76cf...` + current #488 `9f9ffc3f...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-052 | All-covered Wilson score coverage could cancel a positive binary64-representable lower endpoint to exact zero by subtracting nearly equal center and margin terms | `verification-pending` | public RED `f84e5918...` + exact all-covered endpoint repair `fe9b9c8a...` + current #488 `9f9ffc3f...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-053 | Strict-interior Wilson score coverage could cancel a positive binary64-representable lower endpoint to exact zero even after the all-covered endpoint specialization | `verification-pending` | public RED `9d45f482...` + initial rationalized lower-root repair `4f259f6e...` + current #488 `9f9ffc3f...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-054 | Wilson score coverage could falsely promote an all-uncovered or strict-interior upper endpoint to exact `1.0` when `center + margin` and the denominator rounded to the same binary64 value | `verification-pending` | all-uncovered RED `c070da26...` + strict-interior RED expansion `344081bf...` + complementary rationalized repair `9a2fdd05...` + current #488 `9f9ffc3f...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-055 | Strict-interior Wilson score coverage could accept a nonzero `center - margin` cancellation residue as the scientific lower endpoint, overstating a representable endpoint by orders of magnitude even though the subtraction did not collapse to zero | `verification-pending` | public RED `1a24fac7...` + scale-aware rationalized-lower repair `f7e20ddc...` + small-`z` reinforcement `39e5e087...` + current #488 `9f9ffc3f...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-056 | Durable or human-facing Validation Evidence could accept impossible finite report fields/cross-field relationships or bypass validation through serde/human projections, including standalone Monte Carlo summary egress | `verification-pending` | report domain RED/repair `e9414e6f...`/`28924b0d...` + ingress RED/repair `6d190cd7...`/`f70a6fc0...` + report direct-egress RED/repair `fb28f959...`/`f7e58ccd...` + Monte Carlo direct-egress RED/repair `b5a8ae1f...`/`18374c35...` + human projection RED/repair `541273f1...`/`53607f80...` + current #488 `9f9ffc3f...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-057 | `ValidationReport::monte_carlo_rmse` could admit a structurally valid generic Monte Carlo summary whose negative mean or percentile values are impossible for RMSE, allowing signed-metric semantics to leak into RMSE-specific Validation Evidence | `verification-pending` | public RED `3cd6e41d...` + report-boundary repair `0090259d...` + changelog `d2631d1b...` + current #488 `9f9ffc3f...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-058 | Durable generic Monte Carlo summaries could admit finite but impossible coarse uncertainty relationships because SD, SE, and replication count were validated independently | `verification-pending` | isolating RED `e2d0c057...` + inequality repair `0e973b56...` + edge contract `858368c8...` + current #488 `9f9ffc3f...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-059 | Durable generic Monte Carlo summaries could still materially understate or overstate positive Monte Carlo uncertainty after coarse inequality checks because `SE` was not required to agree with the represented `SD / sqrt(n)` relationship | `verification-pending` | canonical-coherence RED `0a4c242f...` + causal repair `9b53076a...` + adjacent-binary64 tolerance regression `141246cf...` + changelog `24a48acc...` + current #488 `9f9ffc3f...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-060 | `ValidationReport::monte_carlo_rmse` could admit exact-zero mean together with positive spread, SE, or percentile support, contradicting perfect recovery for a nonnegative replication metric | `verification-pending` | public RED `a17dfe1b...` + report-boundary repair `d17d8034...` + release note `42be8574...` + signed-zero/perfect-recovery edge `944fa96e...` + current #488 `9f9ffc3f...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-061 | Durable generic Monte Carlo summaries could claim exact-zero sample spread while retaining empirical percentile support away from the represented mean | `verification-pending` | public RED `ce21941a...` + support-coherence repair `d0f5c145...` + documentation/change trace `9067d3ca...` + current #488 `9f9ffc3f...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-062 | Finite-tolerance match classification could fail because it attempted to materialize an unrepresentable absolute residual even though the pair is deterministically outside every finite tolerance | `verification-pending` | decision/projection RED `d023ecdb...` + causal separation `5040ff96...` + documentation/change trace `9067d3ca...` + current #488 `9f9ffc3f...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-063 | `ValidationReport` could admit exact-zero point RMSE together with positive RMSE standard error, contradicting the canonical squared-residual estimator's exact-perfect-recovery state | `verification-pending` | public RED `f7b018c5...` + report-boundary repair `4c599918...` + changelog `6ae5b254...` + research/current #488 `9f9ffc3f...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-064 | `ValidationReport` could admit positive point RMSE with RMSE standard error above the maximum support of the declared squared-residual delta-method producer | `verification-pending` | public RED `a2aca5b0...` + support-bound repair `32f09402...` + changelog `7b61c107...` + research/current #488 `9f9ffc3f...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-065 | `ValidationReport::monte_carlo_rmse` could admit a positive mean with Monte Carlo spread/SE impossible for any sample of nonnegative RMSE replications | `verification-pending` | stale-fixture repair `e201a2f4...` + public RED `43a7dec1...` + typed support-bound repair `2f78954e...` + changelog `4ce54959...` + research/current #488 `9f9ffc3f...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | ## Release gate From fcd1b1f6efdf72b29693eac35fa98f086a707c04 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 4 Sep 2026 11:06:00 +0900 Subject: [PATCH 153/235] docs(gaps): track RMSE percentile support repair --- docs/product-technical-gap-baseline.md | 63 ++++++++++++++------------ 1 file changed, 33 insertions(+), 30 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 27054c22c..7e88f771a 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,7 +4,7 @@ **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-04T01:01Z +**Snapshot:** 2026-09-04T02:10Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` @@ -34,7 +34,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `9f9ffc3ff1d730228719fea977613153136fd720` | true | `main` | Validation Evidence numerical/artifact repair. Bias/RMSE/Monte Carlo retain representable extreme/subnormal evidence; zero-multiplier SE-aware acceptance is exact-recovery before scale reduction; signed IEEE zeros are one numeric exact-recovery value. Wilson endpoints use stable represented roots where direct evaluation loses the estimand. `ValidationReport` enforces metric domains and cross-field coherence on explicit validation, serde ingress/egress, and human-readable projection: exact-zero point RMSE requires exact-zero point RMSE SE, and positive point RMSE admits only delta-method standard error within the squared-residual support bound `SE(RMSE) <= RMSE / 2` plus a small binary64 tolerance. Generic `MonteCarloSummary` remains sign-neutral, requires represented `SD / sqrt(n)` coherence for positive spread, and requires zero-spread empirical percentile support to be degenerate at the represented mean. `match_count` owns a decision contract distinct from residual projection, so an unrepresentable absolute residual can still be a deterministic mismatch for every finite tolerance. The `monte_carlo_rmse` embedding additionally requires nonnegative mean/percentiles; exact-zero mean carries zero spread/SE/support, while positive mean must satisfy the nonnegative-replication support bound `SE(mean) <= mean` within the same small binary64 tolerance. Exact-head hosted gates and independent review remain required. | +| #488 | `f10da1b20d02d6961742b4fafa7609612fdacc8c` | true | `main` | Validation Evidence numerical/artifact repair. Bias/RMSE/Monte Carlo retain representable extreme/subnormal evidence; zero-multiplier SE-aware acceptance is exact-recovery before scale reduction; signed IEEE zeros are one numeric exact-recovery value. Wilson endpoints use stable represented roots where direct evaluation loses the estimand. `ValidationReport` enforces metric domains and cross-field coherence on explicit validation, serde ingress/egress, and human-readable projection: exact-zero point RMSE requires exact-zero point RMSE SE, and positive point RMSE admits only delta-method standard error within the squared-residual support bound `SE(RMSE) <= RMSE / 2` plus a small binary64 tolerance. Generic `MonteCarloSummary` remains sign-neutral, requires represented `SD / sqrt(n)` coherence for positive spread, and requires zero-spread empirical percentile support to be degenerate at the represented mean. `match_count` owns a decision contract distinct from residual projection, so an unrepresentable absolute residual can still be a deterministic mismatch for every finite tolerance. The `monte_carlo_rmse` embedding additionally requires nonnegative mean/percentiles; exact-zero mean carries zero spread/SE/support, while positive mean must satisfy both `SE(mean) <= mean` and inclusive nearest-rank empirical percentile support `percentile_upper / mean <= replication_count` within small binary64 tolerances. Exact-head hosted gates and independent review remain required. | | #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 `feat/copy-identity-analysis-run-gap-004` | Validation / Analysis Run fold child. Sparse observed relation classes are valid evidence; RED `a2892b6...`, repair `a6402015...`, predecessor-test correction `6b0c8de6...`; ADR 0079 is `Proposed`. No child-head CI transfers to #416. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | @@ -70,12 +70,12 @@ The clock contract separates event/valid time, assertion time, document time, sy - Mean signed bias is a Validation Evidence performance measure over admitted recovery units. Opposite-sign represented residuals cancel before scale reduction; a representable low-order bias must survive cancellation of unrelated extreme terms. Exact cancellation remains zero, while a mathematically nonzero bias below binary64 range fails closed. - Bias standard error is formed from the same admitted signed differences. A representable SEM must not fail solely because raw squared deviations, their sum, or an intermediate sample variance overflows. - Generic Validation Evidence RMSE and its delta-method standard error normalize finite residual magnitudes before squaring. A representable extreme or minimum-subnormal RMSE must survive avoidable intermediate overflow/underflow, while a mathematically nonzero final RMSE or SE below the binary64 range fails closed. Exact-zero point RMSE denotes exact perfect recovery and therefore requires exact-zero point RMSE standard error. For positive RMSE, the declared squared-residual delta-method producer satisfies `SE(RMSE) <= RMSE / 2`; durable admission enforces that support bound with a small relative binary64 tolerance. Positive RMSE with zero SE remains valid when squared residuals have exactly zero sample spread. -- Monte Carlo mean/sample-SD/SE preserve representable uncertainty across full-range and subnormal replication values. Avoidable raw-product/Welford overflow or final false-zero uncertainty is not accepted as scientific evidence. Durable `MonteCarloSummary` admission requires zero SD to carry zero SE and empirical percentile endpoints equal to the represented mean; positive SD requires a positive SE coherent with `SD / sqrt(n)` within a small relative binary64 tolerance. Singleton summaries require zero spread/SE and degenerate support. The tolerance prevents bit-pattern equality from becoming an interoperability requirement while still rejecting materially understated or overstated uncertainty. When the generic carrier occupies `ValidationReport::monte_carlo_rmse`, every retained replication is nonnegative; with mean `m`, sample support implies `SD <= sqrt(n) * m` and therefore `SE(mean) <= m`. Durable typed admission enforces that additional bound without imposing it on signed metrics such as bias. +- Monte Carlo mean/sample-SD/SE preserve representable uncertainty across full-range and subnormal replication values. Avoidable raw-product/Welford overflow or final false-zero uncertainty is not accepted as scientific evidence. Durable `MonteCarloSummary` admission requires zero SD to carry zero SE and empirical percentile endpoints equal to the represented mean; positive SD requires a positive SE coherent with `SD / sqrt(n)` within a small relative binary64 tolerance. Singleton summaries require zero spread/SE and degenerate support. The tolerance prevents bit-pattern equality from becoming an interoperability requirement while still rejecting materially understated or overstated uncertainty. When the generic carrier occupies `ValidationReport::monte_carlo_rmse`, every retained replication is nonnegative; with mean `m`, sample support implies `SD <= sqrt(n) * m` and therefore `SE(mean) <= m`. Because the stored inclusive nearest-rank percentile endpoints are selected from retained values, each endpoint also lies at or below the nonnegative sample sum `n*m`; positive-mean admission evaluates this without an overflow-prone product as `percentile_upper / mean <= replication_count` with a small relative binary64 tolerance. These typed bounds are not imposed on signed metrics such as bias. - SE-aware acceptance is the declared rule `|estimate - target| <= k * SE`. For `k = 0`, the bound is exactly zero and exact recovery is evaluated before scale reduction; a large finite SE cannot erase a nonzero residual into acceptance. - Exact-recovery acceptance is finite numeric equality, not IEEE total-order identity. `-0.0` and `+0.0` therefore produce one zero-error decision while nonzero finite residuals remain distinct; this does not require blanket signed-zero canonicalization in private numerical intermediates. - `match_count` is a finite-threshold decision and does not require materializing every residual magnitude. If subtraction of two finite endpoints overflows, the real absolute residual exceeds `f64::MAX` and therefore every admitted finite tolerance, so the pair is a deterministic mismatch. `absolute_residuals` remains fail-closed when the residual value itself is requested. - Wilson interval coverage evidence must preserve representable endpoints. All-covered lower bounds use `n / (n + z²)`. Every nonzero strict-interior lower bound uses the algebraically rationalized positive root; the implementation evaluates it on natural scale for `z² < 1` and on `z²`-normalized scale for `z² >= 1`. Thus neither exact-zero collapse nor a nonzero `center - margin` cancellation residue is accepted as the endpoint. If direct `center + margin` rounds an upper endpoint to exact one while uncovered mass is nonzero, the complementary uncovered lower root is evaluated with the same stable representation and subtracted from one. -- Durable and human-facing Validation Evidence must preserve producing-metric invariants at every supported projection boundary, not merely binary64 finiteness. `ValidationReport` enforces nonnegative error/SE fields, point RMSE/SE squared-residual support, probability/accuracy domains, Wilson ordering and containment on explicit validation, JSON/serde ingress and egress, and human-readable summary projection. `MonteCarloSummary` remains generic and sign-neutral; when embedded as `ValidationReport::monte_carlo_rmse`, its mean and percentile endpoints are nonnegative because each RMSE replication is nonnegative, exact-zero mean requires zero spread, SE, and empirical percentile endpoints, and positive mean requires Monte Carlo mean SE not to exceed the mean under nonnegative sample support. Direct `MonteCarloSummary` serialization applies count/finiteness/nonnegative-uncertainty/percentile-order, zero-spread support, and canonical SEM-coherence rules. +- Durable and human-facing Validation Evidence must preserve producing-metric invariants at every supported projection boundary, not merely binary64 finiteness. `ValidationReport` enforces nonnegative error/SE fields, point RMSE/SE squared-residual support, probability/accuracy domains, Wilson ordering and containment on explicit validation, JSON/serde ingress and egress, and human-readable summary projection. `MonteCarloSummary` remains generic and sign-neutral; when embedded as `ValidationReport::monte_carlo_rmse`, its mean and percentile endpoints are nonnegative because each RMSE replication is nonnegative, exact-zero mean requires zero spread, SE, and empirical percentile endpoints, and positive mean requires both Monte Carlo mean SE not to exceed the mean and empirical nearest-rank percentile endpoints not to exceed the `n*mean` support of retained nonnegative replications. Direct `MonteCarloSummary` serialization applies count/finiteness/nonnegative-uncertainty/percentile-order, zero-spread support, and canonical SEM-coherence rules. - Bias, RMSE, and Monte Carlo may share private deterministic scalar support inside `validation_core`, but metric-specific cancellation/normalization, denominator, uncertainty, and fail-closed semantics remain with their bounded modules; support primitives are not second psychometric estimator authorities. - A mathematically nonzero scientific error metric must not be promoted to exact perfect recovery merely because its final binary64 representation underflows to zero. - Known-truth recovery denominators are defined by unique scientific component identity. Duplicate rows and stable-Between occasion aliases are not implicit weights unless a separately named weighted contract explicitly owns weighting. @@ -97,7 +97,7 @@ The clock contract separates event/valid time, assertion time, document time, sy #310 remains the canonical Longitudinal Modeling landing vehicle at `c6680450152b1e0a2c9abb553772d74a23923335`. It retains lagged Pearson association with both marginal variances, stationary/discrete drift-diffusion standardization, CWC, irregular-rate and occasion-mean composition, within/between decomposition, and known-truth component recovery under the owner-correct `longitudinal_core` boundary. -The #486 occasion-mean fold is verified-successor consolidation: valid source/tests/contracts/research/release-note deltas are inherited by #310, including `CHANGELOG.d/longitudinal-occasion-mean-event-time.md`; wrong-owner temporal source, raw-bit signed-zero identity, naive averaging, and unsupported provenance were intentionally not inherited. No child-head CI/review evidence transfers. +The #486 occasion-mean fold is verified-successor consolidation: valid source/tests/contracts/research/release-note deltas are inherited by #310, including `CHANGELOG.d/longitudinal-occasion-mean-event-time.md`; wrong-owner temporal source, raw-bit signed-zero identity, naive mean summation, and unsupported provenance were intentionally not inherited. No child-head CI/review evidence transfers. Longitudinal stable means share one deterministic, overflow-safe authority. RED/repair lineages `23476f45...`→`b14eb6e8...`, `b073f03f...`→`350b8d4e...`, `ae5e61f9...`→`39469067...`, `7dc87aa8...`→`97c8ad35...`, and `96f1c334...`→`ae5081d8...` cover ties-to-even, exact power-of-two normalization, mixed-sign cancellation, decomposition shadow-mean removal, and one-sign false-zero mean refusal. Adjacent-float log-rate RED `766ddc7a...` and repair `16f21d9a...` remove quotient-first rounding through represented difference/`ln_1p` evaluation. @@ -109,7 +109,7 @@ Current #310 exact-head workflows and a qualifying independent current-head appr ### #488 — Validation Evidence recovery arithmetic -#488 is the generic Validation Evidence landing vehicle at exact head `9f9ffc3ff1d730228719fea977613153136fd720`. It remains distinct from Longitudinal Modeling and does not consume mutable fast-mlsirm source. +#488 is the generic Validation Evidence landing vehicle at exact head `f10da1b20d02d6961742b4fafa7609612fdacc8c`. It remains distinct from Longitudinal Modeling and does not consume mutable fast-mlsirm source. Mean signed bias no longer depends on a raw finite sum that can overflow before division (`c5ec42e4...`→`7499042f...`). Full-range mixed-sign cancellation preserves representable low-order bias before scale reduction (`b6084750...`→`227921d9...`, hardening `77dcf38c...`). Bias SEM scales deviations before squaring and forms the final SEM without avoidable variance overflow (`7de0ef90...`→`cad23162...`, edges `8a6cc346...`/`28d96c23...`). @@ -143,9 +143,11 @@ Point-report review first closed exact-perfect coherence: `ValidationReport` ind The same producer yields a broader support bound. For `x_i = r_i^2 >= 0` with mean `m = RMSE^2`, `sum(x_i^2) <= (sum x_i)^2` implies sample `sd(x) <= sqrt(n) * m`; therefore the declared delta-method `SE(RMSE) = sd(x) / (2 * RMSE * sqrt(n))` satisfies `SE(RMSE) <= RMSE / 2`. Residual magnitudes `[0,1]` attain the boundary. Public RED `a2aca5b077665433aad0e5531d53360b599b64b3` proves the predecessor admitted `(rmse=0.2, rmse_standard_error=0.11)`; causal report-boundary repair `32f094029732e2333b35ad3a11521c4c3d956798` enforces the ratio with `64*EPSILON` tolerance; release trace `7b61c107d1bc6391651ce2341e6ad27c2cada17a`; research predecessor `f68c2dea13dddc998c000a20737677555b52cb7e`. Positive RMSE with zero SE remains admissible when squared residuals are exactly constant. -Positive Monte Carlo RMSE summaries have a related but distinct support invariant. If the retained replication values are `x_i >= 0` with sample mean `m`, then `SD <= sqrt(n) * m`, so the stored Monte Carlo `SE(mean)=SD/sqrt(n)` cannot exceed `m`. The boundary is attainable at `[0,0,0,4]`, which gives `(n=4, mean=1, SD=2, SE=1)`. A generic-valid `(n=4, mean=1, SD=3, SE=1.5)` summary therefore cannot represent RMSE replications. Stale zero-mean fixture repair `e201a2f46953152255345a7b3abc35f05ea9e33c`; public RED `43a7dec1dbc848435ca099aea80db46c8cbd97e5`; causal typed-admission repair `2f78954eb21a08c316d0d6b70f659685fb283a0b`; changelog `4ce54959a5c70ccae8212a6494d346ceef0ff35f`; research/current #488 `9f9ffc3ff1d730228719fea977613153136fd720`. +Positive Monte Carlo RMSE summaries have a related but distinct support invariant. If the retained replication values are `x_i >= 0` with sample mean `m`, then `SD <= sqrt(n) * m`, so the stored Monte Carlo `SE(mean)=SD/sqrt(n)` cannot exceed `m`. The boundary is attainable at `[0,0,0,4]`, which gives `(n=4, mean=1, SD=2, SE=1)`. A generic-valid `(n=4, mean=1, SD=3, SE=1.5)` summary therefore cannot represent RMSE replications. Stale zero-mean fixture repair `e201a2f46953152255345a7b3abc35f05ea9e33c`; public RED `43a7dec1dbc848435ca099aea80db46c8cbd97e5`; causal typed-admission repair `2f78954eb21a08c316d0d6b70f659685fb283a0b`; changelog `4ce54959a5c70ccae8212a6494d346ceef0ff35f`; research predecessor `9f9ffc3ff1d730228719fea977613153136fd720`. -Morris, White, and Crowther (2019) remain the simulation performance-measure/Monte Carlo uncertainty methodology trace; Wilson (1927) remains the primary score-interval reference. AERA/APA/NCME (2014) remains the current published testing-standards edition while revision is underway, and AERA publishes a current Standards task-force roster dated 2026-08-31. Exact-head hosted Rust/documentation/security/supply-chain/100%-coverage gates and a qualifying independent current-head review remain required. +The same nonnegative support constrains empirical percentiles. For `n` retained RMSE replications with mean `m`, no retained value can exceed the total sample support `n*m`. Since `summarize_replications` stores inclusive nearest-rank endpoints selected directly from the retained sorted values, an upper empirical percentile above `n*m` is impossible even when the generic carrier's mean/SD/SE relationship is coherent. Public RED `84a200ee451247c8f75fcce322aa7fc558f38c43` uses a generic-valid `(n=4, mean=1, SD=0.5, SE=0.25, upper=5)` payload; causal typed-admission repair `04c9cdd4b89d37145853316bb419943735830c79` checks `percentile_upper / mean <= n` with `64*EPSILON` tolerance, avoiding an overflow-prone `n*mean` intermediate and preserving the attainable `[0,0,0,4]` boundary; changelog `00b9278a2c1bc1b912ed7c945391afe71f56bf55`; research/current #488 `f10da1b20d02d6961742b4fafa7609612fdacc8c`. + +Morris, White, and Crowther (2019) remain the simulation performance-measure/Monte Carlo uncertainty methodology trace; Wilson (1927) remains the primary score-interval reference. AERA/APA/NCME (2014) remains the current published testing-standards edition while revision is underway. Exact-head hosted Rust/documentation/security/supply-chain/100%-coverage gates and a qualifying independent current-head review remain required. ### #416 — Validation / Analysis Run consolidation @@ -190,7 +192,7 @@ Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/num | GAP-017 | dynamic evaluation item/rater/anchor drift monitoring | `owner-contract-active` | released/digest-pinned dynamic criterion/item/run contract, ACL conformance, no-anchor/no-linking refusal, evidence-gated temporal monitoring | | GAP-018 | Longitudinal stable-mean logic had a separate decomposition implementation after CWC/occasion consolidation | `verification-pending` | RED `7dc87aa8...` + repair `97c8ad35...` + trace `a1aef11e...`; scan remaining Longitudinal means, exact-head GREEN/review/main integration | | GAP-019 | Longitudinal scientific instructions contradicted stationary-overflow implementation | `verification-pending` | RED `9d8a82d...` + repair `9c962205...`; exact-head documentation/review GREEN and protected-main integration | -| GAP-020 | Nonzero lagged covariance can be misreported as exact-zero correlation when standardized magnitude is unrepresentable | `verification-pending` | RED `c345ee7b...` + repair `5785e07a...`; exact-head Rust/documentation/review GREEN and protected-main integration | +| GAP-020 | Nonzero lagged covariance can be misreported as exact-zero correlation when standardized magnitude is unrepresentable | `verification-pending` | RED `c345ee7b...` + repair `5785e07a...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-021 | Longitudinal irregular-rate facade duplicated public wrapper identities over one canonical implementation | `verification-pending` | RED `464863860...` + repair `7f0bea084...`; exact-head Rust/documentation/review GREEN and protected-main integration | | GAP-022 | Architecture assigned Longitudinal Modeling semantics to `psychometric_core` and duplicated implementation responsibility rows | `verification-pending` | RED `fe5eb745...` + repair `7fadc757...`; exact-head documentation/review GREEN and protected-main integration | | GAP-023 | `discreteDIFFUSIONstd` rejected a representable subnormal final ratio because `aΔt` underflowed before the required factor two | `verification-pending` | RED `d5107b198...` + repair `7164c7ce4...`; exact-head GREEN and protected-main integration | @@ -215,28 +217,29 @@ Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/num | GAP-042 | Ratio-first logarithm could nearly double an adjacent-float power-of-two irregular residual growth rate before event-time scaling | `verification-pending` | public RED `766ddc7a...` + causal `ln_1p` repair `16f21d9a...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-043 | Duplicate known-truth component identities could silently reweight RMSE recovery evidence by changing the denominator without adding a new scientific target | `verification-pending` | public RED `698f12f5...` + uniqueness repair `2fae4cb2...` + current trace `c9cb68d3...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-044 | Known-truth component RMSE alignment and deterministic binary64 accumulation depended on serialization row order rather than scientific component identity | `verification-pending` | cross-slice RED `8ad72ac9...` + alignment repair `2dd9537e...` + rounding RED `5fb93c40...` + canonical-order repair `025dce7f...` + edge `976ce7d7...` + current #310 `c6680450...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | public RED `c5ec42e4...` + scaled repair `7499042f...` + current #488 `9f9ffc3f...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-046 | Bias standard error could reject a representable SEM because raw squared deviations, their sum, or an intermediate sample variance overflowed | `verification-pending` | public RED `7de0ef90...` + scaled direct-SEM repair `cad23162...` + edges `8a6cc346...` / `28d96c23...` + current #488 `9f9ffc3f...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-047 | Generic Validation Evidence RMSE/RMSE-SE could reject representable extreme recovery or collapse a representable/nonzero subnormal error to false perfect recovery because residuals were squared before scale normalization | `verification-pending` | extreme RED `dd41ff53...` + subnormal RED `f4e19991...` + repair `6b182107...` + current #488 `9f9ffc3f...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-048 | Validation Evidence mean signed bias could erase a representable subnormal residual contribution by normalizing to an unrelated extreme magnitude before mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...` + hardening `77dcf38c...` + current #488 `9f9ffc3f...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | public RED `c5ec42e4...` + scaled repair `7499042f...` + current #488 `f10da1b...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-046 | Bias standard error could reject a representable SEM because raw squared deviations, their sum, or an intermediate sample variance overflowed | `verification-pending` | public RED `7de0ef90...` + scaled direct-SEM repair `cad23162...` + edges `8a6cc346...` / `28d96c23...` + current #488 `f10da1b...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-047 | Generic Validation Evidence RMSE/RMSE-SE could reject representable extreme recovery or collapse a representable/nonzero subnormal error to false perfect recovery because residuals were squared before scale normalization | `verification-pending` | extreme RED `dd41ff53...` + subnormal RED `f4e19991...` + repair `6b182107...` + current #488 `f10da1b...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-048 | Validation Evidence mean signed bias could erase a representable subnormal residual contribution by normalizing to an unrelated extreme magnitude before mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...` + hardening `77dcf38c...` + current #488 `f10da1b...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | | GAP-049 | Stable `Between` recovery could be aliased across occasion indices, duplicating one unit-level scientific target and silently changing the RMSE denominator | `verification-pending` | RED `0a03041c...` + fixture repair `53563e97...` + admission repair `ec2c1219...` + trace `c9cb68d3...` + current #310 `c6680450...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-050 | Zero-multiplier SE-aware acceptance could scale a nonzero residual to exact zero and falsely accept exact recovery when a large finite SE dominated normalization | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...` + current research `c45a76cf...` + current #488 `9f9ffc3f...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-051 | Exact-recovery SE acceptance used IEEE total ordering and therefore treated `-0.0` and `+0.0` as different scientific recovery values | `verification-pending` | signed-zero RED `379e6525...` + numeric-equality repair `55876e60...` + research `c45a76cf...` + current #488 `9f9ffc3f...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-052 | All-covered Wilson score coverage could cancel a positive binary64-representable lower endpoint to exact zero by subtracting nearly equal center and margin terms | `verification-pending` | public RED `f84e5918...` + exact all-covered endpoint repair `fe9b9c8a...` + current #488 `9f9ffc3f...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-053 | Strict-interior Wilson score coverage could cancel a positive binary64-representable lower endpoint to exact zero even after the all-covered endpoint specialization | `verification-pending` | public RED `9d45f482...` + initial rationalized lower-root repair `4f259f6e...` + current #488 `9f9ffc3f...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-054 | Wilson score coverage could falsely promote an all-uncovered or strict-interior upper endpoint to exact `1.0` when `center + margin` and the denominator rounded to the same binary64 value | `verification-pending` | all-uncovered RED `c070da26...` + strict-interior RED expansion `344081bf...` + complementary rationalized repair `9a2fdd05...` + current #488 `9f9ffc3f...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-055 | Strict-interior Wilson score coverage could accept a nonzero `center - margin` cancellation residue as the scientific lower endpoint, overstating a representable endpoint by orders of magnitude even though the subtraction did not collapse to zero | `verification-pending` | public RED `1a24fac7...` + scale-aware rationalized-lower repair `f7e20ddc...` + small-`z` reinforcement `39e5e087...` + current #488 `9f9ffc3f...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-056 | Durable or human-facing Validation Evidence could accept impossible finite report fields/cross-field relationships or bypass validation through serde/human projections, including standalone Monte Carlo summary egress | `verification-pending` | report domain RED/repair `e9414e6f...`/`28924b0d...` + ingress RED/repair `6d190cd7...`/`f70a6fc0...` + report direct-egress RED/repair `fb28f959...`/`f7e58ccd...` + Monte Carlo direct-egress RED/repair `b5a8ae1f...`/`18374c35...` + human projection RED/repair `541273f1...`/`53607f80...` + current #488 `9f9ffc3f...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-057 | `ValidationReport::monte_carlo_rmse` could admit a structurally valid generic Monte Carlo summary whose negative mean or percentile values are impossible for RMSE, allowing signed-metric semantics to leak into RMSE-specific Validation Evidence | `verification-pending` | public RED `3cd6e41d...` + report-boundary repair `0090259d...` + changelog `d2631d1b...` + current #488 `9f9ffc3f...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-058 | Durable generic Monte Carlo summaries could admit finite but impossible coarse uncertainty relationships because SD, SE, and replication count were validated independently | `verification-pending` | isolating RED `e2d0c057...` + inequality repair `0e973b56...` + edge contract `858368c8...` + current #488 `9f9ffc3f...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-059 | Durable generic Monte Carlo summaries could still materially understate or overstate positive Monte Carlo uncertainty after coarse inequality checks because `SE` was not required to agree with the represented `SD / sqrt(n)` relationship | `verification-pending` | canonical-coherence RED `0a4c242f...` + causal repair `9b53076a...` + adjacent-binary64 tolerance regression `141246cf...` + changelog `24a48acc...` + current #488 `9f9ffc3f...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-060 | `ValidationReport::monte_carlo_rmse` could admit exact-zero mean together with positive spread, SE, or percentile support, contradicting perfect recovery for a nonnegative replication metric | `verification-pending` | public RED `a17dfe1b...` + report-boundary repair `d17d8034...` + release note `42be8574...` + signed-zero/perfect-recovery edge `944fa96e...` + current #488 `9f9ffc3f...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-061 | Durable generic Monte Carlo summaries could claim exact-zero sample spread while retaining empirical percentile support away from the represented mean | `verification-pending` | public RED `ce21941a...` + support-coherence repair `d0f5c145...` + documentation/change trace `9067d3ca...` + current #488 `9f9ffc3f...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-062 | Finite-tolerance match classification could fail because it attempted to materialize an unrepresentable absolute residual even though the pair is deterministically outside every finite tolerance | `verification-pending` | decision/projection RED `d023ecdb...` + causal separation `5040ff96...` + documentation/change trace `9067d3ca...` + current #488 `9f9ffc3f...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-063 | `ValidationReport` could admit exact-zero point RMSE together with positive RMSE standard error, contradicting the canonical squared-residual estimator's exact-perfect-recovery state | `verification-pending` | public RED `f7b018c5...` + report-boundary repair `4c599918...` + changelog `6ae5b254...` + research/current #488 `9f9ffc3f...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-064 | `ValidationReport` could admit positive point RMSE with RMSE standard error above the maximum support of the declared squared-residual delta-method producer | `verification-pending` | public RED `a2aca5b0...` + support-bound repair `32f09402...` + changelog `7b61c107...` + research/current #488 `9f9ffc3f...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-065 | `ValidationReport::monte_carlo_rmse` could admit a positive mean with Monte Carlo spread/SE impossible for any sample of nonnegative RMSE replications | `verification-pending` | stale-fixture repair `e201a2f4...` + public RED `43a7dec1...` + typed support-bound repair `2f78954e...` + changelog `4ce54959...` + research/current #488 `9f9ffc3f...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-050 | Zero-multiplier SE-aware acceptance could scale a nonzero residual to exact zero and falsely accept exact recovery when a large finite SE dominated normalization | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...` + current research `c45a76cf...` + current #488 `f10da1b...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-051 | Exact-recovery SE acceptance used IEEE total ordering and therefore treated `-0.0` and `+0.0` as different scientific recovery values | `verification-pending` | signed-zero RED `379e6525...` + numeric-equality repair `55876e60...` + research `c45a76cf...` + current #488 `f10da1b...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-052 | All-covered Wilson score coverage could cancel a positive binary64-representable lower endpoint to exact zero by subtracting nearly equal center and margin terms | `verification-pending` | public RED `f84e5918...` + exact all-covered endpoint repair `fe9b9c8a...` + current #488 `f10da1b...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-053 | Strict-interior Wilson score coverage could cancel a positive binary64-representable lower endpoint to exact zero even after the all-covered endpoint specialization | `verification-pending` | public RED `9d45f482...` + initial rationalized lower-root repair `4f259f6e...` + current #488 `f10da1b...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-054 | Wilson score coverage could falsely promote an all-uncovered or strict-interior upper endpoint to exact `1.0` when `center + margin` and the denominator rounded to the same binary64 value | `verification-pending` | all-uncovered RED `c070da26...` + strict-interior RED expansion `344081bf...` + complementary rationalized repair `9a2fdd05...` + current #488 `f10da1b...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-055 | Strict-interior Wilson score coverage could accept a nonzero `center - margin` cancellation residue as the scientific lower endpoint, overstating a representable endpoint by orders of magnitude even though the subtraction did not collapse to zero | `verification-pending` | public RED `1a24fac7...` + scale-aware rationalized-lower repair `f7e20ddc...` + small-`z` reinforcement `39e5e087...` + current #488 `f10da1b...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-056 | Durable or human-facing Validation Evidence could accept impossible finite report fields/cross-field relationships or bypass validation through serde/human projections, including standalone Monte Carlo summary egress | `verification-pending` | report domain RED/repair `e9414e6f...`/`28924b0d...` + ingress RED/repair `6d190cd7...`/`f70a6fc0...` + report direct-egress RED/repair `fb28f959...`/`f7e58ccd...` + Monte Carlo direct-egress RED/repair `b5a8ae1f...`/`18374c35...` + human projection RED/repair `541273f1...`/`53607f80...` + current #488 `f10da1b...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-057 | `ValidationReport::monte_carlo_rmse` could admit a structurally valid generic Monte Carlo summary whose negative mean or percentile values are impossible for RMSE, allowing signed-metric semantics to leak into RMSE-specific Validation Evidence | `verification-pending` | public RED `3cd6e41d...` + report-boundary repair `0090259d...` + changelog `d2631d1b...` + current #488 `f10da1b...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-058 | Durable generic Monte Carlo summaries could admit finite but impossible coarse uncertainty relationships because SD, SE, and replication count were validated independently | `verification-pending` | isolating RED `e2d0c057...` + inequality repair `0e973b56...` + edge contract `858368c8...` + current #488 `f10da1b...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-059 | Durable generic Monte Carlo summaries could still materially understate or overstate positive Monte Carlo uncertainty after coarse inequality checks because `SE` was not required to agree with the represented `SD / sqrt(n)` relationship | `verification-pending` | canonical-coherence RED `0a4c242f...` + causal repair `9b53076a...` + adjacent-binary64 tolerance regression `141246cf...` + changelog `24a48acc...` + current #488 `f10da1b...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-060 | `ValidationReport::monte_carlo_rmse` could admit exact-zero mean together with positive spread, SE, or percentile support, contradicting perfect recovery for a nonnegative replication metric | `verification-pending` | public RED `a17dfe1b...` + report-boundary repair `d17d8034...` + release note `42be8574...` + signed-zero/perfect-recovery edge `944fa96e...` + current #488 `f10da1b...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-061 | Durable generic Monte Carlo summaries could claim exact-zero sample spread while retaining empirical percentile support away from the represented mean | `verification-pending` | public RED `ce21941a...` + support-coherence repair `d0f5c145...` + documentation/change trace `9067d3ca...` + current #488 `f10da1b...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-062 | Finite-tolerance match classification could fail because it attempted to materialize an unrepresentable absolute residual even though the pair is deterministically outside every finite tolerance | `verification-pending` | decision/projection RED `d023ecdb...` + causal separation `5040ff96...` + documentation/change trace `9067d3ca...` + current #488 `f10da1b...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-063 | `ValidationReport` could admit exact-zero point RMSE together with positive RMSE standard error, contradicting the canonical squared-residual estimator's exact-perfect-recovery state | `verification-pending` | public RED `f7b018c5...` + report-boundary repair `4c599918...` + changelog `6ae5b254...` + research/current #488 `f10da1b...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-064 | `ValidationReport` could admit positive point RMSE with RMSE standard error above the maximum support of the declared squared-residual delta-method producer | `verification-pending` | public RED `a2aca5b0...` + support-bound repair `32f09402...` + changelog `7b61c107...` + research/current #488 `f10da1b...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-065 | `ValidationReport::monte_carlo_rmse` could admit a positive mean with Monte Carlo spread/SE impossible for any sample of nonnegative RMSE replications | `verification-pending` | stale-fixture repair `e201a2f4...` + public RED `43a7dec1...` + typed support-bound repair `2f78954e...` + changelog `4ce54959...` + research/current #488 `f10da1b...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-066 | `ValidationReport::monte_carlo_rmse` could admit an inclusive nearest-rank empirical percentile endpoint above the total `n*mean` support available to `n` nonnegative RMSE replications | `verification-pending` | public RED `84a200ee...` + typed percentile-support repair `04c9cdd4...` + changelog `00b9278a...` + research/current #488 `f10da1b...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | ## Release gate -TEPP currently has no GitHub release. Release is permitted only after a coherent vertical reaches protected main with exact protected-head CI/security/recovery evidence, reproducible package + SBOM + provenance + rollback artifacts, current version/CHANGELOG, required migration/restore/load evidence, and released integration contracts where deployment depends on them. Queued/pending/startup-failed/skipped or predecessor-head evidence is not GREEN. \ No newline at end of file +TEPP currently has no GitHub release. Release is permitted only after a coherent vertical reaches protected main with exact protected-head CI/security/recovery evidence, reproducible package + SBOM + provenance + rollback artifacts, current version/CHANGELOG, required migration/restore/load evidence, and released integration contracts where deployment depends on them. Queued/pending/startup-failed/skipped or predecessor-head evidence is not GREEN. From e0b31bea0c66c44ccb4132692cdd94512b95d079 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 4 Sep 2026 12:16:41 +0900 Subject: [PATCH 154/235] docs(product): refresh Validation Evidence gap authority --- docs/product-technical-gap-baseline.md | 213 +++++++++---------------- 1 file changed, 75 insertions(+), 138 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 7e88f771a..b2b86fadb 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,7 +4,7 @@ **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-04T02:10Z +**Snapshot:** 2026-09-04T03:16Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` @@ -21,7 +21,7 @@ A planning document, mergeable branch, local/source inspection, predecessor-head | Protected `main` | `1bc02f580cf48e1d39da239f0e818453437c31c3` | Capability claims remain bounded to this commit until main advances. | | Open pull requests | **134** | WIP circuit breaker remains active; consolidate into existing bounded-context vehicles. | | Draft pull requests | **134** | Every current open PR is Draft. | -| Non-Draft pull requests | **0** | No PR is eligible for normal merge until it is deliberately made Ready after exact-head evidence. | +| Non-Draft pull requests | **0** | No PR is eligible for normal merge until deliberately made Ready after exact-head evidence. | | Open issues | **16** | ADR normalization, orchestration admission, evaluation drift, and scientific recovery remain open. | | GitHub releases | **0** | No TEPP open head is a released contract. | | Organization ruleset | `18156473` | One qualifying current-head approval, stale-review dismissal after push, resolved threads, extra approval for unattributed changes where applicable, and central required workflows. | @@ -34,8 +34,8 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `f10da1b20d02d6961742b4fafa7609612fdacc8c` | true | `main` | Validation Evidence numerical/artifact repair. Bias/RMSE/Monte Carlo retain representable extreme/subnormal evidence; zero-multiplier SE-aware acceptance is exact-recovery before scale reduction; signed IEEE zeros are one numeric exact-recovery value. Wilson endpoints use stable represented roots where direct evaluation loses the estimand. `ValidationReport` enforces metric domains and cross-field coherence on explicit validation, serde ingress/egress, and human-readable projection: exact-zero point RMSE requires exact-zero point RMSE SE, and positive point RMSE admits only delta-method standard error within the squared-residual support bound `SE(RMSE) <= RMSE / 2` plus a small binary64 tolerance. Generic `MonteCarloSummary` remains sign-neutral, requires represented `SD / sqrt(n)` coherence for positive spread, and requires zero-spread empirical percentile support to be degenerate at the represented mean. `match_count` owns a decision contract distinct from residual projection, so an unrepresentable absolute residual can still be a deterministic mismatch for every finite tolerance. The `monte_carlo_rmse` embedding additionally requires nonnegative mean/percentiles; exact-zero mean carries zero spread/SE/support, while positive mean must satisfy both `SE(mean) <= mean` and inclusive nearest-rank empirical percentile support `percentile_upper / mean <= replication_count` within small binary64 tolerances. Exact-head hosted gates and independent review remain required. | -| #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 `feat/copy-identity-analysis-run-gap-004` | Validation / Analysis Run fold child. Sparse observed relation classes are valid evidence; RED `a2892b6...`, repair `a6402015...`, predecessor-test correction `6b0c8de6...`; ADR 0079 is `Proposed`. No child-head CI transfers to #416. | +| #488 | `67b8e92209024ddec19ba04a018ec87fdcb21271` | true | `main` | Validation Evidence numerical/artifact repair. Generic `MonteCarloSummary` now binds SE to represented `SD / sqrt(n)`, zero spread to degenerate support, each nearest-rank endpoint to the represented mean/sample-spread budget, and distinct lower/upper endpoints jointly to the same `(n - 1) * SD²` squared-deviation budget. Typed `monte_carlo_rmse` additionally enforces nonnegative RMSE support. Exact-head hosted gates and independent review remain required. | +| #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 | Validation / Analysis Run fold child. Unique evidence must be inherited by a conflict-resolving survivor; child-head CI does not transfer. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | | #483 | `847d96f913bb261803ac0bd751ad7e4f51324cee` | true | #416 | Analysis Run fold child; preserve unique evidence. | @@ -43,8 +43,8 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | #480 | `01f45a99392457334a4f6d3d659f992af739eeee` | true | `main` | contextual-orchestrator consumer repair; stays Draft while immutable CO release/deployment/auth provenance is unavailable. | | #460 | `dfab4eab5ff733731e565a9348072b8dab2e4912` | true | #416 | Analysis Run fold child; typed cutoff equality and terminal-validation separation. | | #458 | `08165e3b3c929b4ae77396689549f72723ff8ff5` | true | #416 | Analysis Run fold child; typed cutoff equality and terminal-validation separation. | -| #416 | `aa730c63563eb4a33048d822b581036c8487bd47` | true | `main` | Validation / Analysis Run landing vehicle. Generic cutoff-before-identity repair remains in ancestry; current-head follow-ups canonicalize episode/cutoff fixtures and harden bounded artifact/profile tests. | -| #310 | `c6680450152b1e0a2c9abb553772d74a23923335` | true | `main` | Longitudinal Modeling vehicle. Stable `Between` recovery is unit-level with canonical occasion `0`; nonzero occasion aliases fail closed, while `Within` retains actual occasion identity. Exact-head verification remains non-passing until current gates and review complete. | +| #416 | `aa730c63563eb4a33048d822b581036c8487bd47` | true | `main` | Validation / Analysis Run landing vehicle. Generic cutoff-before-identity repair remains in ancestry. | +| #310 | `c6680450152b1e0a2c9abb553772d74a23923335` | true | `main` | Longitudinal Modeling vehicle. Stable `Between` recovery is unit-level with canonical occasion `0`; `Within` retains actual occasion identity. | Exact-head evidence becomes stale after any source push. @@ -65,109 +65,44 @@ The clock contract separates event/valid time, assertion time, document time, sy - A nominal unit identifier is not repeated-measures evidence; singleton units cannot satisfy a longitudinal multilevel floor. - Occasion-mean deviations `p_it = x_it - μ_t` are not CWC residuals, sample-wide grand-mean residuals, or RI-CLPM within-person effects. Numeric event time defines occasion identity, so `-0.0` and `+0.0` are one occasion. - Row arrival order is not scientific evidence. Fixed admitted observations must produce bit-identical means/centered results under permutation wherever the contract claims deterministic CPU `f64` reference behavior. -- Known-truth component recovery follows bounded-context identity: stable `Between` is unit-level and uses canonical `occasion_index = 0`; `Within` retains actual `(unit, occasion)` identity. Duplicate identities or stable-Between occasion aliases are not weights. Admitted identities accumulate in canonical order. +- Known-truth component recovery follows bounded-context identity: stable `Between` is unit-level and uses canonical `occasion_index = 0`; `Within` retains actual `(unit, occasion)` identity. Duplicate identities or stable-Between occasion aliases are not weights. - A representable final scientific estimand is not rejected solely because an avoidable intermediate binary64 operation overflows/underflows. False exact 0/1/non-finite endpoints and cancellation residues are not accepted when an algebraically equivalent stable form preserves the represented estimand. -- Mean signed bias is a Validation Evidence performance measure over admitted recovery units. Opposite-sign represented residuals cancel before scale reduction; a representable low-order bias must survive cancellation of unrelated extreme terms. Exact cancellation remains zero, while a mathematically nonzero bias below binary64 range fails closed. -- Bias standard error is formed from the same admitted signed differences. A representable SEM must not fail solely because raw squared deviations, their sum, or an intermediate sample variance overflows. -- Generic Validation Evidence RMSE and its delta-method standard error normalize finite residual magnitudes before squaring. A representable extreme or minimum-subnormal RMSE must survive avoidable intermediate overflow/underflow, while a mathematically nonzero final RMSE or SE below the binary64 range fails closed. Exact-zero point RMSE denotes exact perfect recovery and therefore requires exact-zero point RMSE standard error. For positive RMSE, the declared squared-residual delta-method producer satisfies `SE(RMSE) <= RMSE / 2`; durable admission enforces that support bound with a small relative binary64 tolerance. Positive RMSE with zero SE remains valid when squared residuals have exactly zero sample spread. -- Monte Carlo mean/sample-SD/SE preserve representable uncertainty across full-range and subnormal replication values. Avoidable raw-product/Welford overflow or final false-zero uncertainty is not accepted as scientific evidence. Durable `MonteCarloSummary` admission requires zero SD to carry zero SE and empirical percentile endpoints equal to the represented mean; positive SD requires a positive SE coherent with `SD / sqrt(n)` within a small relative binary64 tolerance. Singleton summaries require zero spread/SE and degenerate support. The tolerance prevents bit-pattern equality from becoming an interoperability requirement while still rejecting materially understated or overstated uncertainty. When the generic carrier occupies `ValidationReport::monte_carlo_rmse`, every retained replication is nonnegative; with mean `m`, sample support implies `SD <= sqrt(n) * m` and therefore `SE(mean) <= m`. Because the stored inclusive nearest-rank percentile endpoints are selected from retained values, each endpoint also lies at or below the nonnegative sample sum `n*m`; positive-mean admission evaluates this without an overflow-prone product as `percentile_upper / mean <= replication_count` with a small relative binary64 tolerance. These typed bounds are not imposed on signed metrics such as bias. -- SE-aware acceptance is the declared rule `|estimate - target| <= k * SE`. For `k = 0`, the bound is exactly zero and exact recovery is evaluated before scale reduction; a large finite SE cannot erase a nonzero residual into acceptance. -- Exact-recovery acceptance is finite numeric equality, not IEEE total-order identity. `-0.0` and `+0.0` therefore produce one zero-error decision while nonzero finite residuals remain distinct; this does not require blanket signed-zero canonicalization in private numerical intermediates. -- `match_count` is a finite-threshold decision and does not require materializing every residual magnitude. If subtraction of two finite endpoints overflows, the real absolute residual exceeds `f64::MAX` and therefore every admitted finite tolerance, so the pair is a deterministic mismatch. `absolute_residuals` remains fail-closed when the residual value itself is requested. -- Wilson interval coverage evidence must preserve representable endpoints. All-covered lower bounds use `n / (n + z²)`. Every nonzero strict-interior lower bound uses the algebraically rationalized positive root; the implementation evaluates it on natural scale for `z² < 1` and on `z²`-normalized scale for `z² >= 1`. Thus neither exact-zero collapse nor a nonzero `center - margin` cancellation residue is accepted as the endpoint. If direct `center + margin` rounds an upper endpoint to exact one while uncovered mass is nonzero, the complementary uncovered lower root is evaluated with the same stable representation and subtracted from one. -- Durable and human-facing Validation Evidence must preserve producing-metric invariants at every supported projection boundary, not merely binary64 finiteness. `ValidationReport` enforces nonnegative error/SE fields, point RMSE/SE squared-residual support, probability/accuracy domains, Wilson ordering and containment on explicit validation, JSON/serde ingress and egress, and human-readable summary projection. `MonteCarloSummary` remains generic and sign-neutral; when embedded as `ValidationReport::monte_carlo_rmse`, its mean and percentile endpoints are nonnegative because each RMSE replication is nonnegative, exact-zero mean requires zero spread, SE, and empirical percentile endpoints, and positive mean requires both Monte Carlo mean SE not to exceed the mean and empirical nearest-rank percentile endpoints not to exceed the `n*mean` support of retained nonnegative replications. Direct `MonteCarloSummary` serialization applies count/finiteness/nonnegative-uncertainty/percentile-order, zero-spread support, and canonical SEM-coherence rules. -- Bias, RMSE, and Monte Carlo may share private deterministic scalar support inside `validation_core`, but metric-specific cancellation/normalization, denominator, uncertainty, and fail-closed semantics remain with their bounded modules; support primitives are not second psychometric estimator authorities. -- A mathematically nonzero scientific error metric must not be promoted to exact perfect recovery merely because its final binary64 representation underflows to zero. -- Known-truth recovery denominators are defined by unique scientific component identity. Duplicate rows and stable-Between occasion aliases are not implicit weights unless a separately named weighted contract explicitly owns weighting. -- A mathematically nonzero one-sign temporal-rate mean must not be promoted to exact no-change merely because its final binary64 representation underflows to zero. All-zero inputs and exact mixed-sign cancellation remain exact zero. -- A temporal log-rate over represented endpoint magnitudes must not be materially changed by avoidable ratio-first rounding. Nearby values use exact-difference/`ln_1p` evaluation before event-time division; extreme-scale fallbacks remain fail-closed or log-domain as appropriate. -- A strict-interior exact binary64 covariance must not be promoted to exact `±1` correlation merely because rounded square roots/divisions reach the endpoint. Conversely, an exact represented Cauchy–Schwarz boundary must not be weakened to an interior coefficient by rounded standardization. -- Exact zero covariance has one public no-association encoding. IEEE `-0.0` is not directional scientific evidence and is canonicalized to `+0.0` at the validated Temporal Association projection boundary. -- Exact zero within-person deviation has one public decomposition encoding. IEEE `-0.0` does not denote negative within-person change and is canonicalized only at the validated public residual projection boundary; private numerical intermediates may retain signed zero. -- Binary64 minimum-subnormal means follow IEEE ties-to-even at the public composition boundary. Overflow-safe normalization must not add an avoidable earlier rounding step, and mixed-sign cancellation must apply the original sample-count denominator before rounding a retained-only mean. -- Observed Allen support classes are data, not required design strata. A historical prediction census may truthfully have zero covered, partial-overlap, adjacent, or contradictory rows; absent classes remain explicit zero counts rather than invalidating the run. +- Mean signed bias and bias SE remain Validation Evidence performance measures over admitted recovery units; representable cancellation/SEM must survive avoidable overflow/underflow while mathematically nonzero finals below binary64 range fail closed. +- Generic Validation Evidence RMSE and its delta-method SE normalize before squaring. Exact-zero point RMSE requires exact-zero point RMSE SE. For positive RMSE, the declared producer satisfies `SE(RMSE) <= RMSE / 2`, with a small relative binary64 admission tolerance. +- Generic `MonteCarloSummary` is sign-neutral. Zero SD requires zero SE and percentile endpoints equal to the represented mean. Positive SD requires positive SE coherent with represented `SD / sqrt(n)` within a small relative tolerance. Every inclusive nearest-rank endpoint is a retained observation and therefore satisfies `|endpoint - mean| <= SD * sqrt(n - 1)` using the producer's represented-mean squared-deviation identity. If lower and upper endpoint values are numerically distinct, they denote distinct retained values and their joint squared deviations must fit the same budget: `(lower - mean)² + (upper - mean)² <= (n - 1) * SD²`. The implementation scale-normalizes comparisons and uses `hypot` for the joint norm to avoid validation-only overflow. Equal numeric endpoints are counted once because they may designate the same retained represented value. +- When the generic carrier occupies `ValidationReport::monte_carlo_rmse`, retained replications are nonnegative; positive mean implies `SE(mean) <= mean`, and inclusive nearest-rank endpoints cannot exceed the nonnegative sample-sum support `n * mean`. These typed bounds are not imposed on signed metrics such as bias. +- SE-aware acceptance is `|estimate - target| <= k * SE`. For `k = 0` or exact-zero SE, exact recovery is evaluated before scale reduction; `-0.0` and `+0.0` are one numeric zero-valued scientific state. +- `match_count` is a finite-threshold decision and does not require materializing an unrepresentable absolute residual; `absolute_residuals` remains fail closed when the magnitude itself is requested. +- Wilson interval coverage evidence preserves representable endpoints through stable rationalized/complementary forms rather than cancellation-prone center±margin evaluation. +- Durable and human-facing Validation Evidence must preserve producing-metric invariants on explicit validation, serde ingress/egress, and human projection. Finiteness alone is not evidence validity. +- Bias, RMSE, and Monte Carlo may share private deterministic scalar support inside `validation_core`, but metric-specific cancellation/normalization, denominator, uncertainty, and fail-closed semantics remain with their bounded modules. - Historical-cutoff admission occurs before duplicate-identity checks. Future-unavailable evidence cannot change an earlier run's conflicts, counts, or terminal state. -- Supported temporal estimators require state/trajectory and claimed-structure recovery, bias/RMSE, interval coverage, convergence, uncertainty calibration, and leakage-safe rolling-origin evidence. -- CPU/GPU parity counts only when the relevant accelerator path actually runs. Monte Carlo decisions use simulation uncertainty rather than arbitrary pass percentages. -- Scientific failures are never hidden with skip/xfail/source rewriting/coverage exclusions. +- Supported temporal estimators require state/trajectory and claimed-structure recovery, bias/RMSE, interval coverage, convergence, uncertainty calibration, reproducibility, and leakage-safe rolling-origin evidence. +- CPU/GPU parity counts only when the relevant accelerator path actually runs. Scientific failures are never hidden with skip/xfail/source rewriting/coverage exclusions. ## Current repairs and blockers ### #310 — Longitudinal Modeling -#310 remains the canonical Longitudinal Modeling landing vehicle at `c6680450152b1e0a2c9abb553772d74a23923335`. It retains lagged Pearson association with both marginal variances, stationary/discrete drift-diffusion standardization, CWC, irregular-rate and occasion-mean composition, within/between decomposition, and known-truth component recovery under the owner-correct `longitudinal_core` boundary. +#310 remains the canonical Longitudinal Modeling landing vehicle at `c6680450152b1e0a2c9abb553772d74a23923335`. Current-head Rust/documentation/security/review evidence remains required before Ready/merge; predecessor or child-head evidence does not transfer. -The #486 occasion-mean fold is verified-successor consolidation: valid source/tests/contracts/research/release-note deltas are inherited by #310, including `CHANGELOG.d/longitudinal-occasion-mean-event-time.md`; wrong-owner temporal source, raw-bit signed-zero identity, naive mean summation, and unsupported provenance were intentionally not inherited. No child-head CI/review evidence transfers. +### #488 — Validation Evidence -Longitudinal stable means share one deterministic, overflow-safe authority. RED/repair lineages `23476f45...`→`b14eb6e8...`, `b073f03f...`→`350b8d4e...`, `ae5e61f9...`→`39469067...`, `7dc87aa8...`→`97c8ad35...`, and `96f1c334...`→`ae5081d8...` cover ties-to-even, exact power-of-two normalization, mixed-sign cancellation, decomposition shadow-mean removal, and one-sign false-zero mean refusal. Adjacent-float log-rate RED `766ddc7a...` and repair `16f21d9a...` remove quotient-first rounding through represented difference/`ln_1p` evaluation. +#488 is the generic Validation Evidence landing vehicle at exact head `67b8e92209024ddec19ba04a018ec87fdcb21271`. It remains distinct from Longitudinal Modeling and does not consume mutable fast-mlsirm source. -Known-truth component RMSE has bounded identity and numerical admission: nonzero error cannot underflow to false perfect recovery (`496583c6...`→`a82b383b...`); duplicate identities cannot reweight the denominator (`698f12f5...`→`2fae4cb2...`); truth/recovered rows align by identity rather than position (`8ad72ac9...`→`2dd9537e...`); residual accumulation is canonical-order deterministic (`5fb93c40...`→`025dce7f...`, edge `976ce7d7...`); and stable `Between` is unit-level with canonical occasion `0` (`0a03041c...`, fixture `53563e97...`, repair `ec2c1219...`, trace `c9cb68d3...`). +The preceding RMSE, bias, Wilson, Monte Carlo SE, durable-artifact, typed-RMSE, and matching lineages remain in branch ancestry and in GAP-045–GAP-066. Concurrent branch review then added a generic empirical-percentile moment-support repair without treating the concurrent push as a race. Public RED `40acb4f6f51dd9d7074c652fb6448eaa942b95ac` showed that a nearest-rank percentile could be incompatible with the recorded represented mean/sample spread. An initial repair `2798e4f92dbb30019e2b1288e59d09564ae73a70` assumed exact zero-sum deviations and was rejected during immediate review. Causal correction `c7151b498ccbd562e7945a12a53c55472d93acac` uses the actual represented-mean identity `|x - m| <= SD * sqrt(n - 1)`; edge `dbef285b6348cf691bbb72c25350912a5463e11e` preserves adjacent-binary64 samples; changelog correction `c38a320c730875919a8bff58de42e2db859c248d`; research correction `2bbcbb243a755a5a39b13fbf8407b6854194efc0`. -Lagged-correlation endpoint contracts reject strict-interior covariance that rounds to false `±1` (`683b28ee...`→`9eeb373d...`), return exact `±1` for exact represented Cauchy–Schwarz boundaries (`c2500090...`→`d06259ec...`), and canonicalize validated exact-zero no-association to public `+0.0` (`e15d0531...`→`fc61f7bd...`). Exact-zero within residuals likewise canonicalize only at the public decomposition projection (`aeb008a3...`→`a9a70baa...`). - -Current #310 exact-head workflows and a qualifying independent current-head approval remain required before Ready/merge. Queued, pending, startup-failed, skipped, or predecessor-head evidence is not GREEN. - -### #488 — Validation Evidence recovery arithmetic - -#488 is the generic Validation Evidence landing vehicle at exact head `f10da1b20d02d6961742b4fafa7609612fdacc8c`. It remains distinct from Longitudinal Modeling and does not consume mutable fast-mlsirm source. - -Mean signed bias no longer depends on a raw finite sum that can overflow before division (`c5ec42e4...`→`7499042f...`). Full-range mixed-sign cancellation preserves representable low-order bias before scale reduction (`b6084750...`→`227921d9...`, hardening `77dcf38c...`). Bias SEM scales deviations before squaring and forms the final SEM without avoidable variance overflow (`7de0ef90...`→`cad23162...`, edges `8a6cc346...`/`28d96c23...`). - -Generic RMSE/RMSE-SE normalize residual magnitudes before squaring so representable extremes/subnormals survive while false-perfect final underflow fails closed (`dd41ff53...`, `f4e19991...`→`6b182107...`). Monte Carlo summaries replace Welford raw deviation products with deterministic represented mean plus scaled deviation squares, preserving representable sample SD/SE and refusing nonzero uncertainty that projects to exact zero (`41faba0d...`→`91b4a93d...`). - -The declared acceptance gate is `|estimate - target| <= k * SE`. For `k = 0`, the tolerance is exactly zero. With `estimate = f64::from_bits(1)`, `target = 0`, `SE = f64::MAX`, predecessor scale reduction erased a nonzero minimum-subnormal residual and falsely accepted exact recovery. Public RED `bd8a7c8a6d93ec262f5634cec199265521308dfd`; causal repair `00ef2d90580e01494370e48ef68afbe4d0819ba8` routes the zero multiplier through exact comparison before scale reduction. - -Fresh review then found the exact branch itself used `f64::total_cmp`, which distinguishes `-0.0` and `+0.0` even though the scientific rule treats both as exact zero residual. Public RED `379e65258c5675ae9fee6d84d369803f1e8a1ae3` covers both the `k = 0` and `SE = 0` exact-recovery paths. Causal repair `55876e60b5ae553bcc4c1c41a793861b3d7e9cc8` uses finite numeric equality in that branch only. Research trace `c45a76cfe78f3b6eb6b9854648c769d86d371c0f`. - -All-covered Wilson coverage exposed another representability defect. With one covered replication and finite `z = 1e154`, `z² = 1e308` remains finite and the all-covered lower score endpoint `n / (n + z²)` is about `1e-308`, still representable. The predecessor generic center-minus-margin form cancelled to exact zero. Public RED `f84e5918acc81ca8bf3708f3cce2004c67675b78`; causal repair `fe9b9c8a5b94a01cd8416efd613503569b98ac1a`. - -Strict-interior Wilson coverage retained the same exact-zero lower-endpoint failure. With `n = 2`, one covered replication (`p̂ = 0.5`), and finite `z = 1e154`, the generic center and margin both round to `2.5e307`, collapsing the lower endpoint to exact zero even though the rationalized Wilson root is about `5e-309` and representable. Public RED `9d45f482854037d96d5dff38964fd3844335a39b`; initial rationalized repair `4f259f6e5c98ade2e4a34125430de872f32c1589`. - -The exact-zero fallback was still insufficient because catastrophic cancellation can leave a nonzero floating-point residue. With `n = 3`, one covered replication (`p̂ = 1/3`), and `z = 1e11`, binary64 `center - margin` leaves `262144`, producing a lower endpoint near `7.86432e-17`; the algebraically equivalent rationalized endpoint is near `3.3333333333333333e-23`, exactly 2,359,296 times smaller. Public RED `1a24fac71569334b0c0185d013574ec5ccdcc58d`; causal repair `f7e20ddc59399f2e014a3ac91809bb57ba73460f` makes the rationalized positive lower root authoritative for every nonzero strict-interior lower endpoint. It uses natural scale when `z² < 1` and `z²`-normalized scale otherwise. Small-`z` edge/oracle reinforcement `39e5e087cba22d6df85b9ad5901cda0194e3da93`. - -The complementary upper endpoint had the dual false-one failure. With two uncovered replications and `z = 2^27`, the represented all-uncovered upper endpoint correctly rounds to `next_down(1.0)`, but the predecessor `center + margin` numerator and denominator rounded equal and returned exact `1.0`. Public RED `c070da269aa257fc9c9fa9eae17231a51ec63b74`; strict-interior expansion `344081bfd98ee9bc70a3bf8fdebc795a9090e692` reproduces the same false-one boundary with one covered replication out of eight and `z = 2^28`. Causal repair `9a2fdd05c2994f51f6c72030fe39e695ba5a876d` evaluates the rationalized positive lower root for the complementary uncovered proportion only when the direct upper path has reached exact one while uncovered mass remains. - -Durable/human-facing artifact admission exposed a separate Validation Evidence defect: finite scalar representation was treated as sufficient report validity. Public RED `e9414e6f7b824c2dc508f335d355b97b7e399b9` rejects negative RMSE/SE, out-of-domain probabilities, inverted Wilson bounds, and coverage outside its paired Wilson interval; repair `28924b0d82bc2d4663f5ba1317cc0c3d94a4833b` enforces those invariants. Serde ingress RED/repair `6d190cd783a00f8ce917e37b63ae87053a929ae1`/`f70a6fc0e58c2ae419c3b3bac322db5f35efe538` close deserialization bypass, while direct-report egress RED/repair `fb28f959297a50cf50e26ea14dc9bfb5ee10ea89`/`f7e58ccdb1864ce775ef6797f7fd88596dff1269` close alternate serialization. Standalone `MonteCarloSummary` retained the same egress bypass despite an existing validator; RED `b5a8ae1fbd1344b09a9fbb3c65a3c6d0cdc38c28`, repair `18374c35061fb0b98bfe09079d4967baef7697b4`. Human summary projection was a final bypass: RED `541273f10d2085680073fb8ca9dc72d3cbe1e62b` and repair `53607f8033ee03b409c8fce4ee464797e8cb7be1` make it return `Result` and validate first. - -The nested RMSE summary then exposed a narrower semantic admission bug. `MonteCarloSummary` must remain sign-neutral because it can summarize signed bias, but `ValidationReport::monte_carlo_rmse` gives the same structure RMSE-specific semantics. A negative mean or percentile endpoint is therefore impossible RMSE evidence even when the generic summary is structurally valid. Public RED `3cd6e41ddeffbb41e0a6179a65bc3dd9b60f41d8`; causal report-boundary repair `0090259d01ee00ad0de35ba0c4c9cb7a37c0b13c`; changelog `d2631d1b0047ba8dbf78058272ea6c00d9b0c9a3`; research predecessor `0ba16c080b4bea12873aacb252c49497d34a2162`. - -Generic-carrier review first found that externally constructed/deserialized `MonteCarloSummary` values could encode impossible coarse relationships: `n = 4, SD = 0.5, SE = 0.5`, positive SD with exact-zero SE, or a singleton with nonzero spread. Isolating RED `e2d0c057d39b7786dbd96528d4e259775c6c2e01`; initial repair `0e973b566ec969d0fea8b7403bf09602cdebd4a3`; edge contract `858368c8fda0d7a33f95b821eba2c5b80dc65cfd`. - -A second review then showed that the inequality-only repair still admitted materially understated positive uncertainty. With `n = 4` and `SD = 0.5`, the summary contract implies `SE = 0.25`, but `SE = 0.2` was still accepted. Canonical-coherence RED `0a4c242fbd1c5b2f35e71a1ca1665ca9f7861338`; causal repair `9b53076a53032441623ff487a006ec6d20812030` validates the represented `SD / sqrt(n)` relationship and also closes zero-spread/positive-SE admission; cross-language tolerance regression `141246cfef7c44b327f7bfbeb22bc51279c6b9f0` admits the adjacent binary64 SE rather than requiring bit-pattern equality. Changelog `24a48acc5502bf1b773067c772ea7ca7e5722a2d`; research predecessor `f674183b55e1855cef45561be6d38d9935c62b50`. - -Typed RMSE admission still had one necessary invariant missing after nonnegative-domain enforcement. Because every retained RMSE replication is nonnegative, an exact-zero Monte Carlo RMSE mean implies every retained RMSE is exactly zero. Predecessor `ValidationReport` nevertheless admitted a zero mean with positive SD/SE or positive empirical percentile support. Public RED `a17dfe1bd9d845356b757ec98e930b5d927eab8f`; causal report-boundary repair `d17d803415333f79bf6291efed9206a630979adf`; release note `42be85748c4e4136c54fd1f918dfa89533376451`; signed-zero/perfect-recovery edge contract `944fa96e89e31123e97f95f6909835026c0bd6fa`. - -Concurrent branch work then closed two additional Validation Evidence holes without crossing owner boundaries. A generic Monte Carlo summary with exact-zero sample SD previously could retain percentile endpoints away from its represented mean; RED `ce21941a64c9e54c1ff7dd5914581966708215b8` and repair `d0f5c14559831bc9032c6489a8013ac23686f894` bind zero spread to zero SE and degenerate empirical support. Separately, `match_count` previously depended on materializing an absolute residual even though threshold classification remains decidable when subtraction of finite opposite-sign extremes overflows: RED `d023ecdb9d32e1474c08af16eb7df25c3dc84fc1`, causal decision/projection separation `5040ff96ce2845b2f633781667be8c71039aae7a`, documentation trace `9067d3ca61532b03706f725e8accca8e8d4ac083`. - -Point-report review first closed exact-perfect coherence: `ValidationReport` independently admitted finite nonnegative `rmse` and `rmse_standard_error`, so exact-zero RMSE could be paired with a positive point RMSE SE even though the canonical squared-residual producer returns exact zero SE for exact recovery. Public RED `f7b018c5f10d11c7cc21a3430242e37c2d7a1056`; causal admission repair `4c5999186141dafd8d6293d5da66ab8e19693f5c`; changelog `6ae5b254669868162428fc5c85538e9f5052ac6c`. - -The same producer yields a broader support bound. For `x_i = r_i^2 >= 0` with mean `m = RMSE^2`, `sum(x_i^2) <= (sum x_i)^2` implies sample `sd(x) <= sqrt(n) * m`; therefore the declared delta-method `SE(RMSE) = sd(x) / (2 * RMSE * sqrt(n))` satisfies `SE(RMSE) <= RMSE / 2`. Residual magnitudes `[0,1]` attain the boundary. Public RED `a2aca5b077665433aad0e5531d53360b599b64b3` proves the predecessor admitted `(rmse=0.2, rmse_standard_error=0.11)`; causal report-boundary repair `32f094029732e2333b35ad3a11521c4c3d956798` enforces the ratio with `64*EPSILON` tolerance; release trace `7b61c107d1bc6391651ce2341e6ad27c2cada17a`; research predecessor `f68c2dea13dddc998c000a20737677555b52cb7e`. Positive RMSE with zero SE remains admissible when squared residuals are exactly constant. - -Positive Monte Carlo RMSE summaries have a related but distinct support invariant. If the retained replication values are `x_i >= 0` with sample mean `m`, then `SD <= sqrt(n) * m`, so the stored Monte Carlo `SE(mean)=SD/sqrt(n)` cannot exceed `m`. The boundary is attainable at `[0,0,0,4]`, which gives `(n=4, mean=1, SD=2, SE=1)`. A generic-valid `(n=4, mean=1, SD=3, SE=1.5)` summary therefore cannot represent RMSE replications. Stale zero-mean fixture repair `e201a2f46953152255345a7b3abc35f05ea9e33c`; public RED `43a7dec1dbc848435ca099aea80db46c8cbd97e5`; causal typed-admission repair `2f78954eb21a08c316d0d6b70f659685fb283a0b`; changelog `4ce54959a5c70ccae8212a6494d346ceef0ff35f`; research predecessor `9f9ffc3ff1d730228719fea977613153136fd720`. - -The same nonnegative support constrains empirical percentiles. For `n` retained RMSE replications with mean `m`, no retained value can exceed the total sample support `n*m`. Since `summarize_replications` stores inclusive nearest-rank endpoints selected directly from the retained sorted values, an upper empirical percentile above `n*m` is impossible even when the generic carrier's mean/SD/SE relationship is coherent. Public RED `84a200ee451247c8f75fcce322aa7fc558f38c43` uses a generic-valid `(n=4, mean=1, SD=0.5, SE=0.25, upper=5)` payload; causal typed-admission repair `04c9cdd4b89d37145853316bb419943735830c79` checks `percentile_upper / mean <= n` with `64*EPSILON` tolerance, avoiding an overflow-prone `n*mean` intermediate and preserving the attainable `[0,0,0,4]` boundary; changelog `00b9278a2c1bc1b912ed7c945391afe71f56bf55`; research/current #488 `f10da1b20d02d6961742b4fafa7609612fdacc8c`. +Fresh review found that separate endpoint-radius checks were still not sufficient. For `n=4`, `mean=1`, `SD=0.5`, `SE=0.25`, endpoints `(0.25, 1.75)` each satisfy the individual radius because each deviation is `0.75 < 0.5*sqrt(3)`, but as distinct retained observations they jointly require `0.75² + 0.75² = 1.125` of squared-deviation budget while the entire sample has only `(n-1)SD² = 0.75`. Public RED `c4a13826144708582a73ec4458967bb103287338`; causal scale-normalized `hypot` repair `cb3f80a2ff3439d238d1bd6e674ef789d25f36c7`; changelog `f727450d7a68d253254d3f0a8ae8d305a08137eb`; research/current exact head `67b8e92209024ddec19ba04a018ec87fdcb21271`. Equal numeric endpoints remain admissible without double-counting one represented value. Morris, White, and Crowther (2019) remain the simulation performance-measure/Monte Carlo uncertainty methodology trace; Wilson (1927) remains the primary score-interval reference. AERA/APA/NCME (2014) remains the current published testing-standards edition while revision is underway. Exact-head hosted Rust/documentation/security/supply-chain/100%-coverage gates and a qualifying independent current-head review remain required. ### #416 — Validation / Analysis Run consolidation -#416 exact head is `aa730c63563eb4a33048d822b581036c8487bd47`. Generic cutoff-before-identity repair `0b7155cc...` remains in ancestry; current follow-ups canonicalize episode/cutoff fixtures and harden bounded artifact/profile tests. #458/#460/#482/#483/#484/#485/#487 remain fold children over shared surfaces until every unique source/test/fixture/contract/doctoring delta is inherited by a conflict-resolving survivor. Child-head CI never transfers to #416. - -#487's RED `a2892b6...`, repair `a6402015...`, predecessor-test correction `6b0c8de6...`, and `Proposed` ADR repair `e07b2ff9...` establish that observed Allen relation classes are data, not mandatory production design strata. +#416 exact head is `aa730c63563eb4a33048d822b581036c8487bd47`. #458/#460/#482/#483/#484/#485/#487 remain fold children until every unique source/test/fixture/contract/doctoring delta is inherited by a conflict-resolving survivor. Child-head CI never transfers to #416. ### #480 — contextual-orchestrator boundary -#480 removes TEPP-owned provider discovery/ranking and requires a released contextual-orchestrator owner contract. Branch-local guidance uses `orchestrator/free` for model-backed Actions and refuses direct provider selection. The consumer remains Draft until an immutable compatible release plus deployment/auth/schema/artifact provenance exists. Mutable owner main is evidence, not a production contract. - -### Owner handoffs - -fast-mlsirm protected main and latest immutable release must be revalidated before any dependency bump. Open owner heads newer than the latest release are candidate evidence, not TEPP dependency authority. - -Context Graph Contracts and Enterprise Architecture Core remain read-only owner dependencies until their relevant contracts are immutable releases. No sibling mutable head is promoted to TEPP production authority. - -### #437 — ADR identity - -Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/numbered files, index/file mismatch, and repeated Decision-status or Implementation-maturity authority must fail deterministic documentation fitness. Branch-local micro-slice records do not mint independent architecture authority. +#480 removes TEPP-owned provider discovery/ranking and requires a released contextual-orchestrator owner contract. The consumer remains Draft until an immutable compatible release plus deployment/auth/schema/artifact provenance exists. Mutable owner main is evidence, not a production contract. ## Gap register @@ -190,55 +125,57 @@ Repository-wide ADR IDs are immutable authority. Duplicate index IDs/targets/num | GAP-015 | contextual-orchestrator lacks immutable released contract for current owner behavior | `release-blocking` | compatible immutable CO release, deployment provenance, safe gateway auth, exact TEPP ACL adoption | | GAP-016 | hourly LLM path needs released owner-only routing/authentication | `active-repair` | #480 Draft + released CO adoption + exact-head GREEN/review/main merge | | GAP-017 | dynamic evaluation item/rater/anchor drift monitoring | `owner-contract-active` | released/digest-pinned dynamic criterion/item/run contract, ACL conformance, no-anchor/no-linking refusal, evidence-gated temporal monitoring | -| GAP-018 | Longitudinal stable-mean logic had a separate decomposition implementation after CWC/occasion consolidation | `verification-pending` | RED `7dc87aa8...` + repair `97c8ad35...` + trace `a1aef11e...`; scan remaining Longitudinal means, exact-head GREEN/review/main integration | +| GAP-018 | Longitudinal stable-mean logic had a separate decomposition implementation after CWC/occasion consolidation | `verification-pending` | RED `7dc87aa8...` + repair `97c8ad35...`; exact-head GREEN/review/main integration | | GAP-019 | Longitudinal scientific instructions contradicted stationary-overflow implementation | `verification-pending` | RED `9d8a82d...` + repair `9c962205...`; exact-head documentation/review GREEN and protected-main integration | -| GAP-020 | Nonzero lagged covariance can be misreported as exact-zero correlation when standardized magnitude is unrepresentable | `verification-pending` | RED `c345ee7b...` + repair `5785e07a...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-021 | Longitudinal irregular-rate facade duplicated public wrapper identities over one canonical implementation | `verification-pending` | RED `464863860...` + repair `7f0bea084...`; exact-head Rust/documentation/review GREEN and protected-main integration | -| GAP-022 | Architecture assigned Longitudinal Modeling semantics to `psychometric_core` and duplicated implementation responsibility rows | `verification-pending` | RED `fe5eb745...` + repair `7fadc757...`; exact-head documentation/review GREEN and protected-main integration | -| GAP-023 | `discreteDIFFUSIONstd` rejected a representable subnormal final ratio because `aΔt` underflowed before the required factor two | `verification-pending` | RED `d5107b198...` + repair `7164c7ce4...`; exact-head GREEN and protected-main integration | -| GAP-024 | Contributor guidance re-authorized a direct provider credential after LLM ownership moved to contextual-orchestrator | `verification-pending` | RED `4248b335...` + repair `01f45a993...`; released CO adoption and exact-head GREEN/review/main merge | -| GAP-025 | A singleton unit could satisfy the nominal CWC unit floor while all lag evidence came from one repeated unit | `verification-pending` | RED `671709bbc...` + repair `4784b370c...`; exact-head GREEN and protected-main integration | -| GAP-026 | Scalar standardized longitudinal maps rejected representable finals when a cancelled stationary-variance intermediate lay outside binary64 range | `verification-pending` | RED `4a1f6c49...` / `96d8ed13...` + repairs `a4bc6230...` / `33f4b187...` / `26b03c32...`; exact-head GREEN and protected-main integration | -| GAP-027 | Finite-interval `discreteDIFFUSIONstd` could report exact unit diffusion after exponent saturation erased a nonzero remainder | `verification-pending` | RED `a8de3c9f...` + repair `c17e2ff8...`; exact-head GREEN and protected-main integration | -| GAP-028 | Actual stationary variance `p` could be misreported as exact zero when positive real `p` lies below binary64 range | `verification-pending` | RED `27d9fa39...` + repair `a0132b62...`; exact-head GREEN and protected-main integration | -| GAP-029 | Occasion-mean temporal composition arrived in the wrong bounded context with raw-bit event identity, naive mean summation, and order-dependent averaging | `verification-pending` | verified-successor #486 closure into owner-correct #310 lineage + release fragment `db335d90...`; exact-head GREEN/review/main integration | -| GAP-030 | Prediction-contradiction Analysis Run treated four observed relation classes as mandatory design strata and documented that branch-local rule as accepted architecture | `active-fold` | RED `a2892b6...` + repair `a6402015...` + predecessor-test correction `6b0c8de6...` + Proposed-ADR repair `e07b2ff9...`; fold unique evidence into #416; exact-survivor GREEN/review/main integration | -| GAP-031 | Occasion-mean same-sign averaging double-rounded a representable minimum-subnormal ties-to-even mean | `verification-pending` | RED `9aff817f...` + repair `40e057b8...` + trace `a2e6ace7...`; exact-head GREEN and protected-main integration | -| GAP-032 | CWC/irregular-residual same-sign averaging retained the same minimum-subnormal double-rounding defect | `verification-pending` | RED `23476f45...` + repair `b14eb6e8...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-033 | Arbitrary max-magnitude normalization introduced a second rounding and misrounded a 7.5-ULP subnormal mean to 7 ULPs | `verification-pending` | RED `b073f03f...` + exact-power-of-two repair `350b8d4e...` + Longitudinal mean-authority consolidation `dd53eff6...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-034 | Mixed-sign cancellation rounded a retained-only mean before restoring the original denominator, moving a representable subnormal mean by one ULP | `verification-pending` | RED `ae5e61f9...` + repair `39469067...` + occasion contract `201f3900...` + trace `34fd059a...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-035 | Within/between decomposition shadow running mean misrounded the representable `[1 ULP, 2 ULP]` unit mean and shifted residuals by one ULP | `verification-pending` | RED `7dc87aa8...` + repair `97c8ad35...` + trace `a1aef11e...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-036 | Known-truth component RMSE could underflow a mathematically nonzero recovery error to exact zero and falsely report perfect recovery | `verification-pending` | RED `496583c6...` + repair `a82b383b...` + trace `bfaa69c4...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-037 | Strict-interior lagged covariance could round to false exact `±1` correlation after exact covariance-bound admission | `verification-pending` | RED `683b28ee...` + repair `9eeb373d...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-038 | Exact Cauchy–Schwarz boundary covariance could round one ULP below `±1` and weaken a perfect represented association | `verification-pending` | RED `c2500090...` + repair `d06259ec...` + trace `be5123d5...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-039 | Exact zero lagged covariance could leak IEEE `-0.0` through the public Temporal Association projection and create a bit-distinct directional-looking no-association value | `verification-pending` | RED `e15d0531...` + repair `fc61f7bd...` + trace `b56e1d16...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-040 | Exact zero within-person deviation could leak IEEE `-0.0` through public within/between decomposition and create two bit-distinct identities for one no-deviation estimand | `verification-pending` | RED `aeb008a3...` + repair `a9a70baa...` + trace `ecb90914...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-041 | Individually representable irregular residual log-rates could have a mathematically nonzero one-sign mean that underflowed to exact zero and falsely reported no temporal change | `verification-pending` | RED `96f1c334...` + repair `ae5081d8...` + trace `0280aba0...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-042 | Ratio-first logarithm could nearly double an adjacent-float power-of-two irregular residual growth rate before event-time scaling | `verification-pending` | public RED `766ddc7a...` + causal `ln_1p` repair `16f21d9a...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-043 | Duplicate known-truth component identities could silently reweight RMSE recovery evidence by changing the denominator without adding a new scientific target | `verification-pending` | public RED `698f12f5...` + uniqueness repair `2fae4cb2...` + current trace `c9cb68d3...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-044 | Known-truth component RMSE alignment and deterministic binary64 accumulation depended on serialization row order rather than scientific component identity | `verification-pending` | cross-slice RED `8ad72ac9...` + alignment repair `2dd9537e...` + rounding RED `5fb93c40...` + canonical-order repair `025dce7f...` + edge `976ce7d7...` + current #310 `c6680450...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | public RED `c5ec42e4...` + scaled repair `7499042f...` + current #488 `f10da1b...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-046 | Bias standard error could reject a representable SEM because raw squared deviations, their sum, or an intermediate sample variance overflowed | `verification-pending` | public RED `7de0ef90...` + scaled direct-SEM repair `cad23162...` + edges `8a6cc346...` / `28d96c23...` + current #488 `f10da1b...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-047 | Generic Validation Evidence RMSE/RMSE-SE could reject representable extreme recovery or collapse a representable/nonzero subnormal error to false perfect recovery because residuals were squared before scale normalization | `verification-pending` | extreme RED `dd41ff53...` + subnormal RED `f4e19991...` + repair `6b182107...` + current #488 `f10da1b...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-048 | Validation Evidence mean signed bias could erase a representable subnormal residual contribution by normalizing to an unrelated extreme magnitude before mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...` + hardening `77dcf38c...` + current #488 `f10da1b...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-049 | Stable `Between` recovery could be aliased across occasion indices, duplicating one unit-level scientific target and silently changing the RMSE denominator | `verification-pending` | RED `0a03041c...` + fixture repair `53563e97...` + admission repair `ec2c1219...` + trace `c9cb68d3...` + current #310 `c6680450...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-050 | Zero-multiplier SE-aware acceptance could scale a nonzero residual to exact zero and falsely accept exact recovery when a large finite SE dominated normalization | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...` + current research `c45a76cf...` + current #488 `f10da1b...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-051 | Exact-recovery SE acceptance used IEEE total ordering and therefore treated `-0.0` and `+0.0` as different scientific recovery values | `verification-pending` | signed-zero RED `379e6525...` + numeric-equality repair `55876e60...` + research `c45a76cf...` + current #488 `f10da1b...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-052 | All-covered Wilson score coverage could cancel a positive binary64-representable lower endpoint to exact zero by subtracting nearly equal center and margin terms | `verification-pending` | public RED `f84e5918...` + exact all-covered endpoint repair `fe9b9c8a...` + current #488 `f10da1b...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-053 | Strict-interior Wilson score coverage could cancel a positive binary64-representable lower endpoint to exact zero even after the all-covered endpoint specialization | `verification-pending` | public RED `9d45f482...` + initial rationalized lower-root repair `4f259f6e...` + current #488 `f10da1b...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-054 | Wilson score coverage could falsely promote an all-uncovered or strict-interior upper endpoint to exact `1.0` when `center + margin` and the denominator rounded to the same binary64 value | `verification-pending` | all-uncovered RED `c070da26...` + strict-interior RED expansion `344081bf...` + complementary rationalized repair `9a2fdd05...` + current #488 `f10da1b...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-055 | Strict-interior Wilson score coverage could accept a nonzero `center - margin` cancellation residue as the scientific lower endpoint, overstating a representable endpoint by orders of magnitude even though the subtraction did not collapse to zero | `verification-pending` | public RED `1a24fac7...` + scale-aware rationalized-lower repair `f7e20ddc...` + small-`z` reinforcement `39e5e087...` + current #488 `f10da1b...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-056 | Durable or human-facing Validation Evidence could accept impossible finite report fields/cross-field relationships or bypass validation through serde/human projections, including standalone Monte Carlo summary egress | `verification-pending` | report domain RED/repair `e9414e6f...`/`28924b0d...` + ingress RED/repair `6d190cd7...`/`f70a6fc0...` + report direct-egress RED/repair `fb28f959...`/`f7e58ccd...` + Monte Carlo direct-egress RED/repair `b5a8ae1f...`/`18374c35...` + human projection RED/repair `541273f1...`/`53607f80...` + current #488 `f10da1b...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-057 | `ValidationReport::monte_carlo_rmse` could admit a structurally valid generic Monte Carlo summary whose negative mean or percentile values are impossible for RMSE, allowing signed-metric semantics to leak into RMSE-specific Validation Evidence | `verification-pending` | public RED `3cd6e41d...` + report-boundary repair `0090259d...` + changelog `d2631d1b...` + current #488 `f10da1b...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-058 | Durable generic Monte Carlo summaries could admit finite but impossible coarse uncertainty relationships because SD, SE, and replication count were validated independently | `verification-pending` | isolating RED `e2d0c057...` + inequality repair `0e973b56...` + edge contract `858368c8...` + current #488 `f10da1b...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-059 | Durable generic Monte Carlo summaries could still materially understate or overstate positive Monte Carlo uncertainty after coarse inequality checks because `SE` was not required to agree with the represented `SD / sqrt(n)` relationship | `verification-pending` | canonical-coherence RED `0a4c242f...` + causal repair `9b53076a...` + adjacent-binary64 tolerance regression `141246cf...` + changelog `24a48acc...` + current #488 `f10da1b...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-060 | `ValidationReport::monte_carlo_rmse` could admit exact-zero mean together with positive spread, SE, or percentile support, contradicting perfect recovery for a nonnegative replication metric | `verification-pending` | public RED `a17dfe1b...` + report-boundary repair `d17d8034...` + release note `42be8574...` + signed-zero/perfect-recovery edge `944fa96e...` + current #488 `f10da1b...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-061 | Durable generic Monte Carlo summaries could claim exact-zero sample spread while retaining empirical percentile support away from the represented mean | `verification-pending` | public RED `ce21941a...` + support-coherence repair `d0f5c145...` + documentation/change trace `9067d3ca...` + current #488 `f10da1b...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-062 | Finite-tolerance match classification could fail because it attempted to materialize an unrepresentable absolute residual even though the pair is deterministically outside every finite tolerance | `verification-pending` | decision/projection RED `d023ecdb...` + causal separation `5040ff96...` + documentation/change trace `9067d3ca...` + current #488 `f10da1b...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-063 | `ValidationReport` could admit exact-zero point RMSE together with positive RMSE standard error, contradicting the canonical squared-residual estimator's exact-perfect-recovery state | `verification-pending` | public RED `f7b018c5...` + report-boundary repair `4c599918...` + changelog `6ae5b254...` + research/current #488 `f10da1b...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-064 | `ValidationReport` could admit positive point RMSE with RMSE standard error above the maximum support of the declared squared-residual delta-method producer | `verification-pending` | public RED `a2aca5b0...` + support-bound repair `32f09402...` + changelog `7b61c107...` + research/current #488 `f10da1b...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-065 | `ValidationReport::monte_carlo_rmse` could admit a positive mean with Monte Carlo spread/SE impossible for any sample of nonnegative RMSE replications | `verification-pending` | stale-fixture repair `e201a2f4...` + public RED `43a7dec1...` + typed support-bound repair `2f78954e...` + changelog `4ce54959...` + research/current #488 `f10da1b...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | -| GAP-066 | `ValidationReport::monte_carlo_rmse` could admit an inclusive nearest-rank empirical percentile endpoint above the total `n*mean` support available to `n` nonnegative RMSE replications | `verification-pending` | public RED `84a200ee...` + typed percentile-support repair `04c9cdd4...` + changelog `00b9278a...` + research/current #488 `f10da1b...`; exact-head Rust/documentation/security/review GREEN and protected-main integration | +| GAP-020 | Nonzero lagged covariance can be misreported as exact-zero correlation when standardized magnitude is unrepresentable | `verification-pending` | RED `c345ee7b...` + repair `5785e07a...`; exact-head integration | +| GAP-021 | Longitudinal irregular-rate facade duplicated public wrapper identities over one canonical implementation | `verification-pending` | RED `464863860...` + repair `7f0bea084...`; exact-head integration | +| GAP-022 | Architecture assigned Longitudinal Modeling semantics to `psychometric_core` and duplicated implementation responsibility rows | `verification-pending` | RED `fe5eb745...` + repair `7fadc757...`; exact-head integration | +| GAP-023 | `discreteDIFFUSIONstd` rejected a representable subnormal final ratio because `aΔt` underflowed before factor two | `verification-pending` | RED `d5107b198...` + repair `7164c7ce4...`; exact-head integration | +| GAP-024 | Contributor guidance re-authorized a direct provider credential after LLM ownership moved to contextual-orchestrator | `verification-pending` | RED `4248b335...` + repair `01f45a993...`; released CO adoption + exact-head integration | +| GAP-025 | A singleton unit could satisfy the nominal CWC unit floor while all lag evidence came from one repeated unit | `verification-pending` | RED `671709bbc...` + repair `4784b370c...`; exact-head integration | +| GAP-026 | Scalar standardized longitudinal maps rejected representable finals when a cancelled stationary-variance intermediate lay outside binary64 range | `verification-pending` | RED `4a1f6c49...` / `96d8ed13...` + repairs `a4bc6230...` / `33f4b187...` / `26b03c32...` | +| GAP-027 | Finite-interval `discreteDIFFUSIONstd` could report exact unit diffusion after exponent saturation erased a nonzero remainder | `verification-pending` | RED `a8de3c9f...` + repair `c17e2ff8...` | +| GAP-028 | Actual stationary variance `p` could be misreported as exact zero when positive real `p` lies below binary64 range | `verification-pending` | RED `27d9fa39...` + repair `a0132b62...` | +| GAP-029 | Occasion-mean temporal composition arrived in the wrong bounded context with raw-bit event identity, naive mean summation, and order-dependent averaging | `verification-pending` | verified-successor #486 closure into #310 + release fragment `db335d90...` | +| GAP-030 | Prediction-contradiction Analysis Run treated four observed relation classes as mandatory design strata | `active-fold` | RED `a2892b6...` + repair `a6402015...` + Proposed ADR repair `e07b2ff9...`; fold into #416 | +| GAP-031 | Occasion-mean same-sign averaging double-rounded a representable minimum-subnormal ties-to-even mean | `verification-pending` | RED `9aff817f...` + repair `40e057b8...` | +| GAP-032 | CWC/irregular-residual same-sign averaging retained the same minimum-subnormal double-rounding defect | `verification-pending` | RED `23476f45...` + repair `b14eb6e8...` | +| GAP-033 | Arbitrary max-magnitude normalization introduced a second rounding and misrounded a 7.5-ULP subnormal mean | `verification-pending` | RED `b073f03f...` + repair `350b8d4e...` + consolidation `dd53eff6...` | +| GAP-034 | Mixed-sign cancellation rounded a retained-only mean before restoring the original denominator | `verification-pending` | RED `ae5e61f9...` + repair `39469067...` | +| GAP-035 | Within/between decomposition shadow running mean misrounded `[1 ULP, 2 ULP]` | `verification-pending` | RED `7dc87aa8...` + repair `97c8ad35...` | +| GAP-036 | Known-truth component RMSE could underflow a nonzero recovery error to exact zero | `verification-pending` | RED `496583c6...` + repair `a82b383b...` | +| GAP-037 | Strict-interior lagged covariance could round to false exact `±1` correlation | `verification-pending` | RED `683b28ee...` + repair `9eeb373d...` | +| GAP-038 | Exact Cauchy–Schwarz boundary covariance could round one ULP below `±1` | `verification-pending` | RED `c2500090...` + repair `d06259ec...` | +| GAP-039 | Exact zero lagged covariance could leak IEEE `-0.0` through public projection | `verification-pending` | RED `e15d0531...` + repair `fc61f7bd...` | +| GAP-040 | Exact zero within-person deviation could leak IEEE `-0.0` through public decomposition | `verification-pending` | RED `aeb008a3...` + repair `a9a70baa...` | +| GAP-041 | One-sign irregular residual log-rate mean could underflow to exact zero | `verification-pending` | RED `96f1c334...` + repair `ae5081d8...` | +| GAP-042 | Ratio-first logarithm could nearly double an adjacent-float irregular residual growth rate | `verification-pending` | RED `766ddc7a...` + `ln_1p` repair `16f21d9a...` | +| GAP-043 | Duplicate known-truth component identities could silently reweight RMSE recovery evidence | `verification-pending` | RED `698f12f5...` + uniqueness repair `2fae4cb2...` | +| GAP-044 | Known-truth RMSE alignment/accumulation depended on row order instead of component identity | `verification-pending` | RED `8ad72ac9...` / `5fb93c40...` + repairs `2dd9537e...` / `025dce7f...`; #310 `c6680450...` | +| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; #488 `67b8e922...` | +| GAP-046 | Bias SE could reject a representable SEM because raw squared deviations/intermediates overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; #488 `67b8e922...` | +| GAP-047 | Generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; #488 `67b8e922...` | +| GAP-048 | Mean signed bias could erase a representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; #488 `67b8e922...` | +| GAP-049 | Stable `Between` recovery could be aliased across occasion indices and reweight RMSE | `verification-pending` | RED `0a03041c...` + repair `ec2c1219...`; #310 `c6680450...` | +| GAP-050 | Zero-multiplier SE-aware acceptance could erase a nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; #488 `67b8e922...` | +| GAP-051 | Exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; #488 `67b8e922...` | +| GAP-052 | All-covered Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; #488 `67b8e922...` | +| GAP-053 | Strict-interior Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; #488 `67b8e922...` | +| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; #488 `67b8e922...` | +| GAP-055 | Strict-interior Wilson lower endpoint could accept a nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; #488 `67b8e922...` | +| GAP-056 | Durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; #488 `67b8e922...` | +| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from a generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; #488 `67b8e922...` | +| GAP-058 | Generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; #488 `67b8e922...` | +| GAP-059 | Generic Monte Carlo summary could materially misstate positive SE relative to `SD / sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; #488 `67b8e922...` | +| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; #488 `67b8e922...` | +| GAP-061 | Generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; #488 `67b8e922...` | +| GAP-062 | Finite-tolerance matching could fail while the pair is deterministically outside every finite tolerance | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; #488 `67b8e922...` | +| GAP-063 | Exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; #488 `67b8e922...` | +| GAP-064 | Positive point RMSE could carry SE above the declared squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; #488 `67b8e922...` | +| GAP-065 | Positive Monte Carlo RMSE could carry spread/SE impossible for nonnegative replications | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; #488 `67b8e922...` | +| GAP-066 | RMSE Monte Carlo nearest-rank percentile could exceed total nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; #488 `67b8e922...` | +| GAP-067 | Generic nearest-rank percentile endpoint could be individually incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected over-strong repair `2798e4f9...`; causal repair `c7151b49...`; edge `dbef285b...`; changelog `c38a320c...`; research `2bbcbb24...`; #488 `67b8e922...` | +| GAP-068 | Distinct generic percentile endpoints could each pass individual radius checks while jointly exceeding the sample squared-deviation budget | `verification-pending` | RED `c4a13826...` + causal repair `cb3f80a2...` + changelog `f727450d...` + research/current #488 `67b8e922...`; exact-head GREEN/review/main integration | ## Release gate From ce293458602afc961b7e7359d106589718627852 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 4 Sep 2026 13:11:37 +0900 Subject: [PATCH 155/235] docs(gaps): add two-replication percentile exhaustion gap --- docs/product-technical-gap-baseline.md | 59 +++++++++++++------------- 1 file changed, 30 insertions(+), 29 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index b2b86fadb..53264e596 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,7 +4,7 @@ **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-04T03:16Z +**Snapshot:** 2026-09-04T04:10Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` @@ -34,7 +34,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `67b8e92209024ddec19ba04a018ec87fdcb21271` | true | `main` | Validation Evidence numerical/artifact repair. Generic `MonteCarloSummary` now binds SE to represented `SD / sqrt(n)`, zero spread to degenerate support, each nearest-rank endpoint to the represented mean/sample-spread budget, and distinct lower/upper endpoints jointly to the same `(n - 1) * SD²` squared-deviation budget. Typed `monte_carlo_rmse` additionally enforces nonnegative RMSE support. Exact-head hosted gates and independent review remain required. | +| #488 | `4f1fdc52c1857072f79a3f91f80b5c4f9af8966d` | true | `main` | Validation Evidence numerical/artifact repair. Generic `MonteCarloSummary` binds SE to represented `SD / sqrt(n)`, zero spread to degenerate support, nearest-rank endpoints to represented moment support, distinct endpoints jointly to one squared-deviation budget, and—when `n = 2` and the endpoints are numerically distinct—the exposed endpoints exhaust the retained sample, so recorded mean/SD must match those two values. Typed `monte_carlo_rmse` additionally enforces nonnegative RMSE support. Exact-head hosted gates and independent review remain required. | | #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 | Validation / Analysis Run fold child. Unique evidence must be inherited by a conflict-resolving survivor; child-head CI does not transfer. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | @@ -69,7 +69,7 @@ The clock contract separates event/valid time, assertion time, document time, sy - A representable final scientific estimand is not rejected solely because an avoidable intermediate binary64 operation overflows/underflows. False exact 0/1/non-finite endpoints and cancellation residues are not accepted when an algebraically equivalent stable form preserves the represented estimand. - Mean signed bias and bias SE remain Validation Evidence performance measures over admitted recovery units; representable cancellation/SEM must survive avoidable overflow/underflow while mathematically nonzero finals below binary64 range fail closed. - Generic Validation Evidence RMSE and its delta-method SE normalize before squaring. Exact-zero point RMSE requires exact-zero point RMSE SE. For positive RMSE, the declared producer satisfies `SE(RMSE) <= RMSE / 2`, with a small relative binary64 admission tolerance. -- Generic `MonteCarloSummary` is sign-neutral. Zero SD requires zero SE and percentile endpoints equal to the represented mean. Positive SD requires positive SE coherent with represented `SD / sqrt(n)` within a small relative tolerance. Every inclusive nearest-rank endpoint is a retained observation and therefore satisfies `|endpoint - mean| <= SD * sqrt(n - 1)` using the producer's represented-mean squared-deviation identity. If lower and upper endpoint values are numerically distinct, they denote distinct retained values and their joint squared deviations must fit the same budget: `(lower - mean)² + (upper - mean)² <= (n - 1) * SD²`. The implementation scale-normalizes comparisons and uses `hypot` for the joint norm to avoid validation-only overflow. Equal numeric endpoints are counted once because they may designate the same retained represented value. +- Generic `MonteCarloSummary` is sign-neutral. Zero SD requires zero SE and percentile endpoints equal to the represented mean. Positive SD requires positive SE coherent with represented `SD / sqrt(n)` within a small relative tolerance. Every inclusive nearest-rank endpoint is a retained observation and satisfies `|endpoint - mean| <= SD * sqrt(n - 1)` under the producer's represented-mean squared-deviation identity. Distinct lower/upper endpoint values share the same `(n - 1) * SD²` deviation budget. When `replication_count = 2` and the endpoints are numerically distinct, those two values exhaust the retained sample, so the recorded represented mean and sample SD must agree with the deterministic two-value reconstruction. Equal numeric endpoints do not prove two distinct ranks and are therefore not subjected to that exhaustion rule. - When the generic carrier occupies `ValidationReport::monte_carlo_rmse`, retained replications are nonnegative; positive mean implies `SE(mean) <= mean`, and inclusive nearest-rank endpoints cannot exceed the nonnegative sample-sum support `n * mean`. These typed bounds are not imposed on signed metrics such as bias. - SE-aware acceptance is `|estimate - target| <= k * SE`. For `k = 0` or exact-zero SE, exact recovery is evaluated before scale reduction; `-0.0` and `+0.0` are one numeric zero-valued scientific state. - `match_count` is a finite-threshold decision and does not require materializing an unrepresentable absolute residual; `absolute_residuals` remains fail closed when the magnitude itself is requested. @@ -88,11 +88,11 @@ The clock contract separates event/valid time, assertion time, document time, sy ### #488 — Validation Evidence -#488 is the generic Validation Evidence landing vehicle at exact head `67b8e92209024ddec19ba04a018ec87fdcb21271`. It remains distinct from Longitudinal Modeling and does not consume mutable fast-mlsirm source. +#488 is the generic Validation Evidence landing vehicle at exact head `4f1fdc52c1857072f79a3f91f80b5c4f9af8966d`. It remains distinct from Longitudinal Modeling and does not consume mutable fast-mlsirm source. -The preceding RMSE, bias, Wilson, Monte Carlo SE, durable-artifact, typed-RMSE, and matching lineages remain in branch ancestry and in GAP-045–GAP-066. Concurrent branch review then added a generic empirical-percentile moment-support repair without treating the concurrent push as a race. Public RED `40acb4f6f51dd9d7074c652fb6448eaa942b95ac` showed that a nearest-rank percentile could be incompatible with the recorded represented mean/sample spread. An initial repair `2798e4f92dbb30019e2b1288e59d09564ae73a70` assumed exact zero-sum deviations and was rejected during immediate review. Causal correction `c7151b498ccbd562e7945a12a53c55472d93acac` uses the actual represented-mean identity `|x - m| <= SD * sqrt(n - 1)`; edge `dbef285b6348cf691bbb72c25350912a5463e11e` preserves adjacent-binary64 samples; changelog correction `c38a320c730875919a8bff58de42e2db859c248d`; research correction `2bbcbb243a755a5a39b13fbf8407b6854194efc0`. +The preceding RMSE, bias, Wilson, Monte Carlo SE, durable-artifact, typed-RMSE, matching, individual percentile moment-support, and joint percentile moment-support lineages remain in branch ancestry and GAP-045–GAP-068. -Fresh review found that separate endpoint-radius checks were still not sufficient. For `n=4`, `mean=1`, `SD=0.5`, `SE=0.25`, endpoints `(0.25, 1.75)` each satisfy the individual radius because each deviation is `0.75 < 0.5*sqrt(3)`, but as distinct retained observations they jointly require `0.75² + 0.75² = 1.125` of squared-deviation budget while the entire sample has only `(n-1)SD² = 0.75`. Public RED `c4a13826144708582a73ec4458967bb103287338`; causal scale-normalized `hypot` repair `cb3f80a2ff3439d238d1bd6e674ef789d25f36c7`; changelog `f727450d7a68d253254d3f0a8ae8d305a08137eb`; research/current exact head `67b8e92209024ddec19ba04a018ec87fdcb21271`. Equal numeric endpoints remain admissible without double-counting one represented value. +Fresh review found one more finite-sample contract that the stored artifact itself determines. With exactly two retained replications and two numerically distinct nearest-rank endpoint values, the endpoints are the only two retained observations. A payload with `mean=0`, `SD=1`, `SE=1/sqrt(2)`, lower `-0.5`, upper `0.5` passes the predecessor's SE, individual endpoint, and joint deviation-budget checks, but the only possible two-observation sample has represented mean `0` and sample SD `sqrt(0.5)`. Public RED `81bf0d9e2f1a28947b1343244002d6762b703f8a`; corrected causal implementation `d48f8fef08e77b8fa654f2852814c25c5d1baa79`; represented-mean coverage `fb314d8afccdf19f0074c64f6277d2edb290e907`; branch-coverable cleanup `440b78d86908fe1464e65bdbc4ceb5f9f6606c9f`; changelog `45116498f29c0d3421192d452e26182975b114ae`; research/current exact head `4f1fdc52c1857072f79a3f91f80b5c4f9af8966d`. Equal numeric endpoints remain under the conservative generic rules because the artifact does not preserve percentile probabilities or rank multiplicity. Morris, White, and Crowther (2019) remain the simulation performance-measure/Monte Carlo uncertainty methodology trace; Wilson (1927) remains the primary score-interval reference. AERA/APA/NCME (2014) remains the current published testing-standards edition while revision is underway. Exact-head hosted Rust/documentation/security/supply-chain/100%-coverage gates and a qualifying independent current-head review remain required. @@ -152,30 +152,31 @@ Morris, White, and Crowther (2019) remain the simulation performance-measure/Mon | GAP-042 | Ratio-first logarithm could nearly double an adjacent-float irregular residual growth rate | `verification-pending` | RED `766ddc7a...` + `ln_1p` repair `16f21d9a...` | | GAP-043 | Duplicate known-truth component identities could silently reweight RMSE recovery evidence | `verification-pending` | RED `698f12f5...` + uniqueness repair `2fae4cb2...` | | GAP-044 | Known-truth RMSE alignment/accumulation depended on row order instead of component identity | `verification-pending` | RED `8ad72ac9...` / `5fb93c40...` + repairs `2dd9537e...` / `025dce7f...`; #310 `c6680450...` | -| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; #488 `67b8e922...` | -| GAP-046 | Bias SE could reject a representable SEM because raw squared deviations/intermediates overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; #488 `67b8e922...` | -| GAP-047 | Generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; #488 `67b8e922...` | -| GAP-048 | Mean signed bias could erase a representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; #488 `67b8e922...` | +| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; #488 `4f1fdc52...` | +| GAP-046 | Bias SE could reject a representable SEM because raw squared deviations/intermediates overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; #488 `4f1fdc52...` | +| GAP-047 | Generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; #488 `4f1fdc52...` | +| GAP-048 | Mean signed bias could erase a representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; #488 `4f1fdc52...` | | GAP-049 | Stable `Between` recovery could be aliased across occasion indices and reweight RMSE | `verification-pending` | RED `0a03041c...` + repair `ec2c1219...`; #310 `c6680450...` | -| GAP-050 | Zero-multiplier SE-aware acceptance could erase a nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; #488 `67b8e922...` | -| GAP-051 | Exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; #488 `67b8e922...` | -| GAP-052 | All-covered Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; #488 `67b8e922...` | -| GAP-053 | Strict-interior Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; #488 `67b8e922...` | -| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; #488 `67b8e922...` | -| GAP-055 | Strict-interior Wilson lower endpoint could accept a nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; #488 `67b8e922...` | -| GAP-056 | Durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; #488 `67b8e922...` | -| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from a generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; #488 `67b8e922...` | -| GAP-058 | Generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; #488 `67b8e922...` | -| GAP-059 | Generic Monte Carlo summary could materially misstate positive SE relative to `SD / sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; #488 `67b8e922...` | -| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; #488 `67b8e922...` | -| GAP-061 | Generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; #488 `67b8e922...` | -| GAP-062 | Finite-tolerance matching could fail while the pair is deterministically outside every finite tolerance | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; #488 `67b8e922...` | -| GAP-063 | Exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; #488 `67b8e922...` | -| GAP-064 | Positive point RMSE could carry SE above the declared squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; #488 `67b8e922...` | -| GAP-065 | Positive Monte Carlo RMSE could carry spread/SE impossible for nonnegative replications | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; #488 `67b8e922...` | -| GAP-066 | RMSE Monte Carlo nearest-rank percentile could exceed total nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; #488 `67b8e922...` | -| GAP-067 | Generic nearest-rank percentile endpoint could be individually incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected over-strong repair `2798e4f9...`; causal repair `c7151b49...`; edge `dbef285b...`; changelog `c38a320c...`; research `2bbcbb24...`; #488 `67b8e922...` | -| GAP-068 | Distinct generic percentile endpoints could each pass individual radius checks while jointly exceeding the sample squared-deviation budget | `verification-pending` | RED `c4a13826...` + causal repair `cb3f80a2...` + changelog `f727450d...` + research/current #488 `67b8e922...`; exact-head GREEN/review/main integration | +| GAP-050 | Zero-multiplier SE-aware acceptance could erase a nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; #488 `4f1fdc52...` | +| GAP-051 | Exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; #488 `4f1fdc52...` | +| GAP-052 | All-covered Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; #488 `4f1fdc52...` | +| GAP-053 | Strict-interior Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; #488 `4f1fdc52...` | +| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; #488 `4f1fdc52...` | +| GAP-055 | Strict-interior Wilson lower endpoint could accept a nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; #488 `4f1fdc52...` | +| GAP-056 | Durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; #488 `4f1fdc52...` | +| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from a generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; #488 `4f1fdc52...` | +| GAP-058 | Generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; #488 `4f1fdc52...` | +| GAP-059 | Generic Monte Carlo summary could materially misstate positive SE relative to `SD / sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; #488 `4f1fdc52...` | +| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; #488 `4f1fdc52...` | +| GAP-061 | Generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; #488 `4f1fdc52...` | +| GAP-062 | Finite-tolerance matching could fail while the pair is deterministically outside every finite tolerance | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; #488 `4f1fdc52...` | +| GAP-063 | Exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; #488 `4f1fdc52...` | +| GAP-064 | Positive point RMSE could carry SE above the declared squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; #488 `4f1fdc52...` | +| GAP-065 | Positive Monte Carlo RMSE could carry spread/SE impossible for nonnegative replications | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; #488 `4f1fdc52...` | +| GAP-066 | RMSE Monte Carlo nearest-rank percentile could exceed total nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; #488 `4f1fdc52...` | +| GAP-067 | Generic nearest-rank percentile endpoint could be individually incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected over-strong repair `2798e4f9...`; causal repair `c7151b49...`; edge `dbef285b...`; changelog `c38a320c...`; research `2bbcbb24...`; #488 `4f1fdc52...` | +| GAP-068 | Distinct generic percentile endpoints could each pass individual radius checks while jointly exceeding the sample squared-deviation budget | `verification-pending` | RED `c4a13826...` + causal repair `cb3f80a2...` + changelog `f727450d...`; #488 `4f1fdc52...` | +| GAP-069 | Two-replication distinct nearest-rank endpoints could exhaust the retained sample while the stored mean or SD remained impossible | `verification-pending` | RED `81bf0d9e...` + causal repair `d48f8fef...` + mean coverage `fb314d8a...` + branch cleanup `440b78d8...` + changelog `45116498...` + research/current #488 `4f1fdc52...`; exact-head GREEN/review/main integration | ## Release gate From 422ded168c32ded073063ca990713535f387544f Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 4 Sep 2026 13:14:12 +0900 Subject: [PATCH 156/235] docs(gaps): keep queue baseline validator-current --- docs/product-technical-gap-baseline.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 53264e596..0ae74d7c1 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,7 +4,7 @@ **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-04T04:10Z +**Snapshot:** 2026-09-04T04:10:00Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` @@ -28,18 +28,18 @@ A planning document, mergeable branch, local/source inspection, predecessor-head Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward updates on the default branch. Organization-admin bypass is not normal delivery evidence and is not used by this writer. -## Current landing authority +## Current priority open pull-request evidence #435 intentionally omits its own mutable branch SHA from this file. | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `4f1fdc52c1857072f79a3f91f80b5c4f9af8966d` | true | `main` | Validation Evidence numerical/artifact repair. Generic `MonteCarloSummary` binds SE to represented `SD / sqrt(n)`, zero spread to degenerate support, nearest-rank endpoints to represented moment support, distinct endpoints jointly to one squared-deviation budget, and—when `n = 2` and the endpoints are numerically distinct—the exposed endpoints exhaust the retained sample, so recorded mean/SD must match those two values. Typed `monte_carlo_rmse` additionally enforces nonnegative RMSE support. Exact-head hosted gates and independent review remain required. | +| #488 | `4f1fdc52c1857072f79a3f91f80b5c4f9af8966d` | true | `main` | Validation Evidence numerical/artifact repair. Generic `MonteCarloSummary` binds SE to represented `SD / sqrt(n)`, zero spread to degenerate support, nearest-rank endpoints to represented moment support, distinct endpoints jointly to one squared-deviation budget, and—when `n = 2` and the endpoints are numerically distinct—the exposed endpoints exhaust the retained sample, so recorded mean/SD must match those two values. Exact-head hosted gates and independent review remain required. | | #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 | Validation / Analysis Run fold child. Unique evidence must be inherited by a conflict-resolving survivor; child-head CI does not transfer. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | | #483 | `847d96f913bb261803ac0bd751ad7e4f51324cee` | true | #416 | Analysis Run fold child; preserve unique evidence. | -| #482 | `506dbae236a4484301b704b6c6a05b20faf0fe69` | true | #416 | Analysis Run fold child; preserve unique evidence. | +| #482 | `506dbae236a4484301b7046c6a05b20faf0fe69` | true | #416 | Analysis Run fold child; preserve unique evidence. | | #480 | `01f45a99392457334a4f6d3d659f992af739eeee` | true | `main` | contextual-orchestrator consumer repair; stays Draft while immutable CO release/deployment/auth provenance is unavailable. | | #460 | `dfab4eab5ff733731e565a9348072b8dab2e4912` | true | #416 | Analysis Run fold child; typed cutoff equality and terminal-validation separation. | | #458 | `08165e3b3c929b4ae77396689549f72723ff8ff5` | true | #416 | Analysis Run fold child; typed cutoff equality and terminal-validation separation. | @@ -180,4 +180,4 @@ Morris, White, and Crowther (2019) remain the simulation performance-measure/Mon ## Release gate -TEPP currently has no GitHub release. Release is permitted only after a coherent vertical reaches protected main with exact protected-head CI/security/recovery evidence, reproducible package + SBOM + provenance + rollback artifacts, current version/CHANGELOG, required migration/restore/load evidence, and released integration contracts where deployment depends on them. Queued/pending/startup-failed/skipped or predecessor-head evidence is not GREEN. +TEPP currently has no GitHub release. Release is permitted only after a clean coherent vertical reaches protected main with exact protected-head CI/security evidence, scientific/recovery acceptance, reproducible package/build artifacts with SBOM and provenance, validated migrations/upgrade/rollback/recovery where applicable, consistent version metadata and current `CHANGELOG.md`, accessibility/operability evidence for user-facing components, no unresolved scientific/privacy/security/supply-chain blockers, and released integration contracts where deployment depends on them. Queued/pending/startup-failed/skipped or predecessor-head evidence is not GREEN. From efcf98a00f65ce8bf006207dbf8f264c35cda200 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 4 Sep 2026 13:15:38 +0900 Subject: [PATCH 157/235] docs(gaps): correct priority exact-head evidence --- docs/product-technical-gap-baseline.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 0ae74d7c1..f00979c93 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -39,7 +39,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | | #483 | `847d96f913bb261803ac0bd751ad7e4f51324cee` | true | #416 | Analysis Run fold child; preserve unique evidence. | -| #482 | `506dbae236a4484301b7046c6a05b20faf0fe69` | true | #416 | Analysis Run fold child; preserve unique evidence. | +| #482 | `506dbae236a4484301b704b6c6a05b20faf0fe69` | true | #416 | Analysis Run fold child; preserve unique evidence. | | #480 | `01f45a99392457334a4f6d3d659f992af739eeee` | true | `main` | contextual-orchestrator consumer repair; stays Draft while immutable CO release/deployment/auth provenance is unavailable. | | #460 | `dfab4eab5ff733731e565a9348072b8dab2e4912` | true | #416 | Analysis Run fold child; typed cutoff equality and terminal-validation separation. | | #458 | `08165e3b3c929b4ae77396689549f72723ff8ff5` | true | #416 | Analysis Run fold child; typed cutoff equality and terminal-validation separation. | From 2c3b9ed72329cf7eb62574bab0604f2fd99c169c Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 4 Sep 2026 14:06:18 +0900 Subject: [PATCH 158/235] docs(gap): record Wilson pair-coherence evidence --- docs/product-technical-gap-baseline.md | 69 ++++++++++++++------------ 1 file changed, 37 insertions(+), 32 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index f00979c93..21eec324a 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,7 +4,7 @@ **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-04T04:10:00Z +**Snapshot:** 2026-09-04T05:05:00Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` @@ -34,7 +34,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `4f1fdc52c1857072f79a3f91f80b5c4f9af8966d` | true | `main` | Validation Evidence numerical/artifact repair. Generic `MonteCarloSummary` binds SE to represented `SD / sqrt(n)`, zero spread to degenerate support, nearest-rank endpoints to represented moment support, distinct endpoints jointly to one squared-deviation budget, and—when `n = 2` and the endpoints are numerically distinct—the exposed endpoints exhaust the retained sample, so recorded mean/SD must match those two values. Exact-head hosted gates and independent review remain required. | +| #488 | `5be03bcaaa040fbc0f8d2e749565cf40a8a2f20e` | true | `main` | Validation Evidence numerical/artifact repair. Current finding rejects stored Wilson endpoint pairs that contain empirical coverage but cannot be the two roots of one Wilson score interval for that coverage. Prior Monte Carlo/RMSE/Wilson stability lineages remain in ancestry. Exact-head hosted gates and independent review remain required. | | #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 | Validation / Analysis Run fold child. Unique evidence must be inherited by a conflict-resolving survivor; child-head CI does not transfer. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | @@ -69,11 +69,11 @@ The clock contract separates event/valid time, assertion time, document time, sy - A representable final scientific estimand is not rejected solely because an avoidable intermediate binary64 operation overflows/underflows. False exact 0/1/non-finite endpoints and cancellation residues are not accepted when an algebraically equivalent stable form preserves the represented estimand. - Mean signed bias and bias SE remain Validation Evidence performance measures over admitted recovery units; representable cancellation/SEM must survive avoidable overflow/underflow while mathematically nonzero finals below binary64 range fail closed. - Generic Validation Evidence RMSE and its delta-method SE normalize before squaring. Exact-zero point RMSE requires exact-zero point RMSE SE. For positive RMSE, the declared producer satisfies `SE(RMSE) <= RMSE / 2`, with a small relative binary64 admission tolerance. -- Generic `MonteCarloSummary` is sign-neutral. Zero SD requires zero SE and percentile endpoints equal to the represented mean. Positive SD requires positive SE coherent with represented `SD / sqrt(n)` within a small relative tolerance. Every inclusive nearest-rank endpoint is a retained observation and satisfies `|endpoint - mean| <= SD * sqrt(n - 1)` under the producer's represented-mean squared-deviation identity. Distinct lower/upper endpoint values share the same `(n - 1) * SD²` deviation budget. When `replication_count = 2` and the endpoints are numerically distinct, those two values exhaust the retained sample, so the recorded represented mean and sample SD must agree with the deterministic two-value reconstruction. Equal numeric endpoints do not prove two distinct ranks and are therefore not subjected to that exhaustion rule. +- Generic `MonteCarloSummary` is sign-neutral. Zero SD requires zero SE and percentile endpoints equal to the represented mean. Positive SD requires positive SE coherent with represented `SD / sqrt(n)` within a small relative tolerance. Every inclusive nearest-rank endpoint is a retained observation and satisfies `|endpoint - mean| <= SD * sqrt(n - 1)`. Distinct lower/upper endpoint values share the same `(n - 1) * SD²` deviation budget. When `replication_count = 2` and endpoints are numerically distinct, those values exhaust the retained sample and the recorded represented mean/sample SD must match the deterministic two-value reconstruction. Equal numeric endpoints do not prove two distinct ranks and are not subjected to that exhaustion rule. - When the generic carrier occupies `ValidationReport::monte_carlo_rmse`, retained replications are nonnegative; positive mean implies `SE(mean) <= mean`, and inclusive nearest-rank endpoints cannot exceed the nonnegative sample-sum support `n * mean`. These typed bounds are not imposed on signed metrics such as bias. - SE-aware acceptance is `|estimate - target| <= k * SE`. For `k = 0` or exact-zero SE, exact recovery is evaluated before scale reduction; `-0.0` and `+0.0` are one numeric zero-valued scientific state. - `match_count` is a finite-threshold decision and does not require materializing an unrepresentable absolute residual; `absolute_residuals` remains fail closed when the magnitude itself is requested. -- Wilson interval coverage evidence preserves representable endpoints through stable rationalized/complementary forms rather than cancellation-prone center±margin evaluation. +- Wilson interval coverage evidence preserves representable endpoints through stable rationalized/complementary forms rather than cancellation-prone center±margin evaluation. A stored lower/upper pair must also satisfy the Wilson root identity for the same empirical coverage after eliminating the unrecorded `z²/n` term; containment alone is not sufficient evidence of a coherent Wilson interval. - Durable and human-facing Validation Evidence must preserve producing-metric invariants on explicit validation, serde ingress/egress, and human projection. Finiteness alone is not evidence validity. - Bias, RMSE, and Monte Carlo may share private deterministic scalar support inside `validation_core`, but metric-specific cancellation/normalization, denominator, uncertainty, and fail-closed semantics remain with their bounded modules. - Historical-cutoff admission occurs before duplicate-identity checks. Future-unavailable evidence cannot change an earlier run's conflicts, counts, or terminal state. @@ -88,13 +88,17 @@ The clock contract separates event/valid time, assertion time, document time, sy ### #488 — Validation Evidence -#488 is the generic Validation Evidence landing vehicle at exact head `4f1fdc52c1857072f79a3f91f80b5c4f9af8966d`. It remains distinct from Longitudinal Modeling and does not consume mutable fast-mlsirm source. +#488 is the generic Validation Evidence landing vehicle at exact head `5be03bcaaa040fbc0f8d2e749565cf40a8a2f20e`. It remains distinct from Longitudinal Modeling and does not consume mutable fast-mlsirm source. -The preceding RMSE, bias, Wilson, Monte Carlo SE, durable-artifact, typed-RMSE, matching, individual percentile moment-support, and joint percentile moment-support lineages remain in branch ancestry and GAP-045–GAP-068. +The preceding RMSE, bias, stable-Wilson arithmetic, Monte Carlo SE, durable-artifact, typed-RMSE, matching, individual/joint percentile moment-support, and two-replication exhaustion lineages remain in branch ancestry and GAP-045–GAP-069. -Fresh review found one more finite-sample contract that the stored artifact itself determines. With exactly two retained replications and two numerically distinct nearest-rank endpoint values, the endpoints are the only two retained observations. A payload with `mean=0`, `SD=1`, `SE=1/sqrt(2)`, lower `-0.5`, upper `0.5` passes the predecessor's SE, individual endpoint, and joint deviation-budget checks, but the only possible two-observation sample has represented mean `0` and sample SD `sqrt(0.5)`. Public RED `81bf0d9e2f1a28947b1343244002d6762b703f8a`; corrected causal implementation `d48f8fef08e77b8fa654f2852814c25c5d1baa79`; represented-mean coverage `fb314d8afccdf19f0074c64f6277d2edb290e907`; branch-coverable cleanup `440b78d86908fe1464e65bdbc4ceb5f9f6606c9f`; changelog `45116498f29c0d3421192d452e26182975b114ae`; research/current exact head `4f1fdc52c1857072f79a3f91f80b5c4f9af8966d`. Equal numeric endpoints remain under the conservative generic rules because the artifact does not preserve percentile probabilities or rank multiplicity. +Fresh review found a durable Wilson-artifact coherence hole. The predecessor accepted any ordered Wilson endpoints containing the recorded empirical coverage. At `p = 0.5`, `[0.2, 0.9]` passes those checks but no Wilson score interval can produce it because the roots must be symmetric about `0.5`. More generally, with `a = z²/n`, Wilson roots satisfy `LU = p²/(1+a)` and `L+U = 1 + (2p-1)/(1+a)`; eliminating `a` yields `p²(L+U-1) = (2p-1)LU`. Below `p = 0.5`, the complementary uncovered-proportion identity is used to avoid squaring a tiny `p`. -Morris, White, and Crowther (2019) remain the simulation performance-measure/Monte Carlo uncertainty methodology trace; Wilson (1927) remains the primary score-interval reference. AERA/APA/NCME (2014) remains the current published testing-standards edition while revision is underway. Exact-head hosted Rust/documentation/security/supply-chain/100%-coverage gates and a qualifying independent current-head review remain required. +Public RED `a839c606fb2329ce1b339eb235c79e02abf40e16`; causal admission repair `38c5b8e83fe2433167afb6ece13e72b6608ceb03`; asymmetric/complement edge `c1cb16a78499648c10d6d5a8dad5e212a267064a`; changelog `6af0821bc2fca3e9f101cfa4ad36048ecfaa6ddd`; research/current #488 `5be03bcaaa040fbc0f8d2e749565cf40a8a2f20e`. + +The new check is deliberately necessary rather than falsely sufficient. `ValidationReport` does not yet retain the interval-coverage denominator or Wilson critical value `z`, so exact recomputation and denominator provenance cannot be proved from the current artifact. That is the next schema-level Validation Evidence gap, not information inferred by the current repair. + +Wilson (1927) remains the primary score-interval reference. AERA/APA/NCME (2014) remains the current published testing-standards edition while revision is underway. Exact-head hosted Rust/documentation/security/supply-chain/100%-coverage gates and a qualifying independent current-head review remain required. ### #416 — Validation / Analysis Run consolidation @@ -152,31 +156,32 @@ Morris, White, and Crowther (2019) remain the simulation performance-measure/Mon | GAP-042 | Ratio-first logarithm could nearly double an adjacent-float irregular residual growth rate | `verification-pending` | RED `766ddc7a...` + `ln_1p` repair `16f21d9a...` | | GAP-043 | Duplicate known-truth component identities could silently reweight RMSE recovery evidence | `verification-pending` | RED `698f12f5...` + uniqueness repair `2fae4cb2...` | | GAP-044 | Known-truth RMSE alignment/accumulation depended on row order instead of component identity | `verification-pending` | RED `8ad72ac9...` / `5fb93c40...` + repairs `2dd9537e...` / `025dce7f...`; #310 `c6680450...` | -| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; #488 `4f1fdc52...` | -| GAP-046 | Bias SE could reject a representable SEM because raw squared deviations/intermediates overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; #488 `4f1fdc52...` | -| GAP-047 | Generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; #488 `4f1fdc52...` | -| GAP-048 | Mean signed bias could erase a representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; #488 `4f1fdc52...` | +| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; #488 `5be03bca...` | +| GAP-046 | Bias SE could reject a representable SEM because raw squared deviations/intermediates overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; #488 `5be03bca...` | +| GAP-047 | Generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; #488 `5be03bca...` | +| GAP-048 | Mean signed bias could erase a representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; #488 `5be03bca...` | | GAP-049 | Stable `Between` recovery could be aliased across occasion indices and reweight RMSE | `verification-pending` | RED `0a03041c...` + repair `ec2c1219...`; #310 `c6680450...` | -| GAP-050 | Zero-multiplier SE-aware acceptance could erase a nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; #488 `4f1fdc52...` | -| GAP-051 | Exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; #488 `4f1fdc52...` | -| GAP-052 | All-covered Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; #488 `4f1fdc52...` | -| GAP-053 | Strict-interior Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; #488 `4f1fdc52...` | -| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; #488 `4f1fdc52...` | -| GAP-055 | Strict-interior Wilson lower endpoint could accept a nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; #488 `4f1fdc52...` | -| GAP-056 | Durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; #488 `4f1fdc52...` | -| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from a generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; #488 `4f1fdc52...` | -| GAP-058 | Generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; #488 `4f1fdc52...` | -| GAP-059 | Generic Monte Carlo summary could materially misstate positive SE relative to `SD / sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; #488 `4f1fdc52...` | -| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; #488 `4f1fdc52...` | -| GAP-061 | Generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; #488 `4f1fdc52...` | -| GAP-062 | Finite-tolerance matching could fail while the pair is deterministically outside every finite tolerance | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; #488 `4f1fdc52...` | -| GAP-063 | Exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; #488 `4f1fdc52...` | -| GAP-064 | Positive point RMSE could carry SE above the declared squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; #488 `4f1fdc52...` | -| GAP-065 | Positive Monte Carlo RMSE could carry spread/SE impossible for nonnegative replications | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; #488 `4f1fdc52...` | -| GAP-066 | RMSE Monte Carlo nearest-rank percentile could exceed total nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; #488 `4f1fdc52...` | -| GAP-067 | Generic nearest-rank percentile endpoint could be individually incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected over-strong repair `2798e4f9...`; causal repair `c7151b49...`; edge `dbef285b...`; changelog `c38a320c...`; research `2bbcbb24...`; #488 `4f1fdc52...` | -| GAP-068 | Distinct generic percentile endpoints could each pass individual radius checks while jointly exceeding the sample squared-deviation budget | `verification-pending` | RED `c4a13826...` + causal repair `cb3f80a2...` + changelog `f727450d...`; #488 `4f1fdc52...` | -| GAP-069 | Two-replication distinct nearest-rank endpoints could exhaust the retained sample while the stored mean or SD remained impossible | `verification-pending` | RED `81bf0d9e...` + causal repair `d48f8fef...` + mean coverage `fb314d8a...` + branch cleanup `440b78d8...` + changelog `45116498...` + research/current #488 `4f1fdc52...`; exact-head GREEN/review/main integration | +| GAP-050 | Zero-multiplier SE-aware acceptance could erase a nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; #488 `5be03bca...` | +| GAP-051 | Exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; #488 `5be03bca...` | +| GAP-052 | All-covered Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; #488 `5be03bca...` | +| GAP-053 | Strict-interior Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; #488 `5be03bca...` | +| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; #488 `5be03bca...` | +| GAP-055 | Strict-interior Wilson lower endpoint could accept a nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; #488 `5be03bca...` | +| GAP-056 | Durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; #488 `5be03bca...` | +| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from a generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; #488 `5be03bca...` | +| GAP-058 | Generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; #488 `5be03bca...` | +| GAP-059 | Generic Monte Carlo summary could materially misstate positive SE relative to `SD / sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; #488 `5be03bca...` | +| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; #488 `5be03bca...` | +| GAP-061 | Generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; #488 `5be03bca...` | +| GAP-062 | Finite-tolerance matching could fail while the pair is deterministically outside every finite tolerance | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; #488 `5be03bca...` | +| GAP-063 | Exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; #488 `5be03bca...` | +| GAP-064 | Positive point RMSE could carry SE above the declared squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; #488 `5be03bca...` | +| GAP-065 | Positive Monte Carlo RMSE could carry spread/SE impossible for nonnegative replications | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; #488 `5be03bca...` | +| GAP-066 | RMSE Monte Carlo nearest-rank percentile could exceed total nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; #488 `5be03bca...` | +| GAP-067 | Generic nearest-rank percentile endpoint could be individually incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected over-strong repair `2798e4f9...`; causal repair `c7151b49...`; edge `dbef285b...`; changelog `c38a320c...`; research `2bbcbb24...`; #488 `5be03bca...` | +| GAP-068 | Distinct generic percentile endpoints could each pass individual radius checks while jointly exceeding the sample squared-deviation budget | `verification-pending` | RED `c4a13826...` + causal repair `cb3f80a2...` + changelog `f727450d...`; #488 `5be03bca...` | +| GAP-069 | Two-replication distinct nearest-rank endpoints could exhaust the retained sample while the stored mean or SD remained impossible | `verification-pending` | RED `81bf0d9e...` + causal repair `d48f8fef...` + mean coverage `fb314d8a...` + branch cleanup `440b78d8...` + changelog `45116498...` + research; #488 `5be03bca...`; exact-head GREEN/review/main integration | +| GAP-070 | Stored Wilson bounds could contain empirical coverage while the lower/upper pair could not arise from one Wilson score interval for that same coverage | `verification-pending` | RED `a839c606...` + causal repair `38c5b8e8...` + complementary edge `c1cb16a7...` + changelog `6af0821b...` + research/current #488 `5be03bca...`; exact-head GREEN/review/main integration | ## Release gate From 7242c466f6988d4bcc124812d5d8d411234ada26 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 4 Sep 2026 14:19:36 +0900 Subject: [PATCH 159/235] docs(gap): refresh Wilson coherence and provenance gap --- docs/product-technical-gap-baseline.md | 81 +++++++++++++------------- 1 file changed, 40 insertions(+), 41 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 21eec324a..aa7f9aa75 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,13 +1,9 @@ # Product and Technical Gap Baseline -**Status:** Active delivery recovery - -**Product:** Temporal Event Psychometrics Platform (TEPP) - -**Snapshot:** 2026-09-04T05:05:00Z - -**Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` - +**Status:** Active delivery recovery +**Product:** Temporal Event Psychometrics Platform (TEPP) +**Snapshot:** 2026-09-04T05:18:00Z +**Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` **Workspace version:** `0.2.0` **Delivery authority:** issue [#175](https://github.com/ContextualWisdomLab/TEPP/issues/175), PR [#435](https://github.com/ContextualWisdomLab/TEPP/pull/435), and [`docs/delivery/pr-queue-authority-2026-09-01.md`](delivery/pr-queue-authority-2026-09-01.md). @@ -34,7 +30,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `5be03bcaaa040fbc0f8d2e749565cf40a8a2f20e` | true | `main` | Validation Evidence numerical/artifact repair. Current finding rejects stored Wilson endpoint pairs that contain empirical coverage but cannot be the two roots of one Wilson score interval for that coverage. Prior Monte Carlo/RMSE/Wilson stability lineages remain in ancestry. Exact-head hosted gates and independent review remain required. | +| #488 | `1246c583161d7f64a7d33139cec46665ee745584` | true | `main` | Validation Evidence numerical/artifact repair. Current finding rejects stored Wilson endpoint pairs that contain empirical coverage but cannot be the roots of one Wilson score interval for that coverage. Self-review repaired dependent fixtures so unrelated tests remain scientifically coherent. Exact-head hosted gates and independent review remain required. | | #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 | Validation / Analysis Run fold child. Unique evidence must be inherited by a conflict-resolving survivor; child-head CI does not transfer. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | @@ -54,7 +50,7 @@ TEPP owns temporal/event composition, irregular time, time-varying multilevel/cr `psychometric_core` is not authority for new temporal/state composition. fast-mlsirm owns reusable static/generalized-mixed/dependence-aware psychometric specification and arithmetic. TEPP consumes only immutable released/versioned Published Language through an ACL; source copying and mutable sibling-head dependencies are prohibited. -contextual-orchestrator owns provider/model routing and semantic LLM execution. Semantic LLM work and model-backed Actions must use a released/versioned contextual-orchestrator contract; Actions use `orchestrator/free` through the gateway credential and must not select providers/models/groups or consume direct provider keys. Context Graph contracts are contract-only integration authority; EA Core owns enterprise-architecture decisions. No cross-service SQL. +contextual-orchestrator owns provider/model routing and semantic LLM execution. Its protected main is currently `17095dad706199a2e108ea6c20d7e6f1f5ac3b89`, but GitHub releases remain zero. Semantic LLM work and model-backed Actions therefore continue to require a future released/versioned contextual-orchestrator contract; Actions use `orchestrator/free` through the gateway credential and must not select providers/models/groups or consume direct provider keys. Mutable owner main is evidence, not a TEPP production contract. Context Graph contracts are contract-only integration authority; EA Core owns enterprise-architecture decisions. No cross-service SQL. The clock contract separates event/valid time, assertion time, document time, system time, available time, and knowledge cutoff. Retrospective evidence may describe an earlier event but cannot enter an earlier knowledge cutoff. Forward state/transition edges remain distinct from retrospective/citation/revision/provenance relations. @@ -73,7 +69,7 @@ The clock contract separates event/valid time, assertion time, document time, sy - When the generic carrier occupies `ValidationReport::monte_carlo_rmse`, retained replications are nonnegative; positive mean implies `SE(mean) <= mean`, and inclusive nearest-rank endpoints cannot exceed the nonnegative sample-sum support `n * mean`. These typed bounds are not imposed on signed metrics such as bias. - SE-aware acceptance is `|estimate - target| <= k * SE`. For `k = 0` or exact-zero SE, exact recovery is evaluated before scale reduction; `-0.0` and `+0.0` are one numeric zero-valued scientific state. - `match_count` is a finite-threshold decision and does not require materializing an unrepresentable absolute residual; `absolute_residuals` remains fail closed when the magnitude itself is requested. -- Wilson interval coverage evidence preserves representable endpoints through stable rationalized/complementary forms rather than cancellation-prone center±margin evaluation. A stored lower/upper pair must also satisfy the Wilson root identity for the same empirical coverage after eliminating the unrecorded `z²/n` term; containment alone is not sufficient evidence of a coherent Wilson interval. +- Wilson interval coverage evidence preserves representable endpoints through stable rationalized/complementary forms rather than cancellation-prone center±margin evaluation. A stored lower/upper pair must also satisfy the Wilson root identity for the same empirical coverage after eliminating the unrecorded `z²/n` term; containment alone is not sufficient evidence of a coherent Wilson interval. This is a necessary artifact-level check, not denominator/critical-value provenance. - Durable and human-facing Validation Evidence must preserve producing-metric invariants on explicit validation, serde ingress/egress, and human projection. Finiteness alone is not evidence validity. - Bias, RMSE, and Monte Carlo may share private deterministic scalar support inside `validation_core`, but metric-specific cancellation/normalization, denominator, uncertainty, and fail-closed semantics remain with their bounded modules. - Historical-cutoff admission occurs before duplicate-identity checks. Future-unavailable evidence cannot change an earlier run's conflicts, counts, or terminal state. @@ -88,25 +84,27 @@ The clock contract separates event/valid time, assertion time, document time, sy ### #488 — Validation Evidence -#488 is the generic Validation Evidence landing vehicle at exact head `5be03bcaaa040fbc0f8d2e749565cf40a8a2f20e`. It remains distinct from Longitudinal Modeling and does not consume mutable fast-mlsirm source. +#488 is the generic Validation Evidence landing vehicle at exact head `1246c583161d7f64a7d33139cec46665ee745584`. It remains distinct from Longitudinal Modeling and does not consume mutable fast-mlsirm source. The preceding RMSE, bias, stable-Wilson arithmetic, Monte Carlo SE, durable-artifact, typed-RMSE, matching, individual/joint percentile moment-support, and two-replication exhaustion lineages remain in branch ancestry and GAP-045–GAP-069. Fresh review found a durable Wilson-artifact coherence hole. The predecessor accepted any ordered Wilson endpoints containing the recorded empirical coverage. At `p = 0.5`, `[0.2, 0.9]` passes those checks but no Wilson score interval can produce it because the roots must be symmetric about `0.5`. More generally, with `a = z²/n`, Wilson roots satisfy `LU = p²/(1+a)` and `L+U = 1 + (2p-1)/(1+a)`; eliminating `a` yields `p²(L+U-1) = (2p-1)LU`. Below `p = 0.5`, the complementary uncovered-proportion identity is used to avoid squaring a tiny `p`. -Public RED `a839c606fb2329ce1b339eb235c79e02abf40e16`; causal admission repair `38c5b8e83fe2433167afb6ece13e72b6608ceb03`; asymmetric/complement edge `c1cb16a78499648c10d6d5a8dad5e212a267064a`; changelog `6af0821bc2fca3e9f101cfa4ad36048ecfaa6ddd`; research/current #488 `5be03bcaaa040fbc0f8d2e749565cf40a8a2f20e`. +Public RED `a839c606fb2329ce1b339eb235c79e02abf40e16`; causal admission repair `38c5b8e83fe2433167afb6ece13e72b6608ceb03`; asymmetric/complement edge `c1cb16a78499648c10d6d5a8dad5e212a267064a`; changelog `6af0821bc2fca3e9f101cfa4ad36048ecfaa6ddd`; dependent-fixture doctoring through `59e40b4f0ebbb3b991c84724ded157ffe974abcd`; research/current #488 `1246c583161d7f64a7d33139cec46665ee745584`. + +The new check is deliberately necessary rather than falsely sufficient. `ValidationReport` does not retain the interval-coverage denominator or Wilson critical value `z`, so exact recomputation, confidence-level interpretation, and denominator provenance cannot be proved from the current artifact. That limitation is GAP-071 rather than information inferred by the current repair. The producer also permits positive `z` values whose squared binary64 representation underflows to zero; artifact admission therefore does not invent a non-degeneracy rule that the producer itself does not guarantee. -The new check is deliberately necessary rather than falsely sufficient. `ValidationReport` does not yet retain the interval-coverage denominator or Wilson critical value `z`, so exact recomputation and denominator provenance cannot be proved from the current artifact. That is the next schema-level Validation Evidence gap, not information inferred by the current repair. +Self-review changed old unrelated report fixtures from arbitrary Wilson-looking values to the exactly coherent `p=0.5`, `[0.2,0.8]` pair. Typed RMSE RED fixtures were also rechecked against predecessor generic `MonteCarloSummary` support so each test still fails for the intended typed invariant rather than an earlier generic one. No coverage or security gate was weakened. Wilson (1927) remains the primary score-interval reference. AERA/APA/NCME (2014) remains the current published testing-standards edition while revision is underway. Exact-head hosted Rust/documentation/security/supply-chain/100%-coverage gates and a qualifying independent current-head review remain required. ### #416 — Validation / Analysis Run consolidation -#416 exact head is `aa730c63563eb4a33048d822b581036c8487bd47`. #458/#460/#482/#483/#484/#485/#487 remain fold children until every unique source/test/fixture/contract/doctoring delta is inherited by a conflict-resolving survivor. Child-head CI never transfers to #416. +#416 branch head is `aa730c63563eb4a33048d822b581036c8487bd47`; its body distinguishes the current exact source repair `0b7155cc238defb1e55129ff3000658f04b343cf` from later branch metadata/docs commits. #458/#460/#482/#483/#484/#485/#487 remain fold children until every unique source/test/fixture/contract/doctoring delta is inherited by a conflict-resolving survivor. Child-head CI never transfers to #416. ### #480 — contextual-orchestrator boundary -#480 removes TEPP-owned provider discovery/ranking and requires a released contextual-orchestrator owner contract. The consumer remains Draft until an immutable compatible release plus deployment/auth/schema/artifact provenance exists. Mutable owner main is evidence, not a production contract. +#480 removes TEPP-owned provider discovery/ranking and requires a released contextual-orchestrator owner contract. Its exact source head remains `01f45a99392457334a4f6d3d659f992af739eeee`. Fresh owner main is `17095dad706199a2e108ea6c20d7e6f1f5ac3b89`, but contextual-orchestrator still has zero GitHub releases. #480 therefore remains Draft until an immutable compatible release plus deployment/auth/schema/artifact provenance exists. Mutable owner main is evidence, not a production contract. ## Gap register @@ -156,32 +154,33 @@ Wilson (1927) remains the primary score-interval reference. AERA/APA/NCME (2014) | GAP-042 | Ratio-first logarithm could nearly double an adjacent-float irregular residual growth rate | `verification-pending` | RED `766ddc7a...` + `ln_1p` repair `16f21d9a...` | | GAP-043 | Duplicate known-truth component identities could silently reweight RMSE recovery evidence | `verification-pending` | RED `698f12f5...` + uniqueness repair `2fae4cb2...` | | GAP-044 | Known-truth RMSE alignment/accumulation depended on row order instead of component identity | `verification-pending` | RED `8ad72ac9...` / `5fb93c40...` + repairs `2dd9537e...` / `025dce7f...`; #310 `c6680450...` | -| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; #488 `5be03bca...` | -| GAP-046 | Bias SE could reject a representable SEM because raw squared deviations/intermediates overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; #488 `5be03bca...` | -| GAP-047 | Generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; #488 `5be03bca...` | -| GAP-048 | Mean signed bias could erase a representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; #488 `5be03bca...` | +| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; #488 `1246c583...` | +| GAP-046 | Bias SE could reject a representable SEM because raw squared deviations/intermediates overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; #488 `1246c583...` | +| GAP-047 | Generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; #488 `1246c583...` | +| GAP-048 | Mean signed bias could erase a representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; #488 `1246c583...` | | GAP-049 | Stable `Between` recovery could be aliased across occasion indices and reweight RMSE | `verification-pending` | RED `0a03041c...` + repair `ec2c1219...`; #310 `c6680450...` | -| GAP-050 | Zero-multiplier SE-aware acceptance could erase a nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; #488 `5be03bca...` | -| GAP-051 | Exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; #488 `5be03bca...` | -| GAP-052 | All-covered Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; #488 `5be03bca...` | -| GAP-053 | Strict-interior Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; #488 `5be03bca...` | -| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; #488 `5be03bca...` | -| GAP-055 | Strict-interior Wilson lower endpoint could accept a nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; #488 `5be03bca...` | -| GAP-056 | Durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; #488 `5be03bca...` | -| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from a generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; #488 `5be03bca...` | -| GAP-058 | Generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; #488 `5be03bca...` | -| GAP-059 | Generic Monte Carlo summary could materially misstate positive SE relative to `SD / sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; #488 `5be03bca...` | -| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; #488 `5be03bca...` | -| GAP-061 | Generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; #488 `5be03bca...` | -| GAP-062 | Finite-tolerance matching could fail while the pair is deterministically outside every finite tolerance | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; #488 `5be03bca...` | -| GAP-063 | Exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; #488 `5be03bca...` | -| GAP-064 | Positive point RMSE could carry SE above the declared squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; #488 `5be03bca...` | -| GAP-065 | Positive Monte Carlo RMSE could carry spread/SE impossible for nonnegative replications | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; #488 `5be03bca...` | -| GAP-066 | RMSE Monte Carlo nearest-rank percentile could exceed total nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; #488 `5be03bca...` | -| GAP-067 | Generic nearest-rank percentile endpoint could be individually incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected over-strong repair `2798e4f9...`; causal repair `c7151b49...`; edge `dbef285b...`; changelog `c38a320c...`; research `2bbcbb24...`; #488 `5be03bca...` | -| GAP-068 | Distinct generic percentile endpoints could each pass individual radius checks while jointly exceeding the sample squared-deviation budget | `verification-pending` | RED `c4a13826...` + causal repair `cb3f80a2...` + changelog `f727450d...`; #488 `5be03bca...` | -| GAP-069 | Two-replication distinct nearest-rank endpoints could exhaust the retained sample while the stored mean or SD remained impossible | `verification-pending` | RED `81bf0d9e...` + causal repair `d48f8fef...` + mean coverage `fb314d8a...` + branch cleanup `440b78d8...` + changelog `45116498...` + research; #488 `5be03bca...`; exact-head GREEN/review/main integration | -| GAP-070 | Stored Wilson bounds could contain empirical coverage while the lower/upper pair could not arise from one Wilson score interval for that same coverage | `verification-pending` | RED `a839c606...` + causal repair `38c5b8e8...` + complementary edge `c1cb16a7...` + changelog `6af0821b...` + research/current #488 `5be03bca...`; exact-head GREEN/review/main integration | +| GAP-050 | Zero-multiplier SE-aware acceptance could erase a nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; #488 `1246c583...` | +| GAP-051 | Exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; #488 `1246c583...` | +| GAP-052 | All-covered Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; #488 `1246c583...` | +| GAP-053 | Strict-interior Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; #488 `1246c583...` | +| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; #488 `1246c583...` | +| GAP-055 | Strict-interior Wilson lower endpoint could accept a nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; #488 `1246c583...` | +| GAP-056 | Durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; #488 `1246c583...` | +| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from a generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; #488 `1246c583...` | +| GAP-058 | Generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; #488 `1246c583...` | +| GAP-059 | Generic Monte Carlo summary could materially misstate positive SE relative to `SD / sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; #488 `1246c583...` | +| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; #488 `1246c583...` | +| GAP-061 | Generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; #488 `1246c583...` | +| GAP-062 | Finite-tolerance matching could fail while the pair is deterministically outside every finite tolerance | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; #488 `1246c583...` | +| GAP-063 | Exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; #488 `1246c583...` | +| GAP-064 | Positive point RMSE could carry SE above the declared squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; #488 `1246c583...` | +| GAP-065 | Positive Monte Carlo RMSE could carry spread/SE impossible for nonnegative replications | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; #488 `1246c583...` | +| GAP-066 | RMSE Monte Carlo nearest-rank percentile could exceed total nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; #488 `1246c583...` | +| GAP-067 | Generic nearest-rank percentile endpoint could be individually incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected over-strong repair `2798e4f9...`; causal repair `c7151b49...`; edge `dbef285b...`; changelog `c38a320c...`; research `2bbcbb24...`; #488 `1246c583...` | +| GAP-068 | Distinct generic percentile endpoints could each pass individual radius checks while jointly exceeding the sample squared-deviation budget | `verification-pending` | RED `c4a13826...` + causal repair `cb3f80a2...` + changelog `f727450d...`; #488 `1246c583...` | +| GAP-069 | Two-replication distinct nearest-rank endpoints could exhaust the retained sample while the stored mean or SD remained impossible | `verification-pending` | RED `81bf0d9e...` + causal repair `d48f8fef...` + mean coverage `fb314d8a...` + branch cleanup `440b78d8...` + changelog `45116498...` + research; #488 `1246c583...`; exact-head GREEN/review/main integration | +| GAP-070 | Stored Wilson bounds could contain empirical coverage while the lower/upper pair could not arise from one Wilson score interval for that same coverage | `verification-pending` | RED `a839c606...` + causal repair `38c5b8e8...` + complementary edge `c1cb16a7...` + changelog `6af0821b...` + dependent fixture doctoring + research/current #488 `1246c583...`; exact-head GREEN/review/main integration | +| GAP-071 | Durable Wilson coverage evidence does not retain the empirical denominator or critical value, so exact recomputation, confidence-level interpretation, and denominator provenance cannot be verified from `ValidationReport` alone | `active-design` | add versioned coverage-evidence provenance carrying retained denominator and critical-value/confidence-level semantics; RED round-trip/recompute contracts; preserve backward migration and fail closed when provenance is required but absent | ## Release gate From 53ec435f32363f42dca2be63c5f6268f7ec9f9e2 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 4 Sep 2026 14:42:05 +0900 Subject: [PATCH 160/235] docs(gap): record all-covered Wilson support repair --- docs/product-technical-gap-baseline.md | 23 ++++++++++++----------- 1 file changed, 12 insertions(+), 11 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index aa7f9aa75..c76b4c963 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-04T05:18:00Z +**Snapshot:** 2026-09-04T05:42:00Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` **Workspace version:** `0.2.0` @@ -30,7 +30,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `1246c583161d7f64a7d33139cec46665ee745584` | true | `main` | Validation Evidence numerical/artifact repair. Current finding rejects stored Wilson endpoint pairs that contain empirical coverage but cannot be the roots of one Wilson score interval for that coverage. Self-review repaired dependent fixtures so unrelated tests remain scientifically coherent. Exact-head hosted gates and independent review remain required. | +| #488 | `b6a6604b405a1119357813fa4d97b54a4d9a4b01` | true | `main` | Validation Evidence numerical/artifact repair. Current finding rejects exact all-covered Wilson evidence with a zero lower endpoint because the canonical `n/(n+z²)` producer is strictly positive for every accepted non-empty sample and finite represented `z²`. Exact-head hosted gates and independent review remain required. | | #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 | Validation / Analysis Run fold child. Unique evidence must be inherited by a conflict-resolving survivor; child-head CI does not transfer. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | @@ -50,7 +50,7 @@ TEPP owns temporal/event composition, irregular time, time-varying multilevel/cr `psychometric_core` is not authority for new temporal/state composition. fast-mlsirm owns reusable static/generalized-mixed/dependence-aware psychometric specification and arithmetic. TEPP consumes only immutable released/versioned Published Language through an ACL; source copying and mutable sibling-head dependencies are prohibited. -contextual-orchestrator owns provider/model routing and semantic LLM execution. Its protected main is currently `17095dad706199a2e108ea6c20d7e6f1f5ac3b89`, but GitHub releases remain zero. Semantic LLM work and model-backed Actions therefore continue to require a future released/versioned contextual-orchestrator contract; Actions use `orchestrator/free` through the gateway credential and must not select providers/models/groups or consume direct provider keys. Mutable owner main is evidence, not a TEPP production contract. Context Graph contracts are contract-only integration authority; EA Core owns enterprise-architecture decisions. No cross-service SQL. +contextual-orchestrator owns provider/model routing and semantic LLM execution. Its protected main is currently `60c562defc81fb1897fa97ebdb5bf8f69eae0c55`, but GitHub releases remain zero. Semantic LLM work and model-backed Actions therefore continue to require a future released/versioned contextual-orchestrator contract; Actions use `orchestrator/free` through the gateway credential and must not select providers/models/groups or consume direct provider keys. Mutable owner main is evidence, not a TEPP production contract. Context Graph contracts are contract-only integration authority; EA Core owns enterprise-architecture decisions. No cross-service SQL. The clock contract separates event/valid time, assertion time, document time, system time, available time, and knowledge cutoff. Retrospective evidence may describe an earlier event but cannot enter an earlier knowledge cutoff. Forward state/transition edges remain distinct from retrospective/citation/revision/provenance relations. @@ -69,7 +69,7 @@ The clock contract separates event/valid time, assertion time, document time, sy - When the generic carrier occupies `ValidationReport::monte_carlo_rmse`, retained replications are nonnegative; positive mean implies `SE(mean) <= mean`, and inclusive nearest-rank endpoints cannot exceed the nonnegative sample-sum support `n * mean`. These typed bounds are not imposed on signed metrics such as bias. - SE-aware acceptance is `|estimate - target| <= k * SE`. For `k = 0` or exact-zero SE, exact recovery is evaluated before scale reduction; `-0.0` and `+0.0` are one numeric zero-valued scientific state. - `match_count` is a finite-threshold decision and does not require materializing an unrepresentable absolute residual; `absolute_residuals` remains fail closed when the magnitude itself is requested. -- Wilson interval coverage evidence preserves representable endpoints through stable rationalized/complementary forms rather than cancellation-prone center±margin evaluation. A stored lower/upper pair must also satisfy the Wilson root identity for the same empirical coverage after eliminating the unrecorded `z²/n` term; containment alone is not sufficient evidence of a coherent Wilson interval. This is a necessary artifact-level check, not denominator/critical-value provenance. +- Wilson interval coverage evidence preserves representable endpoints through stable rationalized/complementary forms rather than cancellation-prone center±margin evaluation. A stored lower/upper pair must also satisfy the Wilson root identity for the same empirical coverage after eliminating the unrecorded `z²/n` term; containment alone is not sufficient evidence of a coherent Wilson interval. At exact all-covered `p = 1`, the eliminated identity degenerates, but the canonical non-empty finite-`z²` producer still requires `coverage_wilson_lower > 0`; `[0,1]` is therefore invalid durable evidence. The `p = 0` boundary is intentionally asymmetric because represented `z² = 0` can make the producer's upper endpoint zero. These are necessary artifact-level checks, not denominator/critical-value provenance. - Durable and human-facing Validation Evidence must preserve producing-metric invariants on explicit validation, serde ingress/egress, and human projection. Finiteness alone is not evidence validity. - Bias, RMSE, and Monte Carlo may share private deterministic scalar support inside `validation_core`, but metric-specific cancellation/normalization, denominator, uncertainty, and fail-closed semantics remain with their bounded modules. - Historical-cutoff admission occurs before duplicate-identity checks. Future-unavailable evidence cannot change an earlier run's conflicts, counts, or terminal state. @@ -84,17 +84,17 @@ The clock contract separates event/valid time, assertion time, document time, sy ### #488 — Validation Evidence -#488 is the generic Validation Evidence landing vehicle at exact head `1246c583161d7f64a7d33139cec46665ee745584`. It remains distinct from Longitudinal Modeling and does not consume mutable fast-mlsirm source. +#488 is the generic Validation Evidence landing vehicle at exact head `b6a6604b405a1119357813fa4d97b54a4d9a4b01`. It remains distinct from Longitudinal Modeling and does not consume mutable fast-mlsirm source. -The preceding RMSE, bias, stable-Wilson arithmetic, Monte Carlo SE, durable-artifact, typed-RMSE, matching, individual/joint percentile moment-support, and two-replication exhaustion lineages remain in branch ancestry and GAP-045–GAP-069. +The preceding RMSE, bias, stable-Wilson arithmetic, Monte Carlo SE, durable-artifact, typed-RMSE, matching, individual/joint percentile moment-support, two-replication exhaustion, and Wilson endpoint-pair coherence lineages remain in branch ancestry and GAP-045–GAP-070. -Fresh review found a durable Wilson-artifact coherence hole. The predecessor accepted any ordered Wilson endpoints containing the recorded empirical coverage. At `p = 0.5`, `[0.2, 0.9]` passes those checks but no Wilson score interval can produce it because the roots must be symmetric about `0.5`. More generally, with `a = z²/n`, Wilson roots satisfy `LU = p²/(1+a)` and `L+U = 1 + (2p-1)/(1+a)`; eliminating `a` yields `p²(L+U-1) = (2p-1)LU`. Below `p = 0.5`, the complementary uncovered-proportion identity is used to avoid squaring a tiny `p`. +The latest review found a boundary hole left by the eliminated Wilson-root identity. At exact empirical coverage `p = 1`, `U = 1` makes that identity degenerate, so the predecessor accepted `L = 0`. The canonical producer cannot emit that state: for a non-empty sample and finite represented `z²`, it returns `L = n / (n + z²) > 0`, `U = 1`. Even a positive `z` whose square underflows to represented zero yields `L = 1`, not zero. -Public RED `a839c606fb2329ce1b339eb235c79e02abf40e16`; causal admission repair `38c5b8e83fe2433167afb6ece13e72b6608ceb03`; asymmetric/complement edge `c1cb16a78499648c10d6d5a8dad5e212a267064a`; changelog `6af0821bc2fca3e9f101cfa4ad36048ecfaa6ddd`; dependent-fixture doctoring through `59e40b4f0ebbb3b991c84724ded157ffe974abcd`; research/current #488 `1246c583161d7f64a7d33139cec46665ee745584`. +Public RED `ce714f077fe1575b50f1b97131e1857ad0c69b1e` adds the all-covered positive-lower contract. Two intermediate source edits (`422745c8...`, `b2f46d6f...`) introduced unrelated transcription defects and are not counted as repair evidence; non-force restore `184990522287e254a8e4c1995c02bce20aaa288e` reinstates the exact predecessor `report.rs` blob while retaining the RED. Causal source repair `72e9d9546e4bf98a63544d6e76a92116da5bf670` makes the sole surviving source change by requiring `coverage_wilson_lower > 0.0` for exact all-covered evidence. Changelog `e3a2f4a27a9355c77c2aa9aad92793d254536439`; research/current #488 `b6a6604b405a1119357813fa4d97b54a4d9a4b01`. -The new check is deliberately necessary rather than falsely sufficient. `ValidationReport` does not retain the interval-coverage denominator or Wilson critical value `z`, so exact recomputation, confidence-level interpretation, and denominator provenance cannot be proved from the current artifact. That limitation is GAP-071 rather than information inferred by the current repair. The producer also permits positive `z` values whose squared binary64 representation underflows to zero; artifact admission therefore does not invent a non-degeneracy rule that the producer itself does not guarantee. +The prior pair-coherence lineage remains intact: RED `a839c606fb2329ce1b339eb235c79e02abf40e16`; causal admission repair `38c5b8e83fe2433167afb6ece13e72b6608ceb03`; asymmetric/complement edge `c1cb16a78499648c10d6d5a8dad5e212a267064a`; changelog `6af0821bc2fca3e9f101cfa4ad36048ecfaa6ddd`; dependent-fixture doctoring through `59e40b4f0ebbb3b991c84724ded157ffe974abcd`. -Self-review changed old unrelated report fixtures from arbitrary Wilson-looking values to the exactly coherent `p=0.5`, `[0.2,0.8]` pair. Typed RMSE RED fixtures were also rechecked against predecessor generic `MonteCarloSummary` support so each test still fails for the intended typed invariant rather than an earlier generic one. No coverage or security gate was weakened. +The artifact checks remain deliberately necessary rather than falsely sufficient. `ValidationReport` does not retain the interval-coverage denominator or Wilson critical value `z`, so exact recomputation, confidence-level interpretation, and denominator provenance cannot be proved from the current artifact. That limitation remains GAP-071 rather than information inferred by the current repairs. Wilson (1927) remains the primary score-interval reference. AERA/APA/NCME (2014) remains the current published testing-standards edition while revision is underway. Exact-head hosted Rust/documentation/security/supply-chain/100%-coverage gates and a qualifying independent current-head review remain required. @@ -104,7 +104,7 @@ Wilson (1927) remains the primary score-interval reference. AERA/APA/NCME (2014) ### #480 — contextual-orchestrator boundary -#480 removes TEPP-owned provider discovery/ranking and requires a released contextual-orchestrator owner contract. Its exact source head remains `01f45a99392457334a4f6d3d659f992af739eeee`. Fresh owner main is `17095dad706199a2e108ea6c20d7e6f1f5ac3b89`, but contextual-orchestrator still has zero GitHub releases. #480 therefore remains Draft until an immutable compatible release plus deployment/auth/schema/artifact provenance exists. Mutable owner main is evidence, not a production contract. +#480 removes TEPP-owned provider discovery/ranking and requires a released contextual-orchestrator owner contract. Its exact source head remains `01f45a99392457334a4f6d3d659f992af739eeee`. Fresh owner main is `60c562defc81fb1897fa97ebdb5bf8f69eae0c55`, but contextual-orchestrator still has zero GitHub releases. #480 therefore remains Draft until an immutable compatible release plus deployment/auth/schema/artifact provenance exists. Mutable owner main is evidence, not a production contract. ## Gap register @@ -181,6 +181,7 @@ Wilson (1927) remains the primary score-interval reference. AERA/APA/NCME (2014) | GAP-069 | Two-replication distinct nearest-rank endpoints could exhaust the retained sample while the stored mean or SD remained impossible | `verification-pending` | RED `81bf0d9e...` + causal repair `d48f8fef...` + mean coverage `fb314d8a...` + branch cleanup `440b78d8...` + changelog `45116498...` + research; #488 `1246c583...`; exact-head GREEN/review/main integration | | GAP-070 | Stored Wilson bounds could contain empirical coverage while the lower/upper pair could not arise from one Wilson score interval for that same coverage | `verification-pending` | RED `a839c606...` + causal repair `38c5b8e8...` + complementary edge `c1cb16a7...` + changelog `6af0821b...` + dependent fixture doctoring + research/current #488 `1246c583...`; exact-head GREEN/review/main integration | | GAP-071 | Durable Wilson coverage evidence does not retain the empirical denominator or critical value, so exact recomputation, confidence-level interpretation, and denominator provenance cannot be verified from `ValidationReport` alone | `active-design` | add versioned coverage-evidence provenance carrying retained denominator and critical-value/confidence-level semantics; RED round-trip/recompute contracts; preserve backward migration and fail closed when provenance is required but absent | +| GAP-072 | Exact all-covered Wilson evidence could retain a zero lower endpoint even though the canonical non-empty finite-`z²` producer always emits `n/(n+z²) > 0` | `verification-pending` | RED `ce714f07...` + non-force source-restore RCA `18499052...` + causal repair `72e9d954...` + changelog `e3a2f4a2...` + research/current #488 `b6a6604b...`; exact-head GREEN/review/main integration | ## Release gate From 37b66543e918d10be4258884b1764dc088d5f744 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 4 Sep 2026 15:07:53 +0900 Subject: [PATCH 161/235] docs(gaps): bind Wilson provenance to current Validation Evidence --- docs/product-technical-gap-baseline.md | 82 ++++++++++++-------------- 1 file changed, 38 insertions(+), 44 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index c76b4c963..75f9c801e 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-04T05:42:00Z +**Snapshot:** 2026-09-04T06:06:00Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` **Workspace version:** `0.2.0` @@ -30,7 +30,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `b6a6604b405a1119357813fa4d97b54a4d9a4b01` | true | `main` | Validation Evidence numerical/artifact repair. Current finding rejects exact all-covered Wilson evidence with a zero lower endpoint because the canonical `n/(n+z²)` producer is strictly positive for every accepted non-empty sample and finite represented `z²`. Exact-head hosted gates and independent review remain required. | +| #488 | `c6ce28b1825dbbb7b4376be0ff218a2159ce401a` | true | `main` | Validation Evidence landing vehicle. `WilsonCoverageEvidenceV1` now retains denominator/count, standard-normal `z`, two-sided semantics, represented coverage and canonical Wilson endpoints; `ValidationEvidenceV1` binds those values to the legacy report projection. Consumer adoption, exact-head hosted gates and independent review remain required. | | #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 | Validation / Analysis Run fold child. Unique evidence must be inherited by a conflict-resolving survivor; child-head CI does not transfer. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | @@ -50,9 +50,9 @@ TEPP owns temporal/event composition, irregular time, time-varying multilevel/cr `psychometric_core` is not authority for new temporal/state composition. fast-mlsirm owns reusable static/generalized-mixed/dependence-aware psychometric specification and arithmetic. TEPP consumes only immutable released/versioned Published Language through an ACL; source copying and mutable sibling-head dependencies are prohibited. -contextual-orchestrator owns provider/model routing and semantic LLM execution. Its protected main is currently `60c562defc81fb1897fa97ebdb5bf8f69eae0c55`, but GitHub releases remain zero. Semantic LLM work and model-backed Actions therefore continue to require a future released/versioned contextual-orchestrator contract; Actions use `orchestrator/free` through the gateway credential and must not select providers/models/groups or consume direct provider keys. Mutable owner main is evidence, not a TEPP production contract. Context Graph contracts are contract-only integration authority; EA Core owns enterprise-architecture decisions. No cross-service SQL. +contextual-orchestrator owns provider/model routing and semantic LLM execution. Its last fresh protected-main evidence is `60c562defc81fb1897fa97ebdb5bf8f69eae0c55`, while GitHub releases remain zero. Semantic LLM work and model-backed Actions therefore continue to require a released/versioned contextual-orchestrator contract; Actions use `orchestrator/free` through the gateway credential and do not select providers/models/groups or consume direct provider keys. Mutable owner main is evidence, not a TEPP production contract. Context Graph contracts are contract-only integration authority; EA Core owns enterprise-architecture decisions. No cross-service SQL. -The clock contract separates event/valid time, assertion time, document time, system time, available time, and knowledge cutoff. Retrospective evidence may describe an earlier event but cannot enter an earlier knowledge cutoff. Forward state/transition edges remain distinct from retrospective/citation/revision/provenance relations. +The clock contract separates event/valid time, assertion time, document time, system time, availability time, and knowledge cutoff. Retrospective evidence may describe an earlier event but cannot enter an earlier knowledge cutoff. Forward state/transition edges remain distinct from retrospective/citation/revision/provenance relations. ## Scientific invariants @@ -69,8 +69,8 @@ The clock contract separates event/valid time, assertion time, document time, sy - When the generic carrier occupies `ValidationReport::monte_carlo_rmse`, retained replications are nonnegative; positive mean implies `SE(mean) <= mean`, and inclusive nearest-rank endpoints cannot exceed the nonnegative sample-sum support `n * mean`. These typed bounds are not imposed on signed metrics such as bias. - SE-aware acceptance is `|estimate - target| <= k * SE`. For `k = 0` or exact-zero SE, exact recovery is evaluated before scale reduction; `-0.0` and `+0.0` are one numeric zero-valued scientific state. - `match_count` is a finite-threshold decision and does not require materializing an unrepresentable absolute residual; `absolute_residuals` remains fail closed when the magnitude itself is requested. -- Wilson interval coverage evidence preserves representable endpoints through stable rationalized/complementary forms rather than cancellation-prone center±margin evaluation. A stored lower/upper pair must also satisfy the Wilson root identity for the same empirical coverage after eliminating the unrecorded `z²/n` term; containment alone is not sufficient evidence of a coherent Wilson interval. At exact all-covered `p = 1`, the eliminated identity degenerates, but the canonical non-empty finite-`z²` producer still requires `coverage_wilson_lower > 0`; `[0,1]` is therefore invalid durable evidence. The `p = 0` boundary is intentionally asymmetric because represented `z² = 0` can make the producer's upper endpoint zero. These are necessary artifact-level checks, not denominator/critical-value provenance. -- Durable and human-facing Validation Evidence must preserve producing-metric invariants on explicit validation, serde ingress/egress, and human projection. Finiteness alone is not evidence validity. +- Wilson interval coverage preserves representable endpoints through stable rationalized/complementary forms. Legacy `ValidationReport` endpoint pairs satisfy necessary Wilson coherence and boundary checks, but exact provenance is not inferred from them. `WilsonCoverageEvidenceV1` retains `sample_count`, `covered_count`, `critical_value_kind=standard_normal_z`, `interval_sidedness=two_sided`, the numeric `z`, represented coverage, and canonical endpoints and validates them by exact recomputation through the single crate-private Wilson authority. `ValidationEvidenceV1` binds that provenance to the legacy report projection without breaking existing report callers. +- Durable and human-facing Validation Evidence must preserve producing-metric invariants on explicit validation, serde ingress/egress, and human projection. Missing v1 provenance is never synthesized from endpoint algebra. - Bias, RMSE, and Monte Carlo may share private deterministic scalar support inside `validation_core`, but metric-specific cancellation/normalization, denominator, uncertainty, and fail-closed semantics remain with their bounded modules. - Historical-cutoff admission occurs before duplicate-identity checks. Future-unavailable evidence cannot change an earlier run's conflicts, counts, or terminal state. - Supported temporal estimators require state/trajectory and claimed-structure recovery, bias/RMSE, interval coverage, convergence, uncertainty calibration, reproducibility, and leakage-safe rolling-origin evidence. @@ -84,19 +84,13 @@ The clock contract separates event/valid time, assertion time, document time, sy ### #488 — Validation Evidence -#488 is the generic Validation Evidence landing vehicle at exact head `b6a6604b405a1119357813fa4d97b54a4d9a4b01`. It remains distinct from Longitudinal Modeling and does not consume mutable fast-mlsirm source. +#488 is the generic Validation Evidence landing vehicle at exact head `c6ce28b1825dbbb7b4376be0ff218a2159ce401a`. It remains distinct from Longitudinal Modeling and does not consume mutable fast-mlsirm source. -The preceding RMSE, bias, stable-Wilson arithmetic, Monte Carlo SE, durable-artifact, typed-RMSE, matching, individual/joint percentile moment-support, two-replication exhaustion, and Wilson endpoint-pair coherence lineages remain in branch ancestry and GAP-045–GAP-070. +GAP-070 and GAP-072 remain inherited: stored Wilson endpoints must be one coherent score interval, and exact all-covered evidence cannot use a zero lower endpoint. GAP-071 has advanced from design-only to source implementation. The first test draft `9fc96345...` was invalid and is not evidence; corrected public RED `6f6e06d2...` requires a versioned denominator/critical-value carrier. `ca517ed3...` establishes one private covered-count/Wilson-from-counts authority; `31e1ab2b...` adds `WilsonCoverageEvidenceV1`; `e9c63926...`/`fdd24a1a...` bind standard-normal/two-sided semantics. Envelope RED `07766cb0...` and repair `a16f22e6...` add `ValidationEvidenceV1`, which cross-validates the legacy report projection against the recomputable carrier. The accidental unrelated `lib.rs` wording mutation in `4e2381f3...` is excluded from repair evidence and was corrected non-force by `57d8bf57...`. Changelog `6e546742...`; research/current #488 `c6ce28b1...`. -The latest review found a boundary hole left by the eliminated Wilson-root identity. At exact empirical coverage `p = 1`, `U = 1` makes that identity degenerate, so the predecessor accepted `L = 0`. The canonical producer cannot emit that state: for a non-empty sample and finite represented `z²`, it returns `L = n / (n + z²) > 0`, `U = 1`. Even a positive `z` whose square underflows to represented zero yields `L = 1`, not zero. +This closes the missing-source-contract portion of GAP-071 but not delivery: exact-head hosted gates, independent review, protected-main integration, and adoption by durable consumers that require v1 provenance remain outstanding. Bare legacy `ValidationReport` remains a backward-compatible compact projection and is not silently treated as v1 provenance. -Public RED `ce714f077fe1575b50f1b97131e1857ad0c69b1e` adds the all-covered positive-lower contract. Two intermediate source edits (`422745c8...`, `b2f46d6f...`) introduced unrelated transcription defects and are not counted as repair evidence; non-force restore `184990522287e254a8e4c1995c02bce20aaa288e` reinstates the exact predecessor `report.rs` blob while retaining the RED. Causal source repair `72e9d9546e4bf98a63544d6e76a92116da5bf670` makes the sole surviving source change by requiring `coverage_wilson_lower > 0.0` for exact all-covered evidence. Changelog `e3a2f4a27a9355c77c2aa9aad92793d254536439`; research/current #488 `b6a6604b405a1119357813fa4d97b54a4d9a4b01`. - -The prior pair-coherence lineage remains intact: RED `a839c606fb2329ce1b339eb235c79e02abf40e16`; causal admission repair `38c5b8e83fe2433167afb6ece13e72b6608ceb03`; asymmetric/complement edge `c1cb16a78499648c10d6d5a8dad5e212a267064a`; changelog `6af0821bc2fca3e9f101cfa4ad36048ecfaa6ddd`; dependent-fixture doctoring through `59e40b4f0ebbb3b991c84724ded157ffe974abcd`. - -The artifact checks remain deliberately necessary rather than falsely sufficient. `ValidationReport` does not retain the interval-coverage denominator or Wilson critical value `z`, so exact recomputation, confidence-level interpretation, and denominator provenance cannot be proved from the current artifact. That limitation remains GAP-071 rather than information inferred by the current repairs. - -Wilson (1927) remains the primary score-interval reference. AERA/APA/NCME (2014) remains the current published testing-standards edition while revision is underway. Exact-head hosted Rust/documentation/security/supply-chain/100%-coverage gates and a qualifying independent current-head review remain required. +Wilson (1927) remains the primary score-interval reference. AERA/APA/NCME (2014) remains the current published testing-standards edition while revision is underway. ### #416 — Validation / Analysis Run consolidation @@ -104,7 +98,7 @@ Wilson (1927) remains the primary score-interval reference. AERA/APA/NCME (2014) ### #480 — contextual-orchestrator boundary -#480 removes TEPP-owned provider discovery/ranking and requires a released contextual-orchestrator owner contract. Its exact source head remains `01f45a99392457334a4f6d3d659f992af739eeee`. Fresh owner main is `60c562defc81fb1897fa97ebdb5bf8f69eae0c55`, but contextual-orchestrator still has zero GitHub releases. #480 therefore remains Draft until an immutable compatible release plus deployment/auth/schema/artifact provenance exists. Mutable owner main is evidence, not a production contract. +#480 removes TEPP-owned provider discovery/ranking and requires a released contextual-orchestrator owner contract. Its exact source head remains `01f45a99392457334a4f6d3d659f992af739eeee`. contextual-orchestrator protected main has advanced, but GitHub releases remain zero, so #480 stays Draft until an immutable compatible release plus deployment/auth/schema/artifact provenance exists. Mutable owner main is evidence, not a production contract. ## Gap register @@ -154,34 +148,34 @@ Wilson (1927) remains the primary score-interval reference. AERA/APA/NCME (2014) | GAP-042 | Ratio-first logarithm could nearly double an adjacent-float irregular residual growth rate | `verification-pending` | RED `766ddc7a...` + `ln_1p` repair `16f21d9a...` | | GAP-043 | Duplicate known-truth component identities could silently reweight RMSE recovery evidence | `verification-pending` | RED `698f12f5...` + uniqueness repair `2fae4cb2...` | | GAP-044 | Known-truth RMSE alignment/accumulation depended on row order instead of component identity | `verification-pending` | RED `8ad72ac9...` / `5fb93c40...` + repairs `2dd9537e...` / `025dce7f...`; #310 `c6680450...` | -| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; #488 `1246c583...` | -| GAP-046 | Bias SE could reject a representable SEM because raw squared deviations/intermediates overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; #488 `1246c583...` | -| GAP-047 | Generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; #488 `1246c583...` | -| GAP-048 | Mean signed bias could erase a representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; #488 `1246c583...` | +| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; #488 `c6ce28b1...` | +| GAP-046 | Bias SE could reject a representable SEM because raw squared deviations/intermediates overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; #488 `c6ce28b1...` | +| GAP-047 | Generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; #488 `c6ce28b1...` | +| GAP-048 | Mean signed bias could erase a representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; #488 `c6ce28b1...` | | GAP-049 | Stable `Between` recovery could be aliased across occasion indices and reweight RMSE | `verification-pending` | RED `0a03041c...` + repair `ec2c1219...`; #310 `c6680450...` | -| GAP-050 | Zero-multiplier SE-aware acceptance could erase a nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; #488 `1246c583...` | -| GAP-051 | Exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; #488 `1246c583...` | -| GAP-052 | All-covered Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; #488 `1246c583...` | -| GAP-053 | Strict-interior Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; #488 `1246c583...` | -| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; #488 `1246c583...` | -| GAP-055 | Strict-interior Wilson lower endpoint could accept a nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; #488 `1246c583...` | -| GAP-056 | Durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; #488 `1246c583...` | -| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from a generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; #488 `1246c583...` | -| GAP-058 | Generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; #488 `1246c583...` | -| GAP-059 | Generic Monte Carlo summary could materially misstate positive SE relative to `SD / sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; #488 `1246c583...` | -| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; #488 `1246c583...` | -| GAP-061 | Generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; #488 `1246c583...` | -| GAP-062 | Finite-tolerance matching could fail while the pair is deterministically outside every finite tolerance | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; #488 `1246c583...` | -| GAP-063 | Exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; #488 `1246c583...` | -| GAP-064 | Positive point RMSE could carry SE above the declared squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; #488 `1246c583...` | -| GAP-065 | Positive Monte Carlo RMSE could carry spread/SE impossible for nonnegative replications | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; #488 `1246c583...` | -| GAP-066 | RMSE Monte Carlo nearest-rank percentile could exceed total nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; #488 `1246c583...` | -| GAP-067 | Generic nearest-rank percentile endpoint could be individually incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected over-strong repair `2798e4f9...`; causal repair `c7151b49...`; edge `dbef285b...`; changelog `c38a320c...`; research `2bbcbb24...`; #488 `1246c583...` | -| GAP-068 | Distinct generic percentile endpoints could each pass individual radius checks while jointly exceeding the sample squared-deviation budget | `verification-pending` | RED `c4a13826...` + causal repair `cb3f80a2...` + changelog `f727450d...`; #488 `1246c583...` | -| GAP-069 | Two-replication distinct nearest-rank endpoints could exhaust the retained sample while the stored mean or SD remained impossible | `verification-pending` | RED `81bf0d9e...` + causal repair `d48f8fef...` + mean coverage `fb314d8a...` + branch cleanup `440b78d8...` + changelog `45116498...` + research; #488 `1246c583...`; exact-head GREEN/review/main integration | -| GAP-070 | Stored Wilson bounds could contain empirical coverage while the lower/upper pair could not arise from one Wilson score interval for that same coverage | `verification-pending` | RED `a839c606...` + causal repair `38c5b8e8...` + complementary edge `c1cb16a7...` + changelog `6af0821b...` + dependent fixture doctoring + research/current #488 `1246c583...`; exact-head GREEN/review/main integration | -| GAP-071 | Durable Wilson coverage evidence does not retain the empirical denominator or critical value, so exact recomputation, confidence-level interpretation, and denominator provenance cannot be verified from `ValidationReport` alone | `active-design` | add versioned coverage-evidence provenance carrying retained denominator and critical-value/confidence-level semantics; RED round-trip/recompute contracts; preserve backward migration and fail closed when provenance is required but absent | -| GAP-072 | Exact all-covered Wilson evidence could retain a zero lower endpoint even though the canonical non-empty finite-`z²` producer always emits `n/(n+z²) > 0` | `verification-pending` | RED `ce714f07...` + non-force source-restore RCA `18499052...` + causal repair `72e9d954...` + changelog `e3a2f4a2...` + research/current #488 `b6a6604b...`; exact-head GREEN/review/main integration | +| GAP-050 | Zero-multiplier SE-aware acceptance could erase a nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; #488 `c6ce28b1...` | +| GAP-051 | Exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; #488 `c6ce28b1...` | +| GAP-052 | All-covered Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; #488 `c6ce28b1...` | +| GAP-053 | Strict-interior Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; #488 `c6ce28b1...` | +| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; #488 `c6ce28b1...` | +| GAP-055 | Strict-interior Wilson lower endpoint could accept a nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; #488 `c6ce28b1...` | +| GAP-056 | Durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; #488 `c6ce28b1...` | +| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from a generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; #488 `c6ce28b1...` | +| GAP-058 | Generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; #488 `c6ce28b1...` | +| GAP-059 | Generic Monte Carlo summary could materially misstate positive SE relative to `SD / sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; #488 `c6ce28b1...` | +| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; #488 `c6ce28b1...` | +| GAP-061 | Generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; #488 `c6ce28b1...` | +| GAP-062 | Finite-tolerance matching could fail while the pair is deterministically outside every finite tolerance | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; #488 `c6ce28b1...` | +| GAP-063 | Exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; #488 `c6ce28b1...` | +| GAP-064 | Positive point RMSE could carry SE above the declared squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; #488 `c6ce28b1...` | +| GAP-065 | Positive Monte Carlo RMSE could carry spread/SE impossible for nonnegative replications | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; #488 `c6ce28b1...` | +| GAP-066 | RMSE Monte Carlo nearest-rank percentile could exceed total nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; #488 `c6ce28b1...` | +| GAP-067 | Generic nearest-rank percentile endpoint could be individually incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected over-strong repair `2798e4f9...`; causal repair `c7151b49...`; edge `dbef285b...`; changelog `c38a320c...`; research `2bbcbb24...`; #488 `c6ce28b1...` | +| GAP-068 | Distinct generic percentile endpoints could each pass individual radius checks while jointly exceeding the sample squared-deviation budget | `verification-pending` | RED `c4a13826...` + causal repair `cb3f80a2...` + changelog `f727450d...`; #488 `c6ce28b1...` | +| GAP-069 | Two-replication distinct nearest-rank endpoints could exhaust the retained sample while the stored mean or SD remained impossible | `verification-pending` | RED `81bf0d9e...` + causal repair `d48f8fef...` + mean coverage `fb314d8a...` + branch cleanup `440b78d8...` + changelog `45116498...`; #488 `c6ce28b1...` | +| GAP-070 | Stored Wilson bounds could contain empirical coverage while the lower/upper pair could not arise from one Wilson score interval for that same coverage | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...` + complementary edge `c1cb16a7...`; #488 `c6ce28b1...` | +| GAP-071 | Durable Wilson evidence lacked denominator and critical-value/sidedness provenance, preventing exact recomputation from a persisted artifact | `active-repair` | valid carrier RED `6f6e06d2...`; shared count/Wilson authority `ca517ed3...`; `WilsonCoverageEvidenceV1` `31e1ab2b...`; sidedness `e9c63926...`/`fdd24a1a...`; envelope RED `07766cb0...` + `ValidationEvidenceV1` repair `a16f22e6...`; docs/current #488 `c6ce28b1...`; remaining: hosted GREEN/review/main plus durable-consumer adoption | +| GAP-072 | Exact all-covered Wilson evidence could retain a zero lower endpoint even though the canonical non-empty finite-`z²` producer always emits `n/(n+z²) > 0` | `verification-pending` | RED `ce714f07...` + non-force source-restore RCA `18499052...` + repair `72e9d954...` + changelog `e3a2f4a2...`; inherited by #488 `c6ce28b1...` | ## Release gate From 432c1204e7ddd24c17613cd7ceb106c5b57d7622 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 4 Sep 2026 15:40:41 +0900 Subject: [PATCH 162/235] docs(ddd): register Wilson durable count precision gap --- docs/product-technical-gap-baseline.md | 71 ++++++++++++++------------ 1 file changed, 37 insertions(+), 34 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 75f9c801e..02c4732b9 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-04T06:06:00Z +**Snapshot:** 2026-09-04T06:38:00Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` **Workspace version:** `0.2.0` @@ -30,7 +30,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `c6ce28b1825dbbb7b4376be0ff218a2159ce401a` | true | `main` | Validation Evidence landing vehicle. `WilsonCoverageEvidenceV1` now retains denominator/count, standard-normal `z`, two-sided semantics, represented coverage and canonical Wilson endpoints; `ValidationEvidenceV1` binds those values to the legacy report projection. Consumer adoption, exact-head hosted gates and independent review remain required. | +| #488 | `a2c4ad8b8b441ce3cd9d15fcc66794ffd573d021` | true | `main` | Validation Evidence landing vehicle. `WilsonCoverageEvidenceV1` retains fixed-width `u64` denominator/count provenance, standard-normal `z`, two-sided semantics, represented coverage and canonical Wilson endpoints. Large-count recomputation preserves one-uncovered states above binary64's exact-integer range by evaluating the smaller complement instead of rounding both counts into an all-covered path. Consumer adoption, exact-head hosted gates and independent review remain required. | | #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 | Validation / Analysis Run fold child. Unique evidence must be inherited by a conflict-resolving survivor; child-head CI does not transfer. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | @@ -69,7 +69,7 @@ The clock contract separates event/valid time, assertion time, document time, sy - When the generic carrier occupies `ValidationReport::monte_carlo_rmse`, retained replications are nonnegative; positive mean implies `SE(mean) <= mean`, and inclusive nearest-rank endpoints cannot exceed the nonnegative sample-sum support `n * mean`. These typed bounds are not imposed on signed metrics such as bias. - SE-aware acceptance is `|estimate - target| <= k * SE`. For `k = 0` or exact-zero SE, exact recovery is evaluated before scale reduction; `-0.0` and `+0.0` are one numeric zero-valued scientific state. - `match_count` is a finite-threshold decision and does not require materializing an unrepresentable absolute residual; `absolute_residuals` remains fail closed when the magnitude itself is requested. -- Wilson interval coverage preserves representable endpoints through stable rationalized/complementary forms. Legacy `ValidationReport` endpoint pairs satisfy necessary Wilson coherence and boundary checks, but exact provenance is not inferred from them. `WilsonCoverageEvidenceV1` retains `sample_count`, `covered_count`, `critical_value_kind=standard_normal_z`, `interval_sidedness=two_sided`, the numeric `z`, represented coverage, and canonical endpoints and validates them by exact recomputation through the single crate-private Wilson authority. `ValidationEvidenceV1` binds that provenance to the legacy report projection without breaking existing report callers. +- Wilson interval coverage preserves representable endpoints through stable rationalized/complementary forms. Legacy `ValidationReport` endpoint pairs satisfy necessary Wilson coherence and boundary checks, but exact provenance is not inferred from them. `WilsonCoverageEvidenceV1` retains fixed-width `u64` `sample_count`/`covered_count`, `critical_value_kind=standard_normal_z`, `interval_sidedness=two_sided`, the numeric `z`, represented coverage, and canonical endpoints and validates them by exact recomputation through the single crate-private Wilson authority. Exact all-covered status is integer count equality, not rounded `p == 1`. When covered counts dominate, represented coverage and the Wilson interval are evaluated from the smaller uncovered complement and reflected, preserving count distinction beyond binary64's exact-integer range. `ValidationEvidenceV1` binds that provenance to the legacy report projection without breaking existing report callers. - Durable and human-facing Validation Evidence must preserve producing-metric invariants on explicit validation, serde ingress/egress, and human projection. Missing v1 provenance is never synthesized from endpoint algebra. - Bias, RMSE, and Monte Carlo may share private deterministic scalar support inside `validation_core`, but metric-specific cancellation/normalization, denominator, uncertainty, and fail-closed semantics remain with their bounded modules. - Historical-cutoff admission occurs before duplicate-identity checks. Future-unavailable evidence cannot change an earlier run's conflicts, counts, or terminal state. @@ -84,11 +84,13 @@ The clock contract separates event/valid time, assertion time, document time, sy ### #488 — Validation Evidence -#488 is the generic Validation Evidence landing vehicle at exact head `c6ce28b1825dbbb7b4376be0ff218a2159ce401a`. It remains distinct from Longitudinal Modeling and does not consume mutable fast-mlsirm source. +#488 is the generic Validation Evidence landing vehicle at exact head `a2c4ad8b8b441ce3cd9d15fcc66794ffd573d021`. It remains distinct from Longitudinal Modeling and does not consume mutable fast-mlsirm source. -GAP-070 and GAP-072 remain inherited: stored Wilson endpoints must be one coherent score interval, and exact all-covered evidence cannot use a zero lower endpoint. GAP-071 has advanced from design-only to source implementation. The first test draft `9fc96345...` was invalid and is not evidence; corrected public RED `6f6e06d2...` requires a versioned denominator/critical-value carrier. `ca517ed3...` establishes one private covered-count/Wilson-from-counts authority; `31e1ab2b...` adds `WilsonCoverageEvidenceV1`; `e9c63926...`/`fdd24a1a...` bind standard-normal/two-sided semantics. Envelope RED `07766cb0...` and repair `a16f22e6...` add `ValidationEvidenceV1`, which cross-validates the legacy report projection against the recomputable carrier. The accidental unrelated `lib.rs` wording mutation in `4e2381f3...` is excluded from repair evidence and was corrected non-force by `57d8bf57...`. Changelog `6e546742...`; research/current #488 `c6ce28b1...`. +GAP-070 and GAP-072 remain inherited: stored Wilson endpoints must be one coherent score interval, and exact all-covered evidence cannot use a zero lower endpoint. GAP-071 has advanced from design-only to source implementation. The first test draft `9fc96345...` was invalid and is not evidence; corrected public RED `6f6e06d2...` requires a versioned denominator/critical-value carrier. `ca517ed3...` establishes one private covered-count/Wilson-from-counts authority; `31e1ab2b...` adds `WilsonCoverageEvidenceV1`; `e9c63926...`/`fdd24a1a...` bind standard-normal/two-sided semantics. Envelope RED `07766cb0...` and repair `a16f22e6...` add `ValidationEvidenceV1`, which cross-validates the legacy report projection against the recomputable carrier. The accidental unrelated `lib.rs` wording mutation in `4e2381f3...` is excluded from repair evidence and was corrected non-force by `57d8bf57...`. -This closes the missing-source-contract portion of GAP-071 but not delivery: exact-head hosted gates, independent review, protected-main integration, and adoption by durable consumers that require v1 provenance remain outstanding. Bare legacy `ValidationReport` remains a backward-compatible compact projection and is not silently treated as v1 provenance. +GAP-073 closes a newly exposed large-count numerical/source-contract defect. Public RED `29d710a5...` uses `n = 2^53 + 1`, `k = 2^53`, and `z = 1.96` to require a one-uncovered durable artifact to retain represented coverage `0.9999999999999999` and Wilson lower `0.9999999999999993` instead of collapsing into an all-covered path. Causal repair `29968c80...` evaluates the smaller uncovered complement and reflects the Wilson endpoints; `91d9a3bb...` makes versioned count fields fixed-width `u64`; changelog `d908ce2a...`; research/current #488 `a2c4ad8b...`. + +This closes the missing-source-contract portion of GAP-071 and the source portion of GAP-073 but not delivery: exact-head hosted gates, independent review, protected-main integration, and adoption by durable consumers that require v1 provenance remain outstanding. Bare legacy `ValidationReport` remains a backward-compatible compact projection and is not silently treated as v1 provenance. Wilson (1927) remains the primary score-interval reference. AERA/APA/NCME (2014) remains the current published testing-standards edition while revision is underway. @@ -98,7 +100,7 @@ Wilson (1927) remains the primary score-interval reference. AERA/APA/NCME (2014) ### #480 — contextual-orchestrator boundary -#480 removes TEPP-owned provider discovery/ranking and requires a released contextual-orchestrator owner contract. Its exact source head remains `01f45a99392457334a4f6d3d659f992af739eeee`. contextual-orchestrator protected main has advanced, but GitHub releases remain zero, so #480 stays Draft until an immutable compatible release plus deployment/auth/schema/artifact provenance exists. Mutable owner main is evidence, not a production contract. +#480 removes TEPP-owned provider discovery/ranking and requires a released contextual-orchestrator owner contract. Its exact source head remains `01f45a99392457334a4f6d3d659f992af739eeee`. contextual-orchestrator protected main is `60c562defc81fb1897fa97ebdb5bf8f69eae0c55`, but GitHub releases remain zero, so #480 stays Draft until an immutable compatible release plus deployment/auth/schema/artifact provenance exists. Mutable owner main is evidence, not a production contract. ## Gap register @@ -148,34 +150,35 @@ Wilson (1927) remains the primary score-interval reference. AERA/APA/NCME (2014) | GAP-042 | Ratio-first logarithm could nearly double an adjacent-float irregular residual growth rate | `verification-pending` | RED `766ddc7a...` + `ln_1p` repair `16f21d9a...` | | GAP-043 | Duplicate known-truth component identities could silently reweight RMSE recovery evidence | `verification-pending` | RED `698f12f5...` + uniqueness repair `2fae4cb2...` | | GAP-044 | Known-truth RMSE alignment/accumulation depended on row order instead of component identity | `verification-pending` | RED `8ad72ac9...` / `5fb93c40...` + repairs `2dd9537e...` / `025dce7f...`; #310 `c6680450...` | -| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; #488 `c6ce28b1...` | -| GAP-046 | Bias SE could reject a representable SEM because raw squared deviations/intermediates overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; #488 `c6ce28b1...` | -| GAP-047 | Generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; #488 `c6ce28b1...` | -| GAP-048 | Mean signed bias could erase a representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; #488 `c6ce28b1...` | +| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; #488 `a2c4ad8b...` | +| GAP-046 | Bias SE could reject a representable SEM because raw squared deviations/intermediates overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; #488 `a2c4ad8b...` | +| GAP-047 | Generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; #488 `a2c4ad8b...` | +| GAP-048 | Mean signed bias could erase a representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; #488 `a2c4ad8b...` | | GAP-049 | Stable `Between` recovery could be aliased across occasion indices and reweight RMSE | `verification-pending` | RED `0a03041c...` + repair `ec2c1219...`; #310 `c6680450...` | -| GAP-050 | Zero-multiplier SE-aware acceptance could erase a nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; #488 `c6ce28b1...` | -| GAP-051 | Exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; #488 `c6ce28b1...` | -| GAP-052 | All-covered Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; #488 `c6ce28b1...` | -| GAP-053 | Strict-interior Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; #488 `c6ce28b1...` | -| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; #488 `c6ce28b1...` | -| GAP-055 | Strict-interior Wilson lower endpoint could accept a nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; #488 `c6ce28b1...` | -| GAP-056 | Durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; #488 `c6ce28b1...` | -| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from a generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; #488 `c6ce28b1...` | -| GAP-058 | Generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; #488 `c6ce28b1...` | -| GAP-059 | Generic Monte Carlo summary could materially misstate positive SE relative to `SD / sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; #488 `c6ce28b1...` | -| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; #488 `c6ce28b1...` | -| GAP-061 | Generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; #488 `c6ce28b1...` | -| GAP-062 | Finite-tolerance matching could fail while the pair is deterministically outside every finite tolerance | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; #488 `c6ce28b1...` | -| GAP-063 | Exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; #488 `c6ce28b1...` | -| GAP-064 | Positive point RMSE could carry SE above the declared squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; #488 `c6ce28b1...` | -| GAP-065 | Positive Monte Carlo RMSE could carry spread/SE impossible for nonnegative replications | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; #488 `c6ce28b1...` | -| GAP-066 | RMSE Monte Carlo nearest-rank percentile could exceed total nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; #488 `c6ce28b1...` | -| GAP-067 | Generic nearest-rank percentile endpoint could be individually incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected over-strong repair `2798e4f9...`; causal repair `c7151b49...`; edge `dbef285b...`; changelog `c38a320c...`; research `2bbcbb24...`; #488 `c6ce28b1...` | -| GAP-068 | Distinct generic percentile endpoints could each pass individual radius checks while jointly exceeding the sample squared-deviation budget | `verification-pending` | RED `c4a13826...` + causal repair `cb3f80a2...` + changelog `f727450d...`; #488 `c6ce28b1...` | -| GAP-069 | Two-replication distinct nearest-rank endpoints could exhaust the retained sample while the stored mean or SD remained impossible | `verification-pending` | RED `81bf0d9e...` + causal repair `d48f8fef...` + mean coverage `fb314d8a...` + branch cleanup `440b78d8...` + changelog `45116498...`; #488 `c6ce28b1...` | -| GAP-070 | Stored Wilson bounds could contain empirical coverage while the lower/upper pair could not arise from one Wilson score interval for that same coverage | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...` + complementary edge `c1cb16a7...`; #488 `c6ce28b1...` | -| GAP-071 | Durable Wilson evidence lacked denominator and critical-value/sidedness provenance, preventing exact recomputation from a persisted artifact | `active-repair` | valid carrier RED `6f6e06d2...`; shared count/Wilson authority `ca517ed3...`; `WilsonCoverageEvidenceV1` `31e1ab2b...`; sidedness `e9c63926...`/`fdd24a1a...`; envelope RED `07766cb0...` + `ValidationEvidenceV1` repair `a16f22e6...`; docs/current #488 `c6ce28b1...`; remaining: hosted GREEN/review/main plus durable-consumer adoption | -| GAP-072 | Exact all-covered Wilson evidence could retain a zero lower endpoint even though the canonical non-empty finite-`z²` producer always emits `n/(n+z²) > 0` | `verification-pending` | RED `ce714f07...` + non-force source-restore RCA `18499052...` + repair `72e9d954...` + changelog `e3a2f4a2...`; inherited by #488 `c6ce28b1...` | +| GAP-050 | Zero-multiplier SE-aware acceptance could erase a nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; #488 `a2c4ad8b...` | +| GAP-051 | Exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; #488 `a2c4ad8b...` | +| GAP-052 | All-covered Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; #488 `a2c4ad8b...` | +| GAP-053 | Strict-interior Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; #488 `a2c4ad8b...` | +| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; #488 `a2c4ad8b...` | +| GAP-055 | Strict-interior Wilson lower endpoint could accept a nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; #488 `a2c4ad8b...` | +| GAP-056 | Durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; #488 `a2c4ad8b...` | +| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from a generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; #488 `a2c4ad8b...` | +| GAP-058 | Generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; #488 `a2c4ad8b...` | +| GAP-059 | Generic Monte Carlo summary could materially misstate positive SE relative to `SD / sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; #488 `a2c4ad8b...` | +| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; #488 `a2c4ad8b...` | +| GAP-061 | Generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; #488 `a2c4ad8b...` | +| GAP-062 | Finite-tolerance matching could fail while the pair is deterministically outside every finite tolerance | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; #488 `a2c4ad8b...` | +| GAP-063 | Exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; #488 `a2c4ad8b...` | +| GAP-064 | Positive point RMSE could carry SE above the declared squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; #488 `a2c4ad8b...` | +| GAP-065 | Positive Monte Carlo RMSE could carry spread/SE impossible for nonnegative replications | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; #488 `a2c4ad8b...` | +| GAP-066 | RMSE Monte Carlo nearest-rank percentile could exceed total nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; #488 `a2c4ad8b...` | +| GAP-067 | Generic nearest-rank percentile endpoint could be individually incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected over-strong repair `2798e4f9...`; causal repair `c7151b49...`; edge `dbef285b...`; changelog `c38a320c...`; research `2bbcbb24...`; #488 `a2c4ad8b...` | +| GAP-068 | Distinct generic percentile endpoints could each pass individual radius checks while jointly exceeding the sample squared-deviation budget | `verification-pending` | RED `c4a13826...` + causal repair `cb3f80a2...` + changelog `f727450d...`; #488 `a2c4ad8b...` | +| GAP-069 | Two-replication distinct nearest-rank endpoints could exhaust the retained sample while the stored mean or SD remained impossible | `verification-pending` | RED `81bf0d9e...` + causal repair `d48f8fef...` + mean coverage `fb314d8a...` + branch cleanup `440b78d8...` + changelog `45116498...`; #488 `a2c4ad8b...` | +| GAP-070 | Stored Wilson bounds could contain empirical coverage while the lower/upper pair could not arise from one Wilson score interval for that same coverage | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...` + complementary edge `c1cb16a7...`; #488 `a2c4ad8b...` | +| GAP-071 | Durable Wilson evidence lacked denominator and critical-value/sidedness provenance, preventing exact recomputation from a persisted artifact | `active-repair` | valid carrier RED `6f6e06d2...`; shared count/Wilson authority `ca517ed3...`; `WilsonCoverageEvidenceV1` `31e1ab2b...`; sidedness `e9c63926...`/`fdd24a1a...`; envelope RED `07766cb0...` + `ValidationEvidenceV1` repair `a16f22e6...`; docs/current #488 `a2c4ad8b...`; remaining: hosted GREEN/review/main plus durable-consumer adoption | +| GAP-072 | Exact all-covered Wilson evidence could retain a zero lower endpoint even though the canonical non-empty finite-`z²` producer always emits `n/(n+z²) > 0` | `verification-pending` | RED `ce714f07...` + non-force source-restore RCA `18499052...` + repair `72e9d954...` + changelog `e3a2f4a2...`; inherited by #488 `a2c4ad8b...` | +| GAP-073 | Durable Wilson count provenance could round one uncovered observation away above binary64's exact-integer range and expose a pointer-width-dependent count schema | `verification-pending` | RED `29d710a5...` + complement/count repair `29968c80...` + fixed-width carrier repair `91d9a3bb...` + changelog `d908ce2a...`; research/current #488 `a2c4ad8b...` | ## Release gate From a1d813597d3968c2270f02545519478e7f880c41 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 4 Sep 2026 15:45:07 +0900 Subject: [PATCH 163/235] docs(ddd): advance Validation Evidence exact-head authority --- docs/product-technical-gap-baseline.md | 66 +++++++++++++------------- 1 file changed, 33 insertions(+), 33 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 02c4732b9..038625143 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-04T06:38:00Z +**Snapshot:** 2026-09-04T06:44:00Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` **Workspace version:** `0.2.0` @@ -30,7 +30,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `a2c4ad8b8b441ce3cd9d15fcc66794ffd573d021` | true | `main` | Validation Evidence landing vehicle. `WilsonCoverageEvidenceV1` retains fixed-width `u64` denominator/count provenance, standard-normal `z`, two-sided semantics, represented coverage and canonical Wilson endpoints. Large-count recomputation preserves one-uncovered states above binary64's exact-integer range by evaluating the smaller complement instead of rounding both counts into an all-covered path. Consumer adoption, exact-head hosted gates and independent review remain required. | +| #488 | `2809a5ccf42731198f32cbc27e8db09c15000ac8` | true | `main` | Validation Evidence landing vehicle. `WilsonCoverageEvidenceV1` retains fixed-width `u64` denominator/count provenance, standard-normal `z`, two-sided semantics, represented coverage and canonical Wilson endpoints. Large-count recomputation preserves one-uncovered states above binary64's exact-integer range by evaluating the smaller complement instead of rounding both counts into an all-covered path. IEEE 754-2019 and ISO/IEC 60559:2020 ground the current binary64 representation trace. Consumer adoption, exact-head hosted gates and independent review remain required. | | #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 | Validation / Analysis Run fold child. Unique evidence must be inherited by a conflict-resolving survivor; child-head CI does not transfer. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | @@ -84,15 +84,15 @@ The clock contract separates event/valid time, assertion time, document time, sy ### #488 — Validation Evidence -#488 is the generic Validation Evidence landing vehicle at exact head `a2c4ad8b8b441ce3cd9d15fcc66794ffd573d021`. It remains distinct from Longitudinal Modeling and does not consume mutable fast-mlsirm source. +#488 is the generic Validation Evidence landing vehicle at exact head `2809a5ccf42731198f32cbc27e8db09c15000ac8`. It remains distinct from Longitudinal Modeling and does not consume mutable fast-mlsirm source. GAP-070 and GAP-072 remain inherited: stored Wilson endpoints must be one coherent score interval, and exact all-covered evidence cannot use a zero lower endpoint. GAP-071 has advanced from design-only to source implementation. The first test draft `9fc96345...` was invalid and is not evidence; corrected public RED `6f6e06d2...` requires a versioned denominator/critical-value carrier. `ca517ed3...` establishes one private covered-count/Wilson-from-counts authority; `31e1ab2b...` adds `WilsonCoverageEvidenceV1`; `e9c63926...`/`fdd24a1a...` bind standard-normal/two-sided semantics. Envelope RED `07766cb0...` and repair `a16f22e6...` add `ValidationEvidenceV1`, which cross-validates the legacy report projection against the recomputable carrier. The accidental unrelated `lib.rs` wording mutation in `4e2381f3...` is excluded from repair evidence and was corrected non-force by `57d8bf57...`. -GAP-073 closes a newly exposed large-count numerical/source-contract defect. Public RED `29d710a5...` uses `n = 2^53 + 1`, `k = 2^53`, and `z = 1.96` to require a one-uncovered durable artifact to retain represented coverage `0.9999999999999999` and Wilson lower `0.9999999999999993` instead of collapsing into an all-covered path. Causal repair `29968c80...` evaluates the smaller uncovered complement and reflects the Wilson endpoints; `91d9a3bb...` makes versioned count fields fixed-width `u64`; changelog `d908ce2a...`; research/current #488 `a2c4ad8b...`. +GAP-073 closes a newly exposed large-count numerical/source-contract defect. Public RED `29d710a5...` uses `n = 2^53 + 1`, `k = 2^53`, and `z = 1.96` to require a one-uncovered durable artifact to retain represented coverage `0.9999999999999999` and Wilson lower `0.9999999999999993` instead of collapsing into an all-covered path. Causal repair `29968c80...` evaluates the smaller uncovered complement and reflects the Wilson endpoints; `91d9a3bb...` makes versioned count fields fixed-width `u64`; changelog `d908ce2a...`; standards/research/current #488 `2809a5cc...`. This closes the missing-source-contract portion of GAP-071 and the source portion of GAP-073 but not delivery: exact-head hosted gates, independent review, protected-main integration, and adoption by durable consumers that require v1 provenance remain outstanding. Bare legacy `ValidationReport` remains a backward-compatible compact projection and is not silently treated as v1 provenance. -Wilson (1927) remains the primary score-interval reference. AERA/APA/NCME (2014) remains the current published testing-standards edition while revision is underway. +Wilson (1927) remains the primary score-interval reference. AERA/APA/NCME (2014) remains the current published testing-standards edition while revision is underway. IEEE 754-2019 and ISO/IEC 60559:2020 remain the published active floating-point authorities used for the current binary64 representation trace; active IEEE P754 is not treated as a published replacement. ### #416 — Validation / Analysis Run consolidation @@ -150,35 +150,35 @@ Wilson (1927) remains the primary score-interval reference. AERA/APA/NCME (2014) | GAP-042 | Ratio-first logarithm could nearly double an adjacent-float irregular residual growth rate | `verification-pending` | RED `766ddc7a...` + `ln_1p` repair `16f21d9a...` | | GAP-043 | Duplicate known-truth component identities could silently reweight RMSE recovery evidence | `verification-pending` | RED `698f12f5...` + uniqueness repair `2fae4cb2...` | | GAP-044 | Known-truth RMSE alignment/accumulation depended on row order instead of component identity | `verification-pending` | RED `8ad72ac9...` / `5fb93c40...` + repairs `2dd9537e...` / `025dce7f...`; #310 `c6680450...` | -| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; #488 `a2c4ad8b...` | -| GAP-046 | Bias SE could reject a representable SEM because raw squared deviations/intermediates overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; #488 `a2c4ad8b...` | -| GAP-047 | Generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; #488 `a2c4ad8b...` | -| GAP-048 | Mean signed bias could erase a representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; #488 `a2c4ad8b...` | +| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; #488 `2809a5cc...` | +| GAP-046 | Bias SE could reject a representable SEM because raw squared deviations/intermediates overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; #488 `2809a5cc...` | +| GAP-047 | Generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; #488 `2809a5cc...` | +| GAP-048 | Mean signed bias could erase a representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; #488 `2809a5cc...` | | GAP-049 | Stable `Between` recovery could be aliased across occasion indices and reweight RMSE | `verification-pending` | RED `0a03041c...` + repair `ec2c1219...`; #310 `c6680450...` | -| GAP-050 | Zero-multiplier SE-aware acceptance could erase a nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; #488 `a2c4ad8b...` | -| GAP-051 | Exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; #488 `a2c4ad8b...` | -| GAP-052 | All-covered Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; #488 `a2c4ad8b...` | -| GAP-053 | Strict-interior Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; #488 `a2c4ad8b...` | -| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; #488 `a2c4ad8b...` | -| GAP-055 | Strict-interior Wilson lower endpoint could accept a nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; #488 `a2c4ad8b...` | -| GAP-056 | Durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; #488 `a2c4ad8b...` | -| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from a generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; #488 `a2c4ad8b...` | -| GAP-058 | Generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; #488 `a2c4ad8b...` | -| GAP-059 | Generic Monte Carlo summary could materially misstate positive SE relative to `SD / sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; #488 `a2c4ad8b...` | -| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; #488 `a2c4ad8b...` | -| GAP-061 | Generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; #488 `a2c4ad8b...` | -| GAP-062 | Finite-tolerance matching could fail while the pair is deterministically outside every finite tolerance | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; #488 `a2c4ad8b...` | -| GAP-063 | Exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; #488 `a2c4ad8b...` | -| GAP-064 | Positive point RMSE could carry SE above the declared squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; #488 `a2c4ad8b...` | -| GAP-065 | Positive Monte Carlo RMSE could carry spread/SE impossible for nonnegative replications | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; #488 `a2c4ad8b...` | -| GAP-066 | RMSE Monte Carlo nearest-rank percentile could exceed total nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; #488 `a2c4ad8b...` | -| GAP-067 | Generic nearest-rank percentile endpoint could be individually incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected over-strong repair `2798e4f9...`; causal repair `c7151b49...`; edge `dbef285b...`; changelog `c38a320c...`; research `2bbcbb24...`; #488 `a2c4ad8b...` | -| GAP-068 | Distinct generic percentile endpoints could each pass individual radius checks while jointly exceeding the sample squared-deviation budget | `verification-pending` | RED `c4a13826...` + causal repair `cb3f80a2...` + changelog `f727450d...`; #488 `a2c4ad8b...` | -| GAP-069 | Two-replication distinct nearest-rank endpoints could exhaust the retained sample while the stored mean or SD remained impossible | `verification-pending` | RED `81bf0d9e...` + causal repair `d48f8fef...` + mean coverage `fb314d8a...` + branch cleanup `440b78d8...` + changelog `45116498...`; #488 `a2c4ad8b...` | -| GAP-070 | Stored Wilson bounds could contain empirical coverage while the lower/upper pair could not arise from one Wilson score interval for that same coverage | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...` + complementary edge `c1cb16a7...`; #488 `a2c4ad8b...` | -| GAP-071 | Durable Wilson evidence lacked denominator and critical-value/sidedness provenance, preventing exact recomputation from a persisted artifact | `active-repair` | valid carrier RED `6f6e06d2...`; shared count/Wilson authority `ca517ed3...`; `WilsonCoverageEvidenceV1` `31e1ab2b...`; sidedness `e9c63926...`/`fdd24a1a...`; envelope RED `07766cb0...` + `ValidationEvidenceV1` repair `a16f22e6...`; docs/current #488 `a2c4ad8b...`; remaining: hosted GREEN/review/main plus durable-consumer adoption | -| GAP-072 | Exact all-covered Wilson evidence could retain a zero lower endpoint even though the canonical non-empty finite-`z²` producer always emits `n/(n+z²) > 0` | `verification-pending` | RED `ce714f07...` + non-force source-restore RCA `18499052...` + repair `72e9d954...` + changelog `e3a2f4a2...`; inherited by #488 `a2c4ad8b...` | -| GAP-073 | Durable Wilson count provenance could round one uncovered observation away above binary64's exact-integer range and expose a pointer-width-dependent count schema | `verification-pending` | RED `29d710a5...` + complement/count repair `29968c80...` + fixed-width carrier repair `91d9a3bb...` + changelog `d908ce2a...`; research/current #488 `a2c4ad8b...` | +| GAP-050 | Zero-multiplier SE-aware acceptance could erase a nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; #488 `2809a5cc...` | +| GAP-051 | Exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; #488 `2809a5cc...` | +| GAP-052 | All-covered Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; #488 `2809a5cc...` | +| GAP-053 | Strict-interior Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; #488 `2809a5cc...` | +| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; #488 `2809a5cc...` | +| GAP-055 | Strict-interior Wilson lower endpoint could accept a nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; #488 `2809a5cc...` | +| GAP-056 | Durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; #488 `2809a5cc...` | +| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from a generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; #488 `2809a5cc...` | +| GAP-058 | Generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; #488 `2809a5cc...` | +| GAP-059 | Generic Monte Carlo summary could materially misstate positive SE relative to `SD / sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; #488 `2809a5cc...` | +| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; #488 `2809a5cc...` | +| GAP-061 | Generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; #488 `2809a5cc...` | +| GAP-062 | Finite-tolerance matching could fail while the pair is deterministically outside every finite tolerance | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; #488 `2809a5cc...` | +| GAP-063 | Exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; #488 `2809a5cc...` | +| GAP-064 | Positive point RMSE could carry SE above the declared squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; #488 `2809a5cc...` | +| GAP-065 | Positive Monte Carlo RMSE could carry spread/SE impossible for nonnegative replications | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; #488 `2809a5cc...` | +| GAP-066 | RMSE Monte Carlo nearest-rank percentile could exceed total nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; #488 `2809a5cc...` | +| GAP-067 | Generic nearest-rank percentile endpoint could be individually incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected over-strong repair `2798e4f9...`; causal repair `c7151b49...`; edge `dbef285b...`; changelog `c38a320c...`; research `2bbcbb24...`; #488 `2809a5cc...` | +| GAP-068 | Distinct generic percentile endpoints could each pass individual radius checks while jointly exceeding the sample squared-deviation budget | `verification-pending` | RED `c4a13826...` + causal repair `cb3f80a2...` + changelog `f727450d...`; #488 `2809a5cc...` | +| GAP-069 | Two-replication distinct nearest-rank endpoints could exhaust the retained sample while the stored mean or SD remained impossible | `verification-pending` | RED `81bf0d9e...` + causal repair `d48f8fef...` + mean coverage `fb314d8a...` + branch cleanup `440b78d8...` + changelog `45116498...`; #488 `2809a5cc...` | +| GAP-070 | Stored Wilson bounds could contain empirical coverage while the lower/upper pair could not arise from one Wilson score interval for that same coverage | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...` + complementary edge `c1cb16a7...`; #488 `2809a5cc...` | +| GAP-071 | Durable Wilson evidence lacked denominator and critical-value/sidedness provenance, preventing exact recomputation from a persisted artifact | `active-repair` | valid carrier RED `6f6e06d2...`; shared count/Wilson authority `ca517ed3...`; `WilsonCoverageEvidenceV1` `31e1ab2b...`; sidedness `e9c63926...`/`fdd24a1a...`; envelope RED `07766cb0...` + `ValidationEvidenceV1` repair `a16f22e6...`; docs/current #488 `2809a5cc...`; remaining: hosted GREEN/review/main plus durable-consumer adoption | +| GAP-072 | Exact all-covered Wilson evidence could retain a zero lower endpoint even though the canonical non-empty finite-`z²` producer always emits `n/(n+z²) > 0` | `verification-pending` | RED `ce714f07...` + non-force source-restore RCA `18499052...` + repair `72e9d954...` + changelog `e3a2f4a2...`; inherited by #488 `2809a5cc...` | +| GAP-073 | Durable Wilson count provenance could round one uncovered observation away above binary64's exact-integer range and expose a pointer-width-dependent count schema | `verification-pending` | RED `29d710a5...` + complement/count repair `29968c80...` + fixed-width carrier repair `91d9a3bb...` + changelog `d908ce2a...`; standards/research/current #488 `2809a5cc...` | ## Release gate From c862420d98d71b6ab2575f1800d87d547413893f Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 4 Sep 2026 16:13:46 +0900 Subject: [PATCH 164/235] docs(gap): record exact Wilson denominator scale repair --- docs/product-technical-gap-baseline.md | 75 +++++++++++++------------- 1 file changed, 39 insertions(+), 36 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 038625143..30e831e4b 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-04T06:44:00Z +**Snapshot:** 2026-09-04T07:12:00Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` **Workspace version:** `0.2.0` @@ -30,7 +30,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `2809a5ccf42731198f32cbc27e8db09c15000ac8` | true | `main` | Validation Evidence landing vehicle. `WilsonCoverageEvidenceV1` retains fixed-width `u64` denominator/count provenance, standard-normal `z`, two-sided semantics, represented coverage and canonical Wilson endpoints. Large-count recomputation preserves one-uncovered states above binary64's exact-integer range by evaluating the smaller complement instead of rounding both counts into an all-covered path. IEEE 754-2019 and ISO/IEC 60559:2020 ground the current binary64 representation trace. Consumer adoption, exact-head hosted gates and independent review remain required. | +| #488 | `7fc78a59206d36cca32a9d45e023d109b628b114` | true | `main` | Validation Evidence landing vehicle. `WilsonCoverageEvidenceV1` retains fixed-width `u64` denominator/count provenance, standard-normal `z`, two-sided semantics, represented coverage and canonical Wilson endpoints. Large-count recomputation preserves exact count-ratio rounding, complement identity, and Wilson sample-count scale when a retained `u64` denominator is not exactly representable in binary64. Hosted exact-head gates and independent review remain required. | | #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 | Validation / Analysis Run fold child. Unique evidence must be inherited by a conflict-resolving survivor; child-head CI does not transfer. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | @@ -50,7 +50,7 @@ TEPP owns temporal/event composition, irregular time, time-varying multilevel/cr `psychometric_core` is not authority for new temporal/state composition. fast-mlsirm owns reusable static/generalized-mixed/dependence-aware psychometric specification and arithmetic. TEPP consumes only immutable released/versioned Published Language through an ACL; source copying and mutable sibling-head dependencies are prohibited. -contextual-orchestrator owns provider/model routing and semantic LLM execution. Its last fresh protected-main evidence is `60c562defc81fb1897fa97ebdb5bf8f69eae0c55`, while GitHub releases remain zero. Semantic LLM work and model-backed Actions therefore continue to require a released/versioned contextual-orchestrator contract; Actions use `orchestrator/free` through the gateway credential and do not select providers/models/groups or consume direct provider keys. Mutable owner main is evidence, not a TEPP production contract. Context Graph contracts are contract-only integration authority; EA Core owns enterprise-architecture decisions. No cross-service SQL. +contextual-orchestrator owns provider/model routing and semantic LLM execution. Its fresh protected-main evidence is `60c562defc81fb1897fa97ebdb5bf8f69eae0c55`, while GitHub releases remain zero. Semantic LLM work and model-backed Actions therefore continue to require a released/versioned contextual-orchestrator contract; Actions use `orchestrator/free` through the gateway credential and do not select providers/models/groups or consume direct provider keys. Mutable owner main is evidence, not a TEPP production contract. Context Graph contracts are contract-only integration authority; EA Core owns enterprise-architecture decisions. No cross-service SQL. The clock contract separates event/valid time, assertion time, document time, system time, availability time, and knowledge cutoff. Retrospective evidence may describe an earlier event but cannot enter an earlier knowledge cutoff. Forward state/transition edges remain distinct from retrospective/citation/revision/provenance relations. @@ -69,7 +69,7 @@ The clock contract separates event/valid time, assertion time, document time, sy - When the generic carrier occupies `ValidationReport::monte_carlo_rmse`, retained replications are nonnegative; positive mean implies `SE(mean) <= mean`, and inclusive nearest-rank endpoints cannot exceed the nonnegative sample-sum support `n * mean`. These typed bounds are not imposed on signed metrics such as bias. - SE-aware acceptance is `|estimate - target| <= k * SE`. For `k = 0` or exact-zero SE, exact recovery is evaluated before scale reduction; `-0.0` and `+0.0` are one numeric zero-valued scientific state. - `match_count` is a finite-threshold decision and does not require materializing an unrepresentable absolute residual; `absolute_residuals` remains fail closed when the magnitude itself is requested. -- Wilson interval coverage preserves representable endpoints through stable rationalized/complementary forms. Legacy `ValidationReport` endpoint pairs satisfy necessary Wilson coherence and boundary checks, but exact provenance is not inferred from them. `WilsonCoverageEvidenceV1` retains fixed-width `u64` `sample_count`/`covered_count`, `critical_value_kind=standard_normal_z`, `interval_sidedness=two_sided`, the numeric `z`, represented coverage, and canonical endpoints and validates them by exact recomputation through the single crate-private Wilson authority. Exact all-covered status is integer count equality, not rounded `p == 1`. When covered counts dominate, represented coverage and the Wilson interval are evaluated from the smaller uncovered complement and reflected, preserving count distinction beyond binary64's exact-integer range. `ValidationEvidenceV1` binds that provenance to the legacy report projection without breaking existing report callers. +- Wilson interval coverage preserves representable endpoints through stable rationalized/complementary forms. Legacy `ValidationReport` endpoint pairs satisfy necessary Wilson coherence and boundary checks, but exact provenance is not inferred from them. `WilsonCoverageEvidenceV1` retains fixed-width `u64` `sample_count`/`covered_count`, `critical_value_kind=standard_normal_z`, `interval_sidedness=two_sided`, the numeric `z`, represented coverage, and canonical endpoints and validates them by exact recomputation through the single crate-private Wilson authority. Exact all-covered status is integer count equality, not rounded `p == 1`. Count proportions are correctly rounded from exact integers. When covered counts dominate, the smaller uncovered complement is evaluated and reflected. When retained `sample_count` itself is not exactly representable in binary64, Wilson scale terms use the correctly rounded reciprocal `1/n` rather than a pre-rounded integer denominator; exact all-covered evidence uses complementary miss mass so a representable lower endpoint immediately below `1.0` is not erased. `ValidationEvidenceV1` binds that provenance to the legacy report projection without breaking existing report callers. - Durable and human-facing Validation Evidence must preserve producing-metric invariants on explicit validation, serde ingress/egress, and human projection. Missing v1 provenance is never synthesized from endpoint algebra. - Bias, RMSE, and Monte Carlo may share private deterministic scalar support inside `validation_core`, but metric-specific cancellation/normalization, denominator, uncertainty, and fail-closed semantics remain with their bounded modules. - Historical-cutoff admission occurs before duplicate-identity checks. Future-unavailable evidence cannot change an earlier run's conflicts, counts, or terminal state. @@ -84,13 +84,15 @@ The clock contract separates event/valid time, assertion time, document time, sy ### #488 — Validation Evidence -#488 is the generic Validation Evidence landing vehicle at exact head `2809a5ccf42731198f32cbc27e8db09c15000ac8`. It remains distinct from Longitudinal Modeling and does not consume mutable fast-mlsirm source. +#488 is the generic Validation Evidence landing vehicle at exact head `7fc78a59206d36cca32a9d45e023d109b628b114`. It remains distinct from Longitudinal Modeling and does not consume mutable fast-mlsirm source. -GAP-070 and GAP-072 remain inherited: stored Wilson endpoints must be one coherent score interval, and exact all-covered evidence cannot use a zero lower endpoint. GAP-071 has advanced from design-only to source implementation. The first test draft `9fc96345...` was invalid and is not evidence; corrected public RED `6f6e06d2...` requires a versioned denominator/critical-value carrier. `ca517ed3...` establishes one private covered-count/Wilson-from-counts authority; `31e1ab2b...` adds `WilsonCoverageEvidenceV1`; `e9c63926...`/`fdd24a1a...` bind standard-normal/two-sided semantics. Envelope RED `07766cb0...` and repair `a16f22e6...` add `ValidationEvidenceV1`, which cross-validates the legacy report projection against the recomputable carrier. The accidental unrelated `lib.rs` wording mutation in `4e2381f3...` is excluded from repair evidence and was corrected non-force by `57d8bf57...`. +GAP-070 and GAP-072 remain inherited: stored Wilson endpoints must be one coherent score interval, and exact all-covered evidence cannot use a zero lower endpoint. GAP-071 has advanced from design-only to source implementation. The first carrier test draft `9fc96345...` was invalid and is not evidence; corrected public RED `6f6e06d2...` requires a versioned denominator/critical-value carrier. `ca517ed3...` establishes one private covered-count/Wilson-from-counts authority; `31e1ab2b...` adds `WilsonCoverageEvidenceV1`; `e9c63926...`/`fdd24a1a...` bind standard-normal/two-sided semantics. Envelope RED `07766cb0...` and repair `a16f22e6...` add `ValidationEvidenceV1`, which cross-validates the legacy report projection against the recomputable carrier. The accidental unrelated `lib.rs` wording mutation in `4e2381f3...` is excluded from repair evidence and was corrected non-force by `57d8bf57...`. -GAP-073 closes a newly exposed large-count numerical/source-contract defect. Public RED `29d710a5...` uses `n = 2^53 + 1`, `k = 2^53`, and `z = 1.96` to require a one-uncovered durable artifact to retain represented coverage `0.9999999999999999` and Wilson lower `0.9999999999999993` instead of collapsing into an all-covered path. Causal repair `29968c80...` evaluates the smaller uncovered complement and reflects the Wilson endpoints; `91d9a3bb...` makes versioned count fields fixed-width `u64`; changelog `d908ce2a...`; standards/research/current #488 `2809a5cc...`. +GAP-073 retains the large-count identity/schema repair. Public RED `29d710a5...` uses `n = 2^53 + 1`, `k = 2^53`, and `z = 1.96` to require a one-uncovered durable artifact to remain distinct from all-covered evidence. Repair `29968c80...` evaluates the smaller uncovered complement and reflects the Wilson endpoints; `91d9a3bb...` makes versioned count fields fixed-width `u64`. The later ratio RED `63ddfdd6...` and repair `11323c57...` correctly round non-boundary `covered_count/sample_count` from exact integer provenance. -This closes the missing-source-contract portion of GAP-071 and the source portion of GAP-073 but not delivery: exact-head hosted gates, independent review, protected-main integration, and adoption by durable consumers that require v1 provenance remain outstanding. Bare legacy `ValidationReport` remains a backward-compatible compact projection and is not silently treated as v1 provenance. +GAP-074 records the denominator-scale defect left after those repairs. Public RED `f89e2467...` fixes `n = 9_007_199_254_740_1013`, `k = 1_286_742_750_677_287`, `z = 1.96`, where pre-rounding `sample_count` moves the Wilson lower endpoint one ULP. Reinforcement `1a5180b2...` fixes exact all-covered `n = 2^55 + 3`, whose lower endpoint must remain `next_down(1.0)` rather than false exact one. `6254c498...` corrects the predecessor non-boundary fixture whose empirical ratio was exact but Wilson lower still encoded rounded-denominator arithmetic. Causal repair `73bbb5cf...` uses reciprocal-scale Wilson evaluation only for `u64` sample counts that are not exactly binary64-representable; changelog `f2b5768b...`; research/current #488 `7fc78a59...`. + +These repairs advance the source-contract portion of GAP-071/GAP-073/GAP-074 but not delivery: exact-head hosted gates, independent review, protected-main integration, and adoption by durable consumers that require v1 provenance remain outstanding. Bare legacy `ValidationReport` remains a backward-compatible compact projection and is not silently treated as v1 provenance. Wilson (1927) remains the primary score-interval reference. AERA/APA/NCME (2014) remains the current published testing-standards edition while revision is underway. IEEE 754-2019 and ISO/IEC 60559:2020 remain the published active floating-point authorities used for the current binary64 representation trace; active IEEE P754 is not treated as a published replacement. @@ -150,35 +152,36 @@ Wilson (1927) remains the primary score-interval reference. AERA/APA/NCME (2014) | GAP-042 | Ratio-first logarithm could nearly double an adjacent-float irregular residual growth rate | `verification-pending` | RED `766ddc7a...` + `ln_1p` repair `16f21d9a...` | | GAP-043 | Duplicate known-truth component identities could silently reweight RMSE recovery evidence | `verification-pending` | RED `698f12f5...` + uniqueness repair `2fae4cb2...` | | GAP-044 | Known-truth RMSE alignment/accumulation depended on row order instead of component identity | `verification-pending` | RED `8ad72ac9...` / `5fb93c40...` + repairs `2dd9537e...` / `025dce7f...`; #310 `c6680450...` | -| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; #488 `2809a5cc...` | -| GAP-046 | Bias SE could reject a representable SEM because raw squared deviations/intermediates overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; #488 `2809a5cc...` | -| GAP-047 | Generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; #488 `2809a5cc...` | -| GAP-048 | Mean signed bias could erase a representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; #488 `2809a5cc...` | +| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; #488 `7fc78a59...` | +| GAP-046 | Bias SE could reject a representable SEM because raw squared deviations/intermediates overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; #488 `7fc78a59...` | +| GAP-047 | Generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; #488 `7fc78a59...` | +| GAP-048 | Mean signed bias could erase a representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; #488 `7fc78a59...` | | GAP-049 | Stable `Between` recovery could be aliased across occasion indices and reweight RMSE | `verification-pending` | RED `0a03041c...` + repair `ec2c1219...`; #310 `c6680450...` | -| GAP-050 | Zero-multiplier SE-aware acceptance could erase a nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; #488 `2809a5cc...` | -| GAP-051 | Exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; #488 `2809a5cc...` | -| GAP-052 | All-covered Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; #488 `2809a5cc...` | -| GAP-053 | Strict-interior Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; #488 `2809a5cc...` | -| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; #488 `2809a5cc...` | -| GAP-055 | Strict-interior Wilson lower endpoint could accept a nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; #488 `2809a5cc...` | -| GAP-056 | Durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; #488 `2809a5cc...` | -| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from a generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; #488 `2809a5cc...` | -| GAP-058 | Generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; #488 `2809a5cc...` | -| GAP-059 | Generic Monte Carlo summary could materially misstate positive SE relative to `SD / sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; #488 `2809a5cc...` | -| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; #488 `2809a5cc...` | -| GAP-061 | Generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; #488 `2809a5cc...` | -| GAP-062 | Finite-tolerance matching could fail while the pair is deterministically outside every finite tolerance | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; #488 `2809a5cc...` | -| GAP-063 | Exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; #488 `2809a5cc...` | -| GAP-064 | Positive point RMSE could carry SE above the declared squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; #488 `2809a5cc...` | -| GAP-065 | Positive Monte Carlo RMSE could carry spread/SE impossible for nonnegative replications | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; #488 `2809a5cc...` | -| GAP-066 | RMSE Monte Carlo nearest-rank percentile could exceed total nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; #488 `2809a5cc...` | -| GAP-067 | Generic nearest-rank percentile endpoint could be individually incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected over-strong repair `2798e4f9...`; causal repair `c7151b49...`; edge `dbef285b...`; changelog `c38a320c...`; research `2bbcbb24...`; #488 `2809a5cc...` | -| GAP-068 | Distinct generic percentile endpoints could each pass individual radius checks while jointly exceeding the sample squared-deviation budget | `verification-pending` | RED `c4a13826...` + causal repair `cb3f80a2...` + changelog `f727450d...`; #488 `2809a5cc...` | -| GAP-069 | Two-replication distinct nearest-rank endpoints could exhaust the retained sample while the stored mean or SD remained impossible | `verification-pending` | RED `81bf0d9e...` + causal repair `d48f8fef...` + mean coverage `fb314d8a...` + branch cleanup `440b78d8...` + changelog `45116498...`; #488 `2809a5cc...` | -| GAP-070 | Stored Wilson bounds could contain empirical coverage while the lower/upper pair could not arise from one Wilson score interval for that same coverage | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...` + complementary edge `c1cb16a7...`; #488 `2809a5cc...` | -| GAP-071 | Durable Wilson evidence lacked denominator and critical-value/sidedness provenance, preventing exact recomputation from a persisted artifact | `active-repair` | valid carrier RED `6f6e06d2...`; shared count/Wilson authority `ca517ed3...`; `WilsonCoverageEvidenceV1` `31e1ab2b...`; sidedness `e9c63926...`/`fdd24a1a...`; envelope RED `07766cb0...` + `ValidationEvidenceV1` repair `a16f22e6...`; docs/current #488 `2809a5cc...`; remaining: hosted GREEN/review/main plus durable-consumer adoption | -| GAP-072 | Exact all-covered Wilson evidence could retain a zero lower endpoint even though the canonical non-empty finite-`z²` producer always emits `n/(n+z²) > 0` | `verification-pending` | RED `ce714f07...` + non-force source-restore RCA `18499052...` + repair `72e9d954...` + changelog `e3a2f4a2...`; inherited by #488 `2809a5cc...` | -| GAP-073 | Durable Wilson count provenance could round one uncovered observation away above binary64's exact-integer range and expose a pointer-width-dependent count schema | `verification-pending` | RED `29d710a5...` + complement/count repair `29968c80...` + fixed-width carrier repair `91d9a3bb...` + changelog `d908ce2a...`; standards/research/current #488 `2809a5cc...` | +| GAP-050 | Zero-multiplier SE-aware acceptance could erase a nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; #488 `7fc78a59...` | +| GAP-051 | Exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; #488 `7fc78a59...` | +| GAP-052 | All-covered Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; #488 `7fc78a59...` | +| GAP-053 | Strict-interior Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; #488 `7fc78a59...` | +| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; #488 `7fc78a59...` | +| GAP-055 | Strict-interior Wilson lower endpoint could accept a nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; #488 `7fc78a59...` | +| GAP-056 | Durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; #488 `7fc78a59...` | +| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from a generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; #488 `7fc78a59...` | +| GAP-058 | Generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; #488 `7fc78a59...` | +| GAP-059 | Generic Monte Carlo summary could materially misstate positive SE relative to `SD / sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; #488 `7fc78a59...` | +| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; #488 `7fc78a59...` | +| GAP-061 | Generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; #488 `7fc78a59...` | +| GAP-062 | Finite-tolerance matching could fail while the pair is deterministically outside every finite tolerance | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; #488 `7fc78a59...` | +| GAP-063 | Exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; #488 `7fc78a59...` | +| GAP-064 | Positive point RMSE could carry SE above the declared squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; #488 `7fc78a59...` | +| GAP-065 | Positive Monte Carlo RMSE could carry spread/SE impossible for nonnegative replications | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; #488 `7fc78a59...` | +| GAP-066 | RMSE Monte Carlo nearest-rank percentile could exceed total nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; #488 `7fc78a59...` | +| GAP-067 | Generic nearest-rank percentile endpoint could be individually incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected over-strong repair `2798e4f9...`; causal repair `c7151b49...`; edge `dbef285b...`; changelog `c38a320c...`; research `2bbcbb24...`; #488 `7fc78a59...` | +| GAP-068 | Distinct generic percentile endpoints could each pass individual radius checks while jointly exceeding the sample squared-deviation budget | `verification-pending` | RED `c4a13826...` + causal repair `cb3f80a2...` + changelog `f727450d...`; #488 `7fc78a59...` | +| GAP-069 | Two-replication distinct nearest-rank endpoints could exhaust the retained sample while the stored mean or SD remained impossible | `verification-pending` | RED `81bf0d9e...` + causal repair `d48f8fef...` + mean coverage `fb314d8a...` + branch cleanup `440b78d8...` + changelog `45116498...`; #488 `7fc78a59...` | +| GAP-070 | Stored Wilson bounds could contain empirical coverage while the lower/upper pair could not arise from one Wilson score interval for that same coverage | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...` + complementary edge `c1cb16a7...`; #488 `7fc78a59...` | +| GAP-071 | Durable Wilson evidence lacked denominator and critical-value/sidedness provenance, preventing exact recomputation from a persisted artifact | `active-repair` | valid carrier RED `6f6e06d2...`; shared count/Wilson authority `ca517ed3...`; `WilsonCoverageEvidenceV1` `31e1ab2b...`; sidedness `e9c63926...`/`fdd24a1a...`; envelope RED `07766cb0...` + `ValidationEvidenceV1` repair `a16f22e6...`; docs/current #488 `7fc78a59...`; remaining: hosted GREEN/review/main plus durable-consumer adoption | +| GAP-072 | Exact all-covered Wilson evidence could retain a zero lower endpoint even though the canonical non-empty finite-`z²` producer always emits `n/(n+z²) > 0` | `verification-pending` | RED `ce714f07...` + non-force source-restore RCA `18499052...` + repair `72e9d954...` + changelog `e3a2f4a2...`; inherited by #488 `7fc78a59...` | +| GAP-073 | Durable Wilson count provenance could round one uncovered observation away above binary64's exact-integer range and expose a pointer-width-dependent count schema | `verification-pending` | RED `29d710a5...` + complement/count repair `29968c80...` + fixed-width carrier repair `91d9a3bb...` + exact ratio RED/repair `63ddfdd6...`/`11323c57...`; #488 `7fc78a59...` | +| GAP-074 | Durable Wilson evidence could correctly retain exact `u64` counts yet pre-round `sample_count` before endpoint projection, shifting strict-interior endpoints or erasing all-covered finite-sample uncertainty | `verification-pending` | RED `f89e2467...` + all-covered edge `1a5180b2...` + stale-oracle correction `6254c498...` + causal reciprocal-scale repair `73bbb5cf...` + changelog `f2b5768b...` + research/current #488 `7fc78a59...` | ## Release gate From 4cde1520fcdef30108fe20b77a02ae322e23b12c Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 4 Sep 2026 16:41:04 +0900 Subject: [PATCH 165/235] docs(gap): record extreme-z Wilson all-covered scale repair --- docs/product-technical-gap-baseline.md | 74 +++++++++++++------------- 1 file changed, 38 insertions(+), 36 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 30e831e4b..736f76f98 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-04T07:12:00Z +**Snapshot:** 2026-09-04T07:39:25Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` **Workspace version:** `0.2.0` @@ -30,7 +30,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `7fc78a59206d36cca32a9d45e023d109b628b114` | true | `main` | Validation Evidence landing vehicle. `WilsonCoverageEvidenceV1` retains fixed-width `u64` denominator/count provenance, standard-normal `z`, two-sided semantics, represented coverage and canonical Wilson endpoints. Large-count recomputation preserves exact count-ratio rounding, complement identity, and Wilson sample-count scale when a retained `u64` denominator is not exactly representable in binary64. Hosted exact-head gates and independent review remain required. | +| #488 | `ebe6b660486e3f7a527849c9e3ad895e6e0fb011` | true | `main` | Validation Evidence landing vehicle. `WilsonCoverageEvidenceV1` retains fixed-width `u64` denominator/count provenance, standard-normal `z`, two-sided semantics, represented coverage and canonical Wilson endpoints. Large-count recomputation preserves exact count-ratio rounding and complement identity; inexact binary64 sample-count scale uses reciprocal evaluation and an all-covered scale switch so neither tiny uncertainty below one nor a positive lower endpoint under extreme finite `z` is erased. Hosted exact-head gates and independent review remain required. | | #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 | Validation / Analysis Run fold child. Unique evidence must be inherited by a conflict-resolving survivor; child-head CI does not transfer. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | @@ -57,7 +57,6 @@ The clock contract separates event/valid time, assertion time, document time, sy ## Scientific invariants - Rasch remains distinct from generic 1PL; formulation-qualified 2PLM–5PLM, MIRT, ideal-point/GGUM, testlet/rater/facet/generalized-mixed identity is preserved. -- Cross-classification and multiple membership remain distinct; weights are explicit, auditable, time-valid, and normalized or model-estimated according to the formulation. - A nominal unit identifier is not repeated-measures evidence; singleton units cannot satisfy a longitudinal multilevel floor. - Occasion-mean deviations `p_it = x_it - μ_t` are not CWC residuals, sample-wide grand-mean residuals, or RI-CLPM within-person effects. Numeric event time defines occasion identity, so `-0.0` and `+0.0` are one occasion. - Row arrival order is not scientific evidence. Fixed admitted observations must produce bit-identical means/centered results under permutation wherever the contract claims deterministic CPU `f64` reference behavior. @@ -69,7 +68,7 @@ The clock contract separates event/valid time, assertion time, document time, sy - When the generic carrier occupies `ValidationReport::monte_carlo_rmse`, retained replications are nonnegative; positive mean implies `SE(mean) <= mean`, and inclusive nearest-rank endpoints cannot exceed the nonnegative sample-sum support `n * mean`. These typed bounds are not imposed on signed metrics such as bias. - SE-aware acceptance is `|estimate - target| <= k * SE`. For `k = 0` or exact-zero SE, exact recovery is evaluated before scale reduction; `-0.0` and `+0.0` are one numeric zero-valued scientific state. - `match_count` is a finite-threshold decision and does not require materializing an unrepresentable absolute residual; `absolute_residuals` remains fail closed when the magnitude itself is requested. -- Wilson interval coverage preserves representable endpoints through stable rationalized/complementary forms. Legacy `ValidationReport` endpoint pairs satisfy necessary Wilson coherence and boundary checks, but exact provenance is not inferred from them. `WilsonCoverageEvidenceV1` retains fixed-width `u64` `sample_count`/`covered_count`, `critical_value_kind=standard_normal_z`, `interval_sidedness=two_sided`, the numeric `z`, represented coverage, and canonical endpoints and validates them by exact recomputation through the single crate-private Wilson authority. Exact all-covered status is integer count equality, not rounded `p == 1`. Count proportions are correctly rounded from exact integers. When covered counts dominate, the smaller uncovered complement is evaluated and reflected. When retained `sample_count` itself is not exactly representable in binary64, Wilson scale terms use the correctly rounded reciprocal `1/n` rather than a pre-rounded integer denominator; exact all-covered evidence uses complementary miss mass so a representable lower endpoint immediately below `1.0` is not erased. `ValidationEvidenceV1` binds that provenance to the legacy report projection without breaking existing report callers. +- Wilson interval coverage preserves representable endpoints through stable rationalized/complementary forms. Legacy `ValidationReport` endpoint pairs satisfy necessary Wilson coherence and boundary checks, but exact provenance is not inferred from them. `WilsonCoverageEvidenceV1` retains fixed-width `u64` `sample_count`/`covered_count`, `critical_value_kind=standard_normal_z`, `interval_sidedness=two_sided`, the numeric `z`, represented coverage, and canonical endpoints and validates them by exact recomputation through the single crate-private Wilson authority. Exact all-covered status is integer count equality, not rounded `p == 1`. Count proportions are correctly rounded from exact integers. When covered counts dominate, the smaller uncovered complement is evaluated and reflected. When retained `sample_count` itself is not exactly representable in binary64, Wilson scale terms use the correctly rounded reciprocal `1/n` rather than a pre-rounded integer denominator. Exact all-covered evidence uses complementary miss mass for `z²/n <= 1` so a representable endpoint immediately below `1.0` is not erased, and direct reciprocal evaluation for `z²/n > 1` so a large miss mass cannot round to exact one and erase a representable positive lower endpoint. Both forms are algebraically the same Wilson endpoint. `ValidationEvidenceV1` binds that provenance to the legacy report projection without breaking existing report callers. - Durable and human-facing Validation Evidence must preserve producing-metric invariants on explicit validation, serde ingress/egress, and human projection. Missing v1 provenance is never synthesized from endpoint algebra. - Bias, RMSE, and Monte Carlo may share private deterministic scalar support inside `validation_core`, but metric-specific cancellation/normalization, denominator, uncertainty, and fail-closed semantics remain with their bounded modules. - Historical-cutoff admission occurs before duplicate-identity checks. Future-unavailable evidence cannot change an earlier run's conflicts, counts, or terminal state. @@ -84,15 +83,17 @@ The clock contract separates event/valid time, assertion time, document time, sy ### #488 — Validation Evidence -#488 is the generic Validation Evidence landing vehicle at exact head `7fc78a59206d36cca32a9d45e023d109b628b114`. It remains distinct from Longitudinal Modeling and does not consume mutable fast-mlsirm source. +#488 is the generic Validation Evidence landing vehicle at exact head `ebe6b660486e3f7a527849c9e3ad895e6e0fb011`. It remains distinct from Longitudinal Modeling and does not consume mutable fast-mlsirm source. GAP-070 and GAP-072 remain inherited: stored Wilson endpoints must be one coherent score interval, and exact all-covered evidence cannot use a zero lower endpoint. GAP-071 has advanced from design-only to source implementation. The first carrier test draft `9fc96345...` was invalid and is not evidence; corrected public RED `6f6e06d2...` requires a versioned denominator/critical-value carrier. `ca517ed3...` establishes one private covered-count/Wilson-from-counts authority; `31e1ab2b...` adds `WilsonCoverageEvidenceV1`; `e9c63926...`/`fdd24a1a...` bind standard-normal/two-sided semantics. Envelope RED `07766cb0...` and repair `a16f22e6...` add `ValidationEvidenceV1`, which cross-validates the legacy report projection against the recomputable carrier. The accidental unrelated `lib.rs` wording mutation in `4e2381f3...` is excluded from repair evidence and was corrected non-force by `57d8bf57...`. GAP-073 retains the large-count identity/schema repair. Public RED `29d710a5...` uses `n = 2^53 + 1`, `k = 2^53`, and `z = 1.96` to require a one-uncovered durable artifact to remain distinct from all-covered evidence. Repair `29968c80...` evaluates the smaller uncovered complement and reflects the Wilson endpoints; `91d9a3bb...` makes versioned count fields fixed-width `u64`. The later ratio RED `63ddfdd6...` and repair `11323c57...` correctly round non-boundary `covered_count/sample_count` from exact integer provenance. -GAP-074 records the denominator-scale defect left after those repairs. Public RED `f89e2467...` fixes `n = 9_007_199_254_740_1013`, `k = 1_286_742_750_677_287`, `z = 1.96`, where pre-rounding `sample_count` moves the Wilson lower endpoint one ULP. Reinforcement `1a5180b2...` fixes exact all-covered `n = 2^55 + 3`, whose lower endpoint must remain `next_down(1.0)` rather than false exact one. `6254c498...` corrects the predecessor non-boundary fixture whose empirical ratio was exact but Wilson lower still encoded rounded-denominator arithmetic. Causal repair `73bbb5cf...` uses reciprocal-scale Wilson evaluation only for `u64` sample counts that are not exactly binary64-representable; changelog `f2b5768b...`; research/current #488 `7fc78a59...`. +GAP-074 records the denominator-scale defect left after those repairs. Public RED `f89e2467...` fixes `n = 9_007_199_254_740_1013`, `k = 1_286_742_750_677_287`, `z = 1.96`, where pre-rounding `sample_count` moves the Wilson lower endpoint one ULP. Reinforcement `1a5180b2...` fixes exact all-covered `n = 2^55 + 3`, whose lower endpoint must remain `next_down(1.0)` rather than false exact one. `6254c498...` corrects the predecessor non-boundary fixture whose empirical ratio was exact but Wilson lower still encoded rounded-denominator arithmetic. Causal repair `73bbb5cf...` uses reciprocal-scale Wilson evaluation only for `u64` sample counts that are not exactly binary64-representable; changelog `f2b5768b...`; research predecessor `7fc78a59...`. -These repairs advance the source-contract portion of GAP-071/GAP-073/GAP-074 but not delivery: exact-head hosted gates, independent review, protected-main integration, and adoption by durable consumers that require v1 provenance remain outstanding. Bare legacy `ValidationReport` remains a backward-compatible compact projection and is not silently treated as v1 provenance. +GAP-075 records the remaining all-covered conditioning defect on that reciprocal path. Public RED `059ce70d3dd497f486214137bca6a1f1b2e8b3cd` fixes `n = 2^53 + 1`, `covered_count = n`, and `z = 1e20`, where the predecessor complementary miss mass rounds to exact one and turns the lower endpoint into false exact zero although `n/(n+z²)` is the positive binary64 value `9.007199254740993e-25`. Transient commit `46f91f3f3723e8b400dbf3f7e8adaf0422e2c4ee` duplicated canonical Wilson math in the evidence carrier and is excluded from final repair evidence. Causal repair `0f4783929b8d067eecb91696e1ad5761cd315b1e` keeps the scale switch in `coverage.rs`; cleanup `8e2058f2fc6ab42af8f732f03e7ae1dcee3e873d` restores the carrier to consuming that single writer; changelog `8a73cb64d15e5412e5afabbae80603a66c12a7f0`; research/current #488 `ebe6b660486e3f7a527849c9e3ad895e6e0fb011`. + +These repairs advance the source-contract portion of GAP-071/GAP-073/GAP-074/GAP-075 but not delivery: exact-head hosted gates, independent review, protected-main integration, and adoption by durable consumers that require v1 provenance remain outstanding. Bare legacy `ValidationReport` remains a backward-compatible compact projection and is not silently treated as v1 provenance. Wilson (1927) remains the primary score-interval reference. AERA/APA/NCME (2014) remains the current published testing-standards edition while revision is underway. IEEE 754-2019 and ISO/IEC 60559:2020 remain the published active floating-point authorities used for the current binary64 representation trace; active IEEE P754 is not treated as a published replacement. @@ -152,36 +153,37 @@ Wilson (1927) remains the primary score-interval reference. AERA/APA/NCME (2014) | GAP-042 | Ratio-first logarithm could nearly double an adjacent-float irregular residual growth rate | `verification-pending` | RED `766ddc7a...` + `ln_1p` repair `16f21d9a...` | | GAP-043 | Duplicate known-truth component identities could silently reweight RMSE recovery evidence | `verification-pending` | RED `698f12f5...` + uniqueness repair `2fae4cb2...` | | GAP-044 | Known-truth RMSE alignment/accumulation depended on row order instead of component identity | `verification-pending` | RED `8ad72ac9...` / `5fb93c40...` + repairs `2dd9537e...` / `025dce7f...`; #310 `c6680450...` | -| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; #488 `7fc78a59...` | -| GAP-046 | Bias SE could reject a representable SEM because raw squared deviations/intermediates overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; #488 `7fc78a59...` | -| GAP-047 | Generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; #488 `7fc78a59...` | -| GAP-048 | Mean signed bias could erase a representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; #488 `7fc78a59...` | +| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; #488 `ebe6b660...` | +| GAP-046 | Bias SE could reject a representable SEM because raw squared deviations/intermediates overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; #488 `ebe6b660...` | +| GAP-047 | Generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; #488 `ebe6b660...` | +| GAP-048 | Mean signed bias could erase a representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; #488 `ebe6b660...` | | GAP-049 | Stable `Between` recovery could be aliased across occasion indices and reweight RMSE | `verification-pending` | RED `0a03041c...` + repair `ec2c1219...`; #310 `c6680450...` | -| GAP-050 | Zero-multiplier SE-aware acceptance could erase a nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; #488 `7fc78a59...` | -| GAP-051 | Exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; #488 `7fc78a59...` | -| GAP-052 | All-covered Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; #488 `7fc78a59...` | -| GAP-053 | Strict-interior Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; #488 `7fc78a59...` | -| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; #488 `7fc78a59...` | -| GAP-055 | Strict-interior Wilson lower endpoint could accept a nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; #488 `7fc78a59...` | -| GAP-056 | Durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; #488 `7fc78a59...` | -| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from a generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; #488 `7fc78a59...` | -| GAP-058 | Generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; #488 `7fc78a59...` | -| GAP-059 | Generic Monte Carlo summary could materially misstate positive SE relative to `SD / sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; #488 `7fc78a59...` | -| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; #488 `7fc78a59...` | -| GAP-061 | Generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; #488 `7fc78a59...` | -| GAP-062 | Finite-tolerance matching could fail while the pair is deterministically outside every finite tolerance | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; #488 `7fc78a59...` | -| GAP-063 | Exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; #488 `7fc78a59...` | -| GAP-064 | Positive point RMSE could carry SE above the declared squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; #488 `7fc78a59...` | -| GAP-065 | Positive Monte Carlo RMSE could carry spread/SE impossible for nonnegative replications | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; #488 `7fc78a59...` | -| GAP-066 | RMSE Monte Carlo nearest-rank percentile could exceed total nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; #488 `7fc78a59...` | -| GAP-067 | Generic nearest-rank percentile endpoint could be individually incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected over-strong repair `2798e4f9...`; causal repair `c7151b49...`; edge `dbef285b...`; changelog `c38a320c...`; research `2bbcbb24...`; #488 `7fc78a59...` | -| GAP-068 | Distinct generic percentile endpoints could each pass individual radius checks while jointly exceeding the sample squared-deviation budget | `verification-pending` | RED `c4a13826...` + causal repair `cb3f80a2...` + changelog `f727450d...`; #488 `7fc78a59...` | -| GAP-069 | Two-replication distinct nearest-rank endpoints could exhaust the retained sample while the stored mean or SD remained impossible | `verification-pending` | RED `81bf0d9e...` + causal repair `d48f8fef...` + mean coverage `fb314d8a...` + branch cleanup `440b78d8...` + changelog `45116498...`; #488 `7fc78a59...` | -| GAP-070 | Stored Wilson bounds could contain empirical coverage while the lower/upper pair could not arise from one Wilson score interval for that same coverage | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...` + complementary edge `c1cb16a7...`; #488 `7fc78a59...` | -| GAP-071 | Durable Wilson evidence lacked denominator and critical-value/sidedness provenance, preventing exact recomputation from a persisted artifact | `active-repair` | valid carrier RED `6f6e06d2...`; shared count/Wilson authority `ca517ed3...`; `WilsonCoverageEvidenceV1` `31e1ab2b...`; sidedness `e9c63926...`/`fdd24a1a...`; envelope RED `07766cb0...` + `ValidationEvidenceV1` repair `a16f22e6...`; docs/current #488 `7fc78a59...`; remaining: hosted GREEN/review/main plus durable-consumer adoption | -| GAP-072 | Exact all-covered Wilson evidence could retain a zero lower endpoint even though the canonical non-empty finite-`z²` producer always emits `n/(n+z²) > 0` | `verification-pending` | RED `ce714f07...` + non-force source-restore RCA `18499052...` + repair `72e9d954...` + changelog `e3a2f4a2...`; inherited by #488 `7fc78a59...` | -| GAP-073 | Durable Wilson count provenance could round one uncovered observation away above binary64's exact-integer range and expose a pointer-width-dependent count schema | `verification-pending` | RED `29d710a5...` + complement/count repair `29968c80...` + fixed-width carrier repair `91d9a3bb...` + exact ratio RED/repair `63ddfdd6...`/`11323c57...`; #488 `7fc78a59...` | -| GAP-074 | Durable Wilson evidence could correctly retain exact `u64` counts yet pre-round `sample_count` before endpoint projection, shifting strict-interior endpoints or erasing all-covered finite-sample uncertainty | `verification-pending` | RED `f89e2467...` + all-covered edge `1a5180b2...` + stale-oracle correction `6254c498...` + causal reciprocal-scale repair `73bbb5cf...` + changelog `f2b5768b...` + research/current #488 `7fc78a59...` | +| GAP-050 | Zero-multiplier SE-aware acceptance could erase a nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; #488 `ebe6b660...` | +| GAP-051 | Exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; #488 `ebe6b660...` | +| GAP-052 | All-covered Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; #488 `ebe6b660...` | +| GAP-053 | Strict-interior Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; #488 `ebe6b660...` | +| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; #488 `ebe6b660...` | +| GAP-055 | Strict-interior Wilson lower endpoint could accept a nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; #488 `ebe6b660...` | +| GAP-056 | Durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; #488 `ebe6b660...` | +| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from a generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; #488 `ebe6b660...` | +| GAP-058 | Generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; #488 `ebe6b660...` | +| GAP-059 | Generic Monte Carlo summary could materially misstate positive SE relative to `SD / sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; #488 `ebe6b660...` | +| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; #488 `ebe6b660...` | +| GAP-061 | Generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; #488 `ebe6b660...` | +| GAP-062 | Finite-tolerance matching could fail while the pair is deterministically outside every finite tolerance | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; #488 `ebe6b660...` | +| GAP-063 | Exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; #488 `ebe6b660...` | +| GAP-064 | Positive point RMSE could carry SE above the declared squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; #488 `ebe6b660...` | +| GAP-065 | Positive Monte Carlo RMSE could carry spread/SE impossible for nonnegative replications | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; #488 `ebe6b660...` | +| GAP-066 | RMSE Monte Carlo nearest-rank percentile could exceed total nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; #488 `ebe6b660...` | +| GAP-067 | Generic nearest-rank percentile endpoint could be individually incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected over-strong repair `2798e4f9...`; causal repair `c7151b49...`; edge `dbef285b...`; changelog `c38a320c...`; research `2bbcbb24...`; #488 `ebe6b660...` | +| GAP-068 | Distinct generic percentile endpoints could each pass individual radius checks while jointly exceeding the sample squared-deviation budget | `verification-pending` | RED `c4a13826...` + causal repair `cb3f80a2...` + changelog `f727450d...`; #488 `ebe6b660...` | +| GAP-069 | Two-replication distinct nearest-rank endpoints could exhaust the retained sample while the stored mean or SD remained impossible | `verification-pending` | RED `81bf0d9e...` + causal repair `d48f8fef...` + mean coverage `fb314d8a...` + branch cleanup `440b78d8...` + changelog `45116498...`; #488 `ebe6b660...` | +| GAP-070 | Stored Wilson bounds could contain empirical coverage while the lower/upper pair could not arise from one Wilson score interval for that same coverage | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...` + complementary edge `c1cb16a7...`; #488 `ebe6b660...` | +| GAP-071 | Durable Wilson evidence lacked denominator and critical-value/sidedness provenance, preventing exact recomputation from a persisted artifact | `active-repair` | valid carrier RED `6f6e06d2...`; shared count/Wilson authority `ca517ed3...`; `WilsonCoverageEvidenceV1` `31e1ab2b...`; sidedness `e9c63926...`/`fdd24a1a...`; envelope RED `07766cb0...` + `ValidationEvidenceV1` repair `a16f22e6...`; docs/current #488 `ebe6b660...`; remaining: hosted GREEN/review/main plus durable-consumer adoption | +| GAP-072 | Exact all-covered Wilson evidence could retain a zero lower endpoint even though the canonical non-empty finite-`z²` producer always emits `n/(n+z²) > 0` | `verification-pending` | RED `ce714f07...` + non-force source-restore RCA `18499052...` + repair `72e9d954...` + changelog `e3a2f4a2...`; inherited by #488 `ebe6b660...` | +| GAP-073 | Durable Wilson count provenance could round one uncovered observation away above binary64's exact-integer range and expose a pointer-width-dependent count schema | `verification-pending` | RED `29d710a5...` + complement/count repair `29968c80...` + fixed-width carrier repair `91d9a3bb...` + exact ratio RED/repair `63ddfdd6...`/`11323c57...`; #488 `ebe6b660...` | +| GAP-074 | Durable Wilson evidence could correctly retain exact `u64` counts yet pre-round `sample_count` before endpoint projection, shifting strict-interior endpoints or erasing all-covered finite-sample uncertainty | `verification-pending` | RED `f89e2467...` + all-covered edge `1a5180b2...` + stale-oracle correction `6254c498...` + causal reciprocal-scale repair `73bbb5cf...` + changelog `f2b5768b...` + research predecessor #488 `7fc78a59...`; current #488 `ebe6b660...` | +| GAP-075 | Inexact durable all-covered Wilson evidence could round the complementary miss mass to exact one at extreme finite `z` and erase a representable positive lower endpoint | `verification-pending` | RED `059ce70d...`; transient duplicate-owner implementation `46f91f3f...` excluded; canonical repair `0f478392...`; single-writer cleanup `8e2058f2...`; changelog `8a73cb64...`; research/current #488 `ebe6b660...` | ## Release gate From 67722e294c013326d62fe22462506db7acb14fb2 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 4 Sep 2026 17:08:31 +0900 Subject: [PATCH 166/235] docs(product): record exact-count Wilson near-one gap --- docs/product-technical-gap-baseline.md | 79 +++++++++++++------------- 1 file changed, 41 insertions(+), 38 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 736f76f98..951ef9e34 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-04T07:39:25Z +**Snapshot:** 2026-09-04T08:04:01Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` **Workspace version:** `0.2.0` @@ -30,7 +30,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `ebe6b660486e3f7a527849c9e3ad895e6e0fb011` | true | `main` | Validation Evidence landing vehicle. `WilsonCoverageEvidenceV1` retains fixed-width `u64` denominator/count provenance, standard-normal `z`, two-sided semantics, represented coverage and canonical Wilson endpoints. Large-count recomputation preserves exact count-ratio rounding and complement identity; inexact binary64 sample-count scale uses reciprocal evaluation and an all-covered scale switch so neither tiny uncertainty below one nor a positive lower endpoint under extreme finite `z` is erased. Hosted exact-head gates and independent review remain required. | +| #488 | `fe89c43803136ab979912fffa636d2a4f169a73e` | true | `main` | Validation Evidence landing vehicle. `WilsonCoverageEvidenceV1` retains fixed-width `u64` denominator/count provenance, standard-normal `z`, two-sided semantics, represented coverage and canonical Wilson endpoints. Large-count recomputation preserves exact count-ratio rounding and complement identity; inexact binary64 sample-count scale uses reciprocal evaluation and an all-covered scale switch. Exactly representable all-covered counts now also preserve a representable near-one miss mass when direct `n/(n+z²)` denominator addition collapses spuriously to `n`, while uncertainty below binary64 resolution remains exact one. Hosted exact-head gates and independent review remain required. | | #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 | Validation / Analysis Run fold child. Unique evidence must be inherited by a conflict-resolving survivor; child-head CI does not transfer. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | @@ -50,7 +50,7 @@ TEPP owns temporal/event composition, irregular time, time-varying multilevel/cr `psychometric_core` is not authority for new temporal/state composition. fast-mlsirm owns reusable static/generalized-mixed/dependence-aware psychometric specification and arithmetic. TEPP consumes only immutable released/versioned Published Language through an ACL; source copying and mutable sibling-head dependencies are prohibited. -contextual-orchestrator owns provider/model routing and semantic LLM execution. Its fresh protected-main evidence is `60c562defc81fb1897fa97ebdb5bf8f69eae0c55`, while GitHub releases remain zero. Semantic LLM work and model-backed Actions therefore continue to require a released/versioned contextual-orchestrator contract; Actions use `orchestrator/free` through the gateway credential and do not select providers/models/groups or consume direct provider keys. Mutable owner main is evidence, not a TEPP production contract. Context Graph contracts are contract-only integration authority; EA Core owns enterprise-architecture decisions. No cross-service SQL. +contextual-orchestrator owns provider/model routing and semantic LLM execution. Its fresh protected-main evidence is `c4f932b0aebe6fb7ba743451fa47775b678a7f8c`, while GitHub releases remain zero. Semantic LLM work and model-backed Actions therefore continue to require a released/versioned contextual-orchestrator contract; Actions use `orchestrator/free` through the gateway credential and do not select providers/models/groups or consume direct provider keys. Mutable owner main is evidence, not a TEPP production contract. Context Graph contracts are contract-only integration authority; EA Core owns enterprise-architecture decisions. No cross-service SQL. The clock contract separates event/valid time, assertion time, document time, system time, availability time, and knowledge cutoff. Retrospective evidence may describe an earlier event but cannot enter an earlier knowledge cutoff. Forward state/transition edges remain distinct from retrospective/citation/revision/provenance relations. @@ -68,7 +68,7 @@ The clock contract separates event/valid time, assertion time, document time, sy - When the generic carrier occupies `ValidationReport::monte_carlo_rmse`, retained replications are nonnegative; positive mean implies `SE(mean) <= mean`, and inclusive nearest-rank endpoints cannot exceed the nonnegative sample-sum support `n * mean`. These typed bounds are not imposed on signed metrics such as bias. - SE-aware acceptance is `|estimate - target| <= k * SE`. For `k = 0` or exact-zero SE, exact recovery is evaluated before scale reduction; `-0.0` and `+0.0` are one numeric zero-valued scientific state. - `match_count` is a finite-threshold decision and does not require materializing an unrepresentable absolute residual; `absolute_residuals` remains fail closed when the magnitude itself is requested. -- Wilson interval coverage preserves representable endpoints through stable rationalized/complementary forms. Legacy `ValidationReport` endpoint pairs satisfy necessary Wilson coherence and boundary checks, but exact provenance is not inferred from them. `WilsonCoverageEvidenceV1` retains fixed-width `u64` `sample_count`/`covered_count`, `critical_value_kind=standard_normal_z`, `interval_sidedness=two_sided`, the numeric `z`, represented coverage, and canonical endpoints and validates them by exact recomputation through the single crate-private Wilson authority. Exact all-covered status is integer count equality, not rounded `p == 1`. Count proportions are correctly rounded from exact integers. When covered counts dominate, the smaller uncovered complement is evaluated and reflected. When retained `sample_count` itself is not exactly representable in binary64, Wilson scale terms use the correctly rounded reciprocal `1/n` rather than a pre-rounded integer denominator. Exact all-covered evidence uses complementary miss mass for `z²/n <= 1` so a representable endpoint immediately below `1.0` is not erased, and direct reciprocal evaluation for `z²/n > 1` so a large miss mass cannot round to exact one and erase a representable positive lower endpoint. Both forms are algebraically the same Wilson endpoint. `ValidationEvidenceV1` binds that provenance to the legacy report projection without breaking existing report callers. +- Wilson interval coverage preserves representable endpoints through stable rationalized/complementary forms. Legacy `ValidationReport` endpoint pairs satisfy necessary Wilson coherence and boundary checks, but exact provenance is not inferred from them. `WilsonCoverageEvidenceV1` retains fixed-width `u64` `sample_count`/`covered_count`, `critical_value_kind=standard_normal_z`, `interval_sidedness=two_sided`, the numeric `z`, represented coverage, and canonical endpoints and validates them by exact recomputation through the single crate-private Wilson authority. Exact all-covered status is integer count equality, not rounded `p == 1`. Count proportions are correctly rounded from exact integers. When covered counts dominate, the smaller uncovered complement is evaluated and reflected. When retained `sample_count` itself is not exactly representable in binary64, Wilson scale terms use the correctly rounded reciprocal `1/n` rather than a pre-rounded integer denominator; its all-covered path uses complementary miss mass for `z²/n <= 1` and direct reciprocal evaluation for `z²/n > 1`. When an exactly representable all-covered count makes direct `n/(n+z²)` collapse spuriously to exact one despite a representable miss mass, the canonical writer subtracts the algebraically equivalent `z²/(n+z²)` only on that boundary. Smaller miss mass genuinely below binary64 resolution remains exact one. `ValidationEvidenceV1` binds that provenance to the legacy report projection without breaking existing report callers. - Durable and human-facing Validation Evidence must preserve producing-metric invariants on explicit validation, serde ingress/egress, and human projection. Missing v1 provenance is never synthesized from endpoint algebra. - Bias, RMSE, and Monte Carlo may share private deterministic scalar support inside `validation_core`, but metric-specific cancellation/normalization, denominator, uncertainty, and fail-closed semantics remain with their bounded modules. - Historical-cutoff admission occurs before duplicate-identity checks. Future-unavailable evidence cannot change an earlier run's conflicts, counts, or terminal state. @@ -83,7 +83,7 @@ The clock contract separates event/valid time, assertion time, document time, sy ### #488 — Validation Evidence -#488 is the generic Validation Evidence landing vehicle at exact head `ebe6b660486e3f7a527849c9e3ad895e6e0fb011`. It remains distinct from Longitudinal Modeling and does not consume mutable fast-mlsirm source. +#488 is the generic Validation Evidence landing vehicle at exact head `fe89c43803136ab979912fffa636d2a4f169a73e`. It remains distinct from Longitudinal Modeling and does not consume mutable fast-mlsirm source. GAP-070 and GAP-072 remain inherited: stored Wilson endpoints must be one coherent score interval, and exact all-covered evidence cannot use a zero lower endpoint. GAP-071 has advanced from design-only to source implementation. The first carrier test draft `9fc96345...` was invalid and is not evidence; corrected public RED `6f6e06d2...` requires a versioned denominator/critical-value carrier. `ca517ed3...` establishes one private covered-count/Wilson-from-counts authority; `31e1ab2b...` adds `WilsonCoverageEvidenceV1`; `e9c63926...`/`fdd24a1a...` bind standard-normal/two-sided semantics. Envelope RED `07766cb0...` and repair `a16f22e6...` add `ValidationEvidenceV1`, which cross-validates the legacy report projection against the recomputable carrier. The accidental unrelated `lib.rs` wording mutation in `4e2381f3...` is excluded from repair evidence and was corrected non-force by `57d8bf57...`. @@ -91,9 +91,11 @@ GAP-073 retains the large-count identity/schema repair. Public RED `29d710a5...` GAP-074 records the denominator-scale defect left after those repairs. Public RED `f89e2467...` fixes `n = 9_007_199_254_740_1013`, `k = 1_286_742_750_677_287`, `z = 1.96`, where pre-rounding `sample_count` moves the Wilson lower endpoint one ULP. Reinforcement `1a5180b2...` fixes exact all-covered `n = 2^55 + 3`, whose lower endpoint must remain `next_down(1.0)` rather than false exact one. `6254c498...` corrects the predecessor non-boundary fixture whose empirical ratio was exact but Wilson lower still encoded rounded-denominator arithmetic. Causal repair `73bbb5cf...` uses reciprocal-scale Wilson evaluation only for `u64` sample counts that are not exactly binary64-representable; changelog `f2b5768b...`; research predecessor `7fc78a59...`. -GAP-075 records the remaining all-covered conditioning defect on that reciprocal path. Public RED `059ce70d3dd497f486214137bca6a1f1b2e8b3cd` fixes `n = 2^53 + 1`, `covered_count = n`, and `z = 1e20`, where the predecessor complementary miss mass rounds to exact one and turns the lower endpoint into false exact zero although `n/(n+z²)` is the positive binary64 value `9.007199254740993e-25`. Transient commit `46f91f3f3723e8b400dbf3f7e8adaf0422e2c4ee` duplicated canonical Wilson math in the evidence carrier and is excluded from final repair evidence. Causal repair `0f4783929b8d067eecb91696e1ad5761cd315b1e` keeps the scale switch in `coverage.rs`; cleanup `8e2058f2fc6ab42af8f732f03e7ae1dcee3e873d` restores the carrier to consuming that single writer; changelog `8a73cb64d15e5412e5afabbae80603a66c12a7f0`; research/current #488 `ebe6b660486e3f7a527849c9e3ad895e6e0fb011`. +GAP-075 records the remaining all-covered conditioning defect on that reciprocal path. Public RED `059ce70d3dd497f486214137bca6a1f1b2e8b3cd` fixes `n = 2^53 + 1`, `covered_count = n`, and `z = 1e20`, where the predecessor complementary miss mass rounds to exact one and turns the lower endpoint into false exact zero although `n/(n+z²)` is the positive binary64 value `9.007199254740993e-25`. Transient commit `46f91f3f3723e8b400dbf3f7e8adaf0422e2c4ee` duplicated canonical Wilson math in the evidence carrier and is excluded from final repair evidence. Causal repair `0f4783929b8d067eecb91696e1ad5761cd315b1e` keeps the scale switch in `coverage.rs`; cleanup `8e2058f2fc6ab42af8f732f03e7ae1dcee3e873d` restores the carrier to consuming that single writer; exact-oracle correction `93d5d208...`; changelog correction `43b6562c...`; research predecessor `b03a719d...`. -These repairs advance the source-contract portion of GAP-071/GAP-073/GAP-074/GAP-075 but not delivery: exact-head hosted gates, independent review, protected-main integration, and adoption by durable consumers that require v1 provenance remain outstanding. Bare legacy `ValidationReport` remains a backward-compatible compact projection and is not silently treated as v1 provenance. +GAP-076 records the exact-count all-covered near-one denominator-absorption defect. Public RED `e0c4ec81bb455d230259489dc71e23fe33704b1d` fixes `n = 1` and represented `z = 0x1.0000000000001p-27`, whose represented square is `0x1.0000000000002p-54`. The predecessor adds `z²` to `n` first, that denominator rounds back to `1.0`, and direct `n/(n+z²)` falsely emits exact one although the represented-input Wilson lower endpoint is `next_down(1.0)`. Causal repair `c9dcb9df363999bbcbb6fffdc8b6a6d9ae5e762c` performs the algebraically equivalent complementary miss calculation only after that direct false-one collapse; boundary reinforcement `6140080d2257d0550be479d71371d70e2255c3d0` proves `z=2^-28`, `z²=2^-56` remains correctly represented as exact one; changelog `09ebb482851fe7836e738a74395e6424621da9bf`; research/current #488 `fe89c43803136ab979912fffa636d2a4f169a73e`. Concurrent edge commit `ccb75e812988c969206177e4876c7abe9944bfd5` remains inherited for the inexact-count subnormal-scale boundary. + +These repairs advance the source-contract portion of GAP-071/GAP-073/GAP-074/GAP-075/GAP-076 but not delivery: exact-head hosted gates, independent review, protected-main integration, and adoption by durable consumers that require v1 provenance remain outstanding. Bare legacy `ValidationReport` remains a backward-compatible compact projection and is not silently treated as v1 provenance. Wilson (1927) remains the primary score-interval reference. AERA/APA/NCME (2014) remains the current published testing-standards edition while revision is underway. IEEE 754-2019 and ISO/IEC 60559:2020 remain the published active floating-point authorities used for the current binary64 representation trace; active IEEE P754 is not treated as a published replacement. @@ -103,7 +105,7 @@ Wilson (1927) remains the primary score-interval reference. AERA/APA/NCME (2014) ### #480 — contextual-orchestrator boundary -#480 removes TEPP-owned provider discovery/ranking and requires a released contextual-orchestrator owner contract. Its exact source head remains `01f45a99392457334a4f6d3d659f992af739eeee`. contextual-orchestrator protected main is `60c562defc81fb1897fa97ebdb5bf8f69eae0c55`, but GitHub releases remain zero, so #480 stays Draft until an immutable compatible release plus deployment/auth/schema/artifact provenance exists. Mutable owner main is evidence, not a production contract. +#480 removes TEPP-owned provider discovery/ranking and requires a released contextual-orchestrator owner contract. Its exact source head remains `01f45a99392457334a4f6d3d659f992af739eeee`. contextual-orchestrator protected main is `c4f932b0aebe6fb7ba743451fa47775b678a7f8c`, but GitHub releases remain zero, so #480 stays Draft until an immutable compatible release plus deployment/auth/schema/artifact provenance exists. Mutable owner main is evidence, not a production contract. ## Gap register @@ -153,37 +155,38 @@ Wilson (1927) remains the primary score-interval reference. AERA/APA/NCME (2014) | GAP-042 | Ratio-first logarithm could nearly double an adjacent-float irregular residual growth rate | `verification-pending` | RED `766ddc7a...` + `ln_1p` repair `16f21d9a...` | | GAP-043 | Duplicate known-truth component identities could silently reweight RMSE recovery evidence | `verification-pending` | RED `698f12f5...` + uniqueness repair `2fae4cb2...` | | GAP-044 | Known-truth RMSE alignment/accumulation depended on row order instead of component identity | `verification-pending` | RED `8ad72ac9...` / `5fb93c40...` + repairs `2dd9537e...` / `025dce7f...`; #310 `c6680450...` | -| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; #488 `ebe6b660...` | -| GAP-046 | Bias SE could reject a representable SEM because raw squared deviations/intermediates overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; #488 `ebe6b660...` | -| GAP-047 | Generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; #488 `ebe6b660...` | -| GAP-048 | Mean signed bias could erase a representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; #488 `ebe6b660...` | +| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; #488 `fe89c438...` | +| GAP-046 | Bias SE could reject a representable SEM because raw squared deviations/intermediates overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; #488 `fe89c438...` | +| GAP-047 | Generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; #488 `fe89c438...` | +| GAP-048 | Mean signed bias could erase a representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; #488 `fe89c438...` | | GAP-049 | Stable `Between` recovery could be aliased across occasion indices and reweight RMSE | `verification-pending` | RED `0a03041c...` + repair `ec2c1219...`; #310 `c6680450...` | -| GAP-050 | Zero-multiplier SE-aware acceptance could erase a nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; #488 `ebe6b660...` | -| GAP-051 | Exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; #488 `ebe6b660...` | -| GAP-052 | All-covered Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; #488 `ebe6b660...` | -| GAP-053 | Strict-interior Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; #488 `ebe6b660...` | -| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; #488 `ebe6b660...` | -| GAP-055 | Strict-interior Wilson lower endpoint could accept a nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; #488 `ebe6b660...` | -| GAP-056 | Durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; #488 `ebe6b660...` | -| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from a generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; #488 `ebe6b660...` | -| GAP-058 | Generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; #488 `ebe6b660...` | -| GAP-059 | Generic Monte Carlo summary could materially misstate positive SE relative to `SD / sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; #488 `ebe6b660...` | -| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; #488 `ebe6b660...` | -| GAP-061 | Generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; #488 `ebe6b660...` | -| GAP-062 | Finite-tolerance matching could fail while the pair is deterministically outside every finite tolerance | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; #488 `ebe6b660...` | -| GAP-063 | Exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; #488 `ebe6b660...` | -| GAP-064 | Positive point RMSE could carry SE above the declared squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; #488 `ebe6b660...` | -| GAP-065 | Positive Monte Carlo RMSE could carry spread/SE impossible for nonnegative replications | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; #488 `ebe6b660...` | -| GAP-066 | RMSE Monte Carlo nearest-rank percentile could exceed total nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; #488 `ebe6b660...` | -| GAP-067 | Generic nearest-rank percentile endpoint could be individually incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected over-strong repair `2798e4f9...`; causal repair `c7151b49...`; edge `dbef285b...`; changelog `c38a320c...`; research `2bbcbb24...`; #488 `ebe6b660...` | -| GAP-068 | Distinct generic percentile endpoints could each pass individual radius checks while jointly exceeding the sample squared-deviation budget | `verification-pending` | RED `c4a13826...` + causal repair `cb3f80a2...` + changelog `f727450d...`; #488 `ebe6b660...` | -| GAP-069 | Two-replication distinct nearest-rank endpoints could exhaust the retained sample while the stored mean or SD remained impossible | `verification-pending` | RED `81bf0d9e...` + causal repair `d48f8fef...` + mean coverage `fb314d8a...` + branch cleanup `440b78d8...` + changelog `45116498...`; #488 `ebe6b660...` | -| GAP-070 | Stored Wilson bounds could contain empirical coverage while the lower/upper pair could not arise from one Wilson score interval for that same coverage | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...` + complementary edge `c1cb16a7...`; #488 `ebe6b660...` | -| GAP-071 | Durable Wilson evidence lacked denominator and critical-value/sidedness provenance, preventing exact recomputation from a persisted artifact | `active-repair` | valid carrier RED `6f6e06d2...`; shared count/Wilson authority `ca517ed3...`; `WilsonCoverageEvidenceV1` `31e1ab2b...`; sidedness `e9c63926...`/`fdd24a1a...`; envelope RED `07766cb0...` + `ValidationEvidenceV1` repair `a16f22e6...`; docs/current #488 `ebe6b660...`; remaining: hosted GREEN/review/main plus durable-consumer adoption | -| GAP-072 | Exact all-covered Wilson evidence could retain a zero lower endpoint even though the canonical non-empty finite-`z²` producer always emits `n/(n+z²) > 0` | `verification-pending` | RED `ce714f07...` + non-force source-restore RCA `18499052...` + repair `72e9d954...` + changelog `e3a2f4a2...`; inherited by #488 `ebe6b660...` | -| GAP-073 | Durable Wilson count provenance could round one uncovered observation away above binary64's exact-integer range and expose a pointer-width-dependent count schema | `verification-pending` | RED `29d710a5...` + complement/count repair `29968c80...` + fixed-width carrier repair `91d9a3bb...` + exact ratio RED/repair `63ddfdd6...`/`11323c57...`; #488 `ebe6b660...` | -| GAP-074 | Durable Wilson evidence could correctly retain exact `u64` counts yet pre-round `sample_count` before endpoint projection, shifting strict-interior endpoints or erasing all-covered finite-sample uncertainty | `verification-pending` | RED `f89e2467...` + all-covered edge `1a5180b2...` + stale-oracle correction `6254c498...` + causal reciprocal-scale repair `73bbb5cf...` + changelog `f2b5768b...` + research predecessor #488 `7fc78a59...`; current #488 `ebe6b660...` | -| GAP-075 | Inexact durable all-covered Wilson evidence could round the complementary miss mass to exact one at extreme finite `z` and erase a representable positive lower endpoint | `verification-pending` | RED `059ce70d...`; transient duplicate-owner implementation `46f91f3f...` excluded; canonical repair `0f478392...`; single-writer cleanup `8e2058f2...`; changelog `8a73cb64...`; research/current #488 `ebe6b660...` | +| GAP-050 | Zero-multiplier SE-aware acceptance could erase a nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; #488 `fe89c438...` | +| GAP-051 | Exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; #488 `fe89c438...` | +| GAP-052 | All-covered Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; #488 `fe89c438...` | +| GAP-053 | Strict-interior Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; #488 `fe89c438...` | +| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; #488 `fe89c438...` | +| GAP-055 | Strict-interior Wilson lower endpoint could accept a nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; #488 `fe89c438...` | +| GAP-056 | Durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; #488 `fe89c438...` | +| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from a generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; #488 `fe89c438...` | +| GAP-058 | Generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; #488 `fe89c438...` | +| GAP-059 | Generic Monte Carlo summary could materially misstate positive SE relative to `SD / sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; #488 `fe89c438...` | +| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; #488 `fe89c438...` | +| GAP-061 | Generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; #488 `fe89c438...` | +| GAP-062 | Finite-tolerance matching could fail while the pair is deterministically outside every finite tolerance | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; #488 `fe89c438...` | +| GAP-063 | Exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; #488 `fe89c438...` | +| GAP-064 | Positive point RMSE could carry SE above the declared squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; #488 `fe89c438...` | +| GAP-065 | Positive Monte Carlo RMSE could carry spread/SE impossible for nonnegative replications | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; #488 `fe89c438...` | +| GAP-066 | RMSE Monte Carlo nearest-rank percentile could exceed total nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; #488 `fe89c438...` | +| GAP-067 | Generic nearest-rank percentile endpoint could be individually incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected over-strong repair `2798e4f9...`; causal repair `c7151b49...`; edge `dbef285b...`; changelog `c38a320c...`; research `2bbcbb24...`; #488 `fe89c438...` | +| GAP-068 | Distinct generic percentile endpoints could each pass individual radius checks while jointly exceeding the sample squared-deviation budget | `verification-pending` | RED `c4a13826...` + causal repair `cb3f80a2...` + changelog `f727450d...`; #488 `fe89c438...` | +| GAP-069 | Two-replication distinct nearest-rank endpoints could exhaust the retained sample while the stored mean or SD remained impossible | `verification-pending` | RED `81bf0d9e...` + causal repair `d48f8fef...` + mean coverage `fb314d8a...` + branch cleanup `440b78d8...` + changelog `45116498...`; #488 `fe89c438...` | +| GAP-070 | Stored Wilson bounds could contain empirical coverage while the lower/upper pair could not arise from one Wilson score interval for that same coverage | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...` + complementary edge `c1cb16a7...`; #488 `fe89c438...` | +| GAP-071 | Durable Wilson evidence lacked denominator and critical-value/sidedness provenance, preventing exact recomputation from a persisted artifact | `active-repair` | valid carrier RED `6f6e06d2...`; shared count/Wilson authority `ca517ed3...`; `WilsonCoverageEvidenceV1` `31e1ab2b...`; sidedness `e9c63926...`/`fdd24a1a...`; envelope RED `07766cb0...` + `ValidationEvidenceV1` repair `a16f22e6...`; docs/current #488 `fe89c438...`; remaining: hosted GREEN/review/main plus durable-consumer adoption | +| GAP-072 | Exact all-covered Wilson evidence could retain a zero lower endpoint even though the canonical non-empty finite-`z²` producer always emits `n/(n+z²) > 0` | `verification-pending` | RED `ce714f07...` + non-force source-restore RCA `18499052...` + repair `72e9d954...` + changelog `e3a2f4a2...`; inherited by #488 `fe89c438...` | +| GAP-073 | Durable Wilson count provenance could round one uncovered observation away above binary64's exact-integer range and expose a pointer-width-dependent count schema | `verification-pending` | RED `29d710a5...` + complement/count repair `29968c80...` + fixed-width carrier repair `91d9a3bb...` + exact ratio RED/repair `63ddfdd6...`/`11323c57...`; #488 `fe89c438...` | +| GAP-074 | Durable Wilson evidence could correctly retain exact `u64` counts yet pre-round `sample_count` before endpoint projection, shifting strict-interior endpoints or erasing all-covered finite-sample uncertainty | `verification-pending` | RED `f89e2467...` + all-covered edge `1a5180b2...` + stale-oracle correction `6254c498...` + causal reciprocal-scale repair `73bbb5cf...` + changelog `f2b5768b...` + research predecessor #488 `7fc78a59...`; current #488 `fe89c438...` | +| GAP-075 | Inexact durable all-covered Wilson evidence could round the complementary miss mass to exact one at extreme finite `z` and erase a representable positive lower endpoint | `verification-pending` | RED `059ce70d...`; transient duplicate-owner implementation `46f91f3f...` excluded; canonical repair `0f478392...`; single-writer cleanup `8e2058f2...`; exact-oracle correction `93d5d208...`; changelog correction `43b6562c...`; research predecessor `b03a719d...`; current #488 `fe89c438...` | +| GAP-076 | Exactly representable all-covered Wilson counts could absorb a small positive `z²` in `n + z²` and falsely emit exact `1.0` although a lower binary64 endpoint is representable | `verification-pending` | RED `e0c4ec81...` + causal boundary repair `c9dcb9df...` + below-resolution edge `6140080d...` + changelog `09ebb482...` + research/current #488 `fe89c438...` | ## Release gate From 4256e68b3c7d9bd418e015a0a1001f44462e6532 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 4 Sep 2026 18:39:08 +0900 Subject: [PATCH 167/235] docs(ddd): add Wilson partial-denominator gap authority --- docs/product-technical-gap-baseline.md | 95 +++++++++++++------------- 1 file changed, 47 insertions(+), 48 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 951ef9e34..0a80c7609 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-04T08:04:01Z +**Snapshot:** 2026-09-04T09:37:15Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` **Workspace version:** `0.2.0` @@ -30,7 +30,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `fe89c43803136ab979912fffa636d2a4f169a73e` | true | `main` | Validation Evidence landing vehicle. `WilsonCoverageEvidenceV1` retains fixed-width `u64` denominator/count provenance, standard-normal `z`, two-sided semantics, represented coverage and canonical Wilson endpoints. Large-count recomputation preserves exact count-ratio rounding and complement identity; inexact binary64 sample-count scale uses reciprocal evaluation and an all-covered scale switch. Exactly representable all-covered counts now also preserve a representable near-one miss mass when direct `n/(n+z²)` denominator addition collapses spuriously to `n`, while uncertainty below binary64 resolution remains exact one. Hosted exact-head gates and independent review remain required. | +| #488 | `51ca9e8a6a3201d2a3e4e4fcff52e1175b746297` | true | `main` | Validation Evidence landing vehicle. `WilsonCoverageEvidenceV1` retains fixed-width `u64` denominator/count provenance, standard-normal `z`, two-sided semantics, represented coverage, and canonical Wilson endpoints. Large-count recomputation preserves exact count-ratio rounding and complement identity; inexact binary64 sample-count scale uses reciprocal evaluation and an all-covered scale switch. For exactly representable all-covered counts, the canonical writer preserves near-one miss mass and now also compensates any demonstrably inexact `n + z²` denominator sum with a TwoSum/FMA quotient residual; exact sums remain on the direct path. Hosted exact-head gates and independent review remain required. | | #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 | Validation / Analysis Run fold child. Unique evidence must be inherited by a conflict-resolving survivor; child-head CI does not transfer. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | @@ -50,7 +50,7 @@ TEPP owns temporal/event composition, irregular time, time-varying multilevel/cr `psychometric_core` is not authority for new temporal/state composition. fast-mlsirm owns reusable static/generalized-mixed/dependence-aware psychometric specification and arithmetic. TEPP consumes only immutable released/versioned Published Language through an ACL; source copying and mutable sibling-head dependencies are prohibited. -contextual-orchestrator owns provider/model routing and semantic LLM execution. Its fresh protected-main evidence is `c4f932b0aebe6fb7ba743451fa47775b678a7f8c`, while GitHub releases remain zero. Semantic LLM work and model-backed Actions therefore continue to require a released/versioned contextual-orchestrator contract; Actions use `orchestrator/free` through the gateway credential and do not select providers/models/groups or consume direct provider keys. Mutable owner main is evidence, not a TEPP production contract. Context Graph contracts are contract-only integration authority; EA Core owns enterprise-architecture decisions. No cross-service SQL. +contextual-orchestrator owns provider/model routing and semantic LLM execution. Its last verified protected-main evidence in this baseline is `c4f932b0aebe6fb7ba743451fa47775b678a7f8c`, while GitHub releases remain zero. Semantic LLM work and model-backed Actions therefore continue to require a released/versioned contextual-orchestrator contract; Actions use `orchestrator/free` through the gateway credential and do not select providers/models/groups or consume direct provider keys. Mutable owner main is evidence, not a TEPP production contract. Context Graph contracts are contract-only integration authority; EA Core owns enterprise-architecture decisions. No cross-service SQL. The clock contract separates event/valid time, assertion time, document time, system time, availability time, and knowledge cutoff. Retrospective evidence may describe an earlier event but cannot enter an earlier knowledge cutoff. Forward state/transition edges remain distinct from retrospective/citation/revision/provenance relations. @@ -64,11 +64,11 @@ The clock contract separates event/valid time, assertion time, document time, sy - A representable final scientific estimand is not rejected solely because an avoidable intermediate binary64 operation overflows/underflows. False exact 0/1/non-finite endpoints and cancellation residues are not accepted when an algebraically equivalent stable form preserves the represented estimand. - Mean signed bias and bias SE remain Validation Evidence performance measures over admitted recovery units; representable cancellation/SEM must survive avoidable overflow/underflow while mathematically nonzero finals below binary64 range fail closed. - Generic Validation Evidence RMSE and its delta-method SE normalize before squaring. Exact-zero point RMSE requires exact-zero point RMSE SE. For positive RMSE, the declared producer satisfies `SE(RMSE) <= RMSE / 2`, with a small relative binary64 admission tolerance. -- Generic `MonteCarloSummary` is sign-neutral. Zero SD requires zero SE and percentile endpoints equal to the represented mean. Positive SD requires positive SE coherent with represented `SD / sqrt(n)` within a small relative tolerance. Every inclusive nearest-rank endpoint is a retained observation and satisfies `|endpoint - mean| <= SD * sqrt(n - 1)`. Distinct lower/upper endpoint values share the same `(n - 1) * SD²` deviation budget. When `replication_count = 2` and endpoints are numerically distinct, those values exhaust the retained sample and the recorded represented mean/sample SD must match the deterministic two-value reconstruction. Equal numeric endpoints do not prove two distinct ranks and are not subjected to that exhaustion rule. -- When the generic carrier occupies `ValidationReport::monte_carlo_rmse`, retained replications are nonnegative; positive mean implies `SE(mean) <= mean`, and inclusive nearest-rank endpoints cannot exceed the nonnegative sample-sum support `n * mean`. These typed bounds are not imposed on signed metrics such as bias. +- Generic `MonteCarloSummary` is sign-neutral. Zero SD requires zero SE and percentile endpoints equal to the represented mean. Positive SD requires positive SE coherent with represented `SD / sqrt(n)` within a small relative tolerance. Every inclusive nearest-rank endpoint is a retained observation and satisfies `|endpoint - mean| <= SD * sqrt(n - 1)`. Distinct lower/upper endpoint values share the same `(n - 1) * SD²` deviation budget. When `replication_count = 2` and endpoints are numerically distinct, those values exhaust the retained sample and the recorded represented mean/sample SD must match deterministic two-value reconstruction. Equal numeric endpoints do not prove two distinct ranks and are not subjected to that exhaustion rule. +- When the generic carrier occupies `ValidationReport::monte_carlo_rmse`, retained replications are nonnegative; positive mean implies `SE(mean) <= mean`, and inclusive nearest-rank endpoints cannot exceed nonnegative sample-sum support `n * mean`. These typed bounds are not imposed on signed metrics such as bias. - SE-aware acceptance is `|estimate - target| <= k * SE`. For `k = 0` or exact-zero SE, exact recovery is evaluated before scale reduction; `-0.0` and `+0.0` are one numeric zero-valued scientific state. - `match_count` is a finite-threshold decision and does not require materializing an unrepresentable absolute residual; `absolute_residuals` remains fail closed when the magnitude itself is requested. -- Wilson interval coverage preserves representable endpoints through stable rationalized/complementary forms. Legacy `ValidationReport` endpoint pairs satisfy necessary Wilson coherence and boundary checks, but exact provenance is not inferred from them. `WilsonCoverageEvidenceV1` retains fixed-width `u64` `sample_count`/`covered_count`, `critical_value_kind=standard_normal_z`, `interval_sidedness=two_sided`, the numeric `z`, represented coverage, and canonical endpoints and validates them by exact recomputation through the single crate-private Wilson authority. Exact all-covered status is integer count equality, not rounded `p == 1`. Count proportions are correctly rounded from exact integers. When covered counts dominate, the smaller uncovered complement is evaluated and reflected. When retained `sample_count` itself is not exactly representable in binary64, Wilson scale terms use the correctly rounded reciprocal `1/n` rather than a pre-rounded integer denominator; its all-covered path uses complementary miss mass for `z²/n <= 1` and direct reciprocal evaluation for `z²/n > 1`. When an exactly representable all-covered count makes direct `n/(n+z²)` collapse spuriously to exact one despite a representable miss mass, the canonical writer subtracts the algebraically equivalent `z²/(n+z²)` only on that boundary. Smaller miss mass genuinely below binary64 resolution remains exact one. `ValidationEvidenceV1` binds that provenance to the legacy report projection without breaking existing report callers. +- Wilson interval coverage preserves represented-input endpoints through stable rationalized/complementary/compensated forms. Legacy `ValidationReport` endpoint pairs satisfy necessary Wilson coherence and boundary checks, but exact provenance is not inferred from them. `WilsonCoverageEvidenceV1` retains fixed-width `u64` `sample_count`/`covered_count`, `critical_value_kind=standard_normal_z`, `interval_sidedness=two_sided`, numeric `z`, represented coverage, and canonical endpoints and validates them by exact recomputation through the single crate-private Wilson authority. Exact all-covered status is integer count equality, not rounded `p == 1`. Count proportions are correctly rounded from exact integers. When covered counts dominate, the smaller uncovered complement is evaluated and reflected. When retained `sample_count` itself is not exactly representable in binary64, Wilson scale terms use correctly rounded reciprocal `1/n`; its all-covered path uses complementary miss mass for `z²/n <= 1` and direct reciprocal evaluation for `z²/n > 1`. For an exactly representable all-covered count, a false exact-one quotient retains the boundary-local complementary repair. Otherwise, if `n + z²` is inexact, the canonical writer recovers the TwoSum denominator residual and applies a fused quotient-residual correction; exact denominator sums remain direct. This is a demonstrated represented-input repair, not a claim of global correct rounding for every Wilson rearrangement. Smaller miss mass genuinely below binary64 resolution remains exact one. `ValidationEvidenceV1` binds provenance to the legacy report projection without breaking existing report callers. - Durable and human-facing Validation Evidence must preserve producing-metric invariants on explicit validation, serde ingress/egress, and human projection. Missing v1 provenance is never synthesized from endpoint algebra. - Bias, RMSE, and Monte Carlo may share private deterministic scalar support inside `validation_core`, but metric-specific cancellation/normalization, denominator, uncertainty, and fail-closed semantics remain with their bounded modules. - Historical-cutoff admission occurs before duplicate-identity checks. Future-unavailable evidence cannot change an earlier run's conflicts, counts, or terminal state. @@ -83,29 +83,27 @@ The clock contract separates event/valid time, assertion time, document time, sy ### #488 — Validation Evidence -#488 is the generic Validation Evidence landing vehicle at exact head `fe89c43803136ab979912fffa636d2a4f169a73e`. It remains distinct from Longitudinal Modeling and does not consume mutable fast-mlsirm source. +#488 is the generic Validation Evidence landing vehicle at exact head `51ca9e8a6a3201d2a3e4e4fcff52e1175b746297`. It remains distinct from Longitudinal Modeling and does not consume mutable fast-mlsirm source. -GAP-070 and GAP-072 remain inherited: stored Wilson endpoints must be one coherent score interval, and exact all-covered evidence cannot use a zero lower endpoint. GAP-071 has advanced from design-only to source implementation. The first carrier test draft `9fc96345...` was invalid and is not evidence; corrected public RED `6f6e06d2...` requires a versioned denominator/critical-value carrier. `ca517ed3...` establishes one private covered-count/Wilson-from-counts authority; `31e1ab2b...` adds `WilsonCoverageEvidenceV1`; `e9c63926...`/`fdd24a1a...` bind standard-normal/two-sided semantics. Envelope RED `07766cb0...` and repair `a16f22e6...` add `ValidationEvidenceV1`, which cross-validates the legacy report projection against the recomputable carrier. The accidental unrelated `lib.rs` wording mutation in `4e2381f3...` is excluded from repair evidence and was corrected non-force by `57d8bf57...`. +GAP-070 and GAP-072 remain inherited: stored Wilson endpoints must be one coherent score interval, and exact all-covered evidence cannot use a zero lower endpoint. GAP-071 has advanced from design-only to source implementation. Corrected carrier RED `6f6e06d2...` requires a versioned denominator/critical-value carrier; `ca517ed3...` establishes one private covered-count/Wilson-from-counts authority; `31e1ab2b...` adds `WilsonCoverageEvidenceV1`; `e9c63926...`/`fdd24a1a...` bind standard-normal/two-sided semantics. Envelope RED `07766cb0...` and repair `a16f22e6...` add `ValidationEvidenceV1`, which cross-validates the legacy report projection against the recomputable carrier. -GAP-073 retains the large-count identity/schema repair. Public RED `29d710a5...` uses `n = 2^53 + 1`, `k = 2^53`, and `z = 1.96` to require a one-uncovered durable artifact to remain distinct from all-covered evidence. Repair `29968c80...` evaluates the smaller uncovered complement and reflects the Wilson endpoints; `91d9a3bb...` makes versioned count fields fixed-width `u64`. The later ratio RED `63ddfdd6...` and repair `11323c57...` correctly round non-boundary `covered_count/sample_count` from exact integer provenance. +GAP-073 retains large-count identity/schema and exact-ratio projection. GAP-074 retains reciprocal-scale evaluation for sample counts that are not exactly representable in binary64. GAP-075 retains the inexact-count all-covered extreme-`z` scale switch and exact-oracle correction. -GAP-074 records the denominator-scale defect left after those repairs. Public RED `f89e2467...` fixes `n = 9_007_199_254_740_1013`, `k = 1_286_742_750_677_287`, `z = 1.96`, where pre-rounding `sample_count` moves the Wilson lower endpoint one ULP. Reinforcement `1a5180b2...` fixes exact all-covered `n = 2^55 + 3`, whose lower endpoint must remain `next_down(1.0)` rather than false exact one. `6254c498...` corrects the predecessor non-boundary fixture whose empirical ratio was exact but Wilson lower still encoded rounded-denominator arithmetic. Causal repair `73bbb5cf...` uses reciprocal-scale Wilson evaluation only for `u64` sample counts that are not exactly binary64-representable; changelog `f2b5768b...`; research predecessor `7fc78a59...`. +GAP-076 records the exact-count all-covered near-one denominator-absorption defect. Public RED `e0c4ec81bb455d230259489dc71e23fe33704b1d` fixes `n=1` and represented `z=0x1.0000000000001p-27`; causal repair `c9dcb9df363999bbcbb6fffdc8b6a6d9ae5e762c` performs the complementary miss calculation only after direct false-one collapse; boundary `6140080d2257d0550be479d71371d70e2255c3d0` preserves true exact one below binary64 resolution; changelog `09ebb482851fe7836e738a74395e6424621da9bf`; research predecessor `fe89c43803136ab979912fffa636d2a4f169a73e`. -GAP-075 records the remaining all-covered conditioning defect on that reciprocal path. Public RED `059ce70d3dd497f486214137bca6a1f1b2e8b3cd` fixes `n = 2^53 + 1`, `covered_count = n`, and `z = 1e20`, where the predecessor complementary miss mass rounds to exact one and turns the lower endpoint into false exact zero although `n/(n+z²)` is the positive binary64 value `9.007199254740993e-25`. Transient commit `46f91f3f3723e8b400dbf3f7e8adaf0422e2c4ee` duplicated canonical Wilson math in the evidence carrier and is excluded from final repair evidence. Causal repair `0f4783929b8d067eecb91696e1ad5761cd315b1e` keeps the scale switch in `coverage.rs`; cleanup `8e2058f2fc6ab42af8f732f03e7ae1dcee3e873d` restores the carrier to consuming that single writer; exact-oracle correction `93d5d208...`; changelog correction `43b6562c...`; research predecessor `b03a719d...`. +GAP-077 records the ordinary partial-denominator state left after the near-one and complete-absorption repairs. With `n=1` and represented `z=3*2^-28`, represented `z²=9*2^-56`; `1+z²` rounds upward before division, so predecessor direct evaluation emits `0x1.ffffffffffffep-1` although the represented-input rational lower endpoint rounds to `0x1.fffffffffffffp-1`. Public RED `06e556538e171e675c4d8a8287d75052ffc2c4c3` → causal TwoSum/FMA residual repair `6c084dbe607e6c415288c77fa41a4270947cd51e` → research `25cc19436085881602356e7f2609b697b575540c` → dedicated changelog `5acc894b8a4d42cd7af8cdc22a02b61a063f16aa` → predecessor changelog correction `f89e36d1f2a048befb983327c83f5696baf530cc` → correct-direct-rounding control `80a0a0ade16f516bf63907f2a8d5105dbcd9c438` → research/current #488 `51ca9e8a6a3201d2a3e4e4fcff52e1175b746297`. -GAP-076 records the exact-count all-covered near-one denominator-absorption defect. Public RED `e0c4ec81bb455d230259489dc71e23fe33704b1d` fixes `n = 1` and represented `z = 0x1.0000000000001p-27`, whose represented square is `0x1.0000000000002p-54`. The predecessor adds `z²` to `n` first, that denominator rounds back to `1.0`, and direct `n/(n+z²)` falsely emits exact one although the represented-input Wilson lower endpoint is `next_down(1.0)`. Causal repair `c9dcb9df363999bbcbb6fffdc8b6a6d9ae5e762c` performs the algebraically equivalent complementary miss calculation only after that direct false-one collapse; boundary reinforcement `6140080d2257d0550be479d71371d70e2255c3d0` proves `z=2^-28`, `z²=2^-56` remains correctly represented as exact one; changelog `09ebb482851fe7836e738a74395e6424621da9bf`; research/current #488 `fe89c43803136ab979912fffa636d2a4f169a73e`. Concurrent edge commit `ccb75e812988c969206177e4876c7abe9944bfd5` remains inherited for the inexact-count subnormal-scale boundary. +These repairs advance the source-contract portion of GAP-071/GAP-073/GAP-074/GAP-075/GAP-076/GAP-077 but not delivery: exact-head hosted gates, independent review, protected-main integration, and adoption by durable consumers that require v1 provenance remain outstanding. Bare legacy `ValidationReport` remains a backward-compatible compact projection and is not silently treated as v1 provenance. -These repairs advance the source-contract portion of GAP-071/GAP-073/GAP-074/GAP-075/GAP-076 but not delivery: exact-head hosted gates, independent review, protected-main integration, and adoption by durable consumers that require v1 provenance remain outstanding. Bare legacy `ValidationReport` remains a backward-compatible compact projection and is not silently treated as v1 provenance. - -Wilson (1927) remains the primary score-interval reference. AERA/APA/NCME (2014) remains the current published testing-standards edition while revision is underway. IEEE 754-2019 and ISO/IEC 60559:2020 remain the published active floating-point authorities used for the current binary64 representation trace; active IEEE P754 is not treated as a published replacement. +Wilson (1927) remains the primary score-interval reference. AERA/APA/NCME (2014) remains the current published testing-standards edition while revision is underway. IEEE 754-2019 and ISO/IEC 60559:2020 remain the published floating-point authorities used for binary64 representation trace; active IEEE P754 is not treated as a published replacement. ### #416 — Validation / Analysis Run consolidation -#416 branch head is `aa730c63563eb4a33048d822b581036c8487bd47`; its body distinguishes the current exact source repair `0b7155cc238defb1e55129ff3000658f04b343cf` from later branch metadata/docs commits. #458/#460/#482/#483/#484/#485/#487 remain fold children until every unique source/test/fixture/contract/doctoring delta is inherited by a conflict-resolving survivor. Child-head CI never transfers to #416. +#416 branch head is `aa730c63563eb4a33048d822b581036c8487bd47`; its body distinguishes current exact source repair from later metadata/docs commits. #458/#460/#482/#483/#484/#485/#487 remain fold children until every unique source/test/fixture/contract/doctoring delta is inherited by a conflict-resolving survivor. Child-head CI never transfers to #416. ### #480 — contextual-orchestrator boundary -#480 removes TEPP-owned provider discovery/ranking and requires a released contextual-orchestrator owner contract. Its exact source head remains `01f45a99392457334a4f6d3d659f992af739eeee`. contextual-orchestrator protected main is `c4f932b0aebe6fb7ba743451fa47775b678a7f8c`, but GitHub releases remain zero, so #480 stays Draft until an immutable compatible release plus deployment/auth/schema/artifact provenance exists. Mutable owner main is evidence, not a production contract. +#480 removes TEPP-owned provider discovery/ranking and requires a released contextual-orchestrator owner contract. Its exact source head remains `01f45a99392457334a4f6d3d659f992af739eeee`. The latest owner state must be refreshed before any consumer bump; mutable owner main is evidence, not a production contract, and #480 stays Draft until an immutable compatible release plus deployment/auth/schema/artifact provenance exists. ## Gap register @@ -155,38 +153,39 @@ Wilson (1927) remains the primary score-interval reference. AERA/APA/NCME (2014) | GAP-042 | Ratio-first logarithm could nearly double an adjacent-float irregular residual growth rate | `verification-pending` | RED `766ddc7a...` + `ln_1p` repair `16f21d9a...` | | GAP-043 | Duplicate known-truth component identities could silently reweight RMSE recovery evidence | `verification-pending` | RED `698f12f5...` + uniqueness repair `2fae4cb2...` | | GAP-044 | Known-truth RMSE alignment/accumulation depended on row order instead of component identity | `verification-pending` | RED `8ad72ac9...` / `5fb93c40...` + repairs `2dd9537e...` / `025dce7f...`; #310 `c6680450...` | -| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; #488 `fe89c438...` | -| GAP-046 | Bias SE could reject a representable SEM because raw squared deviations/intermediates overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; #488 `fe89c438...` | -| GAP-047 | Generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; #488 `fe89c438...` | -| GAP-048 | Mean signed bias could erase a representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; #488 `fe89c438...` | +| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; #488 `51ca9e8a...` | +| GAP-046 | Bias SE could reject a representable SEM because raw squared deviations/intermediates overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; #488 `51ca9e8a...` | +| GAP-047 | Generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; #488 `51ca9e8a...` | +| GAP-048 | Mean signed bias could erase a representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; #488 `51ca9e8a...` | | GAP-049 | Stable `Between` recovery could be aliased across occasion indices and reweight RMSE | `verification-pending` | RED `0a03041c...` + repair `ec2c1219...`; #310 `c6680450...` | -| GAP-050 | Zero-multiplier SE-aware acceptance could erase a nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; #488 `fe89c438...` | -| GAP-051 | Exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; #488 `fe89c438...` | -| GAP-052 | All-covered Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; #488 `fe89c438...` | -| GAP-053 | Strict-interior Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; #488 `fe89c438...` | -| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; #488 `fe89c438...` | -| GAP-055 | Strict-interior Wilson lower endpoint could accept a nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; #488 `fe89c438...` | -| GAP-056 | Durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; #488 `fe89c438...` | -| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from a generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; #488 `fe89c438...` | -| GAP-058 | Generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; #488 `fe89c438...` | -| GAP-059 | Generic Monte Carlo summary could materially misstate positive SE relative to `SD / sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; #488 `fe89c438...` | -| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; #488 `fe89c438...` | -| GAP-061 | Generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; #488 `fe89c438...` | -| GAP-062 | Finite-tolerance matching could fail while the pair is deterministically outside every finite tolerance | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; #488 `fe89c438...` | -| GAP-063 | Exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; #488 `fe89c438...` | -| GAP-064 | Positive point RMSE could carry SE above the declared squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; #488 `fe89c438...` | -| GAP-065 | Positive Monte Carlo RMSE could carry spread/SE impossible for nonnegative replications | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; #488 `fe89c438...` | -| GAP-066 | RMSE Monte Carlo nearest-rank percentile could exceed total nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; #488 `fe89c438...` | -| GAP-067 | Generic nearest-rank percentile endpoint could be individually incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected over-strong repair `2798e4f9...`; causal repair `c7151b49...`; edge `dbef285b...`; changelog `c38a320c...`; research `2bbcbb24...`; #488 `fe89c438...` | -| GAP-068 | Distinct generic percentile endpoints could each pass individual radius checks while jointly exceeding the sample squared-deviation budget | `verification-pending` | RED `c4a13826...` + causal repair `cb3f80a2...` + changelog `f727450d...`; #488 `fe89c438...` | -| GAP-069 | Two-replication distinct nearest-rank endpoints could exhaust the retained sample while the stored mean or SD remained impossible | `verification-pending` | RED `81bf0d9e...` + causal repair `d48f8fef...` + mean coverage `fb314d8a...` + branch cleanup `440b78d8...` + changelog `45116498...`; #488 `fe89c438...` | -| GAP-070 | Stored Wilson bounds could contain empirical coverage while the lower/upper pair could not arise from one Wilson score interval for that same coverage | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...` + complementary edge `c1cb16a7...`; #488 `fe89c438...` | -| GAP-071 | Durable Wilson evidence lacked denominator and critical-value/sidedness provenance, preventing exact recomputation from a persisted artifact | `active-repair` | valid carrier RED `6f6e06d2...`; shared count/Wilson authority `ca517ed3...`; `WilsonCoverageEvidenceV1` `31e1ab2b...`; sidedness `e9c63926...`/`fdd24a1a...`; envelope RED `07766cb0...` + `ValidationEvidenceV1` repair `a16f22e6...`; docs/current #488 `fe89c438...`; remaining: hosted GREEN/review/main plus durable-consumer adoption | -| GAP-072 | Exact all-covered Wilson evidence could retain a zero lower endpoint even though the canonical non-empty finite-`z²` producer always emits `n/(n+z²) > 0` | `verification-pending` | RED `ce714f07...` + non-force source-restore RCA `18499052...` + repair `72e9d954...` + changelog `e3a2f4a2...`; inherited by #488 `fe89c438...` | -| GAP-073 | Durable Wilson count provenance could round one uncovered observation away above binary64's exact-integer range and expose a pointer-width-dependent count schema | `verification-pending` | RED `29d710a5...` + complement/count repair `29968c80...` + fixed-width carrier repair `91d9a3bb...` + exact ratio RED/repair `63ddfdd6...`/`11323c57...`; #488 `fe89c438...` | -| GAP-074 | Durable Wilson evidence could correctly retain exact `u64` counts yet pre-round `sample_count` before endpoint projection, shifting strict-interior endpoints or erasing all-covered finite-sample uncertainty | `verification-pending` | RED `f89e2467...` + all-covered edge `1a5180b2...` + stale-oracle correction `6254c498...` + causal reciprocal-scale repair `73bbb5cf...` + changelog `f2b5768b...` + research predecessor #488 `7fc78a59...`; current #488 `fe89c438...` | -| GAP-075 | Inexact durable all-covered Wilson evidence could round the complementary miss mass to exact one at extreme finite `z` and erase a representable positive lower endpoint | `verification-pending` | RED `059ce70d...`; transient duplicate-owner implementation `46f91f3f...` excluded; canonical repair `0f478392...`; single-writer cleanup `8e2058f2...`; exact-oracle correction `93d5d208...`; changelog correction `43b6562c...`; research predecessor `b03a719d...`; current #488 `fe89c438...` | -| GAP-076 | Exactly representable all-covered Wilson counts could absorb a small positive `z²` in `n + z²` and falsely emit exact `1.0` although a lower binary64 endpoint is representable | `verification-pending` | RED `e0c4ec81...` + causal boundary repair `c9dcb9df...` + below-resolution edge `6140080d...` + changelog `09ebb482...` + research/current #488 `fe89c438...` | +| GAP-050 | Zero-multiplier SE-aware acceptance could erase a nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; #488 `51ca9e8a...` | +| GAP-051 | Exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; #488 `51ca9e8a...` | +| GAP-052 | All-covered Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; #488 `51ca9e8a...` | +| GAP-053 | Strict-interior Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; #488 `51ca9e8a...` | +| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; #488 `51ca9e8a...` | +| GAP-055 | Strict-interior Wilson lower endpoint could accept a nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; #488 `51ca9e8a...` | +| GAP-056 | Durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; #488 `51ca9e8a...` | +| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from a generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; #488 `51ca9e8a...` | +| GAP-058 | Generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; #488 `51ca9e8a...` | +| GAP-059 | Generic Monte Carlo summary could materially misstate positive SE relative to `SD / sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; #488 `51ca9e8a...` | +| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; #488 `51ca9e8a...` | +| GAP-061 | Generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; #488 `51ca9e8a...` | +| GAP-062 | Finite-tolerance matching could fail while the pair is deterministically outside every finite tolerance | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; #488 `51ca9e8a...` | +| GAP-063 | Exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; #488 `51ca9e8a...` | +| GAP-064 | Positive point RMSE could carry SE above the declared squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; #488 `51ca9e8a...` | +| GAP-065 | Positive Monte Carlo RMSE could carry spread/SE impossible for nonnegative replications | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; #488 `51ca9e8a...` | +| GAP-066 | RMSE Monte Carlo nearest-rank percentile could exceed total nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; #488 `51ca9e8a...` | +| GAP-067 | Generic nearest-rank percentile endpoint could be individually incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected over-strong repair `2798e4f9...`; causal repair `c7151b49...`; edge `dbef285b...`; changelog `c38a320c...`; research `2bbcbb24...`; #488 `51ca9e8a...` | +| GAP-068 | Distinct generic percentile endpoints could each pass individual radius checks while jointly exceeding the sample squared-deviation budget | `verification-pending` | RED `c4a13826...` + causal repair `cb3f80a2...` + changelog `f727450d...`; #488 `51ca9e8a...` | +| GAP-069 | Two-replication distinct nearest-rank endpoints could exhaust the retained sample while the stored mean or SD remained impossible | `verification-pending` | RED `81bf0d9e...` + causal repair `d48f8fef...` + mean coverage `fb314d8a...` + branch cleanup `440b78d8...` + changelog `45116498...`; #488 `51ca9e8a...` | +| GAP-070 | Stored Wilson bounds could contain empirical coverage while the lower/upper pair could not arise from one Wilson score interval for that same coverage | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...` + complementary edge `c1cb16a7...`; #488 `51ca9e8a...` | +| GAP-071 | Durable Wilson evidence lacked denominator and critical-value/sidedness provenance, preventing exact recomputation from a persisted artifact | `active-repair` | valid carrier RED `6f6e06d2...`; shared count/Wilson authority `ca517ed3...`; `WilsonCoverageEvidenceV1` `31e1ab2b...`; sidedness `e9c63926...`/`fdd24a1a...`; envelope RED `07766cb0...` + `ValidationEvidenceV1` repair `a16f22e6...`; docs/current #488 `51ca9e8a...`; remaining: hosted GREEN/review/main plus durable-consumer adoption | +| GAP-072 | Exact all-covered Wilson evidence could retain a zero lower endpoint even though the canonical non-empty finite-`z²` producer always emits `n/(n+z²) > 0` | `verification-pending` | RED `ce714f07...` + non-force source-restore RCA `18499052...` + repair `72e9d954...` + changelog `e3a2f4a2...`; inherited by #488 `51ca9e8a...` | +| GAP-073 | Durable Wilson count provenance could round one uncovered observation away above binary64's exact-integer range and expose a pointer-width-dependent count schema | `verification-pending` | RED `29d710a5...` + complement/count repair `29968c80...` + fixed-width carrier repair `91d9a3bb...` + exact ratio RED/repair `63ddfdd6...`/`11323c57...`; #488 `51ca9e8a...` | +| GAP-074 | Durable Wilson evidence could correctly retain exact `u64` counts yet pre-round `sample_count` before endpoint projection, shifting strict-interior endpoints or erasing all-covered finite-sample uncertainty | `verification-pending` | RED `f89e2467...` + all-covered edge `1a5180b2...` + stale-oracle correction `6254c498...` + causal reciprocal-scale repair `73bbb5cf...` + changelog `f2b5768b...` + research predecessor `7fc78a59...`; current #488 `51ca9e8a...` | +| GAP-075 | Inexact durable all-covered Wilson evidence could round the complementary miss mass to exact one at extreme finite `z` and erase a representable positive lower endpoint | `verification-pending` | RED `059ce70d...`; transient duplicate-owner implementation `46f91f3f...` excluded; canonical repair `0f478392...`; single-writer cleanup `8e2058f2...`; exact-oracle correction `93d5d208...`; changelog correction `43b6562c...`; research predecessor `b03a719d...`; current #488 `51ca9e8a...` | +| GAP-076 | Exactly representable all-covered Wilson counts could absorb a small positive `z²` in `n + z²` and falsely emit exact `1.0` although a lower binary64 endpoint is representable | `verification-pending` | RED `e0c4ec81...` + causal boundary repair `c9dcb9df...` + below-resolution edge `6140080d...` + changelog `09ebb482...` + research predecessor `fe89c438...`; current #488 `51ca9e8a...` | +| GAP-077 | Exactly representable all-covered Wilson counts could form an inexact partial denominator `n + z²` whose rounded sum shifts the represented-input lower endpoint by one ULP even though neither operand is fully absorbed | `verification-pending` | RED `06e55653...` + causal TwoSum/FMA repair `6c084dbe...` + research `25cc1943...` + changelog `5acc894b...` + predecessor changelog correction `f89e36d1...` + correct-direct-rounding control `80a0a0ad...`; current #488 `51ca9e8a...` | ## Release gate From 290702c6ed7e68c6200698ec7d908e12584de69d Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 4 Sep 2026 18:43:59 +0900 Subject: [PATCH 168/235] docs(ddd): refresh validation owner boundaries --- docs/product-technical-gap-baseline.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 0a80c7609..ca57ef3e7 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-04T09:37:15Z +**Snapshot:** 2026-09-04T09:41:59Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` **Workspace version:** `0.2.0` @@ -48,9 +48,9 @@ Exact-head evidence becomes stale after any source push. TEPP owns temporal/event composition, irregular time, time-varying multilevel/cross-classified/multiple-membership semantics, longitudinal invariance/drift/alignment, leakage-safe knowledge cutoff, temporal recovery, Validation Evidence, and Projection policy. `longitudinal_modeling` is the bounded context and `longitudinal_core` is its current Rust implementation path. -`psychometric_core` is not authority for new temporal/state composition. fast-mlsirm owns reusable static/generalized-mixed/dependence-aware psychometric specification and arithmetic. TEPP consumes only immutable released/versioned Published Language through an ACL; source copying and mutable sibling-head dependencies are prohibited. +`psychometric_core` is not authority for new temporal/state composition. fast-mlsirm owns reusable static/generalized-mixed/dependence-aware psychometric specification and arithmetic. TEPP consumes only immutable released/versioned Published Language through an ACL; source copying and mutable sibling-head dependencies are prohibited. Fresh owner evidence is fast-mlsirm protected `main@b5a3a0c1057d4b53d7a4bb18e0de69f630c2b45c`; latest immutable release remains `v0.9.1`. -contextual-orchestrator owns provider/model routing and semantic LLM execution. Its last verified protected-main evidence in this baseline is `c4f932b0aebe6fb7ba743451fa47775b678a7f8c`, while GitHub releases remain zero. Semantic LLM work and model-backed Actions therefore continue to require a released/versioned contextual-orchestrator contract; Actions use `orchestrator/free` through the gateway credential and do not select providers/models/groups or consume direct provider keys. Mutable owner main is evidence, not a TEPP production contract. Context Graph contracts are contract-only integration authority; EA Core owns enterprise-architecture decisions. No cross-service SQL. +contextual-orchestrator owns provider/model routing and semantic LLM execution. Fresh owner evidence is protected `main@2e414d15ba58f28597751b625a8a2f00fc9fadcf`, while GitHub releases remain zero. Semantic LLM work and model-backed Actions therefore continue to require a released/versioned contextual-orchestrator contract; Actions use `orchestrator/free` through the gateway credential and do not select providers/models/groups or consume direct provider keys. Mutable owner main is evidence, not a TEPP production contract. Context Graph contracts are contract-only integration authority; EA Core owns enterprise-architecture decisions. No cross-service SQL. The clock contract separates event/valid time, assertion time, document time, system time, availability time, and knowledge cutoff. Retrospective evidence may describe an earlier event but cannot enter an earlier knowledge cutoff. Forward state/transition edges remain distinct from retrospective/citation/revision/provenance relations. @@ -103,7 +103,7 @@ Wilson (1927) remains the primary score-interval reference. AERA/APA/NCME (2014) ### #480 — contextual-orchestrator boundary -#480 removes TEPP-owned provider discovery/ranking and requires a released contextual-orchestrator owner contract. Its exact source head remains `01f45a99392457334a4f6d3d659f992af739eeee`. The latest owner state must be refreshed before any consumer bump; mutable owner main is evidence, not a production contract, and #480 stays Draft until an immutable compatible release plus deployment/auth/schema/artifact provenance exists. +#480 removes TEPP-owned provider discovery/ranking and requires a released contextual-orchestrator owner contract. Its exact source head remains `01f45a99392457334a4f6d3d659f992af739eeee`. contextual-orchestrator protected main is `2e414d15ba58f28597751b625a8a2f00fc9fadcf`, but GitHub releases remain zero, so #480 stays Draft until an immutable compatible release plus deployment/auth/schema/artifact provenance exists. Mutable owner main is evidence, not a production contract. ## Gap register From d8f6def0a83e0fe3665122aee151db451f93a762 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 4 Sep 2026 19:05:06 +0900 Subject: [PATCH 169/235] docs(product): track Wilson residual midpoint gap --- docs/product-technical-gap-baseline.md | 79 +++++++++++++------------- 1 file changed, 41 insertions(+), 38 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index ca57ef3e7..799cc5ad1 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-04T09:41:59Z +**Snapshot:** 2026-09-04T10:03:33Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` **Workspace version:** `0.2.0` @@ -30,7 +30,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `51ca9e8a6a3201d2a3e4e4fcff52e1175b746297` | true | `main` | Validation Evidence landing vehicle. `WilsonCoverageEvidenceV1` retains fixed-width `u64` denominator/count provenance, standard-normal `z`, two-sided semantics, represented coverage, and canonical Wilson endpoints. Large-count recomputation preserves exact count-ratio rounding and complement identity; inexact binary64 sample-count scale uses reciprocal evaluation and an all-covered scale switch. For exactly representable all-covered counts, the canonical writer preserves near-one miss mass and now also compensates any demonstrably inexact `n + z²` denominator sum with a TwoSum/FMA quotient residual; exact sums remain on the direct path. Hosted exact-head gates and independent review remain required. | +| #488 | `ef6441f786d64e6dca198d0d6140838c391f0659` | true | `main` | Validation Evidence landing vehicle. `WilsonCoverageEvidenceV1` retains fixed-width `u64` denominator/count provenance, standard-normal `z`, two-sided semantics, represented coverage, and canonical Wilson endpoints. Large-count recomputation preserves exact count-ratio rounding and complement identity; inexact binary64 sample-count scale uses reciprocal evaluation and an all-covered scale switch. For exactly representable all-covered counts, the canonical writer preserves near-one miss mass, recovers inexact `n + z²` with TwoSum/FMA residuals, and changes a direct quotient only when the represented-input rational crosses the adjacent binary64 midpoint. Hosted exact-head gates and independent review remain required. | | #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 | Validation / Analysis Run fold child. Unique evidence must be inherited by a conflict-resolving survivor; child-head CI does not transfer. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | @@ -68,7 +68,7 @@ The clock contract separates event/valid time, assertion time, document time, sy - When the generic carrier occupies `ValidationReport::monte_carlo_rmse`, retained replications are nonnegative; positive mean implies `SE(mean) <= mean`, and inclusive nearest-rank endpoints cannot exceed nonnegative sample-sum support `n * mean`. These typed bounds are not imposed on signed metrics such as bias. - SE-aware acceptance is `|estimate - target| <= k * SE`. For `k = 0` or exact-zero SE, exact recovery is evaluated before scale reduction; `-0.0` and `+0.0` are one numeric zero-valued scientific state. - `match_count` is a finite-threshold decision and does not require materializing an unrepresentable absolute residual; `absolute_residuals` remains fail closed when the magnitude itself is requested. -- Wilson interval coverage preserves represented-input endpoints through stable rationalized/complementary/compensated forms. Legacy `ValidationReport` endpoint pairs satisfy necessary Wilson coherence and boundary checks, but exact provenance is not inferred from them. `WilsonCoverageEvidenceV1` retains fixed-width `u64` `sample_count`/`covered_count`, `critical_value_kind=standard_normal_z`, `interval_sidedness=two_sided`, numeric `z`, represented coverage, and canonical endpoints and validates them by exact recomputation through the single crate-private Wilson authority. Exact all-covered status is integer count equality, not rounded `p == 1`. Count proportions are correctly rounded from exact integers. When covered counts dominate, the smaller uncovered complement is evaluated and reflected. When retained `sample_count` itself is not exactly representable in binary64, Wilson scale terms use correctly rounded reciprocal `1/n`; its all-covered path uses complementary miss mass for `z²/n <= 1` and direct reciprocal evaluation for `z²/n > 1`. For an exactly representable all-covered count, a false exact-one quotient retains the boundary-local complementary repair. Otherwise, if `n + z²` is inexact, the canonical writer recovers the TwoSum denominator residual and applies a fused quotient-residual correction; exact denominator sums remain direct. This is a demonstrated represented-input repair, not a claim of global correct rounding for every Wilson rearrangement. Smaller miss mass genuinely below binary64 resolution remains exact one. `ValidationEvidenceV1` binds provenance to the legacy report projection without breaking existing report callers. +- Wilson interval coverage preserves represented-input endpoints through stable rationalized/complementary/compensated forms. Legacy `ValidationReport` endpoint pairs satisfy necessary Wilson coherence and boundary checks, but exact provenance is not inferred from them. `WilsonCoverageEvidenceV1` retains fixed-width `u64` `sample_count`/`covered_count`, `critical_value_kind=standard_normal_z`, `interval_sidedness=two_sided`, numeric `z`, represented coverage, and canonical endpoints and validates them by exact recomputation through the single crate-private Wilson authority. Exact all-covered status is integer count equality, not rounded `p == 1`. Count proportions are correctly rounded from exact integers. When covered counts dominate, the smaller uncovered complement is evaluated and reflected. When retained `sample_count` itself is not exactly representable in binary64, Wilson scale terms use correctly rounded reciprocal `1/n`; its all-covered path uses complementary miss mass for `z²/n <= 1` and direct reciprocal evaluation for `z²/n > 1`. For an exactly representable all-covered count, a false exact-one quotient retains the boundary-local complementary repair. Otherwise, if `n + z²` is inexact, the canonical writer recovers the TwoSum denominator residual and FMA quotient residual, identifies the adjacent binary64 candidate from residual direction, and changes the direct quotient only when the exact represented-input rational lies beyond that candidate's midpoint; exact midpoint selection is ties-to-even. This avoids both under-correction and residual double-rounding overcorrection without claiming globally correctly rounded Wilson rearrangements. Smaller miss mass genuinely below binary64 resolution remains exact one. `ValidationEvidenceV1` binds provenance to the legacy report projection without breaking existing report callers. - Durable and human-facing Validation Evidence must preserve producing-metric invariants on explicit validation, serde ingress/egress, and human projection. Missing v1 provenance is never synthesized from endpoint algebra. - Bias, RMSE, and Monte Carlo may share private deterministic scalar support inside `validation_core`, but metric-specific cancellation/normalization, denominator, uncertainty, and fail-closed semantics remain with their bounded modules. - Historical-cutoff admission occurs before duplicate-identity checks. Future-unavailable evidence cannot change an earlier run's conflicts, counts, or terminal state. @@ -83,7 +83,7 @@ The clock contract separates event/valid time, assertion time, document time, sy ### #488 — Validation Evidence -#488 is the generic Validation Evidence landing vehicle at exact head `51ca9e8a6a3201d2a3e4e4fcff52e1175b746297`. It remains distinct from Longitudinal Modeling and does not consume mutable fast-mlsirm source. +#488 is the generic Validation Evidence landing vehicle at exact head `ef6441f786d64e6dca198d0d6140838c391f0659`. It remains distinct from Longitudinal Modeling and does not consume mutable fast-mlsirm source. GAP-070 and GAP-072 remain inherited: stored Wilson endpoints must be one coherent score interval, and exact all-covered evidence cannot use a zero lower endpoint. GAP-071 has advanced from design-only to source implementation. Corrected carrier RED `6f6e06d2...` requires a versioned denominator/critical-value carrier; `ca517ed3...` establishes one private covered-count/Wilson-from-counts authority; `31e1ab2b...` adds `WilsonCoverageEvidenceV1`; `e9c63926...`/`fdd24a1a...` bind standard-normal/two-sided semantics. Envelope RED `07766cb0...` and repair `a16f22e6...` add `ValidationEvidenceV1`, which cross-validates the legacy report projection against the recomputable carrier. @@ -91,9 +91,11 @@ GAP-073 retains large-count identity/schema and exact-ratio projection. GAP-074 GAP-076 records the exact-count all-covered near-one denominator-absorption defect. Public RED `e0c4ec81bb455d230259489dc71e23fe33704b1d` fixes `n=1` and represented `z=0x1.0000000000001p-27`; causal repair `c9dcb9df363999bbcbb6fffdc8b6a6d9ae5e762c` performs the complementary miss calculation only after direct false-one collapse; boundary `6140080d2257d0550be479d71371d70e2255c3d0` preserves true exact one below binary64 resolution; changelog `09ebb482851fe7836e738a74395e6424621da9bf`; research predecessor `fe89c43803136ab979912fffa636d2a4f169a73e`. -GAP-077 records the ordinary partial-denominator state left after the near-one and complete-absorption repairs. With `n=1` and represented `z=3*2^-28`, represented `z²=9*2^-56`; `1+z²` rounds upward before division, so predecessor direct evaluation emits `0x1.ffffffffffffep-1` although the represented-input rational lower endpoint rounds to `0x1.fffffffffffffp-1`. Public RED `06e556538e171e675c4d8a8287d75052ffc2c4c3` → causal TwoSum/FMA residual repair `6c084dbe607e6c415288c77fa41a4270947cd51e` → research `25cc19436085881602356e7f2609b697b575540c` → dedicated changelog `5acc894b8a4d42cd7af8cdc22a02b61a063f16aa` → predecessor changelog correction `f89e36d1f2a048befb983327c83f5696baf530cc` → correct-direct-rounding control `80a0a0ade16f516bf63907f2a8d5105dbcd9c438` → research/current #488 `51ca9e8a6a3201d2a3e4e4fcff52e1175b746297`. +GAP-077 records the ordinary partial-denominator state left after the near-one and complete-absorption repairs. With `n=1` and represented `z=3*2^-28`, represented `z²=9*2^-56`; `1+z²` rounds upward before division, so predecessor direct evaluation emits `0x1.ffffffffffffep-1` although the represented-input rational lower endpoint rounds to `0x1.fffffffffffffp-1`. Public RED `06e556538e171e675c4d8a8287d75052ffc2c4c3` → causal TwoSum/FMA residual repair `6c084dbe607e6c415288c77fa41a4270947cd51e` → research `25cc19436085881602356e7f2609b697b575540c` → dedicated changelog `5acc894b8a4d42cd7af8cdc22a02b61a063f16aa` → predecessor changelog correction `f89e36d1f2a048befb983327c83f5696baf530cc` → correct-direct-rounding control `80a0a0ade16f516bf63907f2a8d5105dbcd9c438`. -These repairs advance the source-contract portion of GAP-071/GAP-073/GAP-074/GAP-075/GAP-076/GAP-077 but not delivery: exact-head hosted gates, independent review, protected-main integration, and adoption by durable consumers that require v1 provenance remain outstanding. Bare legacy `ValidationReport` remains a backward-compatible compact projection and is not silently treated as v1 provenance. +GAP-078 records the opposite residual-rounding state. With `n=3`, represented `z=0x1.6a09e667f3bcdp+492`, and represented `z²=0x1.0000000000001p+985`, the rounded denominator fully absorbs `n`, but the exact represented-input rational and the direct rounded-denominator quotient both round to `0x1.7ffffffffffffp-984`. The predecessor additive residual correction forced `0x1.7fffffffffffep-984`, one ULP too low. Public RED `d076d344cb3cd3a768e7a5c2d8d7bd9039c657e9` → midpoint-selection repair `32314239754204158f228ec67a0771abf4d39b45` → changelog `a75940c955633d5eb92f227d79e64acd0ef46ea8` → research/current #488 `ef6441f786d64e6dca198d0d6140838c391f0659`. + +These repairs advance the source-contract portion of GAP-071/GAP-073/GAP-074/GAP-075/GAP-076/GAP-077/GAP-078 but not delivery: exact-head hosted gates, independent review, protected-main integration, and adoption by durable consumers that require v1 provenance remain outstanding. Bare legacy `ValidationReport` remains a backward-compatible compact projection and is not silently treated as v1 provenance. Wilson (1927) remains the primary score-interval reference. AERA/APA/NCME (2014) remains the current published testing-standards edition while revision is underway. IEEE 754-2019 and ISO/IEC 60559:2020 remain the published floating-point authorities used for binary64 representation trace; active IEEE P754 is not treated as a published replacement. @@ -153,39 +155,40 @@ Wilson (1927) remains the primary score-interval reference. AERA/APA/NCME (2014) | GAP-042 | Ratio-first logarithm could nearly double an adjacent-float irregular residual growth rate | `verification-pending` | RED `766ddc7a...` + `ln_1p` repair `16f21d9a...` | | GAP-043 | Duplicate known-truth component identities could silently reweight RMSE recovery evidence | `verification-pending` | RED `698f12f5...` + uniqueness repair `2fae4cb2...` | | GAP-044 | Known-truth RMSE alignment/accumulation depended on row order instead of component identity | `verification-pending` | RED `8ad72ac9...` / `5fb93c40...` + repairs `2dd9537e...` / `025dce7f...`; #310 `c6680450...` | -| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; #488 `51ca9e8a...` | -| GAP-046 | Bias SE could reject a representable SEM because raw squared deviations/intermediates overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; #488 `51ca9e8a...` | -| GAP-047 | Generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; #488 `51ca9e8a...` | -| GAP-048 | Mean signed bias could erase a representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; #488 `51ca9e8a...` | +| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; #488 `ef6441f7...` | +| GAP-046 | Bias SE could reject a representable SEM because raw squared deviations/intermediates overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; #488 `ef6441f7...` | +| GAP-047 | Generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; #488 `ef6441f7...` | +| GAP-048 | Mean signed bias could erase a representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; #488 `ef6441f7...` | | GAP-049 | Stable `Between` recovery could be aliased across occasion indices and reweight RMSE | `verification-pending` | RED `0a03041c...` + repair `ec2c1219...`; #310 `c6680450...` | -| GAP-050 | Zero-multiplier SE-aware acceptance could erase a nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; #488 `51ca9e8a...` | -| GAP-051 | Exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; #488 `51ca9e8a...` | -| GAP-052 | All-covered Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; #488 `51ca9e8a...` | -| GAP-053 | Strict-interior Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; #488 `51ca9e8a...` | -| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; #488 `51ca9e8a...` | -| GAP-055 | Strict-interior Wilson lower endpoint could accept a nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; #488 `51ca9e8a...` | -| GAP-056 | Durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; #488 `51ca9e8a...` | -| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from a generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; #488 `51ca9e8a...` | -| GAP-058 | Generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; #488 `51ca9e8a...` | -| GAP-059 | Generic Monte Carlo summary could materially misstate positive SE relative to `SD / sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; #488 `51ca9e8a...` | -| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; #488 `51ca9e8a...` | -| GAP-061 | Generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; #488 `51ca9e8a...` | -| GAP-062 | Finite-tolerance matching could fail while the pair is deterministically outside every finite tolerance | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; #488 `51ca9e8a...` | -| GAP-063 | Exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; #488 `51ca9e8a...` | -| GAP-064 | Positive point RMSE could carry SE above the declared squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; #488 `51ca9e8a...` | -| GAP-065 | Positive Monte Carlo RMSE could carry spread/SE impossible for nonnegative replications | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; #488 `51ca9e8a...` | -| GAP-066 | RMSE Monte Carlo nearest-rank percentile could exceed total nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; #488 `51ca9e8a...` | -| GAP-067 | Generic nearest-rank percentile endpoint could be individually incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected over-strong repair `2798e4f9...`; causal repair `c7151b49...`; edge `dbef285b...`; changelog `c38a320c...`; research `2bbcbb24...`; #488 `51ca9e8a...` | -| GAP-068 | Distinct generic percentile endpoints could each pass individual radius checks while jointly exceeding the sample squared-deviation budget | `verification-pending` | RED `c4a13826...` + causal repair `cb3f80a2...` + changelog `f727450d...`; #488 `51ca9e8a...` | -| GAP-069 | Two-replication distinct nearest-rank endpoints could exhaust the retained sample while the stored mean or SD remained impossible | `verification-pending` | RED `81bf0d9e...` + causal repair `d48f8fef...` + mean coverage `fb314d8a...` + branch cleanup `440b78d8...` + changelog `45116498...`; #488 `51ca9e8a...` | -| GAP-070 | Stored Wilson bounds could contain empirical coverage while the lower/upper pair could not arise from one Wilson score interval for that same coverage | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...` + complementary edge `c1cb16a7...`; #488 `51ca9e8a...` | -| GAP-071 | Durable Wilson evidence lacked denominator and critical-value/sidedness provenance, preventing exact recomputation from a persisted artifact | `active-repair` | valid carrier RED `6f6e06d2...`; shared count/Wilson authority `ca517ed3...`; `WilsonCoverageEvidenceV1` `31e1ab2b...`; sidedness `e9c63926...`/`fdd24a1a...`; envelope RED `07766cb0...` + `ValidationEvidenceV1` repair `a16f22e6...`; docs/current #488 `51ca9e8a...`; remaining: hosted GREEN/review/main plus durable-consumer adoption | -| GAP-072 | Exact all-covered Wilson evidence could retain a zero lower endpoint even though the canonical non-empty finite-`z²` producer always emits `n/(n+z²) > 0` | `verification-pending` | RED `ce714f07...` + non-force source-restore RCA `18499052...` + repair `72e9d954...` + changelog `e3a2f4a2...`; inherited by #488 `51ca9e8a...` | -| GAP-073 | Durable Wilson count provenance could round one uncovered observation away above binary64's exact-integer range and expose a pointer-width-dependent count schema | `verification-pending` | RED `29d710a5...` + complement/count repair `29968c80...` + fixed-width carrier repair `91d9a3bb...` + exact ratio RED/repair `63ddfdd6...`/`11323c57...`; #488 `51ca9e8a...` | -| GAP-074 | Durable Wilson evidence could correctly retain exact `u64` counts yet pre-round `sample_count` before endpoint projection, shifting strict-interior endpoints or erasing all-covered finite-sample uncertainty | `verification-pending` | RED `f89e2467...` + all-covered edge `1a5180b2...` + stale-oracle correction `6254c498...` + causal reciprocal-scale repair `73bbb5cf...` + changelog `f2b5768b...` + research predecessor `7fc78a59...`; current #488 `51ca9e8a...` | -| GAP-075 | Inexact durable all-covered Wilson evidence could round the complementary miss mass to exact one at extreme finite `z` and erase a representable positive lower endpoint | `verification-pending` | RED `059ce70d...`; transient duplicate-owner implementation `46f91f3f...` excluded; canonical repair `0f478392...`; single-writer cleanup `8e2058f2...`; exact-oracle correction `93d5d208...`; changelog correction `43b6562c...`; research predecessor `b03a719d...`; current #488 `51ca9e8a...` | -| GAP-076 | Exactly representable all-covered Wilson counts could absorb a small positive `z²` in `n + z²` and falsely emit exact `1.0` although a lower binary64 endpoint is representable | `verification-pending` | RED `e0c4ec81...` + causal boundary repair `c9dcb9df...` + below-resolution edge `6140080d...` + changelog `09ebb482...` + research predecessor `fe89c438...`; current #488 `51ca9e8a...` | -| GAP-077 | Exactly representable all-covered Wilson counts could form an inexact partial denominator `n + z²` whose rounded sum shifts the represented-input lower endpoint by one ULP even though neither operand is fully absorbed | `verification-pending` | RED `06e55653...` + causal TwoSum/FMA repair `6c084dbe...` + research `25cc1943...` + changelog `5acc894b...` + predecessor changelog correction `f89e36d1...` + correct-direct-rounding control `80a0a0ad...`; current #488 `51ca9e8a...` | +| GAP-050 | Zero-multiplier SE-aware acceptance could erase a nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; #488 `ef6441f7...` | +| GAP-051 | Exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; #488 `ef6441f7...` | +| GAP-052 | All-covered Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; #488 `ef6441f7...` | +| GAP-053 | Strict-interior Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; #488 `ef6441f7...` | +| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; #488 `ef6441f7...` | +| GAP-055 | Strict-interior Wilson lower endpoint could accept a nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; #488 `ef6441f7...` | +| GAP-056 | Durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; #488 `ef6441f7...` | +| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from a generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; #488 `ef6441f7...` | +| GAP-058 | Generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; #488 `ef6441f7...` | +| GAP-059 | Generic Monte Carlo summary could materially misstate positive SE relative to `SD / sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; #488 `ef6441f7...` | +| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; #488 `ef6441f7...` | +| GAP-061 | Generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; #488 `ef6441f7...` | +| GAP-062 | Finite-tolerance matching could fail while the pair is deterministically outside every finite tolerance | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; #488 `ef6441f7...` | +| GAP-063 | Exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; #488 `ef6441f7...` | +| GAP-064 | Positive point RMSE could carry SE above the declared squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; #488 `ef6441f7...` | +| GAP-065 | Positive Monte Carlo RMSE could carry spread/SE impossible for nonnegative replications | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; #488 `ef6441f7...` | +| GAP-066 | RMSE Monte Carlo nearest-rank percentile could exceed total nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; #488 `ef6441f7...` | +| GAP-067 | Generic nearest-rank percentile endpoint could be individually incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected over-strong repair `2798e4f9...`; causal repair `c7151b49...`; edge `dbef285b...`; changelog `c38a320c...`; research `2bbcbb24...`; #488 `ef6441f7...` | +| GAP-068 | Distinct generic percentile endpoints could each pass individual radius checks while jointly exceeding the sample squared-deviation budget | `verification-pending` | RED `c4a13826...` + causal repair `cb3f80a2...` + changelog `f727450d...`; #488 `ef6441f7...` | +| GAP-069 | Two-replication distinct nearest-rank endpoints could exhaust the retained sample while the stored mean or SD remained impossible | `verification-pending` | RED `81bf0d9e...` + causal repair `d48f8fef...` + mean coverage `fb314d8a...` + branch cleanup `440b78d8...` + changelog `45116498...`; #488 `ef6441f7...` | +| GAP-070 | Stored Wilson bounds could contain empirical coverage while the lower/upper pair could not arise from one Wilson score interval for that same coverage | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...` + complementary edge `c1cb16a7...`; #488 `ef6441f7...` | +| GAP-071 | Durable Wilson evidence lacked denominator and critical-value/sidedness provenance, preventing exact recomputation from a persisted artifact | `active-repair` | valid carrier RED `6f6e06d2...`; shared count/Wilson authority `ca517ed3...`; `WilsonCoverageEvidenceV1` `31e1ab2b...`; sidedness `e9c63926...`/`fdd24a1a...`; envelope RED `07766cb0...` + `ValidationEvidenceV1` repair `a16f22e6...`; docs/current #488 `ef6441f7...`; remaining: hosted GREEN/review/main plus durable-consumer adoption | +| GAP-072 | Exact all-covered Wilson evidence could retain a zero lower endpoint even though the canonical non-empty finite-`z²` producer always emits `n/(n+z²) > 0` | `verification-pending` | RED `ce714f07...` + non-force source-restore RCA `18499052...` + repair `72e9d954...` + changelog `e3a2f4a2...`; inherited by #488 `ef6441f7...` | +| GAP-073 | Durable Wilson count provenance could round one uncovered observation away above binary64's exact-integer range and expose a pointer-width-dependent count schema | `verification-pending` | RED `29d710a5...` + complement/count repair `29968c80...` + fixed-width carrier repair `91d9a3bb...` + exact ratio RED/repair `63ddfdd6...`/`11323c57...`; #488 `ef6441f7...` | +| GAP-074 | Durable Wilson evidence could correctly retain exact `u64` counts yet pre-round `sample_count` before endpoint projection, shifting strict-interior endpoints or erasing all-covered finite-sample uncertainty | `verification-pending` | RED `f89e2467...` + all-covered edge `1a5180b2...` + stale-oracle correction `6254c498...` + causal reciprocal-scale repair `73bbb5cf...` + changelog `f2b5768b...` + research predecessor `7fc78a59...`; current #488 `ef6441f7...` | +| GAP-075 | Inexact durable all-covered Wilson evidence could round the complementary miss mass to exact one at extreme finite `z` and erase a representable positive lower endpoint | `verification-pending` | RED `059ce70d...`; transient duplicate-owner implementation `46f91f3f...` excluded; canonical repair `0f478392...`; single-writer cleanup `8e2058f2...`; exact-oracle correction `93d5d208...`; changelog correction `43b6562c...`; research predecessor `b03a719d...`; current #488 `ef6441f7...` | +| GAP-076 | Exactly representable all-covered Wilson counts could absorb a small positive `z²` in `n + z²` and falsely emit exact `1.0` although a lower binary64 endpoint is representable | `verification-pending` | RED `e0c4ec81...` + causal boundary repair `c9dcb9df...` + below-resolution edge `6140080d...` + changelog `09ebb482...` + research predecessor `fe89c438...`; current #488 `ef6441f7...` | +| GAP-077 | Exactly representable all-covered Wilson counts could form an inexact partial denominator `n + z²` whose rounded sum shifts the represented-input lower endpoint by one ULP even though neither operand is fully absorbed | `verification-pending` | RED `06e55653...` + causal TwoSum/FMA repair `6c084dbe...` + research `25cc1943...` + changelog `5acc894b...` + predecessor changelog correction `f89e36d1...` + correct-direct-rounding control `80a0a0ad...`; current #488 `ef6441f7...` | +| GAP-078 | Exact-count all-covered Wilson residual compensation could move a direct quotient by one ULP even when the represented-input rational remains on the same side of the adjacent midpoint | `verification-pending` | RED `d076d344...` + midpoint-selection repair `32314239...` + changelog `a75940c9...` + research/current #488 `ef6441f7...` | ## Release gate From 37b60c787e19907b433209bc0d16f4f28c48765d Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 4 Sep 2026 20:11:03 +0900 Subject: [PATCH 170/235] docs(ddd): record SE acceptance scale-underflow gap --- docs/product-technical-gap-baseline.md | 83 +++++++++++++------------- 1 file changed, 43 insertions(+), 40 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 799cc5ad1..67709e76e 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-04T10:03:33Z +**Snapshot:** 2026-09-04T11:09:23Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` **Workspace version:** `0.2.0` @@ -30,7 +30,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `ef6441f786d64e6dca198d0d6140838c391f0659` | true | `main` | Validation Evidence landing vehicle. `WilsonCoverageEvidenceV1` retains fixed-width `u64` denominator/count provenance, standard-normal `z`, two-sided semantics, represented coverage, and canonical Wilson endpoints. Large-count recomputation preserves exact count-ratio rounding and complement identity; inexact binary64 sample-count scale uses reciprocal evaluation and an all-covered scale switch. For exactly representable all-covered counts, the canonical writer preserves near-one miss mass, recovers inexact `n + z²` with TwoSum/FMA residuals, and changes a direct quotient only when the represented-input rational crosses the adjacent binary64 midpoint. Hosted exact-head gates and independent review remain required. | +| #488 | `daa097861342ac14a7f0553c8d565b75cb6131fd` | true | `main` | Validation Evidence landing vehicle. Wilson provenance/count and rounding repairs remain inherited. `accept_within_standard_errors` now preserves a finite represented `k · SE` bound before scale normalization so a large estimate/target scale cannot erase positive scientific tolerance by underflow; overflow-only normalization remains for the both-overflow case. Hosted exact-head gates and independent review remain required. | | #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 | Validation / Analysis Run fold child. Unique evidence must be inherited by a conflict-resolving survivor; child-head CI does not transfer. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | @@ -61,12 +61,12 @@ The clock contract separates event/valid time, assertion time, document time, sy - Occasion-mean deviations `p_it = x_it - μ_t` are not CWC residuals, sample-wide grand-mean residuals, or RI-CLPM within-person effects. Numeric event time defines occasion identity, so `-0.0` and `+0.0` are one occasion. - Row arrival order is not scientific evidence. Fixed admitted observations must produce bit-identical means/centered results under permutation wherever the contract claims deterministic CPU `f64` reference behavior. - Known-truth component recovery follows bounded-context identity: stable `Between` is unit-level and uses canonical `occasion_index = 0`; `Within` retains actual `(unit, occasion)` identity. Duplicate identities or stable-Between occasion aliases are not weights. -- A representable final scientific estimand is not rejected solely because an avoidable intermediate binary64 operation overflows/underflows. False exact 0/1/non-finite endpoints and cancellation residues are not accepted when an algebraically equivalent stable form preserves the represented estimand. +- A representable final scientific estimand is not rejected solely because an avoidable intermediate binary64 operation overflows/underflows. False exact 0/1/non-finite endpoints, erased finite bounds, and cancellation residues are not accepted when an equivalent operation order preserves the represented estimand or decision. - Mean signed bias and bias SE remain Validation Evidence performance measures over admitted recovery units; representable cancellation/SEM must survive avoidable overflow/underflow while mathematically nonzero finals below binary64 range fail closed. - Generic Validation Evidence RMSE and its delta-method SE normalize before squaring. Exact-zero point RMSE requires exact-zero point RMSE SE. For positive RMSE, the declared producer satisfies `SE(RMSE) <= RMSE / 2`, with a small relative binary64 admission tolerance. - Generic `MonteCarloSummary` is sign-neutral. Zero SD requires zero SE and percentile endpoints equal to the represented mean. Positive SD requires positive SE coherent with represented `SD / sqrt(n)` within a small relative tolerance. Every inclusive nearest-rank endpoint is a retained observation and satisfies `|endpoint - mean| <= SD * sqrt(n - 1)`. Distinct lower/upper endpoint values share the same `(n - 1) * SD²` deviation budget. When `replication_count = 2` and endpoints are numerically distinct, those values exhaust the retained sample and the recorded represented mean/sample SD must match deterministic two-value reconstruction. Equal numeric endpoints do not prove two distinct ranks and are not subjected to that exhaustion rule. - When the generic carrier occupies `ValidationReport::monte_carlo_rmse`, retained replications are nonnegative; positive mean implies `SE(mean) <= mean`, and inclusive nearest-rank endpoints cannot exceed nonnegative sample-sum support `n * mean`. These typed bounds are not imposed on signed metrics such as bias. -- SE-aware acceptance is `|estimate - target| <= k * SE`. For `k = 0` or exact-zero SE, exact recovery is evaluated before scale reduction; `-0.0` and `+0.0` are one numeric zero-valued scientific state. +- SE-aware acceptance is `|estimate - target| <= k * SE`. For `k = 0` or exact-zero SE, exact recovery is evaluated before any scale reduction; `-0.0` and `+0.0` are one numeric zero-valued scientific state. When the represented residual and represented `k · SE` bound are finite, they are compared directly so `SE / scale` cannot underflow a positive admissible bound to zero. Scale normalization is reserved for overflow handling. - `match_count` is a finite-threshold decision and does not require materializing an unrepresentable absolute residual; `absolute_residuals` remains fail closed when the magnitude itself is requested. - Wilson interval coverage preserves represented-input endpoints through stable rationalized/complementary/compensated forms. Legacy `ValidationReport` endpoint pairs satisfy necessary Wilson coherence and boundary checks, but exact provenance is not inferred from them. `WilsonCoverageEvidenceV1` retains fixed-width `u64` `sample_count`/`covered_count`, `critical_value_kind=standard_normal_z`, `interval_sidedness=two_sided`, numeric `z`, represented coverage, and canonical endpoints and validates them by exact recomputation through the single crate-private Wilson authority. Exact all-covered status is integer count equality, not rounded `p == 1`. Count proportions are correctly rounded from exact integers. When covered counts dominate, the smaller uncovered complement is evaluated and reflected. When retained `sample_count` itself is not exactly representable in binary64, Wilson scale terms use correctly rounded reciprocal `1/n`; its all-covered path uses complementary miss mass for `z²/n <= 1` and direct reciprocal evaluation for `z²/n > 1`. For an exactly representable all-covered count, a false exact-one quotient retains the boundary-local complementary repair. Otherwise, if `n + z²` is inexact, the canonical writer recovers the TwoSum denominator residual and FMA quotient residual, identifies the adjacent binary64 candidate from residual direction, and changes the direct quotient only when the exact represented-input rational lies beyond that candidate's midpoint; exact midpoint selection is ties-to-even. This avoids both under-correction and residual double-rounding overcorrection without claiming globally correctly rounded Wilson rearrangements. Smaller miss mass genuinely below binary64 resolution remains exact one. `ValidationEvidenceV1` binds provenance to the legacy report projection without breaking existing report callers. - Durable and human-facing Validation Evidence must preserve producing-metric invariants on explicit validation, serde ingress/egress, and human projection. Missing v1 provenance is never synthesized from endpoint algebra. @@ -83,7 +83,7 @@ The clock contract separates event/valid time, assertion time, document time, sy ### #488 — Validation Evidence -#488 is the generic Validation Evidence landing vehicle at exact head `ef6441f786d64e6dca198d0d6140838c391f0659`. It remains distinct from Longitudinal Modeling and does not consume mutable fast-mlsirm source. +#488 is the generic Validation Evidence landing vehicle at exact head `daa097861342ac14a7f0553c8d565b75cb6131fd`. It remains distinct from Longitudinal Modeling and does not consume mutable fast-mlsirm source. GAP-070 and GAP-072 remain inherited: stored Wilson endpoints must be one coherent score interval, and exact all-covered evidence cannot use a zero lower endpoint. GAP-071 has advanced from design-only to source implementation. Corrected carrier RED `6f6e06d2...` requires a versioned denominator/critical-value carrier; `ca517ed3...` establishes one private covered-count/Wilson-from-counts authority; `31e1ab2b...` adds `WilsonCoverageEvidenceV1`; `e9c63926...`/`fdd24a1a...` bind standard-normal/two-sided semantics. Envelope RED `07766cb0...` and repair `a16f22e6...` add `ValidationEvidenceV1`, which cross-validates the legacy report projection against the recomputable carrier. @@ -93,9 +93,11 @@ GAP-076 records the exact-count all-covered near-one denominator-absorption defe GAP-077 records the ordinary partial-denominator state left after the near-one and complete-absorption repairs. With `n=1` and represented `z=3*2^-28`, represented `z²=9*2^-56`; `1+z²` rounds upward before division, so predecessor direct evaluation emits `0x1.ffffffffffffep-1` although the represented-input rational lower endpoint rounds to `0x1.fffffffffffffp-1`. Public RED `06e556538e171e675c4d8a8287d75052ffc2c4c3` → causal TwoSum/FMA residual repair `6c084dbe607e6c415288c77fa41a4270947cd51e` → research `25cc19436085881602356e7f2609b697b575540c` → dedicated changelog `5acc894b8a4d42cd7af8cdc22a02b61a063f16aa` → predecessor changelog correction `f89e36d1f2a048befb983327c83f5696baf530cc` → correct-direct-rounding control `80a0a0ade16f516bf63907f2a8d5105dbcd9c438`. -GAP-078 records the opposite residual-rounding state. With `n=3`, represented `z=0x1.6a09e667f3bcdp+492`, and represented `z²=0x1.0000000000001p+985`, the rounded denominator fully absorbs `n`, but the exact represented-input rational and the direct rounded-denominator quotient both round to `0x1.7ffffffffffffp-984`. The predecessor additive residual correction forced `0x1.7fffffffffffep-984`, one ULP too low. Public RED `d076d344cb3cd3a768e7a5c2d8d7bd9039c657e9` → midpoint-selection repair `32314239754204158f228ec67a0771abf4d39b45` → changelog `a75940c955633d5eb92f227d79e64acd0ef46ea8` → research/current #488 `ef6441f786d64e6dca198d0d6140838c391f0659`. +GAP-078 records the opposite residual-rounding state. With `n=3`, represented `z=0x1.6a09e667f3bcdp+492`, and represented `z²=0x1.0000000000001p+985`, the rounded denominator fully absorbs `n`, but the exact represented-input rational and the direct rounded-denominator quotient both round to `0x1.7ffffffffffffp-984`. The predecessor additive residual correction forced `0x1.7fffffffffffep-984`, one ULP too low. Public RED `d076d344cb3cd3a768e7a5c2d8d7bd9039c657e9` → midpoint-selection repair `32314239754204158f228ec67a0771abf4d39b45` → changelog `a75940c955633d5eb92f227d79e64acd0ef46ea8` → research predecessor `ef6441f786d64e6dca198d0d6140838c391f0659`. -These repairs advance the source-contract portion of GAP-071/GAP-073/GAP-074/GAP-075/GAP-076/GAP-077/GAP-078 but not delivery: exact-head hosted gates, independent review, protected-main integration, and adoption by durable consumers that require v1 provenance remain outstanding. Bare legacy `ValidationReport` remains a backward-compatible compact projection and is not silently treated as v1 provenance. +GAP-079 records SE-aware acceptance scale-first underflow. For `estimate=1.0e308`, `target=next_down(estimate)`, `SE=2.2e-16`, and `k=1.0e308`, the represented residual (`1.99584030953472e292`) is within the represented finite bound (`2.2e292`), but the predecessor formed `SE / scale == 0.0` before multiplication and falsely rejected the recovery. Public RED `76067efce44419c27687b8673cb76092c90fb5a5` includes the admissible case and a nearby rejection at `SE=1.8e-16`; causal repair `4ffdf3665b3bbafd3b0bbf06b599fe71498169ab`; changelog `d822c0ba7fa548c3283e462323c56d8f5705de31`; research/current #488 `daa097861342ac14a7f0553c8d565b75cb6131fd`. + +These repairs advance the source-contract portion of GAP-071/GAP-073/GAP-074/GAP-075/GAP-076/GAP-077/GAP-078/GAP-079 but not delivery: exact-head hosted gates, independent review, protected-main integration, and adoption by durable consumers that require v1 provenance remain outstanding. Bare legacy `ValidationReport` remains a backward-compatible compact projection and is not silently treated as v1 provenance. Wilson (1927) remains the primary score-interval reference. AERA/APA/NCME (2014) remains the current published testing-standards edition while revision is underway. IEEE 754-2019 and ISO/IEC 60559:2020 remain the published floating-point authorities used for binary64 representation trace; active IEEE P754 is not treated as a published replacement. @@ -155,40 +157,41 @@ Wilson (1927) remains the primary score-interval reference. AERA/APA/NCME (2014) | GAP-042 | Ratio-first logarithm could nearly double an adjacent-float irregular residual growth rate | `verification-pending` | RED `766ddc7a...` + `ln_1p` repair `16f21d9a...` | | GAP-043 | Duplicate known-truth component identities could silently reweight RMSE recovery evidence | `verification-pending` | RED `698f12f5...` + uniqueness repair `2fae4cb2...` | | GAP-044 | Known-truth RMSE alignment/accumulation depended on row order instead of component identity | `verification-pending` | RED `8ad72ac9...` / `5fb93c40...` + repairs `2dd9537e...` / `025dce7f...`; #310 `c6680450...` | -| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; #488 `ef6441f7...` | -| GAP-046 | Bias SE could reject a representable SEM because raw squared deviations/intermediates overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; #488 `ef6441f7...` | -| GAP-047 | Generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; #488 `ef6441f7...` | -| GAP-048 | Mean signed bias could erase a representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; #488 `ef6441f7...` | +| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; #488 `daa09786...` | +| GAP-046 | Bias SE could reject a representable SEM because raw squared deviations/intermediates overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; #488 `daa09786...` | +| GAP-047 | Generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; #488 `daa09786...` | +| GAP-048 | Mean signed bias could erase a representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; #488 `daa09786...` | | GAP-049 | Stable `Between` recovery could be aliased across occasion indices and reweight RMSE | `verification-pending` | RED `0a03041c...` + repair `ec2c1219...`; #310 `c6680450...` | -| GAP-050 | Zero-multiplier SE-aware acceptance could erase a nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; #488 `ef6441f7...` | -| GAP-051 | Exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; #488 `ef6441f7...` | -| GAP-052 | All-covered Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; #488 `ef6441f7...` | -| GAP-053 | Strict-interior Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; #488 `ef6441f7...` | -| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; #488 `ef6441f7...` | -| GAP-055 | Strict-interior Wilson lower endpoint could accept a nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; #488 `ef6441f7...` | -| GAP-056 | Durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; #488 `ef6441f7...` | -| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from a generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; #488 `ef6441f7...` | -| GAP-058 | Generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; #488 `ef6441f7...` | -| GAP-059 | Generic Monte Carlo summary could materially misstate positive SE relative to `SD / sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; #488 `ef6441f7...` | -| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; #488 `ef6441f7...` | -| GAP-061 | Generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; #488 `ef6441f7...` | -| GAP-062 | Finite-tolerance matching could fail while the pair is deterministically outside every finite tolerance | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; #488 `ef6441f7...` | -| GAP-063 | Exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; #488 `ef6441f7...` | -| GAP-064 | Positive point RMSE could carry SE above the declared squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; #488 `ef6441f7...` | -| GAP-065 | Positive Monte Carlo RMSE could carry spread/SE impossible for nonnegative replications | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; #488 `ef6441f7...` | -| GAP-066 | RMSE Monte Carlo nearest-rank percentile could exceed total nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; #488 `ef6441f7...` | -| GAP-067 | Generic nearest-rank percentile endpoint could be individually incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected over-strong repair `2798e4f9...`; causal repair `c7151b49...`; edge `dbef285b...`; changelog `c38a320c...`; research `2bbcbb24...`; #488 `ef6441f7...` | -| GAP-068 | Distinct generic percentile endpoints could each pass individual radius checks while jointly exceeding the sample squared-deviation budget | `verification-pending` | RED `c4a13826...` + causal repair `cb3f80a2...` + changelog `f727450d...`; #488 `ef6441f7...` | -| GAP-069 | Two-replication distinct nearest-rank endpoints could exhaust the retained sample while the stored mean or SD remained impossible | `verification-pending` | RED `81bf0d9e...` + causal repair `d48f8fef...` + mean coverage `fb314d8a...` + branch cleanup `440b78d8...` + changelog `45116498...`; #488 `ef6441f7...` | -| GAP-070 | Stored Wilson bounds could contain empirical coverage while the lower/upper pair could not arise from one Wilson score interval for that same coverage | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...` + complementary edge `c1cb16a7...`; #488 `ef6441f7...` | -| GAP-071 | Durable Wilson evidence lacked denominator and critical-value/sidedness provenance, preventing exact recomputation from a persisted artifact | `active-repair` | valid carrier RED `6f6e06d2...`; shared count/Wilson authority `ca517ed3...`; `WilsonCoverageEvidenceV1` `31e1ab2b...`; sidedness `e9c63926...`/`fdd24a1a...`; envelope RED `07766cb0...` + `ValidationEvidenceV1` repair `a16f22e6...`; docs/current #488 `ef6441f7...`; remaining: hosted GREEN/review/main plus durable-consumer adoption | -| GAP-072 | Exact all-covered Wilson evidence could retain a zero lower endpoint even though the canonical non-empty finite-`z²` producer always emits `n/(n+z²) > 0` | `verification-pending` | RED `ce714f07...` + non-force source-restore RCA `18499052...` + repair `72e9d954...` + changelog `e3a2f4a2...`; inherited by #488 `ef6441f7...` | -| GAP-073 | Durable Wilson count provenance could round one uncovered observation away above binary64's exact-integer range and expose a pointer-width-dependent count schema | `verification-pending` | RED `29d710a5...` + complement/count repair `29968c80...` + fixed-width carrier repair `91d9a3bb...` + exact ratio RED/repair `63ddfdd6...`/`11323c57...`; #488 `ef6441f7...` | -| GAP-074 | Durable Wilson evidence could correctly retain exact `u64` counts yet pre-round `sample_count` before endpoint projection, shifting strict-interior endpoints or erasing all-covered finite-sample uncertainty | `verification-pending` | RED `f89e2467...` + all-covered edge `1a5180b2...` + stale-oracle correction `6254c498...` + causal reciprocal-scale repair `73bbb5cf...` + changelog `f2b5768b...` + research predecessor `7fc78a59...`; current #488 `ef6441f7...` | -| GAP-075 | Inexact durable all-covered Wilson evidence could round the complementary miss mass to exact one at extreme finite `z` and erase a representable positive lower endpoint | `verification-pending` | RED `059ce70d...`; transient duplicate-owner implementation `46f91f3f...` excluded; canonical repair `0f478392...`; single-writer cleanup `8e2058f2...`; exact-oracle correction `93d5d208...`; changelog correction `43b6562c...`; research predecessor `b03a719d...`; current #488 `ef6441f7...` | -| GAP-076 | Exactly representable all-covered Wilson counts could absorb a small positive `z²` in `n + z²` and falsely emit exact `1.0` although a lower binary64 endpoint is representable | `verification-pending` | RED `e0c4ec81...` + causal boundary repair `c9dcb9df...` + below-resolution edge `6140080d...` + changelog `09ebb482...` + research predecessor `fe89c438...`; current #488 `ef6441f7...` | -| GAP-077 | Exactly representable all-covered Wilson counts could form an inexact partial denominator `n + z²` whose rounded sum shifts the represented-input lower endpoint by one ULP even though neither operand is fully absorbed | `verification-pending` | RED `06e55653...` + causal TwoSum/FMA repair `6c084dbe...` + research `25cc1943...` + changelog `5acc894b...` + predecessor changelog correction `f89e36d1...` + correct-direct-rounding control `80a0a0ad...`; current #488 `ef6441f7...` | -| GAP-078 | Exact-count all-covered Wilson residual compensation could move a direct quotient by one ULP even when the represented-input rational remains on the same side of the adjacent midpoint | `verification-pending` | RED `d076d344...` + midpoint-selection repair `32314239...` + changelog `a75940c9...` + research/current #488 `ef6441f7...` | +| GAP-050 | Zero-multiplier SE-aware acceptance could erase a nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; #488 `daa09786...` | +| GAP-051 | Exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; #488 `daa09786...` | +| GAP-052 | All-covered Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; #488 `daa09786...` | +| GAP-053 | Strict-interior Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; #488 `daa09786...` | +| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; #488 `daa09786...` | +| GAP-055 | Strict-interior Wilson lower endpoint could accept a nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; #488 `daa09786...` | +| GAP-056 | Durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; #488 `daa09786...` | +| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from a generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; #488 `daa09786...` | +| GAP-058 | Generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; #488 `daa09786...` | +| GAP-059 | Generic Monte Carlo summary could materially misstate positive SE relative to `SD / sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; #488 `daa09786...` | +| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; #488 `daa09786...` | +| GAP-061 | Generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; #488 `daa09786...` | +| GAP-062 | Finite-tolerance matching could fail while the pair is deterministically outside every finite tolerance | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; #488 `daa09786...` | +| GAP-063 | Exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; #488 `daa09786...` | +| GAP-064 | Positive point RMSE could carry SE above the declared squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; #488 `daa09786...` | +| GAP-065 | Positive Monte Carlo RMSE could carry spread/SE impossible for nonnegative replications | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; #488 `daa09786...` | +| GAP-066 | RMSE Monte Carlo nearest-rank percentile could exceed total nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; #488 `daa09786...` | +| GAP-067 | Generic nearest-rank percentile endpoint could be individually incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected over-strong repair `2798e4f9...`; causal repair `c7151b49...`; edge `dbef285b...`; changelog `c38a320c...`; research `2bbcbb24...`; #488 `daa09786...` | +| GAP-068 | Distinct generic percentile endpoints could each pass individual radius checks while jointly exceeding the sample squared-deviation budget | `verification-pending` | RED `c4a13826...` + causal repair `cb3f80a2...` + changelog `f727450d...`; #488 `daa09786...` | +| GAP-069 | Two-replication distinct nearest-rank endpoints could exhaust the retained sample while the stored mean or SD remained impossible | `verification-pending` | RED `81bf0d9e...` + causal repair `d48f8fef...` + mean coverage `fb314d8a...` + branch cleanup `440b78d8...` + changelog `45116498...`; #488 `daa09786...` | +| GAP-070 | Stored Wilson bounds could contain empirical coverage while the lower/upper pair could not arise from one Wilson score interval for that same coverage | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...` + complementary edge `c1cb16a7...`; #488 `daa09786...` | +| GAP-071 | Durable Wilson evidence lacked denominator and critical-value/sidedness provenance, preventing exact recomputation from a persisted artifact | `active-repair` | valid carrier RED `6f6e06d2...`; shared count/Wilson authority `ca517ed3...`; `WilsonCoverageEvidenceV1` `31e1ab2b...`; sidedness `e9c63926...`/`fdd24a1a...`; envelope RED `07766cb0...` + `ValidationEvidenceV1` repair `a16f22e6...`; docs/current #488 `daa09786...`; remaining: hosted GREEN/review/main plus durable-consumer adoption | +| GAP-072 | Exact all-covered Wilson evidence could retain a zero lower endpoint even though the canonical non-empty finite-`z²` producer always emits `n/(n+z²) > 0` | `verification-pending` | RED `ce714f07...` + non-force source-restore RCA `18499052...` + repair `72e9d954...` + changelog `e3a2f4a2...`; inherited by #488 `daa09786...` | +| GAP-073 | Durable Wilson count provenance could round one uncovered observation away above binary64's exact-integer range and expose a pointer-width-dependent count schema | `verification-pending` | RED `29d710a5...` + complement/count repair `29968c80...` + fixed-width carrier repair `91d9a3bb...` + exact ratio RED/repair `63ddfdd6...`/`11323c57...`; #488 `daa09786...` | +| GAP-074 | Durable Wilson evidence could correctly retain exact `u64` counts yet pre-round `sample_count` before endpoint projection, shifting strict-interior endpoints or erasing all-covered finite-sample uncertainty | `verification-pending` | RED `f89e2467...` + all-covered edge `1a5180b2...` + stale-oracle correction `6254c498...` + causal reciprocal-scale repair `73bbb5cf...` + changelog `f2b5768b...` + research predecessor `7fc78a59...`; current #488 `daa09786...` | +| GAP-075 | Inexact durable all-covered Wilson evidence could round the complementary miss mass to exact one at extreme finite `z` and erase a representable positive lower endpoint | `verification-pending` | RED `059ce70d...`; transient duplicate-owner implementation `46f91f3f...` excluded; canonical repair `0f478392...`; single-writer cleanup `8e2058f2...`; exact-oracle correction `93d5d208...`; changelog correction `43b6562c...`; research predecessor `b03a719d...`; current #488 `daa09786...` | +| GAP-076 | Exactly representable all-covered Wilson counts could absorb a small positive `z²` in `n + z²` and falsely emit exact `1.0` although a lower binary64 endpoint is representable | `verification-pending` | RED `e0c4ec81...` + causal boundary repair `c9dcb9df...` + below-resolution edge `6140080d...` + changelog `09ebb482...` + research predecessor `fe89c438...`; current #488 `daa09786...` | +| GAP-077 | Exactly representable all-covered Wilson counts could form an inexact partial denominator `n + z²` whose rounded sum shifts the represented-input lower endpoint by one ULP even though neither operand is fully absorbed | `verification-pending` | RED `06e55653...` + causal TwoSum/FMA repair `6c084dbe...` + research `25cc1943...` + changelog `5acc894b...` + predecessor changelog correction `f89e36d1...` + correct-direct-rounding control `80a0a0ad...`; current #488 `daa09786...` | +| GAP-078 | Exact-count all-covered Wilson residual compensation could move a direct quotient by one ULP even when the represented-input rational remains on the same side of the adjacent midpoint | `verification-pending` | RED `d076d344...` + midpoint-selection repair `32314239...` + changelog `a75940c9...` + research predecessor `ef6441f7...`; current #488 `daa09786...` | +| GAP-079 | SE-aware acceptance could underflow a finite positive `k · SE` tolerance to exact zero by dividing `SE` by a much larger estimate/target scale before multiplication | `verification-pending` | RED `76067efc...` + causal direct-finite comparison repair `4ffdf366...` + changelog `d822c0ba...` + research/current #488 `daa09786...` | ## Release gate From 4ed323ce00ca9acd42f9b6582efac88c17d783b4 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 4 Sep 2026 21:10:28 +0900 Subject: [PATCH 171/235] docs(gap): record exact both-overflow SE decision --- docs/product-technical-gap-baseline.md | 83 +++++++++++++------------- 1 file changed, 43 insertions(+), 40 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 67709e76e..74b4ee91f 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-04T11:09:23Z +**Snapshot:** 2026-09-04T12:07:11Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` **Workspace version:** `0.2.0` @@ -30,7 +30,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `daa097861342ac14a7f0553c8d565b75cb6131fd` | true | `main` | Validation Evidence landing vehicle. Wilson provenance/count and rounding repairs remain inherited. `accept_within_standard_errors` now preserves a finite represented `k · SE` bound before scale normalization so a large estimate/target scale cannot erase positive scientific tolerance by underflow; overflow-only normalization remains for the both-overflow case. Hosted exact-head gates and independent review remain required. | +| #488 | `ba2f169424e7551762ed32ac47733a9d8261266c` | true | `main` | Validation Evidence landing vehicle. Wilson provenance/count and rounding repairs remain inherited. `accept_within_standard_errors` compares finite represented residual/bound directly and, when both direct operations overflow, compares the exact rational values represented by the binary64 inputs through integer significand/exponent arithmetic instead of a rounded scale-normalized fallback. Hosted exact-head gates and independent review remain required. | | #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 | Validation / Analysis Run fold child. Unique evidence must be inherited by a conflict-resolving survivor; child-head CI does not transfer. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | @@ -66,7 +66,7 @@ The clock contract separates event/valid time, assertion time, document time, sy - Generic Validation Evidence RMSE and its delta-method SE normalize before squaring. Exact-zero point RMSE requires exact-zero point RMSE SE. For positive RMSE, the declared producer satisfies `SE(RMSE) <= RMSE / 2`, with a small relative binary64 admission tolerance. - Generic `MonteCarloSummary` is sign-neutral. Zero SD requires zero SE and percentile endpoints equal to the represented mean. Positive SD requires positive SE coherent with represented `SD / sqrt(n)` within a small relative tolerance. Every inclusive nearest-rank endpoint is a retained observation and satisfies `|endpoint - mean| <= SD * sqrt(n - 1)`. Distinct lower/upper endpoint values share the same `(n - 1) * SD²` deviation budget. When `replication_count = 2` and endpoints are numerically distinct, those values exhaust the retained sample and the recorded represented mean/sample SD must match deterministic two-value reconstruction. Equal numeric endpoints do not prove two distinct ranks and are not subjected to that exhaustion rule. - When the generic carrier occupies `ValidationReport::monte_carlo_rmse`, retained replications are nonnegative; positive mean implies `SE(mean) <= mean`, and inclusive nearest-rank endpoints cannot exceed nonnegative sample-sum support `n * mean`. These typed bounds are not imposed on signed metrics such as bias. -- SE-aware acceptance is `|estimate - target| <= k * SE`. For `k = 0` or exact-zero SE, exact recovery is evaluated before any scale reduction; `-0.0` and `+0.0` are one numeric zero-valued scientific state. When the represented residual and represented `k · SE` bound are finite, they are compared directly so `SE / scale` cannot underflow a positive admissible bound to zero. Scale normalization is reserved for overflow handling. +- SE-aware acceptance is `|estimate - target| <= k * SE`. For `k = 0` or exact-zero SE, exact recovery is evaluated before any scale reduction; `-0.0` and `+0.0` are one numeric zero-valued scientific state. Finite represented residuals and finite represented `k · SE` bounds are compared directly. If both direct operations overflow, the exact rational magnitudes represented by the binary64 inputs are compared from their integer significands and powers of two; an independently rounded scale-normalized tie is not decision evidence. - `match_count` is a finite-threshold decision and does not require materializing an unrepresentable absolute residual; `absolute_residuals` remains fail closed when the magnitude itself is requested. - Wilson interval coverage preserves represented-input endpoints through stable rationalized/complementary/compensated forms. Legacy `ValidationReport` endpoint pairs satisfy necessary Wilson coherence and boundary checks, but exact provenance is not inferred from them. `WilsonCoverageEvidenceV1` retains fixed-width `u64` `sample_count`/`covered_count`, `critical_value_kind=standard_normal_z`, `interval_sidedness=two_sided`, numeric `z`, represented coverage, and canonical endpoints and validates them by exact recomputation through the single crate-private Wilson authority. Exact all-covered status is integer count equality, not rounded `p == 1`. Count proportions are correctly rounded from exact integers. When covered counts dominate, the smaller uncovered complement is evaluated and reflected. When retained `sample_count` itself is not exactly representable in binary64, Wilson scale terms use correctly rounded reciprocal `1/n`; its all-covered path uses complementary miss mass for `z²/n <= 1` and direct reciprocal evaluation for `z²/n > 1`. For an exactly representable all-covered count, a false exact-one quotient retains the boundary-local complementary repair. Otherwise, if `n + z²` is inexact, the canonical writer recovers the TwoSum denominator residual and FMA quotient residual, identifies the adjacent binary64 candidate from residual direction, and changes the direct quotient only when the exact represented-input rational lies beyond that candidate's midpoint; exact midpoint selection is ties-to-even. This avoids both under-correction and residual double-rounding overcorrection without claiming globally correctly rounded Wilson rearrangements. Smaller miss mass genuinely below binary64 resolution remains exact one. `ValidationEvidenceV1` binds provenance to the legacy report projection without breaking existing report callers. - Durable and human-facing Validation Evidence must preserve producing-metric invariants on explicit validation, serde ingress/egress, and human projection. Missing v1 provenance is never synthesized from endpoint algebra. @@ -83,7 +83,7 @@ The clock contract separates event/valid time, assertion time, document time, sy ### #488 — Validation Evidence -#488 is the generic Validation Evidence landing vehicle at exact head `daa097861342ac14a7f0553c8d565b75cb6131fd`. It remains distinct from Longitudinal Modeling and does not consume mutable fast-mlsirm source. +#488 is the generic Validation Evidence landing vehicle at exact head `ba2f169424e7551762ed32ac47733a9d8261266c`. It remains distinct from Longitudinal Modeling and does not consume mutable fast-mlsirm source. GAP-070 and GAP-072 remain inherited: stored Wilson endpoints must be one coherent score interval, and exact all-covered evidence cannot use a zero lower endpoint. GAP-071 has advanced from design-only to source implementation. Corrected carrier RED `6f6e06d2...` requires a versioned denominator/critical-value carrier; `ca517ed3...` establishes one private covered-count/Wilson-from-counts authority; `31e1ab2b...` adds `WilsonCoverageEvidenceV1`; `e9c63926...`/`fdd24a1a...` bind standard-normal/two-sided semantics. Envelope RED `07766cb0...` and repair `a16f22e6...` add `ValidationEvidenceV1`, which cross-validates the legacy report projection against the recomputable carrier. @@ -95,9 +95,11 @@ GAP-077 records the ordinary partial-denominator state left after the near-one a GAP-078 records the opposite residual-rounding state. With `n=3`, represented `z=0x1.6a09e667f3bcdp+492`, and represented `z²=0x1.0000000000001p+985`, the rounded denominator fully absorbs `n`, but the exact represented-input rational and the direct rounded-denominator quotient both round to `0x1.7ffffffffffffp-984`. The predecessor additive residual correction forced `0x1.7fffffffffffep-984`, one ULP too low. Public RED `d076d344cb3cd3a768e7a5c2d8d7bd9039c657e9` → midpoint-selection repair `32314239754204158f228ec67a0771abf4d39b45` → changelog `a75940c955633d5eb92f227d79e64acd0ef46ea8` → research predecessor `ef6441f786d64e6dca198d0d6140838c391f0659`. -GAP-079 records SE-aware acceptance scale-first underflow. For `estimate=1.0e308`, `target=next_down(estimate)`, `SE=2.2e-16`, and `k=1.0e308`, the represented residual (`1.99584030953472e292`) is within the represented finite bound (`2.2e292`), but the predecessor formed `SE / scale == 0.0` before multiplication and falsely rejected the recovery. Public RED `76067efce44419c27687b8673cb76092c90fb5a5` includes the admissible case and a nearby rejection at `SE=1.8e-16`; causal repair `4ffdf3665b3bbafd3b0bbf06b599fe71498169ab`; changelog `d822c0ba7fa548c3283e462323c56d8f5705de31`; research/current #488 `daa097861342ac14a7f0553c8d565b75cb6131fd`. +GAP-079 records SE-aware acceptance scale-first underflow. For `estimate=1.0e308`, `target=next_down(estimate)`, `SE=2.2e-16`, and `k=1.0e308`, the represented residual (`1.99584030953472e292`) is within the represented finite bound (`2.2e292`), but the predecessor formed `SE / scale == 0.0` before multiplication and falsely rejected the recovery. Public RED `76067efce44419c27687b8673cb76092c90fb5a5` includes the admissible case and a nearby rejection at `SE=1.8e-16`; causal repair `4ffdf3665b3bbafd3b0bbf06b599fe71498169ab`; changelog `d822c0ba7fa548c3283e462323c56d8f5705de31`; retained by current #488 `ba2f169424e7551762ed32ac47733a9d8261266c`. -These repairs advance the source-contract portion of GAP-071/GAP-073/GAP-074/GAP-075/GAP-076/GAP-077/GAP-078/GAP-079 but not delivery: exact-head hosted gates, independent review, protected-main integration, and adoption by durable consumers that require v1 provenance remain outstanding. Bare legacy `ValidationReport` remains a backward-compatible compact projection and is not silently treated as v1 provenance. +GAP-080 records the remaining both-overflow decision defect. With exact binary64 payloads `estimate=0x7fee446cf80dddbc`, `target=0xffe2d7e397966af3`, `SE=0x73620ad22ddb6f38`, and `k=0x4c85c69ac1c7a9ed`, direct subtraction and multiplication both overflow; predecessor scale normalization rounds residual and bound to the same finite value and falsely accepts although the exact represented-input bound is smaller. Public RED `a9a45714eb6266f6b922086112b313060e77c522` includes that strict rejection and the adjacent accepted multiplier `0x4c85c69ac1c7a9ee`; causal exact significand/exponent comparison repair `425e89638d594fdb2f3586d73f021b60a530b456`; changelog `e62706291ad556c6d9078a2bc50dcf3bca5a6feb`; research/current #488 `ba2f169424e7551762ed32ac47733a9d8261266c`. + +These repairs advance the source-contract portion of GAP-071/GAP-073/GAP-074/GAP-075/GAP-076/GAP-077/GAP-078/GAP-079/GAP-080 but not delivery: exact-head hosted gates, independent review, protected-main integration, and adoption by durable consumers that require v1 provenance remain outstanding. Bare legacy `ValidationReport` remains a backward-compatible compact projection and is not silently treated as v1 provenance. Wilson (1927) remains the primary score-interval reference. AERA/APA/NCME (2014) remains the current published testing-standards edition while revision is underway. IEEE 754-2019 and ISO/IEC 60559:2020 remain the published floating-point authorities used for binary64 representation trace; active IEEE P754 is not treated as a published replacement. @@ -157,41 +159,42 @@ Wilson (1927) remains the primary score-interval reference. AERA/APA/NCME (2014) | GAP-042 | Ratio-first logarithm could nearly double an adjacent-float irregular residual growth rate | `verification-pending` | RED `766ddc7a...` + `ln_1p` repair `16f21d9a...` | | GAP-043 | Duplicate known-truth component identities could silently reweight RMSE recovery evidence | `verification-pending` | RED `698f12f5...` + uniqueness repair `2fae4cb2...` | | GAP-044 | Known-truth RMSE alignment/accumulation depended on row order instead of component identity | `verification-pending` | RED `8ad72ac9...` / `5fb93c40...` + repairs `2dd9537e...` / `025dce7f...`; #310 `c6680450...` | -| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; #488 `daa09786...` | -| GAP-046 | Bias SE could reject a representable SEM because raw squared deviations/intermediates overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; #488 `daa09786...` | -| GAP-047 | Generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; #488 `daa09786...` | -| GAP-048 | Mean signed bias could erase a representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; #488 `daa09786...` | +| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; #488 `ba2f1694...` | +| GAP-046 | Bias SE could reject a representable SEM because raw squared deviations/intermediates overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; #488 `ba2f1694...` | +| GAP-047 | Generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; #488 `ba2f1694...` | +| GAP-048 | Mean signed bias could erase a representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; #488 `ba2f1694...` | | GAP-049 | Stable `Between` recovery could be aliased across occasion indices and reweight RMSE | `verification-pending` | RED `0a03041c...` + repair `ec2c1219...`; #310 `c6680450...` | -| GAP-050 | Zero-multiplier SE-aware acceptance could erase a nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; #488 `daa09786...` | -| GAP-051 | Exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; #488 `daa09786...` | -| GAP-052 | All-covered Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; #488 `daa09786...` | -| GAP-053 | Strict-interior Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; #488 `daa09786...` | -| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; #488 `daa09786...` | -| GAP-055 | Strict-interior Wilson lower endpoint could accept a nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; #488 `daa09786...` | -| GAP-056 | Durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; #488 `daa09786...` | -| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from a generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; #488 `daa09786...` | -| GAP-058 | Generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; #488 `daa09786...` | -| GAP-059 | Generic Monte Carlo summary could materially misstate positive SE relative to `SD / sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; #488 `daa09786...` | -| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; #488 `daa09786...` | -| GAP-061 | Generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; #488 `daa09786...` | -| GAP-062 | Finite-tolerance matching could fail while the pair is deterministically outside every finite tolerance | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; #488 `daa09786...` | -| GAP-063 | Exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; #488 `daa09786...` | -| GAP-064 | Positive point RMSE could carry SE above the declared squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; #488 `daa09786...` | -| GAP-065 | Positive Monte Carlo RMSE could carry spread/SE impossible for nonnegative replications | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; #488 `daa09786...` | -| GAP-066 | RMSE Monte Carlo nearest-rank percentile could exceed total nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; #488 `daa09786...` | -| GAP-067 | Generic nearest-rank percentile endpoint could be individually incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected over-strong repair `2798e4f9...`; causal repair `c7151b49...`; edge `dbef285b...`; changelog `c38a320c...`; research `2bbcbb24...`; #488 `daa09786...` | -| GAP-068 | Distinct generic percentile endpoints could each pass individual radius checks while jointly exceeding the sample squared-deviation budget | `verification-pending` | RED `c4a13826...` + causal repair `cb3f80a2...` + changelog `f727450d...`; #488 `daa09786...` | -| GAP-069 | Two-replication distinct nearest-rank endpoints could exhaust the retained sample while the stored mean or SD remained impossible | `verification-pending` | RED `81bf0d9e...` + causal repair `d48f8fef...` + mean coverage `fb314d8a...` + branch cleanup `440b78d8...` + changelog `45116498...`; #488 `daa09786...` | -| GAP-070 | Stored Wilson bounds could contain empirical coverage while the lower/upper pair could not arise from one Wilson score interval for that same coverage | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...` + complementary edge `c1cb16a7...`; #488 `daa09786...` | -| GAP-071 | Durable Wilson evidence lacked denominator and critical-value/sidedness provenance, preventing exact recomputation from a persisted artifact | `active-repair` | valid carrier RED `6f6e06d2...`; shared count/Wilson authority `ca517ed3...`; `WilsonCoverageEvidenceV1` `31e1ab2b...`; sidedness `e9c63926...`/`fdd24a1a...`; envelope RED `07766cb0...` + `ValidationEvidenceV1` repair `a16f22e6...`; docs/current #488 `daa09786...`; remaining: hosted GREEN/review/main plus durable-consumer adoption | -| GAP-072 | Exact all-covered Wilson evidence could retain a zero lower endpoint even though the canonical non-empty finite-`z²` producer always emits `n/(n+z²) > 0` | `verification-pending` | RED `ce714f07...` + non-force source-restore RCA `18499052...` + repair `72e9d954...` + changelog `e3a2f4a2...`; inherited by #488 `daa09786...` | -| GAP-073 | Durable Wilson count provenance could round one uncovered observation away above binary64's exact-integer range and expose a pointer-width-dependent count schema | `verification-pending` | RED `29d710a5...` + complement/count repair `29968c80...` + fixed-width carrier repair `91d9a3bb...` + exact ratio RED/repair `63ddfdd6...`/`11323c57...`; #488 `daa09786...` | -| GAP-074 | Durable Wilson evidence could correctly retain exact `u64` counts yet pre-round `sample_count` before endpoint projection, shifting strict-interior endpoints or erasing all-covered finite-sample uncertainty | `verification-pending` | RED `f89e2467...` + all-covered edge `1a5180b2...` + stale-oracle correction `6254c498...` + causal reciprocal-scale repair `73bbb5cf...` + changelog `f2b5768b...` + research predecessor `7fc78a59...`; current #488 `daa09786...` | -| GAP-075 | Inexact durable all-covered Wilson evidence could round the complementary miss mass to exact one at extreme finite `z` and erase a representable positive lower endpoint | `verification-pending` | RED `059ce70d...`; transient duplicate-owner implementation `46f91f3f...` excluded; canonical repair `0f478392...`; single-writer cleanup `8e2058f2...`; exact-oracle correction `93d5d208...`; changelog correction `43b6562c...`; research predecessor `b03a719d...`; current #488 `daa09786...` | -| GAP-076 | Exactly representable all-covered Wilson counts could absorb a small positive `z²` in `n + z²` and falsely emit exact `1.0` although a lower binary64 endpoint is representable | `verification-pending` | RED `e0c4ec81...` + causal boundary repair `c9dcb9df...` + below-resolution edge `6140080d...` + changelog `09ebb482...` + research predecessor `fe89c438...`; current #488 `daa09786...` | -| GAP-077 | Exactly representable all-covered Wilson counts could form an inexact partial denominator `n + z²` whose rounded sum shifts the represented-input lower endpoint by one ULP even though neither operand is fully absorbed | `verification-pending` | RED `06e55653...` + causal TwoSum/FMA repair `6c084dbe...` + research `25cc1943...` + changelog `5acc894b...` + predecessor changelog correction `f89e36d1...` + correct-direct-rounding control `80a0a0ad...`; current #488 `daa09786...` | -| GAP-078 | Exact-count all-covered Wilson residual compensation could move a direct quotient by one ULP even when the represented-input rational remains on the same side of the adjacent midpoint | `verification-pending` | RED `d076d344...` + midpoint-selection repair `32314239...` + changelog `a75940c9...` + research predecessor `ef6441f7...`; current #488 `daa09786...` | -| GAP-079 | SE-aware acceptance could underflow a finite positive `k · SE` tolerance to exact zero by dividing `SE` by a much larger estimate/target scale before multiplication | `verification-pending` | RED `76067efc...` + causal direct-finite comparison repair `4ffdf366...` + changelog `d822c0ba...` + research/current #488 `daa09786...` | +| GAP-050 | Zero-multiplier SE-aware acceptance could erase a nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; #488 `ba2f1694...` | +| GAP-051 | Exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; #488 `ba2f1694...` | +| GAP-052 | All-covered Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; #488 `ba2f1694...` | +| GAP-053 | Strict-interior Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; #488 `ba2f1694...` | +| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; #488 `ba2f1694...` | +| GAP-055 | Strict-interior Wilson lower endpoint could accept a nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; #488 `ba2f1694...` | +| GAP-056 | Durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; #488 `ba2f1694...` | +| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from a generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; #488 `ba2f1694...` | +| GAP-058 | Generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; #488 `ba2f1694...` | +| GAP-059 | Generic Monte Carlo summary could materially misstate positive SE relative to `SD / sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; #488 `ba2f1694...` | +| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; #488 `ba2f1694...` | +| GAP-061 | Generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; #488 `ba2f1694...` | +| GAP-062 | Finite-tolerance matching could fail while the pair is deterministically outside every finite tolerance | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; #488 `ba2f1694...` | +| GAP-063 | Exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; #488 `ba2f1694...` | +| GAP-064 | Positive point RMSE could carry SE above the declared squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; #488 `ba2f1694...` | +| GAP-065 | Positive Monte Carlo RMSE could carry spread/SE impossible for nonnegative replications | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; #488 `ba2f1694...` | +| GAP-066 | RMSE Monte Carlo nearest-rank percentile could exceed total nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; #488 `ba2f1694...` | +| GAP-067 | Generic nearest-rank percentile endpoint could be individually incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected over-strong repair `2798e4f9...`; causal repair `c7151b49...`; edge `dbef285b...`; changelog `c38a320c...`; research `2bbcbb24...`; #488 `ba2f1694...` | +| GAP-068 | Distinct generic percentile endpoints could each pass individual radius checks while jointly exceeding the sample squared-deviation budget | `verification-pending` | RED `c4a13826...` + causal repair `cb3f80a2...` + changelog `f727450d...`; #488 `ba2f1694...` | +| GAP-069 | Two-replication distinct nearest-rank endpoints could exhaust the retained sample while the stored mean or SD remained impossible | `verification-pending` | RED `81bf0d9e...` + causal repair `d48f8fef...` + mean coverage `fb314d8a...` + branch cleanup `440b78d8...` + changelog `45116498...`; #488 `ba2f1694...` | +| GAP-070 | Stored Wilson bounds could contain empirical coverage while the lower/upper pair could not arise from one Wilson score interval for that same coverage | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...` + complementary edge `c1cb16a7...`; #488 `ba2f1694...` | +| GAP-071 | Durable Wilson evidence lacked denominator and critical-value/sidedness provenance, preventing exact recomputation from a persisted artifact | `active-repair` | valid carrier RED `6f6e06d2...`; shared count/Wilson authority `ca517ed3...`; `WilsonCoverageEvidenceV1` `31e1ab2b...`; sidedness `e9c63926...`/`fdd24a1a...`; envelope RED `07766cb0...` + `ValidationEvidenceV1` repair `a16f22e6...`; docs/current #488 `ba2f1694...`; remaining: hosted GREEN/review/main plus durable-consumer adoption | +| GAP-072 | Exact all-covered Wilson evidence could retain a zero lower endpoint even though the canonical non-empty finite-`z²` producer always emits `n/(n+z²) > 0` | `verification-pending` | RED `ce714f07...` + non-force source-restore RCA `18499052...` + repair `72e9d954...` + changelog `e3a2f4a2...`; inherited by #488 `ba2f1694...` | +| GAP-073 | Durable Wilson count provenance could round one uncovered observation away above binary64's exact-integer range and expose a pointer-width-dependent count schema | `verification-pending` | RED `29d710a5...` + complement/count repair `29968c80...` + fixed-width carrier repair `91d9a3bb...` + exact ratio RED/repair `63ddfdd6...`/`11323c57...`; #488 `ba2f1694...` | +| GAP-074 | Durable Wilson evidence could correctly retain exact `u64` counts yet pre-round `sample_count` before endpoint projection, shifting strict-interior endpoints or erasing all-covered finite-sample uncertainty | `verification-pending` | RED `f89e2467...` + all-covered edge `1a5180b2...` + stale-oracle correction `6254c498...` + causal reciprocal-scale repair `73bbb5cf...` + changelog `f2b5768b...` + research predecessor `7fc78a59...`; current #488 `ba2f1694...` | +| GAP-075 | Inexact durable all-covered Wilson evidence could round the complementary miss mass to exact one at extreme finite `z` and erase a representable positive lower endpoint | `verification-pending` | RED `059ce70d...`; transient duplicate-owner implementation `46f91f3f...` excluded; canonical repair `0f478392...`; single-writer cleanup `8e2058f2...`; exact-oracle correction `93d5d208...`; changelog correction `43b6562c...`; research predecessor `b03a719d...`; current #488 `ba2f1694...` | +| GAP-076 | Exactly representable all-covered Wilson counts could absorb a small positive `z²` in `n + z²` and falsely emit exact `1.0` although a lower binary64 endpoint is representable | `verification-pending` | RED `e0c4ec81...` + causal boundary repair `c9dcb9df...` + below-resolution edge `6140080d...` + changelog `09ebb482...` + research predecessor `fe89c438...`; current #488 `ba2f1694...` | +| GAP-077 | Exactly representable all-covered Wilson counts could form an inexact partial denominator `n + z²` whose rounded sum shifts the represented-input lower endpoint by one ULP even though neither operand is fully absorbed | `verification-pending` | RED `06e55653...` + causal TwoSum/FMA repair `6c084dbe...` + research `25cc1943...` + changelog `5acc894b...` + predecessor changelog correction `f89e36d1...` + correct-direct-rounding control `80a0a0ad...`; current #488 `ba2f1694...` | +| GAP-078 | Exact-count all-covered Wilson residual compensation could move a direct quotient by one ULP even when the represented-input rational remains on the same side of the adjacent midpoint | `verification-pending` | RED `d076d344...` + midpoint-selection repair `32314239...` + changelog `a75940c9...` + research predecessor `ef6441f7...`; current #488 `ba2f1694...` | +| GAP-079 | SE-aware acceptance could underflow a finite positive `k · SE` tolerance to exact zero by dividing `SE` by a much larger estimate/target scale before multiplication | `verification-pending` | RED `76067efc...` + causal direct-finite comparison repair `4ffdf366...` + changelog `d822c0ba...` + retained by current #488 `ba2f1694...` | +| GAP-080 | SE-aware acceptance both-overflow fallback could normalize an exact strict rejection into an equal rounded residual/bound and falsely accept it | `verification-pending` | RED `a9a45714...` + exact significand/exponent repair `425e8963...` + changelog `e6270629...` + research/current #488 `ba2f1694...` | ## Release gate From 8ac71e414f21456319998deecfe878f0bed72d51 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 4 Sep 2026 22:13:02 +0900 Subject: [PATCH 172/235] docs(gaps): add finite SE rounding tie --- docs/product-technical-gap-baseline.md | 87 +++++++++++++------------- 1 file changed, 45 insertions(+), 42 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 74b4ee91f..2a3aa2fcf 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-04T12:07:11Z +**Snapshot:** 2026-09-04T13:09:51Z **Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` **Workspace version:** `0.2.0` @@ -30,7 +30,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `ba2f169424e7551762ed32ac47733a9d8261266c` | true | `main` | Validation Evidence landing vehicle. Wilson provenance/count and rounding repairs remain inherited. `accept_within_standard_errors` compares finite represented residual/bound directly and, when both direct operations overflow, compares the exact rational values represented by the binary64 inputs through integer significand/exponent arithmetic instead of a rounded scale-normalized fallback. Hosted exact-head gates and independent review remain required. | +| #488 | `9e1ecdb0b2abd727aae4534b79b648309fad80dd` | true | `main` | Validation Evidence landing vehicle. Wilson provenance/count and rounding repairs remain inherited. `accept_within_standard_errors` compares finite represented residual/bound directly; a nonzero finite rounded tie whose subtraction is exact is disambiguated by the FMA product residual, and when both direct operations overflow the exact binary64 input rationals are compared through integer significand/exponent arithmetic. Hosted exact-head gates and independent review remain required. | | #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 | Validation / Analysis Run fold child. Unique evidence must be inherited by a conflict-resolving survivor; child-head CI does not transfer. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | @@ -66,7 +66,7 @@ The clock contract separates event/valid time, assertion time, document time, sy - Generic Validation Evidence RMSE and its delta-method SE normalize before squaring. Exact-zero point RMSE requires exact-zero point RMSE SE. For positive RMSE, the declared producer satisfies `SE(RMSE) <= RMSE / 2`, with a small relative binary64 admission tolerance. - Generic `MonteCarloSummary` is sign-neutral. Zero SD requires zero SE and percentile endpoints equal to the represented mean. Positive SD requires positive SE coherent with represented `SD / sqrt(n)` within a small relative tolerance. Every inclusive nearest-rank endpoint is a retained observation and satisfies `|endpoint - mean| <= SD * sqrt(n - 1)`. Distinct lower/upper endpoint values share the same `(n - 1) * SD²` deviation budget. When `replication_count = 2` and endpoints are numerically distinct, those values exhaust the retained sample and the recorded represented mean/sample SD must match deterministic two-value reconstruction. Equal numeric endpoints do not prove two distinct ranks and are not subjected to that exhaustion rule. - When the generic carrier occupies `ValidationReport::monte_carlo_rmse`, retained replications are nonnegative; positive mean implies `SE(mean) <= mean`, and inclusive nearest-rank endpoints cannot exceed nonnegative sample-sum support `n * mean`. These typed bounds are not imposed on signed metrics such as bias. -- SE-aware acceptance is `|estimate - target| <= k * SE`. For `k = 0` or exact-zero SE, exact recovery is evaluated before any scale reduction; `-0.0` and `+0.0` are one numeric zero-valued scientific state. Finite represented residuals and finite represented `k · SE` bounds are compared directly. If both direct operations overflow, the exact rational magnitudes represented by the binary64 inputs are compared from their integer significands and powers of two; an independently rounded scale-normalized tie is not decision evidence. +- SE-aware acceptance is `|estimate - target| <= k * SE`. For `k = 0` or exact-zero SE, exact recovery is evaluated before any scale reduction; `-0.0` and `+0.0` are one numeric zero-valued scientific state. Finite represented residuals and finite represented `k · SE` bounds are compared directly. When a nonzero finite rounded residual/bound tie occurs, an exact subtraction plus nonzero FMA product residual may disambiguate the represented-input inequality; if subtraction itself rounded or the product residual is zero, the conservative rounded comparison remains. If both direct operations overflow, exact rational magnitudes represented by the binary64 inputs are compared from integer significands and powers of two; independently rounded normalization is not decision evidence. - `match_count` is a finite-threshold decision and does not require materializing an unrepresentable absolute residual; `absolute_residuals` remains fail closed when the magnitude itself is requested. - Wilson interval coverage preserves represented-input endpoints through stable rationalized/complementary/compensated forms. Legacy `ValidationReport` endpoint pairs satisfy necessary Wilson coherence and boundary checks, but exact provenance is not inferred from them. `WilsonCoverageEvidenceV1` retains fixed-width `u64` `sample_count`/`covered_count`, `critical_value_kind=standard_normal_z`, `interval_sidedness=two_sided`, numeric `z`, represented coverage, and canonical endpoints and validates them by exact recomputation through the single crate-private Wilson authority. Exact all-covered status is integer count equality, not rounded `p == 1`. Count proportions are correctly rounded from exact integers. When covered counts dominate, the smaller uncovered complement is evaluated and reflected. When retained `sample_count` itself is not exactly representable in binary64, Wilson scale terms use correctly rounded reciprocal `1/n`; its all-covered path uses complementary miss mass for `z²/n <= 1` and direct reciprocal evaluation for `z²/n > 1`. For an exactly representable all-covered count, a false exact-one quotient retains the boundary-local complementary repair. Otherwise, if `n + z²` is inexact, the canonical writer recovers the TwoSum denominator residual and FMA quotient residual, identifies the adjacent binary64 candidate from residual direction, and changes the direct quotient only when the exact represented-input rational lies beyond that candidate's midpoint; exact midpoint selection is ties-to-even. This avoids both under-correction and residual double-rounding overcorrection without claiming globally correctly rounded Wilson rearrangements. Smaller miss mass genuinely below binary64 resolution remains exact one. `ValidationEvidenceV1` binds provenance to the legacy report projection without breaking existing report callers. - Durable and human-facing Validation Evidence must preserve producing-metric invariants on explicit validation, serde ingress/egress, and human projection. Missing v1 provenance is never synthesized from endpoint algebra. @@ -83,7 +83,7 @@ The clock contract separates event/valid time, assertion time, document time, sy ### #488 — Validation Evidence -#488 is the generic Validation Evidence landing vehicle at exact head `ba2f169424e7551762ed32ac47733a9d8261266c`. It remains distinct from Longitudinal Modeling and does not consume mutable fast-mlsirm source. +#488 is the generic Validation Evidence landing vehicle at exact head `9e1ecdb0b2abd727aae4534b79b648309fad80dd`. It remains distinct from Longitudinal Modeling and does not consume mutable fast-mlsirm source. GAP-070 and GAP-072 remain inherited: stored Wilson endpoints must be one coherent score interval, and exact all-covered evidence cannot use a zero lower endpoint. GAP-071 has advanced from design-only to source implementation. Corrected carrier RED `6f6e06d2...` requires a versioned denominator/critical-value carrier; `ca517ed3...` establishes one private covered-count/Wilson-from-counts authority; `31e1ab2b...` adds `WilsonCoverageEvidenceV1`; `e9c63926...`/`fdd24a1a...` bind standard-normal/two-sided semantics. Envelope RED `07766cb0...` and repair `a16f22e6...` add `ValidationEvidenceV1`, which cross-validates the legacy report projection against the recomputable carrier. @@ -95,11 +95,13 @@ GAP-077 records the ordinary partial-denominator state left after the near-one a GAP-078 records the opposite residual-rounding state. With `n=3`, represented `z=0x1.6a09e667f3bcdp+492`, and represented `z²=0x1.0000000000001p+985`, the rounded denominator fully absorbs `n`, but the exact represented-input rational and the direct rounded-denominator quotient both round to `0x1.7ffffffffffffp-984`. The predecessor additive residual correction forced `0x1.7fffffffffffep-984`, one ULP too low. Public RED `d076d344cb3cd3a768e7a5c2d8d7bd9039c657e9` → midpoint-selection repair `32314239754204158f228ec67a0771abf4d39b45` → changelog `a75940c955633d5eb92f227d79e64acd0ef46ea8` → research predecessor `ef6441f786d64e6dca198d0d6140838c391f0659`. -GAP-079 records SE-aware acceptance scale-first underflow. For `estimate=1.0e308`, `target=next_down(estimate)`, `SE=2.2e-16`, and `k=1.0e308`, the represented residual (`1.99584030953472e292`) is within the represented finite bound (`2.2e292`), but the predecessor formed `SE / scale == 0.0` before multiplication and falsely rejected the recovery. Public RED `76067efce44419c27687b8673cb76092c90fb5a5` includes the admissible case and a nearby rejection at `SE=1.8e-16`; causal repair `4ffdf3665b3bbafd3b0bbf06b599fe71498169ab`; changelog `d822c0ba7fa548c3283e462323c56d8f5705de31`; retained by current #488 `ba2f169424e7551762ed32ac47733a9d8261266c`. +GAP-079 records SE-aware acceptance scale-first underflow. For `estimate=1.0e308`, `target=next_down(estimate)`, `SE=2.2e-16`, and `k=1.0e308`, the represented residual (`1.99584030953472e292`) is within the represented finite bound (`2.2e292`), but the predecessor formed `SE / scale == 0.0` before multiplication and falsely rejected the recovery. Public RED `76067efce44419c27687b8673cb76092c90fb5a5` includes the admissible case and a nearby rejection at `SE=1.8e-16`; causal repair `4ffdf3665b3bbafd3b0bbf06b599fe71498169ab`; changelog `d822c0ba7fa548c3283e462323c56d8f5705de31`; retained by current #488 `9e1ecdb0b2abd727aae4534b79b648309fad80dd`. -GAP-080 records the remaining both-overflow decision defect. With exact binary64 payloads `estimate=0x7fee446cf80dddbc`, `target=0xffe2d7e397966af3`, `SE=0x73620ad22ddb6f38`, and `k=0x4c85c69ac1c7a9ed`, direct subtraction and multiplication both overflow; predecessor scale normalization rounds residual and bound to the same finite value and falsely accepts although the exact represented-input bound is smaller. Public RED `a9a45714eb6266f6b922086112b313060e77c522` includes that strict rejection and the adjacent accepted multiplier `0x4c85c69ac1c7a9ee`; causal exact significand/exponent comparison repair `425e89638d594fdb2f3586d73f021b60a530b456`; changelog `e62706291ad556c6d9078a2bc50dcf3bca5a6feb`; research/current #488 `ba2f169424e7551762ed32ac47733a9d8261266c`. +GAP-080 records the both-overflow decision defect. With exact binary64 payloads `estimate=0x7fee446cf80dddbc`, `target=0xffe2d7e397966af3`, `SE=0x73620ad22ddb6f38`, and `k=0x4c85c69ac1c7a9ed`, direct subtraction and multiplication both overflow; predecessor scale normalization rounds residual and bound to the same finite value and falsely accepts although the exact represented-input bound is smaller. Public RED `a9a45714eb6266f6b922086112b313060e77c522` includes that strict rejection and the adjacent accepted multiplier `0x4c85c69ac1c7a9ee`; causal exact significand/exponent comparison repair `425e89638d594fdb2f3586d73f021b60a530b456`; changelog `e62706291ad556c6d9078a2bc50dcf3bca5a6feb`; retained by current #488 `9e1ecdb0b2abd727aae4534b79b648309fad80dd`. -These repairs advance the source-contract portion of GAP-071/GAP-073/GAP-074/GAP-075/GAP-076/GAP-077/GAP-078/GAP-079/GAP-080 but not delivery: exact-head hosted gates, independent review, protected-main integration, and adoption by durable consumers that require v1 provenance remain outstanding. Bare legacy `ValidationReport` remains a backward-compatible compact projection and is not silently treated as v1 provenance. +GAP-081 records the remaining finite/finite rounded-tie defect. For `estimate=1`, `target=0`, `SE=1-2^-27`, and `k=1+2^-27`, exact represented `k·SE = 1-2^-54` is strictly below residual 1, but binary64 multiplication rounds the bound ties-to-even to `1.0`, so predecessor comparison falsely accepts equality. Public RED `23c3262c824609d79dc14d45bb0acb5a54e99a51`; causal exact-subtraction/FMA-product-residual repair `6a2add488cfa6bb5ac3cc854a107f287b61bbed5`; edge coverage `3656deb2f2abc0a83027618a823497a829d9227e`; changelog `090f5124588cb184fc2ef644d91355f2b2c2082b`; research/current #488 `9e1ecdb0b2abd727aae4534b79b648309fad80dd`. + +These repairs advance the source-contract portion of GAP-071/GAP-073/GAP-074/GAP-075/GAP-076/GAP-077/GAP-078/GAP-079/GAP-080/GAP-081 but not delivery: exact-head hosted gates, independent review, protected-main integration, and adoption by durable consumers that require v1 provenance remain outstanding. Bare legacy `ValidationReport` remains a backward-compatible compact projection and is not silently treated as v1 provenance. Wilson (1927) remains the primary score-interval reference. AERA/APA/NCME (2014) remains the current published testing-standards edition while revision is underway. IEEE 754-2019 and ISO/IEC 60559:2020 remain the published floating-point authorities used for binary64 representation trace; active IEEE P754 is not treated as a published replacement. @@ -159,42 +161,43 @@ Wilson (1927) remains the primary score-interval reference. AERA/APA/NCME (2014) | GAP-042 | Ratio-first logarithm could nearly double an adjacent-float irregular residual growth rate | `verification-pending` | RED `766ddc7a...` + `ln_1p` repair `16f21d9a...` | | GAP-043 | Duplicate known-truth component identities could silently reweight RMSE recovery evidence | `verification-pending` | RED `698f12f5...` + uniqueness repair `2fae4cb2...` | | GAP-044 | Known-truth RMSE alignment/accumulation depended on row order instead of component identity | `verification-pending` | RED `8ad72ac9...` / `5fb93c40...` + repairs `2dd9537e...` / `025dce7f...`; #310 `c6680450...` | -| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; #488 `ba2f1694...` | -| GAP-046 | Bias SE could reject a representable SEM because raw squared deviations/intermediates overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; #488 `ba2f1694...` | -| GAP-047 | Generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; #488 `ba2f1694...` | -| GAP-048 | Mean signed bias could erase a representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; #488 `ba2f1694...` | +| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; #488 `9e1ecdb0...` | +| GAP-046 | Bias SE could reject a representable SEM because raw squared deviations/intermediates overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; #488 `9e1ecdb0...` | +| GAP-047 | Generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; #488 `9e1ecdb0...` | +| GAP-048 | Mean signed bias could erase a representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; #488 `9e1ecdb0...` | | GAP-049 | Stable `Between` recovery could be aliased across occasion indices and reweight RMSE | `verification-pending` | RED `0a03041c...` + repair `ec2c1219...`; #310 `c6680450...` | -| GAP-050 | Zero-multiplier SE-aware acceptance could erase a nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; #488 `ba2f1694...` | -| GAP-051 | Exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; #488 `ba2f1694...` | -| GAP-052 | All-covered Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; #488 `ba2f1694...` | -| GAP-053 | Strict-interior Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; #488 `ba2f1694...` | -| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; #488 `ba2f1694...` | -| GAP-055 | Strict-interior Wilson lower endpoint could accept a nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; #488 `ba2f1694...` | -| GAP-056 | Durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; #488 `ba2f1694...` | -| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from a generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; #488 `ba2f1694...` | -| GAP-058 | Generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; #488 `ba2f1694...` | -| GAP-059 | Generic Monte Carlo summary could materially misstate positive SE relative to `SD / sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; #488 `ba2f1694...` | -| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; #488 `ba2f1694...` | -| GAP-061 | Generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; #488 `ba2f1694...` | -| GAP-062 | Finite-tolerance matching could fail while the pair is deterministically outside every finite tolerance | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; #488 `ba2f1694...` | -| GAP-063 | Exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; #488 `ba2f1694...` | -| GAP-064 | Positive point RMSE could carry SE above the declared squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; #488 `ba2f1694...` | -| GAP-065 | Positive Monte Carlo RMSE could carry spread/SE impossible for nonnegative replications | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; #488 `ba2f1694...` | -| GAP-066 | RMSE Monte Carlo nearest-rank percentile could exceed total nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; #488 `ba2f1694...` | -| GAP-067 | Generic nearest-rank percentile endpoint could be individually incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected over-strong repair `2798e4f9...`; causal repair `c7151b49...`; edge `dbef285b...`; changelog `c38a320c...`; research `2bbcbb24...`; #488 `ba2f1694...` | -| GAP-068 | Distinct generic percentile endpoints could each pass individual radius checks while jointly exceeding the sample squared-deviation budget | `verification-pending` | RED `c4a13826...` + causal repair `cb3f80a2...` + changelog `f727450d...`; #488 `ba2f1694...` | -| GAP-069 | Two-replication distinct nearest-rank endpoints could exhaust the retained sample while the stored mean or SD remained impossible | `verification-pending` | RED `81bf0d9e...` + causal repair `d48f8fef...` + mean coverage `fb314d8a...` + branch cleanup `440b78d8...` + changelog `45116498...`; #488 `ba2f1694...` | -| GAP-070 | Stored Wilson bounds could contain empirical coverage while the lower/upper pair could not arise from one Wilson score interval for that same coverage | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...` + complementary edge `c1cb16a7...`; #488 `ba2f1694...` | -| GAP-071 | Durable Wilson evidence lacked denominator and critical-value/sidedness provenance, preventing exact recomputation from a persisted artifact | `active-repair` | valid carrier RED `6f6e06d2...`; shared count/Wilson authority `ca517ed3...`; `WilsonCoverageEvidenceV1` `31e1ab2b...`; sidedness `e9c63926...`/`fdd24a1a...`; envelope RED `07766cb0...` + `ValidationEvidenceV1` repair `a16f22e6...`; docs/current #488 `ba2f1694...`; remaining: hosted GREEN/review/main plus durable-consumer adoption | -| GAP-072 | Exact all-covered Wilson evidence could retain a zero lower endpoint even though the canonical non-empty finite-`z²` producer always emits `n/(n+z²) > 0` | `verification-pending` | RED `ce714f07...` + non-force source-restore RCA `18499052...` + repair `72e9d954...` + changelog `e3a2f4a2...`; inherited by #488 `ba2f1694...` | -| GAP-073 | Durable Wilson count provenance could round one uncovered observation away above binary64's exact-integer range and expose a pointer-width-dependent count schema | `verification-pending` | RED `29d710a5...` + complement/count repair `29968c80...` + fixed-width carrier repair `91d9a3bb...` + exact ratio RED/repair `63ddfdd6...`/`11323c57...`; #488 `ba2f1694...` | -| GAP-074 | Durable Wilson evidence could correctly retain exact `u64` counts yet pre-round `sample_count` before endpoint projection, shifting strict-interior endpoints or erasing all-covered finite-sample uncertainty | `verification-pending` | RED `f89e2467...` + all-covered edge `1a5180b2...` + stale-oracle correction `6254c498...` + causal reciprocal-scale repair `73bbb5cf...` + changelog `f2b5768b...` + research predecessor `7fc78a59...`; current #488 `ba2f1694...` | -| GAP-075 | Inexact durable all-covered Wilson evidence could round the complementary miss mass to exact one at extreme finite `z` and erase a representable positive lower endpoint | `verification-pending` | RED `059ce70d...`; transient duplicate-owner implementation `46f91f3f...` excluded; canonical repair `0f478392...`; single-writer cleanup `8e2058f2...`; exact-oracle correction `93d5d208...`; changelog correction `43b6562c...`; research predecessor `b03a719d...`; current #488 `ba2f1694...` | -| GAP-076 | Exactly representable all-covered Wilson counts could absorb a small positive `z²` in `n + z²` and falsely emit exact `1.0` although a lower binary64 endpoint is representable | `verification-pending` | RED `e0c4ec81...` + causal boundary repair `c9dcb9df...` + below-resolution edge `6140080d...` + changelog `09ebb482...` + research predecessor `fe89c438...`; current #488 `ba2f1694...` | -| GAP-077 | Exactly representable all-covered Wilson counts could form an inexact partial denominator `n + z²` whose rounded sum shifts the represented-input lower endpoint by one ULP even though neither operand is fully absorbed | `verification-pending` | RED `06e55653...` + causal TwoSum/FMA repair `6c084dbe...` + research `25cc1943...` + changelog `5acc894b...` + predecessor changelog correction `f89e36d1...` + correct-direct-rounding control `80a0a0ad...`; current #488 `ba2f1694...` | -| GAP-078 | Exact-count all-covered Wilson residual compensation could move a direct quotient by one ULP even when the represented-input rational remains on the same side of the adjacent midpoint | `verification-pending` | RED `d076d344...` + midpoint-selection repair `32314239...` + changelog `a75940c9...` + research predecessor `ef6441f7...`; current #488 `ba2f1694...` | -| GAP-079 | SE-aware acceptance could underflow a finite positive `k · SE` tolerance to exact zero by dividing `SE` by a much larger estimate/target scale before multiplication | `verification-pending` | RED `76067efc...` + causal direct-finite comparison repair `4ffdf366...` + changelog `d822c0ba...` + retained by current #488 `ba2f1694...` | -| GAP-080 | SE-aware acceptance both-overflow fallback could normalize an exact strict rejection into an equal rounded residual/bound and falsely accept it | `verification-pending` | RED `a9a45714...` + exact significand/exponent repair `425e8963...` + changelog `e6270629...` + research/current #488 `ba2f1694...` | +| GAP-050 | Zero-multiplier SE-aware acceptance could erase a nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; #488 `9e1ecdb0...` | +| GAP-051 | Exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; #488 `9e1ecdb0...` | +| GAP-052 | All-covered Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; #488 `9e1ecdb0...` | +| GAP-053 | Strict-interior Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; #488 `9e1ecdb0...` | +| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; #488 `9e1ecdb0...` | +| GAP-055 | Strict-interior Wilson lower endpoint could accept a nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; #488 `9e1ecdb0...` | +| GAP-056 | Durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; #488 `9e1ecdb0...` | +| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from a generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; #488 `9e1ecdb0...` | +| GAP-058 | Generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; #488 `9e1ecdb0...` | +| GAP-059 | Generic Monte Carlo summary could materially misstate positive SE relative to `SD / sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; #488 `9e1ecdb0...` | +| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; #488 `9e1ecdb0...` | +| GAP-061 | Generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; #488 `9e1ecdb0...` | +| GAP-062 | Finite-tolerance matching could fail while the pair is deterministically outside every finite tolerance | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; #488 `9e1ecdb0...` | +| GAP-063 | Exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; #488 `9e1ecdb0...` | +| GAP-064 | Positive point RMSE could carry SE above the declared squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; #488 `9e1ecdb0...` | +| GAP-065 | Positive Monte Carlo RMSE could carry spread/SE impossible for nonnegative replications | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; #488 `9e1ecdb0...` | +| GAP-066 | RMSE Monte Carlo nearest-rank percentile could exceed total nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; #488 `9e1ecdb0...` | +| GAP-067 | Generic nearest-rank percentile endpoint could be individually incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected over-strong repair `2798e4f9...`; causal repair `c7151b49...`; edge `dbef285b...`; changelog `c38a320c...`; research `2bbcbb24...`; #488 `9e1ecdb0...` | +| GAP-068 | Distinct generic percentile endpoints could each pass individual radius checks while jointly exceeding the sample squared-deviation budget | `verification-pending` | RED `c4a13826...` + causal repair `cb3f80a2...` + changelog `f727450d...`; #488 `9e1ecdb0...` | +| GAP-069 | Two-replication distinct nearest-rank endpoints could exhaust the retained sample while the stored mean or SD remained impossible | `verification-pending` | RED `81bf0d9e...` + causal repair `d48f8fef...` + mean coverage `fb314d8a...` + branch cleanup `440b78d8...` + changelog `45116498...`; #488 `9e1ecdb0...` | +| GAP-070 | Stored Wilson bounds could contain empirical coverage while the lower/upper pair could not arise from one Wilson score interval for that same coverage | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...` + complementary edge `c1cb16a7...`; #488 `9e1ecdb0...` | +| GAP-071 | Durable Wilson evidence lacked denominator and critical-value/sidedness provenance, preventing exact recomputation from a persisted artifact | `active-repair` | valid carrier RED `6f6e06d2...`; shared count/Wilson authority `ca517ed3...`; `WilsonCoverageEvidenceV1` `31e1ab2b...`; sidedness `e9c63926...`/`fdd24a1a...`; envelope RED `07766cb0...` + `ValidationEvidenceV1` repair `a16f22e6...`; docs/current #488 `9e1ecdb0...`; remaining: hosted GREEN/review/main plus durable-consumer adoption | +| GAP-072 | Exact all-covered Wilson evidence could retain a zero lower endpoint even though the canonical non-empty finite-`z²` producer always emits `n/(n+z²) > 0` | `verification-pending` | RED `ce714f07...` + non-force source-restore RCA `18499052...` + repair `72e9d954...` + changelog `e3a2f4a2...`; inherited by #488 `9e1ecdb0...` | +| GAP-073 | Durable Wilson count provenance could round one uncovered observation away above binary64's exact-integer range and expose a pointer-width-dependent count schema | `verification-pending` | RED `29d710a5...` + complement/count repair `29968c80...` + fixed-width carrier repair `91d9a3bb...` + exact ratio RED/repair `63ddfdd6...`/`11323c57...`; #488 `9e1ecdb0...` | +| GAP-074 | Durable Wilson evidence could correctly retain exact `u64` counts yet pre-round `sample_count` before endpoint projection, shifting strict-interior endpoints or erasing all-covered finite-sample uncertainty | `verification-pending` | RED `f89e2467...` + all-covered edge `1a5180b2...` + stale-oracle correction `6254c498...` + causal reciprocal-scale repair `73bbb5cf...` + changelog `f2b5768b...` + research predecessor `7fc78a59...`; current #488 `9e1ecdb0...` | +| GAP-075 | Inexact durable all-covered Wilson evidence could round the complementary miss mass to exact one at extreme finite `z` and erase a representable positive lower endpoint | `verification-pending` | RED `059ce70d...`; transient duplicate-owner implementation `46f91f3f...` excluded; canonical repair `0f478392...`; single-writer cleanup `8e2058f2...`; exact-oracle correction `93d5d208...`; changelog correction `43b6562c...`; research predecessor `b03a719d...`; current #488 `9e1ecdb0...` | +| GAP-076 | Exactly representable all-covered Wilson counts could absorb a small positive `z²` in `n + z²` and falsely emit exact `1.0` although a lower binary64 endpoint is representable | `verification-pending` | RED `e0c4ec81...` + causal boundary repair `c9dcb9df...` + below-resolution edge `6140080d...` + changelog `09ebb482...` + research predecessor `fe89c438...`; current #488 `9e1ecdb0...` | +| GAP-077 | Exactly representable all-covered Wilson counts could form an inexact partial denominator `n + z²` whose rounded sum shifts the represented-input lower endpoint by one ULP even though neither operand is fully absorbed | `verification-pending` | RED `06e55653...` + causal TwoSum/FMA repair `6c084dbe...` + research `25cc1943...` + changelog `5acc894b...` + predecessor changelog correction `f89e36d1...` + correct-direct-rounding control `80a0a0ad...`; current #488 `9e1ecdb0...` | +| GAP-078 | Exact-count all-covered Wilson residual compensation could move a direct quotient by one ULP even when the represented-input rational remains on the same side of the adjacent midpoint | `verification-pending` | RED `d076d344...` + midpoint-selection repair `32314239...` + changelog `a75940c9...` + research predecessor `ef6441f7...`; current #488 `9e1ecdb0...` | +| GAP-079 | SE-aware acceptance could underflow a finite positive `k · SE` tolerance to exact zero by dividing `SE` by a much larger estimate/target scale before multiplication | `verification-pending` | RED `76067efc...` + causal direct-finite comparison repair `4ffdf366...` + changelog `d822c0ba...` + retained by current #488 `9e1ecdb0...` | +| GAP-080 | SE-aware acceptance both-overflow fallback could normalize an exact strict rejection into an equal rounded residual/bound and falsely accept it | `verification-pending` | RED `a9a45714...` + exact significand/exponent repair `425e8963...` + changelog `e6270629...` + retained by current #488 `9e1ecdb0...` | +| GAP-081 | SE-aware acceptance finite/finite path could round an exact strict represented-input rejection into an equal residual/bound and falsely accept it | `verification-pending` | RED `23c3262c...` + exact-subtraction/FMA tie repair `6a2add48...` + edge coverage `3656deb2...` + changelog `090f5124...` + research/current #488 `9e1ecdb0...` | ## Release gate From 4502a386b9d6458bc69a9a312c149f593e3ebd46 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 4 Sep 2026 23:14:34 +0900 Subject: [PATCH 173/235] docs(gaps): add subtraction-rounded SE acceptance gap --- docs/product-technical-gap-baseline.md | 97 +++++++++++++------------- 1 file changed, 50 insertions(+), 47 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 2a3aa2fcf..88cae2b2f 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,8 +2,8 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-04T13:09:51Z -**Protected-main evidence:** `1bc02f580cf48e1d39da239f0e818453437c31c3` +**Snapshot:** 2026-09-04T14:10:26Z +**Protected-main evidence:** `b18bca1c69ef8d1799fcd3af6bf4412498e007c3` **Workspace version:** `0.2.0` **Delivery authority:** issue [#175](https://github.com/ContextualWisdomLab/TEPP/issues/175), PR [#435](https://github.com/ContextualWisdomLab/TEPP/pull/435), and [`docs/delivery/pr-queue-authority-2026-09-01.md`](delivery/pr-queue-authority-2026-09-01.md). @@ -14,7 +14,7 @@ A planning document, mergeable branch, local/source inspection, predecessor-head | Signal | Fresh evidence | Implication | | --- | ---: | --- | -| Protected `main` | `1bc02f580cf48e1d39da239f0e818453437c31c3` | Capability claims remain bounded to this commit until main advances. | +| Protected `main` | `b18bca1c69ef8d1799fcd3af6bf4412498e007c3` | #489 is integrated; capability claims remain bounded to this commit until main advances. | | Open pull requests | **134** | WIP circuit breaker remains active; consolidate into existing bounded-context vehicles. | | Draft pull requests | **134** | Every current open PR is Draft. | | Non-Draft pull requests | **0** | No PR is eligible for normal merge until deliberately made Ready after exact-head evidence. | @@ -22,7 +22,7 @@ A planning document, mergeable branch, local/source inspection, predecessor-head | GitHub releases | **0** | No TEPP open head is a released contract. | | Organization ruleset | `18156473` | One qualifying current-head approval, stale-review dismissal after push, resolved threads, extra approval for unattributed changes where applicable, and central required workflows. | -Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward updates on the default branch. Organization-admin bypass is not normal delivery evidence and is not used by this writer. +Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward updates on the default branch. Organization-admin bypass is not normal delivery evidence and is not used by this writer. Protected-main #489 removes the repository-local hourly PR-maintenance caller in favor of the central required scheduler, narrows duplicate documentation triggers, isolates PR validation concurrency by repository/PR, and combines line/branch coverage work while retaining both coverage gates. ## Current priority open pull-request evidence @@ -30,7 +30,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `9e1ecdb0b2abd727aae4534b79b648309fad80dd` | true | `main` | Validation Evidence landing vehicle. Wilson provenance/count and rounding repairs remain inherited. `accept_within_standard_errors` compares finite represented residual/bound directly; a nonzero finite rounded tie whose subtraction is exact is disambiguated by the FMA product residual, and when both direct operations overflow the exact binary64 input rationals are compared through integer significand/exponent arithmetic. Hosted exact-head gates and independent review remain required. | +| #488 | `0d630fbdda85173cf71a9a82673c52070345e191` | true | `main` | Validation Evidence landing vehicle, non-force restacked onto protected #489 by merge commit `a2754592...`. Wilson provenance/count and rounding repairs remain inherited. `accept_within_standard_errors` compares finite represented residual/bound directly; on a nonzero finite rounded tie it compares subtraction and product low-term corrections when those projections differ, and when both direct operations overflow it compares exact binary64 input rationals through integer significand/exponent arithmetic. Hosted exact-head gates and independent review remain required. | | #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 | Validation / Analysis Run fold child. Unique evidence must be inherited by a conflict-resolving survivor; child-head CI does not transfer. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | @@ -66,7 +66,7 @@ The clock contract separates event/valid time, assertion time, document time, sy - Generic Validation Evidence RMSE and its delta-method SE normalize before squaring. Exact-zero point RMSE requires exact-zero point RMSE SE. For positive RMSE, the declared producer satisfies `SE(RMSE) <= RMSE / 2`, with a small relative binary64 admission tolerance. - Generic `MonteCarloSummary` is sign-neutral. Zero SD requires zero SE and percentile endpoints equal to the represented mean. Positive SD requires positive SE coherent with represented `SD / sqrt(n)` within a small relative tolerance. Every inclusive nearest-rank endpoint is a retained observation and satisfies `|endpoint - mean| <= SD * sqrt(n - 1)`. Distinct lower/upper endpoint values share the same `(n - 1) * SD²` deviation budget. When `replication_count = 2` and endpoints are numerically distinct, those values exhaust the retained sample and the recorded represented mean/sample SD must match deterministic two-value reconstruction. Equal numeric endpoints do not prove two distinct ranks and are not subjected to that exhaustion rule. - When the generic carrier occupies `ValidationReport::monte_carlo_rmse`, retained replications are nonnegative; positive mean implies `SE(mean) <= mean`, and inclusive nearest-rank endpoints cannot exceed nonnegative sample-sum support `n * mean`. These typed bounds are not imposed on signed metrics such as bias. -- SE-aware acceptance is `|estimate - target| <= k * SE`. For `k = 0` or exact-zero SE, exact recovery is evaluated before any scale reduction; `-0.0` and `+0.0` are one numeric zero-valued scientific state. Finite represented residuals and finite represented `k · SE` bounds are compared directly. When a nonzero finite rounded residual/bound tie occurs, an exact subtraction plus nonzero FMA product residual may disambiguate the represented-input inequality; if subtraction itself rounded or the product residual is zero, the conservative rounded comparison remains. If both direct operations overflow, exact rational magnitudes represented by the binary64 inputs are compared from integer significands and powers of two; independently rounded normalization is not decision evidence. +- SE-aware acceptance is `|estimate - target| <= k * SE`. For `k = 0` or exact-zero SE, exact recovery is evaluated before any scale reduction; `-0.0` and `+0.0` are one numeric zero-valued scientific state. Finite represented residuals and finite represented `k · SE` bounds are compared directly. When a nonzero finite rounded residual/bound tie occurs, TEPP compares the error-free subtraction low term—sign-adjusted for the absolute residual—with the FMA product low term; when the projected corrections differ, their order preserves the represented-input inequality, while equal projected corrections remain on the ordinary rounded decision rather than claiming a global exact comparator. If both direct operations overflow, exact rational magnitudes represented by the binary64 inputs are compared from integer significands and powers of two; independently rounded normalization is not decision evidence. - `match_count` is a finite-threshold decision and does not require materializing an unrepresentable absolute residual; `absolute_residuals` remains fail closed when the magnitude itself is requested. - Wilson interval coverage preserves represented-input endpoints through stable rationalized/complementary/compensated forms. Legacy `ValidationReport` endpoint pairs satisfy necessary Wilson coherence and boundary checks, but exact provenance is not inferred from them. `WilsonCoverageEvidenceV1` retains fixed-width `u64` `sample_count`/`covered_count`, `critical_value_kind=standard_normal_z`, `interval_sidedness=two_sided`, numeric `z`, represented coverage, and canonical endpoints and validates them by exact recomputation through the single crate-private Wilson authority. Exact all-covered status is integer count equality, not rounded `p == 1`. Count proportions are correctly rounded from exact integers. When covered counts dominate, the smaller uncovered complement is evaluated and reflected. When retained `sample_count` itself is not exactly representable in binary64, Wilson scale terms use correctly rounded reciprocal `1/n`; its all-covered path uses complementary miss mass for `z²/n <= 1` and direct reciprocal evaluation for `z²/n > 1`. For an exactly representable all-covered count, a false exact-one quotient retains the boundary-local complementary repair. Otherwise, if `n + z²` is inexact, the canonical writer recovers the TwoSum denominator residual and FMA quotient residual, identifies the adjacent binary64 candidate from residual direction, and changes the direct quotient only when the exact represented-input rational lies beyond that candidate's midpoint; exact midpoint selection is ties-to-even. This avoids both under-correction and residual double-rounding overcorrection without claiming globally correctly rounded Wilson rearrangements. Smaller miss mass genuinely below binary64 resolution remains exact one. `ValidationEvidenceV1` binds provenance to the legacy report projection without breaking existing report callers. - Durable and human-facing Validation Evidence must preserve producing-metric invariants on explicit validation, serde ingress/egress, and human projection. Missing v1 provenance is never synthesized from endpoint algebra. @@ -83,7 +83,7 @@ The clock contract separates event/valid time, assertion time, document time, sy ### #488 — Validation Evidence -#488 is the generic Validation Evidence landing vehicle at exact head `9e1ecdb0b2abd727aae4534b79b648309fad80dd`. It remains distinct from Longitudinal Modeling and does not consume mutable fast-mlsirm source. +#488 is the generic Validation Evidence landing vehicle at exact head `0d630fbdda85173cf71a9a82673c52070345e191`. It remains distinct from Longitudinal Modeling and does not consume mutable fast-mlsirm source. The branch was non-force merge-restacked onto protected #489 by `a2754592987be9e88941d220565c45e34f621a4e`, preserving its complete ancestry and inheriting the protected workflow-load repair. GAP-070 and GAP-072 remain inherited: stored Wilson endpoints must be one coherent score interval, and exact all-covered evidence cannot use a zero lower endpoint. GAP-071 has advanced from design-only to source implementation. Corrected carrier RED `6f6e06d2...` requires a versioned denominator/critical-value carrier; `ca517ed3...` establishes one private covered-count/Wilson-from-counts authority; `31e1ab2b...` adds `WilsonCoverageEvidenceV1`; `e9c63926...`/`fdd24a1a...` bind standard-normal/two-sided semantics. Envelope RED `07766cb0...` and repair `a16f22e6...` add `ValidationEvidenceV1`, which cross-validates the legacy report projection against the recomputable carrier. @@ -95,13 +95,15 @@ GAP-077 records the ordinary partial-denominator state left after the near-one a GAP-078 records the opposite residual-rounding state. With `n=3`, represented `z=0x1.6a09e667f3bcdp+492`, and represented `z²=0x1.0000000000001p+985`, the rounded denominator fully absorbs `n`, but the exact represented-input rational and the direct rounded-denominator quotient both round to `0x1.7ffffffffffffp-984`. The predecessor additive residual correction forced `0x1.7fffffffffffep-984`, one ULP too low. Public RED `d076d344cb3cd3a768e7a5c2d8d7bd9039c657e9` → midpoint-selection repair `32314239754204158f228ec67a0771abf4d39b45` → changelog `a75940c955633d5eb92f227d79e64acd0ef46ea8` → research predecessor `ef6441f786d64e6dca198d0d6140838c391f0659`. -GAP-079 records SE-aware acceptance scale-first underflow. For `estimate=1.0e308`, `target=next_down(estimate)`, `SE=2.2e-16`, and `k=1.0e308`, the represented residual (`1.99584030953472e292`) is within the represented finite bound (`2.2e292`), but the predecessor formed `SE / scale == 0.0` before multiplication and falsely rejected the recovery. Public RED `76067efce44419c27687b8673cb76092c90fb5a5` includes the admissible case and a nearby rejection at `SE=1.8e-16`; causal repair `4ffdf3665b3bbafd3b0bbf06b599fe71498169ab`; changelog `d822c0ba7fa548c3283e462323c56d8f5705de31`; retained by current #488 `9e1ecdb0b2abd727aae4534b79b648309fad80dd`. +GAP-079 records SE-aware acceptance scale-first underflow. For `estimate=1.0e308`, `target=next_down(estimate)`, `SE=2.2e-16`, and `k=1.0e308`, the represented residual (`1.99584030953472e292`) is within the represented finite bound (`2.2e292`), but the predecessor formed `SE / scale == 0.0` before multiplication and falsely rejected the recovery. Public RED `76067efce44419c27687b8673cb76092c90fb5a5` includes the admissible case and a nearby rejection at `SE=1.8e-16`; causal repair `4ffdf3665b3bbafd3b0bbf06b599fe71498169ab`; changelog `d822c0ba7fa548c3283e462323c56d8f5705de31`; retained by current #488 `0d630fbdda85173cf71a9a82673c52070345e191`. -GAP-080 records the both-overflow decision defect. With exact binary64 payloads `estimate=0x7fee446cf80dddbc`, `target=0xffe2d7e397966af3`, `SE=0x73620ad22ddb6f38`, and `k=0x4c85c69ac1c7a9ed`, direct subtraction and multiplication both overflow; predecessor scale normalization rounds residual and bound to the same finite value and falsely accepts although the exact represented-input bound is smaller. Public RED `a9a45714eb6266f6b922086112b313060e77c522` includes that strict rejection and the adjacent accepted multiplier `0x4c85c69ac1c7a9ee`; causal exact significand/exponent comparison repair `425e89638d594fdb2f3586d73f021b60a530b456`; changelog `e62706291ad556c6d9078a2bc50dcf3bca5a6feb`; retained by current #488 `9e1ecdb0b2abd727aae4534b79b648309fad80dd`. +GAP-080 records the both-overflow decision defect. With exact binary64 payloads `estimate=0x7fee446cf80dddbc`, `target=0xffe2d7e397966af3`, `SE=0x73620ad22ddb6f38`, and `k=0x4c85c69ac1c7a9ed`, direct subtraction and multiplication both overflow; predecessor scale normalization rounds residual and bound to the same finite value and falsely accepts although the exact represented-input bound is smaller. Public RED `a9a45714eb6266f6b922086112b313060e77c522` includes that strict rejection and the adjacent accepted multiplier `0x4c85c69ac1c7a9ee`; causal exact significand/exponent comparison repair `425e89638d594fdb2f3586d73f021b60a530b456`; changelog `e62706291ad556c6d9078a2bc50dcf3bca5a6feb`; retained by current #488 `0d630fbdda85173cf71a9a82673c52070345e191`. -GAP-081 records the remaining finite/finite rounded-tie defect. For `estimate=1`, `target=0`, `SE=1-2^-27`, and `k=1+2^-27`, exact represented `k·SE = 1-2^-54` is strictly below residual 1, but binary64 multiplication rounds the bound ties-to-even to `1.0`, so predecessor comparison falsely accepts equality. Public RED `23c3262c824609d79dc14d45bb0acb5a54e99a51`; causal exact-subtraction/FMA-product-residual repair `6a2add488cfa6bb5ac3cc854a107f287b61bbed5`; edge coverage `3656deb2f2abc0a83027618a823497a829d9227e`; changelog `090f5124588cb184fc2ef644d91355f2b2c2082b`; research/current #488 `9e1ecdb0b2abd727aae4534b79b648309fad80dd`. +GAP-081 records the finite multiplication-rounded tie defect. For `estimate=1`, `target=0`, `SE=1-2^-27`, and `k=1+2^-27`, exact represented `k·SE = 1-2^-54` is strictly below residual 1, but binary64 multiplication rounds the bound ties-to-even to `1.0`, so predecessor comparison falsely accepts equality. Public RED `23c3262c824609d79dc14d45bb0acb5a54e99a51`; causal repair `6a2add488cfa6bb5ac3cc854a107f287b61bbed5`; edge coverage `3656deb2f2abc0a83027618a823497a829d9227e`; changelog `090f5124588cb184fc2ef644d91355f2b2c2082b`; inherited by current #488 `0d630fbdda85173cf71a9a82673c52070345e191`. -These repairs advance the source-contract portion of GAP-071/GAP-073/GAP-074/GAP-075/GAP-076/GAP-077/GAP-078/GAP-079/GAP-080/GAP-081 but not delivery: exact-head hosted gates, independent review, protected-main integration, and adoption by durable consumers that require v1 provenance remain outstanding. Bare legacy `ValidationReport` remains a backward-compatible compact projection and is not silently treated as v1 provenance. +GAP-082 records the complementary finite subtraction-rounded tie. Public RED `58cbc03253997865b7c8ec19fb501fc89c22c851` fixes `estimate=1`, `target=-2^-54`, `SE=1`, `k=1`: the exact represented residual is `1+2^-54`, strictly above the exact unit bound, while binary64 subtraction rounds it to `1.0` and the predecessor falsely accepts. Causal repair `68a6fd98b4f661ad5d4c3c35dc8b9074f2c59281` compares the sign-adjusted error-free subtraction low term with the FMA product low term only on nonzero finite rounded ties whose correction projections differ; equal projected low terms retain the rounded decision rather than claiming a global exact comparator. Dedicated changelog `c4f752f30121901bfbf4a96b03fdef0ccd9f4bf3`; research/current #488 `0d630fbdda85173cf71a9a82673c52070345e191`. + +These repairs advance the source-contract portion of GAP-071/GAP-073/GAP-074/GAP-075/GAP-076/GAP-077/GAP-078/GAP-079/GAP-080/GAP-081/GAP-082 but not delivery: exact-head hosted gates, independent review, protected-main integration, and adoption by durable consumers that require v1 provenance remain outstanding. Bare legacy `ValidationReport` remains a backward-compatible compact projection and is not silently treated as v1 provenance. Wilson (1927) remains the primary score-interval reference. AERA/APA/NCME (2014) remains the current published testing-standards edition while revision is underway. IEEE 754-2019 and ISO/IEC 60559:2020 remain the published floating-point authorities used for binary64 representation trace; active IEEE P754 is not treated as a published replacement. @@ -161,43 +163,44 @@ Wilson (1927) remains the primary score-interval reference. AERA/APA/NCME (2014) | GAP-042 | Ratio-first logarithm could nearly double an adjacent-float irregular residual growth rate | `verification-pending` | RED `766ddc7a...` + `ln_1p` repair `16f21d9a...` | | GAP-043 | Duplicate known-truth component identities could silently reweight RMSE recovery evidence | `verification-pending` | RED `698f12f5...` + uniqueness repair `2fae4cb2...` | | GAP-044 | Known-truth RMSE alignment/accumulation depended on row order instead of component identity | `verification-pending` | RED `8ad72ac9...` / `5fb93c40...` + repairs `2dd9537e...` / `025dce7f...`; #310 `c6680450...` | -| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; #488 `9e1ecdb0...` | -| GAP-046 | Bias SE could reject a representable SEM because raw squared deviations/intermediates overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; #488 `9e1ecdb0...` | -| GAP-047 | Generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; #488 `9e1ecdb0...` | -| GAP-048 | Mean signed bias could erase a representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; #488 `9e1ecdb0...` | +| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; #488 `0d630fbdda85173cf71a9a82673c52070345e191` | +| GAP-046 | Bias SE could reject a representable SEM because raw squared deviations/intermediates overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; #488 `0d630fbdda85173cf71a9a82673c52070345e191` | +| GAP-047 | Generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; #488 `0d630fbdda85173cf71a9a82673c52070345e191` | +| GAP-048 | Mean signed bias could erase a representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; #488 `0d630fbdda85173cf71a9a82673c52070345e191` | | GAP-049 | Stable `Between` recovery could be aliased across occasion indices and reweight RMSE | `verification-pending` | RED `0a03041c...` + repair `ec2c1219...`; #310 `c6680450...` | -| GAP-050 | Zero-multiplier SE-aware acceptance could erase a nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; #488 `9e1ecdb0...` | -| GAP-051 | Exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; #488 `9e1ecdb0...` | -| GAP-052 | All-covered Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; #488 `9e1ecdb0...` | -| GAP-053 | Strict-interior Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; #488 `9e1ecdb0...` | -| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; #488 `9e1ecdb0...` | -| GAP-055 | Strict-interior Wilson lower endpoint could accept a nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; #488 `9e1ecdb0...` | -| GAP-056 | Durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; #488 `9e1ecdb0...` | -| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from a generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; #488 `9e1ecdb0...` | -| GAP-058 | Generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; #488 `9e1ecdb0...` | -| GAP-059 | Generic Monte Carlo summary could materially misstate positive SE relative to `SD / sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; #488 `9e1ecdb0...` | -| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; #488 `9e1ecdb0...` | -| GAP-061 | Generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; #488 `9e1ecdb0...` | -| GAP-062 | Finite-tolerance matching could fail while the pair is deterministically outside every finite tolerance | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; #488 `9e1ecdb0...` | -| GAP-063 | Exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; #488 `9e1ecdb0...` | -| GAP-064 | Positive point RMSE could carry SE above the declared squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; #488 `9e1ecdb0...` | -| GAP-065 | Positive Monte Carlo RMSE could carry spread/SE impossible for nonnegative replications | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; #488 `9e1ecdb0...` | -| GAP-066 | RMSE Monte Carlo nearest-rank percentile could exceed total nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; #488 `9e1ecdb0...` | -| GAP-067 | Generic nearest-rank percentile endpoint could be individually incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected over-strong repair `2798e4f9...`; causal repair `c7151b49...`; edge `dbef285b...`; changelog `c38a320c...`; research `2bbcbb24...`; #488 `9e1ecdb0...` | -| GAP-068 | Distinct generic percentile endpoints could each pass individual radius checks while jointly exceeding the sample squared-deviation budget | `verification-pending` | RED `c4a13826...` + causal repair `cb3f80a2...` + changelog `f727450d...`; #488 `9e1ecdb0...` | -| GAP-069 | Two-replication distinct nearest-rank endpoints could exhaust the retained sample while the stored mean or SD remained impossible | `verification-pending` | RED `81bf0d9e...` + causal repair `d48f8fef...` + mean coverage `fb314d8a...` + branch cleanup `440b78d8...` + changelog `45116498...`; #488 `9e1ecdb0...` | -| GAP-070 | Stored Wilson bounds could contain empirical coverage while the lower/upper pair could not arise from one Wilson score interval for that same coverage | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...` + complementary edge `c1cb16a7...`; #488 `9e1ecdb0...` | -| GAP-071 | Durable Wilson evidence lacked denominator and critical-value/sidedness provenance, preventing exact recomputation from a persisted artifact | `active-repair` | valid carrier RED `6f6e06d2...`; shared count/Wilson authority `ca517ed3...`; `WilsonCoverageEvidenceV1` `31e1ab2b...`; sidedness `e9c63926...`/`fdd24a1a...`; envelope RED `07766cb0...` + `ValidationEvidenceV1` repair `a16f22e6...`; docs/current #488 `9e1ecdb0...`; remaining: hosted GREEN/review/main plus durable-consumer adoption | -| GAP-072 | Exact all-covered Wilson evidence could retain a zero lower endpoint even though the canonical non-empty finite-`z²` producer always emits `n/(n+z²) > 0` | `verification-pending` | RED `ce714f07...` + non-force source-restore RCA `18499052...` + repair `72e9d954...` + changelog `e3a2f4a2...`; inherited by #488 `9e1ecdb0...` | -| GAP-073 | Durable Wilson count provenance could round one uncovered observation away above binary64's exact-integer range and expose a pointer-width-dependent count schema | `verification-pending` | RED `29d710a5...` + complement/count repair `29968c80...` + fixed-width carrier repair `91d9a3bb...` + exact ratio RED/repair `63ddfdd6...`/`11323c57...`; #488 `9e1ecdb0...` | -| GAP-074 | Durable Wilson evidence could correctly retain exact `u64` counts yet pre-round `sample_count` before endpoint projection, shifting strict-interior endpoints or erasing all-covered finite-sample uncertainty | `verification-pending` | RED `f89e2467...` + all-covered edge `1a5180b2...` + stale-oracle correction `6254c498...` + causal reciprocal-scale repair `73bbb5cf...` + changelog `f2b5768b...` + research predecessor `7fc78a59...`; current #488 `9e1ecdb0...` | -| GAP-075 | Inexact durable all-covered Wilson evidence could round the complementary miss mass to exact one at extreme finite `z` and erase a representable positive lower endpoint | `verification-pending` | RED `059ce70d...`; transient duplicate-owner implementation `46f91f3f...` excluded; canonical repair `0f478392...`; single-writer cleanup `8e2058f2...`; exact-oracle correction `93d5d208...`; changelog correction `43b6562c...`; research predecessor `b03a719d...`; current #488 `9e1ecdb0...` | -| GAP-076 | Exactly representable all-covered Wilson counts could absorb a small positive `z²` in `n + z²` and falsely emit exact `1.0` although a lower binary64 endpoint is representable | `verification-pending` | RED `e0c4ec81...` + causal boundary repair `c9dcb9df...` + below-resolution edge `6140080d...` + changelog `09ebb482...` + research predecessor `fe89c438...`; current #488 `9e1ecdb0...` | -| GAP-077 | Exactly representable all-covered Wilson counts could form an inexact partial denominator `n + z²` whose rounded sum shifts the represented-input lower endpoint by one ULP even though neither operand is fully absorbed | `verification-pending` | RED `06e55653...` + causal TwoSum/FMA repair `6c084dbe...` + research `25cc1943...` + changelog `5acc894b...` + predecessor changelog correction `f89e36d1...` + correct-direct-rounding control `80a0a0ad...`; current #488 `9e1ecdb0...` | -| GAP-078 | Exact-count all-covered Wilson residual compensation could move a direct quotient by one ULP even when the represented-input rational remains on the same side of the adjacent midpoint | `verification-pending` | RED `d076d344...` + midpoint-selection repair `32314239...` + changelog `a75940c9...` + research predecessor `ef6441f7...`; current #488 `9e1ecdb0...` | -| GAP-079 | SE-aware acceptance could underflow a finite positive `k · SE` tolerance to exact zero by dividing `SE` by a much larger estimate/target scale before multiplication | `verification-pending` | RED `76067efc...` + causal direct-finite comparison repair `4ffdf366...` + changelog `d822c0ba...` + retained by current #488 `9e1ecdb0...` | -| GAP-080 | SE-aware acceptance both-overflow fallback could normalize an exact strict rejection into an equal rounded residual/bound and falsely accept it | `verification-pending` | RED `a9a45714...` + exact significand/exponent repair `425e8963...` + changelog `e6270629...` + retained by current #488 `9e1ecdb0...` | -| GAP-081 | SE-aware acceptance finite/finite path could round an exact strict represented-input rejection into an equal residual/bound and falsely accept it | `verification-pending` | RED `23c3262c...` + exact-subtraction/FMA tie repair `6a2add48...` + edge coverage `3656deb2...` + changelog `090f5124...` + research/current #488 `9e1ecdb0...` | +| GAP-050 | Zero-multiplier SE-aware acceptance could erase a nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; #488 `0d630fbdda85173cf71a9a82673c52070345e191` | +| GAP-051 | Exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; #488 `0d630fbdda85173cf71a9a82673c52070345e191` | +| GAP-052 | All-covered Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; #488 `0d630fbdda85173cf71a9a82673c52070345e191` | +| GAP-053 | Strict-interior Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; #488 `0d630fbdda85173cf71a9a82673c52070345e191` | +| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; #488 `0d630fbdda85173cf71a9a82673c52070345e191` | +| GAP-055 | Strict-interior Wilson lower endpoint could accept a nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; #488 `0d630fbdda85173cf71a9a82673c52070345e191` | +| GAP-056 | Durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; #488 `0d630fbdda85173cf71a9a82673c52070345e191` | +| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from a generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; #488 `0d630fbdda85173cf71a9a82673c52070345e191` | +| GAP-058 | Generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; #488 `0d630fbdda85173cf71a9a82673c52070345e191` | +| GAP-059 | Generic Monte Carlo summary could materially misstate positive SE relative to `SD / sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; #488 `0d630fbdda85173cf71a9a82673c52070345e191` | +| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; #488 `0d630fbdda85173cf71a9a82673c52070345e191` | +| GAP-061 | Generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; #488 `0d630fbdda85173cf71a9a82673c52070345e191` | +| GAP-062 | Finite-tolerance matching could fail while the pair is deterministically outside every finite tolerance | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; #488 `0d630fbdda85173cf71a9a82673c52070345e191` | +| GAP-063 | Exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; #488 `0d630fbdda85173cf71a9a82673c52070345e191` | +| GAP-064 | Positive point RMSE could carry SE above the declared squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; #488 `0d630fbdda85173cf71a9a82673c52070345e191` | +| GAP-065 | Positive Monte Carlo RMSE could carry spread/SE impossible for nonnegative replications | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; #488 `0d630fbdda85173cf71a9a82673c52070345e191` | +| GAP-066 | RMSE Monte Carlo nearest-rank percentile could exceed total nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; #488 `0d630fbdda85173cf71a9a82673c52070345e191` | +| GAP-067 | Generic nearest-rank percentile endpoint could be individually incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected over-strong repair `2798e4f9...`; causal repair `c7151b49...`; edge `dbef285b...`; changelog `c38a320c...`; research `2bbcbb24...`; #488 `0d630fbdda85173cf71a9a82673c52070345e191` | +| GAP-068 | Distinct generic percentile endpoints could each pass individual radius checks while jointly exceeding the sample squared-deviation budget | `verification-pending` | RED `c4a13826...` + causal repair `cb3f80a2...` + changelog `f727450d...`; #488 `0d630fbdda85173cf71a9a82673c52070345e191` | +| GAP-069 | Two-replication distinct nearest-rank endpoints could exhaust the retained sample while the stored mean or SD remained impossible | `verification-pending` | RED `81bf0d9e...` + causal repair `d48f8fef...` + mean coverage `fb314d8a...` + branch cleanup `440b78d8...` + changelog `45116498...`; #488 `0d630fbdda85173cf71a9a82673c52070345e191` | +| GAP-070 | Stored Wilson bounds could contain empirical coverage while the lower/upper pair could not arise from one Wilson score interval for that same coverage | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...` + complementary edge `c1cb16a7...`; #488 `0d630fbdda85173cf71a9a82673c52070345e191` | +| GAP-071 | Durable Wilson evidence lacked denominator and critical-value/sidedness provenance, preventing exact recomputation from a persisted artifact | `active-repair` | valid carrier RED `6f6e06d2...`; shared count/Wilson authority `ca517ed3...`; `WilsonCoverageEvidenceV1` `31e1ab2b...`; sidedness `e9c63926...`/`fdd24a1a...`; envelope RED `07766cb0...` + `ValidationEvidenceV1` repair `a16f22e6...`; docs/current #488 `0d630fbdda85173cf71a9a82673c52070345e191`; remaining: hosted GREEN/review/main plus durable-consumer adoption | +| GAP-072 | Exact all-covered Wilson evidence could retain a zero lower endpoint even though the canonical non-empty finite-`z²` producer always emits `n/(n+z²) > 0` | `verification-pending` | RED `ce714f07...` + non-force source-restore RCA `18499052...` + repair `72e9d954...` + changelog `e3a2f4a2...`; inherited by #488 `0d630fbdda85173cf71a9a82673c52070345e191` | +| GAP-073 | Durable Wilson count provenance could round one uncovered observation away above binary64's exact-integer range and expose a pointer-width-dependent count schema | `verification-pending` | RED `29d710a5...` + complement/count repair `29968c80...` + fixed-width carrier repair `91d9a3bb...` + exact ratio RED/repair `63ddfdd6...`/`11323c57...`; #488 `0d630fbdda85173cf71a9a82673c52070345e191` | +| GAP-074 | Durable Wilson evidence could correctly retain exact `u64` counts yet pre-round `sample_count` before endpoint projection, shifting strict-interior endpoints or erasing all-covered finite-sample uncertainty | `verification-pending` | RED `f89e2467...` + all-covered edge `1a5180b2...` + stale-oracle correction `6254c498...` + causal reciprocal-scale repair `73bbb5cf...` + changelog `f2b5768b...` + research predecessor `7fc78a59...`; current #488 `0d630fbdda85173cf71a9a82673c52070345e191` | +| GAP-075 | Inexact durable all-covered Wilson evidence could round the complementary miss mass to exact one at extreme finite `z` and erase a representable positive lower endpoint | `verification-pending` | RED `059ce70d...`; transient duplicate-owner implementation `46f91f3f...` excluded; canonical repair `0f478392...`; single-writer cleanup `8e2058f2...`; exact-oracle correction `93d5d208...`; changelog correction `43b6562c...`; research predecessor `b03a719d...`; current #488 `0d630fbdda85173cf71a9a82673c52070345e191` | +| GAP-076 | Exactly representable all-covered Wilson counts could absorb a small positive `z²` in `n + z²` and falsely emit exact `1.0` although a lower binary64 endpoint is representable | `verification-pending` | RED `e0c4ec81...` + causal boundary repair `c9dcb9df...` + below-resolution edge `6140080d...` + changelog `09ebb482...` + research predecessor `fe89c438...`; current #488 `0d630fbdda85173cf71a9a82673c52070345e191` | +| GAP-077 | Exactly representable all-covered Wilson counts could form an inexact partial denominator `n + z²` whose rounded sum shifts the represented-input lower endpoint by one ULP even though neither operand is fully absorbed | `verification-pending` | RED `06e55653...` + causal TwoSum/FMA repair `6c084dbe...` + research `25cc1943...` + changelog `5acc894b...` + predecessor changelog correction `f89e36d1...` + correct-direct-rounding control `80a0a0ad...`; current #488 `0d630fbdda85173cf71a9a82673c52070345e191` | +| GAP-078 | Exact-count all-covered Wilson residual compensation could move a direct quotient by one ULP even when the represented-input rational remains on the same side of the adjacent midpoint | `verification-pending` | RED `d076d344...` + midpoint-selection repair `32314239...` + changelog `a75940c9...` + research predecessor `ef6441f7...`; current #488 `0d630fbdda85173cf71a9a82673c52070345e191` | +| GAP-079 | SE-aware acceptance could underflow a finite positive `k · SE` tolerance to exact zero by dividing `SE` by a much larger estimate/target scale before multiplication | `verification-pending` | RED `76067efc...` + causal direct-finite comparison repair `4ffdf366...` + changelog `d822c0ba...` + retained by current #488 `0d630fbdda85173cf71a9a82673c52070345e191` | +| GAP-080 | SE-aware acceptance both-overflow fallback could normalize an exact strict rejection into an equal rounded residual/bound and falsely accept it | `verification-pending` | RED `a9a45714...` + exact significand/exponent repair `425e8963...` + changelog `e6270629...` + retained by current #488 `0d630fbdda85173cf71a9a82673c52070345e191` | +| GAP-081 | SE-aware acceptance finite/finite multiplication could round an exact strict represented-input rejection into an equal residual/bound and falsely accept it | `verification-pending` | RED `23c3262c...` + tie repair `6a2add48...` + edge coverage `3656deb2...` + changelog `090f5124...` + inherited by current #488 `0d630fbdda85173cf71a9a82673c52070345e191` | +| GAP-082 | SE-aware acceptance finite subtraction could round an exact strict represented-input rejection onto an exact finite bound and falsely accept equality | `verification-pending` | RED `58cbc032...` + causal low-term comparison repair `68a6fd98...` + changelog `c4f752f3...` + research/current #488 `0d630fbd...` | ## Release gate From b7ff3000f59c55236de1b012668a7e1edb9feac7 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 4 Sep 2026 23:20:00 +0900 Subject: [PATCH 174/235] docs(gaps): align Validation authority after sign coverage --- docs/product-technical-gap-baseline.md | 88 +++++++++++++------------- 1 file changed, 44 insertions(+), 44 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 88cae2b2f..6a811aa09 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-04T14:10:26Z +**Snapshot:** 2026-09-04T14:17:10Z **Protected-main evidence:** `b18bca1c69ef8d1799fcd3af6bf4412498e007c3` **Workspace version:** `0.2.0` @@ -30,7 +30,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `0d630fbdda85173cf71a9a82673c52070345e191` | true | `main` | Validation Evidence landing vehicle, non-force restacked onto protected #489 by merge commit `a2754592...`. Wilson provenance/count and rounding repairs remain inherited. `accept_within_standard_errors` compares finite represented residual/bound directly; on a nonzero finite rounded tie it compares subtraction and product low-term corrections when those projections differ, and when both direct operations overflow it compares exact binary64 input rationals through integer significand/exponent arithmetic. Hosted exact-head gates and independent review remain required. | +| #488 | `9aa0dc8d20b1e0cee85778bead526f1fd838721f` | true | `main` | Validation Evidence landing vehicle, non-force restacked onto protected #489 by merge commit `a2754592...`. Wilson provenance/count and rounding repairs remain inherited. `accept_within_standard_errors` compares finite represented residual/bound directly; on a nonzero finite rounded tie it compares subtraction and product low-term corrections when those projections differ, and when both direct operations overflow it compares exact binary64 input rationals through integer significand/exponent arithmetic. Hosted exact-head gates and independent review remain required. | | #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 | Validation / Analysis Run fold child. Unique evidence must be inherited by a conflict-resolving survivor; child-head CI does not transfer. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | @@ -83,7 +83,7 @@ The clock contract separates event/valid time, assertion time, document time, sy ### #488 — Validation Evidence -#488 is the generic Validation Evidence landing vehicle at exact head `0d630fbdda85173cf71a9a82673c52070345e191`. It remains distinct from Longitudinal Modeling and does not consume mutable fast-mlsirm source. The branch was non-force merge-restacked onto protected #489 by `a2754592987be9e88941d220565c45e34f621a4e`, preserving its complete ancestry and inheriting the protected workflow-load repair. +#488 is the generic Validation Evidence landing vehicle at exact head `9aa0dc8d20b1e0cee85778bead526f1fd838721f`. It remains distinct from Longitudinal Modeling and does not consume mutable fast-mlsirm source. The branch was non-force merge-restacked onto protected #489 by `a2754592987be9e88941d220565c45e34f621a4e`, preserving its complete ancestry and inheriting the protected workflow-load repair. GAP-070 and GAP-072 remain inherited: stored Wilson endpoints must be one coherent score interval, and exact all-covered evidence cannot use a zero lower endpoint. GAP-071 has advanced from design-only to source implementation. Corrected carrier RED `6f6e06d2...` requires a versioned denominator/critical-value carrier; `ca517ed3...` establishes one private covered-count/Wilson-from-counts authority; `31e1ab2b...` adds `WilsonCoverageEvidenceV1`; `e9c63926...`/`fdd24a1a...` bind standard-normal/two-sided semantics. Envelope RED `07766cb0...` and repair `a16f22e6...` add `ValidationEvidenceV1`, which cross-validates the legacy report projection against the recomputable carrier. @@ -95,13 +95,13 @@ GAP-077 records the ordinary partial-denominator state left after the near-one a GAP-078 records the opposite residual-rounding state. With `n=3`, represented `z=0x1.6a09e667f3bcdp+492`, and represented `z²=0x1.0000000000001p+985`, the rounded denominator fully absorbs `n`, but the exact represented-input rational and the direct rounded-denominator quotient both round to `0x1.7ffffffffffffp-984`. The predecessor additive residual correction forced `0x1.7fffffffffffep-984`, one ULP too low. Public RED `d076d344cb3cd3a768e7a5c2d8d7bd9039c657e9` → midpoint-selection repair `32314239754204158f228ec67a0771abf4d39b45` → changelog `a75940c955633d5eb92f227d79e64acd0ef46ea8` → research predecessor `ef6441f786d64e6dca198d0d6140838c391f0659`. -GAP-079 records SE-aware acceptance scale-first underflow. For `estimate=1.0e308`, `target=next_down(estimate)`, `SE=2.2e-16`, and `k=1.0e308`, the represented residual (`1.99584030953472e292`) is within the represented finite bound (`2.2e292`), but the predecessor formed `SE / scale == 0.0` before multiplication and falsely rejected the recovery. Public RED `76067efce44419c27687b8673cb76092c90fb5a5` includes the admissible case and a nearby rejection at `SE=1.8e-16`; causal repair `4ffdf3665b3bbafd3b0bbf06b599fe71498169ab`; changelog `d822c0ba7fa548c3283e462323c56d8f5705de31`; retained by current #488 `0d630fbdda85173cf71a9a82673c52070345e191`. +GAP-079 records SE-aware acceptance scale-first underflow. For `estimate=1.0e308`, `target=next_down(estimate)`, `SE=2.2e-16`, and `k=1.0e308`, the represented residual (`1.99584030953472e292`) is within the represented finite bound (`2.2e292`), but the predecessor formed `SE / scale == 0.0` before multiplication and falsely rejected the recovery. Public RED `76067efce44419c27687b8673cb76092c90fb5a5` includes the admissible case and a nearby rejection at `SE=1.8e-16`; causal repair `4ffdf3665b3bbafd3b0bbf06b599fe71498169ab`; changelog `d822c0ba7fa548c3283e462323c56d8f5705de31`; retained by current #488 `9aa0dc8d20b1e0cee85778bead526f1fd838721f`. -GAP-080 records the both-overflow decision defect. With exact binary64 payloads `estimate=0x7fee446cf80dddbc`, `target=0xffe2d7e397966af3`, `SE=0x73620ad22ddb6f38`, and `k=0x4c85c69ac1c7a9ed`, direct subtraction and multiplication both overflow; predecessor scale normalization rounds residual and bound to the same finite value and falsely accepts although the exact represented-input bound is smaller. Public RED `a9a45714eb6266f6b922086112b313060e77c522` includes that strict rejection and the adjacent accepted multiplier `0x4c85c69ac1c7a9ee`; causal exact significand/exponent comparison repair `425e89638d594fdb2f3586d73f021b60a530b456`; changelog `e62706291ad556c6d9078a2bc50dcf3bca5a6feb`; retained by current #488 `0d630fbdda85173cf71a9a82673c52070345e191`. +GAP-080 records the both-overflow decision defect. With exact binary64 payloads `estimate=0x7fee446cf80dddbc`, `target=0xffe2d7e397966af3`, `SE=0x73620ad22ddb6f38`, and `k=0x4c85c69ac1c7a9ed`, direct subtraction and multiplication both overflow; predecessor scale normalization rounds residual and bound to the same finite value and falsely accepts although the exact represented-input bound is smaller. Public RED `a9a45714eb6266f6b922086112b313060e77c522` includes that strict rejection and the adjacent accepted multiplier `0x4c85c69ac1c7a9ee`; causal exact significand/exponent comparison repair `425e89638d594fdb2f3586d73f021b60a530b456`; changelog `e62706291ad556c6d9078a2bc50dcf3bca5a6feb`; retained by current #488 `9aa0dc8d20b1e0cee85778bead526f1fd838721f`. -GAP-081 records the finite multiplication-rounded tie defect. For `estimate=1`, `target=0`, `SE=1-2^-27`, and `k=1+2^-27`, exact represented `k·SE = 1-2^-54` is strictly below residual 1, but binary64 multiplication rounds the bound ties-to-even to `1.0`, so predecessor comparison falsely accepts equality. Public RED `23c3262c824609d79dc14d45bb0acb5a54e99a51`; causal repair `6a2add488cfa6bb5ac3cc854a107f287b61bbed5`; edge coverage `3656deb2f2abc0a83027618a823497a829d9227e`; changelog `090f5124588cb184fc2ef644d91355f2b2c2082b`; inherited by current #488 `0d630fbdda85173cf71a9a82673c52070345e191`. +GAP-081 records the finite multiplication-rounded tie defect. For `estimate=1`, `target=0`, `SE=1-2^-27`, and `k=1+2^-27`, exact represented `k·SE = 1-2^-54` is strictly below residual 1, but binary64 multiplication rounds the bound ties-to-even to `1.0`, so predecessor comparison falsely accepts equality. Public RED `23c3262c824609d79dc14d45bb0acb5a54e99a51`; causal repair `6a2add488cfa6bb5ac3cc854a107f287b61bbed5`; edge coverage `3656deb2f2abc0a83027618a823497a829d9227e`; changelog `090f5124588cb184fc2ef644d91355f2b2c2082b`; inherited by current #488 `9aa0dc8d20b1e0cee85778bead526f1fd838721f`. -GAP-082 records the complementary finite subtraction-rounded tie. Public RED `58cbc03253997865b7c8ec19fb501fc89c22c851` fixes `estimate=1`, `target=-2^-54`, `SE=1`, `k=1`: the exact represented residual is `1+2^-54`, strictly above the exact unit bound, while binary64 subtraction rounds it to `1.0` and the predecessor falsely accepts. Causal repair `68a6fd98b4f661ad5d4c3c35dc8b9074f2c59281` compares the sign-adjusted error-free subtraction low term with the FMA product low term only on nonzero finite rounded ties whose correction projections differ; equal projected low terms retain the rounded decision rather than claiming a global exact comparator. Dedicated changelog `c4f752f30121901bfbf4a96b03fdef0ccd9f4bf3`; research/current #488 `0d630fbdda85173cf71a9a82673c52070345e191`. +GAP-082 records the complementary finite subtraction-rounded tie. Public RED `58cbc03253997865b7c8ec19fb501fc89c22c851` fixes `estimate=1`, `target=-2^-54`, `SE=1`, `k=1`: the exact represented residual is `1+2^-54`, strictly above the exact unit bound, while binary64 subtraction rounds it to `1.0` and the predecessor falsely accepts. Causal repair `68a6fd98b4f661ad5d4c3c35dc8b9074f2c59281` compares the sign-adjusted error-free subtraction low term with the FMA product low term only on nonzero finite rounded ties whose correction projections differ; equal projected low terms retain the rounded decision rather than claiming a global exact comparator. Sign-symmetric edge coverage `b2c06512b6d795555269862c1c3d7e4bc67f3f18`; dedicated changelog `c4f752f30121901bfbf4a96b03fdef0ccd9f4bf3`; research/current #488 `9aa0dc8d20b1e0cee85778bead526f1fd838721f`. These repairs advance the source-contract portion of GAP-071/GAP-073/GAP-074/GAP-075/GAP-076/GAP-077/GAP-078/GAP-079/GAP-080/GAP-081/GAP-082 but not delivery: exact-head hosted gates, independent review, protected-main integration, and adoption by durable consumers that require v1 provenance remain outstanding. Bare legacy `ValidationReport` remains a backward-compatible compact projection and is not silently treated as v1 provenance. @@ -163,44 +163,44 @@ Wilson (1927) remains the primary score-interval reference. AERA/APA/NCME (2014) | GAP-042 | Ratio-first logarithm could nearly double an adjacent-float irregular residual growth rate | `verification-pending` | RED `766ddc7a...` + `ln_1p` repair `16f21d9a...` | | GAP-043 | Duplicate known-truth component identities could silently reweight RMSE recovery evidence | `verification-pending` | RED `698f12f5...` + uniqueness repair `2fae4cb2...` | | GAP-044 | Known-truth RMSE alignment/accumulation depended on row order instead of component identity | `verification-pending` | RED `8ad72ac9...` / `5fb93c40...` + repairs `2dd9537e...` / `025dce7f...`; #310 `c6680450...` | -| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; #488 `0d630fbdda85173cf71a9a82673c52070345e191` | -| GAP-046 | Bias SE could reject a representable SEM because raw squared deviations/intermediates overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; #488 `0d630fbdda85173cf71a9a82673c52070345e191` | -| GAP-047 | Generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; #488 `0d630fbdda85173cf71a9a82673c52070345e191` | -| GAP-048 | Mean signed bias could erase a representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; #488 `0d630fbdda85173cf71a9a82673c52070345e191` | +| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; #488 `9aa0dc8d20b1e0cee85778bead526f1fd838721f` | +| GAP-046 | Bias SE could reject a representable SEM because raw squared deviations/intermediates overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; #488 `9aa0dc8d20b1e0cee85778bead526f1fd838721f` | +| GAP-047 | Generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; #488 `9aa0dc8d20b1e0cee85778bead526f1fd838721f` | +| GAP-048 | Mean signed bias could erase a representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; #488 `9aa0dc8d20b1e0cee85778bead526f1fd838721f` | | GAP-049 | Stable `Between` recovery could be aliased across occasion indices and reweight RMSE | `verification-pending` | RED `0a03041c...` + repair `ec2c1219...`; #310 `c6680450...` | -| GAP-050 | Zero-multiplier SE-aware acceptance could erase a nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; #488 `0d630fbdda85173cf71a9a82673c52070345e191` | -| GAP-051 | Exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; #488 `0d630fbdda85173cf71a9a82673c52070345e191` | -| GAP-052 | All-covered Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; #488 `0d630fbdda85173cf71a9a82673c52070345e191` | -| GAP-053 | Strict-interior Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; #488 `0d630fbdda85173cf71a9a82673c52070345e191` | -| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; #488 `0d630fbdda85173cf71a9a82673c52070345e191` | -| GAP-055 | Strict-interior Wilson lower endpoint could accept a nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; #488 `0d630fbdda85173cf71a9a82673c52070345e191` | -| GAP-056 | Durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; #488 `0d630fbdda85173cf71a9a82673c52070345e191` | -| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from a generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; #488 `0d630fbdda85173cf71a9a82673c52070345e191` | -| GAP-058 | Generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; #488 `0d630fbdda85173cf71a9a82673c52070345e191` | -| GAP-059 | Generic Monte Carlo summary could materially misstate positive SE relative to `SD / sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; #488 `0d630fbdda85173cf71a9a82673c52070345e191` | -| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; #488 `0d630fbdda85173cf71a9a82673c52070345e191` | -| GAP-061 | Generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; #488 `0d630fbdda85173cf71a9a82673c52070345e191` | -| GAP-062 | Finite-tolerance matching could fail while the pair is deterministically outside every finite tolerance | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; #488 `0d630fbdda85173cf71a9a82673c52070345e191` | -| GAP-063 | Exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; #488 `0d630fbdda85173cf71a9a82673c52070345e191` | -| GAP-064 | Positive point RMSE could carry SE above the declared squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; #488 `0d630fbdda85173cf71a9a82673c52070345e191` | -| GAP-065 | Positive Monte Carlo RMSE could carry spread/SE impossible for nonnegative replications | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; #488 `0d630fbdda85173cf71a9a82673c52070345e191` | -| GAP-066 | RMSE Monte Carlo nearest-rank percentile could exceed total nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; #488 `0d630fbdda85173cf71a9a82673c52070345e191` | -| GAP-067 | Generic nearest-rank percentile endpoint could be individually incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected over-strong repair `2798e4f9...`; causal repair `c7151b49...`; edge `dbef285b...`; changelog `c38a320c...`; research `2bbcbb24...`; #488 `0d630fbdda85173cf71a9a82673c52070345e191` | -| GAP-068 | Distinct generic percentile endpoints could each pass individual radius checks while jointly exceeding the sample squared-deviation budget | `verification-pending` | RED `c4a13826...` + causal repair `cb3f80a2...` + changelog `f727450d...`; #488 `0d630fbdda85173cf71a9a82673c52070345e191` | -| GAP-069 | Two-replication distinct nearest-rank endpoints could exhaust the retained sample while the stored mean or SD remained impossible | `verification-pending` | RED `81bf0d9e...` + causal repair `d48f8fef...` + mean coverage `fb314d8a...` + branch cleanup `440b78d8...` + changelog `45116498...`; #488 `0d630fbdda85173cf71a9a82673c52070345e191` | -| GAP-070 | Stored Wilson bounds could contain empirical coverage while the lower/upper pair could not arise from one Wilson score interval for that same coverage | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...` + complementary edge `c1cb16a7...`; #488 `0d630fbdda85173cf71a9a82673c52070345e191` | -| GAP-071 | Durable Wilson evidence lacked denominator and critical-value/sidedness provenance, preventing exact recomputation from a persisted artifact | `active-repair` | valid carrier RED `6f6e06d2...`; shared count/Wilson authority `ca517ed3...`; `WilsonCoverageEvidenceV1` `31e1ab2b...`; sidedness `e9c63926...`/`fdd24a1a...`; envelope RED `07766cb0...` + `ValidationEvidenceV1` repair `a16f22e6...`; docs/current #488 `0d630fbdda85173cf71a9a82673c52070345e191`; remaining: hosted GREEN/review/main plus durable-consumer adoption | -| GAP-072 | Exact all-covered Wilson evidence could retain a zero lower endpoint even though the canonical non-empty finite-`z²` producer always emits `n/(n+z²) > 0` | `verification-pending` | RED `ce714f07...` + non-force source-restore RCA `18499052...` + repair `72e9d954...` + changelog `e3a2f4a2...`; inherited by #488 `0d630fbdda85173cf71a9a82673c52070345e191` | -| GAP-073 | Durable Wilson count provenance could round one uncovered observation away above binary64's exact-integer range and expose a pointer-width-dependent count schema | `verification-pending` | RED `29d710a5...` + complement/count repair `29968c80...` + fixed-width carrier repair `91d9a3bb...` + exact ratio RED/repair `63ddfdd6...`/`11323c57...`; #488 `0d630fbdda85173cf71a9a82673c52070345e191` | -| GAP-074 | Durable Wilson evidence could correctly retain exact `u64` counts yet pre-round `sample_count` before endpoint projection, shifting strict-interior endpoints or erasing all-covered finite-sample uncertainty | `verification-pending` | RED `f89e2467...` + all-covered edge `1a5180b2...` + stale-oracle correction `6254c498...` + causal reciprocal-scale repair `73bbb5cf...` + changelog `f2b5768b...` + research predecessor `7fc78a59...`; current #488 `0d630fbdda85173cf71a9a82673c52070345e191` | -| GAP-075 | Inexact durable all-covered Wilson evidence could round the complementary miss mass to exact one at extreme finite `z` and erase a representable positive lower endpoint | `verification-pending` | RED `059ce70d...`; transient duplicate-owner implementation `46f91f3f...` excluded; canonical repair `0f478392...`; single-writer cleanup `8e2058f2...`; exact-oracle correction `93d5d208...`; changelog correction `43b6562c...`; research predecessor `b03a719d...`; current #488 `0d630fbdda85173cf71a9a82673c52070345e191` | -| GAP-076 | Exactly representable all-covered Wilson counts could absorb a small positive `z²` in `n + z²` and falsely emit exact `1.0` although a lower binary64 endpoint is representable | `verification-pending` | RED `e0c4ec81...` + causal boundary repair `c9dcb9df...` + below-resolution edge `6140080d...` + changelog `09ebb482...` + research predecessor `fe89c438...`; current #488 `0d630fbdda85173cf71a9a82673c52070345e191` | -| GAP-077 | Exactly representable all-covered Wilson counts could form an inexact partial denominator `n + z²` whose rounded sum shifts the represented-input lower endpoint by one ULP even though neither operand is fully absorbed | `verification-pending` | RED `06e55653...` + causal TwoSum/FMA repair `6c084dbe...` + research `25cc1943...` + changelog `5acc894b...` + predecessor changelog correction `f89e36d1...` + correct-direct-rounding control `80a0a0ad...`; current #488 `0d630fbdda85173cf71a9a82673c52070345e191` | -| GAP-078 | Exact-count all-covered Wilson residual compensation could move a direct quotient by one ULP even when the represented-input rational remains on the same side of the adjacent midpoint | `verification-pending` | RED `d076d344...` + midpoint-selection repair `32314239...` + changelog `a75940c9...` + research predecessor `ef6441f7...`; current #488 `0d630fbdda85173cf71a9a82673c52070345e191` | -| GAP-079 | SE-aware acceptance could underflow a finite positive `k · SE` tolerance to exact zero by dividing `SE` by a much larger estimate/target scale before multiplication | `verification-pending` | RED `76067efc...` + causal direct-finite comparison repair `4ffdf366...` + changelog `d822c0ba...` + retained by current #488 `0d630fbdda85173cf71a9a82673c52070345e191` | -| GAP-080 | SE-aware acceptance both-overflow fallback could normalize an exact strict rejection into an equal rounded residual/bound and falsely accept it | `verification-pending` | RED `a9a45714...` + exact significand/exponent repair `425e8963...` + changelog `e6270629...` + retained by current #488 `0d630fbdda85173cf71a9a82673c52070345e191` | -| GAP-081 | SE-aware acceptance finite/finite multiplication could round an exact strict represented-input rejection into an equal residual/bound and falsely accept it | `verification-pending` | RED `23c3262c...` + tie repair `6a2add48...` + edge coverage `3656deb2...` + changelog `090f5124...` + inherited by current #488 `0d630fbdda85173cf71a9a82673c52070345e191` | -| GAP-082 | SE-aware acceptance finite subtraction could round an exact strict represented-input rejection onto an exact finite bound and falsely accept equality | `verification-pending` | RED `58cbc032...` + causal low-term comparison repair `68a6fd98...` + changelog `c4f752f3...` + research/current #488 `0d630fbd...` | +| GAP-050 | Zero-multiplier SE-aware acceptance could erase a nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; #488 `9aa0dc8d20b1e0cee85778bead526f1fd838721f` | +| GAP-051 | Exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; #488 `9aa0dc8d20b1e0cee85778bead526f1fd838721f` | +| GAP-052 | All-covered Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; #488 `9aa0dc8d20b1e0cee85778bead526f1fd838721f` | +| GAP-053 | Strict-interior Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; #488 `9aa0dc8d20b1e0cee85778bead526f1fd838721f` | +| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; #488 `9aa0dc8d20b1e0cee85778bead526f1fd838721f` | +| GAP-055 | Strict-interior Wilson lower endpoint could accept a nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; #488 `9aa0dc8d20b1e0cee85778bead526f1fd838721f` | +| GAP-056 | Durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; #488 `9aa0dc8d20b1e0cee85778bead526f1fd838721f` | +| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from a generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; #488 `9aa0dc8d20b1e0cee85778bead526f1fd838721f` | +| GAP-058 | Generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; #488 `9aa0dc8d20b1e0cee85778bead526f1fd838721f` | +| GAP-059 | Generic Monte Carlo summary could materially misstate positive SE relative to `SD / sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; #488 `9aa0dc8d20b1e0cee85778bead526f1fd838721f` | +| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; #488 `9aa0dc8d20b1e0cee85778bead526f1fd838721f` | +| GAP-061 | Generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; #488 `9aa0dc8d20b1e0cee85778bead526f1fd838721f` | +| GAP-062 | Finite-tolerance matching could fail while the pair is deterministically outside every finite tolerance | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; #488 `9aa0dc8d20b1e0cee85778bead526f1fd838721f` | +| GAP-063 | Exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; #488 `9aa0dc8d20b1e0cee85778bead526f1fd838721f` | +| GAP-064 | Positive point RMSE could carry SE above the declared squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; #488 `9aa0dc8d20b1e0cee85778bead526f1fd838721f` | +| GAP-065 | Positive Monte Carlo RMSE could carry spread/SE impossible for nonnegative replications | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; #488 `9aa0dc8d20b1e0cee85778bead526f1fd838721f` | +| GAP-066 | RMSE Monte Carlo nearest-rank percentile could exceed total nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; #488 `9aa0dc8d20b1e0cee85778bead526f1fd838721f` | +| GAP-067 | Generic nearest-rank percentile endpoint could be individually incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected over-strong repair `2798e4f9...`; causal repair `c7151b49...`; edge `dbef285b...`; changelog `c38a320c...`; research `2bbcbb24...`; #488 `9aa0dc8d20b1e0cee85778bead526f1fd838721f` | +| GAP-068 | Distinct generic percentile endpoints could each pass individual radius checks while jointly exceeding the sample squared-deviation budget | `verification-pending` | RED `c4a13826...` + causal repair `cb3f80a2...` + changelog `f727450d...`; #488 `9aa0dc8d20b1e0cee85778bead526f1fd838721f` | +| GAP-069 | Two-replication distinct nearest-rank endpoints could exhaust the retained sample while the stored mean or SD remained impossible | `verification-pending` | RED `81bf0d9e...` + causal repair `d48f8fef...` + mean coverage `fb314d8a...` + branch cleanup `440b78d8...` + changelog `45116498...`; #488 `9aa0dc8d20b1e0cee85778bead526f1fd838721f` | +| GAP-070 | Stored Wilson bounds could contain empirical coverage while the lower/upper pair could not arise from one Wilson score interval for that same coverage | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...` + complementary edge `c1cb16a7...`; #488 `9aa0dc8d20b1e0cee85778bead526f1fd838721f` | +| GAP-071 | Durable Wilson evidence lacked denominator and critical-value/sidedness provenance, preventing exact recomputation from a persisted artifact | `active-repair` | valid carrier RED `6f6e06d2...`; shared count/Wilson authority `ca517ed3...`; `WilsonCoverageEvidenceV1` `31e1ab2b...`; sidedness `e9c63926...`/`fdd24a1a...`; envelope RED `07766cb0...` + `ValidationEvidenceV1` repair `a16f22e6...`; docs/current #488 `9aa0dc8d20b1e0cee85778bead526f1fd838721f`; remaining: hosted GREEN/review/main plus durable-consumer adoption | +| GAP-072 | Exact all-covered Wilson evidence could retain a zero lower endpoint even though the canonical non-empty finite-`z²` producer always emits `n/(n+z²) > 0` | `verification-pending` | RED `ce714f07...` + non-force source-restore RCA `18499052...` + repair `72e9d954...` + changelog `e3a2f4a2...`; inherited by #488 `9aa0dc8d20b1e0cee85778bead526f1fd838721f` | +| GAP-073 | Durable Wilson count provenance could round one uncovered observation away above binary64's exact-integer range and expose a pointer-width-dependent count schema | `verification-pending` | RED `29d710a5...` + complement/count repair `29968c80...` + fixed-width carrier repair `91d9a3bb...` + exact ratio RED/repair `63ddfdd6...`/`11323c57...`; #488 `9aa0dc8d20b1e0cee85778bead526f1fd838721f` | +| GAP-074 | Durable Wilson evidence could correctly retain exact `u64` counts yet pre-round `sample_count` before endpoint projection, shifting strict-interior endpoints or erasing all-covered finite-sample uncertainty | `verification-pending` | RED `f89e2467...` + all-covered edge `1a5180b2...` + stale-oracle correction `6254c498...` + causal reciprocal-scale repair `73bbb5cf...` + changelog `f2b5768b...` + research predecessor `7fc78a59...`; current #488 `9aa0dc8d20b1e0cee85778bead526f1fd838721f` | +| GAP-075 | Inexact durable all-covered Wilson evidence could round the complementary miss mass to exact one at extreme finite `z` and erase a representable positive lower endpoint | `verification-pending` | RED `059ce70d...`; transient duplicate-owner implementation `46f91f3f...` excluded; canonical repair `0f478392...`; single-writer cleanup `8e2058f2...`; exact-oracle correction `93d5d208...`; changelog correction `43b6562c...`; research predecessor `b03a719d...`; current #488 `9aa0dc8d20b1e0cee85778bead526f1fd838721f` | +| GAP-076 | Exactly representable all-covered Wilson counts could absorb a small positive `z²` in `n + z²` and falsely emit exact `1.0` although a lower binary64 endpoint is representable | `verification-pending` | RED `e0c4ec81...` + causal boundary repair `c9dcb9df...` + below-resolution edge `6140080d...` + changelog `09ebb482...` + research predecessor `fe89c438...`; current #488 `9aa0dc8d20b1e0cee85778bead526f1fd838721f` | +| GAP-077 | Exactly representable all-covered Wilson counts could form an inexact partial denominator `n + z²` whose rounded sum shifts the represented-input lower endpoint by one ULP even though neither operand is fully absorbed | `verification-pending` | RED `06e55653...` + causal TwoSum/FMA repair `6c084dbe...` + research `25cc1943...` + changelog `5acc894b...` + predecessor changelog correction `f89e36d1...` + correct-direct-rounding control `80a0a0ad...`; current #488 `9aa0dc8d20b1e0cee85778bead526f1fd838721f` | +| GAP-078 | Exact-count all-covered Wilson residual compensation could move a direct quotient by one ULP even when the represented-input rational remains on the same side of the adjacent midpoint | `verification-pending` | RED `d076d344...` + midpoint-selection repair `32314239...` + changelog `a75940c9...` + research predecessor `ef6441f7...`; current #488 `9aa0dc8d20b1e0cee85778bead526f1fd838721f` | +| GAP-079 | SE-aware acceptance could underflow a finite positive `k · SE` tolerance to exact zero by dividing `SE` by a much larger estimate/target scale before multiplication | `verification-pending` | RED `76067efc...` + causal direct-finite comparison repair `4ffdf366...` + changelog `d822c0ba...` + retained by current #488 `9aa0dc8d20b1e0cee85778bead526f1fd838721f` | +| GAP-080 | SE-aware acceptance both-overflow fallback could normalize an exact strict rejection into an equal rounded residual/bound and falsely accept it | `verification-pending` | RED `a9a45714...` + exact significand/exponent repair `425e8963...` + changelog `e6270629...` + retained by current #488 `9aa0dc8d20b1e0cee85778bead526f1fd838721f` | +| GAP-081 | SE-aware acceptance finite/finite multiplication could round an exact strict represented-input rejection into an equal residual/bound and falsely accept it | `verification-pending` | RED `23c3262c...` + tie repair `6a2add48...` + edge coverage `3656deb2...` + changelog `090f5124...` + inherited by current #488 `9aa0dc8d20b1e0cee85778bead526f1fd838721f` | +| GAP-082 | SE-aware acceptance finite subtraction could round an exact strict represented-input rejection onto an exact finite bound and falsely accept equality | `verification-pending` | RED `58cbc032...` + causal low-term comparison repair `68a6fd98...` + sign-symmetric edge `b2c06512...` + changelog `c4f752f3...` + research/current #488 `9aa0dc8d...` | ## Release gate From 649c5e5f4eb2b70174d6110eeda9a24b9a971aae Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 4 Sep 2026 23:31:25 +0900 Subject: [PATCH 175/235] docs(gaps): add subnormal SE product boundary --- docs/product-technical-gap-baseline.md | 95 +++++++++++++------------- 1 file changed, 49 insertions(+), 46 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 6a811aa09..c74f0adab 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-04T14:17:10Z +**Snapshot:** 2026-09-04T14:30:00Z **Protected-main evidence:** `b18bca1c69ef8d1799fcd3af6bf4412498e007c3` **Workspace version:** `0.2.0` @@ -30,7 +30,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `9aa0dc8d20b1e0cee85778bead526f1fd838721f` | true | `main` | Validation Evidence landing vehicle, non-force restacked onto protected #489 by merge commit `a2754592...`. Wilson provenance/count and rounding repairs remain inherited. `accept_within_standard_errors` compares finite represented residual/bound directly; on a nonzero finite rounded tie it compares subtraction and product low-term corrections when those projections differ, and when both direct operations overflow it compares exact binary64 input rationals through integer significand/exponent arithmetic. Hosted exact-head gates and independent review remain required. | +| #488 | `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e` | true | `main` | Validation Evidence landing vehicle, non-force restacked onto protected #489 by merge commit `a2754592...`. Wilson provenance/count and rounding repairs remain inherited. `accept_within_standard_errors` compares finite represented residual/bound directly; finite rounded ties use subtraction/product low terms, with an exact dyadic product fallback at the subnormal correction-resolution boundary; both-overflow uses integer significand/exponent comparison. Hosted exact-head gates and independent review remain required. | | #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 | Validation / Analysis Run fold child. Unique evidence must be inherited by a conflict-resolving survivor; child-head CI does not transfer. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | @@ -66,7 +66,7 @@ The clock contract separates event/valid time, assertion time, document time, sy - Generic Validation Evidence RMSE and its delta-method SE normalize before squaring. Exact-zero point RMSE requires exact-zero point RMSE SE. For positive RMSE, the declared producer satisfies `SE(RMSE) <= RMSE / 2`, with a small relative binary64 admission tolerance. - Generic `MonteCarloSummary` is sign-neutral. Zero SD requires zero SE and percentile endpoints equal to the represented mean. Positive SD requires positive SE coherent with represented `SD / sqrt(n)` within a small relative tolerance. Every inclusive nearest-rank endpoint is a retained observation and satisfies `|endpoint - mean| <= SD * sqrt(n - 1)`. Distinct lower/upper endpoint values share the same `(n - 1) * SD²` deviation budget. When `replication_count = 2` and endpoints are numerically distinct, those values exhaust the retained sample and the recorded represented mean/sample SD must match deterministic two-value reconstruction. Equal numeric endpoints do not prove two distinct ranks and are not subjected to that exhaustion rule. - When the generic carrier occupies `ValidationReport::monte_carlo_rmse`, retained replications are nonnegative; positive mean implies `SE(mean) <= mean`, and inclusive nearest-rank endpoints cannot exceed nonnegative sample-sum support `n * mean`. These typed bounds are not imposed on signed metrics such as bias. -- SE-aware acceptance is `|estimate - target| <= k * SE`. For `k = 0` or exact-zero SE, exact recovery is evaluated before any scale reduction; `-0.0` and `+0.0` are one numeric zero-valued scientific state. Finite represented residuals and finite represented `k · SE` bounds are compared directly. When a nonzero finite rounded residual/bound tie occurs, TEPP compares the error-free subtraction low term—sign-adjusted for the absolute residual—with the FMA product low term; when the projected corrections differ, their order preserves the represented-input inequality, while equal projected corrections remain on the ordinary rounded decision rather than claiming a global exact comparator. If both direct operations overflow, exact rational magnitudes represented by the binary64 inputs are compared from integer significands and powers of two; independently rounded normalization is not decision evidence. +- SE-aware acceptance is `|estimate - target| <= k * SE`. For `k = 0` or exact-zero SE, exact recovery is evaluated before any scale reduction; `-0.0` and `+0.0` are one numeric zero-valued scientific state. Finite represented residuals and finite represented `k · SE` bounds are compared directly. On a nonzero finite rounded tie, TEPP compares the error-free subtraction low term—sign-adjusted for the absolute residual—with the FMA product low term when those corrections differ. If both correction projections are zero and the rounded bound is subnormal, an exact subtraction residual is compared against the exact dyadic represented `k · SE` product so subnormal FMA-error underflow cannot turn a strict rejection into equality. Other equal correction projections retain the ordinary rounded decision rather than claiming a global exact comparator. If both direct operations overflow, exact rational magnitudes represented by the binary64 inputs are compared from integer significands and powers of two; independently rounded normalization is not decision evidence. - `match_count` is a finite-threshold decision and does not require materializing an unrepresentable absolute residual; `absolute_residuals` remains fail closed when the magnitude itself is requested. - Wilson interval coverage preserves represented-input endpoints through stable rationalized/complementary/compensated forms. Legacy `ValidationReport` endpoint pairs satisfy necessary Wilson coherence and boundary checks, but exact provenance is not inferred from them. `WilsonCoverageEvidenceV1` retains fixed-width `u64` `sample_count`/`covered_count`, `critical_value_kind=standard_normal_z`, `interval_sidedness=two_sided`, numeric `z`, represented coverage, and canonical endpoints and validates them by exact recomputation through the single crate-private Wilson authority. Exact all-covered status is integer count equality, not rounded `p == 1`. Count proportions are correctly rounded from exact integers. When covered counts dominate, the smaller uncovered complement is evaluated and reflected. When retained `sample_count` itself is not exactly representable in binary64, Wilson scale terms use correctly rounded reciprocal `1/n`; its all-covered path uses complementary miss mass for `z²/n <= 1` and direct reciprocal evaluation for `z²/n > 1`. For an exactly representable all-covered count, a false exact-one quotient retains the boundary-local complementary repair. Otherwise, if `n + z²` is inexact, the canonical writer recovers the TwoSum denominator residual and FMA quotient residual, identifies the adjacent binary64 candidate from residual direction, and changes the direct quotient only when the exact represented-input rational lies beyond that candidate's midpoint; exact midpoint selection is ties-to-even. This avoids both under-correction and residual double-rounding overcorrection without claiming globally correctly rounded Wilson rearrangements. Smaller miss mass genuinely below binary64 resolution remains exact one. `ValidationEvidenceV1` binds provenance to the legacy report projection without breaking existing report callers. - Durable and human-facing Validation Evidence must preserve producing-metric invariants on explicit validation, serde ingress/egress, and human projection. Missing v1 provenance is never synthesized from endpoint algebra. @@ -83,7 +83,7 @@ The clock contract separates event/valid time, assertion time, document time, sy ### #488 — Validation Evidence -#488 is the generic Validation Evidence landing vehicle at exact head `9aa0dc8d20b1e0cee85778bead526f1fd838721f`. It remains distinct from Longitudinal Modeling and does not consume mutable fast-mlsirm source. The branch was non-force merge-restacked onto protected #489 by `a2754592987be9e88941d220565c45e34f621a4e`, preserving its complete ancestry and inheriting the protected workflow-load repair. +#488 is the generic Validation Evidence landing vehicle at exact head `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e`. It remains distinct from Longitudinal Modeling and does not consume mutable fast-mlsirm source. The branch was non-force merge-restacked onto protected #489 by `a2754592987be9e88941d220565c45e34f621a4e`, preserving its complete ancestry and inheriting the protected workflow-load repair. GAP-070 and GAP-072 remain inherited: stored Wilson endpoints must be one coherent score interval, and exact all-covered evidence cannot use a zero lower endpoint. GAP-071 has advanced from design-only to source implementation. Corrected carrier RED `6f6e06d2...` requires a versioned denominator/critical-value carrier; `ca517ed3...` establishes one private covered-count/Wilson-from-counts authority; `31e1ab2b...` adds `WilsonCoverageEvidenceV1`; `e9c63926...`/`fdd24a1a...` bind standard-normal/two-sided semantics. Envelope RED `07766cb0...` and repair `a16f22e6...` add `ValidationEvidenceV1`, which cross-validates the legacy report projection against the recomputable carrier. @@ -95,15 +95,17 @@ GAP-077 records the ordinary partial-denominator state left after the near-one a GAP-078 records the opposite residual-rounding state. With `n=3`, represented `z=0x1.6a09e667f3bcdp+492`, and represented `z²=0x1.0000000000001p+985`, the rounded denominator fully absorbs `n`, but the exact represented-input rational and the direct rounded-denominator quotient both round to `0x1.7ffffffffffffp-984`. The predecessor additive residual correction forced `0x1.7fffffffffffep-984`, one ULP too low. Public RED `d076d344cb3cd3a768e7a5c2d8d7bd9039c657e9` → midpoint-selection repair `32314239754204158f228ec67a0771abf4d39b45` → changelog `a75940c955633d5eb92f227d79e64acd0ef46ea8` → research predecessor `ef6441f786d64e6dca198d0d6140838c391f0659`. -GAP-079 records SE-aware acceptance scale-first underflow. For `estimate=1.0e308`, `target=next_down(estimate)`, `SE=2.2e-16`, and `k=1.0e308`, the represented residual (`1.99584030953472e292`) is within the represented finite bound (`2.2e292`), but the predecessor formed `SE / scale == 0.0` before multiplication and falsely rejected the recovery. Public RED `76067efce44419c27687b8673cb76092c90fb5a5` includes the admissible case and a nearby rejection at `SE=1.8e-16`; causal repair `4ffdf3665b3bbafd3b0bbf06b599fe71498169ab`; changelog `d822c0ba7fa548c3283e462323c56d8f5705de31`; retained by current #488 `9aa0dc8d20b1e0cee85778bead526f1fd838721f`. +GAP-079 records SE-aware acceptance scale-first underflow. For `estimate=1.0e308`, `target=next_down(estimate)`, `SE=2.2e-16`, and `k=1.0e308`, the represented residual (`1.99584030953472e292`) is within the represented finite bound (`2.2e292`), but the predecessor formed `SE / scale == 0.0` before multiplication and falsely rejected the recovery. Public RED `76067efce44419c27687b8673cb76092c90fb5a5` includes the admissible case and a nearby rejection at `SE=1.8e-16`; causal repair `4ffdf3665b3bbafd3b0bbf06b599fe71498169ab`; changelog `d822c0ba7fa548c3283e462323c56d8f5705de31`; retained by current #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e`. -GAP-080 records the both-overflow decision defect. With exact binary64 payloads `estimate=0x7fee446cf80dddbc`, `target=0xffe2d7e397966af3`, `SE=0x73620ad22ddb6f38`, and `k=0x4c85c69ac1c7a9ed`, direct subtraction and multiplication both overflow; predecessor scale normalization rounds residual and bound to the same finite value and falsely accepts although the exact represented-input bound is smaller. Public RED `a9a45714eb6266f6b922086112b313060e77c522` includes that strict rejection and the adjacent accepted multiplier `0x4c85c69ac1c7a9ee`; causal exact significand/exponent comparison repair `425e89638d594fdb2f3586d73f021b60a530b456`; changelog `e62706291ad556c6d9078a2bc50dcf3bca5a6feb`; retained by current #488 `9aa0dc8d20b1e0cee85778bead526f1fd838721f`. +GAP-080 records the both-overflow decision defect. With exact binary64 payloads `estimate=0x7fee446cf80dddbc`, `target=0xffe2d7e397966af3`, `SE=0x73620ad22ddb6f38`, and `k=0x4c85c69ac1c7a9ed`, direct subtraction and multiplication both overflow; predecessor scale normalization rounds residual and bound to the same finite value and falsely accepts although the exact represented-input bound is smaller. Public RED `a9a45714eb6266f6b922086112b313060e77c522` includes that strict rejection and the adjacent accepted multiplier `0x4c85c69ac1c7a9ee`; causal exact significand/exponent comparison repair `425e89638d594fdb2f3586d73f021b60a530b456`; changelog `e62706291ad556c6d9078a2bc50dcf3bca5a6feb`; retained by current #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e`. -GAP-081 records the finite multiplication-rounded tie defect. For `estimate=1`, `target=0`, `SE=1-2^-27`, and `k=1+2^-27`, exact represented `k·SE = 1-2^-54` is strictly below residual 1, but binary64 multiplication rounds the bound ties-to-even to `1.0`, so predecessor comparison falsely accepts equality. Public RED `23c3262c824609d79dc14d45bb0acb5a54e99a51`; causal repair `6a2add488cfa6bb5ac3cc854a107f287b61bbed5`; edge coverage `3656deb2f2abc0a83027618a823497a829d9227e`; changelog `090f5124588cb184fc2ef644d91355f2b2c2082b`; inherited by current #488 `9aa0dc8d20b1e0cee85778bead526f1fd838721f`. +GAP-081 records the finite multiplication-rounded tie defect. For `estimate=1`, `target=0`, `SE=1-2^-27`, and `k=1+2^-27`, exact represented `k·SE = 1-2^-54` is strictly below residual 1, but binary64 multiplication rounds the bound ties-to-even to `1.0`, so predecessor comparison falsely accepts equality. Public RED `23c3262c824609d79dc14d45bb0acb5a54e99a51`; causal repair `6a2add488cfa6bb5ac3cc854a107f287b61bbed5`; edge coverage `3656deb2f2abc0a83027618a823497a829d9227e`; changelog `090f5124588cb184fc2ef644d91355f2b2c2082b`; inherited by current #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e`. -GAP-082 records the complementary finite subtraction-rounded tie. Public RED `58cbc03253997865b7c8ec19fb501fc89c22c851` fixes `estimate=1`, `target=-2^-54`, `SE=1`, `k=1`: the exact represented residual is `1+2^-54`, strictly above the exact unit bound, while binary64 subtraction rounds it to `1.0` and the predecessor falsely accepts. Causal repair `68a6fd98b4f661ad5d4c3c35dc8b9074f2c59281` compares the sign-adjusted error-free subtraction low term with the FMA product low term only on nonzero finite rounded ties whose correction projections differ; equal projected low terms retain the rounded decision rather than claiming a global exact comparator. Sign-symmetric edge coverage `b2c06512b6d795555269862c1c3d7e4bc67f3f18`; dedicated changelog `c4f752f30121901bfbf4a96b03fdef0ccd9f4bf3`; research/current #488 `9aa0dc8d20b1e0cee85778bead526f1fd838721f`. +GAP-082 records the complementary finite subtraction-rounded tie. Public RED `58cbc03253997865b7c8ec19fb501fc89c22c851` fixes `estimate=1`, `target=-2^-54`, `SE=1`, `k=1`: the exact represented residual is `1+2^-54`, strictly above the exact unit bound, while binary64 subtraction rounds it to `1.0` and the predecessor falsely accepts. Causal repair `68a6fd98b4f661ad5d4c3c35dc8b9074f2c59281` compares the sign-adjusted error-free subtraction low term with the FMA product low term only on nonzero finite rounded ties whose correction projections differ; equal projected low terms retain the rounded decision rather than claiming a global exact comparator. Sign-symmetric edge coverage `b2c06512b6d795555269862c1c3d7e4bc67f3f18`; dedicated changelog `c4f752f30121901bfbf4a96b03fdef0ccd9f4bf3`. -These repairs advance the source-contract portion of GAP-071/GAP-073/GAP-074/GAP-075/GAP-076/GAP-077/GAP-078/GAP-079/GAP-080/GAP-081/GAP-082 but not delivery: exact-head hosted gates, independent review, protected-main integration, and adoption by durable consumers that require v1 provenance remain outstanding. Bare legacy `ValidationReport` remains a backward-compatible compact projection and is not silently treated as v1 provenance. +GAP-083 records the subnormal product-correction resolution boundary. Public RED `b55c5473c8ee7a70ec2508d14d0755c2aeb38191` uses exact residual `minimum_subnormal`, `k=0x1.8p-538`, and `SE=0x1p-537`; exact represented `k·SE` is `3/4` minimum subnormal, but multiplication rounds up to the minimum subnormal while the `-1/4`-subnormal FMA correction rounds to signed zero. Causal repair `210cebc4980c861ddfd6d098bf1c9d66c8449e72` compares the exact represented residual with the exact dyadic product only when finite rounded tie, zero correction projections, and subnormal rounded bound coincide; exact minimum-subnormal equality is retained as an acceptance control. Dedicated changelog `338c270c65c10d305432029c455b9ac37c28c0f1`; research/current #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e`. + +These repairs advance the source-contract portion of GAP-071/GAP-073–GAP-083 but not delivery: exact-head hosted gates, independent review, protected-main integration, and adoption by durable consumers that require v1 provenance remain outstanding. Bare legacy `ValidationReport` remains a backward-compatible compact projection and is not silently treated as v1 provenance. Wilson (1927) remains the primary score-interval reference. AERA/APA/NCME (2014) remains the current published testing-standards edition while revision is underway. IEEE 754-2019 and ISO/IEC 60559:2020 remain the published floating-point authorities used for binary64 representation trace; active IEEE P754 is not treated as a published replacement. @@ -163,44 +165,45 @@ Wilson (1927) remains the primary score-interval reference. AERA/APA/NCME (2014) | GAP-042 | Ratio-first logarithm could nearly double an adjacent-float irregular residual growth rate | `verification-pending` | RED `766ddc7a...` + `ln_1p` repair `16f21d9a...` | | GAP-043 | Duplicate known-truth component identities could silently reweight RMSE recovery evidence | `verification-pending` | RED `698f12f5...` + uniqueness repair `2fae4cb2...` | | GAP-044 | Known-truth RMSE alignment/accumulation depended on row order instead of component identity | `verification-pending` | RED `8ad72ac9...` / `5fb93c40...` + repairs `2dd9537e...` / `025dce7f...`; #310 `c6680450...` | -| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; #488 `9aa0dc8d20b1e0cee85778bead526f1fd838721f` | -| GAP-046 | Bias SE could reject a representable SEM because raw squared deviations/intermediates overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; #488 `9aa0dc8d20b1e0cee85778bead526f1fd838721f` | -| GAP-047 | Generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; #488 `9aa0dc8d20b1e0cee85778bead526f1fd838721f` | -| GAP-048 | Mean signed bias could erase a representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; #488 `9aa0dc8d20b1e0cee85778bead526f1fd838721f` | +| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e` | +| GAP-046 | Bias SE could reject a representable SEM because raw squared deviations/intermediates overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e` | +| GAP-047 | Generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e` | +| GAP-048 | Mean signed bias could erase a representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e` | | GAP-049 | Stable `Between` recovery could be aliased across occasion indices and reweight RMSE | `verification-pending` | RED `0a03041c...` + repair `ec2c1219...`; #310 `c6680450...` | -| GAP-050 | Zero-multiplier SE-aware acceptance could erase a nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; #488 `9aa0dc8d20b1e0cee85778bead526f1fd838721f` | -| GAP-051 | Exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; #488 `9aa0dc8d20b1e0cee85778bead526f1fd838721f` | -| GAP-052 | All-covered Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; #488 `9aa0dc8d20b1e0cee85778bead526f1fd838721f` | -| GAP-053 | Strict-interior Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; #488 `9aa0dc8d20b1e0cee85778bead526f1fd838721f` | -| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; #488 `9aa0dc8d20b1e0cee85778bead526f1fd838721f` | -| GAP-055 | Strict-interior Wilson lower endpoint could accept a nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; #488 `9aa0dc8d20b1e0cee85778bead526f1fd838721f` | -| GAP-056 | Durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; #488 `9aa0dc8d20b1e0cee85778bead526f1fd838721f` | -| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from a generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; #488 `9aa0dc8d20b1e0cee85778bead526f1fd838721f` | -| GAP-058 | Generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; #488 `9aa0dc8d20b1e0cee85778bead526f1fd838721f` | -| GAP-059 | Generic Monte Carlo summary could materially misstate positive SE relative to `SD / sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; #488 `9aa0dc8d20b1e0cee85778bead526f1fd838721f` | -| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; #488 `9aa0dc8d20b1e0cee85778bead526f1fd838721f` | -| GAP-061 | Generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; #488 `9aa0dc8d20b1e0cee85778bead526f1fd838721f` | -| GAP-062 | Finite-tolerance matching could fail while the pair is deterministically outside every finite tolerance | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; #488 `9aa0dc8d20b1e0cee85778bead526f1fd838721f` | -| GAP-063 | Exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; #488 `9aa0dc8d20b1e0cee85778bead526f1fd838721f` | -| GAP-064 | Positive point RMSE could carry SE above the declared squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; #488 `9aa0dc8d20b1e0cee85778bead526f1fd838721f` | -| GAP-065 | Positive Monte Carlo RMSE could carry spread/SE impossible for nonnegative replications | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; #488 `9aa0dc8d20b1e0cee85778bead526f1fd838721f` | -| GAP-066 | RMSE Monte Carlo nearest-rank percentile could exceed total nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; #488 `9aa0dc8d20b1e0cee85778bead526f1fd838721f` | -| GAP-067 | Generic nearest-rank percentile endpoint could be individually incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected over-strong repair `2798e4f9...`; causal repair `c7151b49...`; edge `dbef285b...`; changelog `c38a320c...`; research `2bbcbb24...`; #488 `9aa0dc8d20b1e0cee85778bead526f1fd838721f` | -| GAP-068 | Distinct generic percentile endpoints could each pass individual radius checks while jointly exceeding the sample squared-deviation budget | `verification-pending` | RED `c4a13826...` + causal repair `cb3f80a2...` + changelog `f727450d...`; #488 `9aa0dc8d20b1e0cee85778bead526f1fd838721f` | -| GAP-069 | Two-replication distinct nearest-rank endpoints could exhaust the retained sample while the stored mean or SD remained impossible | `verification-pending` | RED `81bf0d9e...` + causal repair `d48f8fef...` + mean coverage `fb314d8a...` + branch cleanup `440b78d8...` + changelog `45116498...`; #488 `9aa0dc8d20b1e0cee85778bead526f1fd838721f` | -| GAP-070 | Stored Wilson bounds could contain empirical coverage while the lower/upper pair could not arise from one Wilson score interval for that same coverage | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...` + complementary edge `c1cb16a7...`; #488 `9aa0dc8d20b1e0cee85778bead526f1fd838721f` | -| GAP-071 | Durable Wilson evidence lacked denominator and critical-value/sidedness provenance, preventing exact recomputation from a persisted artifact | `active-repair` | valid carrier RED `6f6e06d2...`; shared count/Wilson authority `ca517ed3...`; `WilsonCoverageEvidenceV1` `31e1ab2b...`; sidedness `e9c63926...`/`fdd24a1a...`; envelope RED `07766cb0...` + `ValidationEvidenceV1` repair `a16f22e6...`; docs/current #488 `9aa0dc8d20b1e0cee85778bead526f1fd838721f`; remaining: hosted GREEN/review/main plus durable-consumer adoption | -| GAP-072 | Exact all-covered Wilson evidence could retain a zero lower endpoint even though the canonical non-empty finite-`z²` producer always emits `n/(n+z²) > 0` | `verification-pending` | RED `ce714f07...` + non-force source-restore RCA `18499052...` + repair `72e9d954...` + changelog `e3a2f4a2...`; inherited by #488 `9aa0dc8d20b1e0cee85778bead526f1fd838721f` | -| GAP-073 | Durable Wilson count provenance could round one uncovered observation away above binary64's exact-integer range and expose a pointer-width-dependent count schema | `verification-pending` | RED `29d710a5...` + complement/count repair `29968c80...` + fixed-width carrier repair `91d9a3bb...` + exact ratio RED/repair `63ddfdd6...`/`11323c57...`; #488 `9aa0dc8d20b1e0cee85778bead526f1fd838721f` | -| GAP-074 | Durable Wilson evidence could correctly retain exact `u64` counts yet pre-round `sample_count` before endpoint projection, shifting strict-interior endpoints or erasing all-covered finite-sample uncertainty | `verification-pending` | RED `f89e2467...` + all-covered edge `1a5180b2...` + stale-oracle correction `6254c498...` + causal reciprocal-scale repair `73bbb5cf...` + changelog `f2b5768b...` + research predecessor `7fc78a59...`; current #488 `9aa0dc8d20b1e0cee85778bead526f1fd838721f` | -| GAP-075 | Inexact durable all-covered Wilson evidence could round the complementary miss mass to exact one at extreme finite `z` and erase a representable positive lower endpoint | `verification-pending` | RED `059ce70d...`; transient duplicate-owner implementation `46f91f3f...` excluded; canonical repair `0f478392...`; single-writer cleanup `8e2058f2...`; exact-oracle correction `93d5d208...`; changelog correction `43b6562c...`; research predecessor `b03a719d...`; current #488 `9aa0dc8d20b1e0cee85778bead526f1fd838721f` | -| GAP-076 | Exactly representable all-covered Wilson counts could absorb a small positive `z²` in `n + z²` and falsely emit exact `1.0` although a lower binary64 endpoint is representable | `verification-pending` | RED `e0c4ec81...` + causal boundary repair `c9dcb9df...` + below-resolution edge `6140080d...` + changelog `09ebb482...` + research predecessor `fe89c438...`; current #488 `9aa0dc8d20b1e0cee85778bead526f1fd838721f` | -| GAP-077 | Exactly representable all-covered Wilson counts could form an inexact partial denominator `n + z²` whose rounded sum shifts the represented-input lower endpoint by one ULP even though neither operand is fully absorbed | `verification-pending` | RED `06e55653...` + causal TwoSum/FMA repair `6c084dbe...` + research `25cc1943...` + changelog `5acc894b...` + predecessor changelog correction `f89e36d1...` + correct-direct-rounding control `80a0a0ad...`; current #488 `9aa0dc8d20b1e0cee85778bead526f1fd838721f` | -| GAP-078 | Exact-count all-covered Wilson residual compensation could move a direct quotient by one ULP even when the represented-input rational remains on the same side of the adjacent midpoint | `verification-pending` | RED `d076d344...` + midpoint-selection repair `32314239...` + changelog `a75940c9...` + research predecessor `ef6441f7...`; current #488 `9aa0dc8d20b1e0cee85778bead526f1fd838721f` | -| GAP-079 | SE-aware acceptance could underflow a finite positive `k · SE` tolerance to exact zero by dividing `SE` by a much larger estimate/target scale before multiplication | `verification-pending` | RED `76067efc...` + causal direct-finite comparison repair `4ffdf366...` + changelog `d822c0ba...` + retained by current #488 `9aa0dc8d20b1e0cee85778bead526f1fd838721f` | -| GAP-080 | SE-aware acceptance both-overflow fallback could normalize an exact strict rejection into an equal rounded residual/bound and falsely accept it | `verification-pending` | RED `a9a45714...` + exact significand/exponent repair `425e8963...` + changelog `e6270629...` + retained by current #488 `9aa0dc8d20b1e0cee85778bead526f1fd838721f` | -| GAP-081 | SE-aware acceptance finite/finite multiplication could round an exact strict represented-input rejection into an equal residual/bound and falsely accept it | `verification-pending` | RED `23c3262c...` + tie repair `6a2add48...` + edge coverage `3656deb2...` + changelog `090f5124...` + inherited by current #488 `9aa0dc8d20b1e0cee85778bead526f1fd838721f` | -| GAP-082 | SE-aware acceptance finite subtraction could round an exact strict represented-input rejection onto an exact finite bound and falsely accept equality | `verification-pending` | RED `58cbc032...` + causal low-term comparison repair `68a6fd98...` + sign-symmetric edge `b2c06512...` + changelog `c4f752f3...` + research/current #488 `9aa0dc8d...` | +| GAP-050 | Zero-multiplier SE-aware acceptance could erase a nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e` | +| GAP-051 | Exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e` | +| GAP-052 | All-covered Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e` | +| GAP-053 | Strict-interior Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e` | +| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e` | +| GAP-055 | Strict-interior Wilson lower endpoint could accept a nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e` | +| GAP-056 | Durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e` | +| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from a generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e` | +| GAP-058 | Generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e` | +| GAP-059 | Generic Monte Carlo summary could materially misstate positive SE relative to `SD / sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e` | +| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e` | +| GAP-061 | Generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e` | +| GAP-062 | Finite-tolerance matching could fail while the pair is deterministically outside every finite tolerance | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e` | +| GAP-063 | Exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e` | +| GAP-064 | Positive point RMSE could carry SE above the declared squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e` | +| GAP-065 | Positive Monte Carlo RMSE could carry spread/SE impossible for nonnegative replications | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e` | +| GAP-066 | RMSE Monte Carlo nearest-rank percentile could exceed total nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e` | +| GAP-067 | Generic nearest-rank percentile endpoint could be individually incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected over-strong repair `2798e4f9...`; causal repair `c7151b49...`; edge `dbef285b...`; changelog `c38a320c...`; research `2bbcbb24...`; #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e` | +| GAP-068 | Distinct generic percentile endpoints could each pass individual radius checks while jointly exceeding the sample squared-deviation budget | `verification-pending` | RED `c4a13826...` + causal repair `cb3f80a2...` + changelog `f727450d...`; #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e` | +| GAP-069 | Two-replication distinct nearest-rank endpoints could exhaust the retained sample while the stored mean or SD remained impossible | `verification-pending` | RED `81bf0d9e...` + causal repair `d48f8fef...` + mean coverage `fb314d8a...` + branch cleanup `440b78d8...` + changelog `45116498...`; #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e` | +| GAP-070 | Stored Wilson bounds could contain empirical coverage while the lower/upper pair could not arise from one Wilson score interval for that same coverage | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...` + complementary edge `c1cb16a7...`; #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e` | +| GAP-071 | Durable Wilson evidence lacked denominator and critical-value/sidedness provenance, preventing exact recomputation from a persisted artifact | `active-repair` | valid carrier RED `6f6e06d2...`; shared count/Wilson authority `ca517ed3...`; `WilsonCoverageEvidenceV1` `31e1ab2b...`; sidedness `e9c63926...`/`fdd24a1a...`; envelope RED `07766cb0...` + `ValidationEvidenceV1` repair `a16f22e6...`; docs/current #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e`; remaining: hosted GREEN/review/main plus durable-consumer adoption | +| GAP-072 | Exact all-covered Wilson evidence could retain a zero lower endpoint even though the canonical non-empty finite-`z²` producer always emits `n/(n+z²) > 0` | `verification-pending` | RED `ce714f07...` + non-force source-restore RCA `18499052...` + repair `72e9d954...` + changelog `e3a2f4a2...`; inherited by #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e` | +| GAP-073 | Durable Wilson count provenance could round one uncovered observation away above binary64's exact-integer range and expose a pointer-width-dependent count schema | `verification-pending` | RED `29d710a5...` + complement/count repair `29968c80...` + fixed-width carrier repair `91d9a3bb...` + exact ratio RED/repair `63ddfdd6...`/`11323c57...`; #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e` | +| GAP-074 | Durable Wilson evidence could correctly retain exact `u64` counts yet pre-round `sample_count` before endpoint projection, shifting strict-interior endpoints or erasing all-covered finite-sample uncertainty | `verification-pending` | RED `f89e2467...` + all-covered edge `1a5180b2...` + stale-oracle correction `6254c498...` + causal reciprocal-scale repair `73bbb5cf...` + changelog `f2b5768b...` + research predecessor `7fc78a59...`; current #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e` | +| GAP-075 | Inexact durable all-covered Wilson evidence could round the complementary miss mass to exact one at extreme finite `z` and erase a representable positive lower endpoint | `verification-pending` | RED `059ce70d...`; transient duplicate-owner implementation `46f91f3f...` excluded; canonical repair `0f478392...`; single-writer cleanup `8e2058f2...`; exact-oracle correction `93d5d208...`; changelog correction `43b6562c...`; research predecessor `b03a719d...`; current #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e` | +| GAP-076 | Exactly representable all-covered Wilson counts could absorb a small positive `z²` in `n + z²` and falsely emit exact `1.0` although a lower binary64 endpoint is representable | `verification-pending` | RED `e0c4ec81...` + causal boundary repair `c9dcb9df...` + below-resolution edge `6140080d...` + changelog `09ebb482...` + research predecessor `fe89c438...`; current #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e` | +| GAP-077 | Exactly representable all-covered Wilson counts could form an inexact partial denominator `n + z²` whose rounded sum shifts the represented-input lower endpoint by one ULP even though neither operand is fully absorbed | `verification-pending` | RED `06e55653...` + causal TwoSum/FMA repair `6c084dbe...` + research `25cc1943...` + changelog `5acc894b...` + predecessor changelog correction `f89e36d1...` + correct-direct-rounding control `80a0a0ad...`; current #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e` | +| GAP-078 | Exact-count all-covered Wilson residual compensation could move a direct quotient by one ULP even when the represented-input rational remains on the same side of the adjacent midpoint | `verification-pending` | RED `d076d344...` + midpoint-selection repair `32314239...` + changelog `a75940c9...` + research predecessor `ef6441f7...`; current #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e` | +| GAP-079 | SE-aware acceptance could underflow a finite positive `k · SE` tolerance to exact zero by dividing `SE` by a much larger estimate/target scale before multiplication | `verification-pending` | RED `76067efc...` + causal direct-finite comparison repair `4ffdf366...` + changelog `d822c0ba...` + retained by current #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e` | +| GAP-080 | SE-aware acceptance both-overflow fallback could normalize an exact strict rejection into an equal rounded residual/bound and falsely accept it | `verification-pending` | RED `a9a45714...` + exact significand/exponent repair `425e8963...` + changelog `e6270629...` + retained by current #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e` | +| GAP-081 | SE-aware acceptance finite/finite multiplication could round an exact strict represented-input rejection into an equal residual/bound and falsely accept it | `verification-pending` | RED `23c3262c...` + tie repair `6a2add48...` + edge coverage `3656deb2...` + changelog `090f5124...` + inherited by current #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e` | +| GAP-082 | SE-aware acceptance finite subtraction could round an exact strict represented-input rejection onto an exact finite bound and falsely accept equality | `verification-pending` | RED `58cbc032...` + causal low-term comparison repair `68a6fd98...` + sign-symmetric edge `b2c06512...` + changelog `c4f752f3...` + inherited by current #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e` | +| GAP-083 | SE-aware acceptance subnormal product rounding could hide a strict rejection because the FMA correction itself underflowed to signed zero | `verification-pending` | RED `b55c5473...` + exact dyadic subnormal-bound repair `210cebc4...` + changelog `338c270c...` + research/current #488 `8ac453c2...` | ## Release gate From 1046486d238061c8ca691caaea5432a9f9518132 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 4 Sep 2026 23:39:24 +0900 Subject: [PATCH 176/235] docs(gaps): correct zero-projection SE boundary --- docs/product-technical-gap-baseline.md | 94 +++++++++++++------------- 1 file changed, 47 insertions(+), 47 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index c74f0adab..f3613bc1b 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-04T14:30:00Z +**Snapshot:** 2026-09-04T14:36:00Z **Protected-main evidence:** `b18bca1c69ef8d1799fcd3af6bf4412498e007c3` **Workspace version:** `0.2.0` @@ -30,7 +30,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e` | true | `main` | Validation Evidence landing vehicle, non-force restacked onto protected #489 by merge commit `a2754592...`. Wilson provenance/count and rounding repairs remain inherited. `accept_within_standard_errors` compares finite represented residual/bound directly; finite rounded ties use subtraction/product low terms, with an exact dyadic product fallback at the subnormal correction-resolution boundary; both-overflow uses integer significand/exponent comparison. Hosted exact-head gates and independent review remain required. | +| #488 | `d937795d9af55527d6a733f5a2441a2eb1d83b4b` | true | `main` | Validation Evidence landing vehicle, non-force restacked onto protected #489 by merge commit `a2754592...`. Wilson provenance/count and rounding repairs remain inherited. `accept_within_standard_errors` compares finite represented residual/bound directly; finite rounded ties use subtraction/product low terms and exact dyadic product comparison when both correction projections collapse to zero; both-overflow uses integer significand/exponent comparison. Hosted exact-head gates and independent review remain required. | | #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 | Validation / Analysis Run fold child. Unique evidence must be inherited by a conflict-resolving survivor; child-head CI does not transfer. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | @@ -66,7 +66,7 @@ The clock contract separates event/valid time, assertion time, document time, sy - Generic Validation Evidence RMSE and its delta-method SE normalize before squaring. Exact-zero point RMSE requires exact-zero point RMSE SE. For positive RMSE, the declared producer satisfies `SE(RMSE) <= RMSE / 2`, with a small relative binary64 admission tolerance. - Generic `MonteCarloSummary` is sign-neutral. Zero SD requires zero SE and percentile endpoints equal to the represented mean. Positive SD requires positive SE coherent with represented `SD / sqrt(n)` within a small relative tolerance. Every inclusive nearest-rank endpoint is a retained observation and satisfies `|endpoint - mean| <= SD * sqrt(n - 1)`. Distinct lower/upper endpoint values share the same `(n - 1) * SD²` deviation budget. When `replication_count = 2` and endpoints are numerically distinct, those values exhaust the retained sample and the recorded represented mean/sample SD must match deterministic two-value reconstruction. Equal numeric endpoints do not prove two distinct ranks and are not subjected to that exhaustion rule. - When the generic carrier occupies `ValidationReport::monte_carlo_rmse`, retained replications are nonnegative; positive mean implies `SE(mean) <= mean`, and inclusive nearest-rank endpoints cannot exceed nonnegative sample-sum support `n * mean`. These typed bounds are not imposed on signed metrics such as bias. -- SE-aware acceptance is `|estimate - target| <= k * SE`. For `k = 0` or exact-zero SE, exact recovery is evaluated before any scale reduction; `-0.0` and `+0.0` are one numeric zero-valued scientific state. Finite represented residuals and finite represented `k · SE` bounds are compared directly. On a nonzero finite rounded tie, TEPP compares the error-free subtraction low term—sign-adjusted for the absolute residual—with the FMA product low term when those corrections differ. If both correction projections are zero and the rounded bound is subnormal, an exact subtraction residual is compared against the exact dyadic represented `k · SE` product so subnormal FMA-error underflow cannot turn a strict rejection into equality. Other equal correction projections retain the ordinary rounded decision rather than claiming a global exact comparator. If both direct operations overflow, exact rational magnitudes represented by the binary64 inputs are compared from integer significands and powers of two; independently rounded normalization is not decision evidence. +- SE-aware acceptance is `|estimate - target| <= k * SE`. For `k = 0` or exact-zero SE, exact recovery is evaluated before any scale reduction; `-0.0` and `+0.0` are one numeric zero-valued scientific state. Finite represented residuals and finite represented `k · SE` bounds are compared directly. On a nonzero finite rounded tie, TEPP compares the error-free subtraction low term—sign-adjusted for the absolute residual—with the FMA product low term when those corrections differ. If both correction projections are zero, zero subtraction correction means the represented residual is exact while the product correction may be below binary64 resolution, so TEPP compares that represented residual against the exact dyadic represented `k · SE` product. Other equal nonzero correction projections retain the ordinary rounded decision rather than claiming a global exact comparator. If both direct operations overflow, exact rational magnitudes represented by the binary64 inputs are compared from integer significands and powers of two; independently rounded normalization is not decision evidence. - `match_count` is a finite-threshold decision and does not require materializing an unrepresentable absolute residual; `absolute_residuals` remains fail closed when the magnitude itself is requested. - Wilson interval coverage preserves represented-input endpoints through stable rationalized/complementary/compensated forms. Legacy `ValidationReport` endpoint pairs satisfy necessary Wilson coherence and boundary checks, but exact provenance is not inferred from them. `WilsonCoverageEvidenceV1` retains fixed-width `u64` `sample_count`/`covered_count`, `critical_value_kind=standard_normal_z`, `interval_sidedness=two_sided`, numeric `z`, represented coverage, and canonical endpoints and validates them by exact recomputation through the single crate-private Wilson authority. Exact all-covered status is integer count equality, not rounded `p == 1`. Count proportions are correctly rounded from exact integers. When covered counts dominate, the smaller uncovered complement is evaluated and reflected. When retained `sample_count` itself is not exactly representable in binary64, Wilson scale terms use correctly rounded reciprocal `1/n`; its all-covered path uses complementary miss mass for `z²/n <= 1` and direct reciprocal evaluation for `z²/n > 1`. For an exactly representable all-covered count, a false exact-one quotient retains the boundary-local complementary repair. Otherwise, if `n + z²` is inexact, the canonical writer recovers the TwoSum denominator residual and FMA quotient residual, identifies the adjacent binary64 candidate from residual direction, and changes the direct quotient only when the exact represented-input rational lies beyond that candidate's midpoint; exact midpoint selection is ties-to-even. This avoids both under-correction and residual double-rounding overcorrection without claiming globally correctly rounded Wilson rearrangements. Smaller miss mass genuinely below binary64 resolution remains exact one. `ValidationEvidenceV1` binds provenance to the legacy report projection without breaking existing report callers. - Durable and human-facing Validation Evidence must preserve producing-metric invariants on explicit validation, serde ingress/egress, and human projection. Missing v1 provenance is never synthesized from endpoint algebra. @@ -83,7 +83,7 @@ The clock contract separates event/valid time, assertion time, document time, sy ### #488 — Validation Evidence -#488 is the generic Validation Evidence landing vehicle at exact head `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e`. It remains distinct from Longitudinal Modeling and does not consume mutable fast-mlsirm source. The branch was non-force merge-restacked onto protected #489 by `a2754592987be9e88941d220565c45e34f621a4e`, preserving its complete ancestry and inheriting the protected workflow-load repair. +#488 is the generic Validation Evidence landing vehicle at exact head `d937795d9af55527d6a733f5a2441a2eb1d83b4b`. It remains distinct from Longitudinal Modeling and does not consume mutable fast-mlsirm source. The branch was non-force merge-restacked onto protected #489 by `a2754592987be9e88941d220565c45e34f621a4e`, preserving its complete ancestry and inheriting the protected workflow-load repair. GAP-070 and GAP-072 remain inherited: stored Wilson endpoints must be one coherent score interval, and exact all-covered evidence cannot use a zero lower endpoint. GAP-071 has advanced from design-only to source implementation. Corrected carrier RED `6f6e06d2...` requires a versioned denominator/critical-value carrier; `ca517ed3...` establishes one private covered-count/Wilson-from-counts authority; `31e1ab2b...` adds `WilsonCoverageEvidenceV1`; `e9c63926...`/`fdd24a1a...` bind standard-normal/two-sided semantics. Envelope RED `07766cb0...` and repair `a16f22e6...` add `ValidationEvidenceV1`, which cross-validates the legacy report projection against the recomputable carrier. @@ -95,15 +95,15 @@ GAP-077 records the ordinary partial-denominator state left after the near-one a GAP-078 records the opposite residual-rounding state. With `n=3`, represented `z=0x1.6a09e667f3bcdp+492`, and represented `z²=0x1.0000000000001p+985`, the rounded denominator fully absorbs `n`, but the exact represented-input rational and the direct rounded-denominator quotient both round to `0x1.7ffffffffffffp-984`. The predecessor additive residual correction forced `0x1.7fffffffffffep-984`, one ULP too low. Public RED `d076d344cb3cd3a768e7a5c2d8d7bd9039c657e9` → midpoint-selection repair `32314239754204158f228ec67a0771abf4d39b45` → changelog `a75940c955633d5eb92f227d79e64acd0ef46ea8` → research predecessor `ef6441f786d64e6dca198d0d6140838c391f0659`. -GAP-079 records SE-aware acceptance scale-first underflow. For `estimate=1.0e308`, `target=next_down(estimate)`, `SE=2.2e-16`, and `k=1.0e308`, the represented residual (`1.99584030953472e292`) is within the represented finite bound (`2.2e292`), but the predecessor formed `SE / scale == 0.0` before multiplication and falsely rejected the recovery. Public RED `76067efce44419c27687b8673cb76092c90fb5a5` includes the admissible case and a nearby rejection at `SE=1.8e-16`; causal repair `4ffdf3665b3bbafd3b0bbf06b599fe71498169ab`; changelog `d822c0ba7fa548c3283e462323c56d8f5705de31`; retained by current #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e`. +GAP-079 records SE-aware acceptance scale-first underflow. For `estimate=1.0e308`, `target=next_down(estimate)`, `SE=2.2e-16`, and `k=1.0e308`, the represented residual (`1.99584030953472e292`) is within the represented finite bound (`2.2e292`), but the predecessor formed `SE / scale == 0.0` before multiplication and falsely rejected the recovery. Public RED `76067efce44419c27687b8673cb76092c90fb5a5` includes the admissible case and a nearby rejection at `SE=1.8e-16`; causal repair `4ffdf3665b3bbafd3b0bbf06b599fe71498169ab`; changelog `d822c0ba7fa548c3283e462323c56d8f5705de31`; retained by current #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b`. -GAP-080 records the both-overflow decision defect. With exact binary64 payloads `estimate=0x7fee446cf80dddbc`, `target=0xffe2d7e397966af3`, `SE=0x73620ad22ddb6f38`, and `k=0x4c85c69ac1c7a9ed`, direct subtraction and multiplication both overflow; predecessor scale normalization rounds residual and bound to the same finite value and falsely accepts although the exact represented-input bound is smaller. Public RED `a9a45714eb6266f6b922086112b313060e77c522` includes that strict rejection and the adjacent accepted multiplier `0x4c85c69ac1c7a9ee`; causal exact significand/exponent comparison repair `425e89638d594fdb2f3586d73f021b60a530b456`; changelog `e62706291ad556c6d9078a2bc50dcf3bca5a6feb`; retained by current #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e`. +GAP-080 records the both-overflow decision defect. With exact binary64 payloads `estimate=0x7fee446cf80dddbc`, `target=0xffe2d7e397966af3`, `SE=0x73620ad22ddb6f38`, and `k=0x4c85c69ac1c7a9ed`, direct subtraction and multiplication both overflow; predecessor scale normalization rounds residual and bound to the same finite value and falsely accepts although the exact represented-input bound is smaller. Public RED `a9a45714eb6266f6b922086112b313060e77c522` includes that strict rejection and the adjacent accepted multiplier `0x4c85c69ac1c7a9ee`; causal exact significand/exponent comparison repair `425e89638d594fdb2f3586d73f021b60a530b456`; changelog `e62706291ad556c6d9078a2bc50dcf3bca5a6feb`; retained by current #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b`. -GAP-081 records the finite multiplication-rounded tie defect. For `estimate=1`, `target=0`, `SE=1-2^-27`, and `k=1+2^-27`, exact represented `k·SE = 1-2^-54` is strictly below residual 1, but binary64 multiplication rounds the bound ties-to-even to `1.0`, so predecessor comparison falsely accepts equality. Public RED `23c3262c824609d79dc14d45bb0acb5a54e99a51`; causal repair `6a2add488cfa6bb5ac3cc854a107f287b61bbed5`; edge coverage `3656deb2f2abc0a83027618a823497a829d9227e`; changelog `090f5124588cb184fc2ef644d91355f2b2c2082b`; inherited by current #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e`. +GAP-081 records the finite multiplication-rounded tie defect. For `estimate=1`, `target=0`, `SE=1-2^-27`, and `k=1+2^-27`, exact represented `k·SE = 1-2^-54` is strictly below residual 1, but binary64 multiplication rounds the bound ties-to-even to `1.0`, so predecessor comparison falsely accepts equality. Public RED `23c3262c824609d79dc14d45bb0acb5a54e99a51`; causal repair `6a2add488cfa6bb5ac3cc854a107f287b61bbed5`; edge coverage `3656deb2f2abc0a83027618a823497a829d9227e`; changelog `090f5124588cb184fc2ef644d91355f2b2c2082b`; inherited by current #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b`. -GAP-082 records the complementary finite subtraction-rounded tie. Public RED `58cbc03253997865b7c8ec19fb501fc89c22c851` fixes `estimate=1`, `target=-2^-54`, `SE=1`, `k=1`: the exact represented residual is `1+2^-54`, strictly above the exact unit bound, while binary64 subtraction rounds it to `1.0` and the predecessor falsely accepts. Causal repair `68a6fd98b4f661ad5d4c3c35dc8b9074f2c59281` compares the sign-adjusted error-free subtraction low term with the FMA product low term only on nonzero finite rounded ties whose correction projections differ; equal projected low terms retain the rounded decision rather than claiming a global exact comparator. Sign-symmetric edge coverage `b2c06512b6d795555269862c1c3d7e4bc67f3f18`; dedicated changelog `c4f752f30121901bfbf4a96b03fdef0ccd9f4bf3`. +GAP-082 records the complementary finite subtraction-rounded tie. Public RED `58cbc03253997865b7c8ec19fb501fc89c22c851` fixes `estimate=1`, `target=-2^-54`, `SE=1`, `k=1`: the exact represented residual is `1+2^-54`, strictly above the exact unit bound, while binary64 subtraction rounds it to `1.0` and the predecessor falsely accepts. Causal repair `68a6fd98b4f661ad5d4c3c35dc8b9074f2c59281` compares the sign-adjusted error-free subtraction low term with the FMA product low term only on nonzero finite rounded ties whose correction projections differ. Sign-symmetric edge coverage `b2c06512b6d795555269862c1c3d7e4bc67f3f18`; dedicated changelog `c4f752f30121901bfbf4a96b03fdef0ccd9f4bf3`; inherited by current #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b`. -GAP-083 records the subnormal product-correction resolution boundary. Public RED `b55c5473c8ee7a70ec2508d14d0755c2aeb38191` uses exact residual `minimum_subnormal`, `k=0x1.8p-538`, and `SE=0x1p-537`; exact represented `k·SE` is `3/4` minimum subnormal, but multiplication rounds up to the minimum subnormal while the `-1/4`-subnormal FMA correction rounds to signed zero. Causal repair `210cebc4980c861ddfd6d098bf1c9d66c8449e72` compares the exact represented residual with the exact dyadic product only when finite rounded tie, zero correction projections, and subnormal rounded bound coincide; exact minimum-subnormal equality is retained as an acceptance control. Dedicated changelog `338c270c65c10d305432029c455b9ac37c28c0f1`; research/current #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e`. +GAP-083 records product correction below binary64 resolution. Public RED `b55c5473c8ee7a70ec2508d14d0755c2aeb38191` uses exact residual `minimum_subnormal`, `k=0x1.8p-538`, and `SE=0x1p-537`: exact represented `k·SE` is `3/4` minimum subnormal, multiplication rounds up, and the `-1/4`-subnormal FMA correction rounds to signed zero. Initial repair `210cebc4980c861ddfd6d098bf1c9d66c8449e72` correctly closed that RED but over-restricted the fallback to subnormal rounded bounds. Concurrent follow-up RED `c77ac440971abc649e6ede35874e5a7439e96797` proves the same failure at the minimum-normal boundary, where exact `(1-2^-54)·2^-1022` rounds to `f64::MIN_POSITIVE` and the correction still projects to zero. Corrected causal repair `772ad8ed3be8d105975bf776e9f9d898774a4a23` removes the rounded-bound-class guard and, only when both finite-tie correction projections are zero, compares the exact represented residual against the exact dyadic `k·SE` product. Exact minimum-subnormal/minimum-normal equality controls remain accepted. CHANGELOG correction `ceb68825f2759637034c2aaea935e50771aa6afc`; research/current #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b`. These repairs advance the source-contract portion of GAP-071/GAP-073–GAP-083 but not delivery: exact-head hosted gates, independent review, protected-main integration, and adoption by durable consumers that require v1 provenance remain outstanding. Bare legacy `ValidationReport` remains a backward-compatible compact projection and is not silently treated as v1 provenance. @@ -165,45 +165,45 @@ Wilson (1927) remains the primary score-interval reference. AERA/APA/NCME (2014) | GAP-042 | Ratio-first logarithm could nearly double an adjacent-float irregular residual growth rate | `verification-pending` | RED `766ddc7a...` + `ln_1p` repair `16f21d9a...` | | GAP-043 | Duplicate known-truth component identities could silently reweight RMSE recovery evidence | `verification-pending` | RED `698f12f5...` + uniqueness repair `2fae4cb2...` | | GAP-044 | Known-truth RMSE alignment/accumulation depended on row order instead of component identity | `verification-pending` | RED `8ad72ac9...` / `5fb93c40...` + repairs `2dd9537e...` / `025dce7f...`; #310 `c6680450...` | -| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e` | -| GAP-046 | Bias SE could reject a representable SEM because raw squared deviations/intermediates overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e` | -| GAP-047 | Generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e` | -| GAP-048 | Mean signed bias could erase a representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e` | +| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b` | +| GAP-046 | Bias SE could reject a representable SEM because raw squared deviations/intermediates overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b` | +| GAP-047 | Generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b` | +| GAP-048 | Mean signed bias could erase a representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b` | | GAP-049 | Stable `Between` recovery could be aliased across occasion indices and reweight RMSE | `verification-pending` | RED `0a03041c...` + repair `ec2c1219...`; #310 `c6680450...` | -| GAP-050 | Zero-multiplier SE-aware acceptance could erase a nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e` | -| GAP-051 | Exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e` | -| GAP-052 | All-covered Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e` | -| GAP-053 | Strict-interior Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e` | -| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e` | -| GAP-055 | Strict-interior Wilson lower endpoint could accept a nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e` | -| GAP-056 | Durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e` | -| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from a generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e` | -| GAP-058 | Generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e` | -| GAP-059 | Generic Monte Carlo summary could materially misstate positive SE relative to `SD / sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e` | -| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e` | -| GAP-061 | Generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e` | -| GAP-062 | Finite-tolerance matching could fail while the pair is deterministically outside every finite tolerance | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e` | -| GAP-063 | Exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e` | -| GAP-064 | Positive point RMSE could carry SE above the declared squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e` | -| GAP-065 | Positive Monte Carlo RMSE could carry spread/SE impossible for nonnegative replications | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e` | -| GAP-066 | RMSE Monte Carlo nearest-rank percentile could exceed total nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e` | -| GAP-067 | Generic nearest-rank percentile endpoint could be individually incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected over-strong repair `2798e4f9...`; causal repair `c7151b49...`; edge `dbef285b...`; changelog `c38a320c...`; research `2bbcbb24...`; #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e` | -| GAP-068 | Distinct generic percentile endpoints could each pass individual radius checks while jointly exceeding the sample squared-deviation budget | `verification-pending` | RED `c4a13826...` + causal repair `cb3f80a2...` + changelog `f727450d...`; #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e` | -| GAP-069 | Two-replication distinct nearest-rank endpoints could exhaust the retained sample while the stored mean or SD remained impossible | `verification-pending` | RED `81bf0d9e...` + causal repair `d48f8fef...` + mean coverage `fb314d8a...` + branch cleanup `440b78d8...` + changelog `45116498...`; #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e` | -| GAP-070 | Stored Wilson bounds could contain empirical coverage while the lower/upper pair could not arise from one Wilson score interval for that same coverage | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...` + complementary edge `c1cb16a7...`; #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e` | -| GAP-071 | Durable Wilson evidence lacked denominator and critical-value/sidedness provenance, preventing exact recomputation from a persisted artifact | `active-repair` | valid carrier RED `6f6e06d2...`; shared count/Wilson authority `ca517ed3...`; `WilsonCoverageEvidenceV1` `31e1ab2b...`; sidedness `e9c63926...`/`fdd24a1a...`; envelope RED `07766cb0...` + `ValidationEvidenceV1` repair `a16f22e6...`; docs/current #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e`; remaining: hosted GREEN/review/main plus durable-consumer adoption | -| GAP-072 | Exact all-covered Wilson evidence could retain a zero lower endpoint even though the canonical non-empty finite-`z²` producer always emits `n/(n+z²) > 0` | `verification-pending` | RED `ce714f07...` + non-force source-restore RCA `18499052...` + repair `72e9d954...` + changelog `e3a2f4a2...`; inherited by #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e` | -| GAP-073 | Durable Wilson count provenance could round one uncovered observation away above binary64's exact-integer range and expose a pointer-width-dependent count schema | `verification-pending` | RED `29d710a5...` + complement/count repair `29968c80...` + fixed-width carrier repair `91d9a3bb...` + exact ratio RED/repair `63ddfdd6...`/`11323c57...`; #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e` | -| GAP-074 | Durable Wilson evidence could correctly retain exact `u64` counts yet pre-round `sample_count` before endpoint projection, shifting strict-interior endpoints or erasing all-covered finite-sample uncertainty | `verification-pending` | RED `f89e2467...` + all-covered edge `1a5180b2...` + stale-oracle correction `6254c498...` + causal reciprocal-scale repair `73bbb5cf...` + changelog `f2b5768b...` + research predecessor `7fc78a59...`; current #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e` | -| GAP-075 | Inexact durable all-covered Wilson evidence could round the complementary miss mass to exact one at extreme finite `z` and erase a representable positive lower endpoint | `verification-pending` | RED `059ce70d...`; transient duplicate-owner implementation `46f91f3f...` excluded; canonical repair `0f478392...`; single-writer cleanup `8e2058f2...`; exact-oracle correction `93d5d208...`; changelog correction `43b6562c...`; research predecessor `b03a719d...`; current #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e` | -| GAP-076 | Exactly representable all-covered Wilson counts could absorb a small positive `z²` in `n + z²` and falsely emit exact `1.0` although a lower binary64 endpoint is representable | `verification-pending` | RED `e0c4ec81...` + causal boundary repair `c9dcb9df...` + below-resolution edge `6140080d...` + changelog `09ebb482...` + research predecessor `fe89c438...`; current #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e` | -| GAP-077 | Exactly representable all-covered Wilson counts could form an inexact partial denominator `n + z²` whose rounded sum shifts the represented-input lower endpoint by one ULP even though neither operand is fully absorbed | `verification-pending` | RED `06e55653...` + causal TwoSum/FMA repair `6c084dbe...` + research `25cc1943...` + changelog `5acc894b...` + predecessor changelog correction `f89e36d1...` + correct-direct-rounding control `80a0a0ad...`; current #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e` | -| GAP-078 | Exact-count all-covered Wilson residual compensation could move a direct quotient by one ULP even when the represented-input rational remains on the same side of the adjacent midpoint | `verification-pending` | RED `d076d344...` + midpoint-selection repair `32314239...` + changelog `a75940c9...` + research predecessor `ef6441f7...`; current #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e` | -| GAP-079 | SE-aware acceptance could underflow a finite positive `k · SE` tolerance to exact zero by dividing `SE` by a much larger estimate/target scale before multiplication | `verification-pending` | RED `76067efc...` + causal direct-finite comparison repair `4ffdf366...` + changelog `d822c0ba...` + retained by current #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e` | -| GAP-080 | SE-aware acceptance both-overflow fallback could normalize an exact strict rejection into an equal rounded residual/bound and falsely accept it | `verification-pending` | RED `a9a45714...` + exact significand/exponent repair `425e8963...` + changelog `e6270629...` + retained by current #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e` | -| GAP-081 | SE-aware acceptance finite/finite multiplication could round an exact strict represented-input rejection into an equal residual/bound and falsely accept it | `verification-pending` | RED `23c3262c...` + tie repair `6a2add48...` + edge coverage `3656deb2...` + changelog `090f5124...` + inherited by current #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e` | -| GAP-082 | SE-aware acceptance finite subtraction could round an exact strict represented-input rejection onto an exact finite bound and falsely accept equality | `verification-pending` | RED `58cbc032...` + causal low-term comparison repair `68a6fd98...` + sign-symmetric edge `b2c06512...` + changelog `c4f752f3...` + inherited by current #488 `8ac453c217a9b4dac31d47bbedb4d1be0e9d7a1e` | -| GAP-083 | SE-aware acceptance subnormal product rounding could hide a strict rejection because the FMA correction itself underflowed to signed zero | `verification-pending` | RED `b55c5473...` + exact dyadic subnormal-bound repair `210cebc4...` + changelog `338c270c...` + research/current #488 `8ac453c2...` | +| GAP-050 | Zero-multiplier SE-aware acceptance could erase a nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b` | +| GAP-051 | Exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b` | +| GAP-052 | All-covered Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b` | +| GAP-053 | Strict-interior Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b` | +| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b` | +| GAP-055 | Strict-interior Wilson lower endpoint could accept a nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b` | +| GAP-056 | Durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b` | +| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from a generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b` | +| GAP-058 | Generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b` | +| GAP-059 | Generic Monte Carlo summary could materially misstate positive SE relative to `SD / sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b` | +| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b` | +| GAP-061 | Generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b` | +| GAP-062 | Finite-tolerance matching could fail while the pair is deterministically outside every finite tolerance | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b` | +| GAP-063 | Exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b` | +| GAP-064 | Positive point RMSE could carry SE above the declared squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b` | +| GAP-065 | Positive Monte Carlo RMSE could carry spread/SE impossible for nonnegative replications | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b` | +| GAP-066 | RMSE Monte Carlo nearest-rank percentile could exceed total nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b` | +| GAP-067 | Generic nearest-rank percentile endpoint could be individually incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected over-strong repair `2798e4f9...`; causal repair `c7151b49...`; edge `dbef285b...`; changelog `c38a320c...`; research `2bbcbb24...`; #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b` | +| GAP-068 | Distinct generic percentile endpoints could each pass individual radius checks while jointly exceeding the sample squared-deviation budget | `verification-pending` | RED `c4a13826...` + causal repair `cb3f80a2...` + changelog `f727450d...`; #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b` | +| GAP-069 | Two-replication distinct nearest-rank endpoints could exhaust the retained sample while the stored mean or SD remained impossible | `verification-pending` | RED `81bf0d9e...` + causal repair `d48f8fef...` + mean coverage `fb314d8a...` + branch cleanup `440b78d8...` + changelog `45116498...`; #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b` | +| GAP-070 | Stored Wilson bounds could contain empirical coverage while the lower/upper pair could not arise from one Wilson score interval for that same coverage | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...` + complementary edge `c1cb16a7...`; #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b` | +| GAP-071 | Durable Wilson evidence lacked denominator and critical-value/sidedness provenance, preventing exact recomputation from a persisted artifact | `active-repair` | valid carrier RED `6f6e06d2...`; shared count/Wilson authority `ca517ed3...`; `WilsonCoverageEvidenceV1` `31e1ab2b...`; sidedness `e9c63926...`/`fdd24a1a...`; envelope RED `07766cb0...` + `ValidationEvidenceV1` repair `a16f22e6...`; docs/current #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b`; remaining: hosted GREEN/review/main plus durable-consumer adoption | +| GAP-072 | Exact all-covered Wilson evidence could retain a zero lower endpoint even though the canonical non-empty finite-`z²` producer always emits `n/(n+z²) > 0` | `verification-pending` | RED `ce714f07...` + non-force source-restore RCA `18499052...` + repair `72e9d954...` + changelog `e3a2f4a2...`; inherited by #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b` | +| GAP-073 | Durable Wilson count provenance could round one uncovered observation away above binary64's exact-integer range and expose a pointer-width-dependent count schema | `verification-pending` | RED `29d710a5...` + complement/count repair `29968c80...` + fixed-width carrier repair `91d9a3bb...` + exact ratio RED/repair `63ddfdd6...`/`11323c57...`; #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b` | +| GAP-074 | Durable Wilson evidence could correctly retain exact `u64` counts yet pre-round `sample_count` before endpoint projection, shifting strict-interior endpoints or erasing all-covered finite-sample uncertainty | `verification-pending` | RED `f89e2467...` + all-covered edge `1a5180b2...` + stale-oracle correction `6254c498...` + causal reciprocal-scale repair `73bbb5cf...` + changelog `f2b5768b...` + research predecessor `7fc78a59...`; current #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b` | +| GAP-075 | Inexact durable all-covered Wilson evidence could round the complementary miss mass to exact one at extreme finite `z` and erase a representable positive lower endpoint | `verification-pending` | RED `059ce70d...`; transient duplicate-owner implementation `46f91f3f...` excluded; canonical repair `0f478392...`; single-writer cleanup `8e2058f2...`; exact-oracle correction `93d5d208...`; changelog correction `43b6562c...`; research predecessor `b03a719d...`; current #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b` | +| GAP-076 | Exactly representable all-covered Wilson counts could absorb a small positive `z²` in `n + z²` and falsely emit exact `1.0` although a lower binary64 endpoint is representable | `verification-pending` | RED `e0c4ec81...` + causal boundary repair `c9dcb9df...` + below-resolution edge `6140080d...` + changelog `09ebb482...` + research predecessor `fe89c438...`; current #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b` | +| GAP-077 | Exactly representable all-covered Wilson counts could form an inexact partial denominator `n + z²` whose rounded sum shifts the represented-input lower endpoint by one ULP even though neither operand is fully absorbed | `verification-pending` | RED `06e55653...` + causal TwoSum/FMA repair `6c084dbe...` + research `25cc1943...` + changelog `5acc894b...` + predecessor changelog correction `f89e36d1...` + correct-direct-rounding control `80a0a0ad...`; current #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b` | +| GAP-078 | Exact-count all-covered Wilson residual compensation could move a direct quotient by one ULP even when the represented-input rational remains on the same side of the adjacent midpoint | `verification-pending` | RED `d076d344...` + midpoint-selection repair `32314239...` + changelog `a75940c9...` + research predecessor `ef6441f7...`; current #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b` | +| GAP-079 | SE-aware acceptance could underflow a finite positive `k · SE` tolerance to exact zero by dividing `SE` by a much larger estimate/target scale before multiplication | `verification-pending` | RED `76067efc...` + causal direct-finite comparison repair `4ffdf366...` + changelog `d822c0ba...` + retained by current #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b` | +| GAP-080 | SE-aware acceptance both-overflow fallback could normalize an exact strict rejection into an equal rounded residual/bound and falsely accept it | `verification-pending` | RED `a9a45714...` + exact significand/exponent repair `425e8963...` + changelog `e6270629...` + retained by current #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b` | +| GAP-081 | SE-aware acceptance finite/finite multiplication could round an exact strict represented-input rejection into an equal residual/bound and falsely accept it | `verification-pending` | RED `23c3262c...` + tie repair `6a2add48...` + edge coverage `3656deb2...` + changelog `090f5124...` + inherited by current #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b` | +| GAP-082 | SE-aware acceptance finite subtraction could round an exact strict represented-input rejection onto an exact finite bound and falsely accept equality | `verification-pending` | RED `58cbc032...` + causal low-term comparison repair `68a6fd98...` + sign-symmetric edge `b2c06512...` + changelog `c4f752f3...` + inherited by current #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b` | +| GAP-083 | SE-aware acceptance product correction can fall below binary64 resolution even when the rounded finite bound is subnormal or minimum normal, erasing a strict represented-input rejection | `verification-pending` | RED `b55c5473...` + initial narrow repair `210cebc4...` + minimum-normal RED `c77ac440...` + corrected zero-projection repair `772ad8ed...` + changelog correction `ceb68825...` + research/current #488 `d937795d...` | ## Release gate From a5c7cd306b3af32f0066298bb4d310b3d4613002 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 5 Sep 2026 00:15:51 +0900 Subject: [PATCH 177/235] docs(gap): record Wilson boundary peer-root admission --- docs/product-technical-gap-baseline.md | 101 +++++++++++++------------ 1 file changed, 52 insertions(+), 49 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index f3613bc1b..aaa46f035 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-04T14:36:00Z +**Snapshot:** 2026-09-04T15:12:00Z **Protected-main evidence:** `b18bca1c69ef8d1799fcd3af6bf4412498e007c3` **Workspace version:** `0.2.0` @@ -30,7 +30,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `d937795d9af55527d6a733f5a2441a2eb1d83b4b` | true | `main` | Validation Evidence landing vehicle, non-force restacked onto protected #489 by merge commit `a2754592...`. Wilson provenance/count and rounding repairs remain inherited. `accept_within_standard_errors` compares finite represented residual/bound directly; finite rounded ties use subtraction/product low terms and exact dyadic product comparison when both correction projections collapse to zero; both-overflow uses integer significand/exponent comparison. Hosted exact-head gates and independent review remain required. | +| #488 | `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6` | true | `main` | Validation Evidence landing vehicle, non-force restacked onto protected #489 by merge commit `a2754592...`. Wilson provenance/count/rounding repairs remain inherited; legacy Wilson boundary pairs now also reject exact 0/1 endpoints when the peer endpoint implies a representable non-boundary root. `accept_within_standard_errors` retains direct finite comparison, bounded tie discrimination, exact dyadic zero-projection comparison, and exact both-overflow comparison. Hosted exact-head gates and independent review remain required. | | #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 | Validation / Analysis Run fold child. Unique evidence must be inherited by a conflict-resolving survivor; child-head CI does not transfer. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | @@ -68,7 +68,7 @@ The clock contract separates event/valid time, assertion time, document time, sy - When the generic carrier occupies `ValidationReport::monte_carlo_rmse`, retained replications are nonnegative; positive mean implies `SE(mean) <= mean`, and inclusive nearest-rank endpoints cannot exceed nonnegative sample-sum support `n * mean`. These typed bounds are not imposed on signed metrics such as bias. - SE-aware acceptance is `|estimate - target| <= k * SE`. For `k = 0` or exact-zero SE, exact recovery is evaluated before any scale reduction; `-0.0` and `+0.0` are one numeric zero-valued scientific state. Finite represented residuals and finite represented `k · SE` bounds are compared directly. On a nonzero finite rounded tie, TEPP compares the error-free subtraction low term—sign-adjusted for the absolute residual—with the FMA product low term when those corrections differ. If both correction projections are zero, zero subtraction correction means the represented residual is exact while the product correction may be below binary64 resolution, so TEPP compares that represented residual against the exact dyadic represented `k · SE` product. Other equal nonzero correction projections retain the ordinary rounded decision rather than claiming a global exact comparator. If both direct operations overflow, exact rational magnitudes represented by the binary64 inputs are compared from integer significands and powers of two; independently rounded normalization is not decision evidence. - `match_count` is a finite-threshold decision and does not require materializing an unrepresentable absolute residual; `absolute_residuals` remains fail closed when the magnitude itself is requested. -- Wilson interval coverage preserves represented-input endpoints through stable rationalized/complementary/compensated forms. Legacy `ValidationReport` endpoint pairs satisfy necessary Wilson coherence and boundary checks, but exact provenance is not inferred from them. `WilsonCoverageEvidenceV1` retains fixed-width `u64` `sample_count`/`covered_count`, `critical_value_kind=standard_normal_z`, `interval_sidedness=two_sided`, numeric `z`, represented coverage, and canonical endpoints and validates them by exact recomputation through the single crate-private Wilson authority. Exact all-covered status is integer count equality, not rounded `p == 1`. Count proportions are correctly rounded from exact integers. When covered counts dominate, the smaller uncovered complement is evaluated and reflected. When retained `sample_count` itself is not exactly representable in binary64, Wilson scale terms use correctly rounded reciprocal `1/n`; its all-covered path uses complementary miss mass for `z²/n <= 1` and direct reciprocal evaluation for `z²/n > 1`. For an exactly representable all-covered count, a false exact-one quotient retains the boundary-local complementary repair. Otherwise, if `n + z²` is inexact, the canonical writer recovers the TwoSum denominator residual and FMA quotient residual, identifies the adjacent binary64 candidate from residual direction, and changes the direct quotient only when the exact represented-input rational lies beyond that candidate's midpoint; exact midpoint selection is ties-to-even. This avoids both under-correction and residual double-rounding overcorrection without claiming globally correctly rounded Wilson rearrangements. Smaller miss mass genuinely below binary64 resolution remains exact one. `ValidationEvidenceV1` binds provenance to the legacy report projection without breaking existing report callers. +- Wilson interval coverage preserves represented-input endpoints through stable rationalized/complementary/compensated forms. Legacy `ValidationReport` endpoint pairs satisfy necessary Wilson coherence and boundary checks, but exact provenance is not inferred from them. For `0 < p < 0.5`, a stored exact-zero lower endpoint is rejected when the peer upper endpoint implies a positive representable lower root under `L = p²(1-U) / [p² + (1-2p)U]`; `p > 0.5` applies the complement-symmetric rule to exact-one upper endpoints. The stable implementation delays squaring so the check itself does not erase a peer root before that final root becomes unrepresentable. A boundary remains admissible when the implied peer root also rounds to zero because the legacy report lacks enough producer provenance for a stronger claim. `WilsonCoverageEvidenceV1` retains fixed-width `u64` `sample_count`/`covered_count`, `critical_value_kind=standard_normal_z`, `interval_sidedness=two_sided`, numeric `z`, represented coverage, and canonical endpoints and validates them by exact recomputation through the single crate-private Wilson authority. Exact all-covered status is integer count equality, not rounded `p == 1`. Count proportions are correctly rounded from exact integers. When covered counts dominate, the smaller uncovered complement is evaluated and reflected. When retained `sample_count` itself is not exactly representable in binary64, Wilson scale terms use correctly rounded reciprocal `1/n`; its all-covered path uses complementary miss mass for `z²/n <= 1` and direct reciprocal evaluation for `z²/n > 1`. For an exactly representable all-covered count, a false exact-one quotient retains the boundary-local complementary repair. Otherwise, if `n + z²` is inexact, the canonical writer recovers the TwoSum denominator residual and FMA quotient residual, identifies the adjacent binary64 candidate from residual direction, and changes the direct quotient only when the exact represented-input rational lies beyond that candidate's midpoint; exact midpoint selection is ties-to-even. This avoids both under-correction and residual double-rounding overcorrection without claiming globally correctly rounded Wilson rearrangements. Smaller miss mass genuinely below binary64 resolution remains exact one. `ValidationEvidenceV1` binds provenance to the legacy report projection without breaking existing report callers. - Durable and human-facing Validation Evidence must preserve producing-metric invariants on explicit validation, serde ingress/egress, and human projection. Missing v1 provenance is never synthesized from endpoint algebra. - Bias, RMSE, and Monte Carlo may share private deterministic scalar support inside `validation_core`, but metric-specific cancellation/normalization, denominator, uncertainty, and fail-closed semantics remain with their bounded modules. - Historical-cutoff admission occurs before duplicate-identity checks. Future-unavailable evidence cannot change an earlier run's conflicts, counts, or terminal state. @@ -83,29 +83,31 @@ The clock contract separates event/valid time, assertion time, document time, sy ### #488 — Validation Evidence -#488 is the generic Validation Evidence landing vehicle at exact head `d937795d9af55527d6a733f5a2441a2eb1d83b4b`. It remains distinct from Longitudinal Modeling and does not consume mutable fast-mlsirm source. The branch was non-force merge-restacked onto protected #489 by `a2754592987be9e88941d220565c45e34f621a4e`, preserving its complete ancestry and inheriting the protected workflow-load repair. +#488 is the generic Validation Evidence landing vehicle at exact head `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6`. It remains distinct from Longitudinal Modeling and does not consume mutable fast-mlsirm source. The branch was non-force merge-restacked onto protected #489 by `a2754592987be9e88941d220565c45e34f621a4e`, preserving its complete ancestry and inheriting the protected workflow-load repair. GAP-070 and GAP-072 remain inherited: stored Wilson endpoints must be one coherent score interval, and exact all-covered evidence cannot use a zero lower endpoint. GAP-071 has advanced from design-only to source implementation. Corrected carrier RED `6f6e06d2...` requires a versioned denominator/critical-value carrier; `ca517ed3...` establishes one private covered-count/Wilson-from-counts authority; `31e1ab2b...` adds `WilsonCoverageEvidenceV1`; `e9c63926...`/`fdd24a1a...` bind standard-normal/two-sided semantics. Envelope RED `07766cb0...` and repair `a16f22e6...` add `ValidationEvidenceV1`, which cross-validates the legacy report projection against the recomputable carrier. GAP-073 retains large-count identity/schema and exact-ratio projection. GAP-074 retains reciprocal-scale evaluation for sample counts that are not exactly representable in binary64. GAP-075 retains the inexact-count all-covered extreme-`z` scale switch and exact-oracle correction. -GAP-076 records the exact-count all-covered near-one denominator-absorption defect. Public RED `e0c4ec81bb455d230259489dc71e23fe33704b1d` fixes `n=1` and represented `z=0x1.0000000000001p-27`; causal repair `c9dcb9df363999bbcbb6fffdc8b6a6d9ae5e762c` performs the complementary miss calculation only after direct false-one collapse; boundary `6140080d2257d0550be479d71371d70e2255c3d0` preserves true exact one below binary64 resolution; changelog `09ebb482851fe7836e738a74395e6424621da9bf`; research predecessor `fe89c43803136ab979912fffa636d2a4f169a73e`. +GAP-076 records the exact-count all-covered near-one denominator-absorption defect. Public RED `e0c4ec81bb455d230259489dc71e23fe33704b1d` fixes `n=1` and represented `z=0x1.0000000000001p-27`; causal repair `c9dcb9df363999bbcbb6fffdc31b68922e8d01d2` performs the complementary miss calculation only after direct false-one collapse; boundary `6140080d2257d0550be479d71371d70e2255c3d0` preserves true exact one below binary64 resolution; changelog `09ebb482851fe7836e738a74395e6424621da9bf`; research predecessor `fe89c43803136ab979912fffa636d2a4f169a73e`. GAP-077 records the ordinary partial-denominator state left after the near-one and complete-absorption repairs. With `n=1` and represented `z=3*2^-28`, represented `z²=9*2^-56`; `1+z²` rounds upward before division, so predecessor direct evaluation emits `0x1.ffffffffffffep-1` although the represented-input rational lower endpoint rounds to `0x1.fffffffffffffp-1`. Public RED `06e556538e171e675c4d8a8287d75052ffc2c4c3` → causal TwoSum/FMA residual repair `6c084dbe607e6c415288c77fa41a4270947cd51e` → research `25cc19436085881602356e7f2609b697b575540c` → dedicated changelog `5acc894b8a4d42cd7af8cdc22a02b61a063f16aa` → predecessor changelog correction `f89e36d1f2a048befb983327c83f5696baf530cc` → correct-direct-rounding control `80a0a0ade16f516bf63907f2a8d5105dbcd9c438`. GAP-078 records the opposite residual-rounding state. With `n=3`, represented `z=0x1.6a09e667f3bcdp+492`, and represented `z²=0x1.0000000000001p+985`, the rounded denominator fully absorbs `n`, but the exact represented-input rational and the direct rounded-denominator quotient both round to `0x1.7ffffffffffffp-984`. The predecessor additive residual correction forced `0x1.7fffffffffffep-984`, one ULP too low. Public RED `d076d344cb3cd3a768e7a5c2d8d7bd9039c657e9` → midpoint-selection repair `32314239754204158f228ec67a0771abf4d39b45` → changelog `a75940c955633d5eb92f227d79e64acd0ef46ea8` → research predecessor `ef6441f786d64e6dca198d0d6140838c391f0659`. -GAP-079 records SE-aware acceptance scale-first underflow. For `estimate=1.0e308`, `target=next_down(estimate)`, `SE=2.2e-16`, and `k=1.0e308`, the represented residual (`1.99584030953472e292`) is within the represented finite bound (`2.2e292`), but the predecessor formed `SE / scale == 0.0` before multiplication and falsely rejected the recovery. Public RED `76067efce44419c27687b8673cb76092c90fb5a5` includes the admissible case and a nearby rejection at `SE=1.8e-16`; causal repair `4ffdf3665b3bbafd3b0bbf06b599fe71498169ab`; changelog `d822c0ba7fa548c3283e462323c56d8f5705de31`; retained by current #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b`. +GAP-079 records SE-aware acceptance scale-first underflow. For `estimate=1.0e308`, `target=next_down(estimate)`, `SE=2.2e-16`, and `k=1.0e308`, the represented residual (`1.99584030953472e292`) is within the represented finite bound (`2.2e292`), but the predecessor formed `SE / scale == 0.0` before multiplication and falsely rejected the recovery. Public RED `76067efce44419c27687b8673cb76092c90fb5a5` includes the admissible case and a nearby rejection at `SE=1.8e-16`; causal repair `4ffdf3665b3bbafd3b0bbf06b599fe71498169ab`; changelog `d822c0ba7fa548c3283e462323c56d8f5705de31`; retained by current #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6`. -GAP-080 records the both-overflow decision defect. With exact binary64 payloads `estimate=0x7fee446cf80dddbc`, `target=0xffe2d7e397966af3`, `SE=0x73620ad22ddb6f38`, and `k=0x4c85c69ac1c7a9ed`, direct subtraction and multiplication both overflow; predecessor scale normalization rounds residual and bound to the same finite value and falsely accepts although the exact represented-input bound is smaller. Public RED `a9a45714eb6266f6b922086112b313060e77c522` includes that strict rejection and the adjacent accepted multiplier `0x4c85c69ac1c7a9ee`; causal exact significand/exponent comparison repair `425e89638d594fdb2f3586d73f021b60a530b456`; changelog `e62706291ad556c6d9078a2bc50dcf3bca5a6feb`; retained by current #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b`. +GAP-080 records the both-overflow decision defect. With exact binary64 payloads `estimate=0x7fee446cf80dddbc`, `target=0xffe2d7e397966af3`, `SE=0x73620ad22ddb6f38`, and `k=0x4c85c69ac1c7a9ed`, direct subtraction and multiplication both overflow; predecessor scale normalization rounds residual and bound to the same finite value and falsely accepts although the exact represented-input bound is smaller. Public RED `a9a45714eb6266f6b922086112b313060e77c522` includes that strict rejection and the adjacent accepted multiplier `0x4c85c69ac1c7a9ee`; causal exact significand/exponent comparison repair `425e89638d594fdb2f3586d73f021b60a530b456`; changelog `e62706291ad556c6d9078a2bc50dcf3bca5a6feb`; retained by current #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6`. -GAP-081 records the finite multiplication-rounded tie defect. For `estimate=1`, `target=0`, `SE=1-2^-27`, and `k=1+2^-27`, exact represented `k·SE = 1-2^-54` is strictly below residual 1, but binary64 multiplication rounds the bound ties-to-even to `1.0`, so predecessor comparison falsely accepts equality. Public RED `23c3262c824609d79dc14d45bb0acb5a54e99a51`; causal repair `6a2add488cfa6bb5ac3cc854a107f287b61bbed5`; edge coverage `3656deb2f2abc0a83027618a823497a829d9227e`; changelog `090f5124588cb184fc2ef644d91355f2b2c2082b`; inherited by current #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b`. +GAP-081 records the finite multiplication-rounded tie defect. For `estimate=1`, `target=0`, `SE=1-2^-27`, and `k=1+2^-27`, exact represented `k·SE = 1-2^-54` is strictly below residual 1, but binary64 multiplication rounds the bound ties-to-even to `1.0`, so predecessor comparison falsely accepts equality. Public RED `23c3262c824609d79dc14d45bb0acb5a54e99a51`; causal repair `6a2add488cfa6bb5ac3cc854a107f287b61bbed5`; edge coverage `3656deb2f2abc0a83027618a823497a829d9227e`; changelog `090f5124588cb184fc2ef644d91355f2b2c2082b`; inherited by current #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6`. -GAP-082 records the complementary finite subtraction-rounded tie. Public RED `58cbc03253997865b7c8ec19fb501fc89c22c851` fixes `estimate=1`, `target=-2^-54`, `SE=1`, `k=1`: the exact represented residual is `1+2^-54`, strictly above the exact unit bound, while binary64 subtraction rounds it to `1.0` and the predecessor falsely accepts. Causal repair `68a6fd98b4f661ad5d4c3c35dc8b9074f2c59281` compares the sign-adjusted error-free subtraction low term with the FMA product low term only on nonzero finite rounded ties whose correction projections differ. Sign-symmetric edge coverage `b2c06512b6d795555269862c1c3d7e4bc67f3f18`; dedicated changelog `c4f752f30121901bfbf4a96b03fdef0ccd9f4bf3`; inherited by current #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b`. +GAP-082 records the complementary finite subtraction-rounded tie. Public RED `58cbc03253997865b7c8ec19fb501fc89c22c851` fixes `estimate=1`, `target=-2^-54`, `SE=1`, `k=1`: the exact represented residual is `1+2^-54`, strictly above the exact unit bound, while binary64 subtraction rounds it to `1.0` and the predecessor falsely accepts. Causal repair `68a6fd98b4f661ad5d4c3c35dc8b9074f2c59281` compares the sign-adjusted error-free subtraction low term with the FMA product low term only on nonzero finite rounded ties whose correction projections differ. Sign-symmetric edge coverage `b2c06512b6d795555269862c1c3d7e4bc67f3f18`; dedicated changelog `c4f752f30121901bfbf4a96b03fdef0ccd9f4bf3`; inherited by current #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6`. -GAP-083 records product correction below binary64 resolution. Public RED `b55c5473c8ee7a70ec2508d14d0755c2aeb38191` uses exact residual `minimum_subnormal`, `k=0x1.8p-538`, and `SE=0x1p-537`: exact represented `k·SE` is `3/4` minimum subnormal, multiplication rounds up, and the `-1/4`-subnormal FMA correction rounds to signed zero. Initial repair `210cebc4980c861ddfd6d098bf1c9d66c8449e72` correctly closed that RED but over-restricted the fallback to subnormal rounded bounds. Concurrent follow-up RED `c77ac440971abc649e6ede35874e5a7439e96797` proves the same failure at the minimum-normal boundary, where exact `(1-2^-54)·2^-1022` rounds to `f64::MIN_POSITIVE` and the correction still projects to zero. Corrected causal repair `772ad8ed3be8d105975bf776e9f9d898774a4a23` removes the rounded-bound-class guard and, only when both finite-tie correction projections are zero, compares the exact represented residual against the exact dyadic `k·SE` product. Exact minimum-subnormal/minimum-normal equality controls remain accepted. CHANGELOG correction `ceb68825f2759637034c2aaea935e50771aa6afc`; research/current #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b`. +GAP-083 records product correction below binary64 resolution. Public RED `b55c5473c8ee7a70ec2508d14d0755c2aeb38191` uses exact residual `minimum_subnormal`, `k=0x1.8p-538`, and `SE=0x1p-537`: exact represented `k·SE` is `3/4` minimum subnormal, multiplication rounds up, and the `-1/4`-subnormal FMA correction rounds to signed zero. Initial repair `210cebc4980c861ddfd6d098bf1c9d66c8449e72` correctly closed that RED but over-restricted the fallback to subnormal rounded bounds. Concurrent follow-up RED `c77ac440971abc649e6ede35874e5a7439e96797` proves the same failure at the minimum-normal boundary, where exact `(1-2^-54)·2^-1022` rounds to `f64::MIN_POSITIVE` and the correction still projects to zero. Corrected causal repair `772ad8ed3be8d105975bf776e9f9d898774a4a23` removes the rounded-bound-class guard and, only when both finite-tie correction projections are zero, compares the exact represented residual against the exact dyadic `k·SE` product. Exact minimum-subnormal/minimum-normal equality controls remain accepted. CHANGELOG correction `ceb68825f2759637034c2aaea935e50771aa6afc`; inherited by current #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6`. -These repairs advance the source-contract portion of GAP-071/GAP-073–GAP-083 but not delivery: exact-head hosted gates, independent review, protected-main integration, and adoption by durable consumers that require v1 provenance remain outstanding. Bare legacy `ValidationReport` remains a backward-compatible compact projection and is not silently treated as v1 provenance. +GAP-084 records a legacy Wilson endpoint-pair boundary-admission defect. For one covered observation in `100_000_000` and `z=10_000`, the canonical represented endpoints are lower `0x3c9c_d2b2_8e2c_a873` and upper `0x3fe0_0000_055e_63b8`. Replacing only the representable positive lower root with exact zero made the predecessor complement-form eliminated identity cancel to numerical equality. Public RED `c9d612f2964eb89ae6070e707c77115a12be84b9`; causal peer-root repair `88512417d931e54ec4eb41581caa0ef20b71df5b`; branch-complete stable evaluation `6a4f89da52cf18f63b2818545f15f72f43099a3f`; symmetry/serde/extreme-boundary contracts `0ce7639bd9f0ab5df2ecd6b24cd57a467e975d26`; changelog `407b3645233e8855cf30487250155ac903d6a4cb`; research/current #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6`. + +These repairs advance the source-contract portion of GAP-071/GAP-073–GAP-084 but not delivery: exact-head hosted gates, independent review, protected-main integration, and adoption by durable consumers that require v1 provenance remain outstanding. Bare legacy `ValidationReport` remains a backward-compatible compact projection and is not silently treated as v1 provenance. Wilson (1927) remains the primary score-interval reference. AERA/APA/NCME (2014) remains the current published testing-standards edition while revision is underway. IEEE 754-2019 and ISO/IEC 60559:2020 remain the published floating-point authorities used for binary64 representation trace; active IEEE P754 is not treated as a published replacement. @@ -165,45 +167,46 @@ Wilson (1927) remains the primary score-interval reference. AERA/APA/NCME (2014) | GAP-042 | Ratio-first logarithm could nearly double an adjacent-float irregular residual growth rate | `verification-pending` | RED `766ddc7a...` + `ln_1p` repair `16f21d9a...` | | GAP-043 | Duplicate known-truth component identities could silently reweight RMSE recovery evidence | `verification-pending` | RED `698f12f5...` + uniqueness repair `2fae4cb2...` | | GAP-044 | Known-truth RMSE alignment/accumulation depended on row order instead of component identity | `verification-pending` | RED `8ad72ac9...` / `5fb93c40...` + repairs `2dd9537e...` / `025dce7f...`; #310 `c6680450...` | -| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b` | -| GAP-046 | Bias SE could reject a representable SEM because raw squared deviations/intermediates overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b` | -| GAP-047 | Generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b` | -| GAP-048 | Mean signed bias could erase a representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b` | +| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6` | +| GAP-046 | Bias SE could reject a representable SEM because raw squared deviations/intermediates overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6` | +| GAP-047 | Generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6` | +| GAP-048 | Mean signed bias could erase a representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6` | | GAP-049 | Stable `Between` recovery could be aliased across occasion indices and reweight RMSE | `verification-pending` | RED `0a03041c...` + repair `ec2c1219...`; #310 `c6680450...` | -| GAP-050 | Zero-multiplier SE-aware acceptance could erase a nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b` | -| GAP-051 | Exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b` | -| GAP-052 | All-covered Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b` | -| GAP-053 | Strict-interior Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b` | -| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b` | -| GAP-055 | Strict-interior Wilson lower endpoint could accept a nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b` | -| GAP-056 | Durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b` | -| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from a generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b` | -| GAP-058 | Generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b` | -| GAP-059 | Generic Monte Carlo summary could materially misstate positive SE relative to `SD / sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b` | -| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b` | -| GAP-061 | Generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b` | -| GAP-062 | Finite-tolerance matching could fail while the pair is deterministically outside every finite tolerance | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b` | -| GAP-063 | Exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b` | -| GAP-064 | Positive point RMSE could carry SE above the declared squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b` | -| GAP-065 | Positive Monte Carlo RMSE could carry spread/SE impossible for nonnegative replications | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b` | -| GAP-066 | RMSE Monte Carlo nearest-rank percentile could exceed total nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b` | -| GAP-067 | Generic nearest-rank percentile endpoint could be individually incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected over-strong repair `2798e4f9...`; causal repair `c7151b49...`; edge `dbef285b...`; changelog `c38a320c...`; research `2bbcbb24...`; #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b` | -| GAP-068 | Distinct generic percentile endpoints could each pass individual radius checks while jointly exceeding the sample squared-deviation budget | `verification-pending` | RED `c4a13826...` + causal repair `cb3f80a2...` + changelog `f727450d...`; #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b` | -| GAP-069 | Two-replication distinct nearest-rank endpoints could exhaust the retained sample while the stored mean or SD remained impossible | `verification-pending` | RED `81bf0d9e...` + causal repair `d48f8fef...` + mean coverage `fb314d8a...` + branch cleanup `440b78d8...` + changelog `45116498...`; #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b` | -| GAP-070 | Stored Wilson bounds could contain empirical coverage while the lower/upper pair could not arise from one Wilson score interval for that same coverage | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...` + complementary edge `c1cb16a7...`; #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b` | -| GAP-071 | Durable Wilson evidence lacked denominator and critical-value/sidedness provenance, preventing exact recomputation from a persisted artifact | `active-repair` | valid carrier RED `6f6e06d2...`; shared count/Wilson authority `ca517ed3...`; `WilsonCoverageEvidenceV1` `31e1ab2b...`; sidedness `e9c63926...`/`fdd24a1a...`; envelope RED `07766cb0...` + `ValidationEvidenceV1` repair `a16f22e6...`; docs/current #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b`; remaining: hosted GREEN/review/main plus durable-consumer adoption | -| GAP-072 | Exact all-covered Wilson evidence could retain a zero lower endpoint even though the canonical non-empty finite-`z²` producer always emits `n/(n+z²) > 0` | `verification-pending` | RED `ce714f07...` + non-force source-restore RCA `18499052...` + repair `72e9d954...` + changelog `e3a2f4a2...`; inherited by #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b` | -| GAP-073 | Durable Wilson count provenance could round one uncovered observation away above binary64's exact-integer range and expose a pointer-width-dependent count schema | `verification-pending` | RED `29d710a5...` + complement/count repair `29968c80...` + fixed-width carrier repair `91d9a3bb...` + exact ratio RED/repair `63ddfdd6...`/`11323c57...`; #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b` | -| GAP-074 | Durable Wilson evidence could correctly retain exact `u64` counts yet pre-round `sample_count` before endpoint projection, shifting strict-interior endpoints or erasing all-covered finite-sample uncertainty | `verification-pending` | RED `f89e2467...` + all-covered edge `1a5180b2...` + stale-oracle correction `6254c498...` + causal reciprocal-scale repair `73bbb5cf...` + changelog `f2b5768b...` + research predecessor `7fc78a59...`; current #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b` | -| GAP-075 | Inexact durable all-covered Wilson evidence could round the complementary miss mass to exact one at extreme finite `z` and erase a representable positive lower endpoint | `verification-pending` | RED `059ce70d...`; transient duplicate-owner implementation `46f91f3f...` excluded; canonical repair `0f478392...`; single-writer cleanup `8e2058f2...`; exact-oracle correction `93d5d208...`; changelog correction `43b6562c...`; research predecessor `b03a719d...`; current #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b` | -| GAP-076 | Exactly representable all-covered Wilson counts could absorb a small positive `z²` in `n + z²` and falsely emit exact `1.0` although a lower binary64 endpoint is representable | `verification-pending` | RED `e0c4ec81...` + causal boundary repair `c9dcb9df...` + below-resolution edge `6140080d...` + changelog `09ebb482...` + research predecessor `fe89c438...`; current #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b` | -| GAP-077 | Exactly representable all-covered Wilson counts could form an inexact partial denominator `n + z²` whose rounded sum shifts the represented-input lower endpoint by one ULP even though neither operand is fully absorbed | `verification-pending` | RED `06e55653...` + causal TwoSum/FMA repair `6c084dbe...` + research `25cc1943...` + changelog `5acc894b...` + predecessor changelog correction `f89e36d1...` + correct-direct-rounding control `80a0a0ad...`; current #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b` | -| GAP-078 | Exact-count all-covered Wilson residual compensation could move a direct quotient by one ULP even when the represented-input rational remains on the same side of the adjacent midpoint | `verification-pending` | RED `d076d344...` + midpoint-selection repair `32314239...` + changelog `a75940c9...` + research predecessor `ef6441f7...`; current #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b` | -| GAP-079 | SE-aware acceptance could underflow a finite positive `k · SE` tolerance to exact zero by dividing `SE` by a much larger estimate/target scale before multiplication | `verification-pending` | RED `76067efc...` + causal direct-finite comparison repair `4ffdf366...` + changelog `d822c0ba...` + retained by current #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b` | -| GAP-080 | SE-aware acceptance both-overflow fallback could normalize an exact strict rejection into an equal rounded residual/bound and falsely accept it | `verification-pending` | RED `a9a45714...` + exact significand/exponent repair `425e8963...` + changelog `e6270629...` + retained by current #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b` | -| GAP-081 | SE-aware acceptance finite/finite multiplication could round an exact strict represented-input rejection into an equal residual/bound and falsely accept it | `verification-pending` | RED `23c3262c...` + tie repair `6a2add48...` + edge coverage `3656deb2...` + changelog `090f5124...` + inherited by current #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b` | -| GAP-082 | SE-aware acceptance finite subtraction could round an exact strict represented-input rejection onto an exact finite bound and falsely accept equality | `verification-pending` | RED `58cbc032...` + causal low-term comparison repair `68a6fd98...` + sign-symmetric edge `b2c06512...` + changelog `c4f752f3...` + inherited by current #488 `d937795d9af55527d6a733f5a2441a2eb1d83b4b` | -| GAP-083 | SE-aware acceptance product correction can fall below binary64 resolution even when the rounded finite bound is subnormal or minimum normal, erasing a strict represented-input rejection | `verification-pending` | RED `b55c5473...` + initial narrow repair `210cebc4...` + minimum-normal RED `c77ac440...` + corrected zero-projection repair `772ad8ed...` + changelog correction `ceb68825...` + research/current #488 `d937795d...` | +| GAP-050 | Zero-multiplier SE-aware acceptance could erase a nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6` | +| GAP-051 | Exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6` | +| GAP-052 | All-covered Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6` | +| GAP-053 | Strict-interior Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6` | +| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6` | +| GAP-055 | Strict-interior Wilson lower endpoint could accept a nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6` | +| GAP-056 | Durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6` | +| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from a generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6` | +| GAP-058 | Generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6` | +| GAP-059 | Generic Monte Carlo summary could materially misstate positive SE relative to `SD / sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6` | +| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6` | +| GAP-061 | Generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6` | +| GAP-062 | Finite-tolerance matching could fail while the pair is deterministically outside every finite tolerance | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6` | +| GAP-063 | Exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6` | +| GAP-064 | Positive point RMSE could carry SE above the declared squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6` | +| GAP-065 | Positive Monte Carlo RMSE could carry spread/SE impossible for nonnegative replications | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6` | +| GAP-066 | RMSE Monte Carlo nearest-rank percentile could exceed total nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6` | +| GAP-067 | Generic nearest-rank percentile endpoint could be individually incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected over-strong repair `2798e4f9...`; causal repair `c7151b49...`; edge `dbef285b...`; changelog `c38a320c...`; research `2bbcbb24...`; #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6` | +| GAP-068 | Distinct generic percentile endpoints could each pass individual radius checks while jointly exceeding the sample squared-deviation budget | `verification-pending` | RED `c4a13826...` + causal repair `cb3f80a2...` + changelog `f727450d...`; #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6` | +| GAP-069 | Two-replication distinct nearest-rank endpoints could exhaust the retained sample while the stored mean or SD remained impossible | `verification-pending` | RED `81bf0d9e...` + causal repair `d48f8fef...` + mean coverage `fb314d8a...` + branch cleanup `440b78d8...` + changelog `45116498...`; #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6` | +| GAP-070 | Stored Wilson bounds could contain empirical coverage while the lower/upper pair could not arise from one Wilson score interval for that same coverage | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...` + complementary edge `c1cb16a7...`; #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6` | +| GAP-071 | Durable Wilson evidence lacked denominator and critical-value/sidedness provenance, preventing exact recomputation from a persisted artifact | `active-repair` | valid carrier RED `6f6e06d2...`; shared count/Wilson authority `ca517ed3...`; `WilsonCoverageEvidenceV1` `31e1ab2b...`; sidedness `e9c63926...`/`fdd24a1a...`; envelope RED `07766cb0...` + `ValidationEvidenceV1` repair `a16f22e6...`; docs/current #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6`; remaining: hosted GREEN/review/main plus durable-consumer adoption | +| GAP-072 | Exact all-covered Wilson evidence could retain a zero lower endpoint even though the canonical non-empty finite-`z²` producer always emits `n/(n+z²) > 0` | `verification-pending` | RED `ce714f07...` + non-force source-restore RCA `18499052...` + repair `72e9d954...` + changelog `e3a2f4a2...`; inherited by #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6` | +| GAP-073 | Durable Wilson count provenance could round one uncovered observation away above binary64's exact-integer range and expose a pointer-width-dependent count schema | `verification-pending` | RED `29d710a5...` + complement/count repair `29968c80...` + fixed-width carrier repair `91d9a3bb...` + exact ratio RED/repair `63ddfdd6...`/`11323c57...`; #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6` | +| GAP-074 | Durable Wilson evidence could correctly retain exact `u64` counts yet pre-round `sample_count` before endpoint projection, shifting strict-interior endpoints or erasing all-covered finite-sample uncertainty | `verification-pending` | RED `f89e2467...` + all-covered edge `1a5180b2...` + stale-oracle correction `6254c498...` + causal reciprocal-scale repair `73bbb5cf...` + changelog `f2b5768b...` + research predecessor `7fc78a59...`; current #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6` | +| GAP-075 | Inexact durable all-covered Wilson evidence could round the complementary miss mass to exact one at extreme finite `z` and erase a representable positive lower endpoint | `verification-pending` | RED `059ce70d...`; transient duplicate-owner implementation `46f91f3f...` excluded; canonical repair `0f478392...`; single-writer cleanup `8e2058f2...`; exact-oracle correction `93d5d208...`; changelog correction `43b6562c...`; research predecessor `b03a719d...`; current #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6` | +| GAP-076 | Exactly representable all-covered Wilson counts could absorb a small positive `z²` in `n + z²` and falsely emit exact `1.0` although a lower binary64 endpoint is representable | `verification-pending` | RED `e0c4ec81...` + causal boundary repair `c9dcb9df...` + below-resolution edge `6140080d...` + changelog `09ebb482...` + research predecessor `fe89c438...`; current #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6` | +| GAP-077 | Exactly representable all-covered Wilson counts could form an inexact partial denominator `n + z²` whose rounded sum shifts the represented-input lower endpoint by one ULP even though neither operand is fully absorbed | `verification-pending` | RED `06e55653...` + causal TwoSum/FMA repair `6c084dbe...` + research `25cc1943...` + changelog `5acc894b...` + predecessor changelog correction `f89e36d1...` + correct-direct-rounding control `80a0a0ad...`; current #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6` | +| GAP-078 | Exact-count all-covered Wilson residual compensation could move a direct quotient by one ULP even when the represented-input rational remains on the same side of the adjacent midpoint | `verification-pending` | RED `d076d344...` + midpoint-selection repair `32314239...` + changelog `a75940c9...` + research predecessor `ef6441f7...`; current #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6` | +| GAP-079 | SE-aware acceptance could underflow a finite positive `k · SE` tolerance to exact zero by dividing `SE` by a much larger estimate/target scale before multiplication | `verification-pending` | RED `76067efc...` + causal direct-finite comparison repair `4ffdf366...` + changelog `d822c0ba...` + retained by current #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6` | +| GAP-080 | SE-aware acceptance both-overflow fallback could normalize an exact strict rejection into an equal rounded residual/bound and falsely accept it | `verification-pending` | RED `a9a45714...` + exact significand/exponent repair `425e8963...` + changelog `e6270629...` + retained by current #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6` | +| GAP-081 | SE-aware acceptance finite/finite multiplication could round an exact strict represented-input rejection into an equal residual/bound and falsely accept it | `verification-pending` | RED `23c3262c...` + tie repair `6a2add48...` + edge coverage `3656deb2...` + changelog `090f5124...` + inherited by current #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6` | +| GAP-082 | SE-aware acceptance finite subtraction could round an exact strict represented-input rejection onto an exact finite bound and falsely accept equality | `verification-pending` | RED `58cbc032...` + causal low-term comparison repair `68a6fd98...` + sign-symmetric edge `b2c06512...` + changelog `c4f752f3...` + inherited by current #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6` | +| GAP-083 | SE-aware acceptance product correction can fall below binary64 resolution even when the rounded finite bound is subnormal or minimum normal, erasing a strict represented-input rejection | `verification-pending` | RED `b55c5473...` + initial narrow repair `210cebc4...` + minimum-normal RED `c77ac440...` + corrected zero-projection repair `772ad8ed...` + changelog correction `ceb68825...` + inherited by current #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6` | +| GAP-084 | Legacy Wilson pair admission could accept an exact-zero/exact-one boundary even though the peer endpoint implied a representable non-boundary root | `verification-pending` | RED `c9d612f2...` + causal peer-root repair `88512417...` + branch-complete stable evaluation `6a4f89da...` + symmetry/serde/extreme-boundary contracts `0ce7639b...` + changelog `407b3645...` + research/current #488 `d57aa89b...` | ## Release gate From 28a516b4a8386e3d098e41921753cd8b2818da25 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 5 Sep 2026 00:20:35 +0900 Subject: [PATCH 178/235] docs(gap): restore exact Wilson repair SHA --- docs/product-technical-gap-baseline.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index aaa46f035..3acf8b770 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -89,7 +89,7 @@ GAP-070 and GAP-072 remain inherited: stored Wilson endpoints must be one cohere GAP-073 retains large-count identity/schema and exact-ratio projection. GAP-074 retains reciprocal-scale evaluation for sample counts that are not exactly representable in binary64. GAP-075 retains the inexact-count all-covered extreme-`z` scale switch and exact-oracle correction. -GAP-076 records the exact-count all-covered near-one denominator-absorption defect. Public RED `e0c4ec81bb455d230259489dc71e23fe33704b1d` fixes `n=1` and represented `z=0x1.0000000000001p-27`; causal repair `c9dcb9df363999bbcbb6fffdc31b68922e8d01d2` performs the complementary miss calculation only after direct false-one collapse; boundary `6140080d2257d0550be479d71371d70e2255c3d0` preserves true exact one below binary64 resolution; changelog `09ebb482851fe7836e738a74395e6424621da9bf`; research predecessor `fe89c43803136ab979912fffa636d2a4f169a73e`. +GAP-076 records the exact-count all-covered near-one denominator-absorption defect. Public RED `e0c4ec81bb455d230259489dc71e23fe33704b1d` fixes `n=1` and represented `z=0x1.0000000000001p-27`; causal repair `c9dcb9df363999bbcbb6fffdc8b6a6d9ae5e762c` performs the complementary miss calculation only after direct false-one collapse; boundary `6140080d2257d0550be479d71371d70e2255c3d0` preserves true exact one below binary64 resolution; changelog `09ebb482851fe7836e738a74395e6424621da9bf`; research predecessor `fe89c43803136ab979912fffa636d2a4f169a73e`. GAP-077 records the ordinary partial-denominator state left after the near-one and complete-absorption repairs. With `n=1` and represented `z=3*2^-28`, represented `z²=9*2^-56`; `1+z²` rounds upward before division, so predecessor direct evaluation emits `0x1.ffffffffffffep-1` although the represented-input rational lower endpoint rounds to `0x1.fffffffffffffp-1`. Public RED `06e556538e171e675c4d8a8287d75052ffc2c4c3` → causal TwoSum/FMA residual repair `6c084dbe607e6c415288c77fa41a4270947cd51e` → research `25cc19436085881602356e7f2609b697b575540c` → dedicated changelog `5acc894b8a4d42cd7af8cdc22a02b61a063f16aa` → predecessor changelog correction `f89e36d1f2a048befb983327c83f5696baf530cc` → correct-direct-rounding control `80a0a0ade16f516bf63907f2a8d5105dbcd9c438`. @@ -113,7 +113,7 @@ Wilson (1927) remains the primary score-interval reference. AERA/APA/NCME (2014) ### #416 — Validation / Analysis Run consolidation -#416 branch head is `aa730c63563eb4a33048d822b581036c8487bd47`; its body distinguishes current exact source repair from later metadata/docs commits. #458/#460/#482/#483/#484/#485/#487 remain fold children until every unique source/test/fixture/contract/doctoring delta is inherited by a conflict-resolving survivor. Child-head CI never transfers to #416. +#416 branch head is `aa730c63563eb4a33048d822b581036c8487bd47`; its body distinguishes current exact source repair from later metadata/docs commits. #458/#460/#482/#483/#484/#485/#487 remain fold children until every unique source/test/fixture/contract/doctoring delta is inherited by a conflict-resolving survivor. Child-head evidence does not transfer to #416. ### #480 — contextual-orchestrator boundary From 110f986f333619d4e904ebddeb3c66122da3517e Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 5 Sep 2026 00:47:55 +0900 Subject: [PATCH 179/235] docs(ddd): add GAP-085 equal-correction projection --- docs/product-technical-gap-baseline.md | 103 +++++++++++++------------ 1 file changed, 53 insertions(+), 50 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 3acf8b770..9cf3e37d8 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-04T15:12:00Z +**Snapshot:** 2026-09-04T15:45:00Z **Protected-main evidence:** `b18bca1c69ef8d1799fcd3af6bf4412498e007c3` **Workspace version:** `0.2.0` @@ -30,7 +30,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6` | true | `main` | Validation Evidence landing vehicle, non-force restacked onto protected #489 by merge commit `a2754592...`. Wilson provenance/count/rounding repairs remain inherited; legacy Wilson boundary pairs now also reject exact 0/1 endpoints when the peer endpoint implies a representable non-boundary root. `accept_within_standard_errors` retains direct finite comparison, bounded tie discrimination, exact dyadic zero-projection comparison, and exact both-overflow comparison. Hosted exact-head gates and independent review remain required. | +| #488 | `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f` | true | `main` | Validation Evidence landing vehicle, non-force restacked onto protected #489. GAP-085 now resolves equal nonzero finite correction projections by comparing the represented subtraction correction with the exact dyadic `k·SE` product roundoff; signed public controls bound the branch. Wilson provenance/count/rounding and prior SE-aware repairs remain inherited. Hosted exact-head gates and independent review remain required. | | #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 | Validation / Analysis Run fold child. Unique evidence must be inherited by a conflict-resolving survivor; child-head CI does not transfer. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | @@ -66,7 +66,7 @@ The clock contract separates event/valid time, assertion time, document time, sy - Generic Validation Evidence RMSE and its delta-method SE normalize before squaring. Exact-zero point RMSE requires exact-zero point RMSE SE. For positive RMSE, the declared producer satisfies `SE(RMSE) <= RMSE / 2`, with a small relative binary64 admission tolerance. - Generic `MonteCarloSummary` is sign-neutral. Zero SD requires zero SE and percentile endpoints equal to the represented mean. Positive SD requires positive SE coherent with represented `SD / sqrt(n)` within a small relative tolerance. Every inclusive nearest-rank endpoint is a retained observation and satisfies `|endpoint - mean| <= SD * sqrt(n - 1)`. Distinct lower/upper endpoint values share the same `(n - 1) * SD²` deviation budget. When `replication_count = 2` and endpoints are numerically distinct, those values exhaust the retained sample and the recorded represented mean/sample SD must match deterministic two-value reconstruction. Equal numeric endpoints do not prove two distinct ranks and are not subjected to that exhaustion rule. - When the generic carrier occupies `ValidationReport::monte_carlo_rmse`, retained replications are nonnegative; positive mean implies `SE(mean) <= mean`, and inclusive nearest-rank endpoints cannot exceed nonnegative sample-sum support `n * mean`. These typed bounds are not imposed on signed metrics such as bias. -- SE-aware acceptance is `|estimate - target| <= k * SE`. For `k = 0` or exact-zero SE, exact recovery is evaluated before any scale reduction; `-0.0` and `+0.0` are one numeric zero-valued scientific state. Finite represented residuals and finite represented `k · SE` bounds are compared directly. On a nonzero finite rounded tie, TEPP compares the error-free subtraction low term—sign-adjusted for the absolute residual—with the FMA product low term when those corrections differ. If both correction projections are zero, zero subtraction correction means the represented residual is exact while the product correction may be below binary64 resolution, so TEPP compares that represented residual against the exact dyadic represented `k · SE` product. Other equal nonzero correction projections retain the ordinary rounded decision rather than claiming a global exact comparator. If both direct operations overflow, exact rational magnitudes represented by the binary64 inputs are compared from integer significands and powers of two; independently rounded normalization is not decision evidence. +- SE-aware acceptance is `|estimate - target| <= k * SE`. For `k = 0` or exact-zero SE, exact recovery is evaluated before any scale reduction; `-0.0` and `+0.0` are one numeric zero-valued scientific state. Finite represented residuals and finite represented `k · SE` bounds are compared directly. On a nonzero finite rounded tie, TEPP compares the error-free subtraction low term—sign-adjusted for the absolute residual—with the FMA product low term when those corrections differ. If both correction projections are zero, zero subtraction correction means the represented residual is exact while the product correction may be below binary64 resolution, so TEPP compares that represented residual against the exact dyadic represented `k · SE` product. If the two correction projections are equal and nonzero, TEPP compares the represented subtraction correction with the exact dyadic product roundoff, with positive and negative signed orderings covered explicitly. If both direct operations overflow, exact rational magnitudes represented by the binary64 inputs are compared from integer significands and powers of two; independently rounded normalization is not decision evidence. - `match_count` is a finite-threshold decision and does not require materializing an unrepresentable absolute residual; `absolute_residuals` remains fail closed when the magnitude itself is requested. - Wilson interval coverage preserves represented-input endpoints through stable rationalized/complementary/compensated forms. Legacy `ValidationReport` endpoint pairs satisfy necessary Wilson coherence and boundary checks, but exact provenance is not inferred from them. For `0 < p < 0.5`, a stored exact-zero lower endpoint is rejected when the peer upper endpoint implies a positive representable lower root under `L = p²(1-U) / [p² + (1-2p)U]`; `p > 0.5` applies the complement-symmetric rule to exact-one upper endpoints. The stable implementation delays squaring so the check itself does not erase a peer root before that final root becomes unrepresentable. A boundary remains admissible when the implied peer root also rounds to zero because the legacy report lacks enough producer provenance for a stronger claim. `WilsonCoverageEvidenceV1` retains fixed-width `u64` `sample_count`/`covered_count`, `critical_value_kind=standard_normal_z`, `interval_sidedness=two_sided`, numeric `z`, represented coverage, and canonical endpoints and validates them by exact recomputation through the single crate-private Wilson authority. Exact all-covered status is integer count equality, not rounded `p == 1`. Count proportions are correctly rounded from exact integers. When covered counts dominate, the smaller uncovered complement is evaluated and reflected. When retained `sample_count` itself is not exactly representable in binary64, Wilson scale terms use correctly rounded reciprocal `1/n`; its all-covered path uses complementary miss mass for `z²/n <= 1` and direct reciprocal evaluation for `z²/n > 1`. For an exactly representable all-covered count, a false exact-one quotient retains the boundary-local complementary repair. Otherwise, if `n + z²` is inexact, the canonical writer recovers the TwoSum denominator residual and FMA quotient residual, identifies the adjacent binary64 candidate from residual direction, and changes the direct quotient only when the exact represented-input rational lies beyond that candidate's midpoint; exact midpoint selection is ties-to-even. This avoids both under-correction and residual double-rounding overcorrection without claiming globally correctly rounded Wilson rearrangements. Smaller miss mass genuinely below binary64 resolution remains exact one. `ValidationEvidenceV1` binds provenance to the legacy report projection without breaking existing report callers. - Durable and human-facing Validation Evidence must preserve producing-metric invariants on explicit validation, serde ingress/egress, and human projection. Missing v1 provenance is never synthesized from endpoint algebra. @@ -83,7 +83,7 @@ The clock contract separates event/valid time, assertion time, document time, sy ### #488 — Validation Evidence -#488 is the generic Validation Evidence landing vehicle at exact head `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6`. It remains distinct from Longitudinal Modeling and does not consume mutable fast-mlsirm source. The branch was non-force merge-restacked onto protected #489 by `a2754592987be9e88941d220565c45e34f621a4e`, preserving its complete ancestry and inheriting the protected workflow-load repair. +#488 is the generic Validation Evidence landing vehicle at exact head `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f`. It remains distinct from Longitudinal Modeling and does not consume mutable fast-mlsirm source. The branch was non-force merge-restacked onto protected #489 by `a2754592987be9e88941d220565c45e34f621a4e`, preserving its complete ancestry and inheriting the protected workflow-load repair. GAP-070 and GAP-072 remain inherited: stored Wilson endpoints must be one coherent score interval, and exact all-covered evidence cannot use a zero lower endpoint. GAP-071 has advanced from design-only to source implementation. Corrected carrier RED `6f6e06d2...` requires a versioned denominator/critical-value carrier; `ca517ed3...` establishes one private covered-count/Wilson-from-counts authority; `31e1ab2b...` adds `WilsonCoverageEvidenceV1`; `e9c63926...`/`fdd24a1a...` bind standard-normal/two-sided semantics. Envelope RED `07766cb0...` and repair `a16f22e6...` add `ValidationEvidenceV1`, which cross-validates the legacy report projection against the recomputable carrier. @@ -95,19 +95,21 @@ GAP-077 records the ordinary partial-denominator state left after the near-one a GAP-078 records the opposite residual-rounding state. With `n=3`, represented `z=0x1.6a09e667f3bcdp+492`, and represented `z²=0x1.0000000000001p+985`, the rounded denominator fully absorbs `n`, but the exact represented-input rational and the direct rounded-denominator quotient both round to `0x1.7ffffffffffffp-984`. The predecessor additive residual correction forced `0x1.7fffffffffffep-984`, one ULP too low. Public RED `d076d344cb3cd3a768e7a5c2d8d7bd9039c657e9` → midpoint-selection repair `32314239754204158f228ec67a0771abf4d39b45` → changelog `a75940c955633d5eb92f227d79e64acd0ef46ea8` → research predecessor `ef6441f786d64e6dca198d0d6140838c391f0659`. -GAP-079 records SE-aware acceptance scale-first underflow. For `estimate=1.0e308`, `target=next_down(estimate)`, `SE=2.2e-16`, and `k=1.0e308`, the represented residual (`1.99584030953472e292`) is within the represented finite bound (`2.2e292`), but the predecessor formed `SE / scale == 0.0` before multiplication and falsely rejected the recovery. Public RED `76067efce44419c27687b8673cb76092c90fb5a5` includes the admissible case and a nearby rejection at `SE=1.8e-16`; causal repair `4ffdf3665b3bbafd3b0bbf06b599fe71498169ab`; changelog `d822c0ba7fa548c3283e462323c56d8f5705de31`; retained by current #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6`. +GAP-079 records SE-aware acceptance scale-first underflow. For `estimate=1.0e308`, `target=next_down(estimate)`, `SE=2.2e-16`, and `k=1.0e308`, the represented residual (`1.99584030953472e292`) is within the represented finite bound (`2.2e292`), but the predecessor formed `SE / scale == 0.0` before multiplication and falsely rejected the recovery. Public RED `76067efce44419c27687b8673cb76092c90fb5a5` includes the admissible case and a nearby rejection at `SE=1.8e-16`; causal repair `4ffdf3665b3bbafd3b0bbf06b599fe71498169ab`; changelog `d822c0ba7fa548c3283e462323c56d8f5705de31`; retained by current #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f`. -GAP-080 records the both-overflow decision defect. With exact binary64 payloads `estimate=0x7fee446cf80dddbc`, `target=0xffe2d7e397966af3`, `SE=0x73620ad22ddb6f38`, and `k=0x4c85c69ac1c7a9ed`, direct subtraction and multiplication both overflow; predecessor scale normalization rounds residual and bound to the same finite value and falsely accepts although the exact represented-input bound is smaller. Public RED `a9a45714eb6266f6b922086112b313060e77c522` includes that strict rejection and the adjacent accepted multiplier `0x4c85c69ac1c7a9ee`; causal exact significand/exponent comparison repair `425e89638d594fdb2f3586d73f021b60a530b456`; changelog `e62706291ad556c6d9078a2bc50dcf3bca5a6feb`; retained by current #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6`. +GAP-080 records the both-overflow decision defect. With exact binary64 payloads `estimate=0x7fee446cf80dddbc`, `target=0xffe2d7e397966af3`, `SE=0x73620ad22ddb6f38`, and `k=0x4c85c69ac1c7a9ed`, direct subtraction and multiplication both overflow; predecessor scale normalization rounds residual and bound to the same finite value and falsely accepts although the exact represented-input bound is smaller. Public RED `a9a45714eb6266f6b922086112b313060e77c522` includes that strict rejection and the adjacent accepted multiplier `0x4c85c69ac1c7a9ee`; causal exact significand/exponent comparison repair `425e89638d594fdb2f3586d73f021b60a530b456`; changelog `e62706291ad556c6d9078a2bc50dcf3bca5a6feb`; retained by current #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f`. -GAP-081 records the finite multiplication-rounded tie defect. For `estimate=1`, `target=0`, `SE=1-2^-27`, and `k=1+2^-27`, exact represented `k·SE = 1-2^-54` is strictly below residual 1, but binary64 multiplication rounds the bound ties-to-even to `1.0`, so predecessor comparison falsely accepts equality. Public RED `23c3262c824609d79dc14d45bb0acb5a54e99a51`; causal repair `6a2add488cfa6bb5ac3cc854a107f287b61bbed5`; edge coverage `3656deb2f2abc0a83027618a823497a829d9227e`; changelog `090f5124588cb184fc2ef644d91355f2b2c2082b`; inherited by current #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6`. +GAP-081 records the finite multiplication-rounded tie defect. For `estimate=1`, `target=0`, `SE=1-2^-27`, and `k=1+2^-27`, exact represented `k·SE = 1-2^-54` is strictly below residual 1, but binary64 multiplication rounds the bound ties-to-even to `1.0`, so predecessor comparison falsely accepts equality. Public RED `23c3262c824609d79dc14d45bb0acb5a54e99a51`; causal repair `6a2add488cfa6bb5ac3cc854a107f287b61bbed5`; edge coverage `3656deb2f2abc0a83027618a823497a829d9227e`; changelog `090f5124588cb184fc2ef644d91355f2b2c2082b`; inherited by current #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f`. -GAP-082 records the complementary finite subtraction-rounded tie. Public RED `58cbc03253997865b7c8ec19fb501fc89c22c851` fixes `estimate=1`, `target=-2^-54`, `SE=1`, `k=1`: the exact represented residual is `1+2^-54`, strictly above the exact unit bound, while binary64 subtraction rounds it to `1.0` and the predecessor falsely accepts. Causal repair `68a6fd98b4f661ad5d4c3c35dc8b9074f2c59281` compares the sign-adjusted error-free subtraction low term with the FMA product low term only on nonzero finite rounded ties whose correction projections differ. Sign-symmetric edge coverage `b2c06512b6d795555269862c1c3d7e4bc67f3f18`; dedicated changelog `c4f752f30121901bfbf4a96b03fdef0ccd9f4bf3`; inherited by current #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6`. +GAP-082 records the complementary finite subtraction-rounded tie. Public RED `58cbc03253997865b7c8ec19fb501fc89c22c851` fixes `estimate=1`, `target=-2^-54`, `SE=1`, `k=1`: the exact represented residual is `1+2^-54`, strictly above the exact unit bound, while binary64 subtraction rounds it to `1.0` and the predecessor falsely accepts. Causal repair `68a6fd98b4f661ad5d4c3c35dc8b9074f2c59281` compares the sign-adjusted error-free subtraction low term with the FMA product low term only on nonzero finite rounded ties whose correction projections differ. Sign-symmetric edge coverage `b2c06512b6d795555269862c1c3d7e4bc67f3f18`; dedicated changelog `c4f752f30121901bfbf4a96b03fdef0ccd9f4bf3`; inherited by current #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f`. -GAP-083 records product correction below binary64 resolution. Public RED `b55c5473c8ee7a70ec2508d14d0755c2aeb38191` uses exact residual `minimum_subnormal`, `k=0x1.8p-538`, and `SE=0x1p-537`: exact represented `k·SE` is `3/4` minimum subnormal, multiplication rounds up, and the `-1/4`-subnormal FMA correction rounds to signed zero. Initial repair `210cebc4980c861ddfd6d098bf1c9d66c8449e72` correctly closed that RED but over-restricted the fallback to subnormal rounded bounds. Concurrent follow-up RED `c77ac440971abc649e6ede35874e5a7439e96797` proves the same failure at the minimum-normal boundary, where exact `(1-2^-54)·2^-1022` rounds to `f64::MIN_POSITIVE` and the correction still projects to zero. Corrected causal repair `772ad8ed3be8d105975bf776e9f9d898774a4a23` removes the rounded-bound-class guard and, only when both finite-tie correction projections are zero, compares the exact represented residual against the exact dyadic `k·SE` product. Exact minimum-subnormal/minimum-normal equality controls remain accepted. CHANGELOG correction `ceb68825f2759637034c2aaea935e50771aa6afc`; inherited by current #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6`. +GAP-083 records product correction below binary64 resolution. Public RED `b55c5473c8ee7a70ec2508d14d0755c2aeb38191` uses exact residual `minimum_subnormal`, `k=0x1.8p-538`, and `SE=0x1p-537`: exact represented `k·SE` is `3/4` minimum subnormal, multiplication rounds up, and the `-1/4`-subnormal FMA correction rounds to signed zero. Initial repair `210cebc4980c861ddfd6d098bf1c9d66c8449e72` correctly closed that RED but over-restricted the fallback to subnormal rounded bounds. Concurrent follow-up RED `c77ac440971abc649e6ede35874e5a7439e96797` proves the same failure at the minimum-normal boundary, where exact `(1-2^-54)·2^-1022` rounds to `f64::MIN_POSITIVE` and the correction still projects to zero. Corrected causal repair `772ad8ed3be8d105975bf776e9f9d898774a4a23` removes the rounded-bound-class guard and, only when both finite-tie correction projections are zero, compares the exact represented residual against the exact dyadic `k·SE` product. Exact minimum-subnormal/minimum-normal equality controls remain accepted. CHANGELOG correction `ceb68825f2759637034c2aaea935e50771aa6afc`; inherited by current #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f`. -GAP-084 records a legacy Wilson endpoint-pair boundary-admission defect. For one covered observation in `100_000_000` and `z=10_000`, the canonical represented endpoints are lower `0x3c9c_d2b2_8e2c_a873` and upper `0x3fe0_0000_055e_63b8`. Replacing only the representable positive lower root with exact zero made the predecessor complement-form eliminated identity cancel to numerical equality. Public RED `c9d612f2964eb89ae6070e707c77115a12be84b9`; causal peer-root repair `88512417d931e54ec4eb41581caa0ef20b71df5b`; branch-complete stable evaluation `6a4f89da52cf18f63b2818545f15f72f43099a3f`; symmetry/serde/extreme-boundary contracts `0ce7639bd9f0ab5df2ecd6b24cd57a467e975d26`; changelog `407b3645233e8855cf30487250155ac903d6a4cb`; research/current #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6`. +GAP-084 records a legacy Wilson endpoint-pair boundary-admission defect. For one covered observation in `100_000_000` and `z=10_000`, the canonical represented endpoints are lower `0x3c9c_d2b2_8e2c_a873` and upper `0x3fe0_0000_055e_63b8`. Replacing only the representable positive lower root with exact zero made the predecessor complement-form eliminated identity cancel to numerical equality. Public RED `c9d612f2964eb89ae6070e707c77115a12be84b9`; causal peer-root repair `88512417d931e54ec4eb41581caa0ef20b71df5b`; branch-complete stable evaluation `6a4f89da52cf18f63b2818545f15f72f43099a3f`; symmetry/serde/extreme-boundary contracts `0ce7639bd9f0ab5df2ecd6b24cd57a467e975d26`; changelog `407b3645233e8855cf30487250155ac903d6a4cb`; inherited by current #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f`. -These repairs advance the source-contract portion of GAP-071/GAP-073–GAP-084 but not delivery: exact-head hosted gates, independent review, protected-main integration, and adoption by durable consumers that require v1 provenance remain outstanding. Bare legacy `ValidationReport` remains a backward-compatible compact projection and is not silently treated as v1 provenance. +GAP-085 records the remaining equal-nonzero correction-projection defect in SE-aware acceptance. Public RED `35ea85ba5c049e3736e8549445bc799638cc6555` fixes a finite rounded tie where the subtraction low term and FMA product correction both project to the same positive subnormal while the exact represented product correction is slightly smaller, so the predecessor falsely accepts equality. The same contract carries the admissible side; signed edge `b463a991adc6ff98fa09f91eb428cda9e0ff1255` covers a negative equal projection. Causal exact-roundoff repair `7d597a18e043f3619b893981823b9be15ddb823c`; branch-scope refinement `ca8c2b86a81cfa6e99a10bdcc141fc10d49ec011`; changelog `702eec2fe211017785f848fe1b23abe7ee60c5ec`; research/TRACEABILITY current #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f`. + +These repairs advance the source-contract portion of GAP-071/GAP-073–GAP-085 but not delivery: exact-head hosted gates, independent review, protected-main integration, and adoption by durable consumers that require v1 provenance remain outstanding. Bare legacy `ValidationReport` remains a backward-compatible compact projection and is not silently treated as v1 provenance. Wilson (1927) remains the primary score-interval reference. AERA/APA/NCME (2014) remains the current published testing-standards edition while revision is underway. IEEE 754-2019 and ISO/IEC 60559:2020 remain the published floating-point authorities used for binary64 representation trace; active IEEE P754 is not treated as a published replacement. @@ -167,46 +169,47 @@ Wilson (1927) remains the primary score-interval reference. AERA/APA/NCME (2014) | GAP-042 | Ratio-first logarithm could nearly double an adjacent-float irregular residual growth rate | `verification-pending` | RED `766ddc7a...` + `ln_1p` repair `16f21d9a...` | | GAP-043 | Duplicate known-truth component identities could silently reweight RMSE recovery evidence | `verification-pending` | RED `698f12f5...` + uniqueness repair `2fae4cb2...` | | GAP-044 | Known-truth RMSE alignment/accumulation depended on row order instead of component identity | `verification-pending` | RED `8ad72ac9...` / `5fb93c40...` + repairs `2dd9537e...` / `025dce7f...`; #310 `c6680450...` | -| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6` | -| GAP-046 | Bias SE could reject a representable SEM because raw squared deviations/intermediates overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6` | -| GAP-047 | Generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6` | -| GAP-048 | Mean signed bias could erase a representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6` | +| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f` | +| GAP-046 | Bias SE could reject a representable SEM because raw squared deviations/intermediates overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f` | +| GAP-047 | Generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f` | +| GAP-048 | Mean signed bias could erase a representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f` | | GAP-049 | Stable `Between` recovery could be aliased across occasion indices and reweight RMSE | `verification-pending` | RED `0a03041c...` + repair `ec2c1219...`; #310 `c6680450...` | -| GAP-050 | Zero-multiplier SE-aware acceptance could erase a nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6` | -| GAP-051 | Exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6` | -| GAP-052 | All-covered Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6` | -| GAP-053 | Strict-interior Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6` | -| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6` | -| GAP-055 | Strict-interior Wilson lower endpoint could accept a nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6` | -| GAP-056 | Durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6` | -| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from a generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6` | -| GAP-058 | Generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6` | -| GAP-059 | Generic Monte Carlo summary could materially misstate positive SE relative to `SD / sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6` | -| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6` | -| GAP-061 | Generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6` | -| GAP-062 | Finite-tolerance matching could fail while the pair is deterministically outside every finite tolerance | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6` | -| GAP-063 | Exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6` | -| GAP-064 | Positive point RMSE could carry SE above the declared squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6` | -| GAP-065 | Positive Monte Carlo RMSE could carry spread/SE impossible for nonnegative replications | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6` | -| GAP-066 | RMSE Monte Carlo nearest-rank percentile could exceed total nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6` | -| GAP-067 | Generic nearest-rank percentile endpoint could be individually incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected over-strong repair `2798e4f9...`; causal repair `c7151b49...`; edge `dbef285b...`; changelog `c38a320c...`; research `2bbcbb24...`; #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6` | -| GAP-068 | Distinct generic percentile endpoints could each pass individual radius checks while jointly exceeding the sample squared-deviation budget | `verification-pending` | RED `c4a13826...` + causal repair `cb3f80a2...` + changelog `f727450d...`; #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6` | -| GAP-069 | Two-replication distinct nearest-rank endpoints could exhaust the retained sample while the stored mean or SD remained impossible | `verification-pending` | RED `81bf0d9e...` + causal repair `d48f8fef...` + mean coverage `fb314d8a...` + branch cleanup `440b78d8...` + changelog `45116498...`; #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6` | -| GAP-070 | Stored Wilson bounds could contain empirical coverage while the lower/upper pair could not arise from one Wilson score interval for that same coverage | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...` + complementary edge `c1cb16a7...`; #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6` | -| GAP-071 | Durable Wilson evidence lacked denominator and critical-value/sidedness provenance, preventing exact recomputation from a persisted artifact | `active-repair` | valid carrier RED `6f6e06d2...`; shared count/Wilson authority `ca517ed3...`; `WilsonCoverageEvidenceV1` `31e1ab2b...`; sidedness `e9c63926...`/`fdd24a1a...`; envelope RED `07766cb0...` + `ValidationEvidenceV1` repair `a16f22e6...`; docs/current #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6`; remaining: hosted GREEN/review/main plus durable-consumer adoption | -| GAP-072 | Exact all-covered Wilson evidence could retain a zero lower endpoint even though the canonical non-empty finite-`z²` producer always emits `n/(n+z²) > 0` | `verification-pending` | RED `ce714f07...` + non-force source-restore RCA `18499052...` + repair `72e9d954...` + changelog `e3a2f4a2...`; inherited by #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6` | -| GAP-073 | Durable Wilson count provenance could round one uncovered observation away above binary64's exact-integer range and expose a pointer-width-dependent count schema | `verification-pending` | RED `29d710a5...` + complement/count repair `29968c80...` + fixed-width carrier repair `91d9a3bb...` + exact ratio RED/repair `63ddfdd6...`/`11323c57...`; #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6` | -| GAP-074 | Durable Wilson evidence could correctly retain exact `u64` counts yet pre-round `sample_count` before endpoint projection, shifting strict-interior endpoints or erasing all-covered finite-sample uncertainty | `verification-pending` | RED `f89e2467...` + all-covered edge `1a5180b2...` + stale-oracle correction `6254c498...` + causal reciprocal-scale repair `73bbb5cf...` + changelog `f2b5768b...` + research predecessor `7fc78a59...`; current #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6` | -| GAP-075 | Inexact durable all-covered Wilson evidence could round the complementary miss mass to exact one at extreme finite `z` and erase a representable positive lower endpoint | `verification-pending` | RED `059ce70d...`; transient duplicate-owner implementation `46f91f3f...` excluded; canonical repair `0f478392...`; single-writer cleanup `8e2058f2...`; exact-oracle correction `93d5d208...`; changelog correction `43b6562c...`; research predecessor `b03a719d...`; current #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6` | -| GAP-076 | Exactly representable all-covered Wilson counts could absorb a small positive `z²` in `n + z²` and falsely emit exact `1.0` although a lower binary64 endpoint is representable | `verification-pending` | RED `e0c4ec81...` + causal boundary repair `c9dcb9df...` + below-resolution edge `6140080d...` + changelog `09ebb482...` + research predecessor `fe89c438...`; current #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6` | -| GAP-077 | Exactly representable all-covered Wilson counts could form an inexact partial denominator `n + z²` whose rounded sum shifts the represented-input lower endpoint by one ULP even though neither operand is fully absorbed | `verification-pending` | RED `06e55653...` + causal TwoSum/FMA repair `6c084dbe...` + research `25cc1943...` + changelog `5acc894b...` + predecessor changelog correction `f89e36d1...` + correct-direct-rounding control `80a0a0ad...`; current #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6` | -| GAP-078 | Exact-count all-covered Wilson residual compensation could move a direct quotient by one ULP even when the represented-input rational remains on the same side of the adjacent midpoint | `verification-pending` | RED `d076d344...` + midpoint-selection repair `32314239...` + changelog `a75940c9...` + research predecessor `ef6441f7...`; current #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6` | -| GAP-079 | SE-aware acceptance could underflow a finite positive `k · SE` tolerance to exact zero by dividing `SE` by a much larger estimate/target scale before multiplication | `verification-pending` | RED `76067efc...` + causal direct-finite comparison repair `4ffdf366...` + changelog `d822c0ba...` + retained by current #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6` | -| GAP-080 | SE-aware acceptance both-overflow fallback could normalize an exact strict rejection into an equal rounded residual/bound and falsely accept it | `verification-pending` | RED `a9a45714...` + exact significand/exponent repair `425e8963...` + changelog `e6270629...` + retained by current #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6` | -| GAP-081 | SE-aware acceptance finite/finite multiplication could round an exact strict represented-input rejection into an equal residual/bound and falsely accept it | `verification-pending` | RED `23c3262c...` + tie repair `6a2add48...` + edge coverage `3656deb2...` + changelog `090f5124...` + inherited by current #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6` | -| GAP-082 | SE-aware acceptance finite subtraction could round an exact strict represented-input rejection onto an exact finite bound and falsely accept equality | `verification-pending` | RED `58cbc032...` + causal low-term comparison repair `68a6fd98...` + sign-symmetric edge `b2c06512...` + changelog `c4f752f3...` + inherited by current #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6` | -| GAP-083 | SE-aware acceptance product correction can fall below binary64 resolution even when the rounded finite bound is subnormal or minimum normal, erasing a strict represented-input rejection | `verification-pending` | RED `b55c5473...` + initial narrow repair `210cebc4...` + minimum-normal RED `c77ac440...` + corrected zero-projection repair `772ad8ed...` + changelog correction `ceb68825...` + inherited by current #488 `d57aa89bea55e691f5862ff1d3b35e4fb55e35a6` | -| GAP-084 | Legacy Wilson pair admission could accept an exact-zero/exact-one boundary even though the peer endpoint implied a representable non-boundary root | `verification-pending` | RED `c9d612f2...` + causal peer-root repair `88512417...` + branch-complete stable evaluation `6a4f89da...` + symmetry/serde/extreme-boundary contracts `0ce7639b...` + changelog `407b3645...` + research/current #488 `d57aa89b...` | +| GAP-050 | Zero-multiplier SE-aware acceptance could erase a nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f` | +| GAP-051 | Exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f` | +| GAP-052 | All-covered Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f` | +| GAP-053 | Strict-interior Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f` | +| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f` | +| GAP-055 | Strict-interior Wilson lower endpoint could accept a nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f` | +| GAP-056 | Durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f` | +| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from a generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f` | +| GAP-058 | Generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f` | +| GAP-059 | Generic Monte Carlo summary could materially misstate positive SE relative to `SD / sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f` | +| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f` | +| GAP-061 | Generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f` | +| GAP-062 | Finite-tolerance matching could fail while the pair is deterministically outside every finite tolerance | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f` | +| GAP-063 | Exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f` | +| GAP-064 | Positive point RMSE could carry SE above the declared squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f` | +| GAP-065 | Positive Monte Carlo RMSE could carry spread/SE impossible for nonnegative replications | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f` | +| GAP-066 | RMSE Monte Carlo nearest-rank percentile could exceed total nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f` | +| GAP-067 | Generic nearest-rank percentile endpoint could be individually incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected over-strong repair `2798e4f9...`; causal repair `c7151b49...`; edge `dbef285b...`; changelog `c38a320c...`; research `2bbcbb24...`; #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f` | +| GAP-068 | Distinct generic percentile endpoints could each pass individual radius checks while jointly exceeding the sample squared-deviation budget | `verification-pending` | RED `c4a13826...` + causal repair `cb3f80a2...` + changelog `f727450d...`; #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f` | +| GAP-069 | Two-replication distinct nearest-rank endpoints could exhaust the retained sample while the stored mean or SD remained impossible | `verification-pending` | RED `81bf0d9e...` + causal repair `d48f8fef...` + mean coverage `fb314d8a...` + branch cleanup `440b78d8...` + changelog `45116498...`; #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f` | +| GAP-070 | Stored Wilson bounds could contain empirical coverage while the lower/upper pair could not arise from one Wilson score interval for that same coverage | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...` + complementary edge `c1cb16a7...`; #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f` | +| GAP-071 | Durable Wilson evidence lacked denominator and critical-value/sidedness provenance, preventing exact recomputation from a persisted artifact | `active-repair` | valid carrier RED `6f6e06d2...`; shared count/Wilson authority `ca517ed3...`; `WilsonCoverageEvidenceV1` `31e1ab2b...`; sidedness `e9c63926...`/`fdd24a1a...`; envelope RED `07766cb0...` + `ValidationEvidenceV1` repair `a16f22e6...`; docs/current #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f`; remaining: hosted GREEN/review/main plus durable-consumer adoption | +| GAP-072 | Exact all-covered Wilson evidence could retain a zero lower endpoint even though the canonical non-empty finite-`z²` producer always emits `n/(n+z²) > 0` | `verification-pending` | RED `ce714f07...` + non-force source-restore RCA `18499052...` + repair `72e9d954...` + changelog `e3a2f4a2...`; inherited by #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f` | +| GAP-073 | Durable Wilson count provenance could round one uncovered observation away above binary64's exact-integer range and expose a pointer-width-dependent count schema | `verification-pending` | RED `29d710a5...` + complement/count repair `29968c80...` + fixed-width carrier repair `91d9a3bb...` + exact ratio RED/repair `63ddfdd6...`/`11323c57...`; #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f` | +| GAP-074 | Durable Wilson evidence could correctly retain exact `u64` counts yet pre-round `sample_count` before endpoint projection, shifting strict-interior endpoints or erasing all-covered finite-sample uncertainty | `verification-pending` | RED `f89e2467...` + all-covered edge `1a5180b2...` + stale-oracle correction `6254c498...` + causal reciprocal-scale repair `73bbb5cf...` + changelog `f2b5768b...` + research predecessor `7fc78a59...`; current #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f` | +| GAP-075 | Inexact durable all-covered Wilson evidence could round the complementary miss mass to exact one at extreme finite `z` and erase a representable positive lower endpoint | `verification-pending` | RED `059ce70d...`; transient duplicate-owner implementation `46f91f3f...` excluded; canonical repair `0f478392...`; single-writer cleanup `8e2058f2...`; exact-oracle correction `93d5d208...`; changelog correction `43b6562c...`; research predecessor `b03a719d...`; current #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f` | +| GAP-076 | Exactly representable all-covered Wilson counts could absorb a small positive `z²` in `n + z²` and falsely emit exact `1.0` although a lower binary64 endpoint is representable | `verification-pending` | RED `e0c4ec81...` + causal boundary repair `c9dcb9df...` + below-resolution edge `6140080d...` + changelog `09ebb482...` + research predecessor `fe89c438...`; current #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f` | +| GAP-077 | Exactly representable all-covered Wilson counts could form an inexact partial denominator `n + z²` whose rounded sum shifts the represented-input lower endpoint by one ULP even though neither operand is fully absorbed | `verification-pending` | RED `06e55653...` + causal TwoSum/FMA repair `6c084dbe...` + research `25cc1943...` + changelog `5acc894b...` + predecessor changelog correction `f89e36d1...` + correct-direct-rounding control `80a0a0ad...`; current #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f` | +| GAP-078 | Exact-count all-covered Wilson residual compensation could move a direct quotient by one ULP even when the represented-input rational remains on the same side of the adjacent midpoint | `verification-pending` | RED `d076d344...` + midpoint-selection repair `32314239...` + changelog `a75940c9...` + research predecessor `ef6441f7...`; current #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f` | +| GAP-079 | SE-aware acceptance could underflow a finite positive `k · SE` tolerance to exact zero by dividing `SE` by a much larger estimate/target scale before multiplication | `verification-pending` | RED `76067efc...` + causal direct-finite comparison repair `4ffdf366...` + changelog `d822c0ba...` + retained by current #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f` | +| GAP-080 | SE-aware acceptance both-overflow fallback could normalize an exact strict rejection into an equal rounded residual/bound and falsely accept it | `verification-pending` | RED `a9a45714...` + exact significand/exponent repair `425e8963...` + changelog `e6270629...` + retained by current #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f` | +| GAP-081 | SE-aware acceptance finite/finite multiplication could round an exact strict represented-input rejection into an equal residual/bound and falsely accept it | `verification-pending` | RED `23c3262c...` + tie repair `6a2add48...` + edge coverage `3656deb2...` + changelog `090f5124...` + inherited by current #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f` | +| GAP-082 | SE-aware acceptance finite subtraction could round an exact strict represented-input rejection onto an exact finite bound and falsely accept equality | `verification-pending` | RED `58cbc032...` + causal low-term comparison repair `68a6fd98...` + sign-symmetric edge `b2c06512...` + changelog `c4f752f3...` + inherited by current #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f` | +| GAP-083 | SE-aware acceptance product correction can fall below binary64 resolution even when the rounded finite bound is subnormal or minimum normal, erasing a strict represented-input rejection | `verification-pending` | RED `b55c5473...` + initial narrow repair `210cebc4...` + minimum-normal RED `c77ac440...` + corrected zero-projection repair `772ad8ed...` + changelog correction `ceb68825...` + inherited by current #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f` | +| GAP-084 | Legacy Wilson pair admission could accept an exact-zero/exact-one boundary even though the peer endpoint implied a representable non-boundary root | `verification-pending` | RED `c9d612f2...` + causal peer-root repair `88512417...` + branch-complete stable evaluation `6a4f89da...` + symmetry/serde/extreme-boundary contracts `0ce7639b...` + changelog `407b3645...` + inherited by current #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f` | +| GAP-085 | Equal nonzero SE-aware subtraction/FMA correction projections could conceal the exact represented-input ordering and turn a strict decision into rounded equality | `verification-pending` | RED `35ea85ba...` + exact product-roundoff repair `7d597a18...` + signed edge `b463a991...` + branch-scope refinement `ca8c2b86...` + changelog `702eec2f...` + research/current #488 `21b1f0e7...` | ## Release gate From 72dd03f9648be26b7b068915d1c32e8ba3c9b794 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 5 Sep 2026 01:11:52 +0900 Subject: [PATCH 180/235] docs(ddd): trace representable bias overflow cancellation --- docs/product-technical-gap-baseline.md | 123 ++++++++++--------------- 1 file changed, 49 insertions(+), 74 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 9cf3e37d8..1008a0ff0 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-04T15:45:00Z +**Snapshot:** 2026-09-04T16:10:00Z **Protected-main evidence:** `b18bca1c69ef8d1799fcd3af6bf4412498e007c3` **Workspace version:** `0.2.0` @@ -30,7 +30,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f` | true | `main` | Validation Evidence landing vehicle, non-force restacked onto protected #489. GAP-085 now resolves equal nonzero finite correction projections by comparing the represented subtraction correction with the exact dyadic `k·SE` product roundoff; signed public controls bound the branch. Wilson provenance/count/rounding and prior SE-aware repairs remain inherited. Hosted exact-head gates and independent review remain required. | +| #488 | `8c34e2f1657f319d925222851570d103759863b4` | true | `main` | Validation Evidence landing vehicle, non-force restacked onto protected #489. GAP-086 preserves representable mean signed bias when pairwise residual materialization overflows but the represented numerator cancels; prior Wilson, provenance, Monte Carlo, RMSE/SE, matching, serde/projection, and GAP-079–085 repairs remain inherited. Hosted exact-head gates and independent review remain required. | | #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 | Validation / Analysis Run fold child. Unique evidence must be inherited by a conflict-resolving survivor; child-head CI does not transfer. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | @@ -62,13 +62,13 @@ The clock contract separates event/valid time, assertion time, document time, sy - Row arrival order is not scientific evidence. Fixed admitted observations must produce bit-identical means/centered results under permutation wherever the contract claims deterministic CPU `f64` reference behavior. - Known-truth component recovery follows bounded-context identity: stable `Between` is unit-level and uses canonical `occasion_index = 0`; `Within` retains actual `(unit, occasion)` identity. Duplicate identities or stable-Between occasion aliases are not weights. - A representable final scientific estimand is not rejected solely because an avoidable intermediate binary64 operation overflows/underflows. False exact 0/1/non-finite endpoints, erased finite bounds, and cancellation residues are not accepted when an equivalent operation order preserves the represented estimand or decision. -- Mean signed bias and bias SE remain Validation Evidence performance measures over admitted recovery units; representable cancellation/SEM must survive avoidable overflow/underflow while mathematically nonzero finals below binary64 range fail closed. +- Mean signed bias and bias SE remain Validation Evidence performance measures over admitted recovery units. `mean_bias` keeps the direct residual path when residuals are finite; if finite inputs create an overflowing pairwise residual while the final bias remains representable, the equivalent recovered-plus-negated-truth numerator is sign-cancelled before exact-power-of-two scale reduction and divided by the original recovery-unit count. `bias_standard_error` still requires representable individual residual dispersion. Mathematically nonzero final results below or above binary64 range fail closed. - Generic Validation Evidence RMSE and its delta-method SE normalize before squaring. Exact-zero point RMSE requires exact-zero point RMSE SE. For positive RMSE, the declared producer satisfies `SE(RMSE) <= RMSE / 2`, with a small relative binary64 admission tolerance. - Generic `MonteCarloSummary` is sign-neutral. Zero SD requires zero SE and percentile endpoints equal to the represented mean. Positive SD requires positive SE coherent with represented `SD / sqrt(n)` within a small relative tolerance. Every inclusive nearest-rank endpoint is a retained observation and satisfies `|endpoint - mean| <= SD * sqrt(n - 1)`. Distinct lower/upper endpoint values share the same `(n - 1) * SD²` deviation budget. When `replication_count = 2` and endpoints are numerically distinct, those values exhaust the retained sample and the recorded represented mean/sample SD must match deterministic two-value reconstruction. Equal numeric endpoints do not prove two distinct ranks and are not subjected to that exhaustion rule. - When the generic carrier occupies `ValidationReport::monte_carlo_rmse`, retained replications are nonnegative; positive mean implies `SE(mean) <= mean`, and inclusive nearest-rank endpoints cannot exceed nonnegative sample-sum support `n * mean`. These typed bounds are not imposed on signed metrics such as bias. -- SE-aware acceptance is `|estimate - target| <= k * SE`. For `k = 0` or exact-zero SE, exact recovery is evaluated before any scale reduction; `-0.0` and `+0.0` are one numeric zero-valued scientific state. Finite represented residuals and finite represented `k · SE` bounds are compared directly. On a nonzero finite rounded tie, TEPP compares the error-free subtraction low term—sign-adjusted for the absolute residual—with the FMA product low term when those corrections differ. If both correction projections are zero, zero subtraction correction means the represented residual is exact while the product correction may be below binary64 resolution, so TEPP compares that represented residual against the exact dyadic represented `k · SE` product. If the two correction projections are equal and nonzero, TEPP compares the represented subtraction correction with the exact dyadic product roundoff, with positive and negative signed orderings covered explicitly. If both direct operations overflow, exact rational magnitudes represented by the binary64 inputs are compared from integer significands and powers of two; independently rounded normalization is not decision evidence. +- SE-aware acceptance is `|estimate - target| <= k * SE`. For `k = 0` or exact-zero SE, exact recovery is evaluated before any scale reduction; `-0.0` and `+0.0` are one numeric zero-valued scientific state. Finite represented residuals and finite represented `k · SE` bounds are compared directly. On a nonzero finite rounded tie, TEPP compares error-free subtraction and FMA product correction evidence; unresolved zero/equal projections use exact dyadic represented-input comparisons. If both direct operations overflow, exact rational magnitudes represented by the binary64 inputs are compared from integer significands and powers of two; independently rounded normalization is not decision evidence. - `match_count` is a finite-threshold decision and does not require materializing an unrepresentable absolute residual; `absolute_residuals` remains fail closed when the magnitude itself is requested. -- Wilson interval coverage preserves represented-input endpoints through stable rationalized/complementary/compensated forms. Legacy `ValidationReport` endpoint pairs satisfy necessary Wilson coherence and boundary checks, but exact provenance is not inferred from them. For `0 < p < 0.5`, a stored exact-zero lower endpoint is rejected when the peer upper endpoint implies a positive representable lower root under `L = p²(1-U) / [p² + (1-2p)U]`; `p > 0.5` applies the complement-symmetric rule to exact-one upper endpoints. The stable implementation delays squaring so the check itself does not erase a peer root before that final root becomes unrepresentable. A boundary remains admissible when the implied peer root also rounds to zero because the legacy report lacks enough producer provenance for a stronger claim. `WilsonCoverageEvidenceV1` retains fixed-width `u64` `sample_count`/`covered_count`, `critical_value_kind=standard_normal_z`, `interval_sidedness=two_sided`, numeric `z`, represented coverage, and canonical endpoints and validates them by exact recomputation through the single crate-private Wilson authority. Exact all-covered status is integer count equality, not rounded `p == 1`. Count proportions are correctly rounded from exact integers. When covered counts dominate, the smaller uncovered complement is evaluated and reflected. When retained `sample_count` itself is not exactly representable in binary64, Wilson scale terms use correctly rounded reciprocal `1/n`; its all-covered path uses complementary miss mass for `z²/n <= 1` and direct reciprocal evaluation for `z²/n > 1`. For an exactly representable all-covered count, a false exact-one quotient retains the boundary-local complementary repair. Otherwise, if `n + z²` is inexact, the canonical writer recovers the TwoSum denominator residual and FMA quotient residual, identifies the adjacent binary64 candidate from residual direction, and changes the direct quotient only when the exact represented-input rational lies beyond that candidate's midpoint; exact midpoint selection is ties-to-even. This avoids both under-correction and residual double-rounding overcorrection without claiming globally correctly rounded Wilson rearrangements. Smaller miss mass genuinely below binary64 resolution remains exact one. `ValidationEvidenceV1` binds provenance to the legacy report projection without breaking existing report callers. +- Wilson interval coverage preserves represented-input endpoints through stable rationalized/complementary/compensated forms. Durable `WilsonCoverageEvidenceV1` retains fixed-width counts, critical-value/sidedness provenance, represented coverage and canonical endpoints, validates through one crate-private authority, and does not infer missing v1 provenance from legacy endpoint algebra. - Durable and human-facing Validation Evidence must preserve producing-metric invariants on explicit validation, serde ingress/egress, and human projection. Missing v1 provenance is never synthesized from endpoint algebra. - Bias, RMSE, and Monte Carlo may share private deterministic scalar support inside `validation_core`, but metric-specific cancellation/normalization, denominator, uncertainty, and fail-closed semantics remain with their bounded modules. - Historical-cutoff admission occurs before duplicate-identity checks. Future-unavailable evidence cannot change an earlier run's conflicts, counts, or terminal state. @@ -83,39 +83,13 @@ The clock contract separates event/valid time, assertion time, document time, sy ### #488 — Validation Evidence -#488 is the generic Validation Evidence landing vehicle at exact head `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f`. It remains distinct from Longitudinal Modeling and does not consume mutable fast-mlsirm source. The branch was non-force merge-restacked onto protected #489 by `a2754592987be9e88941d220565c45e34f621a4e`, preserving its complete ancestry and inheriting the protected workflow-load repair. +#488 is the generic Validation Evidence landing vehicle at exact head `8c34e2f1657f319d925222851570d103759863b4`, non-force restacked onto protected #489. GAP-086 adds public RED `04e6e74507a1adb89aac4b2a58d3682746da30ea`: `truth=[-MAX, MAX, 0]` and `recovered=[MAX, -MAX, 3*MIN_SUBNORMAL]` has two individually overflowing signed residuals that cancel in the numerator and leaves one minimum-subnormal mean bias over three recovery units. Shared arithmetic repair `28b1d186ce2bd08b63ca267c8b98b2eae45d2da7` adds an explicit-denominator deterministic cancellation helper; causal bias repair `d1cd54615ddc311491e26fa427e956b5b5379e1a` invokes it only after finite-input residual overflow; CHANGELOG `d68dde34c2c63e610a859d45e528c2134b3c0f91`; research/TRACEABILITY `8c34e2f1657f319d925222851570d103759863b4`. One-sided unrepresentable bias still fails closed, and `bias_standard_error` is unchanged because individual residual dispersion is part of that estimand. -GAP-070 and GAP-072 remain inherited: stored Wilson endpoints must be one coherent score interval, and exact all-covered evidence cannot use a zero lower endpoint. GAP-071 has advanced from design-only to source implementation. Corrected carrier RED `6f6e06d2...` requires a versioned denominator/critical-value carrier; `ca517ed3...` establishes one private covered-count/Wilson-from-counts authority; `31e1ab2b...` adds `WilsonCoverageEvidenceV1`; `e9c63926...`/`fdd24a1a...` bind standard-normal/two-sided semantics. Envelope RED `07766cb0...` and repair `a16f22e6...` add `ValidationEvidenceV1`, which cross-validates the legacy report projection against the recomputable carrier. - -GAP-073 retains large-count identity/schema and exact-ratio projection. GAP-074 retains reciprocal-scale evaluation for sample counts that are not exactly representable in binary64. GAP-075 retains the inexact-count all-covered extreme-`z` scale switch and exact-oracle correction. - -GAP-076 records the exact-count all-covered near-one denominator-absorption defect. Public RED `e0c4ec81bb455d230259489dc71e23fe33704b1d` fixes `n=1` and represented `z=0x1.0000000000001p-27`; causal repair `c9dcb9df363999bbcbb6fffdc8b6a6d9ae5e762c` performs the complementary miss calculation only after direct false-one collapse; boundary `6140080d2257d0550be479d71371d70e2255c3d0` preserves true exact one below binary64 resolution; changelog `09ebb482851fe7836e738a74395e6424621da9bf`; research predecessor `fe89c43803136ab979912fffa636d2a4f169a73e`. - -GAP-077 records the ordinary partial-denominator state left after the near-one and complete-absorption repairs. With `n=1` and represented `z=3*2^-28`, represented `z²=9*2^-56`; `1+z²` rounds upward before division, so predecessor direct evaluation emits `0x1.ffffffffffffep-1` although the represented-input rational lower endpoint rounds to `0x1.fffffffffffffp-1`. Public RED `06e556538e171e675c4d8a8287d75052ffc2c4c3` → causal TwoSum/FMA residual repair `6c084dbe607e6c415288c77fa41a4270947cd51e` → research `25cc19436085881602356e7f2609b697b575540c` → dedicated changelog `5acc894b8a4d42cd7af8cdc22a02b61a063f16aa` → predecessor changelog correction `f89e36d1f2a048befb983327c83f5696baf530cc` → correct-direct-rounding control `80a0a0ade16f516bf63907f2a8d5105dbcd9c438`. - -GAP-078 records the opposite residual-rounding state. With `n=3`, represented `z=0x1.6a09e667f3bcdp+492`, and represented `z²=0x1.0000000000001p+985`, the rounded denominator fully absorbs `n`, but the exact represented-input rational and the direct rounded-denominator quotient both round to `0x1.7ffffffffffffp-984`. The predecessor additive residual correction forced `0x1.7fffffffffffep-984`, one ULP too low. Public RED `d076d344cb3cd3a768e7a5c2d8d7bd9039c657e9` → midpoint-selection repair `32314239754204158f228ec67a0771abf4d39b45` → changelog `a75940c955633d5eb92f227d79e64acd0ef46ea8` → research predecessor `ef6441f786d64e6dca198d0d6140838c391f0659`. - -GAP-079 records SE-aware acceptance scale-first underflow. For `estimate=1.0e308`, `target=next_down(estimate)`, `SE=2.2e-16`, and `k=1.0e308`, the represented residual (`1.99584030953472e292`) is within the represented finite bound (`2.2e292`), but the predecessor formed `SE / scale == 0.0` before multiplication and falsely rejected the recovery. Public RED `76067efce44419c27687b8673cb76092c90fb5a5` includes the admissible case and a nearby rejection at `SE=1.8e-16`; causal repair `4ffdf3665b3bbafd3b0bbf06b599fe71498169ab`; changelog `d822c0ba7fa548c3283e462323c56d8f5705de31`; retained by current #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f`. - -GAP-080 records the both-overflow decision defect. With exact binary64 payloads `estimate=0x7fee446cf80dddbc`, `target=0xffe2d7e397966af3`, `SE=0x73620ad22ddb6f38`, and `k=0x4c85c69ac1c7a9ed`, direct subtraction and multiplication both overflow; predecessor scale normalization rounds residual and bound to the same finite value and falsely accepts although the exact represented-input bound is smaller. Public RED `a9a45714eb6266f6b922086112b313060e77c522` includes that strict rejection and the adjacent accepted multiplier `0x4c85c69ac1c7a9ee`; causal exact significand/exponent comparison repair `425e89638d594fdb2f3586d73f021b60a530b456`; changelog `e62706291ad556c6d9078a2bc50dcf3bca5a6feb`; retained by current #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f`. - -GAP-081 records the finite multiplication-rounded tie defect. For `estimate=1`, `target=0`, `SE=1-2^-27`, and `k=1+2^-27`, exact represented `k·SE = 1-2^-54` is strictly below residual 1, but binary64 multiplication rounds the bound ties-to-even to `1.0`, so predecessor comparison falsely accepts equality. Public RED `23c3262c824609d79dc14d45bb0acb5a54e99a51`; causal repair `6a2add488cfa6bb5ac3cc854a107f287b61bbed5`; edge coverage `3656deb2f2abc0a83027618a823497a829d9227e`; changelog `090f5124588cb184fc2ef644d91355f2b2c2082b`; inherited by current #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f`. - -GAP-082 records the complementary finite subtraction-rounded tie. Public RED `58cbc03253997865b7c8ec19fb501fc89c22c851` fixes `estimate=1`, `target=-2^-54`, `SE=1`, `k=1`: the exact represented residual is `1+2^-54`, strictly above the exact unit bound, while binary64 subtraction rounds it to `1.0` and the predecessor falsely accepts. Causal repair `68a6fd98b4f661ad5d4c3c35dc8b9074f2c59281` compares the sign-adjusted error-free subtraction low term with the FMA product low term only on nonzero finite rounded ties whose correction projections differ. Sign-symmetric edge coverage `b2c06512b6d795555269862c1c3d7e4bc67f3f18`; dedicated changelog `c4f752f30121901bfbf4a96b03fdef0ccd9f4bf3`; inherited by current #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f`. - -GAP-083 records product correction below binary64 resolution. Public RED `b55c5473c8ee7a70ec2508d14d0755c2aeb38191` uses exact residual `minimum_subnormal`, `k=0x1.8p-538`, and `SE=0x1p-537`: exact represented `k·SE` is `3/4` minimum subnormal, multiplication rounds up, and the `-1/4`-subnormal FMA correction rounds to signed zero. Initial repair `210cebc4980c861ddfd6d098bf1c9d66c8449e72` correctly closed that RED but over-restricted the fallback to subnormal rounded bounds. Concurrent follow-up RED `c77ac440971abc649e6ede35874e5a7439e96797` proves the same failure at the minimum-normal boundary, where exact `(1-2^-54)·2^-1022` rounds to `f64::MIN_POSITIVE` and the correction still projects to zero. Corrected causal repair `772ad8ed3be8d105975bf776e9f9d898774a4a23` removes the rounded-bound-class guard and, only when both finite-tie correction projections are zero, compares the exact represented residual against the exact dyadic `k·SE` product. Exact minimum-subnormal/minimum-normal equality controls remain accepted. CHANGELOG correction `ceb68825f2759637034c2aaea935e50771aa6afc`; inherited by current #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f`. - -GAP-084 records a legacy Wilson endpoint-pair boundary-admission defect. For one covered observation in `100_000_000` and `z=10_000`, the canonical represented endpoints are lower `0x3c9c_d2b2_8e2c_a873` and upper `0x3fe0_0000_055e_63b8`. Replacing only the representable positive lower root with exact zero made the predecessor complement-form eliminated identity cancel to numerical equality. Public RED `c9d612f2964eb89ae6070e707c77115a12be84b9`; causal peer-root repair `88512417d931e54ec4eb41581caa0ef20b71df5b`; branch-complete stable evaluation `6a4f89da52cf18f63b2818545f15f72f43099a3f`; symmetry/serde/extreme-boundary contracts `0ce7639bd9f0ab5df2ecd6b24cd57a467e975d26`; changelog `407b3645233e8855cf30487250155ac903d6a4cb`; inherited by current #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f`. - -GAP-085 records the remaining equal-nonzero correction-projection defect in SE-aware acceptance. Public RED `35ea85ba5c049e3736e8549445bc799638cc6555` fixes a finite rounded tie where the subtraction low term and FMA product correction both project to the same positive subnormal while the exact represented product correction is slightly smaller, so the predecessor falsely accepts equality. The same contract carries the admissible side; signed edge `b463a991adc6ff98fa09f91eb428cda9e0ff1255` covers a negative equal projection. Causal exact-roundoff repair `7d597a18e043f3619b893981823b9be15ddb823c`; branch-scope refinement `ca8c2b86a81cfa6e99a10bdcc141fc10d49ec011`; changelog `702eec2fe211017785f848fe1b23abe7ee60c5ec`; research/TRACEABILITY current #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f`. - -These repairs advance the source-contract portion of GAP-071/GAP-073–GAP-085 but not delivery: exact-head hosted gates, independent review, protected-main integration, and adoption by durable consumers that require v1 provenance remain outstanding. Bare legacy `ValidationReport` remains a backward-compatible compact projection and is not silently treated as v1 provenance. - -Wilson (1927) remains the primary score-interval reference. AERA/APA/NCME (2014) remains the current published testing-standards edition while revision is underway. IEEE 754-2019 and ISO/IEC 60559:2020 remain the published floating-point authorities used for binary64 representation trace; active IEEE P754 is not treated as a published replacement. +GAP-071/GAP-073–GAP-086 remain delivery-pending until current-head hosted gates, independent review, protected-main integration, and required durable-consumer adoption are verified. Bare legacy `ValidationReport` remains a backward-compatible compact projection and is not silently treated as v1 provenance. Earlier GAP-045–085 source/test/fixture/contract/research lineages remain in #488 ancestry and the register below. ### #416 — Validation / Analysis Run consolidation -#416 branch head is `aa730c63563eb4a33048d822b581036c8487bd47`; its body distinguishes current exact source repair from later metadata/docs commits. #458/#460/#482/#483/#484/#485/#487 remain fold children until every unique source/test/fixture/contract/doctoring delta is inherited by a conflict-resolving survivor. Child-head evidence does not transfer to #416. +#416 branch head is `aa730c63563eb4a33048d822b581036c8487bd47`; #458/#460/#482/#483/#484/#485/#487 remain fold children until every unique source/test/fixture/contract/doctoring delta is inherited by a conflict-resolving survivor. Child-head evidence does not transfer to #416. ### #480 — contextual-orchestrator boundary @@ -169,47 +143,48 @@ Wilson (1927) remains the primary score-interval reference. AERA/APA/NCME (2014) | GAP-042 | Ratio-first logarithm could nearly double an adjacent-float irregular residual growth rate | `verification-pending` | RED `766ddc7a...` + `ln_1p` repair `16f21d9a...` | | GAP-043 | Duplicate known-truth component identities could silently reweight RMSE recovery evidence | `verification-pending` | RED `698f12f5...` + uniqueness repair `2fae4cb2...` | | GAP-044 | Known-truth RMSE alignment/accumulation depended on row order instead of component identity | `verification-pending` | RED `8ad72ac9...` / `5fb93c40...` + repairs `2dd9537e...` / `025dce7f...`; #310 `c6680450...` | -| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f` | -| GAP-046 | Bias SE could reject a representable SEM because raw squared deviations/intermediates overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f` | -| GAP-047 | Generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f` | -| GAP-048 | Mean signed bias could erase a representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f` | +| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; #488 `8c34e2f1657f319d925222851570d103759863b4` | +| GAP-046 | Bias SE could reject a representable SEM because raw squared deviations/intermediates overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; #488 `8c34e2f1657f319d925222851570d103759863b4` | +| GAP-047 | Generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; #488 `8c34e2f1657f319d925222851570d103759863b4` | +| GAP-048 | Mean signed bias could erase a representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; #488 `8c34e2f1657f319d925222851570d103759863b4` | | GAP-049 | Stable `Between` recovery could be aliased across occasion indices and reweight RMSE | `verification-pending` | RED `0a03041c...` + repair `ec2c1219...`; #310 `c6680450...` | -| GAP-050 | Zero-multiplier SE-aware acceptance could erase a nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f` | -| GAP-051 | Exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f` | -| GAP-052 | All-covered Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f` | -| GAP-053 | Strict-interior Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f` | -| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f` | -| GAP-055 | Strict-interior Wilson lower endpoint could accept a nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f` | -| GAP-056 | Durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f` | -| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from a generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f` | -| GAP-058 | Generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f` | -| GAP-059 | Generic Monte Carlo summary could materially misstate positive SE relative to `SD / sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f` | -| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f` | -| GAP-061 | Generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f` | -| GAP-062 | Finite-tolerance matching could fail while the pair is deterministically outside every finite tolerance | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f` | -| GAP-063 | Exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f` | -| GAP-064 | Positive point RMSE could carry SE above the declared squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f` | -| GAP-065 | Positive Monte Carlo RMSE could carry spread/SE impossible for nonnegative replications | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f` | -| GAP-066 | RMSE Monte Carlo nearest-rank percentile could exceed total nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f` | -| GAP-067 | Generic nearest-rank percentile endpoint could be individually incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected over-strong repair `2798e4f9...`; causal repair `c7151b49...`; edge `dbef285b...`; changelog `c38a320c...`; research `2bbcbb24...`; #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f` | -| GAP-068 | Distinct generic percentile endpoints could each pass individual radius checks while jointly exceeding the sample squared-deviation budget | `verification-pending` | RED `c4a13826...` + causal repair `cb3f80a2...` + changelog `f727450d...`; #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f` | -| GAP-069 | Two-replication distinct nearest-rank endpoints could exhaust the retained sample while the stored mean or SD remained impossible | `verification-pending` | RED `81bf0d9e...` + causal repair `d48f8fef...` + mean coverage `fb314d8a...` + branch cleanup `440b78d8...` + changelog `45116498...`; #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f` | -| GAP-070 | Stored Wilson bounds could contain empirical coverage while the lower/upper pair could not arise from one Wilson score interval for that same coverage | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...` + complementary edge `c1cb16a7...`; #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f` | -| GAP-071 | Durable Wilson evidence lacked denominator and critical-value/sidedness provenance, preventing exact recomputation from a persisted artifact | `active-repair` | valid carrier RED `6f6e06d2...`; shared count/Wilson authority `ca517ed3...`; `WilsonCoverageEvidenceV1` `31e1ab2b...`; sidedness `e9c63926...`/`fdd24a1a...`; envelope RED `07766cb0...` + `ValidationEvidenceV1` repair `a16f22e6...`; docs/current #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f`; remaining: hosted GREEN/review/main plus durable-consumer adoption | -| GAP-072 | Exact all-covered Wilson evidence could retain a zero lower endpoint even though the canonical non-empty finite-`z²` producer always emits `n/(n+z²) > 0` | `verification-pending` | RED `ce714f07...` + non-force source-restore RCA `18499052...` + repair `72e9d954...` + changelog `e3a2f4a2...`; inherited by #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f` | -| GAP-073 | Durable Wilson count provenance could round one uncovered observation away above binary64's exact-integer range and expose a pointer-width-dependent count schema | `verification-pending` | RED `29d710a5...` + complement/count repair `29968c80...` + fixed-width carrier repair `91d9a3bb...` + exact ratio RED/repair `63ddfdd6...`/`11323c57...`; #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f` | -| GAP-074 | Durable Wilson evidence could correctly retain exact `u64` counts yet pre-round `sample_count` before endpoint projection, shifting strict-interior endpoints or erasing all-covered finite-sample uncertainty | `verification-pending` | RED `f89e2467...` + all-covered edge `1a5180b2...` + stale-oracle correction `6254c498...` + causal reciprocal-scale repair `73bbb5cf...` + changelog `f2b5768b...` + research predecessor `7fc78a59...`; current #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f` | -| GAP-075 | Inexact durable all-covered Wilson evidence could round the complementary miss mass to exact one at extreme finite `z` and erase a representable positive lower endpoint | `verification-pending` | RED `059ce70d...`; transient duplicate-owner implementation `46f91f3f...` excluded; canonical repair `0f478392...`; single-writer cleanup `8e2058f2...`; exact-oracle correction `93d5d208...`; changelog correction `43b6562c...`; research predecessor `b03a719d...`; current #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f` | -| GAP-076 | Exactly representable all-covered Wilson counts could absorb a small positive `z²` in `n + z²` and falsely emit exact `1.0` although a lower binary64 endpoint is representable | `verification-pending` | RED `e0c4ec81...` + causal boundary repair `c9dcb9df...` + below-resolution edge `6140080d...` + changelog `09ebb482...` + research predecessor `fe89c438...`; current #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f` | -| GAP-077 | Exactly representable all-covered Wilson counts could form an inexact partial denominator `n + z²` whose rounded sum shifts the represented-input lower endpoint by one ULP even though neither operand is fully absorbed | `verification-pending` | RED `06e55653...` + causal TwoSum/FMA repair `6c084dbe...` + research `25cc1943...` + changelog `5acc894b...` + predecessor changelog correction `f89e36d1...` + correct-direct-rounding control `80a0a0ad...`; current #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f` | -| GAP-078 | Exact-count all-covered Wilson residual compensation could move a direct quotient by one ULP even when the represented-input rational remains on the same side of the adjacent midpoint | `verification-pending` | RED `d076d344...` + midpoint-selection repair `32314239...` + changelog `a75940c9...` + research predecessor `ef6441f7...`; current #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f` | -| GAP-079 | SE-aware acceptance could underflow a finite positive `k · SE` tolerance to exact zero by dividing `SE` by a much larger estimate/target scale before multiplication | `verification-pending` | RED `76067efc...` + causal direct-finite comparison repair `4ffdf366...` + changelog `d822c0ba...` + retained by current #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f` | -| GAP-080 | SE-aware acceptance both-overflow fallback could normalize an exact strict rejection into an equal rounded residual/bound and falsely accept it | `verification-pending` | RED `a9a45714...` + exact significand/exponent repair `425e8963...` + changelog `e6270629...` + retained by current #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f` | -| GAP-081 | SE-aware acceptance finite/finite multiplication could round an exact strict represented-input rejection into an equal residual/bound and falsely accept it | `verification-pending` | RED `23c3262c...` + tie repair `6a2add48...` + edge coverage `3656deb2...` + changelog `090f5124...` + inherited by current #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f` | -| GAP-082 | SE-aware acceptance finite subtraction could round an exact strict represented-input rejection onto an exact finite bound and falsely accept equality | `verification-pending` | RED `58cbc032...` + causal low-term comparison repair `68a6fd98...` + sign-symmetric edge `b2c06512...` + changelog `c4f752f3...` + inherited by current #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f` | -| GAP-083 | SE-aware acceptance product correction can fall below binary64 resolution even when the rounded finite bound is subnormal or minimum normal, erasing a strict represented-input rejection | `verification-pending` | RED `b55c5473...` + initial narrow repair `210cebc4...` + minimum-normal RED `c77ac440...` + corrected zero-projection repair `772ad8ed...` + changelog correction `ceb68825...` + inherited by current #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f` | -| GAP-084 | Legacy Wilson pair admission could accept an exact-zero/exact-one boundary even though the peer endpoint implied a representable non-boundary root | `verification-pending` | RED `c9d612f2...` + causal peer-root repair `88512417...` + branch-complete stable evaluation `6a4f89da...` + symmetry/serde/extreme-boundary contracts `0ce7639b...` + changelog `407b3645...` + inherited by current #488 `21b1f0e7fc81eb3a3ed5e94464f95913bbb4b69f` | -| GAP-085 | Equal nonzero SE-aware subtraction/FMA correction projections could conceal the exact represented-input ordering and turn a strict decision into rounded equality | `verification-pending` | RED `35ea85ba...` + exact product-roundoff repair `7d597a18...` + signed edge `b463a991...` + branch-scope refinement `ca8c2b86...` + changelog `702eec2f...` + research/current #488 `21b1f0e7...` | +| GAP-050 | Zero-multiplier SE-aware acceptance could erase a nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; #488 `8c34e2f1657f319d925222851570d103759863b4` | +| GAP-051 | Exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; #488 `8c34e2f1657f319d925222851570d103759863b4` | +| GAP-052 | All-covered Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; #488 `8c34e2f1657f319d925222851570d103759863b4` | +| GAP-053 | Strict-interior Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; #488 `8c34e2f1657f319d925222851570d103759863b4` | +| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; #488 `8c34e2f1657f319d925222851570d103759863b4` | +| GAP-055 | Strict-interior Wilson lower endpoint could accept a nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; #488 `8c34e2f1657f319d925222851570d103759863b4` | +| GAP-056 | Durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; #488 `8c34e2f1657f319d925222851570d103759863b4` | +| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from a generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; #488 `8c34e2f1657f319d925222851570d103759863b4` | +| GAP-058 | Generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; #488 `8c34e2f1657f319d925222851570d103759863b4` | +| GAP-059 | Generic Monte Carlo summary could materially misstate positive SE relative to `SD / sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; #488 `8c34e2f1657f319d925222851570d103759863b4` | +| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; #488 `8c34e2f1657f319d925222851570d103759863b4` | +| GAP-061 | Generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; #488 `8c34e2f1657f319d925222851570d103759863b4` | +| GAP-062 | Finite-tolerance matching could fail while the pair is deterministically outside every finite tolerance | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; #488 `8c34e2f1657f319d925222851570d103759863b4` | +| GAP-063 | Exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; #488 `8c34e2f1657f319d925222851570d103759863b4` | +| GAP-064 | Positive point RMSE could carry SE above the declared squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; #488 `8c34e2f1657f319d925222851570d103759863b4` | +| GAP-065 | Positive Monte Carlo RMSE could carry spread/SE impossible for nonnegative replications | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; #488 `8c34e2f1657f319d925222851570d103759863b4` | +| GAP-066 | RMSE Monte Carlo nearest-rank percentile could exceed total nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; #488 `8c34e2f1657f319d925222851570d103759863b4` | +| GAP-067 | Generic nearest-rank percentile endpoint could be individually incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected over-strong repair `2798e4f9...`; causal repair `c7151b49...`; edge `dbef285b...`; changelog `c38a320c...`; research `2bbcbb24...`; #488 `8c34e2f1657f319d925222851570d103759863b4` | +| GAP-068 | Distinct generic percentile endpoints could each pass individual radius checks while jointly exceeding the sample squared-deviation budget | `verification-pending` | RED `c4a13826...` + causal repair `cb3f80a2...` + changelog `f727450d...`; #488 `8c34e2f1657f319d925222851570d103759863b4` | +| GAP-069 | Two-replication distinct nearest-rank endpoints could exhaust the retained sample while the stored mean or SD remained impossible | `verification-pending` | RED `81bf0d9e...` + causal repair `d48f8fef...` + mean coverage `fb314d8a...` + branch cleanup `440b78d8...` + changelog `45116498...`; #488 `8c34e2f1657f319d925222851570d103759863b4` | +| GAP-070 | Stored Wilson bounds could contain empirical coverage while the lower/upper pair could not arise from one Wilson score interval for that same coverage | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...` + complementary edge `c1cb16a7...`; #488 `8c34e2f1657f319d925222851570d103759863b4` | +| GAP-071 | Durable Wilson evidence lacked denominator and critical-value/sidedness provenance, preventing exact recomputation from a persisted artifact | `active-repair` | valid carrier RED `6f6e06d2...`; shared count/Wilson authority `ca517ed3...`; `WilsonCoverageEvidenceV1` `31e1ab2b...`; sidedness `e9c63926...`/`fdd24a1a...`; envelope RED `07766cb0...` + `ValidationEvidenceV1` repair `a16f22e6...`; docs/current #488 `8c34e2f1657f319d925222851570d103759863b4`; remaining: hosted GREEN/review/main plus durable-consumer adoption | +| GAP-072 | Exact all-covered Wilson evidence could retain a zero lower endpoint even though the canonical non-empty finite-`z²` producer always emits `n/(n+z²) > 0` | `verification-pending` | RED `ce714f07...` + non-force source-restore RCA `18499052...` + repair `72e9d954...` + changelog `e3a2f4a2...`; inherited by #488 `8c34e2f1657f319d925222851570d103759863b4` | +| GAP-073 | Durable Wilson count provenance could round one uncovered observation away above binary64's exact-integer range and expose a pointer-width-dependent count schema | `verification-pending` | RED `29d710a5...` + complement/count repair `29968c80...` + fixed-width carrier repair `91d9a3bb...` + exact ratio RED/repair `63ddfdd6...`/`11323c57...`; #488 `8c34e2f1657f319d925222851570d103759863b4` | +| GAP-074 | Durable Wilson evidence could correctly retain exact `u64` counts yet pre-round `sample_count` before endpoint projection, shifting strict-interior endpoints or erasing all-covered finite-sample uncertainty | `verification-pending` | RED `f89e2467...` + all-covered edge `1a5180b2...` + stale-oracle correction `6254c498...` + causal reciprocal-scale repair `73bbb5cf...` + changelog `f2b5768b...` + research predecessor `7fc78a59...`; current #488 `8c34e2f1657f319d925222851570d103759863b4` | +| GAP-075 | Inexact durable all-covered Wilson evidence could round the complementary miss mass to exact one at extreme finite `z` and erase a representable positive lower endpoint | `verification-pending` | RED `059ce70d...`; transient duplicate-owner implementation `46f91f3f...` excluded; canonical repair `0f478392...`; single-writer cleanup `8e2058f2...`; exact-oracle correction `93d5d208...`; changelog correction `43b6562c...`; research predecessor `b03a719d...`; current #488 `8c34e2f1657f319d925222851570d103759863b4` | +| GAP-076 | Exactly representable all-covered Wilson counts could absorb a small positive `z²` in `n + z²` and falsely emit exact `1.0` although a lower binary64 endpoint is representable | `verification-pending` | RED `e0c4ec81...` + causal boundary repair `c9dcb9df...` + below-resolution edge `6140080d...` + changelog `09ebb482...` + research predecessor `fe89c438...`; current #488 `8c34e2f1657f319d925222851570d103759863b4` | +| GAP-077 | Exactly representable all-covered Wilson counts could form an inexact partial denominator `n + z²` whose rounded sum shifts the represented-input lower endpoint by one ULP even though neither operand is fully absorbed | `verification-pending` | RED `06e55653...` + causal TwoSum/FMA repair `6c084dbe...` + research `25cc1943...` + changelog `5acc894b...` + predecessor changelog correction `f89e36d1...` + correct-direct-rounding control `80a0a0ad...`; current #488 `8c34e2f1657f319d925222851570d103759863b4` | +| GAP-078 | Exact-count all-covered Wilson residual compensation could move a direct quotient by one ULP even when the represented-input rational remains on the same side of the adjacent midpoint | `verification-pending` | RED `d076d344...` + midpoint-selection repair `32314239...` + changelog `a75940c9...` + research predecessor `ef6441f7...`; current #488 `8c34e2f1657f319d925222851570d103759863b4` | +| GAP-079 | SE-aware acceptance could underflow a finite positive `k · SE` tolerance to exact zero by dividing `SE` by a much larger estimate/target scale before multiplication | `verification-pending` | RED `76067efc...` + causal direct-finite comparison repair `4ffdf366...` + changelog `d822c0ba...` + retained by current #488 `8c34e2f1657f319d925222851570d103759863b4` | +| GAP-080 | SE-aware acceptance both-overflow fallback could normalize an exact strict rejection into an equal rounded residual/bound and falsely accept it | `verification-pending` | RED `a9a45714...` + exact significand/exponent repair `425e8963...` + changelog `e6270629...` + retained by current #488 `8c34e2f1657f319d925222851570d103759863b4` | +| GAP-081 | SE-aware acceptance finite/finite multiplication could round an exact strict represented-input rejection into an equal residual/bound and falsely accept it | `verification-pending` | RED `23c3262c...` + tie repair `6a2add48...` + edge coverage `3656deb2...` + changelog `090f5124...` + inherited by current #488 `8c34e2f1657f319d925222851570d103759863b4` | +| GAP-082 | SE-aware acceptance finite subtraction could round an exact strict represented-input rejection onto an exact finite bound and falsely accept equality | `verification-pending` | RED `58cbc032...` + causal low-term comparison repair `68a6fd98...` + sign-symmetric edge `b2c06512...` + changelog `c4f752f3...` + inherited by current #488 `8c34e2f1657f319d925222851570d103759863b4` | +| GAP-083 | SE-aware acceptance product correction can fall below binary64 resolution even when the rounded finite bound is subnormal or minimum normal, erasing a strict represented-input rejection | `verification-pending` | RED `b55c5473...` + initial narrow repair `210cebc4...` + minimum-normal RED `c77ac440...` + corrected zero-projection repair `772ad8ed...` + changelog correction `ceb68825...` + inherited by current #488 `8c34e2f1657f319d925222851570d103759863b4` | +| GAP-084 | Legacy Wilson pair admission could accept an exact-zero/exact-one boundary even though the peer endpoint implied a representable non-boundary root | `verification-pending` | RED `c9d612f2...` + causal peer-root repair `88512417...` + branch-complete stable evaluation `6a4f89da...` + symmetry/serde/extreme-boundary contracts `0ce7639b...` + changelog `407b3645...` + inherited by current #488 `8c34e2f1657f319d925222851570d103759863b4` | +| GAP-085 | Equal nonzero SE-aware subtraction/FMA correction projections could conceal the exact represented-input ordering and turn a strict decision into rounded equality | `verification-pending` | RED `35ea85ba...` + exact product-roundoff repair `7d597a18...` + signed edge `b463a991...` + branch-scope refinement `ca8c2b86...` + changelog `702eec2f...` + research/current #488 `8c34e2f1...` | +| GAP-086 | Mean signed bias could reject a representable result because individual `recovered - truth` residuals overflow before opposing represented terms cancel | `verification-pending` | RED `04e6e745...` + explicit-denominator cancellation `28b1d186...` + causal bias repair `d1cd5461...` + changelog `d68dde34...` + research/current #488 `8c34e2f1...` | ## Release gate From 9c06078f7e0c3c14da8defd9ec717871955897b8 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 5 Sep 2026 02:07:15 +0900 Subject: [PATCH 181/235] docs(gaps): record bias cancellation roundoff --- docs/product-technical-gap-baseline.md | 95 +++++++++++++------------- 1 file changed, 49 insertions(+), 46 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 1008a0ff0..dd4dbdb48 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-04T16:10:00Z +**Snapshot:** 2026-09-04T17:05:00Z **Protected-main evidence:** `b18bca1c69ef8d1799fcd3af6bf4412498e007c3` **Workspace version:** `0.2.0` @@ -30,7 +30,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `8c34e2f1657f319d925222851570d103759863b4` | true | `main` | Validation Evidence landing vehicle, non-force restacked onto protected #489. GAP-086 preserves representable mean signed bias when pairwise residual materialization overflows but the represented numerator cancels; prior Wilson, provenance, Monte Carlo, RMSE/SE, matching, serde/projection, and GAP-079–085 repairs remain inherited. Hosted exact-head gates and independent review remain required. | +| #488 | `4b74099b2f1d4e1afb6003af113b471f13df6bf9` | true | `main` | Validation Evidence landing vehicle, non-force restacked onto protected #489. GAP-087 retains error-free low terms during mixed-sign mean-bias cancellation so repeated sub-ULP opposing residuals cannot disappear one at a time before their combined represented mass changes the final bias. GAP-086 and prior Wilson, provenance, Monte Carlo, RMSE/SE, matching, serde/projection, and GAP-079–085 repairs remain inherited. Hosted exact-head gates and independent review remain required. | | #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 | Validation / Analysis Run fold child. Unique evidence must be inherited by a conflict-resolving survivor; child-head CI does not transfer. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | @@ -62,7 +62,7 @@ The clock contract separates event/valid time, assertion time, document time, sy - Row arrival order is not scientific evidence. Fixed admitted observations must produce bit-identical means/centered results under permutation wherever the contract claims deterministic CPU `f64` reference behavior. - Known-truth component recovery follows bounded-context identity: stable `Between` is unit-level and uses canonical `occasion_index = 0`; `Within` retains actual `(unit, occasion)` identity. Duplicate identities or stable-Between occasion aliases are not weights. - A representable final scientific estimand is not rejected solely because an avoidable intermediate binary64 operation overflows/underflows. False exact 0/1/non-finite endpoints, erased finite bounds, and cancellation residues are not accepted when an equivalent operation order preserves the represented estimand or decision. -- Mean signed bias and bias SE remain Validation Evidence performance measures over admitted recovery units. `mean_bias` keeps the direct residual path when residuals are finite; if finite inputs create an overflowing pairwise residual while the final bias remains representable, the equivalent recovered-plus-negated-truth numerator is sign-cancelled before exact-power-of-two scale reduction and divided by the original recovery-unit count. `bias_standard_error` still requires representable individual residual dispersion. Mathematically nonzero final results below or above binary64 range fail closed. +- Mean signed bias and bias SE remain Validation Evidence performance measures over admitted recovery units. `mean_bias` keeps the direct residual path when residuals are finite; if finite inputs create an overflowing pairwise residual while the final bias remains representable, the equivalent recovered-plus-negated-truth numerator is sign-cancelled before exact-power-of-two scale reduction and divided by the original recovery-unit count. During mixed-sign cancellation, error-free low terms are retained so repeated individually sub-ULP opposing residuals can still change the represented mean when their combined mass is material. `bias_standard_error` still requires representable individual residual dispersion. Mathematically nonzero final results below or above binary64 range fail closed. - Generic Validation Evidence RMSE and its delta-method SE normalize before squaring. Exact-zero point RMSE requires exact-zero point RMSE SE. For positive RMSE, the declared producer satisfies `SE(RMSE) <= RMSE / 2`, with a small relative binary64 admission tolerance. - Generic `MonteCarloSummary` is sign-neutral. Zero SD requires zero SE and percentile endpoints equal to the represented mean. Positive SD requires positive SE coherent with represented `SD / sqrt(n)` within a small relative tolerance. Every inclusive nearest-rank endpoint is a retained observation and satisfies `|endpoint - mean| <= SD * sqrt(n - 1)`. Distinct lower/upper endpoint values share the same `(n - 1) * SD²` deviation budget. When `replication_count = 2` and endpoints are numerically distinct, those values exhaust the retained sample and the recorded represented mean/sample SD must match deterministic two-value reconstruction. Equal numeric endpoints do not prove two distinct ranks and are not subjected to that exhaustion rule. - When the generic carrier occupies `ValidationReport::monte_carlo_rmse`, retained replications are nonnegative; positive mean implies `SE(mean) <= mean`, and inclusive nearest-rank endpoints cannot exceed nonnegative sample-sum support `n * mean`. These typed bounds are not imposed on signed metrics such as bias. @@ -83,9 +83,11 @@ The clock contract separates event/valid time, assertion time, document time, sy ### #488 — Validation Evidence -#488 is the generic Validation Evidence landing vehicle at exact head `8c34e2f1657f319d925222851570d103759863b4`, non-force restacked onto protected #489. GAP-086 adds public RED `04e6e74507a1adb89aac4b2a58d3682746da30ea`: `truth=[-MAX, MAX, 0]` and `recovered=[MAX, -MAX, 3*MIN_SUBNORMAL]` has two individually overflowing signed residuals that cancel in the numerator and leaves one minimum-subnormal mean bias over three recovery units. Shared arithmetic repair `28b1d186ce2bd08b63ca267c8b98b2eae45d2da7` adds an explicit-denominator deterministic cancellation helper; causal bias repair `d1cd54615ddc311491e26fa427e956b5b5379e1a` invokes it only after finite-input residual overflow; CHANGELOG `d68dde34c2c63e610a859d45e528c2134b3c0f91`; research/TRACEABILITY `8c34e2f1657f319d925222851570d103759863b4`. One-sided unrepresentable bias still fails closed, and `bias_standard_error` is unchanged because individual residual dispersion is part of that estimand. +#488 is the generic Validation Evidence landing vehicle at exact head `4b74099b2f1d4e1afb6003af113b471f13df6bf9`, non-force restacked onto protected #489. GAP-087 adds public RED `63913727a3dfc2dd65c2508fe7e4acfdd6498508`: residuals equivalent to `[1, -2^-54, -2^-54, -2^-54, -2^-54]` lose four individually sub-ULP opposing terms under ordinary repeated cancellation even though their aggregate changes the represented-input mean from ordinary `0.2` bits `0x3fc999999999999a` to `0x3fc9999999999998`. Causal repair `5697cca51df2ec49e44a04730a14fd77656b48a5` retains TwoSum low terms while preserving the existing high-part cancellation order and original scientific denominator; CHANGELOG `53f5c912fbca415172f621c909b626ea1db66582`; research/current #488 `4b74099b2f1d4e1afb6003af113b471f13df6bf9`. -GAP-071/GAP-073–GAP-086 remain delivery-pending until current-head hosted gates, independent review, protected-main integration, and required durable-consumer adoption are verified. Bare legacy `ValidationReport` remains a backward-compatible compact projection and is not silently treated as v1 provenance. Earlier GAP-045–085 source/test/fixture/contract/research lineages remain in #488 ancestry and the register below. +GAP-086 remains inherited: public RED `04e6e74507a1adb89aac4b2a58d3682746da30ea` covers pairwise residual overflow with representable final cancellation; shared explicit-denominator repair `28b1d186ce2bd08b63ca267c8b98b2eae45d2da7` and bias repair `d1cd54615ddc311491e26fa427e956b5b5379e1a` preserve that representable mean while one-sided unrepresentable bias still fails closed. `bias_standard_error` remains unchanged because individual residual dispersion is part of its estimand. + +GAP-071/GAP-073–GAP-087 remain delivery-pending until current-head hosted gates, independent review, protected-main integration, and required durable-consumer adoption are verified. Bare legacy `ValidationReport` remains a backward-compatible compact projection and is not silently treated as v1 provenance. Earlier GAP-045–086 source/test/fixture/contract/research lineages remain in #488 ancestry and the register below. ### #416 — Validation / Analysis Run consolidation @@ -143,48 +145,49 @@ GAP-071/GAP-073–GAP-086 remain delivery-pending until current-head hosted gate | GAP-042 | Ratio-first logarithm could nearly double an adjacent-float irregular residual growth rate | `verification-pending` | RED `766ddc7a...` + `ln_1p` repair `16f21d9a...` | | GAP-043 | Duplicate known-truth component identities could silently reweight RMSE recovery evidence | `verification-pending` | RED `698f12f5...` + uniqueness repair `2fae4cb2...` | | GAP-044 | Known-truth RMSE alignment/accumulation depended on row order instead of component identity | `verification-pending` | RED `8ad72ac9...` / `5fb93c40...` + repairs `2dd9537e...` / `025dce7f...`; #310 `c6680450...` | -| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; #488 `8c34e2f1657f319d925222851570d103759863b4` | -| GAP-046 | Bias SE could reject a representable SEM because raw squared deviations/intermediates overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; #488 `8c34e2f1657f319d925222851570d103759863b4` | -| GAP-047 | Generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; #488 `8c34e2f1657f319d925222851570d103759863b4` | -| GAP-048 | Mean signed bias could erase a representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; #488 `8c34e2f1657f319d925222851570d103759863b4` | +| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; #488 `4b74099b2f1d4e1afb6003af113b471f13df6bf9` | +| GAP-046 | Bias SE could reject a representable SEM because raw squared deviations/intermediates overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; #488 `4b74099b2f1d4e1afb6003af113b471f13df6bf9` | +| GAP-047 | Generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; #488 `4b74099b2f1d4e1afb6003af113b471f13df6bf9` | +| GAP-048 | Mean signed bias could erase a representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; #488 `4b74099b2f1d4e1afb6003af113b471f13df6bf9` | | GAP-049 | Stable `Between` recovery could be aliased across occasion indices and reweight RMSE | `verification-pending` | RED `0a03041c...` + repair `ec2c1219...`; #310 `c6680450...` | -| GAP-050 | Zero-multiplier SE-aware acceptance could erase a nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; #488 `8c34e2f1657f319d925222851570d103759863b4` | -| GAP-051 | Exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; #488 `8c34e2f1657f319d925222851570d103759863b4` | -| GAP-052 | All-covered Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; #488 `8c34e2f1657f319d925222851570d103759863b4` | -| GAP-053 | Strict-interior Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; #488 `8c34e2f1657f319d925222851570d103759863b4` | -| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; #488 `8c34e2f1657f319d925222851570d103759863b4` | -| GAP-055 | Strict-interior Wilson lower endpoint could accept a nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; #488 `8c34e2f1657f319d925222851570d103759863b4` | -| GAP-056 | Durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; #488 `8c34e2f1657f319d925222851570d103759863b4` | -| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from a generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; #488 `8c34e2f1657f319d925222851570d103759863b4` | -| GAP-058 | Generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; #488 `8c34e2f1657f319d925222851570d103759863b4` | -| GAP-059 | Generic Monte Carlo summary could materially misstate positive SE relative to `SD / sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; #488 `8c34e2f1657f319d925222851570d103759863b4` | -| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; #488 `8c34e2f1657f319d925222851570d103759863b4` | -| GAP-061 | Generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; #488 `8c34e2f1657f319d925222851570d103759863b4` | -| GAP-062 | Finite-tolerance matching could fail while the pair is deterministically outside every finite tolerance | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; #488 `8c34e2f1657f319d925222851570d103759863b4` | -| GAP-063 | Exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; #488 `8c34e2f1657f319d925222851570d103759863b4` | -| GAP-064 | Positive point RMSE could carry SE above the declared squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; #488 `8c34e2f1657f319d925222851570d103759863b4` | -| GAP-065 | Positive Monte Carlo RMSE could carry spread/SE impossible for nonnegative replications | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; #488 `8c34e2f1657f319d925222851570d103759863b4` | -| GAP-066 | RMSE Monte Carlo nearest-rank percentile could exceed total nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; #488 `8c34e2f1657f319d925222851570d103759863b4` | -| GAP-067 | Generic nearest-rank percentile endpoint could be individually incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected over-strong repair `2798e4f9...`; causal repair `c7151b49...`; edge `dbef285b...`; changelog `c38a320c...`; research `2bbcbb24...`; #488 `8c34e2f1657f319d925222851570d103759863b4` | -| GAP-068 | Distinct generic percentile endpoints could each pass individual radius checks while jointly exceeding the sample squared-deviation budget | `verification-pending` | RED `c4a13826...` + causal repair `cb3f80a2...` + changelog `f727450d...`; #488 `8c34e2f1657f319d925222851570d103759863b4` | -| GAP-069 | Two-replication distinct nearest-rank endpoints could exhaust the retained sample while the stored mean or SD remained impossible | `verification-pending` | RED `81bf0d9e...` + causal repair `d48f8fef...` + mean coverage `fb314d8a...` + branch cleanup `440b78d8...` + changelog `45116498...`; #488 `8c34e2f1657f319d925222851570d103759863b4` | -| GAP-070 | Stored Wilson bounds could contain empirical coverage while the lower/upper pair could not arise from one Wilson score interval for that same coverage | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...` + complementary edge `c1cb16a7...`; #488 `8c34e2f1657f319d925222851570d103759863b4` | -| GAP-071 | Durable Wilson evidence lacked denominator and critical-value/sidedness provenance, preventing exact recomputation from a persisted artifact | `active-repair` | valid carrier RED `6f6e06d2...`; shared count/Wilson authority `ca517ed3...`; `WilsonCoverageEvidenceV1` `31e1ab2b...`; sidedness `e9c63926...`/`fdd24a1a...`; envelope RED `07766cb0...` + `ValidationEvidenceV1` repair `a16f22e6...`; docs/current #488 `8c34e2f1657f319d925222851570d103759863b4`; remaining: hosted GREEN/review/main plus durable-consumer adoption | -| GAP-072 | Exact all-covered Wilson evidence could retain a zero lower endpoint even though the canonical non-empty finite-`z²` producer always emits `n/(n+z²) > 0` | `verification-pending` | RED `ce714f07...` + non-force source-restore RCA `18499052...` + repair `72e9d954...` + changelog `e3a2f4a2...`; inherited by #488 `8c34e2f1657f319d925222851570d103759863b4` | -| GAP-073 | Durable Wilson count provenance could round one uncovered observation away above binary64's exact-integer range and expose a pointer-width-dependent count schema | `verification-pending` | RED `29d710a5...` + complement/count repair `29968c80...` + fixed-width carrier repair `91d9a3bb...` + exact ratio RED/repair `63ddfdd6...`/`11323c57...`; #488 `8c34e2f1657f319d925222851570d103759863b4` | -| GAP-074 | Durable Wilson evidence could correctly retain exact `u64` counts yet pre-round `sample_count` before endpoint projection, shifting strict-interior endpoints or erasing all-covered finite-sample uncertainty | `verification-pending` | RED `f89e2467...` + all-covered edge `1a5180b2...` + stale-oracle correction `6254c498...` + causal reciprocal-scale repair `73bbb5cf...` + changelog `f2b5768b...` + research predecessor `7fc78a59...`; current #488 `8c34e2f1657f319d925222851570d103759863b4` | -| GAP-075 | Inexact durable all-covered Wilson evidence could round the complementary miss mass to exact one at extreme finite `z` and erase a representable positive lower endpoint | `verification-pending` | RED `059ce70d...`; transient duplicate-owner implementation `46f91f3f...` excluded; canonical repair `0f478392...`; single-writer cleanup `8e2058f2...`; exact-oracle correction `93d5d208...`; changelog correction `43b6562c...`; research predecessor `b03a719d...`; current #488 `8c34e2f1657f319d925222851570d103759863b4` | -| GAP-076 | Exactly representable all-covered Wilson counts could absorb a small positive `z²` in `n + z²` and falsely emit exact `1.0` although a lower binary64 endpoint is representable | `verification-pending` | RED `e0c4ec81...` + causal boundary repair `c9dcb9df...` + below-resolution edge `6140080d...` + changelog `09ebb482...` + research predecessor `fe89c438...`; current #488 `8c34e2f1657f319d925222851570d103759863b4` | -| GAP-077 | Exactly representable all-covered Wilson counts could form an inexact partial denominator `n + z²` whose rounded sum shifts the represented-input lower endpoint by one ULP even though neither operand is fully absorbed | `verification-pending` | RED `06e55653...` + causal TwoSum/FMA repair `6c084dbe...` + research `25cc1943...` + changelog `5acc894b...` + predecessor changelog correction `f89e36d1...` + correct-direct-rounding control `80a0a0ad...`; current #488 `8c34e2f1657f319d925222851570d103759863b4` | -| GAP-078 | Exact-count all-covered Wilson residual compensation could move a direct quotient by one ULP even when the represented-input rational remains on the same side of the adjacent midpoint | `verification-pending` | RED `d076d344...` + midpoint-selection repair `32314239...` + changelog `a75940c9...` + research predecessor `ef6441f7...`; current #488 `8c34e2f1657f319d925222851570d103759863b4` | -| GAP-079 | SE-aware acceptance could underflow a finite positive `k · SE` tolerance to exact zero by dividing `SE` by a much larger estimate/target scale before multiplication | `verification-pending` | RED `76067efc...` + causal direct-finite comparison repair `4ffdf366...` + changelog `d822c0ba...` + retained by current #488 `8c34e2f1657f319d925222851570d103759863b4` | -| GAP-080 | SE-aware acceptance both-overflow fallback could normalize an exact strict rejection into an equal rounded residual/bound and falsely accept it | `verification-pending` | RED `a9a45714...` + exact significand/exponent repair `425e8963...` + changelog `e6270629...` + retained by current #488 `8c34e2f1657f319d925222851570d103759863b4` | -| GAP-081 | SE-aware acceptance finite/finite multiplication could round an exact strict represented-input rejection into an equal residual/bound and falsely accept it | `verification-pending` | RED `23c3262c...` + tie repair `6a2add48...` + edge coverage `3656deb2...` + changelog `090f5124...` + inherited by current #488 `8c34e2f1657f319d925222851570d103759863b4` | -| GAP-082 | SE-aware acceptance finite subtraction could round an exact strict represented-input rejection onto an exact finite bound and falsely accept equality | `verification-pending` | RED `58cbc032...` + causal low-term comparison repair `68a6fd98...` + sign-symmetric edge `b2c06512...` + changelog `c4f752f3...` + inherited by current #488 `8c34e2f1657f319d925222851570d103759863b4` | -| GAP-083 | SE-aware acceptance product correction can fall below binary64 resolution even when the rounded finite bound is subnormal or minimum normal, erasing a strict represented-input rejection | `verification-pending` | RED `b55c5473...` + initial narrow repair `210cebc4...` + minimum-normal RED `c77ac440...` + corrected zero-projection repair `772ad8ed...` + changelog correction `ceb68825...` + inherited by current #488 `8c34e2f1657f319d925222851570d103759863b4` | -| GAP-084 | Legacy Wilson pair admission could accept an exact-zero/exact-one boundary even though the peer endpoint implied a representable non-boundary root | `verification-pending` | RED `c9d612f2...` + causal peer-root repair `88512417...` + branch-complete stable evaluation `6a4f89da...` + symmetry/serde/extreme-boundary contracts `0ce7639b...` + changelog `407b3645...` + inherited by current #488 `8c34e2f1657f319d925222851570d103759863b4` | -| GAP-085 | Equal nonzero SE-aware subtraction/FMA correction projections could conceal the exact represented-input ordering and turn a strict decision into rounded equality | `verification-pending` | RED `35ea85ba...` + exact product-roundoff repair `7d597a18...` + signed edge `b463a991...` + branch-scope refinement `ca8c2b86...` + changelog `702eec2f...` + research/current #488 `8c34e2f1...` | -| GAP-086 | Mean signed bias could reject a representable result because individual `recovered - truth` residuals overflow before opposing represented terms cancel | `verification-pending` | RED `04e6e745...` + explicit-denominator cancellation `28b1d186...` + causal bias repair `d1cd5461...` + changelog `d68dde34...` + research/current #488 `8c34e2f1...` | +| GAP-050 | Zero-multiplier SE-aware acceptance could erase a nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; #488 `4b74099b2f1d4e1afb6003af113b471f13df6bf9` | +| GAP-051 | Exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; #488 `4b74099b2f1d4e1afb6003af113b471f13df6bf9` | +| GAP-052 | All-covered Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; #488 `4b74099b2f1d4e1afb6003af113b471f13df6bf9` | +| GAP-053 | Strict-interior Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; #488 `4b74099b2f1d4e1afb6003af113b471f13df6bf9` | +| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; #488 `4b74099b2f1d4e1afb6003af113b471f13df6bf9` | +| GAP-055 | Strict-interior Wilson lower endpoint could accept a nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; #488 `4b74099b2f1d4e1afb6003af113b471f13df6bf9` | +| GAP-056 | Durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; #488 `4b74099b2f1d4e1afb6003af113b471f13df6bf9` | +| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from a generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; #488 `4b74099b2f1d4e1afb6003af113b471f13df6bf9` | +| GAP-058 | Generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; #488 `4b74099b2f1d4e1afb6003af113b471f13df6bf9` | +| GAP-059 | Generic Monte Carlo summary could materially misstate positive SE relative to `SD / sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; #488 `4b74099b2f1d4e1afb6003af113b471f13df6bf9` | +| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; #488 `4b74099b2f1d4e1afb6003af113b471f13df6bf9` | +| GAP-061 | Generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; #488 `4b74099b2f1d4e1afb6003af113b471f13df6bf9` | +| GAP-062 | Finite-tolerance matching could fail while the pair is deterministically outside every finite tolerance | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; #488 `4b74099b2f1d4e1afb6003af113b471f13df6bf9` | +| GAP-063 | Exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; #488 `4b74099b2f1d4e1afb6003af113b471f13df6bf9` | +| GAP-064 | Positive point RMSE could carry SE above the declared squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; #488 `4b74099b2f1d4e1afb6003af113b471f13df6bf9` | +| GAP-065 | Positive Monte Carlo RMSE could carry spread/SE impossible for nonnegative replications | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; #488 `4b74099b2f1d4e1afb6003af113b471f13df6bf9` | +| GAP-066 | RMSE Monte Carlo nearest-rank percentile could exceed total nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; #488 `4b74099b2f1d4e1afb6003af113b471f13df6bf9` | +| GAP-067 | Generic nearest-rank percentile endpoint could be individually incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected over-strong repair `2798e4f9...`; causal repair `c7151b49...`; edge `dbef285b...`; changelog `c38a320c...`; research `2bbcbb24...`; #488 `4b74099b2f1d4e1afb6003af113b471f13df6bf9` | +| GAP-068 | Distinct generic percentile endpoints could each pass individual radius checks while jointly exceeding the sample squared-deviation budget | `verification-pending` | RED `c4a13826...` + causal repair `cb3f80a2...` + changelog `f727450d...`; #488 `4b74099b2f1d4e1afb6003af113b471f13df6bf9` | +| GAP-069 | Two-replication distinct nearest-rank endpoints could exhaust the retained sample while the stored mean or SD remained impossible | `verification-pending` | RED `81bf0d9e...` + causal repair `d48f8fef...` + mean coverage `fb314d8a...` + branch cleanup `440b78d8...` + changelog `45116498...`; #488 `4b74099b2f1d4e1afb6003af113b471f13df6bf9` | +| GAP-070 | Stored Wilson bounds could contain empirical coverage while the lower/upper pair could not arise from one Wilson score interval for that same coverage | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...` + complementary edge `c1cb16a7...`; #488 `4b74099b2f1d4e1afb6003af113b471f13df6bf9` | +| GAP-071 | Durable Wilson evidence lacked denominator and critical-value/sidedness provenance, preventing exact recomputation from a persisted artifact | `active-repair` | valid carrier RED `6f6e06d2...`; shared count/Wilson authority `ca517ed3...`; `WilsonCoverageEvidenceV1` `31e1ab2b...`; sidedness `e9c63926...`/`fdd24a1a...`; envelope RED `07766cb0...` + `ValidationEvidenceV1` repair `a16f22e6...`; docs/current #488 `4b74099b2f1d4e1afb6003af113b471f13df6bf9`; remaining: hosted GREEN/review/main plus durable-consumer adoption | +| GAP-072 | Exact all-covered Wilson evidence could retain a zero lower endpoint even though the canonical non-empty finite-`z²` producer always emits `n/(n+z²) > 0` | `verification-pending` | RED `ce714f07...` + non-force source-restore RCA `18499052...` + repair `72e9d954...` + changelog `e3a2f4a2...`; inherited by #488 `4b74099b2f1d4e1afb6003af113b471f13df6bf9` | +| GAP-073 | Durable Wilson count provenance could round one uncovered observation away above binary64's exact-integer range and expose a pointer-width-dependent count schema | `verification-pending` | RED `29d710a5...` + complement/count repair `29968c80...` + fixed-width carrier repair `91d9a3bb...` + exact ratio RED/repair `63ddfdd6...`/`11323c57...`; #488 `4b74099b2f1d4e1afb6003af113b471f13df6bf9` | +| GAP-074 | Durable Wilson evidence could correctly retain exact `u64` counts yet pre-round `sample_count` before endpoint projection, shifting strict-interior endpoints or erasing all-covered finite-sample uncertainty | `verification-pending` | RED `f89e2467...` + all-covered edge `1a5180b2...` + stale-oracle correction `6254c498...` + causal reciprocal-scale repair `73bbb5cf...` + changelog `f2b5768b...` + research predecessor `7fc78a59...`; current #488 `4b74099b2f1d4e1afb6003af113b471f13df6bf9` | +| GAP-075 | Inexact durable all-covered Wilson evidence could round the complementary miss mass to exact one at extreme finite `z` and erase a representable positive lower endpoint | `verification-pending` | RED `059ce70d...`; transient duplicate-owner implementation `46f91f3f...` excluded; canonical repair `0f478392...`; single-writer cleanup `8e2058f2...`; exact-oracle correction `93d5d208...`; changelog correction `43b6562c...`; research predecessor `b03a719d...`; current #488 `4b74099b2f1d4e1afb6003af113b471f13df6bf9` | +| GAP-076 | Exactly representable all-covered Wilson counts could absorb a small positive `z²` in `n + z²` and falsely emit exact `1.0` although a lower binary64 endpoint is representable | `verification-pending` | RED `e0c4ec81...` + causal boundary repair `c9dcb9df...` + below-resolution edge `6140080d...` + changelog `09ebb482...` + research predecessor `fe89c438...`; current #488 `4b74099b2f1d4e1afb6003af113b471f13df6bf9` | +| GAP-077 | Exactly representable all-covered Wilson counts could form an inexact partial denominator `n + z²` whose rounded sum shifts the represented-input lower endpoint by one ULP even though neither operand is fully absorbed | `verification-pending` | RED `06e55653...` + causal TwoSum/FMA repair `6c084dbe...` + research `25cc1943...` + changelog `5acc894b...` + predecessor changelog correction `f89e36d1...` + correct-direct-rounding control `80a0a0ad...`; current #488 `4b74099b2f1d4e1afb6003af113b471f13df6bf9` | +| GAP-078 | Exact-count all-covered Wilson residual compensation could move a direct quotient by one ULP even when the represented-input rational remains on the same side of the adjacent midpoint | `verification-pending` | RED `d076d344...` + midpoint-selection repair `32314239...` + changelog `a75940c9...` + research predecessor `ef6441f7...`; current #488 `4b74099b2f1d4e1afb6003af113b471f13df6bf9` | +| GAP-079 | SE-aware acceptance could underflow a finite positive `k · SE` tolerance to exact zero by dividing `SE` by a much larger estimate/target scale before multiplication | `verification-pending` | RED `76067efc...` + causal direct-finite comparison repair `4ffdf366...` + changelog `d822c0ba...` + retained by current #488 `4b74099b2f1d4e1afb6003af113b471f13df6bf9` | +| GAP-080 | SE-aware acceptance both-overflow fallback could normalize an exact strict rejection into an equal rounded residual/bound and falsely accept it | `verification-pending` | RED `a9a45714...` + exact significand/exponent repair `425e8963...` + changelog `e6270629...` + retained by current #488 `4b74099b2f1d4e1afb6003af113b471f13df6bf9` | +| GAP-081 | SE-aware acceptance finite/finite multiplication could round an exact strict represented-input rejection into an equal residual/bound and falsely accept it | `verification-pending` | RED `23c3262c...` + tie repair `6a2add48...` + edge coverage `3656deb2...` + changelog `090f5124...` + inherited by current #488 `4b74099b2f1d4e1afb6003af113b471f13df6bf9` | +| GAP-082 | SE-aware acceptance finite subtraction could round an exact strict represented-input rejection onto an exact finite bound and falsely accept equality | `verification-pending` | RED `58cbc032...` + causal low-term comparison repair `68a6fd98...` + sign-symmetric edge `b2c06512...` + changelog `c4f752f3...` + inherited by current #488 `4b74099b2f1d4e1afb6003af113b471f13df6bf9` | +| GAP-083 | SE-aware acceptance product correction can fall below binary64 resolution even when the rounded finite bound is subnormal or minimum normal, erasing a strict represented-input rejection | `verification-pending` | RED `b55c5473...` + initial narrow repair `210cebc4...` + minimum-normal RED `c77ac440...` + corrected zero-projection repair `772ad8ed...` + changelog correction `ceb68825...` + inherited by current #488 `4b74099b2f1d4e1afb6003af113b471f13df6bf9` | +| GAP-084 | Legacy Wilson pair admission could accept an exact-zero/exact-one boundary even though the peer endpoint implied a representable non-boundary root | `verification-pending` | RED `c9d612f2...` + causal peer-root repair `88512417...` + branch-complete stable evaluation `6a4f89da...` + symmetry/serde/extreme-boundary contracts `0ce7639b...` + changelog `407b3645...` + inherited by current #488 `4b74099b2f1d4e1afb6003af113b471f13df6bf9` | +| GAP-085 | Equal nonzero SE-aware subtraction/FMA correction projections could conceal the exact represented-input ordering and turn a strict decision into rounded equality | `verification-pending` | RED `35ea85ba...` + exact product-roundoff repair `7d597a18...` + signed edge `b463a991...` + branch-scope refinement `ca8c2b86...` + changelog `702eec2f...` + research/current #488 `4b74099b...` | +| GAP-086 | Mean signed bias could reject a representable result because individual `recovered - truth` residuals overflow before opposing represented terms cancel | `verification-pending` | RED `04e6e745...` + explicit-denominator cancellation `28b1d186...` + causal bias repair `d1cd5461...` + changelog `d68dde34...` + inherited by current #488 `4b74099b...` | +| GAP-087 | Mean signed bias mixed-sign cancellation could discard repeated individually sub-ULP opposing residuals even though their combined represented mass changes the final bias | `verification-pending` | RED `63913727...` + error-free low-term repair `5697cca5...` + changelog `53f5c912...` + research/current #488 `4b74099b...` | ## Release gate From 6cf211fec97646c0a9ce608a134acd4157c0c886 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 5 Sep 2026 03:10:05 +0900 Subject: [PATCH 182/235] docs(gaps): record compensated bias division and main #490 --- docs/product-technical-gap-baseline.md | 115 +++++++++++++------------ 1 file changed, 58 insertions(+), 57 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index dd4dbdb48..bea7cd02b 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,8 +2,8 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-04T17:05:00Z -**Protected-main evidence:** `b18bca1c69ef8d1799fcd3af6bf4412498e007c3` +**Snapshot:** 2026-09-04T18:05:00Z +**Protected-main evidence:** `a243f18da4a4ca8a8d068c39922537f1f8ed6ad0` **Workspace version:** `0.2.0` **Delivery authority:** issue [#175](https://github.com/ContextualWisdomLab/TEPP/issues/175), PR [#435](https://github.com/ContextualWisdomLab/TEPP/pull/435), and [`docs/delivery/pr-queue-authority-2026-09-01.md`](delivery/pr-queue-authority-2026-09-01.md). @@ -14,7 +14,7 @@ A planning document, mergeable branch, local/source inspection, predecessor-head | Signal | Fresh evidence | Implication | | --- | ---: | --- | -| Protected `main` | `b18bca1c69ef8d1799fcd3af6bf4412498e007c3` | #489 is integrated; capability claims remain bounded to this commit until main advances. | +| Protected `main` | `a243f18da4a4ca8a8d068c39922537f1f8ed6ad0` | #490 is integrated; capability claims remain bounded to this commit until main advances. | | Open pull requests | **134** | WIP circuit breaker remains active; consolidate into existing bounded-context vehicles. | | Draft pull requests | **134** | Every current open PR is Draft. | | Non-Draft pull requests | **0** | No PR is eligible for normal merge until deliberately made Ready after exact-head evidence. | @@ -22,7 +22,7 @@ A planning document, mergeable branch, local/source inspection, predecessor-head | GitHub releases | **0** | No TEPP open head is a released contract. | | Organization ruleset | `18156473` | One qualifying current-head approval, stale-review dismissal after push, resolved threads, extra approval for unattributed changes where applicable, and central required workflows. | -Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward updates on the default branch. Organization-admin bypass is not normal delivery evidence and is not used by this writer. Protected-main #489 removes the repository-local hourly PR-maintenance caller in favor of the central required scheduler, narrows duplicate documentation triggers, isolates PR validation concurrency by repository/PR, and combines line/branch coverage work while retaining both coverage gates. +Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward updates on the default branch. Organization-admin bypass is not normal delivery evidence and is not used by this writer. Protected-main #489 narrowed duplicate workflow load and combined line/branch coverage work while retaining both gates; #490 then centralized hourly-development admission. A branch that reintroduces a repository-local hourly schedule after #490 is a repair finding rather than new scheduler authority. ## Current priority open pull-request evidence @@ -30,17 +30,17 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `4b74099b2f1d4e1afb6003af113b471f13df6bf9` | true | `main` | Validation Evidence landing vehicle, non-force restacked onto protected #489. GAP-087 retains error-free low terms during mixed-sign mean-bias cancellation so repeated sub-ULP opposing residuals cannot disappear one at a time before their combined represented mass changes the final bias. GAP-086 and prior Wilson, provenance, Monte Carlo, RMSE/SE, matching, serde/projection, and GAP-079–085 repairs remain inherited. Hosted exact-head gates and independent review remain required. | +| #488 | `ba81aa295a7877fb87767064547031851c31a754` | true | `main` | Validation Evidence landing vehicle, non-force restacked onto protected #490. GAP-088 carries retained mixed-sign compensation through the original scientific denominator rather than rounding it into an intermediate numerator; GAP-087 preserves cancellation low terms. GAP-086 and prior Wilson, provenance, Monte Carlo, RMSE/SE, matching, serde/projection, and GAP-079–085 repairs remain inherited. Hosted exact-head gates and independent review remain required. | | #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 | Validation / Analysis Run fold child. Unique evidence must be inherited by a conflict-resolving survivor; child-head CI does not transfer. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | | #483 | `847d96f913bb261803ac0bd751ad7e4f51324cee` | true | #416 | Analysis Run fold child; preserve unique evidence. | | #482 | `506dbae236a4484301b704b6c6a05b20faf0fe69` | true | #416 | Analysis Run fold child; preserve unique evidence. | -| #480 | `01f45a99392457334a4f6d3d659f992af739eeee` | true | `main` | contextual-orchestrator consumer repair; stays Draft while immutable CO release/deployment/auth provenance is unavailable. | +| #480 | `03876fb3e4c727bb754125ce531d928450d78303` | true | `main` | contextual-orchestrator consumer repair remains Draft while immutable CO release/deployment/auth provenance is unavailable. Its latest branch commit reintroduces a local hourly schedule that protected #490 removed, so wrong-base/restack repair is required before integration; this is not grounds to close the dependent owner-contract work. | | #460 | `dfab4eab5ff733731e565a9348072b8dab2e4912` | true | #416 | Analysis Run fold child; typed cutoff equality and terminal-validation separation. | | #458 | `08165e3b3c929b4ae77396689549f72723ff8ff5` | true | #416 | Analysis Run fold child; typed cutoff equality and terminal-validation separation. | -| #416 | `aa730c63563eb4a33048d822b581036c8487bd47` | true | `main` | Validation / Analysis Run landing vehicle. Generic cutoff-before-identity repair remains in ancestry. | -| #310 | `c6680450152b1e0a2c9abb553772d74a23923335` | true | `main` | Longitudinal Modeling vehicle. Stable `Between` recovery is unit-level with canonical occasion `0`; `Within` retains actual occasion identity. | +| #416 | `aa730c63563eb4a33048d822b581036c8487bd47` | true | `main` | Validation / Analysis Run landing vehicle. Generic cutoff-before-identity repair remains in ancestry; branch is still based before #489/#490 and needs non-destructive consolidation/restack when its fold scope is ready. | +| #310 | `c6680450152b1e0a2c9abb553772d74a23923335` | true | `main` | Longitudinal Modeling vehicle. Stable `Between` recovery is unit-level with canonical occasion `0`; `Within` retains actual occasion identity. Branch is still based before #489/#490 and remains a non-force restack finding, not a closure candidate. | Exact-head evidence becomes stale after any source push. @@ -62,7 +62,7 @@ The clock contract separates event/valid time, assertion time, document time, sy - Row arrival order is not scientific evidence. Fixed admitted observations must produce bit-identical means/centered results under permutation wherever the contract claims deterministic CPU `f64` reference behavior. - Known-truth component recovery follows bounded-context identity: stable `Between` is unit-level and uses canonical `occasion_index = 0`; `Within` retains actual `(unit, occasion)` identity. Duplicate identities or stable-Between occasion aliases are not weights. - A representable final scientific estimand is not rejected solely because an avoidable intermediate binary64 operation overflows/underflows. False exact 0/1/non-finite endpoints, erased finite bounds, and cancellation residues are not accepted when an equivalent operation order preserves the represented estimand or decision. -- Mean signed bias and bias SE remain Validation Evidence performance measures over admitted recovery units. `mean_bias` keeps the direct residual path when residuals are finite; if finite inputs create an overflowing pairwise residual while the final bias remains representable, the equivalent recovered-plus-negated-truth numerator is sign-cancelled before exact-power-of-two scale reduction and divided by the original recovery-unit count. During mixed-sign cancellation, error-free low terms are retained so repeated individually sub-ULP opposing residuals can still change the represented mean when their combined mass is material. `bias_standard_error` still requires representable individual residual dispersion. Mathematically nonzero final results below or above binary64 range fail closed. +- Mean signed bias and bias SE remain Validation Evidence performance measures over admitted recovery units. `mean_bias` keeps the direct residual path when residuals are finite; if finite inputs create an overflowing pairwise residual while the final bias remains representable, the equivalent recovered-plus-negated-truth numerator is sign-cancelled before exact-power-of-two scale reduction and divided by the original recovery-unit count. During mixed-sign cancellation, error-free low terms are retained so repeated individually sub-ULP opposing residuals can still change the represented mean when their combined mass is material. When such retained compensation exists, the high part, division residual, and compensation are carried through the original scientific denominator before final scale restoration; an independently rounded intermediate numerator is not scientific authority. `bias_standard_error` still requires representable individual residual dispersion. Mathematically nonzero final results below or above binary64 range fail closed. - Generic Validation Evidence RMSE and its delta-method SE normalize before squaring. Exact-zero point RMSE requires exact-zero point RMSE SE. For positive RMSE, the declared producer satisfies `SE(RMSE) <= RMSE / 2`, with a small relative binary64 admission tolerance. - Generic `MonteCarloSummary` is sign-neutral. Zero SD requires zero SE and percentile endpoints equal to the represented mean. Positive SD requires positive SE coherent with represented `SD / sqrt(n)` within a small relative tolerance. Every inclusive nearest-rank endpoint is a retained observation and satisfies `|endpoint - mean| <= SD * sqrt(n - 1)`. Distinct lower/upper endpoint values share the same `(n - 1) * SD²` deviation budget. When `replication_count = 2` and endpoints are numerically distinct, those values exhaust the retained sample and the recorded represented mean/sample SD must match deterministic two-value reconstruction. Equal numeric endpoints do not prove two distinct ranks and are not subjected to that exhaustion rule. - When the generic carrier occupies `ValidationReport::monte_carlo_rmse`, retained replications are nonnegative; positive mean implies `SE(mean) <= mean`, and inclusive nearest-rank endpoints cannot exceed nonnegative sample-sum support `n * mean`. These typed bounds are not imposed on signed metrics such as bias. @@ -79,23 +79,23 @@ The clock contract separates event/valid time, assertion time, document time, sy ### #310 — Longitudinal Modeling -#310 remains the canonical Longitudinal Modeling landing vehicle at `c6680450152b1e0a2c9abb553772d74a23923335`. Current-head Rust/documentation/security/review evidence remains required before Ready/merge; predecessor or child-head evidence does not transfer. +#310 remains the canonical Longitudinal Modeling landing vehicle at `c6680450152b1e0a2c9abb553772d74a23923335`. It is still based before protected #489/#490, so wrong-base/restack is a repair finding. Current-head Rust/documentation/security/review evidence remains required before Ready/merge; predecessor or child-head evidence does not transfer. ### #488 — Validation Evidence -#488 is the generic Validation Evidence landing vehicle at exact head `4b74099b2f1d4e1afb6003af113b471f13df6bf9`, non-force restacked onto protected #489. GAP-087 adds public RED `63913727a3dfc2dd65c2508fe7e4acfdd6498508`: residuals equivalent to `[1, -2^-54, -2^-54, -2^-54, -2^-54]` lose four individually sub-ULP opposing terms under ordinary repeated cancellation even though their aggregate changes the represented-input mean from ordinary `0.2` bits `0x3fc999999999999a` to `0x3fc9999999999998`. Causal repair `5697cca51df2ec49e44a04730a14fd77656b48a5` retains TwoSum low terms while preserving the existing high-part cancellation order and original scientific denominator; CHANGELOG `53f5c912fbca415172f621c909b626ea1db66582`; research/current #488 `4b74099b2f1d4e1afb6003af113b471f13df6bf9`. +#488 is the generic Validation Evidence landing vehicle at exact head `ba81aa295a7877fb87767064547031851c31a754`, non-force restacked onto protected #490. GAP-088 adds public RED `8b4d19d161cb4322db3a143b2e34125d3bcc08f1`: residuals `[2^-53, -2^-52, -(1 + 2^-52)]` have exact represented-input numerator `-(1 + 3*2^-53)` and mean bits `0xbfd5555555555557`, while the GAP-087 predecessor rounded `sum + correction` before division and produced `0xbfd5555555555558`. Causal repair `7a33212b0c0f079a9fb138b6a8564881bc22fc9e` retains the normalized Neumaier high part and correction through the original count division, recovers the high-part division residual with FMA, and restores the exact power-of-two scale only after that correction is consumed. CHANGELOG `bad698dd686ce69a96aee1ca748bd7dc8e63aa1b`; research/current #488 `ba81aa295a7877fb87767064547031851c31a754`. -GAP-086 remains inherited: public RED `04e6e74507a1adb89aac4b2a58d3682746da30ea` covers pairwise residual overflow with representable final cancellation; shared explicit-denominator repair `28b1d186ce2bd08b63ca267c8b98b2eae45d2da7` and bias repair `d1cd54615ddc311491e26fa427e956b5b5379e1a` preserve that representable mean while one-sided unrepresentable bias still fails closed. `bias_standard_error` remains unchanged because individual residual dispersion is part of its estimand. +GAP-087 remains inherited: public RED `63913727a3dfc2dd65c2508fe7e4acfdd6498508` covers repeated individually sub-ULP opposing residuals whose combined represented mass changes the final mean; repair `5697cca51df2ec49e44a04730a14fd77656b48a5` retains error-free TwoSum low terms. GAP-086 remains inherited: RED `04e6e74507a1adb89aac4b2a58d3682746da30ea`, explicit-denominator cancellation `28b1d186ce2bd08b63ca267c8b98b2eae45d2da7`, and bias repair `d1cd54615ddc311491e26fa427e956b5b5379e1a` preserve a representable final mean when pairwise residual materialization overflows and cancels. `bias_standard_error` remains unchanged because individual residual dispersion is part of its estimand. -GAP-071/GAP-073–GAP-087 remain delivery-pending until current-head hosted gates, independent review, protected-main integration, and required durable-consumer adoption are verified. Bare legacy `ValidationReport` remains a backward-compatible compact projection and is not silently treated as v1 provenance. Earlier GAP-045–086 source/test/fixture/contract/research lineages remain in #488 ancestry and the register below. +GAP-071/GAP-073–GAP-088 remain delivery-pending until current-head hosted gates, independent review, protected-main integration, and required durable-consumer adoption are verified. Bare legacy `ValidationReport` remains a backward-compatible compact projection and is not silently treated as v1 provenance. Earlier GAP-045–087 source/test/fixture/contract/research lineages remain in #488 ancestry and the register below. ### #416 — Validation / Analysis Run consolidation -#416 branch head is `aa730c63563eb4a33048d822b581036c8487bd47`; #458/#460/#482/#483/#484/#485/#487 remain fold children until every unique source/test/fixture/contract/doctoring delta is inherited by a conflict-resolving survivor. Child-head evidence does not transfer to #416. +#416 branch head is `aa730c63563eb4a33048d822b581036c8487bd47`; #458/#460/#482/#483/#484/#485/#487 remain fold children until every unique source/test/fixture/contract/doctoring delta is inherited by a conflict-resolving survivor. Child-head evidence does not transfer to #416. The vehicle is still based before #489/#490 and must be non-destructively restacked/consolidated rather than closed for staleness. ### #480 — contextual-orchestrator boundary -#480 removes TEPP-owned provider discovery/ranking and requires a released contextual-orchestrator owner contract. Its exact source head remains `01f45a99392457334a4f6d3d659f992af739eeee`. contextual-orchestrator protected main is `2e414d15ba58f28597751b625a8a2f00fc9fadcf`, but GitHub releases remain zero, so #480 stays Draft until an immutable compatible release plus deployment/auth/schema/artifact provenance exists. Mutable owner main is evidence, not a production contract. +#480 removes TEPP-owned provider discovery/ranking and requires a released contextual-orchestrator owner contract. Its current branch head is `03876fb3e4c727bb754125ce531d928450d78303`; the latest commit reintroduces the local hourly `schedule` removed by protected #490, so that wrong-base delta must be repaired during a non-force restack rather than treated as new scheduler authority. contextual-orchestrator protected main remains `2e414d15ba58f28597751b625a8a2f00fc9fadcf`, and GitHub releases remain zero. #480 therefore stays Draft until both the local scheduler conflict and the immutable compatible release/deployment/auth/schema/artifact provenance prerequisites are resolved. Mutable owner main is evidence, not a production contract. ## Gap register @@ -145,49 +145,50 @@ GAP-071/GAP-073–GAP-087 remain delivery-pending until current-head hosted gate | GAP-042 | Ratio-first logarithm could nearly double an adjacent-float irregular residual growth rate | `verification-pending` | RED `766ddc7a...` + `ln_1p` repair `16f21d9a...` | | GAP-043 | Duplicate known-truth component identities could silently reweight RMSE recovery evidence | `verification-pending` | RED `698f12f5...` + uniqueness repair `2fae4cb2...` | | GAP-044 | Known-truth RMSE alignment/accumulation depended on row order instead of component identity | `verification-pending` | RED `8ad72ac9...` / `5fb93c40...` + repairs `2dd9537e...` / `025dce7f...`; #310 `c6680450...` | -| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; #488 `4b74099b2f1d4e1afb6003af113b471f13df6bf9` | -| GAP-046 | Bias SE could reject a representable SEM because raw squared deviations/intermediates overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; #488 `4b74099b2f1d4e1afb6003af113b471f13df6bf9` | -| GAP-047 | Generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; #488 `4b74099b2f1d4e1afb6003af113b471f13df6bf9` | -| GAP-048 | Mean signed bias could erase a representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; #488 `4b74099b2f1d4e1afb6003af113b471f13df6bf9` | +| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; #488 `ba81aa295a7877fb87767064547031851c31a754` | +| GAP-046 | Bias SE could reject a representable SEM because raw squared deviations/intermediates overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; #488 `ba81aa295a7877fb87767064547031851c31a754` | +| GAP-047 | Generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; #488 `ba81aa295a7877fb87767064547031851c31a754` | +| GAP-048 | Mean signed bias could erase a representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; #488 `ba81aa295a7877fb87767064547031851c31a754` | | GAP-049 | Stable `Between` recovery could be aliased across occasion indices and reweight RMSE | `verification-pending` | RED `0a03041c...` + repair `ec2c1219...`; #310 `c6680450...` | -| GAP-050 | Zero-multiplier SE-aware acceptance could erase a nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; #488 `4b74099b2f1d4e1afb6003af113b471f13df6bf9` | -| GAP-051 | Exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; #488 `4b74099b2f1d4e1afb6003af113b471f13df6bf9` | -| GAP-052 | All-covered Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; #488 `4b74099b2f1d4e1afb6003af113b471f13df6bf9` | -| GAP-053 | Strict-interior Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; #488 `4b74099b2f1d4e1afb6003af113b471f13df6bf9` | -| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; #488 `4b74099b2f1d4e1afb6003af113b471f13df6bf9` | -| GAP-055 | Strict-interior Wilson lower endpoint could accept a nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; #488 `4b74099b2f1d4e1afb6003af113b471f13df6bf9` | -| GAP-056 | Durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; #488 `4b74099b2f1d4e1afb6003af113b471f13df6bf9` | -| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from a generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; #488 `4b74099b2f1d4e1afb6003af113b471f13df6bf9` | -| GAP-058 | Generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; #488 `4b74099b2f1d4e1afb6003af113b471f13df6bf9` | -| GAP-059 | Generic Monte Carlo summary could materially misstate positive SE relative to `SD / sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; #488 `4b74099b2f1d4e1afb6003af113b471f13df6bf9` | -| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; #488 `4b74099b2f1d4e1afb6003af113b471f13df6bf9` | -| GAP-061 | Generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; #488 `4b74099b2f1d4e1afb6003af113b471f13df6bf9` | -| GAP-062 | Finite-tolerance matching could fail while the pair is deterministically outside every finite tolerance | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; #488 `4b74099b2f1d4e1afb6003af113b471f13df6bf9` | -| GAP-063 | Exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; #488 `4b74099b2f1d4e1afb6003af113b471f13df6bf9` | -| GAP-064 | Positive point RMSE could carry SE above the declared squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; #488 `4b74099b2f1d4e1afb6003af113b471f13df6bf9` | -| GAP-065 | Positive Monte Carlo RMSE could carry spread/SE impossible for nonnegative replications | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; #488 `4b74099b2f1d4e1afb6003af113b471f13df6bf9` | -| GAP-066 | RMSE Monte Carlo nearest-rank percentile could exceed total nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; #488 `4b74099b2f1d4e1afb6003af113b471f13df6bf9` | -| GAP-067 | Generic nearest-rank percentile endpoint could be individually incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected over-strong repair `2798e4f9...`; causal repair `c7151b49...`; edge `dbef285b...`; changelog `c38a320c...`; research `2bbcbb24...`; #488 `4b74099b2f1d4e1afb6003af113b471f13df6bf9` | -| GAP-068 | Distinct generic percentile endpoints could each pass individual radius checks while jointly exceeding the sample squared-deviation budget | `verification-pending` | RED `c4a13826...` + causal repair `cb3f80a2...` + changelog `f727450d...`; #488 `4b74099b2f1d4e1afb6003af113b471f13df6bf9` | -| GAP-069 | Two-replication distinct nearest-rank endpoints could exhaust the retained sample while the stored mean or SD remained impossible | `verification-pending` | RED `81bf0d9e...` + causal repair `d48f8fef...` + mean coverage `fb314d8a...` + branch cleanup `440b78d8...` + changelog `45116498...`; #488 `4b74099b2f1d4e1afb6003af113b471f13df6bf9` | -| GAP-070 | Stored Wilson bounds could contain empirical coverage while the lower/upper pair could not arise from one Wilson score interval for that same coverage | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...` + complementary edge `c1cb16a7...`; #488 `4b74099b2f1d4e1afb6003af113b471f13df6bf9` | -| GAP-071 | Durable Wilson evidence lacked denominator and critical-value/sidedness provenance, preventing exact recomputation from a persisted artifact | `active-repair` | valid carrier RED `6f6e06d2...`; shared count/Wilson authority `ca517ed3...`; `WilsonCoverageEvidenceV1` `31e1ab2b...`; sidedness `e9c63926...`/`fdd24a1a...`; envelope RED `07766cb0...` + `ValidationEvidenceV1` repair `a16f22e6...`; docs/current #488 `4b74099b2f1d4e1afb6003af113b471f13df6bf9`; remaining: hosted GREEN/review/main plus durable-consumer adoption | -| GAP-072 | Exact all-covered Wilson evidence could retain a zero lower endpoint even though the canonical non-empty finite-`z²` producer always emits `n/(n+z²) > 0` | `verification-pending` | RED `ce714f07...` + non-force source-restore RCA `18499052...` + repair `72e9d954...` + changelog `e3a2f4a2...`; inherited by #488 `4b74099b2f1d4e1afb6003af113b471f13df6bf9` | -| GAP-073 | Durable Wilson count provenance could round one uncovered observation away above binary64's exact-integer range and expose a pointer-width-dependent count schema | `verification-pending` | RED `29d710a5...` + complement/count repair `29968c80...` + fixed-width carrier repair `91d9a3bb...` + exact ratio RED/repair `63ddfdd6...`/`11323c57...`; #488 `4b74099b2f1d4e1afb6003af113b471f13df6bf9` | -| GAP-074 | Durable Wilson evidence could correctly retain exact `u64` counts yet pre-round `sample_count` before endpoint projection, shifting strict-interior endpoints or erasing all-covered finite-sample uncertainty | `verification-pending` | RED `f89e2467...` + all-covered edge `1a5180b2...` + stale-oracle correction `6254c498...` + causal reciprocal-scale repair `73bbb5cf...` + changelog `f2b5768b...` + research predecessor `7fc78a59...`; current #488 `4b74099b2f1d4e1afb6003af113b471f13df6bf9` | -| GAP-075 | Inexact durable all-covered Wilson evidence could round the complementary miss mass to exact one at extreme finite `z` and erase a representable positive lower endpoint | `verification-pending` | RED `059ce70d...`; transient duplicate-owner implementation `46f91f3f...` excluded; canonical repair `0f478392...`; single-writer cleanup `8e2058f2...`; exact-oracle correction `93d5d208...`; changelog correction `43b6562c...`; research predecessor `b03a719d...`; current #488 `4b74099b2f1d4e1afb6003af113b471f13df6bf9` | -| GAP-076 | Exactly representable all-covered Wilson counts could absorb a small positive `z²` in `n + z²` and falsely emit exact `1.0` although a lower binary64 endpoint is representable | `verification-pending` | RED `e0c4ec81...` + causal boundary repair `c9dcb9df...` + below-resolution edge `6140080d...` + changelog `09ebb482...` + research predecessor `fe89c438...`; current #488 `4b74099b2f1d4e1afb6003af113b471f13df6bf9` | -| GAP-077 | Exactly representable all-covered Wilson counts could form an inexact partial denominator `n + z²` whose rounded sum shifts the represented-input lower endpoint by one ULP even though neither operand is fully absorbed | `verification-pending` | RED `06e55653...` + causal TwoSum/FMA repair `6c084dbe...` + research `25cc1943...` + changelog `5acc894b...` + predecessor changelog correction `f89e36d1...` + correct-direct-rounding control `80a0a0ad...`; current #488 `4b74099b2f1d4e1afb6003af113b471f13df6bf9` | -| GAP-078 | Exact-count all-covered Wilson residual compensation could move a direct quotient by one ULP even when the represented-input rational remains on the same side of the adjacent midpoint | `verification-pending` | RED `d076d344...` + midpoint-selection repair `32314239...` + changelog `a75940c9...` + research predecessor `ef6441f7...`; current #488 `4b74099b2f1d4e1afb6003af113b471f13df6bf9` | -| GAP-079 | SE-aware acceptance could underflow a finite positive `k · SE` tolerance to exact zero by dividing `SE` by a much larger estimate/target scale before multiplication | `verification-pending` | RED `76067efc...` + causal direct-finite comparison repair `4ffdf366...` + changelog `d822c0ba...` + retained by current #488 `4b74099b2f1d4e1afb6003af113b471f13df6bf9` | -| GAP-080 | SE-aware acceptance both-overflow fallback could normalize an exact strict rejection into an equal rounded residual/bound and falsely accept it | `verification-pending` | RED `a9a45714...` + exact significand/exponent repair `425e8963...` + changelog `e6270629...` + retained by current #488 `4b74099b2f1d4e1afb6003af113b471f13df6bf9` | -| GAP-081 | SE-aware acceptance finite/finite multiplication could round an exact strict represented-input rejection into an equal residual/bound and falsely accept it | `verification-pending` | RED `23c3262c...` + tie repair `6a2add48...` + edge coverage `3656deb2...` + changelog `090f5124...` + inherited by current #488 `4b74099b2f1d4e1afb6003af113b471f13df6bf9` | -| GAP-082 | SE-aware acceptance finite subtraction could round an exact strict represented-input rejection onto an exact finite bound and falsely accept equality | `verification-pending` | RED `58cbc032...` + causal low-term comparison repair `68a6fd98...` + sign-symmetric edge `b2c06512...` + changelog `c4f752f3...` + inherited by current #488 `4b74099b2f1d4e1afb6003af113b471f13df6bf9` | -| GAP-083 | SE-aware acceptance product correction can fall below binary64 resolution even when the rounded finite bound is subnormal or minimum normal, erasing a strict represented-input rejection | `verification-pending` | RED `b55c5473...` + initial narrow repair `210cebc4...` + minimum-normal RED `c77ac440...` + corrected zero-projection repair `772ad8ed...` + changelog correction `ceb68825...` + inherited by current #488 `4b74099b2f1d4e1afb6003af113b471f13df6bf9` | -| GAP-084 | Legacy Wilson pair admission could accept an exact-zero/exact-one boundary even though the peer endpoint implied a representable non-boundary root | `verification-pending` | RED `c9d612f2...` + causal peer-root repair `88512417...` + branch-complete stable evaluation `6a4f89da...` + symmetry/serde/extreme-boundary contracts `0ce7639b...` + changelog `407b3645...` + inherited by current #488 `4b74099b2f1d4e1afb6003af113b471f13df6bf9` | -| GAP-085 | Equal nonzero SE-aware subtraction/FMA correction projections could conceal the exact represented-input ordering and turn a strict decision into rounded equality | `verification-pending` | RED `35ea85ba...` + exact product-roundoff repair `7d597a18...` + signed edge `b463a991...` + branch-scope refinement `ca8c2b86...` + changelog `702eec2f...` + research/current #488 `4b74099b...` | -| GAP-086 | Mean signed bias could reject a representable result because individual `recovered - truth` residuals overflow before opposing represented terms cancel | `verification-pending` | RED `04e6e745...` + explicit-denominator cancellation `28b1d186...` + causal bias repair `d1cd5461...` + changelog `d68dde34...` + inherited by current #488 `4b74099b...` | -| GAP-087 | Mean signed bias mixed-sign cancellation could discard repeated individually sub-ULP opposing residuals even though their combined represented mass changes the final bias | `verification-pending` | RED `63913727...` + error-free low-term repair `5697cca5...` + changelog `53f5c912...` + research/current #488 `4b74099b...` | +| GAP-050 | Zero-multiplier SE-aware acceptance could erase a nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; #488 `ba81aa295a7877fb87767064547031851c31a754` | +| GAP-051 | Exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; #488 `ba81aa295a7877fb87767064547031851c31a754` | +| GAP-052 | All-covered Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; #488 `ba81aa295a7877fb87767064547031851c31a754` | +| GAP-053 | Strict-interior Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; #488 `ba81aa295a7877fb87767064547031851c31a754` | +| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; #488 `ba81aa295a7877fb87767064547031851c31a754` | +| GAP-055 | Strict-interior Wilson lower endpoint could accept a nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; #488 `ba81aa295a7877fb87767064547031851c31a754` | +| GAP-056 | Durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; #488 `ba81aa295a7877fb87767064547031851c31a754` | +| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from a generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; #488 `ba81aa295a7877fb87767064547031851c31a754` | +| GAP-058 | Generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; #488 `ba81aa295a7877fb87767064547031851c31a754` | +| GAP-059 | Generic Monte Carlo summary could materially misstate positive SE relative to `SD / sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; #488 `ba81aa295a7877fb87767064547031851c31a754` | +| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; #488 `ba81aa295a7877fb87767064547031851c31a754` | +| GAP-061 | Generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; #488 `ba81aa295a7877fb87767064547031851c31a754` | +| GAP-062 | Finite-tolerance matching could fail while the pair is deterministically outside every finite tolerance | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; #488 `ba81aa295a7877fb87767064547031851c31a754` | +| GAP-063 | Exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; #488 `ba81aa295a7877fb87767064547031851c31a754` | +| GAP-064 | Positive point RMSE could carry SE above the declared squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; #488 `ba81aa295a7877fb87767064547031851c31a754` | +| GAP-065 | Positive Monte Carlo RMSE could carry spread/SE impossible for nonnegative replications | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; #488 `ba81aa295a7877fb87767064547031851c31a754` | +| GAP-066 | RMSE Monte Carlo nearest-rank percentile could exceed total nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; #488 `ba81aa295a7877fb87767064547031851c31a754` | +| GAP-067 | Generic nearest-rank percentile endpoint could be individually incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected over-strong repair `2798e4f9...`; causal repair `c7151b49...`; edge `dbef285b...`; changelog `c38a320c...`; research `2bbcbb24...`; #488 `ba81aa295a7877fb87767064547031851c31a754` | +| GAP-068 | Distinct generic percentile endpoints could each pass individual radius checks while jointly exceeding the sample squared-deviation budget | `verification-pending` | RED `c4a13826...` + causal repair `cb3f80a2...` + changelog `f727450d...`; #488 `ba81aa295a7877fb87767064547031851c31a754` | +| GAP-069 | Two-replication distinct nearest-rank endpoints could exhaust the retained sample while the stored mean or SD remained impossible | `verification-pending` | RED `81bf0d9e...` + causal repair `d48f8fef...` + mean coverage `fb314d8a...` + branch cleanup `440b78d8...` + changelog `45116498...`; #488 `ba81aa295a7877fb87767064547031851c31a754` | +| GAP-070 | Stored Wilson bounds could contain empirical coverage while the lower/upper pair could not arise from one Wilson score interval for that same coverage | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...` + complementary edge `c1cb16a7...`; #488 `ba81aa295a7877fb87767064547031851c31a754` | +| GAP-071 | Durable Wilson evidence lacked denominator and critical-value/sidedness provenance, preventing exact recomputation from a persisted artifact | `active-repair` | valid carrier RED `6f6e06d2...`; shared count/Wilson authority `ca517ed3...`; `WilsonCoverageEvidenceV1` `31e1ab2b...`; sidedness `e9c63926...`/`fdd24a1a...`; envelope RED `07766cb0...` + `ValidationEvidenceV1` repair `a16f22e6...`; docs/current #488 `ba81aa295a7877fb87767064547031851c31a754`; remaining: hosted GREEN/review/main plus durable-consumer adoption | +| GAP-072 | Exact all-covered Wilson evidence could retain a zero lower endpoint even though the canonical non-empty finite-`z²` producer always emits `n/(n+z²) > 0` | `verification-pending` | RED `ce714f07...` + non-force source-restore RCA `18499052...` + repair `72e9d954...` + changelog `e3a2f4a2...`; inherited by #488 `ba81aa295a7877fb87767064547031851c31a754` | +| GAP-073 | Durable Wilson count provenance could round one uncovered observation away above binary64's exact-integer range and expose a pointer-width-dependent count schema | `verification-pending` | RED `29d710a5...` + complement/count repair `29968c80...` + fixed-width carrier repair `91d9a3bb...` + exact ratio RED/repair `63ddfdd6...`/`11323c57...`; #488 `ba81aa295a7877fb87767064547031851c31a754` | +| GAP-074 | Durable Wilson evidence could correctly retain exact `u64` counts yet pre-round `sample_count` before endpoint projection, shifting strict-interior endpoints or erasing all-covered finite-sample uncertainty | `verification-pending` | RED `f89e2467...` + all-covered edge `1a5180b2...` + stale-oracle correction `6254c498...` + causal reciprocal-scale repair `73bbb5cf...` + changelog `f2b5768b...` + research predecessor `7fc78a59...`; current #488 `ba81aa295a7877fb87767064547031851c31a754` | +| GAP-075 | Inexact durable all-covered Wilson evidence could round the complementary miss mass to exact one at extreme finite `z` and erase a representable positive lower endpoint | `verification-pending` | RED `059ce70d...`; transient duplicate-owner implementation `46f91f3f...` excluded; canonical repair `0f478392...`; single-writer cleanup `8e2058f2...`; exact-oracle correction `93d5d208...`; changelog correction `43b6562c...`; research predecessor `b03a719d...`; current #488 `ba81aa295a7877fb87767064547031851c31a754` | +| GAP-076 | Exactly representable all-covered Wilson counts could absorb a small positive `z²` in `n + z²` and falsely emit exact `1.0` although a lower binary64 endpoint is representable | `verification-pending` | RED `e0c4ec81...` + causal boundary repair `c9dcb9df...` + below-resolution edge `6140080d...` + changelog `09ebb482...` + research predecessor `fe89c438...`; current #488 `ba81aa295a7877fb87767064547031851c31a754` | +| GAP-077 | Exactly representable all-covered Wilson counts could form an inexact partial denominator `n + z²` whose rounded sum shifts the represented-input lower endpoint by one ULP even though neither operand is fully absorbed | `verification-pending` | RED `06e55653...` + causal TwoSum/FMA repair `6c084dbe...` + research `25cc1943...` + changelog `5acc894b...` + predecessor changelog correction `f89e36d1...` + correct-direct-rounding control `80a0a0ad...`; current #488 `ba81aa295a7877fb87767064547031851c31a754` | +| GAP-078 | Exact-count all-covered Wilson residual compensation could move a direct quotient by one ULP even when the represented-input rational remains on the same side of the adjacent midpoint | `verification-pending` | RED `d076d344...` + midpoint-selection repair `32314239...` + changelog `a75940c9...` + research predecessor `ef6441f7...`; current #488 `ba81aa295a7877fb87767064547031851c31a754` | +| GAP-079 | SE-aware acceptance could underflow a finite positive `k · SE` tolerance to exact zero by dividing `SE` by a much larger estimate/target scale before multiplication | `verification-pending` | RED `76067efc...` + causal direct-finite comparison repair `4ffdf366...` + changelog `d822c0ba...` + retained by current #488 `ba81aa295a7877fb87767064547031851c31a754` | +| GAP-080 | SE-aware acceptance both-overflow fallback could normalize an exact strict rejection into an equal rounded residual/bound and falsely accept it | `verification-pending` | RED `a9a45714...` + exact significand/exponent repair `425e8963...` + changelog `e6270629...` + retained by current #488 `ba81aa295a7877fb87767064547031851c31a754` | +| GAP-081 | SE-aware acceptance finite/finite multiplication could round an exact strict represented-input rejection into an equal residual/bound and falsely accept it | `verification-pending` | RED `23c3262c...` + tie repair `6a2add48...` + edge coverage `3656deb2...` + changelog `090f5124...` + inherited by current #488 `ba81aa295a7877fb87767064547031851c31a754` | +| GAP-082 | SE-aware acceptance finite subtraction could round an exact strict represented-input rejection onto an exact finite bound and falsely accept equality | `verification-pending` | RED `58cbc032...` + causal low-term comparison repair `68a6fd98...` + sign-symmetric edge `b2c06512...` + changelog `c4f752f3...` + inherited by current #488 `ba81aa295a7877fb87767064547031851c31a754` | +| GAP-083 | SE-aware acceptance product correction can fall below binary64 resolution even when the rounded finite bound is subnormal or minimum normal, erasing a strict represented-input rejection | `verification-pending` | RED `b55c5473...` + initial narrow repair `210cebc4...` + minimum-normal RED `c77ac440...` + corrected zero-projection repair `772ad8ed...` + changelog correction `ceb68825...` + inherited by current #488 `ba81aa295a7877fb87767064547031851c31a754` | +| GAP-084 | Legacy Wilson pair admission could accept an exact-zero/exact-one boundary even though the peer endpoint implied a representable non-boundary root | `verification-pending` | RED `c9d612f2...` + causal peer-root repair `88512417...` + branch-complete stable evaluation `6a4f89da...` + symmetry/serde/extreme-boundary contracts `0ce7639b...` + changelog `407b3645...` + inherited by current #488 `ba81aa295a7877fb87767064547031851c31a754` | +| GAP-085 | Equal nonzero SE-aware subtraction/FMA correction projections could conceal the exact represented-input ordering and turn a strict decision into rounded equality | `verification-pending` | RED `35ea85ba...` + exact product-roundoff repair `7d597a18...` + signed edge `b463a991...` + branch-scope refinement `ca8c2b86...` + changelog `702eec2f...` + research/current #488 `ba81aa29...` | +| GAP-086 | Mean signed bias could reject a representable result because individual `recovered - truth` residuals overflow before opposing represented terms cancel | `verification-pending` | RED `04e6e745...` + explicit-denominator cancellation `28b1d186...` + causal bias repair `d1cd5461...` + changelog `d68dde34...` + inherited by current #488 `ba81aa29...` | +| GAP-087 | Mean signed bias mixed-sign cancellation could discard repeated individually sub-ULP opposing residuals even though their combined represented mass changes the final bias | `verification-pending` | RED `63913727...` + error-free low-term repair `5697cca5...` + changelog `53f5c912...` + inherited by current #488 `ba81aa29...` | +| GAP-088 | Mean signed bias mixed-remainder compensation could be rounded into an intermediate numerator before the scientific count division, shifting the represented-input mean by one ULP | `verification-pending` | RED `8b4d19d1...` + causal compensated-division/FMA repair `7a33212b...` + changelog `bad698dd...` + research/current #488 `ba81aa29...` | ## Release gate From cea0cbd894560f66bafc235f9499e740252f2351 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 5 Sep 2026 03:36:20 +0900 Subject: [PATCH 183/235] docs(ddd): register validation GAP-089 --- docs/product-technical-gap-baseline.md | 99 +++++++++++++------------- 1 file changed, 50 insertions(+), 49 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index bea7cd02b..24fcbfdfc 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-04T18:05:00Z +**Snapshot:** 2026-09-04T18:31:54Z **Protected-main evidence:** `a243f18da4a4ca8a8d068c39922537f1f8ed6ad0` **Workspace version:** `0.2.0` @@ -30,7 +30,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `ba81aa295a7877fb87767064547031851c31a754` | true | `main` | Validation Evidence landing vehicle, non-force restacked onto protected #490. GAP-088 carries retained mixed-sign compensation through the original scientific denominator rather than rounding it into an intermediate numerator; GAP-087 preserves cancellation low terms. GAP-086 and prior Wilson, provenance, Monte Carlo, RMSE/SE, matching, serde/projection, and GAP-079–085 repairs remain inherited. Hosted exact-head gates and independent review remain required. | +| #488 | `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6` | true | `main` | Validation Evidence landing vehicle, non-force restacked onto protected #490. GAP-089 carries a same-sign remainder's Neumaier high part and correction through the original scientific denominator after exact opposite-sign cancellation; GAP-088 does the same for mixed remainders with retained cancellation low terms. GAP-087/GAP-086 and prior Wilson, provenance, Monte Carlo, RMSE/SE, matching, serde/projection repairs remain inherited. Hosted exact-head gates and independent review remain required. | | #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 | Validation / Analysis Run fold child. Unique evidence must be inherited by a conflict-resolving survivor; child-head CI does not transfer. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | @@ -62,7 +62,7 @@ The clock contract separates event/valid time, assertion time, document time, sy - Row arrival order is not scientific evidence. Fixed admitted observations must produce bit-identical means/centered results under permutation wherever the contract claims deterministic CPU `f64` reference behavior. - Known-truth component recovery follows bounded-context identity: stable `Between` is unit-level and uses canonical `occasion_index = 0`; `Within` retains actual `(unit, occasion)` identity. Duplicate identities or stable-Between occasion aliases are not weights. - A representable final scientific estimand is not rejected solely because an avoidable intermediate binary64 operation overflows/underflows. False exact 0/1/non-finite endpoints, erased finite bounds, and cancellation residues are not accepted when an equivalent operation order preserves the represented estimand or decision. -- Mean signed bias and bias SE remain Validation Evidence performance measures over admitted recovery units. `mean_bias` keeps the direct residual path when residuals are finite; if finite inputs create an overflowing pairwise residual while the final bias remains representable, the equivalent recovered-plus-negated-truth numerator is sign-cancelled before exact-power-of-two scale reduction and divided by the original recovery-unit count. During mixed-sign cancellation, error-free low terms are retained so repeated individually sub-ULP opposing residuals can still change the represented mean when their combined mass is material. When such retained compensation exists, the high part, division residual, and compensation are carried through the original scientific denominator before final scale restoration; an independently rounded intermediate numerator is not scientific authority. `bias_standard_error` still requires representable individual residual dispersion. Mathematically nonzero final results below or above binary64 range fail closed. +- Mean signed bias and bias SE remain Validation Evidence performance measures over admitted recovery units. `mean_bias` keeps the direct residual path when residuals are finite; if finite inputs create an overflowing pairwise residual while the final bias remains representable, the equivalent recovered-plus-negated-truth numerator is sign-cancelled before exact-power-of-two scale reduction and divided by the original recovery-unit count. During mixed-sign cancellation, error-free low terms are retained so repeated individually sub-ULP opposing residuals can still change the represented mean when their combined mass is material. Whether compensation comes from retained cancellation low terms or from a same-sign remainder left by exact opposite-sign cancellation, the canonical Neumaier high part, division residual, and correction are carried through the original scientific denominator before final scale restoration; an independently rounded compensated numerator is not scientific authority. `bias_standard_error` still requires representable individual residual dispersion. Mathematically nonzero final results below or above binary64 range fail closed. - Generic Validation Evidence RMSE and its delta-method SE normalize before squaring. Exact-zero point RMSE requires exact-zero point RMSE SE. For positive RMSE, the declared producer satisfies `SE(RMSE) <= RMSE / 2`, with a small relative binary64 admission tolerance. - Generic `MonteCarloSummary` is sign-neutral. Zero SD requires zero SE and percentile endpoints equal to the represented mean. Positive SD requires positive SE coherent with represented `SD / sqrt(n)` within a small relative tolerance. Every inclusive nearest-rank endpoint is a retained observation and satisfies `|endpoint - mean| <= SD * sqrt(n - 1)`. Distinct lower/upper endpoint values share the same `(n - 1) * SD²` deviation budget. When `replication_count = 2` and endpoints are numerically distinct, those values exhaust the retained sample and the recorded represented mean/sample SD must match deterministic two-value reconstruction. Equal numeric endpoints do not prove two distinct ranks and are not subjected to that exhaustion rule. - When the generic carrier occupies `ValidationReport::monte_carlo_rmse`, retained replications are nonnegative; positive mean implies `SE(mean) <= mean`, and inclusive nearest-rank endpoints cannot exceed nonnegative sample-sum support `n * mean`. These typed bounds are not imposed on signed metrics such as bias. @@ -83,11 +83,11 @@ The clock contract separates event/valid time, assertion time, document time, sy ### #488 — Validation Evidence -#488 is the generic Validation Evidence landing vehicle at exact head `ba81aa295a7877fb87767064547031851c31a754`, non-force restacked onto protected #490. GAP-088 adds public RED `8b4d19d161cb4322db3a143b2e34125d3bcc08f1`: residuals `[2^-53, -2^-52, -(1 + 2^-52)]` have exact represented-input numerator `-(1 + 3*2^-53)` and mean bits `0xbfd5555555555557`, while the GAP-087 predecessor rounded `sum + correction` before division and produced `0xbfd5555555555558`. Causal repair `7a33212b0c0f079a9fb138b6a8564881bc22fc9e` retains the normalized Neumaier high part and correction through the original count division, recovers the high-part division residual with FMA, and restores the exact power-of-two scale only after that correction is consumed. CHANGELOG `bad698dd686ce69a96aee1ca748bd7dc8e63aa1b`; research/current #488 `ba81aa295a7877fb87767064547031851c31a754`. +#488 is the generic Validation Evidence landing vehicle at exact head `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6`, non-force restacked onto protected #490. GAP-089 adds public RED `84476aad7ef2918c174c1ef986cbec2851cac656`: represented residuals `0x1.0000000000004p-3`, `0x1.ffffffffffffcp-4`, and `-0x1.ffffffffffffdp-4` have exact numerator `9007199254740999 / 72057594037927936`; division by three is `3002399751580333 / 72057594037927936` and rounds to bits `0x3fa555555555555a`. Exact opposite-sign cancellation leaves a same-sign remainder with no cancellation low term, so the predecessor entered `same_sign_mean_over_total`, rounded its Neumaier high part and correction before division, and returned `0x3fa555555555555b`. Causal repair `5f0d40b838e9b9867ec40281f1e4ab6db96a12cb` keeps the high part, FMA-recovered division residual, and correction separate through the original count division. CHANGELOG `5763cde0292b05fda4ebc07436e31e1309e97572`; research/current #488 `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6`. -GAP-087 remains inherited: public RED `63913727a3dfc2dd65c2508fe7e4acfdd6498508` covers repeated individually sub-ULP opposing residuals whose combined represented mass changes the final mean; repair `5697cca51df2ec49e44a04730a14fd77656b48a5` retains error-free TwoSum low terms. GAP-086 remains inherited: RED `04e6e74507a1adb89aac4b2a58d3682746da30ea`, explicit-denominator cancellation `28b1d186ce2bd08b63ca267c8b98b2eae45d2da7`, and bias repair `d1cd54615ddc311491e26fa427e956b5b5379e1a` preserve a representable final mean when pairwise residual materialization overflows and cancels. `bias_standard_error` remains unchanged because individual residual dispersion is part of its estimand. +GAP-088 remains inherited: RED `8b4d19d161cb4322db3a143b2e34125d3bcc08f1` covers mixed-remainder compensation rounded before division; repair `7a33212b0c0f079a9fb138b6a8564881bc22fc9e` preserves that compensation through the original denominator. GAP-087 remains inherited: public RED `63913727a3dfc2dd65c2508fe7e4acfdd6498508` covers repeated individually sub-ULP opposing residuals whose combined represented mass changes the final mean; repair `5697cca51df2ec49e44a04730a14fd77656b48a5` retains error-free TwoSum low terms. GAP-086 remains inherited: RED `04e6e74507a1adb89aac4b2a58d3682746da30ea`, explicit-denominator cancellation `28b1d186ce2bd08b63ca267c8b98b2eae45d2da7`, and bias repair `d1cd54615ddc311491e26fa427e956b5b5379e1a` preserve a representable final mean when pairwise residual materialization overflows and cancels. `bias_standard_error` remains unchanged because individual residual dispersion is part of its estimand. -GAP-071/GAP-073–GAP-088 remain delivery-pending until current-head hosted gates, independent review, protected-main integration, and required durable-consumer adoption are verified. Bare legacy `ValidationReport` remains a backward-compatible compact projection and is not silently treated as v1 provenance. Earlier GAP-045–087 source/test/fixture/contract/research lineages remain in #488 ancestry and the register below. +GAP-071/GAP-073–GAP-089 remain delivery-pending until current-head hosted gates, independent review, protected-main integration, and required durable-consumer adoption are verified. Bare legacy `ValidationReport` remains a backward-compatible compact projection and is not silently treated as v1 provenance. Earlier GAP-045–088 source/test/fixture/contract/research lineages remain in #488 ancestry and the register below. ### #416 — Validation / Analysis Run consolidation @@ -145,50 +145,51 @@ GAP-071/GAP-073–GAP-088 remain delivery-pending until current-head hosted gate | GAP-042 | Ratio-first logarithm could nearly double an adjacent-float irregular residual growth rate | `verification-pending` | RED `766ddc7a...` + `ln_1p` repair `16f21d9a...` | | GAP-043 | Duplicate known-truth component identities could silently reweight RMSE recovery evidence | `verification-pending` | RED `698f12f5...` + uniqueness repair `2fae4cb2...` | | GAP-044 | Known-truth RMSE alignment/accumulation depended on row order instead of component identity | `verification-pending` | RED `8ad72ac9...` / `5fb93c40...` + repairs `2dd9537e...` / `025dce7f...`; #310 `c6680450...` | -| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; #488 `ba81aa295a7877fb87767064547031851c31a754` | -| GAP-046 | Bias SE could reject a representable SEM because raw squared deviations/intermediates overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; #488 `ba81aa295a7877fb87767064547031851c31a754` | -| GAP-047 | Generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; #488 `ba81aa295a7877fb87767064547031851c31a754` | -| GAP-048 | Mean signed bias could erase a representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; #488 `ba81aa295a7877fb87767064547031851c31a754` | +| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; #488 `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6` | +| GAP-046 | Bias SE could reject a representable SEM because raw squared deviations/intermediates overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; #488 `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6` | +| GAP-047 | Generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; #488 `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6` | +| GAP-048 | Mean signed bias could erase a representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; #488 `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6` | | GAP-049 | Stable `Between` recovery could be aliased across occasion indices and reweight RMSE | `verification-pending` | RED `0a03041c...` + repair `ec2c1219...`; #310 `c6680450...` | -| GAP-050 | Zero-multiplier SE-aware acceptance could erase a nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; #488 `ba81aa295a7877fb87767064547031851c31a754` | -| GAP-051 | Exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; #488 `ba81aa295a7877fb87767064547031851c31a754` | -| GAP-052 | All-covered Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; #488 `ba81aa295a7877fb87767064547031851c31a754` | -| GAP-053 | Strict-interior Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; #488 `ba81aa295a7877fb87767064547031851c31a754` | -| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; #488 `ba81aa295a7877fb87767064547031851c31a754` | -| GAP-055 | Strict-interior Wilson lower endpoint could accept a nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; #488 `ba81aa295a7877fb87767064547031851c31a754` | -| GAP-056 | Durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; #488 `ba81aa295a7877fb87767064547031851c31a754` | -| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from a generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; #488 `ba81aa295a7877fb87767064547031851c31a754` | -| GAP-058 | Generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; #488 `ba81aa295a7877fb87767064547031851c31a754` | -| GAP-059 | Generic Monte Carlo summary could materially misstate positive SE relative to `SD / sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; #488 `ba81aa295a7877fb87767064547031851c31a754` | -| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; #488 `ba81aa295a7877fb87767064547031851c31a754` | -| GAP-061 | Generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; #488 `ba81aa295a7877fb87767064547031851c31a754` | -| GAP-062 | Finite-tolerance matching could fail while the pair is deterministically outside every finite tolerance | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; #488 `ba81aa295a7877fb87767064547031851c31a754` | -| GAP-063 | Exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; #488 `ba81aa295a7877fb87767064547031851c31a754` | -| GAP-064 | Positive point RMSE could carry SE above the declared squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; #488 `ba81aa295a7877fb87767064547031851c31a754` | -| GAP-065 | Positive Monte Carlo RMSE could carry spread/SE impossible for nonnegative replications | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; #488 `ba81aa295a7877fb87767064547031851c31a754` | -| GAP-066 | RMSE Monte Carlo nearest-rank percentile could exceed total nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; #488 `ba81aa295a7877fb87767064547031851c31a754` | -| GAP-067 | Generic nearest-rank percentile endpoint could be individually incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected over-strong repair `2798e4f9...`; causal repair `c7151b49...`; edge `dbef285b...`; changelog `c38a320c...`; research `2bbcbb24...`; #488 `ba81aa295a7877fb87767064547031851c31a754` | -| GAP-068 | Distinct generic percentile endpoints could each pass individual radius checks while jointly exceeding the sample squared-deviation budget | `verification-pending` | RED `c4a13826...` + causal repair `cb3f80a2...` + changelog `f727450d...`; #488 `ba81aa295a7877fb87767064547031851c31a754` | -| GAP-069 | Two-replication distinct nearest-rank endpoints could exhaust the retained sample while the stored mean or SD remained impossible | `verification-pending` | RED `81bf0d9e...` + causal repair `d48f8fef...` + mean coverage `fb314d8a...` + branch cleanup `440b78d8...` + changelog `45116498...`; #488 `ba81aa295a7877fb87767064547031851c31a754` | -| GAP-070 | Stored Wilson bounds could contain empirical coverage while the lower/upper pair could not arise from one Wilson score interval for that same coverage | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...` + complementary edge `c1cb16a7...`; #488 `ba81aa295a7877fb87767064547031851c31a754` | -| GAP-071 | Durable Wilson evidence lacked denominator and critical-value/sidedness provenance, preventing exact recomputation from a persisted artifact | `active-repair` | valid carrier RED `6f6e06d2...`; shared count/Wilson authority `ca517ed3...`; `WilsonCoverageEvidenceV1` `31e1ab2b...`; sidedness `e9c63926...`/`fdd24a1a...`; envelope RED `07766cb0...` + `ValidationEvidenceV1` repair `a16f22e6...`; docs/current #488 `ba81aa295a7877fb87767064547031851c31a754`; remaining: hosted GREEN/review/main plus durable-consumer adoption | -| GAP-072 | Exact all-covered Wilson evidence could retain a zero lower endpoint even though the canonical non-empty finite-`z²` producer always emits `n/(n+z²) > 0` | `verification-pending` | RED `ce714f07...` + non-force source-restore RCA `18499052...` + repair `72e9d954...` + changelog `e3a2f4a2...`; inherited by #488 `ba81aa295a7877fb87767064547031851c31a754` | -| GAP-073 | Durable Wilson count provenance could round one uncovered observation away above binary64's exact-integer range and expose a pointer-width-dependent count schema | `verification-pending` | RED `29d710a5...` + complement/count repair `29968c80...` + fixed-width carrier repair `91d9a3bb...` + exact ratio RED/repair `63ddfdd6...`/`11323c57...`; #488 `ba81aa295a7877fb87767064547031851c31a754` | -| GAP-074 | Durable Wilson evidence could correctly retain exact `u64` counts yet pre-round `sample_count` before endpoint projection, shifting strict-interior endpoints or erasing all-covered finite-sample uncertainty | `verification-pending` | RED `f89e2467...` + all-covered edge `1a5180b2...` + stale-oracle correction `6254c498...` + causal reciprocal-scale repair `73bbb5cf...` + changelog `f2b5768b...` + research predecessor `7fc78a59...`; current #488 `ba81aa295a7877fb87767064547031851c31a754` | -| GAP-075 | Inexact durable all-covered Wilson evidence could round the complementary miss mass to exact one at extreme finite `z` and erase a representable positive lower endpoint | `verification-pending` | RED `059ce70d...`; transient duplicate-owner implementation `46f91f3f...` excluded; canonical repair `0f478392...`; single-writer cleanup `8e2058f2...`; exact-oracle correction `93d5d208...`; changelog correction `43b6562c...`; research predecessor `b03a719d...`; current #488 `ba81aa295a7877fb87767064547031851c31a754` | -| GAP-076 | Exactly representable all-covered Wilson counts could absorb a small positive `z²` in `n + z²` and falsely emit exact `1.0` although a lower binary64 endpoint is representable | `verification-pending` | RED `e0c4ec81...` + causal boundary repair `c9dcb9df...` + below-resolution edge `6140080d...` + changelog `09ebb482...` + research predecessor `fe89c438...`; current #488 `ba81aa295a7877fb87767064547031851c31a754` | -| GAP-077 | Exactly representable all-covered Wilson counts could form an inexact partial denominator `n + z²` whose rounded sum shifts the represented-input lower endpoint by one ULP even though neither operand is fully absorbed | `verification-pending` | RED `06e55653...` + causal TwoSum/FMA repair `6c084dbe...` + research `25cc1943...` + changelog `5acc894b...` + predecessor changelog correction `f89e36d1...` + correct-direct-rounding control `80a0a0ad...`; current #488 `ba81aa295a7877fb87767064547031851c31a754` | -| GAP-078 | Exact-count all-covered Wilson residual compensation could move a direct quotient by one ULP even when the represented-input rational remains on the same side of the adjacent midpoint | `verification-pending` | RED `d076d344...` + midpoint-selection repair `32314239...` + changelog `a75940c9...` + research predecessor `ef6441f7...`; current #488 `ba81aa295a7877fb87767064547031851c31a754` | -| GAP-079 | SE-aware acceptance could underflow a finite positive `k · SE` tolerance to exact zero by dividing `SE` by a much larger estimate/target scale before multiplication | `verification-pending` | RED `76067efc...` + causal direct-finite comparison repair `4ffdf366...` + changelog `d822c0ba...` + retained by current #488 `ba81aa295a7877fb87767064547031851c31a754` | -| GAP-080 | SE-aware acceptance both-overflow fallback could normalize an exact strict rejection into an equal rounded residual/bound and falsely accept it | `verification-pending` | RED `a9a45714...` + exact significand/exponent repair `425e8963...` + changelog `e6270629...` + retained by current #488 `ba81aa295a7877fb87767064547031851c31a754` | -| GAP-081 | SE-aware acceptance finite/finite multiplication could round an exact strict represented-input rejection into an equal residual/bound and falsely accept it | `verification-pending` | RED `23c3262c...` + tie repair `6a2add48...` + edge coverage `3656deb2...` + changelog `090f5124...` + inherited by current #488 `ba81aa295a7877fb87767064547031851c31a754` | -| GAP-082 | SE-aware acceptance finite subtraction could round an exact strict represented-input rejection onto an exact finite bound and falsely accept equality | `verification-pending` | RED `58cbc032...` + causal low-term comparison repair `68a6fd98...` + sign-symmetric edge `b2c06512...` + changelog `c4f752f3...` + inherited by current #488 `ba81aa295a7877fb87767064547031851c31a754` | -| GAP-083 | SE-aware acceptance product correction can fall below binary64 resolution even when the rounded finite bound is subnormal or minimum normal, erasing a strict represented-input rejection | `verification-pending` | RED `b55c5473...` + initial narrow repair `210cebc4...` + minimum-normal RED `c77ac440...` + corrected zero-projection repair `772ad8ed...` + changelog correction `ceb68825...` + inherited by current #488 `ba81aa295a7877fb87767064547031851c31a754` | -| GAP-084 | Legacy Wilson pair admission could accept an exact-zero/exact-one boundary even though the peer endpoint implied a representable non-boundary root | `verification-pending` | RED `c9d612f2...` + causal peer-root repair `88512417...` + branch-complete stable evaluation `6a4f89da...` + symmetry/serde/extreme-boundary contracts `0ce7639b...` + changelog `407b3645...` + inherited by current #488 `ba81aa295a7877fb87767064547031851c31a754` | -| GAP-085 | Equal nonzero SE-aware subtraction/FMA correction projections could conceal the exact represented-input ordering and turn a strict decision into rounded equality | `verification-pending` | RED `35ea85ba...` + exact product-roundoff repair `7d597a18...` + signed edge `b463a991...` + branch-scope refinement `ca8c2b86...` + changelog `702eec2f...` + research/current #488 `ba81aa29...` | -| GAP-086 | Mean signed bias could reject a representable result because individual `recovered - truth` residuals overflow before opposing represented terms cancel | `verification-pending` | RED `04e6e745...` + explicit-denominator cancellation `28b1d186...` + causal bias repair `d1cd5461...` + changelog `d68dde34...` + inherited by current #488 `ba81aa29...` | -| GAP-087 | Mean signed bias mixed-sign cancellation could discard repeated individually sub-ULP opposing residuals even though their combined represented mass changes the final bias | `verification-pending` | RED `63913727...` + error-free low-term repair `5697cca5...` + changelog `53f5c912...` + inherited by current #488 `ba81aa29...` | -| GAP-088 | Mean signed bias mixed-remainder compensation could be rounded into an intermediate numerator before the scientific count division, shifting the represented-input mean by one ULP | `verification-pending` | RED `8b4d19d1...` + causal compensated-division/FMA repair `7a33212b...` + changelog `bad698dd...` + research/current #488 `ba81aa29...` | +| GAP-050 | Zero-multiplier SE-aware acceptance could erase a nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; #488 `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6` | +| GAP-051 | Exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; #488 `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6` | +| GAP-052 | All-covered Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; #488 `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6` | +| GAP-053 | Strict-interior Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; #488 `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6` | +| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; #488 `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6` | +| GAP-055 | Strict-interior Wilson lower endpoint could accept a nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; #488 `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6` | +| GAP-056 | Durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; #488 `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6` | +| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from a generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; #488 `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6` | +| GAP-058 | Generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; #488 `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6` | +| GAP-059 | Generic Monte Carlo summary could materially misstate positive SE relative to `SD / sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; #488 `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6` | +| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; #488 `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6` | +| GAP-061 | Generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; #488 `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6` | +| GAP-062 | Finite-tolerance matching could fail while the pair is deterministically outside every finite tolerance | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; #488 `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6` | +| GAP-063 | Exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; #488 `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6` | +| GAP-064 | Positive point RMSE could carry SE above the declared squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; #488 `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6` | +| GAP-065 | Positive Monte Carlo RMSE could carry spread/SE impossible for nonnegative replications | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; #488 `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6` | +| GAP-066 | RMSE Monte Carlo nearest-rank percentile could exceed total nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; #488 `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6` | +| GAP-067 | Generic nearest-rank percentile endpoint could be individually incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected over-strong repair `2798e4f9...`; causal repair `c7151b49...`; edge `dbef285b...`; changelog `c38a320c...`; research `2bbcbb24...`; #488 `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6` | +| GAP-068 | Distinct generic percentile endpoints could each pass individual radius checks while jointly exceeding the sample squared-deviation budget | `verification-pending` | RED `c4a13826...` + causal repair `cb3f80a2...` + changelog `f727450d...`; #488 `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6` | +| GAP-069 | Two-replication distinct nearest-rank endpoints could exhaust the retained sample while the stored mean or SD remained impossible | `verification-pending` | RED `81bf0d9e...` + causal repair `d48f8fef...` + mean coverage `fb314d8a...` + branch cleanup `440b78d8...` + changelog `45116498...`; #488 `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6` | +| GAP-070 | Stored Wilson bounds could contain empirical coverage while the lower/upper pair could not arise from one Wilson score interval for that same coverage | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...` + complementary edge `c1cb16a7...`; #488 `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6` | +| GAP-071 | Durable Wilson evidence lacked denominator and critical-value/sidedness provenance, preventing exact recomputation from a persisted artifact | `active-repair` | valid carrier RED `6f6e06d2...`; shared count/Wilson authority `ca517ed3...`; `WilsonCoverageEvidenceV1` `31e1ab2b...`; sidedness `e9c63926...`/`fdd24a1a...`; envelope RED `07766cb0...` + `ValidationEvidenceV1` repair `a16f22e6...`; docs/current #488 `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6`; remaining: hosted GREEN/review/main plus durable-consumer adoption | +| GAP-072 | Exact all-covered Wilson evidence could retain a zero lower endpoint even though the canonical non-empty finite-`z²` producer always emits `n/(n+z²) > 0` | `verification-pending` | RED `ce714f07...` + non-force source-restore RCA `18499052...` + repair `72e9d954...` + changelog `e3a2f4a2...`; inherited by #488 `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6` | +| GAP-073 | Durable Wilson count provenance could round one uncovered observation away above binary64's exact-integer range and expose a pointer-width-dependent count schema | `verification-pending` | RED `29d710a5...` + complement/count repair `29968c80...` + fixed-width carrier repair `91d9a3bb...` + exact ratio RED/repair `63ddfdd6...`/`11323c57...`; #488 `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6` | +| GAP-074 | Durable Wilson evidence could correctly retain exact `u64` counts yet pre-round `sample_count` before endpoint projection, shifting strict-interior endpoints or erasing all-covered finite-sample uncertainty | `verification-pending` | RED `f89e2467...` + all-covered edge `1a5180b2...` + stale-oracle correction `6254c498...` + causal reciprocal-scale repair `73bbb5cf...` + changelog `f2b5768b...` + research predecessor `7fc78a59...`; current #488 `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6` | +| GAP-075 | Inexact durable all-covered Wilson evidence could round the complementary miss mass to exact one at extreme finite `z` and erase a representable positive lower endpoint | `verification-pending` | RED `059ce70d...`; transient duplicate-owner implementation `46f91f3f...` excluded; canonical repair `0f478392...`; single-writer cleanup `8e2058f2...`; exact-oracle correction `93d5d208...`; changelog correction `43b6562c...`; research predecessor `b03a719d...`; current #488 `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6` | +| GAP-076 | Exactly representable all-covered Wilson counts could absorb a small positive `z²` in `n + z²` and falsely emit exact `1.0` although a lower binary64 endpoint is representable | `verification-pending` | RED `e0c4ec81...` + causal boundary repair `c9dcb9df...` + below-resolution edge `6140080d...` + changelog `09ebb482...` + research predecessor `fe89c438...`; current #488 `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6` | +| GAP-077 | Exactly representable all-covered Wilson counts could form an inexact partial denominator `n + z²` whose rounded sum shifts the represented-input lower endpoint by one ULP even though neither operand is fully absorbed | `verification-pending` | RED `06e55653...` + causal TwoSum/FMA repair `6c084dbe...` + research `25cc1943...` + changelog `5acc894b...` + predecessor changelog correction `f89e36d1...` + correct-direct-rounding control `80a0a0ad...`; current #488 `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6` | +| GAP-078 | Exact-count all-covered Wilson residual compensation could move a direct quotient by one ULP even when the represented-input rational remains on the same side of the adjacent midpoint | `verification-pending` | RED `d076d344...` + midpoint-selection repair `32314239...` + changelog `a75940c9...` + research predecessor `ef6441f7...`; current #488 `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6` | +| GAP-079 | SE-aware acceptance could underflow a finite positive `k · SE` tolerance to exact zero by dividing `SE` by a much larger estimate/target scale before multiplication | `verification-pending` | RED `76067efc...` + causal direct-finite comparison repair `4ffdf366...` + changelog `d822c0ba...` + retained by current #488 `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6` | +| GAP-080 | SE-aware acceptance both-overflow fallback could normalize an exact strict rejection into an equal rounded residual/bound and falsely accept it | `verification-pending` | RED `a9a45714...` + exact significand/exponent repair `425e8963...` + changelog `e6270629...` + retained by current #488 `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6` | +| GAP-081 | SE-aware acceptance finite/finite multiplication could round an exact strict represented-input rejection into an equal residual/bound and falsely accept it | `verification-pending` | RED `23c3262c...` + tie repair `6a2add48...` + edge coverage `3656deb2...` + changelog `090f5124...` + inherited by current #488 `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6` | +| GAP-082 | SE-aware acceptance finite subtraction could round an exact strict represented-input rejection onto an exact finite bound and falsely accept equality | `verification-pending` | RED `58cbc032...` + causal low-term comparison repair `68a6fd98...` + sign-symmetric edge `b2c06512...` + changelog `c4f752f3...` + inherited by current #488 `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6` | +| GAP-083 | SE-aware acceptance product correction can fall below binary64 resolution even when the rounded finite bound is subnormal or minimum normal, erasing a strict represented-input rejection | `verification-pending` | RED `b55c5473...` + initial narrow repair `210cebc4...` + minimum-normal RED `c77ac440...` + corrected zero-projection repair `772ad8ed...` + changelog correction `ceb68825...` + inherited by current #488 `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6` | +| GAP-084 | Legacy Wilson pair admission could accept an exact-zero/exact-one boundary even though the peer endpoint implied a representable non-boundary root | `verification-pending` | RED `c9d612f2...` + causal peer-root repair `88512417...` + branch-complete stable evaluation `6a4f89da...` + symmetry/serde/extreme-boundary contracts `0ce7639b...` + changelog `407b3645...` + inherited by current #488 `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6` | +| GAP-085 | Equal nonzero SE-aware subtraction/FMA correction projections could conceal the exact represented-input ordering and turn a strict decision into rounded equality | `verification-pending` | RED `35ea85ba...` + exact product-roundoff repair `7d597a18...` + signed edge `b463a991...` + branch-scope refinement `ca8c2b86...` + changelog `702eec2f...` + research/current #488 `d1c20f68...` | +| GAP-086 | Mean signed bias could reject a representable result because individual `recovered - truth` residuals overflow before opposing represented terms cancel | `verification-pending` | RED `04e6e745...` + explicit-denominator cancellation `28b1d186...` + causal bias repair `d1cd5461...` + changelog `d68dde34...` + inherited by current #488 `d1c20f68...` | +| GAP-087 | Mean signed bias mixed-sign cancellation could discard repeated individually sub-ULP opposing residuals even though their combined represented mass changes the final bias | `verification-pending` | RED `63913727...` + error-free low-term repair `5697cca5...` + changelog `53f5c912...` + inherited by current #488 `d1c20f68...` | +| GAP-088 | Mean signed bias mixed-remainder compensation could be rounded into an intermediate numerator before the scientific count division, shifting the represented-input mean by one ULP | `verification-pending` | RED `8b4d19d1...` + causal compensated-division/FMA repair `7a33212b...` + changelog `bad698dd...` + inherited by current #488 `d1c20f68...` | +| GAP-089 | Mean signed bias exact opposite-sign cancellation could leave a same-sign compensated remainder whose `sum + correction` was rounded before the scientific count division, shifting the represented-input mean by one ULP | `verification-pending` | RED `84476aad...` + causal same-sign compensated-division repair `5f0d40b8...` + changelog `5763cde0...` + research/current #488 `d1c20f68...` | ## Release gate From 9f23237898a7ae8d189f8138b02682e8ecdbe335 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 5 Sep 2026 04:21:09 +0900 Subject: [PATCH 184/235] docs(gaps): trace validation subnormal single-rounding repair --- docs/product-technical-gap-baseline.md | 115 ++++++++++++------------- 1 file changed, 57 insertions(+), 58 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 24fcbfdfc..546167566 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-04T18:31:54Z +**Snapshot:** 2026-09-04T19:19:08Z **Protected-main evidence:** `a243f18da4a4ca8a8d068c39922537f1f8ed6ad0` **Workspace version:** `0.2.0` @@ -22,7 +22,7 @@ A planning document, mergeable branch, local/source inspection, predecessor-head | GitHub releases | **0** | No TEPP open head is a released contract. | | Organization ruleset | `18156473` | One qualifying current-head approval, stale-review dismissal after push, resolved threads, extra approval for unattributed changes where applicable, and central required workflows. | -Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward updates on the default branch. Organization-admin bypass is not normal delivery evidence and is not used by this writer. Protected-main #489 narrowed duplicate workflow load and combined line/branch coverage work while retaining both gates; #490 then centralized hourly-development admission. A branch that reintroduces a repository-local hourly schedule after #490 is a repair finding rather than new scheduler authority. +Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward updates on the default branch. Organization-admin bypass is not normal delivery evidence and is not used by this writer. Protected-main #489 narrowed duplicate workflow load and combined line/branch coverage work while retaining both gates; #490 centralized hourly-development admission. ## Current priority open pull-request evidence @@ -30,16 +30,16 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6` | true | `main` | Validation Evidence landing vehicle, non-force restacked onto protected #490. GAP-089 carries a same-sign remainder's Neumaier high part and correction through the original scientific denominator after exact opposite-sign cancellation; GAP-088 does the same for mixed remainders with retained cancellation low terms. GAP-087/GAP-086 and prior Wilson, provenance, Monte Carlo, RMSE/SE, matching, serde/projection repairs remain inherited. Hosted exact-head gates and independent review remain required. | +| #488 | `c845e36f16aed2c0d64d486b5647448d27831ea8` | true | `main` | Validation Evidence landing vehicle, based on protected #490. GAP-090 prevents normalize/rescale double rounding for bounded same-sign all-subnormal means by rounding exact `2^-1074` units once. GAP-086–089 and prior Wilson, provenance, Monte Carlo, RMSE/SE, matching, serde/projection repairs remain inherited. Hosted exact-head gates and independent review remain required. | | #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 | Validation / Analysis Run fold child. Unique evidence must be inherited by a conflict-resolving survivor; child-head CI does not transfer. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | | #483 | `847d96f913bb261803ac0bd751ad7e4f51324cee` | true | #416 | Analysis Run fold child; preserve unique evidence. | | #482 | `506dbae236a4484301b704b6c6a05b20faf0fe69` | true | #416 | Analysis Run fold child; preserve unique evidence. | -| #480 | `03876fb3e4c727bb754125ce531d928450d78303` | true | `main` | contextual-orchestrator consumer repair remains Draft while immutable CO release/deployment/auth provenance is unavailable. Its latest branch commit reintroduces a local hourly schedule that protected #490 removed, so wrong-base/restack repair is required before integration; this is not grounds to close the dependent owner-contract work. | +| #480 | `5b2637f7b6142573ba1385a652c56632ecc9faa5` | true | `main` | Forward repair removed the repository-local hourly schedule reintroduced by predecessor `03876fb...`. The branch still needs conflict-resolving non-force inheritance of #489/#490 while immutable contextual-orchestrator release/deployment/auth provenance remains unavailable. | | #460 | `dfab4eab5ff733731e565a9348072b8dab2e4912` | true | #416 | Analysis Run fold child; typed cutoff equality and terminal-validation separation. | | #458 | `08165e3b3c929b4ae77396689549f72723ff8ff5` | true | #416 | Analysis Run fold child; typed cutoff equality and terminal-validation separation. | -| #416 | `aa730c63563eb4a33048d822b581036c8487bd47` | true | `main` | Validation / Analysis Run landing vehicle. Generic cutoff-before-identity repair remains in ancestry; branch is still based before #489/#490 and needs non-destructive consolidation/restack when its fold scope is ready. | +| #416 | `aa730c63563eb4a33048d822b581036c8487bd47` | true | `main` | Validation / Analysis Run landing vehicle. Generic cutoff-before-identity repair `0b7155...` remains inherited; live branch head is six fast-forward commits beyond it. Branch is still based before #489/#490 and needs non-destructive consolidation/restack when fold scope is ready. | | #310 | `c6680450152b1e0a2c9abb553772d74a23923335` | true | `main` | Longitudinal Modeling vehicle. Stable `Between` recovery is unit-level with canonical occasion `0`; `Within` retains actual occasion identity. Branch is still based before #489/#490 and remains a non-force restack finding, not a closure candidate. | Exact-head evidence becomes stale after any source push. @@ -61,8 +61,8 @@ The clock contract separates event/valid time, assertion time, document time, sy - Occasion-mean deviations `p_it = x_it - μ_t` are not CWC residuals, sample-wide grand-mean residuals, or RI-CLPM within-person effects. Numeric event time defines occasion identity, so `-0.0` and `+0.0` are one occasion. - Row arrival order is not scientific evidence. Fixed admitted observations must produce bit-identical means/centered results under permutation wherever the contract claims deterministic CPU `f64` reference behavior. - Known-truth component recovery follows bounded-context identity: stable `Between` is unit-level and uses canonical `occasion_index = 0`; `Within` retains actual `(unit, occasion)` identity. Duplicate identities or stable-Between occasion aliases are not weights. -- A representable final scientific estimand is not rejected solely because an avoidable intermediate binary64 operation overflows/underflows. False exact 0/1/non-finite endpoints, erased finite bounds, and cancellation residues are not accepted when an equivalent operation order preserves the represented estimand or decision. -- Mean signed bias and bias SE remain Validation Evidence performance measures over admitted recovery units. `mean_bias` keeps the direct residual path when residuals are finite; if finite inputs create an overflowing pairwise residual while the final bias remains representable, the equivalent recovered-plus-negated-truth numerator is sign-cancelled before exact-power-of-two scale reduction and divided by the original recovery-unit count. During mixed-sign cancellation, error-free low terms are retained so repeated individually sub-ULP opposing residuals can still change the represented mean when their combined mass is material. Whether compensation comes from retained cancellation low terms or from a same-sign remainder left by exact opposite-sign cancellation, the canonical Neumaier high part, division residual, and correction are carried through the original scientific denominator before final scale restoration; an independently rounded compensated numerator is not scientific authority. `bias_standard_error` still requires representable individual residual dispersion. Mathematically nonzero final results below or above binary64 range fail closed. +- A representable final scientific estimand is not rejected solely because an avoidable intermediate binary64 operation overflows/underflows. False exact 0/1/non-finite endpoints, erased finite bounds, cancellation residues, and double-rounded subnormal endpoints are not accepted when a bounded equivalent operation preserves the represented estimand or decision. +- Mean signed bias and bias SE remain Validation Evidence performance measures over admitted recovery units. `mean_bias` keeps the direct residual path when residuals are finite; if finite inputs create an overflowing pairwise residual while the final bias remains representable, the equivalent recovered-plus-negated-truth numerator is sign-cancelled before exact-power-of-two scale reduction and divided by the original recovery-unit count. During mixed-sign cancellation, error-free low terms are retained so repeated individually sub-ULP opposing residuals can still change the represented mean when their combined mass is material. Whether compensation comes from retained cancellation low terms or from a same-sign remainder left by exact opposite-sign cancellation, the canonical Neumaier high part, division residual, and correction are carried through the original scientific denominator before final scale restoration. For a same-sign all-subnormal remainder whose scientific divisor is at least the surviving term count, each represented magnitude is an exact integer number of `2^-1074` units; those units are summed in bounded integer arithmetic and quotient/remainder ties-to-even is applied once at the final subnormal grid, avoiding normalize/rescale double rounding. `bias_standard_error` still requires representable individual residual dispersion. Mathematically nonzero final results below or above binary64 range fail closed. - Generic Validation Evidence RMSE and its delta-method SE normalize before squaring. Exact-zero point RMSE requires exact-zero point RMSE SE. For positive RMSE, the declared producer satisfies `SE(RMSE) <= RMSE / 2`, with a small relative binary64 admission tolerance. - Generic `MonteCarloSummary` is sign-neutral. Zero SD requires zero SE and percentile endpoints equal to the represented mean. Positive SD requires positive SE coherent with represented `SD / sqrt(n)` within a small relative tolerance. Every inclusive nearest-rank endpoint is a retained observation and satisfies `|endpoint - mean| <= SD * sqrt(n - 1)`. Distinct lower/upper endpoint values share the same `(n - 1) * SD²` deviation budget. When `replication_count = 2` and endpoints are numerically distinct, those values exhaust the retained sample and the recorded represented mean/sample SD must match deterministic two-value reconstruction. Equal numeric endpoints do not prove two distinct ranks and are not subjected to that exhaustion rule. - When the generic carrier occupies `ValidationReport::monte_carlo_rmse`, retained replications are nonnegative; positive mean implies `SE(mean) <= mean`, and inclusive nearest-rank endpoints cannot exceed nonnegative sample-sum support `n * mean`. These typed bounds are not imposed on signed metrics such as bias. @@ -83,19 +83,17 @@ The clock contract separates event/valid time, assertion time, document time, sy ### #488 — Validation Evidence -#488 is the generic Validation Evidence landing vehicle at exact head `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6`, non-force restacked onto protected #490. GAP-089 adds public RED `84476aad7ef2918c174c1ef986cbec2851cac656`: represented residuals `0x1.0000000000004p-3`, `0x1.ffffffffffffcp-4`, and `-0x1.ffffffffffffdp-4` have exact numerator `9007199254740999 / 72057594037927936`; division by three is `3002399751580333 / 72057594037927936` and rounds to bits `0x3fa555555555555a`. Exact opposite-sign cancellation leaves a same-sign remainder with no cancellation low term, so the predecessor entered `same_sign_mean_over_total`, rounded its Neumaier high part and correction before division, and returned `0x3fa555555555555b`. Causal repair `5f0d40b838e9b9867ec40281f1e4ab6db96a12cb` keeps the high part, FMA-recovered division residual, and correction separate through the original count division. CHANGELOG `5763cde0292b05fda4ebc07436e31e1309e97572`; research/current #488 `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6`. +#488 is the generic Validation Evidence landing vehicle at exact head `c845e36f16aed2c0d64d486b5647448d27831ea8`, based on protected #490. GAP-090 public RED `91abdb496ef13229ed95bcf8854770a2cc71b4b8` fixes a same-sign all-subnormal represented-input mean where unit counts `[2^52-32, 2^52-12, 2^52-20]` have exact mean `2^52-21-1/3` and therefore round once to bits `0x000f_ffff_ffff_ffeb`; predecessor normalize/divide/rescale returned adjacent `0x000f_ffff_ffff_ffea`. First repair `e89dc34616dfba86683c8fc05611a7ac31a2d2c3` bypassed scaling but retained a floating compensated accumulation and was invalidated by a separate exact halfway payload. Corrected causal repair `1c0df8a77c4b65583e9d1945864f0a72bc598a71` sums exact subnormal units in `u128` and performs quotient/remainder round-to-nearest, ties-to-even once when the scientific divisor is at least the surviving term count. Halfway contract `f79a1b9a1b299b34f87babbbdd766e4be6bd60df` and regression fixture `eb29a79a3c51034dbff8d29782d8e71fe65012b6` prevent both ordinary and direct-float double-rounding regressions. CHANGELOG `65ff502b8f46f4043ca44983722e0f9722105a08`; research/current head `c845e36f16aed2c0d64d486b5647448d27831ea8`. -GAP-088 remains inherited: RED `8b4d19d161cb4322db3a143b2e34125d3bcc08f1` covers mixed-remainder compensation rounded before division; repair `7a33212b0c0f079a9fb138b6a8564881bc22fc9e` preserves that compensation through the original denominator. GAP-087 remains inherited: public RED `63913727a3dfc2dd65c2508fe7e4acfdd6498508` covers repeated individually sub-ULP opposing residuals whose combined represented mass changes the final mean; repair `5697cca51df2ec49e44a04730a14fd77656b48a5` retains error-free TwoSum low terms. GAP-086 remains inherited: RED `04e6e74507a1adb89aac4b2a58d3682746da30ea`, explicit-denominator cancellation `28b1d186ce2bd08b63ca267c8b98b2eae45d2da7`, and bias repair `d1cd54615ddc311491e26fa427e956b5b5379e1a` preserve a representable final mean when pairwise residual materialization overflows and cancels. `bias_standard_error` remains unchanged because individual residual dispersion is part of its estimand. - -GAP-071/GAP-073–GAP-089 remain delivery-pending until current-head hosted gates, independent review, protected-main integration, and required durable-consumer adoption are verified. Bare legacy `ValidationReport` remains a backward-compatible compact projection and is not silently treated as v1 provenance. Earlier GAP-045–088 source/test/fixture/contract/research lineages remain in #488 ancestry and the register below. +GAP-086–GAP-089 remain inherited: overflowing pairwise residual cancellation, error-free low-term retention, mixed-remainder compensation through the scientific divisor, and exact-cancellation same-sign compensated division. GAP-071/GAP-073–GAP-090 remain delivery-pending until current-head hosted gates, independent review, protected-main integration, and required durable-consumer adoption are verified. Bare legacy `ValidationReport` remains a backward-compatible compact projection and is not silently treated as v1 provenance. ### #416 — Validation / Analysis Run consolidation -#416 branch head is `aa730c63563eb4a33048d822b581036c8487bd47`; #458/#460/#482/#483/#484/#485/#487 remain fold children until every unique source/test/fixture/contract/doctoring delta is inherited by a conflict-resolving survivor. Child-head evidence does not transfer to #416. The vehicle is still based before #489/#490 and must be non-destructively restacked/consolidated rather than closed for staleness. +#416 live branch head is `aa730c63563eb4a33048d822b581036c8487bd47`, six fast-forward commits beyond generic cutoff-before-identity repair `0b7155cc238defb1e55129ff3000658f04b343cf`. Its PR description was corrected to distinguish the inherited repair from the actual branch head. #458/#460/#482/#483/#484/#485/#487 remain fold children until every unique source/test/fixture/contract/doctoring delta is inherited by a conflict-resolving survivor. Child-head evidence does not transfer to #416. The vehicle is still based before #489/#490 and must be non-destructively restacked/consolidated rather than closed for staleness. ### #480 — contextual-orchestrator boundary -#480 removes TEPP-owned provider discovery/ranking and requires a released contextual-orchestrator owner contract. Its current branch head is `03876fb3e4c727bb754125ce531d928450d78303`; the latest commit reintroduces the local hourly `schedule` removed by protected #490, so that wrong-base delta must be repaired during a non-force restack rather than treated as new scheduler authority. contextual-orchestrator protected main remains `2e414d15ba58f28597751b625a8a2f00fc9fadcf`, and GitHub releases remain zero. #480 therefore stays Draft until both the local scheduler conflict and the immutable compatible release/deployment/auth/schema/artifact provenance prerequisites are resolved. Mutable owner main is evidence, not a production contract. +#480 removes TEPP-owned provider discovery/ranking and requires a released contextual-orchestrator owner contract. Forward repair `5b2637f7b6142573ba1385a652c56632ecc9faa5` removed the local hourly `schedule` reintroduced by predecessor `03876fb3e4c727bb754125ce531d928450d78303`. The branch still diverges from protected main because #489/#490 workflow consolidation and admission marker must be conflict-resolved without regressing #480's valid released-owner routing delta. contextual-orchestrator protected main remains `2e414d15ba58f28597751b625a8a2f00fc9fadcf`, and GitHub releases remain zero. #480 therefore stays Draft until non-force restack plus immutable compatible release/deployment/auth/schema/artifact provenance prerequisites are resolved. Mutable owner main is evidence, not a production contract. ## Gap register @@ -145,52 +143,53 @@ GAP-071/GAP-073–GAP-089 remain delivery-pending until current-head hosted gate | GAP-042 | Ratio-first logarithm could nearly double an adjacent-float irregular residual growth rate | `verification-pending` | RED `766ddc7a...` + `ln_1p` repair `16f21d9a...` | | GAP-043 | Duplicate known-truth component identities could silently reweight RMSE recovery evidence | `verification-pending` | RED `698f12f5...` + uniqueness repair `2fae4cb2...` | | GAP-044 | Known-truth RMSE alignment/accumulation depended on row order instead of component identity | `verification-pending` | RED `8ad72ac9...` / `5fb93c40...` + repairs `2dd9537e...` / `025dce7f...`; #310 `c6680450...` | -| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; #488 `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6` | -| GAP-046 | Bias SE could reject a representable SEM because raw squared deviations/intermediates overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; #488 `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6` | -| GAP-047 | Generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; #488 `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6` | -| GAP-048 | Mean signed bias could erase a representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; #488 `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6` | +| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; current #488 `c845e36f...` | +| GAP-046 | Bias SE could reject a representable SEM because raw squared deviations/intermediates overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; current #488 `c845e36f...` | +| GAP-047 | Generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; current #488 `c845e36f...` | +| GAP-048 | Mean signed bias could erase a representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; current #488 `c845e36f...` | | GAP-049 | Stable `Between` recovery could be aliased across occasion indices and reweight RMSE | `verification-pending` | RED `0a03041c...` + repair `ec2c1219...`; #310 `c6680450...` | -| GAP-050 | Zero-multiplier SE-aware acceptance could erase a nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; #488 `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6` | -| GAP-051 | Exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; #488 `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6` | -| GAP-052 | All-covered Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; #488 `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6` | -| GAP-053 | Strict-interior Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; #488 `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6` | -| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; #488 `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6` | -| GAP-055 | Strict-interior Wilson lower endpoint could accept a nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; #488 `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6` | -| GAP-056 | Durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; #488 `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6` | -| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from a generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; #488 `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6` | -| GAP-058 | Generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; #488 `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6` | -| GAP-059 | Generic Monte Carlo summary could materially misstate positive SE relative to `SD / sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; #488 `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6` | -| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; #488 `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6` | -| GAP-061 | Generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; #488 `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6` | -| GAP-062 | Finite-tolerance matching could fail while the pair is deterministically outside every finite tolerance | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; #488 `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6` | -| GAP-063 | Exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; #488 `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6` | -| GAP-064 | Positive point RMSE could carry SE above the declared squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; #488 `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6` | -| GAP-065 | Positive Monte Carlo RMSE could carry spread/SE impossible for nonnegative replications | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; #488 `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6` | -| GAP-066 | RMSE Monte Carlo nearest-rank percentile could exceed total nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; #488 `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6` | -| GAP-067 | Generic nearest-rank percentile endpoint could be individually incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected over-strong repair `2798e4f9...`; causal repair `c7151b49...`; edge `dbef285b...`; changelog `c38a320c...`; research `2bbcbb24...`; #488 `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6` | -| GAP-068 | Distinct generic percentile endpoints could each pass individual radius checks while jointly exceeding the sample squared-deviation budget | `verification-pending` | RED `c4a13826...` + causal repair `cb3f80a2...` + changelog `f727450d...`; #488 `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6` | -| GAP-069 | Two-replication distinct nearest-rank endpoints could exhaust the retained sample while the stored mean or SD remained impossible | `verification-pending` | RED `81bf0d9e...` + causal repair `d48f8fef...` + mean coverage `fb314d8a...` + branch cleanup `440b78d8...` + changelog `45116498...`; #488 `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6` | -| GAP-070 | Stored Wilson bounds could contain empirical coverage while the lower/upper pair could not arise from one Wilson score interval for that same coverage | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...` + complementary edge `c1cb16a7...`; #488 `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6` | -| GAP-071 | Durable Wilson evidence lacked denominator and critical-value/sidedness provenance, preventing exact recomputation from a persisted artifact | `active-repair` | valid carrier RED `6f6e06d2...`; shared count/Wilson authority `ca517ed3...`; `WilsonCoverageEvidenceV1` `31e1ab2b...`; sidedness `e9c63926...`/`fdd24a1a...`; envelope RED `07766cb0...` + `ValidationEvidenceV1` repair `a16f22e6...`; docs/current #488 `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6`; remaining: hosted GREEN/review/main plus durable-consumer adoption | -| GAP-072 | Exact all-covered Wilson evidence could retain a zero lower endpoint even though the canonical non-empty finite-`z²` producer always emits `n/(n+z²) > 0` | `verification-pending` | RED `ce714f07...` + non-force source-restore RCA `18499052...` + repair `72e9d954...` + changelog `e3a2f4a2...`; inherited by #488 `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6` | -| GAP-073 | Durable Wilson count provenance could round one uncovered observation away above binary64's exact-integer range and expose a pointer-width-dependent count schema | `verification-pending` | RED `29d710a5...` + complement/count repair `29968c80...` + fixed-width carrier repair `91d9a3bb...` + exact ratio RED/repair `63ddfdd6...`/`11323c57...`; #488 `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6` | -| GAP-074 | Durable Wilson evidence could correctly retain exact `u64` counts yet pre-round `sample_count` before endpoint projection, shifting strict-interior endpoints or erasing all-covered finite-sample uncertainty | `verification-pending` | RED `f89e2467...` + all-covered edge `1a5180b2...` + stale-oracle correction `6254c498...` + causal reciprocal-scale repair `73bbb5cf...` + changelog `f2b5768b...` + research predecessor `7fc78a59...`; current #488 `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6` | -| GAP-075 | Inexact durable all-covered Wilson evidence could round the complementary miss mass to exact one at extreme finite `z` and erase a representable positive lower endpoint | `verification-pending` | RED `059ce70d...`; transient duplicate-owner implementation `46f91f3f...` excluded; canonical repair `0f478392...`; single-writer cleanup `8e2058f2...`; exact-oracle correction `93d5d208...`; changelog correction `43b6562c...`; research predecessor `b03a719d...`; current #488 `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6` | -| GAP-076 | Exactly representable all-covered Wilson counts could absorb a small positive `z²` in `n + z²` and falsely emit exact `1.0` although a lower binary64 endpoint is representable | `verification-pending` | RED `e0c4ec81...` + causal boundary repair `c9dcb9df...` + below-resolution edge `6140080d...` + changelog `09ebb482...` + research predecessor `fe89c438...`; current #488 `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6` | -| GAP-077 | Exactly representable all-covered Wilson counts could form an inexact partial denominator `n + z²` whose rounded sum shifts the represented-input lower endpoint by one ULP even though neither operand is fully absorbed | `verification-pending` | RED `06e55653...` + causal TwoSum/FMA repair `6c084dbe...` + research `25cc1943...` + changelog `5acc894b...` + predecessor changelog correction `f89e36d1...` + correct-direct-rounding control `80a0a0ad...`; current #488 `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6` | -| GAP-078 | Exact-count all-covered Wilson residual compensation could move a direct quotient by one ULP even when the represented-input rational remains on the same side of the adjacent midpoint | `verification-pending` | RED `d076d344...` + midpoint-selection repair `32314239...` + changelog `a75940c9...` + research predecessor `ef6441f7...`; current #488 `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6` | -| GAP-079 | SE-aware acceptance could underflow a finite positive `k · SE` tolerance to exact zero by dividing `SE` by a much larger estimate/target scale before multiplication | `verification-pending` | RED `76067efc...` + causal direct-finite comparison repair `4ffdf366...` + changelog `d822c0ba...` + retained by current #488 `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6` | -| GAP-080 | SE-aware acceptance both-overflow fallback could normalize an exact strict rejection into an equal rounded residual/bound and falsely accept it | `verification-pending` | RED `a9a45714...` + exact significand/exponent repair `425e8963...` + changelog `e6270629...` + retained by current #488 `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6` | -| GAP-081 | SE-aware acceptance finite/finite multiplication could round an exact strict represented-input rejection into an equal residual/bound and falsely accept it | `verification-pending` | RED `23c3262c...` + tie repair `6a2add48...` + edge coverage `3656deb2...` + changelog `090f5124...` + inherited by current #488 `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6` | -| GAP-082 | SE-aware acceptance finite subtraction could round an exact strict represented-input rejection onto an exact finite bound and falsely accept equality | `verification-pending` | RED `58cbc032...` + causal low-term comparison repair `68a6fd98...` + sign-symmetric edge `b2c06512...` + changelog `c4f752f3...` + inherited by current #488 `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6` | -| GAP-083 | SE-aware acceptance product correction can fall below binary64 resolution even when the rounded finite bound is subnormal or minimum normal, erasing a strict represented-input rejection | `verification-pending` | RED `b55c5473...` + initial narrow repair `210cebc4...` + minimum-normal RED `c77ac440...` + corrected zero-projection repair `772ad8ed...` + changelog correction `ceb68825...` + inherited by current #488 `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6` | -| GAP-084 | Legacy Wilson pair admission could accept an exact-zero/exact-one boundary even though the peer endpoint implied a representable non-boundary root | `verification-pending` | RED `c9d612f2...` + causal peer-root repair `88512417...` + branch-complete stable evaluation `6a4f89da...` + symmetry/serde/extreme-boundary contracts `0ce7639b...` + changelog `407b3645...` + inherited by current #488 `d1c20f68be2d2cc584b47fd0fecfbde2d3e268f6` | -| GAP-085 | Equal nonzero SE-aware subtraction/FMA correction projections could conceal the exact represented-input ordering and turn a strict decision into rounded equality | `verification-pending` | RED `35ea85ba...` + exact product-roundoff repair `7d597a18...` + signed edge `b463a991...` + branch-scope refinement `ca8c2b86...` + changelog `702eec2f...` + research/current #488 `d1c20f68...` | -| GAP-086 | Mean signed bias could reject a representable result because individual `recovered - truth` residuals overflow before opposing represented terms cancel | `verification-pending` | RED `04e6e745...` + explicit-denominator cancellation `28b1d186...` + causal bias repair `d1cd5461...` + changelog `d68dde34...` + inherited by current #488 `d1c20f68...` | -| GAP-087 | Mean signed bias mixed-sign cancellation could discard repeated individually sub-ULP opposing residuals even though their combined represented mass changes the final bias | `verification-pending` | RED `63913727...` + error-free low-term repair `5697cca5...` + changelog `53f5c912...` + inherited by current #488 `d1c20f68...` | -| GAP-088 | Mean signed bias mixed-remainder compensation could be rounded into an intermediate numerator before the scientific count division, shifting the represented-input mean by one ULP | `verification-pending` | RED `8b4d19d1...` + causal compensated-division/FMA repair `7a33212b...` + changelog `bad698dd...` + inherited by current #488 `d1c20f68...` | -| GAP-089 | Mean signed bias exact opposite-sign cancellation could leave a same-sign compensated remainder whose `sum + correction` was rounded before the scientific count division, shifting the represented-input mean by one ULP | `verification-pending` | RED `84476aad...` + causal same-sign compensated-division repair `5f0d40b8...` + changelog `5763cde0...` + research/current #488 `d1c20f68...` | +| GAP-050 | Zero-multiplier SE-aware acceptance could erase a nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; current #488 `c845e36f...` | +| GAP-051 | Exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; current #488 `c845e36f...` | +| GAP-052 | All-covered Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; current #488 `c845e36f...` | +| GAP-053 | Strict-interior Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; current #488 `c845e36f...` | +| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; current #488 `c845e36f...` | +| GAP-055 | Strict-interior Wilson lower endpoint could accept a nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; current #488 `c845e36f...` | +| GAP-056 | Durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; current #488 `c845e36f...` | +| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from a generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; current #488 `c845e36f...` | +| GAP-058 | Generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; current #488 `c845e36f...` | +| GAP-059 | Generic Monte Carlo summary could materially misstate positive SE relative to `SD / sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; current #488 `c845e36f...` | +| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; current #488 `c845e36f...` | +| GAP-061 | Generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; current #488 `c845e36f...` | +| GAP-062 | Finite-tolerance matching could fail while the pair is deterministically outside every finite tolerance | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; current #488 `c845e36f...` | +| GAP-063 | Exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; current #488 `c845e36f...` | +| GAP-064 | Positive point RMSE could carry SE above the declared squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; current #488 `c845e36f...` | +| GAP-065 | Positive Monte Carlo RMSE could carry spread/SE impossible for nonnegative replications | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; current #488 `c845e36f...` | +| GAP-066 | RMSE Monte Carlo nearest-rank percentile could exceed total nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; current #488 `c845e36f...` | +| GAP-067 | Generic nearest-rank percentile endpoint could be individually incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected over-strong repair `2798e4f9...`; causal repair `c7151b49...`; edge `dbef285b...`; changelog `c38a320c...`; research `2bbcbb24...`; current #488 `c845e36f...` | +| GAP-068 | Distinct generic percentile endpoints could each pass individual radius checks while jointly exceeding the sample squared-deviation budget | `verification-pending` | RED `c4a13826...` + causal repair `cb3f80a2...` + changelog `f727450d...`; current #488 `c845e36f...` | +| GAP-069 | Two-replication distinct nearest-rank endpoints could exhaust the retained sample while the stored mean or SD remained impossible | `verification-pending` | RED `81bf0d9e...` + causal repair `d48f8fef...` + mean coverage `fb314d8a...` + branch cleanup `440b78d8...` + changelog `45116498...`; current #488 `c845e36f...` | +| GAP-070 | Stored Wilson bounds could contain empirical coverage while the lower/upper pair could not arise from one Wilson score interval for that same coverage | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...` + complementary edge `c1cb16a7...`; current #488 `c845e36f...` | +| GAP-071 | Durable Wilson evidence lacked denominator and critical-value/sidedness provenance, preventing exact recomputation from a persisted artifact | `active-repair` | valid carrier RED `6f6e06d2...`; shared count/Wilson authority `ca517ed3...`; `WilsonCoverageEvidenceV1` `31e1ab2b...`; sidedness `e9c63926...`/`fdd24a1a...`; envelope RED `07766cb0...` + `ValidationEvidenceV1` repair `a16f22e6...`; current #488 `c845e36f...`; remaining: hosted GREEN/review/main plus durable-consumer adoption | +| GAP-072 | Exact all-covered Wilson evidence could retain a zero lower endpoint even though the canonical non-empty finite-`z²` producer always emits `n/(n+z²) > 0` | `verification-pending` | RED `ce714f07...` + non-force source-restore RCA `18499052...` + repair `72e9d954...` + changelog `e3a2f4a2...`; current #488 `c845e36f...` | +| GAP-073 | Durable Wilson count provenance could round one uncovered observation away above binary64's exact-integer range and expose a pointer-width-dependent count schema | `verification-pending` | RED `29d710a5...` + complement/count repair `29968c80...` + fixed-width carrier repair `91d9a3bb...` + exact ratio RED/repair `63ddfdd6...`/`11323c57...`; current #488 `c845e36f...` | +| GAP-074 | Durable Wilson evidence could correctly retain exact `u64` counts yet pre-round `sample_count` before endpoint projection, shifting strict-interior endpoints or erasing all-covered finite-sample uncertainty | `verification-pending` | RED `f89e2467...` + all-covered edge `1a5180b2...` + stale-oracle correction `6254c498...` + causal reciprocal-scale repair `73bbb5cf...` + changelog `f2b5768b...` + research predecessor `7fc78a59...`; current #488 `c845e36f...` | +| GAP-075 | Inexact durable all-covered Wilson evidence could round the complementary miss mass to exact one at extreme finite `z` and erase a representable positive lower endpoint | `verification-pending` | RED `059ce70d...`; transient duplicate-owner implementation `46f91f3f...` excluded; canonical repair `0f478392...`; single-writer cleanup `8e2058f2...`; exact-oracle correction `93d5d208...`; changelog correction `43b6562c...`; research predecessor `b03a719d...`; current #488 `c845e36f...` | +| GAP-076 | Exactly representable all-covered Wilson counts could absorb a small positive `z²` in `n + z²` and falsely emit exact `1.0` although a lower binary64 endpoint is representable | `verification-pending` | RED `e0c4ec81...` + causal boundary repair `c9dcb9df...` + below-resolution edge `6140080d...` + changelog `09ebb482...` + research predecessor `fe89c438...`; current #488 `c845e36f...` | +| GAP-077 | Exactly representable all-covered Wilson counts could form an inexact partial denominator `n + z²` whose rounded sum shifts the represented-input lower endpoint by one ULP even though neither operand is fully absorbed | `verification-pending` | RED `06e55653...` + causal TwoSum/FMA repair `6c084dbe...` + research `25cc1943...` + changelog `5acc894b...` + predecessor changelog correction `f89e36d1...` + correct-direct-rounding control `80a0a0ad...`; current #488 `c845e36f...` | +| GAP-078 | Exact-count all-covered Wilson residual compensation could move a direct quotient by one ULP even when the represented-input rational remains on the same side of the adjacent midpoint | `verification-pending` | RED `d076d344...` + midpoint-selection repair `32314239...` + changelog `a75940c9...` + research predecessor `ef6441f7...`; current #488 `c845e36f...` | +| GAP-079 | SE-aware acceptance could underflow a finite positive `k · SE` tolerance to exact zero by dividing `SE` by a much larger estimate/target scale before multiplication | `verification-pending` | RED `76067efc...` + causal direct-finite comparison repair `4ffdf366...` + changelog `d822c0ba...` + current #488 `c845e36f...` | +| GAP-080 | SE-aware acceptance both-overflow fallback could normalize an exact strict rejection into an equal rounded residual/bound and falsely accept it | `verification-pending` | RED `a9a45714...` + exact significand/exponent repair `425e8963...` + changelog `e6270629...` + current #488 `c845e36f...` | +| GAP-081 | SE-aware acceptance finite/finite multiplication could round an exact strict represented-input rejection into an equal residual/bound and falsely accept it | `verification-pending` | RED `23c3262c...` + tie repair `6a2add48...` + edge coverage `3656deb2...` + changelog `090f5124...` + current #488 `c845e36f...` | +| GAP-082 | SE-aware acceptance finite subtraction could round an exact strict represented-input rejection onto an exact finite bound and falsely accept equality | `verification-pending` | RED `58cbc032...` + causal low-term comparison repair `68a6fd98...` + sign-symmetric edge `b2c06512...` + changelog `c4f752f3...` + current #488 `c845e36f...` | +| GAP-083 | SE-aware acceptance product correction can fall below binary64 resolution even when the rounded finite bound is subnormal or minimum normal, erasing a strict represented-input rejection | `verification-pending` | RED `b55c5473...` + initial narrow repair `210cebc4...` + minimum-normal RED `c77ac440...` + corrected zero-projection repair `772ad8ed...` + changelog correction `ceb68825...` + current #488 `c845e36f...` | +| GAP-084 | Legacy Wilson pair admission could accept an exact-zero/exact-one boundary even though the peer endpoint implied a representable non-boundary root | `verification-pending` | RED `c9d612f2...` + causal peer-root repair `88512417...` + branch-complete stable evaluation `6a4f89da...` + symmetry/serde/extreme-boundary contracts `0ce7639b...` + changelog `407b3645...` + current #488 `c845e36f...` | +| GAP-085 | Equal nonzero SE-aware subtraction/FMA correction projections could conceal the exact represented-input ordering and turn a strict decision into rounded equality | `verification-pending` | RED `35ea85ba...` + exact product-roundoff repair `7d597a18...` + signed edge `b463a991...` + branch-scope refinement `ca8c2b86...` + changelog `702eec2f...` + current #488 `c845e36f...` | +| GAP-086 | Mean signed bias could reject a representable result because individual `recovered - truth` residuals overflow before opposing represented terms cancel | `verification-pending` | RED `04e6e745...` + explicit-denominator cancellation `28b1d186...` + causal bias repair `d1cd5461...` + changelog `d68dde34...` + current #488 `c845e36f...` | +| GAP-087 | Mean signed bias mixed-sign cancellation could discard repeated individually sub-ULP opposing residuals even though their combined represented mass changes the final bias | `verification-pending` | RED `63913727...` + error-free low-term repair `5697cca5...` + changelog `53f5c912...` + current #488 `c845e36f...` | +| GAP-088 | Mean signed bias mixed-remainder compensation could be rounded into an intermediate numerator before the scientific count division, shifting the represented-input mean by one ULP | `verification-pending` | RED `8b4d19d1...` + causal compensated-division/FMA repair `7a33212b...` + changelog `bad698dd...` + current #488 `c845e36f...` | +| GAP-089 | Mean signed bias exact opposite-sign cancellation could leave a same-sign compensated remainder whose `sum + correction` was rounded before the scientific count division, shifting the represented-input mean by one ULP | `verification-pending` | RED `84476aad...` + causal same-sign compensated-division repair `5f0d40b8...` + changelog `5763cde0...` + current #488 `c845e36f...` | +| GAP-090 | Same-sign all-subnormal mean normalization could double-round the final represented bias by one ULP at scale restoration | `verification-pending` | RED `91abdb49...`; discarded direct-float repair `e89dc346...`; corrected exact-unit repair `1c0df8a7...`; halfway contract `f79a1b9a...`; regression fixture `eb29a79a...`; changelog `65ff502b...`; research/current #488 `c845e36f...` | ## Release gate -TEPP currently has no GitHub release. Release is permitted only after a clean coherent vertical reaches protected main with exact protected-head CI/security evidence, scientific/recovery acceptance, reproducible package/build artifacts with SBOM and provenance, validated migrations/upgrade/rollback/recovery where applicable, consistent version metadata and current `CHANGELOG.md`, accessibility/operability evidence for user-facing components, no unresolved scientific/privacy/security/supply-chain blockers, and released integration contracts where deployment depends on them. Queued/pending/startup-failed/skipped or predecessor-head evidence is not GREEN. +TEPP currently has no GitHub release. Release is permitted only after a clean coherent vertical reaches protected main with exact protected-head CI/security evidence, scientific/recovery acceptance, reproducible package/build artifacts with SBOM and provenance, validated migrations/upgrade/rollback/recovery where applicable, consistent version metadata and current `CHANGELOG.md`, accessibility/operability evidence for user-facing components, no unresolved scientific/privacy/security/supply-chain blockers, and released integration contracts where deployment depends on them. Queued/pending/startup-failed/skipped or predecessor-head evidence is not GREEN. \ No newline at end of file From 3f950873dd74b2dac1aa8468654ee9b08ef03b0c Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 5 Sep 2026 05:21:27 +0900 Subject: [PATCH 185/235] docs(gaps): register bias SE subtraction-roundoff recovery --- docs/product-technical-gap-baseline.md | 108 +++++++++++++------------ 1 file changed, 55 insertions(+), 53 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 546167566..7860b72d9 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-04T19:19:08Z +**Snapshot:** 2026-09-04T20:08:44Z **Protected-main evidence:** `a243f18da4a4ca8a8d068c39922537f1f8ed6ad0` **Workspace version:** `0.2.0` @@ -30,7 +30,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `c845e36f16aed2c0d64d486b5647448d27831ea8` | true | `main` | Validation Evidence landing vehicle, based on protected #490. GAP-090 prevents normalize/rescale double rounding for bounded same-sign all-subnormal means by rounding exact `2^-1074` units once. GAP-086–089 and prior Wilson, provenance, Monte Carlo, RMSE/SE, matching, serde/projection repairs remain inherited. Hosted exact-head gates and independent review remain required. | +| #488 | `a9bf0320419d44854a1efaa11b06fda09884f5e3` | true | `main` | Validation Evidence landing vehicle, based on protected #490. GAP-091 preserves represented-input mean bias when finite pairwise subtraction rounds, and GAP-092 prevents a false-zero two-observation bias standard error when distinct represented residuals collapse to the same binary64 subtraction. GAP-086–090 and prior Wilson, provenance, Monte Carlo, RMSE/SE, matching, serde/projection repairs remain inherited. Hosted exact-head gates and independent review remain required. | | #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 | Validation / Analysis Run fold child. Unique evidence must be inherited by a conflict-resolving survivor; child-head CI does not transfer. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | @@ -62,7 +62,7 @@ The clock contract separates event/valid time, assertion time, document time, sy - Row arrival order is not scientific evidence. Fixed admitted observations must produce bit-identical means/centered results under permutation wherever the contract claims deterministic CPU `f64` reference behavior. - Known-truth component recovery follows bounded-context identity: stable `Between` is unit-level and uses canonical `occasion_index = 0`; `Within` retains actual `(unit, occasion)` identity. Duplicate identities or stable-Between occasion aliases are not weights. - A representable final scientific estimand is not rejected solely because an avoidable intermediate binary64 operation overflows/underflows. False exact 0/1/non-finite endpoints, erased finite bounds, cancellation residues, and double-rounded subnormal endpoints are not accepted when a bounded equivalent operation preserves the represented estimand or decision. -- Mean signed bias and bias SE remain Validation Evidence performance measures over admitted recovery units. `mean_bias` keeps the direct residual path when residuals are finite; if finite inputs create an overflowing pairwise residual while the final bias remains representable, the equivalent recovered-plus-negated-truth numerator is sign-cancelled before exact-power-of-two scale reduction and divided by the original recovery-unit count. During mixed-sign cancellation, error-free low terms are retained so repeated individually sub-ULP opposing residuals can still change the represented mean when their combined mass is material. Whether compensation comes from retained cancellation low terms or from a same-sign remainder left by exact opposite-sign cancellation, the canonical Neumaier high part, division residual, and correction are carried through the original scientific denominator before final scale restoration. For a same-sign all-subnormal remainder whose scientific divisor is at least the surviving term count, each represented magnitude is an exact integer number of `2^-1074` units; those units are summed in bounded integer arithmetic and quotient/remainder ties-to-even is applied once at the final subnormal grid, avoiding normalize/rescale double rounding. `bias_standard_error` still requires representable individual residual dispersion. Mathematically nonzero final results below or above binary64 range fail closed. +- Mean signed bias and bias SE remain Validation Evidence performance measures over admitted recovery units. `mean_bias` uses the direct residual path only when every pairwise subtraction is finite and does not discard represented low-order input mass. Overflowing or inexact finite pairwise subtraction redirects to the algebraically equivalent recovered-plus-negated-truth numerator, which is sign-cancelled before exact-power-of-two scale reduction and divided by the original recovery-unit count. During mixed-sign cancellation, error-free low terms are retained so repeated individually sub-ULP opposing residuals can still change the represented mean when their combined mass is material. Whether compensation comes from retained cancellation low terms or from a same-sign remainder left by exact opposite-sign cancellation, the canonical Neumaier high part, division residual, and correction are carried through the original scientific denominator before final scale restoration. For a same-sign all-subnormal remainder whose scientific divisor is at least the surviving term count, each represented magnitude is an exact integer number of `2^-1074` units; those units are summed in bounded integer arithmetic and quotient/remainder ties-to-even is applied once at the final subnormal grid. `bias_standard_error` still requires each individual signed residual to be representable. For exactly two observations, if either finite pairwise subtraction has error-free roundoff, TEPP evaluates `SE(mean) = |r1-r2| / 2` from the expanded represented inputs instead of treating two equal rounded residuals as zero spread. This is a bounded two-observation repair, not a claim of globally correctly rounded `n > 2` dispersion. Mathematically nonzero final results below or above binary64 range fail closed. - Generic Validation Evidence RMSE and its delta-method SE normalize before squaring. Exact-zero point RMSE requires exact-zero point RMSE SE. For positive RMSE, the declared producer satisfies `SE(RMSE) <= RMSE / 2`, with a small relative binary64 admission tolerance. - Generic `MonteCarloSummary` is sign-neutral. Zero SD requires zero SE and percentile endpoints equal to the represented mean. Positive SD requires positive SE coherent with represented `SD / sqrt(n)` within a small relative tolerance. Every inclusive nearest-rank endpoint is a retained observation and satisfies `|endpoint - mean| <= SD * sqrt(n - 1)`. Distinct lower/upper endpoint values share the same `(n - 1) * SD²` deviation budget. When `replication_count = 2` and endpoints are numerically distinct, those values exhaust the retained sample and the recorded represented mean/sample SD must match deterministic two-value reconstruction. Equal numeric endpoints do not prove two distinct ranks and are not subjected to that exhaustion rule. - When the generic carrier occupies `ValidationReport::monte_carlo_rmse`, retained replications are nonnegative; positive mean implies `SE(mean) <= mean`, and inclusive nearest-rank endpoints cannot exceed nonnegative sample-sum support `n * mean`. These typed bounds are not imposed on signed metrics such as bias. @@ -79,17 +79,17 @@ The clock contract separates event/valid time, assertion time, document time, sy ### #310 — Longitudinal Modeling -#310 remains the canonical Longitudinal Modeling landing vehicle at `c6680450152b1e0a2c9abb553772d74a23923335`. It is still based before protected #489/#490, so wrong-base/restack is a repair finding. Current-head Rust/documentation/security/review evidence remains required before Ready/merge; predecessor or child-head evidence does not transfer. +#310 remains the canonical Longitudinal Modeling landing vehicle at `c6680450152b1e0a2c9abb553772d74a23923335`. Its recorded base tip predates protected #489/#490, so wrong-base/restack remains a repair finding. Current-head Rust/documentation/security/review evidence remains required before Ready/merge; predecessor or child-head evidence does not transfer. ### #488 — Validation Evidence -#488 is the generic Validation Evidence landing vehicle at exact head `c845e36f16aed2c0d64d486b5647448d27831ea8`, based on protected #490. GAP-090 public RED `91abdb496ef13229ed95bcf8854770a2cc71b4b8` fixes a same-sign all-subnormal represented-input mean where unit counts `[2^52-32, 2^52-12, 2^52-20]` have exact mean `2^52-21-1/3` and therefore round once to bits `0x000f_ffff_ffff_ffeb`; predecessor normalize/divide/rescale returned adjacent `0x000f_ffff_ffff_ffea`. First repair `e89dc34616dfba86683c8fc05611a7ac31a2d2c3` bypassed scaling but retained a floating compensated accumulation and was invalidated by a separate exact halfway payload. Corrected causal repair `1c0df8a77c4b65583e9d1945864f0a72bc598a71` sums exact subnormal units in `u128` and performs quotient/remainder round-to-nearest, ties-to-even once when the scientific divisor is at least the surviving term count. Halfway contract `f79a1b9a1b299b34f87babbbdd766e4be6bd60df` and regression fixture `eb29a79a3c51034dbff8d29782d8e71fe65012b6` prevent both ordinary and direct-float double-rounding regressions. CHANGELOG `65ff502b8f46f4043ca44983722e0f9722105a08`; research/current head `c845e36f16aed2c0d64d486b5647448d27831ea8`. +#488 is the generic Validation Evidence landing vehicle at exact head `a9bf0320419d44854a1efaa11b06fda09884f5e3`, based on protected #490. GAP-092 public RED `c9c55ea568d27e33d6e522b02e6431ec4c6983d2` proves that `truth=[2^-54,2^-55]`, `recovered=[1,1]` contains two distinct represented-input residuals although both binary64 pairwise subtractions round to `1.0`; predecessor `bias_standard_error` therefore emitted false exact-zero uncertainty. For two observations, the exact represented-input identity is `SE = |r1-r2|/2 = 2^-56`. Causal repair `f6d7da9681022e0df7a60f444e02894605201cd4` preserves the existing finite-residual gate and uses the canonical expanded numerator `[recovered[0],-truth[0],-recovered[1],truth[1]] / 2` only on this two-observation roundoff path. CHANGELOG `ab7730ca5246598dd916ff264e5bdf97ecf72754`; research/TRACEABILITY/current head `a9bf0320419d44854a1efaa11b06fda09884f5e3`. -GAP-086–GAP-089 remain inherited: overflowing pairwise residual cancellation, error-free low-term retention, mixed-remainder compensation through the scientific divisor, and exact-cancellation same-sign compensated division. GAP-071/GAP-073–GAP-090 remain delivery-pending until current-head hosted gates, independent review, protected-main integration, and required durable-consumer adoption are verified. Bare legacy `ValidationReport` remains a backward-compatible compact projection and is not silently treated as v1 provenance. +GAP-091 remains immediately inherited: RED `a9d9bda3...` exposed mean-bias pairwise subtraction roundoff at a final binary64 midpoint; first repair `96bff8e5...` proved the owner path but was insufficient; corrected mixed-remainder tail/midpoint repair `676ccda0...`, CHANGELOG `cbcfa8d...`, research `1f9e2631...`, and two-direction edge `0bff5a8d...` preserve the represented-input mean without claiming global correct rounding. GAP-086–GAP-090 and earlier Wilson, provenance, Monte Carlo, RMSE/SE, matching, serde/projection repairs remain inherited. GAP-071/GAP-073–GAP-092 remain delivery-pending until current-head hosted gates, independent review, protected-main integration, and required durable-consumer adoption are verified. Bare legacy `ValidationReport` remains a backward-compatible compact projection and is not silently treated as v1 provenance. ### #416 — Validation / Analysis Run consolidation -#416 live branch head is `aa730c63563eb4a33048d822b581036c8487bd47`, six fast-forward commits beyond generic cutoff-before-identity repair `0b7155cc238defb1e55129ff3000658f04b343cf`. Its PR description was corrected to distinguish the inherited repair from the actual branch head. #458/#460/#482/#483/#484/#485/#487 remain fold children until every unique source/test/fixture/contract/doctoring delta is inherited by a conflict-resolving survivor. Child-head evidence does not transfer to #416. The vehicle is still based before #489/#490 and must be non-destructively restacked/consolidated rather than closed for staleness. +#416 live branch head is `aa730c63563eb4a33048d822b581036c8487bd47`, six fast-forward commits beyond generic cutoff-before-identity repair `0b7155cc238defb1e55129ff3000658f04b343cf`. Its PR description distinguishes inherited repair identity from actual branch head. #458/#460/#482/#483/#484/#485/#487 remain fold children until every unique source/test/fixture/contract/doctoring delta is inherited by a conflict-resolving survivor. Child-head evidence does not transfer to #416. The vehicle is still based before #489/#490 and must be non-destructively restacked/consolidated rather than closed for staleness. ### #480 — contextual-orchestrator boundary @@ -143,53 +143,55 @@ GAP-086–GAP-089 remain inherited: overflowing pairwise residual cancellation, | GAP-042 | Ratio-first logarithm could nearly double an adjacent-float irregular residual growth rate | `verification-pending` | RED `766ddc7a...` + `ln_1p` repair `16f21d9a...` | | GAP-043 | Duplicate known-truth component identities could silently reweight RMSE recovery evidence | `verification-pending` | RED `698f12f5...` + uniqueness repair `2fae4cb2...` | | GAP-044 | Known-truth RMSE alignment/accumulation depended on row order instead of component identity | `verification-pending` | RED `8ad72ac9...` / `5fb93c40...` + repairs `2dd9537e...` / `025dce7f...`; #310 `c6680450...` | -| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; current #488 `c845e36f...` | -| GAP-046 | Bias SE could reject a representable SEM because raw squared deviations/intermediates overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; current #488 `c845e36f...` | -| GAP-047 | Generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; current #488 `c845e36f...` | -| GAP-048 | Mean signed bias could erase a representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; current #488 `c845e36f...` | +| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; current #488 `a9bf0320...` | +| GAP-046 | Bias SE could reject a representable SEM because raw squared deviations/intermediates overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; current #488 `a9bf0320...` | +| GAP-047 | Generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; current #488 `a9bf0320...` | +| GAP-048 | Mean signed bias could erase a representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; current #488 `a9bf0320...` | | GAP-049 | Stable `Between` recovery could be aliased across occasion indices and reweight RMSE | `verification-pending` | RED `0a03041c...` + repair `ec2c1219...`; #310 `c6680450...` | -| GAP-050 | Zero-multiplier SE-aware acceptance could erase a nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; current #488 `c845e36f...` | -| GAP-051 | Exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; current #488 `c845e36f...` | -| GAP-052 | All-covered Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; current #488 `c845e36f...` | -| GAP-053 | Strict-interior Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; current #488 `c845e36f...` | -| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; current #488 `c845e36f...` | -| GAP-055 | Strict-interior Wilson lower endpoint could accept a nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; current #488 `c845e36f...` | -| GAP-056 | Durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; current #488 `c845e36f...` | -| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from a generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; current #488 `c845e36f...` | -| GAP-058 | Generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; current #488 `c845e36f...` | -| GAP-059 | Generic Monte Carlo summary could materially misstate positive SE relative to `SD / sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; current #488 `c845e36f...` | -| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; current #488 `c845e36f...` | -| GAP-061 | Generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; current #488 `c845e36f...` | -| GAP-062 | Finite-tolerance matching could fail while the pair is deterministically outside every finite tolerance | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; current #488 `c845e36f...` | -| GAP-063 | Exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; current #488 `c845e36f...` | -| GAP-064 | Positive point RMSE could carry SE above the declared squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; current #488 `c845e36f...` | -| GAP-065 | Positive Monte Carlo RMSE could carry spread/SE impossible for nonnegative replications | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; current #488 `c845e36f...` | -| GAP-066 | RMSE Monte Carlo nearest-rank percentile could exceed total nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; current #488 `c845e36f...` | -| GAP-067 | Generic nearest-rank percentile endpoint could be individually incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected over-strong repair `2798e4f9...`; causal repair `c7151b49...`; edge `dbef285b...`; changelog `c38a320c...`; research `2bbcbb24...`; current #488 `c845e36f...` | -| GAP-068 | Distinct generic percentile endpoints could each pass individual radius checks while jointly exceeding the sample squared-deviation budget | `verification-pending` | RED `c4a13826...` + causal repair `cb3f80a2...` + changelog `f727450d...`; current #488 `c845e36f...` | -| GAP-069 | Two-replication distinct nearest-rank endpoints could exhaust the retained sample while the stored mean or SD remained impossible | `verification-pending` | RED `81bf0d9e...` + causal repair `d48f8fef...` + mean coverage `fb314d8a...` + branch cleanup `440b78d8...` + changelog `45116498...`; current #488 `c845e36f...` | -| GAP-070 | Stored Wilson bounds could contain empirical coverage while the lower/upper pair could not arise from one Wilson score interval for that same coverage | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...` + complementary edge `c1cb16a7...`; current #488 `c845e36f...` | -| GAP-071 | Durable Wilson evidence lacked denominator and critical-value/sidedness provenance, preventing exact recomputation from a persisted artifact | `active-repair` | valid carrier RED `6f6e06d2...`; shared count/Wilson authority `ca517ed3...`; `WilsonCoverageEvidenceV1` `31e1ab2b...`; sidedness `e9c63926...`/`fdd24a1a...`; envelope RED `07766cb0...` + `ValidationEvidenceV1` repair `a16f22e6...`; current #488 `c845e36f...`; remaining: hosted GREEN/review/main plus durable-consumer adoption | -| GAP-072 | Exact all-covered Wilson evidence could retain a zero lower endpoint even though the canonical non-empty finite-`z²` producer always emits `n/(n+z²) > 0` | `verification-pending` | RED `ce714f07...` + non-force source-restore RCA `18499052...` + repair `72e9d954...` + changelog `e3a2f4a2...`; current #488 `c845e36f...` | -| GAP-073 | Durable Wilson count provenance could round one uncovered observation away above binary64's exact-integer range and expose a pointer-width-dependent count schema | `verification-pending` | RED `29d710a5...` + complement/count repair `29968c80...` + fixed-width carrier repair `91d9a3bb...` + exact ratio RED/repair `63ddfdd6...`/`11323c57...`; current #488 `c845e36f...` | -| GAP-074 | Durable Wilson evidence could correctly retain exact `u64` counts yet pre-round `sample_count` before endpoint projection, shifting strict-interior endpoints or erasing all-covered finite-sample uncertainty | `verification-pending` | RED `f89e2467...` + all-covered edge `1a5180b2...` + stale-oracle correction `6254c498...` + causal reciprocal-scale repair `73bbb5cf...` + changelog `f2b5768b...` + research predecessor `7fc78a59...`; current #488 `c845e36f...` | -| GAP-075 | Inexact durable all-covered Wilson evidence could round the complementary miss mass to exact one at extreme finite `z` and erase a representable positive lower endpoint | `verification-pending` | RED `059ce70d...`; transient duplicate-owner implementation `46f91f3f...` excluded; canonical repair `0f478392...`; single-writer cleanup `8e2058f2...`; exact-oracle correction `93d5d208...`; changelog correction `43b6562c...`; research predecessor `b03a719d...`; current #488 `c845e36f...` | -| GAP-076 | Exactly representable all-covered Wilson counts could absorb a small positive `z²` in `n + z²` and falsely emit exact `1.0` although a lower binary64 endpoint is representable | `verification-pending` | RED `e0c4ec81...` + causal boundary repair `c9dcb9df...` + below-resolution edge `6140080d...` + changelog `09ebb482...` + research predecessor `fe89c438...`; current #488 `c845e36f...` | -| GAP-077 | Exactly representable all-covered Wilson counts could form an inexact partial denominator `n + z²` whose rounded sum shifts the represented-input lower endpoint by one ULP even though neither operand is fully absorbed | `verification-pending` | RED `06e55653...` + causal TwoSum/FMA repair `6c084dbe...` + research `25cc1943...` + changelog `5acc894b...` + predecessor changelog correction `f89e36d1...` + correct-direct-rounding control `80a0a0ad...`; current #488 `c845e36f...` | -| GAP-078 | Exact-count all-covered Wilson residual compensation could move a direct quotient by one ULP even when the represented-input rational remains on the same side of the adjacent midpoint | `verification-pending` | RED `d076d344...` + midpoint-selection repair `32314239...` + changelog `a75940c9...` + research predecessor `ef6441f7...`; current #488 `c845e36f...` | -| GAP-079 | SE-aware acceptance could underflow a finite positive `k · SE` tolerance to exact zero by dividing `SE` by a much larger estimate/target scale before multiplication | `verification-pending` | RED `76067efc...` + causal direct-finite comparison repair `4ffdf366...` + changelog `d822c0ba...` + current #488 `c845e36f...` | -| GAP-080 | SE-aware acceptance both-overflow fallback could normalize an exact strict rejection into an equal rounded residual/bound and falsely accept it | `verification-pending` | RED `a9a45714...` + exact significand/exponent repair `425e8963...` + changelog `e6270629...` + current #488 `c845e36f...` | -| GAP-081 | SE-aware acceptance finite/finite multiplication could round an exact strict represented-input rejection into an equal residual/bound and falsely accept it | `verification-pending` | RED `23c3262c...` + tie repair `6a2add48...` + edge coverage `3656deb2...` + changelog `090f5124...` + current #488 `c845e36f...` | -| GAP-082 | SE-aware acceptance finite subtraction could round an exact strict represented-input rejection onto an exact finite bound and falsely accept equality | `verification-pending` | RED `58cbc032...` + causal low-term comparison repair `68a6fd98...` + sign-symmetric edge `b2c06512...` + changelog `c4f752f3...` + current #488 `c845e36f...` | -| GAP-083 | SE-aware acceptance product correction can fall below binary64 resolution even when the rounded finite bound is subnormal or minimum normal, erasing a strict represented-input rejection | `verification-pending` | RED `b55c5473...` + initial narrow repair `210cebc4...` + minimum-normal RED `c77ac440...` + corrected zero-projection repair `772ad8ed...` + changelog correction `ceb68825...` + current #488 `c845e36f...` | -| GAP-084 | Legacy Wilson pair admission could accept an exact-zero/exact-one boundary even though the peer endpoint implied a representable non-boundary root | `verification-pending` | RED `c9d612f2...` + causal peer-root repair `88512417...` + branch-complete stable evaluation `6a4f89da...` + symmetry/serde/extreme-boundary contracts `0ce7639b...` + changelog `407b3645...` + current #488 `c845e36f...` | -| GAP-085 | Equal nonzero SE-aware subtraction/FMA correction projections could conceal the exact represented-input ordering and turn a strict decision into rounded equality | `verification-pending` | RED `35ea85ba...` + exact product-roundoff repair `7d597a18...` + signed edge `b463a991...` + branch-scope refinement `ca8c2b86...` + changelog `702eec2f...` + current #488 `c845e36f...` | -| GAP-086 | Mean signed bias could reject a representable result because individual `recovered - truth` residuals overflow before opposing represented terms cancel | `verification-pending` | RED `04e6e745...` + explicit-denominator cancellation `28b1d186...` + causal bias repair `d1cd5461...` + changelog `d68dde34...` + current #488 `c845e36f...` | -| GAP-087 | Mean signed bias mixed-sign cancellation could discard repeated individually sub-ULP opposing residuals even though their combined represented mass changes the final bias | `verification-pending` | RED `63913727...` + error-free low-term repair `5697cca5...` + changelog `53f5c912...` + current #488 `c845e36f...` | -| GAP-088 | Mean signed bias mixed-remainder compensation could be rounded into an intermediate numerator before the scientific count division, shifting the represented-input mean by one ULP | `verification-pending` | RED `8b4d19d1...` + causal compensated-division/FMA repair `7a33212b...` + changelog `bad698dd...` + current #488 `c845e36f...` | -| GAP-089 | Mean signed bias exact opposite-sign cancellation could leave a same-sign compensated remainder whose `sum + correction` was rounded before the scientific count division, shifting the represented-input mean by one ULP | `verification-pending` | RED `84476aad...` + causal same-sign compensated-division repair `5f0d40b8...` + changelog `5763cde0...` + current #488 `c845e36f...` | -| GAP-090 | Same-sign all-subnormal mean normalization could double-round the final represented bias by one ULP at scale restoration | `verification-pending` | RED `91abdb49...`; discarded direct-float repair `e89dc346...`; corrected exact-unit repair `1c0df8a7...`; halfway contract `f79a1b9a...`; regression fixture `eb29a79a...`; changelog `65ff502b...`; research/current #488 `c845e36f...` | +| GAP-050 | Zero-multiplier SE-aware acceptance could erase a nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; current #488 `a9bf0320...` | +| GAP-051 | Exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; current #488 `a9bf0320...` | +| GAP-052 | All-covered Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; current #488 `a9bf0320...` | +| GAP-053 | Strict-interior Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; current #488 `a9bf0320...` | +| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; current #488 `a9bf0320...` | +| GAP-055 | Strict-interior Wilson lower endpoint could accept a nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; current #488 `a9bf0320...` | +| GAP-056 | Durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; current #488 `a9bf0320...` | +| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from a generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; current #488 `a9bf0320...` | +| GAP-058 | Generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; current #488 `a9bf0320...` | +| GAP-059 | Generic Monte Carlo summary could materially misstate positive SE relative to `SD / sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; current #488 `a9bf0320...` | +| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; current #488 `a9bf0320...` | +| GAP-061 | Generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; current #488 `a9bf0320...` | +| GAP-062 | Finite-tolerance matching could fail while the pair is deterministically outside every finite tolerance | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; current #488 `a9bf0320...` | +| GAP-063 | Exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; current #488 `a9bf0320...` | +| GAP-064 | Positive point RMSE could carry SE above the declared squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; current #488 `a9bf0320...` | +| GAP-065 | Positive Monte Carlo RMSE could carry spread/SE impossible for nonnegative replications | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; current #488 `a9bf0320...` | +| GAP-066 | RMSE Monte Carlo nearest-rank percentile could exceed total nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; current #488 `a9bf0320...` | +| GAP-067 | Generic nearest-rank percentile endpoint could be individually incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected over-strong repair `2798e4f9...`; causal repair `c7151b49...`; edge `dbef285b...`; changelog `c38a320c...`; research `2bbcbb24...`; current #488 `a9bf0320...` | +| GAP-068 | Distinct generic percentile endpoints could each pass individual radius checks while jointly exceeding the sample squared-deviation budget | `verification-pending` | RED `c4a13826...` + causal repair `cb3f80a2...` + changelog `f727450d...`; current #488 `a9bf0320...` | +| GAP-069 | Two-replication distinct nearest-rank endpoints could exhaust the retained sample while the stored mean or SD remained impossible | `verification-pending` | RED `81bf0d9e...` + causal repair `d48f8fef...` + mean coverage `fb314d8a...` + branch cleanup `440b78d8...` + changelog `45116498...`; current #488 `a9bf0320...` | +| GAP-070 | Stored Wilson bounds could contain empirical coverage while the lower/upper pair could not arise from one Wilson score interval for that same coverage | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...` + complementary edge `c1cb16a7...`; current #488 `a9bf0320...` | +| GAP-071 | Durable Wilson evidence lacked denominator and critical-value/sidedness provenance, preventing exact recomputation from a persisted artifact | `active-repair` | valid carrier RED `6f6e06d2...`; shared count/Wilson authority `ca517ed3...`; `WilsonCoverageEvidenceV1` `31e1ab2b...`; sidedness `e9c63926...`/`fdd24a1a...`; envelope RED `07766cb0...` + `ValidationEvidenceV1` repair `a16f22e6...`; current #488 `a9bf0320...`; remaining: hosted GREEN/review/main plus durable-consumer adoption | +| GAP-072 | Exact all-covered Wilson evidence could retain a zero lower endpoint even though the canonical non-empty finite-`z²` producer always emits `n/(n+z²) > 0` | `verification-pending` | RED `ce714f07...` + non-force source-restore RCA `18499052...` + repair `72e9d954...` + changelog `e3a2f4a2...`; current #488 `a9bf0320...` | +| GAP-073 | Durable Wilson count provenance could round one uncovered observation away above binary64's exact-integer range and expose a pointer-width-dependent count schema | `verification-pending` | RED `29d710a5...` + complement/count repair `29968c80...` + fixed-width carrier repair `91d9a3bb...` + exact ratio RED/repair `63ddfdd6...`/`11323c57...`; current #488 `a9bf0320...` | +| GAP-074 | Durable Wilson evidence could correctly retain exact `u64` counts yet pre-round `sample_count` before endpoint projection, shifting strict-interior endpoints or erasing all-covered finite-sample uncertainty | `verification-pending` | RED `f89e2467...` + all-covered edge `1a5180b2...` + stale-oracle correction `6254c498...` + causal reciprocal-scale repair `73bbb5cf...` + changelog `f2b5768b...` + research predecessor `7fc78a59...`; current #488 `a9bf0320...` | +| GAP-075 | Inexact durable all-covered Wilson evidence could round the complementary miss mass to exact one at extreme finite `z` and erase a representable positive lower endpoint | `verification-pending` | RED `059ce70d...`; transient duplicate-owner implementation `46f91f3f...` excluded; canonical repair `0f478392...`; single-writer cleanup `8e2058f2...`; exact-oracle correction `93d5d208...`; changelog correction `43b6562c...`; research predecessor `b03a719d...`; current #488 `a9bf0320...` | +| GAP-076 | Exactly representable all-covered Wilson counts could absorb a small positive `z²` in `n + z²` and falsely emit exact `1.0` although a lower binary64 endpoint is representable | `verification-pending` | RED `e0c4ec81...` + causal boundary repair `c9dcb9df...` + below-resolution edge `6140080d...` + changelog `09ebb482...` + research predecessor `fe89c438...`; current #488 `a9bf0320...` | +| GAP-077 | Exactly representable all-covered Wilson counts could form an inexact partial denominator `n + z²` whose rounded sum shifts the represented-input lower endpoint by one ULP even though neither operand is fully absorbed | `verification-pending` | RED `06e55653...` + causal TwoSum/FMA repair `6c084dbe...` + research `25cc1943...` + changelog `5acc894b...` + predecessor changelog correction `f89e36d1...` + correct-direct-rounding control `80a0a0ad...`; current #488 `a9bf0320...` | +| GAP-078 | Exact-count all-covered Wilson residual compensation could move a direct quotient by one ULP even when the represented-input rational remains on the same side of the adjacent midpoint | `verification-pending` | RED `d076d344...` + midpoint-selection repair `32314239...` + changelog `a75940c9...` + research predecessor `ef6441f7...`; current #488 `a9bf0320...` | +| GAP-079 | SE-aware acceptance could underflow a finite positive `k · SE` tolerance to exact zero by dividing `SE` by a much larger estimate/target scale before multiplication | `verification-pending` | RED `76067efc...` + causal direct-finite comparison repair `4ffdf366...` + changelog `d822c0ba...` + current #488 `a9bf0320...` | +| GAP-080 | SE-aware acceptance both-overflow fallback could normalize an exact strict rejection into an equal rounded residual/bound and falsely accept it | `verification-pending` | RED `a9a45714...` + exact significand/exponent repair `425e8963...` + changelog `e6270629...` + current #488 `a9bf0320...` | +| GAP-081 | SE-aware acceptance finite/finite multiplication could round an exact strict represented-input rejection into an equal residual/bound and falsely accept it | `verification-pending` | RED `23c3262c...` + tie repair `6a2add48...` + edge coverage `3656deb2...` + changelog `090f5124...` + current #488 `a9bf0320...` | +| GAP-082 | SE-aware acceptance finite subtraction could round an exact strict represented-input rejection onto an exact finite bound and falsely accept equality | `verification-pending` | RED `58cbc032...` + causal low-term comparison repair `68a6fd98...` + sign-symmetric edge `b2c06512...` + changelog `c4f752f3...` + current #488 `a9bf0320...` | +| GAP-083 | SE-aware acceptance product correction can fall below binary64 resolution even when the rounded finite bound is subnormal or minimum normal, erasing a strict represented-input rejection | `verification-pending` | RED `b55c5473...` + initial narrow repair `210cebc4...` + minimum-normal RED `c77ac440...` + corrected zero-projection repair `772ad8ed...` + changelog correction `ceb68825...` + current #488 `a9bf0320...` | +| GAP-084 | Legacy Wilson pair admission could accept an exact-zero/exact-one boundary even though the peer endpoint implied a representable non-boundary root | `verification-pending` | RED `c9d612f2...` + causal peer-root repair `88512417...` + branch-complete stable evaluation `6a4f89da...` + symmetry/serde/extreme-boundary contracts `0ce7639b...` + changelog `407b3645...` + current #488 `a9bf0320...` | +| GAP-085 | Equal nonzero SE-aware subtraction/FMA correction projections could conceal the exact represented-input ordering and turn a strict decision into rounded equality | `verification-pending` | RED `35ea85ba...` + exact product-roundoff repair `7d597a18...` + signed edge `b463a991...` + branch-scope refinement `ca8c2b86...` + changelog `702eec2f...` + current #488 `a9bf0320...` | +| GAP-086 | Mean signed bias could reject a representable result because individual `recovered - truth` residuals overflow before opposing represented terms cancel | `verification-pending` | RED `04e6e745...` + explicit-denominator cancellation `28b1d186...` + causal bias repair `d1cd5461...` + changelog `d68dde34...` + current #488 `a9bf0320...` | +| GAP-087 | Mean signed bias mixed-sign cancellation could discard repeated individually sub-ULP opposing residuals even though their combined represented mass changes the final bias | `verification-pending` | RED `63913727...` + error-free low-term repair `5697cca5...` + changelog `53f5c912...` + current #488 `a9bf0320...` | +| GAP-088 | Mean signed bias mixed-remainder compensation could be rounded into an intermediate numerator before the scientific count division, shifting the represented-input mean by one ULP | `verification-pending` | RED `8b4d19d1...` + causal compensated-division/FMA repair `7a33212b...` + changelog `bad698dd...` + current #488 `a9bf0320...` | +| GAP-089 | Mean signed bias exact opposite-sign cancellation could leave a same-sign compensated remainder whose `sum + correction` was rounded before the scientific count division, shifting the represented-input mean by one ULP | `verification-pending` | RED `84476aad...` + causal same-sign compensated-division repair `5f0d40b8...` + changelog `5763cde0...` + current #488 `a9bf0320...` | +| GAP-090 | Same-sign all-subnormal mean normalization could double-round the final represented bias by one ULP at scale restoration | `verification-pending` | RED `91abdb49...`; discarded direct-float repair `e89dc346...`; corrected exact-unit repair `1c0df8a7...`; halfway contract `f79a1b9a...`; regression fixture `eb29a79a...`; changelog `65ff502b...`; research lineage retained by current #488 `a9bf0320...` | +| GAP-091 | Mean signed bias pairwise subtraction roundoff could move the represented-input mean across a final binary64 midpoint | `verification-pending` | RED `a9d9bda3...` + insufficient first repair `96bff8e5...` + corrected tail/midpoint repair `676ccda0...` + changelog `cbcfa8d6...` + research `1f9e2631...` + two-direction edge `0bff5a8d...` + current #488 `a9bf0320...` | +| GAP-092 | Bias standard error could report false exact zero when two distinct represented-input residuals both round to the same pairwise binary64 subtraction | `verification-pending` | RED `c9c55ea5...` + causal two-observation expanded-difference repair `f6d7da96...` + changelog `ab7730ca...` + research/current #488 `a9bf0320...` | ## Release gate -TEPP currently has no GitHub release. Release is permitted only after a clean coherent vertical reaches protected main with exact protected-head CI/security evidence, scientific/recovery acceptance, reproducible package/build artifacts with SBOM and provenance, validated migrations/upgrade/rollback/recovery where applicable, consistent version metadata and current `CHANGELOG.md`, accessibility/operability evidence for user-facing components, no unresolved scientific/privacy/security/supply-chain blockers, and released integration contracts where deployment depends on them. Queued/pending/startup-failed/skipped or predecessor-head evidence is not GREEN. \ No newline at end of file +TEPP currently has no GitHub release. Release is permitted only after a clean coherent vertical reaches protected main with exact protected-head CI/security evidence, scientific/recovery acceptance, reproducible package/build artifacts with SBOM and provenance, validated migrations/upgrade/rollback/recovery where applicable, consistent version metadata and current `CHANGELOG.md`, accessibility/operability evidence for user-facing components, no unresolved scientific/privacy/security/supply-chain blockers, and released integration contracts where deployment depends on them. Queued/pending/startup-failed/skipped or predecessor-head evidence is not GREEN. From f80c888668faddce93b9cc5b086b8a55cdb32e39 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 5 Sep 2026 06:13:45 +0900 Subject: [PATCH 186/235] docs(gaps): trace bias SE multi-observation and sqrt rounding --- docs/product-technical-gap-baseline.md | 108 +++++++++++++------------ 1 file changed, 56 insertions(+), 52 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 7860b72d9..eda2bcd3e 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-04T20:08:44Z +**Snapshot:** 2026-09-04T21:11:19Z **Protected-main evidence:** `a243f18da4a4ca8a8d068c39922537f1f8ed6ad0` **Workspace version:** `0.2.0` @@ -30,7 +30,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `a9bf0320419d44854a1efaa11b06fda09884f5e3` | true | `main` | Validation Evidence landing vehicle, based on protected #490. GAP-091 preserves represented-input mean bias when finite pairwise subtraction rounds, and GAP-092 prevents a false-zero two-observation bias standard error when distinct represented residuals collapse to the same binary64 subtraction. GAP-086–090 and prior Wilson, provenance, Monte Carlo, RMSE/SE, matching, serde/projection repairs remain inherited. Hosted exact-head gates and independent review remain required. | +| #488 | `184f4e2c109c7904027f782e91b8d9a01a1d46f1` | true | `main` | Validation Evidence landing vehicle, based on protected #490. GAP-093 preserves nonzero n>2 bias sampling uncertainty when distinct represented-input residuals collapse to one rounded subtraction, and GAP-094 removes a subsequent one-ULP square-root decomposition error in the represented standard error. GAP-091–092, GAP-086–090, and prior Wilson, provenance, Monte Carlo, RMSE/SE, matching, serde/projection repairs remain inherited. Hosted exact-head gates and independent review remain required. | | #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 | Validation / Analysis Run fold child. Unique evidence must be inherited by a conflict-resolving survivor; child-head CI does not transfer. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | @@ -62,7 +62,7 @@ The clock contract separates event/valid time, assertion time, document time, sy - Row arrival order is not scientific evidence. Fixed admitted observations must produce bit-identical means/centered results under permutation wherever the contract claims deterministic CPU `f64` reference behavior. - Known-truth component recovery follows bounded-context identity: stable `Between` is unit-level and uses canonical `occasion_index = 0`; `Within` retains actual `(unit, occasion)` identity. Duplicate identities or stable-Between occasion aliases are not weights. - A representable final scientific estimand is not rejected solely because an avoidable intermediate binary64 operation overflows/underflows. False exact 0/1/non-finite endpoints, erased finite bounds, cancellation residues, and double-rounded subnormal endpoints are not accepted when a bounded equivalent operation preserves the represented estimand or decision. -- Mean signed bias and bias SE remain Validation Evidence performance measures over admitted recovery units. `mean_bias` uses the direct residual path only when every pairwise subtraction is finite and does not discard represented low-order input mass. Overflowing or inexact finite pairwise subtraction redirects to the algebraically equivalent recovered-plus-negated-truth numerator, which is sign-cancelled before exact-power-of-two scale reduction and divided by the original recovery-unit count. During mixed-sign cancellation, error-free low terms are retained so repeated individually sub-ULP opposing residuals can still change the represented mean when their combined mass is material. Whether compensation comes from retained cancellation low terms or from a same-sign remainder left by exact opposite-sign cancellation, the canonical Neumaier high part, division residual, and correction are carried through the original scientific denominator before final scale restoration. For a same-sign all-subnormal remainder whose scientific divisor is at least the surviving term count, each represented magnitude is an exact integer number of `2^-1074` units; those units are summed in bounded integer arithmetic and quotient/remainder ties-to-even is applied once at the final subnormal grid. `bias_standard_error` still requires each individual signed residual to be representable. For exactly two observations, if either finite pairwise subtraction has error-free roundoff, TEPP evaluates `SE(mean) = |r1-r2| / 2` from the expanded represented inputs instead of treating two equal rounded residuals as zero spread. This is a bounded two-observation repair, not a claim of globally correctly rounded `n > 2` dispersion. Mathematically nonzero final results below or above binary64 range fail closed. +- Mean signed bias and bias SE remain Validation Evidence performance measures over admitted recovery units. `mean_bias` uses the direct residual path only when every pairwise subtraction is finite and does not discard represented low-order input mass. Overflowing or inexact finite pairwise subtraction redirects to the algebraically equivalent recovered-plus-negated-truth numerator, which is sign-cancelled before exact-power-of-two scale reduction and divided by the original recovery-unit count. During mixed-sign cancellation, error-free low terms are retained so repeated individually sub-ULP opposing residuals can still change the represented mean when their combined mass is material. Whether compensation comes from retained cancellation low terms or from a same-sign remainder left by exact opposite-sign cancellation, the canonical Neumaier high part, division residual, and correction are carried through the original scientific denominator before final scale restoration. For a same-sign all-subnormal remainder whose scientific divisor is at least the surviving term count, each represented magnitude is an exact integer number of `2^-1074` units; those units are summed in bounded integer arithmetic and quotient/remainder ties-to-even is applied once at the final subnormal grid. `bias_standard_error` still requires each individual signed residual to be representable. For exactly two observations, if either finite pairwise subtraction has error-free roundoff, TEPP evaluates `SE(mean) = |r1-r2| / 2` from expanded represented inputs. For larger samples in which subtraction roundoff exists and every rounded residual shares the same binary64 high part, that common high part is dispersion-invariant and the standard error is evaluated from the error-free subtraction low terms. The normalized standard error is formed as `sqrt(sum(d²) / (n * (n - 1)))` after scale reduction, avoiding separately rounded `sqrt(sample_variance)` and `sqrt(n)` operands. These are bounded repairs, not a claim of globally correctly rounded n>2 dispersion when rounded residual high parts differ. Mathematically nonzero final results below or above binary64 range fail closed. - Generic Validation Evidence RMSE and its delta-method SE normalize before squaring. Exact-zero point RMSE requires exact-zero point RMSE SE. For positive RMSE, the declared producer satisfies `SE(RMSE) <= RMSE / 2`, with a small relative binary64 admission tolerance. - Generic `MonteCarloSummary` is sign-neutral. Zero SD requires zero SE and percentile endpoints equal to the represented mean. Positive SD requires positive SE coherent with represented `SD / sqrt(n)` within a small relative tolerance. Every inclusive nearest-rank endpoint is a retained observation and satisfies `|endpoint - mean| <= SD * sqrt(n - 1)`. Distinct lower/upper endpoint values share the same `(n - 1) * SD²` deviation budget. When `replication_count = 2` and endpoints are numerically distinct, those values exhaust the retained sample and the recorded represented mean/sample SD must match deterministic two-value reconstruction. Equal numeric endpoints do not prove two distinct ranks and are not subjected to that exhaustion rule. - When the generic carrier occupies `ValidationReport::monte_carlo_rmse`, retained replications are nonnegative; positive mean implies `SE(mean) <= mean`, and inclusive nearest-rank endpoints cannot exceed nonnegative sample-sum support `n * mean`. These typed bounds are not imposed on signed metrics such as bias. @@ -83,9 +83,11 @@ The clock contract separates event/valid time, assertion time, document time, sy ### #488 — Validation Evidence -#488 is the generic Validation Evidence landing vehicle at exact head `a9bf0320419d44854a1efaa11b06fda09884f5e3`, based on protected #490. GAP-092 public RED `c9c55ea568d27e33d6e522b02e6431ec4c6983d2` proves that `truth=[2^-54,2^-55]`, `recovered=[1,1]` contains two distinct represented-input residuals although both binary64 pairwise subtractions round to `1.0`; predecessor `bias_standard_error` therefore emitted false exact-zero uncertainty. For two observations, the exact represented-input identity is `SE = |r1-r2|/2 = 2^-56`. Causal repair `f6d7da9681022e0df7a60f444e02894605201cd4` preserves the existing finite-residual gate and uses the canonical expanded numerator `[recovered[0],-truth[0],-recovered[1],truth[1]] / 2` only on this two-observation roundoff path. CHANGELOG `ab7730ca5246598dd916ff264e5bdf97ecf72754`; research/TRACEABILITY/current head `a9bf0320419d44854a1efaa11b06fda09884f5e3`. +#488 is the generic Validation Evidence landing vehicle at exact head `184f4e2c109c7904027f782e91b8d9a01a1d46f1`, based on protected #490. GAP-093 RED `06a70e1c01629f15f05efef48576a9cadb1f1b98` proves that `truth=[2^-54,2^-55,0]`, `recovered=[1,1,1]` contains three distinct represented-input residuals although every binary64 pairwise subtraction rounds to `1.0`; the predecessor therefore emitted false exact-zero uncertainty. First causal repair `04c62514a23722d63a62bd5d5af6e3a930cc3147` exposes the error-free subtraction low terms and, only when every rounded high part is equal, evaluates dispersion from those low terms in O(n). CHANGELOG `56d091544a5780567a6ef772568d62b0fc651747`. -GAP-091 remains immediately inherited: RED `a9d9bda3...` exposed mean-bias pairwise subtraction roundoff at a final binary64 midpoint; first repair `96bff8e5...` proved the owner path but was insufficient; corrected mixed-remainder tail/midpoint repair `676ccda0...`, CHANGELOG `cbcfa8d...`, research `1f9e2631...`, and two-direction edge `0bff5a8d...` preserve the represented-input mean without claiming global correct rounding. GAP-086–GAP-090 and earlier Wilson, provenance, Monte Carlo, RMSE/SE, matching, serde/projection repairs remain inherited. GAP-071/GAP-073–GAP-092 remain delivery-pending until current-head hosted gates, independent review, protected-main integration, and required durable-consumer adoption are verified. Bare legacy `ValidationReport` remains a backward-compatible compact projection and is not silently treated as v1 provenance. +Oracle correction/RED `6224320410ccabb1cf16d36cc12f88e2b7a05bb1` then established GAP-094: the exact represented-input SE `2^-55/sqrt(3)` rounds to `0x3c72_79a7_4590_331c`, not the `...331d` value produced by separately rounded `sqrt(sample_variance)/sqrt(n)`. Causal repair `8b8f0a21ccc825f355859cadbf20d83f04d2369f` forms the bounded normalized expression `sqrt(sum(d²)/(n(n-1)))`; research correction `18ed314414d45fdf42078bc8261a59e8480747f1`; CHANGELOG/current #488 `184f4e2c109c7904027f782e91b8d9a01a1d46f1`. + +GAP-092 remains inherited for the exact two-observation identity, and GAP-091 remains inherited for mean-bias subtraction roundoff. GAP-086–GAP-090 and earlier Wilson, provenance, Monte Carlo, RMSE/SE, matching, serde/projection repairs remain inherited. GAP-071/GAP-073–GAP-094 remain delivery-pending until current-head hosted gates, independent review, protected-main integration, and required durable-consumer adoption are verified. Bare legacy `ValidationReport` remains a backward-compatible compact projection and is not silently treated as v1 provenance. ### #416 — Validation / Analysis Run consolidation @@ -143,54 +145,56 @@ GAP-091 remains immediately inherited: RED `a9d9bda3...` exposed mean-bias pairw | GAP-042 | Ratio-first logarithm could nearly double an adjacent-float irregular residual growth rate | `verification-pending` | RED `766ddc7a...` + `ln_1p` repair `16f21d9a...` | | GAP-043 | Duplicate known-truth component identities could silently reweight RMSE recovery evidence | `verification-pending` | RED `698f12f5...` + uniqueness repair `2fae4cb2...` | | GAP-044 | Known-truth RMSE alignment/accumulation depended on row order instead of component identity | `verification-pending` | RED `8ad72ac9...` / `5fb93c40...` + repairs `2dd9537e...` / `025dce7f...`; #310 `c6680450...` | -| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; current #488 `a9bf0320...` | -| GAP-046 | Bias SE could reject a representable SEM because raw squared deviations/intermediates overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; current #488 `a9bf0320...` | -| GAP-047 | Generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; current #488 `a9bf0320...` | -| GAP-048 | Mean signed bias could erase a representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; current #488 `a9bf0320...` | +| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; current #488 `184f4e2c...` | +| GAP-046 | Bias SE could reject a representable SEM because raw squared deviations/intermediates overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; current #488 `184f4e2c...` | +| GAP-047 | Generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; current #488 `184f4e2c...` | +| GAP-048 | Mean signed bias could erase a representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; current #488 `184f4e2c...` | | GAP-049 | Stable `Between` recovery could be aliased across occasion indices and reweight RMSE | `verification-pending` | RED `0a03041c...` + repair `ec2c1219...`; #310 `c6680450...` | -| GAP-050 | Zero-multiplier SE-aware acceptance could erase a nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; current #488 `a9bf0320...` | -| GAP-051 | Exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; current #488 `a9bf0320...` | -| GAP-052 | All-covered Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; current #488 `a9bf0320...` | -| GAP-053 | Strict-interior Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; current #488 `a9bf0320...` | -| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; current #488 `a9bf0320...` | -| GAP-055 | Strict-interior Wilson lower endpoint could accept a nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; current #488 `a9bf0320...` | -| GAP-056 | Durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; current #488 `a9bf0320...` | -| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from a generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; current #488 `a9bf0320...` | -| GAP-058 | Generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; current #488 `a9bf0320...` | -| GAP-059 | Generic Monte Carlo summary could materially misstate positive SE relative to `SD / sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; current #488 `a9bf0320...` | -| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; current #488 `a9bf0320...` | -| GAP-061 | Generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; current #488 `a9bf0320...` | -| GAP-062 | Finite-tolerance matching could fail while the pair is deterministically outside every finite tolerance | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; current #488 `a9bf0320...` | -| GAP-063 | Exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; current #488 `a9bf0320...` | -| GAP-064 | Positive point RMSE could carry SE above the declared squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; current #488 `a9bf0320...` | -| GAP-065 | Positive Monte Carlo RMSE could carry spread/SE impossible for nonnegative replications | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; current #488 `a9bf0320...` | -| GAP-066 | RMSE Monte Carlo nearest-rank percentile could exceed total nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; current #488 `a9bf0320...` | -| GAP-067 | Generic nearest-rank percentile endpoint could be individually incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected over-strong repair `2798e4f9...`; causal repair `c7151b49...`; edge `dbef285b...`; changelog `c38a320c...`; research `2bbcbb24...`; current #488 `a9bf0320...` | -| GAP-068 | Distinct generic percentile endpoints could each pass individual radius checks while jointly exceeding the sample squared-deviation budget | `verification-pending` | RED `c4a13826...` + causal repair `cb3f80a2...` + changelog `f727450d...`; current #488 `a9bf0320...` | -| GAP-069 | Two-replication distinct nearest-rank endpoints could exhaust the retained sample while the stored mean or SD remained impossible | `verification-pending` | RED `81bf0d9e...` + causal repair `d48f8fef...` + mean coverage `fb314d8a...` + branch cleanup `440b78d8...` + changelog `45116498...`; current #488 `a9bf0320...` | -| GAP-070 | Stored Wilson bounds could contain empirical coverage while the lower/upper pair could not arise from one Wilson score interval for that same coverage | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...` + complementary edge `c1cb16a7...`; current #488 `a9bf0320...` | -| GAP-071 | Durable Wilson evidence lacked denominator and critical-value/sidedness provenance, preventing exact recomputation from a persisted artifact | `active-repair` | valid carrier RED `6f6e06d2...`; shared count/Wilson authority `ca517ed3...`; `WilsonCoverageEvidenceV1` `31e1ab2b...`; sidedness `e9c63926...`/`fdd24a1a...`; envelope RED `07766cb0...` + `ValidationEvidenceV1` repair `a16f22e6...`; current #488 `a9bf0320...`; remaining: hosted GREEN/review/main plus durable-consumer adoption | -| GAP-072 | Exact all-covered Wilson evidence could retain a zero lower endpoint even though the canonical non-empty finite-`z²` producer always emits `n/(n+z²) > 0` | `verification-pending` | RED `ce714f07...` + non-force source-restore RCA `18499052...` + repair `72e9d954...` + changelog `e3a2f4a2...`; current #488 `a9bf0320...` | -| GAP-073 | Durable Wilson count provenance could round one uncovered observation away above binary64's exact-integer range and expose a pointer-width-dependent count schema | `verification-pending` | RED `29d710a5...` + complement/count repair `29968c80...` + fixed-width carrier repair `91d9a3bb...` + exact ratio RED/repair `63ddfdd6...`/`11323c57...`; current #488 `a9bf0320...` | -| GAP-074 | Durable Wilson evidence could correctly retain exact `u64` counts yet pre-round `sample_count` before endpoint projection, shifting strict-interior endpoints or erasing all-covered finite-sample uncertainty | `verification-pending` | RED `f89e2467...` + all-covered edge `1a5180b2...` + stale-oracle correction `6254c498...` + causal reciprocal-scale repair `73bbb5cf...` + changelog `f2b5768b...` + research predecessor `7fc78a59...`; current #488 `a9bf0320...` | -| GAP-075 | Inexact durable all-covered Wilson evidence could round the complementary miss mass to exact one at extreme finite `z` and erase a representable positive lower endpoint | `verification-pending` | RED `059ce70d...`; transient duplicate-owner implementation `46f91f3f...` excluded; canonical repair `0f478392...`; single-writer cleanup `8e2058f2...`; exact-oracle correction `93d5d208...`; changelog correction `43b6562c...`; research predecessor `b03a719d...`; current #488 `a9bf0320...` | -| GAP-076 | Exactly representable all-covered Wilson counts could absorb a small positive `z²` in `n + z²` and falsely emit exact `1.0` although a lower binary64 endpoint is representable | `verification-pending` | RED `e0c4ec81...` + causal boundary repair `c9dcb9df...` + below-resolution edge `6140080d...` + changelog `09ebb482...` + research predecessor `fe89c438...`; current #488 `a9bf0320...` | -| GAP-077 | Exactly representable all-covered Wilson counts could form an inexact partial denominator `n + z²` whose rounded sum shifts the represented-input lower endpoint by one ULP even though neither operand is fully absorbed | `verification-pending` | RED `06e55653...` + causal TwoSum/FMA repair `6c084dbe...` + research `25cc1943...` + changelog `5acc894b...` + predecessor changelog correction `f89e36d1...` + correct-direct-rounding control `80a0a0ad...`; current #488 `a9bf0320...` | -| GAP-078 | Exact-count all-covered Wilson residual compensation could move a direct quotient by one ULP even when the represented-input rational remains on the same side of the adjacent midpoint | `verification-pending` | RED `d076d344...` + midpoint-selection repair `32314239...` + changelog `a75940c9...` + research predecessor `ef6441f7...`; current #488 `a9bf0320...` | -| GAP-079 | SE-aware acceptance could underflow a finite positive `k · SE` tolerance to exact zero by dividing `SE` by a much larger estimate/target scale before multiplication | `verification-pending` | RED `76067efc...` + causal direct-finite comparison repair `4ffdf366...` + changelog `d822c0ba...` + current #488 `a9bf0320...` | -| GAP-080 | SE-aware acceptance both-overflow fallback could normalize an exact strict rejection into an equal rounded residual/bound and falsely accept it | `verification-pending` | RED `a9a45714...` + exact significand/exponent repair `425e8963...` + changelog `e6270629...` + current #488 `a9bf0320...` | -| GAP-081 | SE-aware acceptance finite/finite multiplication could round an exact strict represented-input rejection into an equal residual/bound and falsely accept it | `verification-pending` | RED `23c3262c...` + tie repair `6a2add48...` + edge coverage `3656deb2...` + changelog `090f5124...` + current #488 `a9bf0320...` | -| GAP-082 | SE-aware acceptance finite subtraction could round an exact strict represented-input rejection onto an exact finite bound and falsely accept equality | `verification-pending` | RED `58cbc032...` + causal low-term comparison repair `68a6fd98...` + sign-symmetric edge `b2c06512...` + changelog `c4f752f3...` + current #488 `a9bf0320...` | -| GAP-083 | SE-aware acceptance product correction can fall below binary64 resolution even when the rounded finite bound is subnormal or minimum normal, erasing a strict represented-input rejection | `verification-pending` | RED `b55c5473...` + initial narrow repair `210cebc4...` + minimum-normal RED `c77ac440...` + corrected zero-projection repair `772ad8ed...` + changelog correction `ceb68825...` + current #488 `a9bf0320...` | -| GAP-084 | Legacy Wilson pair admission could accept an exact-zero/exact-one boundary even though the peer endpoint implied a representable non-boundary root | `verification-pending` | RED `c9d612f2...` + causal peer-root repair `88512417...` + branch-complete stable evaluation `6a4f89da...` + symmetry/serde/extreme-boundary contracts `0ce7639b...` + changelog `407b3645...` + current #488 `a9bf0320...` | -| GAP-085 | Equal nonzero SE-aware subtraction/FMA correction projections could conceal the exact represented-input ordering and turn a strict decision into rounded equality | `verification-pending` | RED `35ea85ba...` + exact product-roundoff repair `7d597a18...` + signed edge `b463a991...` + branch-scope refinement `ca8c2b86...` + changelog `702eec2f...` + current #488 `a9bf0320...` | -| GAP-086 | Mean signed bias could reject a representable result because individual `recovered - truth` residuals overflow before opposing represented terms cancel | `verification-pending` | RED `04e6e745...` + explicit-denominator cancellation `28b1d186...` + causal bias repair `d1cd5461...` + changelog `d68dde34...` + current #488 `a9bf0320...` | -| GAP-087 | Mean signed bias mixed-sign cancellation could discard repeated individually sub-ULP opposing residuals even though their combined represented mass changes the final bias | `verification-pending` | RED `63913727...` + error-free low-term repair `5697cca5...` + changelog `53f5c912...` + current #488 `a9bf0320...` | -| GAP-088 | Mean signed bias mixed-remainder compensation could be rounded into an intermediate numerator before the scientific count division, shifting the represented-input mean by one ULP | `verification-pending` | RED `8b4d19d1...` + causal compensated-division/FMA repair `7a33212b...` + changelog `bad698dd...` + current #488 `a9bf0320...` | -| GAP-089 | Mean signed bias exact opposite-sign cancellation could leave a same-sign compensated remainder whose `sum + correction` was rounded before the scientific count division, shifting the represented-input mean by one ULP | `verification-pending` | RED `84476aad...` + causal same-sign compensated-division repair `5f0d40b8...` + changelog `5763cde0...` + current #488 `a9bf0320...` | -| GAP-090 | Same-sign all-subnormal mean normalization could double-round the final represented bias by one ULP at scale restoration | `verification-pending` | RED `91abdb49...`; discarded direct-float repair `e89dc346...`; corrected exact-unit repair `1c0df8a7...`; halfway contract `f79a1b9a...`; regression fixture `eb29a79a...`; changelog `65ff502b...`; research lineage retained by current #488 `a9bf0320...` | -| GAP-091 | Mean signed bias pairwise subtraction roundoff could move the represented-input mean across a final binary64 midpoint | `verification-pending` | RED `a9d9bda3...` + insufficient first repair `96bff8e5...` + corrected tail/midpoint repair `676ccda0...` + changelog `cbcfa8d6...` + research `1f9e2631...` + two-direction edge `0bff5a8d...` + current #488 `a9bf0320...` | -| GAP-092 | Bias standard error could report false exact zero when two distinct represented-input residuals both round to the same pairwise binary64 subtraction | `verification-pending` | RED `c9c55ea5...` + causal two-observation expanded-difference repair `f6d7da96...` + changelog `ab7730ca...` + research/current #488 `a9bf0320...` | +| GAP-050 | Zero-multiplier SE-aware acceptance could erase a nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; current #488 `184f4e2c...` | +| GAP-051 | Exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; current #488 `184f4e2c...` | +| GAP-052 | All-covered Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; current #488 `184f4e2c...` | +| GAP-053 | Strict-interior Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; current #488 `184f4e2c...` | +| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; current #488 `184f4e2c...` | +| GAP-055 | Strict-interior Wilson lower endpoint could accept a nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; current #488 `184f4e2c...` | +| GAP-056 | Durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; current #488 `184f4e2c...` | +| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from a generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; current #488 `184f4e2c...` | +| GAP-058 | Generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; current #488 `184f4e2c...` | +| GAP-059 | Generic Monte Carlo summary could materially misstate positive SE relative to `SD / sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; current #488 `184f4e2c...` | +| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; current #488 `184f4e2c...` | +| GAP-061 | Generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; current #488 `184f4e2c...` | +| GAP-062 | Finite-tolerance matching could fail while the pair is deterministically outside every finite tolerance | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; current #488 `184f4e2c...` | +| GAP-063 | Exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; current #488 `184f4e2c...` | +| GAP-064 | Positive point RMSE could carry SE above the declared squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; current #488 `184f4e2c...` | +| GAP-065 | Positive Monte Carlo RMSE could carry spread/SE impossible for nonnegative replications | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; current #488 `184f4e2c...` | +| GAP-066 | RMSE Monte Carlo nearest-rank percentile could exceed total nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; current #488 `184f4e2c...` | +| GAP-067 | Generic nearest-rank percentile endpoint could be individually incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected over-strong repair `2798e4f9...`; causal repair `c7151b49...`; edge `dbef285b...`; changelog `c38a320c...`; research `2bbcbb24...`; current #488 `184f4e2c...` | +| GAP-068 | Distinct generic percentile endpoints could each pass individual radius checks while jointly exceeding the sample squared-deviation budget | `verification-pending` | RED `c4a13826...` + causal repair `cb3f80a2...` + changelog `f727450d...`; current #488 `184f4e2c...` | +| GAP-069 | Two-replication distinct nearest-rank endpoints could exhaust the retained sample while the stored mean or SD remained impossible | `verification-pending` | RED `81bf0d9e...` + causal repair `d48f8fef...` + mean coverage `fb314d8a...` + branch cleanup `440b78d8...` + changelog `45116498...`; current #488 `184f4e2c...` | +| GAP-070 | Stored Wilson bounds could contain empirical coverage while the lower/upper pair could not arise from one Wilson score interval for that same coverage | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...` + complementary edge `c1cb16a7...`; current #488 `184f4e2c...` | +| GAP-071 | Durable Wilson evidence lacked denominator and critical-value/sidedness provenance, preventing exact recomputation from a persisted artifact | `active-repair` | valid carrier RED `6f6e06d2...`; shared count/Wilson authority `ca517ed3...`; `WilsonCoverageEvidenceV1` `31e1ab2b...`; sidedness `e9c63926...`/`fdd24a1a...`; envelope RED `07766cb0...` + `ValidationEvidenceV1` repair `a16f22e6...`; current #488 `184f4e2c...`; remaining: hosted GREEN/review/main plus durable-consumer adoption | +| GAP-072 | Exact all-covered Wilson evidence could retain a zero lower endpoint even though the canonical non-empty finite-`z²` producer always emits `n/(n+z²) > 0` | `verification-pending` | RED `ce714f07...` + non-force source-restore RCA `18499052...` + repair `72e9d954...` + changelog `e3a2f4a2...`; current #488 `184f4e2c...` | +| GAP-073 | Durable Wilson count provenance could round one uncovered observation away above binary64's exact-integer range and expose a pointer-width-dependent count schema | `verification-pending` | RED `29d710a5...` + complement/count repair `29968c80...` + fixed-width carrier repair `91d9a3bb...` + exact ratio RED/repair `63ddfdd6...`/`11323c57...`; current #488 `184f4e2c...` | +| GAP-074 | Durable Wilson evidence could correctly retain exact `u64` counts yet pre-round `sample_count` before endpoint projection, shifting strict-interior endpoints or erasing all-covered finite-sample uncertainty | `verification-pending` | RED `f89e2467...` + all-covered edge `1a5180b2...` + stale-oracle correction `6254c498...` + causal reciprocal-scale repair `73bbb5cf...` + changelog `f2b5768b...` + research predecessor `7fc78a59...`; current #488 `184f4e2c...` | +| GAP-075 | Inexact durable all-covered Wilson evidence could round the complementary miss mass to exact one at extreme finite `z` and erase a representable positive lower endpoint | `verification-pending` | RED `059ce70d...`; transient duplicate-owner implementation `46f91f3f...` excluded; canonical repair `0f478392...`; single-writer cleanup `8e2058f2...`; exact-oracle correction `93d5d208...`; changelog correction `43b6562c...`; research predecessor `b03a719d...`; current #488 `184f4e2c...` | +| GAP-076 | Exactly representable all-covered Wilson counts could absorb a small positive `z²` in `n + z²` and falsely emit exact `1.0` although a lower binary64 endpoint is representable | `verification-pending` | RED `e0c4ec81...` + causal boundary repair `c9dcb9df...` + below-resolution edge `6140080d...` + changelog `09ebb482...` + research predecessor `fe89c438...`; current #488 `184f4e2c...` | +| GAP-077 | Exactly representable all-covered Wilson counts could form an inexact partial denominator `n + z²` whose rounded sum shifts the represented-input lower endpoint by one ULP even though neither operand is fully absorbed | `verification-pending` | RED `06e55653...` + causal TwoSum/FMA repair `6c084dbe...` + research `25cc1943...` + changelog `5acc894b...` + predecessor changelog correction `f89e36d1...` + correct-direct-rounding control `80a0a0ad...`; current #488 `184f4e2c...` | +| GAP-078 | Exact-count all-covered Wilson residual compensation could move a direct quotient by one ULP even when the represented-input rational remains on the same side of the adjacent midpoint | `verification-pending` | RED `d076d344...` + midpoint-selection repair `32314239...` + changelog `a75940c9...` + research predecessor `ef6441f7...`; current #488 `184f4e2c...` | +| GAP-079 | SE-aware acceptance could underflow a finite positive `k · SE` tolerance to exact zero by dividing `SE` by a much larger estimate/target scale before multiplication | `verification-pending` | RED `76067efc...` + causal direct-finite comparison repair `4ffdf366...` + changelog `d822c0ba...` + current #488 `184f4e2c...` | +| GAP-080 | SE-aware acceptance both-overflow fallback could normalize an exact strict rejection into an equal rounded residual/bound and falsely accept it | `verification-pending` | RED `a9a45714...` + exact significand/exponent repair `425e8963...` + changelog `e6270629...` + current #488 `184f4e2c...` | +| GAP-081 | SE-aware acceptance finite/finite multiplication could round an exact strict represented-input rejection into an equal residual/bound and falsely accept it | `verification-pending` | RED `23c3262c...` + tie repair `6a2add48...` + edge coverage `3656deb2...` + changelog `090f5124...` + current #488 `184f4e2c...` | +| GAP-082 | SE-aware acceptance finite subtraction could round an exact strict represented-input rejection onto an exact finite bound and falsely accept equality | `verification-pending` | RED `58cbc032...` + causal low-term comparison repair `68a6fd98...` + sign-symmetric edge `b2c06512...` + changelog `c4f752f3...` + current #488 `184f4e2c...` | +| GAP-083 | SE-aware acceptance product correction can fall below binary64 resolution even when the rounded finite bound is subnormal or minimum normal, erasing a strict represented-input rejection | `verification-pending` | RED `b55c5473...` + initial narrow repair `210cebc4...` + minimum-normal RED `c77ac440...` + corrected zero-projection repair `772ad8ed...` + changelog correction `ceb68825...` + current #488 `184f4e2c...` | +| GAP-084 | Legacy Wilson pair admission could accept an exact-zero/exact-one boundary even though the peer endpoint implied a representable non-boundary root | `verification-pending` | RED `c9d612f2...` + causal peer-root repair `88512417...` + branch-complete stable evaluation `6a4f89da...` + symmetry/serde/extreme-boundary contracts `0ce7639b...` + changelog `407b3645...` + current #488 `184f4e2c...` | +| GAP-085 | Equal nonzero SE-aware subtraction/FMA correction projections could conceal the exact represented-input ordering and turn a strict decision into rounded equality | `verification-pending` | RED `35ea85ba...` + exact product-roundoff repair `7d597a18...` + signed edge `b463a991...` + branch-scope refinement `ca8c2b86...` + changelog `702eec2f...` + current #488 `184f4e2c...` | +| GAP-086 | Mean signed bias could reject a representable result because individual `recovered - truth` residuals overflow before opposing represented terms cancel | `verification-pending` | RED `04e6e745...` + explicit-denominator cancellation `28b1d186...` + causal bias repair `d1cd5461...` + changelog `d68dde34...` + current #488 `184f4e2c...` | +| GAP-087 | Mean signed bias mixed-sign cancellation could discard repeated individually sub-ULP opposing residuals even though their combined represented mass changes the final bias | `verification-pending` | RED `63913727...` + error-free low-term repair `5697cca5...` + changelog `53f5c912...` + current #488 `184f4e2c...` | +| GAP-088 | Mean signed bias mixed-remainder compensation could be rounded into an intermediate numerator before the scientific count division, shifting the represented-input mean by one ULP | `verification-pending` | RED `8b4d19d1...` + causal compensated-division/FMA repair `7a33212b...` + changelog `bad698dd...` + current #488 `184f4e2c...` | +| GAP-089 | Mean signed bias exact opposite-sign cancellation could leave a same-sign compensated remainder whose `sum + correction` was rounded before the scientific count division, shifting the represented-input mean by one ULP | `verification-pending` | RED `84476aad...` + causal same-sign compensated-division repair `5f0d40b8...` + changelog `5763cde0...` + current #488 `184f4e2c...` | +| GAP-090 | Same-sign all-subnormal mean normalization could double-round the final represented bias by one ULP at scale restoration | `verification-pending` | RED `91abdb49...`; discarded direct-float repair `e89dc346...`; corrected exact-unit repair `1c0df8a7...`; halfway contract `f79a1b9a...`; regression fixture `eb29a79a...`; changelog `65ff502b...`; research lineage retained by current #488 `184f4e2c...` | +| GAP-091 | Mean signed bias pairwise subtraction roundoff could move the represented-input mean across a final binary64 midpoint | `verification-pending` | RED `a9d9bda3...` + insufficient first repair `96bff8e5...` + corrected tail/midpoint repair `676ccda0...` + changelog `cbcfa8d6...` + research `1f9e2631...` + two-direction edge `0bff5a8d...` + current #488 `184f4e2c...` | +| GAP-092 | Bias standard error could report false exact zero when two distinct represented-input residuals both round to the same pairwise binary64 subtraction | `verification-pending` | RED `c9c55ea5...` + causal two-observation expanded-difference repair `f6d7da96...` + changelog `ab7730ca...` + current #488 `184f4e2c...` | +| GAP-093 | Bias standard error could report false exact zero for n>2 when distinct represented-input residuals collapse to one rounded binary64 subtraction | `verification-pending` | RED `06a70e1c...` + common-high/error-free-low-term repair `04c62514...` + changelog `56d09154...` + oracle correction `62243204...` + current #488 `184f4e2c...` | +| GAP-094 | Bias standard error could shift a representable result by one ULP because `sqrt(sample_variance)` and `sqrt(n)` were rounded separately before division | `verification-pending` | corrected-oracle RED `62243204...` + direct normalized-SE repair `8b8f0a21...` + research correction `18ed3144...` + changelog/current #488 `184f4e2c...` | ## Release gate From 72fa8960187e51a0837ba8e867a2af47b454d403 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 5 Sep 2026 06:18:43 +0900 Subject: [PATCH 187/235] docs(gaps): finalize GAP-093 and GAP-094 traceability --- docs/product-technical-gap-baseline.md | 114 ++++++++++++------------- 1 file changed, 57 insertions(+), 57 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index eda2bcd3e..c7f6daffa 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-04T21:11:19Z +**Snapshot:** 2026-09-04T21:16:59Z **Protected-main evidence:** `a243f18da4a4ca8a8d068c39922537f1f8ed6ad0` **Workspace version:** `0.2.0` @@ -30,13 +30,13 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `184f4e2c109c7904027f782e91b8d9a01a1d46f1` | true | `main` | Validation Evidence landing vehicle, based on protected #490. GAP-093 preserves nonzero n>2 bias sampling uncertainty when distinct represented-input residuals collapse to one rounded subtraction, and GAP-094 removes a subsequent one-ULP square-root decomposition error in the represented standard error. GAP-091–092, GAP-086–090, and prior Wilson, provenance, Monte Carlo, RMSE/SE, matching, serde/projection repairs remain inherited. Hosted exact-head gates and independent review remain required. | +| #488 | `99a220db45f98d557a9ba9e1688016f1349fcc43` | true | `main` | Validation Evidence landing vehicle, based on protected #490. GAP-093 preserves nonzero n>2 bias sampling uncertainty when distinct represented-input residuals collapse to one rounded subtraction. GAP-094 corrects the represented oracle to `0x3c72_79a7_4590_331c`, removes the subsequent one-ULP square-root decomposition error, and adds a direct exact-residual public contract. GAP-091–092, GAP-086–090, and prior Wilson, provenance, Monte Carlo, RMSE/SE, matching, serde/projection repairs remain inherited. Hosted exact-head gates and independent review remain required. | | #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 | Validation / Analysis Run fold child. Unique evidence must be inherited by a conflict-resolving survivor; child-head CI does not transfer. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | | #483 | `847d96f913bb261803ac0bd751ad7e4f51324cee` | true | #416 | Analysis Run fold child; preserve unique evidence. | | #482 | `506dbae236a4484301b704b6c6a05b20faf0fe69` | true | #416 | Analysis Run fold child; preserve unique evidence. | -| #480 | `5b2637f7b6142573ba1385a652c56632ecc9faa5` | true | `main` | Forward repair removed the repository-local hourly schedule reintroduced by predecessor `03876fb...`. The branch still needs conflict-resolving non-force inheritance of #489/#490 while immutable contextual-orchestrator release/deployment/auth provenance remains unavailable. | +| #480 | `5b2637f7b6142573ba1385a652c56632ecc9faa5` | true | `main` | Forward repair removed the repository-local hourly schedule reintroduced by predecessor `03876fb...`. The branch also corrects stale direct-provider guidance in `AGENTS.md`; it still needs conflict-resolving non-force inheritance of #489/#490 while immutable contextual-orchestrator release/deployment/auth provenance remains unavailable. | | #460 | `dfab4eab5ff733731e565a9348072b8dab2e4912` | true | #416 | Analysis Run fold child; typed cutoff equality and terminal-validation separation. | | #458 | `08165e3b3c929b4ae77396689549f72723ff8ff5` | true | #416 | Analysis Run fold child; typed cutoff equality and terminal-validation separation. | | #416 | `aa730c63563eb4a33048d822b581036c8487bd47` | true | `main` | Validation / Analysis Run landing vehicle. Generic cutoff-before-identity repair `0b7155...` remains inherited; live branch head is six fast-forward commits beyond it. Branch is still based before #489/#490 and needs non-destructive consolidation/restack when fold scope is ready. | @@ -50,7 +50,7 @@ TEPP owns temporal/event composition, irregular time, time-varying multilevel/cr `psychometric_core` is not authority for new temporal/state composition. fast-mlsirm owns reusable static/generalized-mixed/dependence-aware psychometric specification and arithmetic. TEPP consumes only immutable released/versioned Published Language through an ACL; source copying and mutable sibling-head dependencies are prohibited. Fresh owner evidence is fast-mlsirm protected `main@b5a3a0c1057d4b53d7a4bb18e0de69f630c2b45c`; latest immutable release remains `v0.9.1`. -contextual-orchestrator owns provider/model routing and semantic LLM execution. Fresh owner evidence is protected `main@2e414d15ba58f28597751b625a8a2f00fc9fadcf`, while GitHub releases remain zero. Semantic LLM work and model-backed Actions therefore continue to require a released/versioned contextual-orchestrator contract; Actions use `orchestrator/free` through the gateway credential and do not select providers/models/groups or consume direct provider keys. Mutable owner main is evidence, not a TEPP production contract. Context Graph contracts are contract-only integration authority; EA Core owns enterprise-architecture decisions. No cross-service SQL. +contextual-orchestrator owns provider/model routing and semantic LLM execution. Fresh owner evidence is protected `main@2e414d15ba58f28597751b625a8a2f00fc9fadcf`, while GitHub releases remain zero. Semantic LLM work and model-backed Actions therefore continue to require a released/versioned contextual-orchestrator contract; Actions use `orchestrator/free` through the gateway credential and do not select providers/models/groups or consume direct provider keys. Mutable owner main is evidence, not a TEPP production contract. Protected-main `AGENTS.md` is stale on this point; #480 carries the owner-correct released-orchestrator wording and must be inherited by normal non-force integration rather than copied into unrelated scientific branches. Context Graph contracts are contract-only integration authority; EA Core owns enterprise-architecture decisions. No cross-service SQL. The clock contract separates event/valid time, assertion time, document time, system time, availability time, and knowledge cutoff. Retrospective evidence may describe an earlier event but cannot enter an earlier knowledge cutoff. Forward state/transition edges remain distinct from retrospective/citation/revision/provenance relations. @@ -83,9 +83,9 @@ The clock contract separates event/valid time, assertion time, document time, sy ### #488 — Validation Evidence -#488 is the generic Validation Evidence landing vehicle at exact head `184f4e2c109c7904027f782e91b8d9a01a1d46f1`, based on protected #490. GAP-093 RED `06a70e1c01629f15f05efef48576a9cadb1f1b98` proves that `truth=[2^-54,2^-55,0]`, `recovered=[1,1,1]` contains three distinct represented-input residuals although every binary64 pairwise subtraction rounds to `1.0`; the predecessor therefore emitted false exact-zero uncertainty. First causal repair `04c62514a23722d63a62bd5d5af6e3a930cc3147` exposes the error-free subtraction low terms and, only when every rounded high part is equal, evaluates dispersion from those low terms in O(n). CHANGELOG `56d091544a5780567a6ef772568d62b0fc651747`. +#488 is the generic Validation Evidence landing vehicle at exact head `99a220db45f98d557a9ba9e1688016f1349fcc43`, based on protected #490. GAP-093 RED `06a70e1c01629f15f05efef48576a9cadb1f1b98` proves that `truth=[2^-54,2^-55,0]`, `recovered=[1,1,1]` contains three distinct represented-input residuals although every binary64 pairwise subtraction rounds to `1.0`; the predecessor therefore emitted false exact-zero uncertainty. First causal repair `04c62514a23722d63a62bd5d5af6e3a930cc3147` exposes the error-free subtraction low terms and, only when every rounded high part is equal, evaluates dispersion from those low terms in O(n). CHANGELOG `56d091544a5780567a6ef772568d62b0fc651747`. -Oracle correction/RED `6224320410ccabb1cf16d36cc12f88e2b7a05bb1` then established GAP-094: the exact represented-input SE `2^-55/sqrt(3)` rounds to `0x3c72_79a7_4590_331c`, not the `...331d` value produced by separately rounded `sqrt(sample_variance)/sqrt(n)`. Causal repair `8b8f0a21ccc825f355859cadbf20d83f04d2369f` forms the bounded normalized expression `sqrt(sum(d²)/(n(n-1)))`; research correction `18ed314414d45fdf42078bc8261a59e8480747f1`; CHANGELOG/current #488 `184f4e2c109c7904027f782e91b8d9a01a1d46f1`. +Oracle correction/RED `6224320410ccabb1cf16d36cc12f88e2b7a05bb1` then established GAP-094: exact high-precision evaluation of represented-input `SE=2^-55/sqrt(3)` rounds to `0x3c72_79a7_4590_331c`, not the `...331d` value produced by separately rounded `sqrt(sample_variance)/sqrt(n)`. Causal repair `8b8f0a21ccc825f355859cadbf20d83f04d2369f` forms the bounded normalized expression `sqrt(sum(d²)/(n(n-1)))`. Dedicated public contract `89fd9ef0add3930346900f75518708978ec9861e` reproduces the same one-ULP defect with exact residuals and no subtraction collapse; research/TRACEABILITY/current #488 `99a220db45f98d557a9ba9e1688016f1349fcc43`; CHANGELOG `184f4e2c109c7904027f782e91b8d9a01a1d46f1`. GAP-092 remains inherited for the exact two-observation identity, and GAP-091 remains inherited for mean-bias subtraction roundoff. GAP-086–GAP-090 and earlier Wilson, provenance, Monte Carlo, RMSE/SE, matching, serde/projection repairs remain inherited. GAP-071/GAP-073–GAP-094 remain delivery-pending until current-head hosted gates, independent review, protected-main integration, and required durable-consumer adoption are verified. Bare legacy `ValidationReport` remains a backward-compatible compact projection and is not silently treated as v1 provenance. @@ -95,7 +95,7 @@ GAP-092 remains inherited for the exact two-observation identity, and GAP-091 re ### #480 — contextual-orchestrator boundary -#480 removes TEPP-owned provider discovery/ranking and requires a released contextual-orchestrator owner contract. Forward repair `5b2637f7b6142573ba1385a652c56632ecc9faa5` removed the local hourly `schedule` reintroduced by predecessor `03876fb3e4c727bb754125ce531d928450d78303`. The branch still diverges from protected main because #489/#490 workflow consolidation and admission marker must be conflict-resolved without regressing #480's valid released-owner routing delta. contextual-orchestrator protected main remains `2e414d15ba58f28597751b625a8a2f00fc9fadcf`, and GitHub releases remain zero. #480 therefore stays Draft until non-force restack plus immutable compatible release/deployment/auth/schema/artifact provenance prerequisites are resolved. Mutable owner main is evidence, not a production contract. +#480 removes TEPP-owned provider discovery/ranking and requires a released contextual-orchestrator owner contract. Forward repair `5b2637f7b6142573ba1385a652c56632ecc9faa5` removed the local hourly `schedule` reintroduced by predecessor `03876fb3e4c727bb754125ce531d928450d78303` and carries owner-correct `AGENTS.md` guidance requiring released/versioned contextual-orchestrator, `orchestrator/free`, and no direct provider keys. The branch still diverges from protected main because #489/#490 workflow consolidation and admission marker must be conflict-resolved without regressing #480's valid released-owner routing delta. contextual-orchestrator protected main remains `2e414d15ba58f28597751b625a8a2f00fc9fadcf`, and GitHub releases remain zero. #480 therefore stays Draft until non-force restack plus immutable compatible release/deployment/auth/schema/artifact provenance prerequisites are resolved. Mutable owner main is evidence, not a production contract. ## Gap register @@ -124,7 +124,7 @@ GAP-092 remains inherited for the exact two-observation identity, and GAP-091 re | GAP-021 | Longitudinal irregular-rate facade duplicated public wrapper identities over one canonical implementation | `verification-pending` | RED `464863860...` + repair `7f0bea084...`; exact-head integration | | GAP-022 | Architecture assigned Longitudinal Modeling semantics to `psychometric_core` and duplicated implementation responsibility rows | `verification-pending` | RED `fe5eb745...` + repair `7fadc757...`; exact-head integration | | GAP-023 | `discreteDIFFUSIONstd` rejected a representable subnormal final ratio because `aΔt` underflowed before factor two | `verification-pending` | RED `d5107b198...` + repair `7164c7ce4...`; exact-head integration | -| GAP-024 | Contributor guidance re-authorized a direct provider credential after LLM ownership moved to contextual-orchestrator | `verification-pending` | RED `4248b335...` + repair `01f45a993...`; released CO adoption + exact-head integration | +| GAP-024 | Contributor guidance re-authorized a direct provider credential after LLM ownership moved to contextual-orchestrator | `verification-pending` | RED `4248b335...` + repair `01f45a993...`; #480 additionally repairs stale protected-main `AGENTS.md`; released CO adoption + exact-head integration | | GAP-025 | A singleton unit could satisfy the nominal CWC unit floor while all lag evidence came from one repeated unit | `verification-pending` | RED `671709bbc...` + repair `4784b370c...`; exact-head integration | | GAP-026 | Scalar standardized longitudinal maps rejected representable finals when a cancelled stationary-variance intermediate lay outside binary64 range | `verification-pending` | RED `4a1f6c49...` / `96d8ed13...` + repairs `a4bc6230...` / `33f4b187...` / `26b03c32...` | | GAP-027 | Finite-interval `discreteDIFFUSIONstd` could report exact unit diffusion after exponent saturation erased a nonzero remainder | `verification-pending` | RED `a8de3c9f...` + repair `c17e2ff8...` | @@ -145,56 +145,56 @@ GAP-092 remains inherited for the exact two-observation identity, and GAP-091 re | GAP-042 | Ratio-first logarithm could nearly double an adjacent-float irregular residual growth rate | `verification-pending` | RED `766ddc7a...` + `ln_1p` repair `16f21d9a...` | | GAP-043 | Duplicate known-truth component identities could silently reweight RMSE recovery evidence | `verification-pending` | RED `698f12f5...` + uniqueness repair `2fae4cb2...` | | GAP-044 | Known-truth RMSE alignment/accumulation depended on row order instead of component identity | `verification-pending` | RED `8ad72ac9...` / `5fb93c40...` + repairs `2dd9537e...` / `025dce7f...`; #310 `c6680450...` | -| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; current #488 `184f4e2c...` | -| GAP-046 | Bias SE could reject a representable SEM because raw squared deviations/intermediates overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; current #488 `184f4e2c...` | -| GAP-047 | Generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; current #488 `184f4e2c...` | -| GAP-048 | Mean signed bias could erase a representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; current #488 `184f4e2c...` | +| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; current #488 `99a220db...` | +| GAP-046 | Bias SE could reject a representable SEM because raw squared deviations/intermediates overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; current #488 `99a220db...` | +| GAP-047 | Generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; current #488 `99a220db...` | +| GAP-048 | Mean signed bias could erase a representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; current #488 `99a220db...` | | GAP-049 | Stable `Between` recovery could be aliased across occasion indices and reweight RMSE | `verification-pending` | RED `0a03041c...` + repair `ec2c1219...`; #310 `c6680450...` | -| GAP-050 | Zero-multiplier SE-aware acceptance could erase a nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; current #488 `184f4e2c...` | -| GAP-051 | Exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; current #488 `184f4e2c...` | -| GAP-052 | All-covered Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; current #488 `184f4e2c...` | -| GAP-053 | Strict-interior Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; current #488 `184f4e2c...` | -| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; current #488 `184f4e2c...` | -| GAP-055 | Strict-interior Wilson lower endpoint could accept a nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; current #488 `184f4e2c...` | -| GAP-056 | Durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; current #488 `184f4e2c...` | -| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from a generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; current #488 `184f4e2c...` | -| GAP-058 | Generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; current #488 `184f4e2c...` | -| GAP-059 | Generic Monte Carlo summary could materially misstate positive SE relative to `SD / sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; current #488 `184f4e2c...` | -| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; current #488 `184f4e2c...` | -| GAP-061 | Generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; current #488 `184f4e2c...` | -| GAP-062 | Finite-tolerance matching could fail while the pair is deterministically outside every finite tolerance | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; current #488 `184f4e2c...` | -| GAP-063 | Exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; current #488 `184f4e2c...` | -| GAP-064 | Positive point RMSE could carry SE above the declared squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; current #488 `184f4e2c...` | -| GAP-065 | Positive Monte Carlo RMSE could carry spread/SE impossible for nonnegative replications | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; current #488 `184f4e2c...` | -| GAP-066 | RMSE Monte Carlo nearest-rank percentile could exceed total nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; current #488 `184f4e2c...` | -| GAP-067 | Generic nearest-rank percentile endpoint could be individually incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected over-strong repair `2798e4f9...`; causal repair `c7151b49...`; edge `dbef285b...`; changelog `c38a320c...`; research `2bbcbb24...`; current #488 `184f4e2c...` | -| GAP-068 | Distinct generic percentile endpoints could each pass individual radius checks while jointly exceeding the sample squared-deviation budget | `verification-pending` | RED `c4a13826...` + causal repair `cb3f80a2...` + changelog `f727450d...`; current #488 `184f4e2c...` | -| GAP-069 | Two-replication distinct nearest-rank endpoints could exhaust the retained sample while the stored mean or SD remained impossible | `verification-pending` | RED `81bf0d9e...` + causal repair `d48f8fef...` + mean coverage `fb314d8a...` + branch cleanup `440b78d8...` + changelog `45116498...`; current #488 `184f4e2c...` | -| GAP-070 | Stored Wilson bounds could contain empirical coverage while the lower/upper pair could not arise from one Wilson score interval for that same coverage | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...` + complementary edge `c1cb16a7...`; current #488 `184f4e2c...` | -| GAP-071 | Durable Wilson evidence lacked denominator and critical-value/sidedness provenance, preventing exact recomputation from a persisted artifact | `active-repair` | valid carrier RED `6f6e06d2...`; shared count/Wilson authority `ca517ed3...`; `WilsonCoverageEvidenceV1` `31e1ab2b...`; sidedness `e9c63926...`/`fdd24a1a...`; envelope RED `07766cb0...` + `ValidationEvidenceV1` repair `a16f22e6...`; current #488 `184f4e2c...`; remaining: hosted GREEN/review/main plus durable-consumer adoption | -| GAP-072 | Exact all-covered Wilson evidence could retain a zero lower endpoint even though the canonical non-empty finite-`z²` producer always emits `n/(n+z²) > 0` | `verification-pending` | RED `ce714f07...` + non-force source-restore RCA `18499052...` + repair `72e9d954...` + changelog `e3a2f4a2...`; current #488 `184f4e2c...` | -| GAP-073 | Durable Wilson count provenance could round one uncovered observation away above binary64's exact-integer range and expose a pointer-width-dependent count schema | `verification-pending` | RED `29d710a5...` + complement/count repair `29968c80...` + fixed-width carrier repair `91d9a3bb...` + exact ratio RED/repair `63ddfdd6...`/`11323c57...`; current #488 `184f4e2c...` | -| GAP-074 | Durable Wilson evidence could correctly retain exact `u64` counts yet pre-round `sample_count` before endpoint projection, shifting strict-interior endpoints or erasing all-covered finite-sample uncertainty | `verification-pending` | RED `f89e2467...` + all-covered edge `1a5180b2...` + stale-oracle correction `6254c498...` + causal reciprocal-scale repair `73bbb5cf...` + changelog `f2b5768b...` + research predecessor `7fc78a59...`; current #488 `184f4e2c...` | -| GAP-075 | Inexact durable all-covered Wilson evidence could round the complementary miss mass to exact one at extreme finite `z` and erase a representable positive lower endpoint | `verification-pending` | RED `059ce70d...`; transient duplicate-owner implementation `46f91f3f...` excluded; canonical repair `0f478392...`; single-writer cleanup `8e2058f2...`; exact-oracle correction `93d5d208...`; changelog correction `43b6562c...`; research predecessor `b03a719d...`; current #488 `184f4e2c...` | -| GAP-076 | Exactly representable all-covered Wilson counts could absorb a small positive `z²` in `n + z²` and falsely emit exact `1.0` although a lower binary64 endpoint is representable | `verification-pending` | RED `e0c4ec81...` + causal boundary repair `c9dcb9df...` + below-resolution edge `6140080d...` + changelog `09ebb482...` + research predecessor `fe89c438...`; current #488 `184f4e2c...` | -| GAP-077 | Exactly representable all-covered Wilson counts could form an inexact partial denominator `n + z²` whose rounded sum shifts the represented-input lower endpoint by one ULP even though neither operand is fully absorbed | `verification-pending` | RED `06e55653...` + causal TwoSum/FMA repair `6c084dbe...` + research `25cc1943...` + changelog `5acc894b...` + predecessor changelog correction `f89e36d1...` + correct-direct-rounding control `80a0a0ad...`; current #488 `184f4e2c...` | -| GAP-078 | Exact-count all-covered Wilson residual compensation could move a direct quotient by one ULP even when the represented-input rational remains on the same side of the adjacent midpoint | `verification-pending` | RED `d076d344...` + midpoint-selection repair `32314239...` + changelog `a75940c9...` + research predecessor `ef6441f7...`; current #488 `184f4e2c...` | -| GAP-079 | SE-aware acceptance could underflow a finite positive `k · SE` tolerance to exact zero by dividing `SE` by a much larger estimate/target scale before multiplication | `verification-pending` | RED `76067efc...` + causal direct-finite comparison repair `4ffdf366...` + changelog `d822c0ba...` + current #488 `184f4e2c...` | -| GAP-080 | SE-aware acceptance both-overflow fallback could normalize an exact strict rejection into an equal rounded residual/bound and falsely accept it | `verification-pending` | RED `a9a45714...` + exact significand/exponent repair `425e8963...` + changelog `e6270629...` + current #488 `184f4e2c...` | -| GAP-081 | SE-aware acceptance finite/finite multiplication could round an exact strict represented-input rejection into an equal residual/bound and falsely accept it | `verification-pending` | RED `23c3262c...` + tie repair `6a2add48...` + edge coverage `3656deb2...` + changelog `090f5124...` + current #488 `184f4e2c...` | -| GAP-082 | SE-aware acceptance finite subtraction could round an exact strict represented-input rejection onto an exact finite bound and falsely accept equality | `verification-pending` | RED `58cbc032...` + causal low-term comparison repair `68a6fd98...` + sign-symmetric edge `b2c06512...` + changelog `c4f752f3...` + current #488 `184f4e2c...` | -| GAP-083 | SE-aware acceptance product correction can fall below binary64 resolution even when the rounded finite bound is subnormal or minimum normal, erasing a strict represented-input rejection | `verification-pending` | RED `b55c5473...` + initial narrow repair `210cebc4...` + minimum-normal RED `c77ac440...` + corrected zero-projection repair `772ad8ed...` + changelog correction `ceb68825...` + current #488 `184f4e2c...` | -| GAP-084 | Legacy Wilson pair admission could accept an exact-zero/exact-one boundary even though the peer endpoint implied a representable non-boundary root | `verification-pending` | RED `c9d612f2...` + causal peer-root repair `88512417...` + branch-complete stable evaluation `6a4f89da...` + symmetry/serde/extreme-boundary contracts `0ce7639b...` + changelog `407b3645...` + current #488 `184f4e2c...` | -| GAP-085 | Equal nonzero SE-aware subtraction/FMA correction projections could conceal the exact represented-input ordering and turn a strict decision into rounded equality | `verification-pending` | RED `35ea85ba...` + exact product-roundoff repair `7d597a18...` + signed edge `b463a991...` + branch-scope refinement `ca8c2b86...` + changelog `702eec2f...` + current #488 `184f4e2c...` | -| GAP-086 | Mean signed bias could reject a representable result because individual `recovered - truth` residuals overflow before opposing represented terms cancel | `verification-pending` | RED `04e6e745...` + explicit-denominator cancellation `28b1d186...` + causal bias repair `d1cd5461...` + changelog `d68dde34...` + current #488 `184f4e2c...` | -| GAP-087 | Mean signed bias mixed-sign cancellation could discard repeated individually sub-ULP opposing residuals even though their combined represented mass changes the final bias | `verification-pending` | RED `63913727...` + error-free low-term repair `5697cca5...` + changelog `53f5c912...` + current #488 `184f4e2c...` | -| GAP-088 | Mean signed bias mixed-remainder compensation could be rounded into an intermediate numerator before the scientific count division, shifting the represented-input mean by one ULP | `verification-pending` | RED `8b4d19d1...` + causal compensated-division/FMA repair `7a33212b...` + changelog `bad698dd...` + current #488 `184f4e2c...` | -| GAP-089 | Mean signed bias exact opposite-sign cancellation could leave a same-sign compensated remainder whose `sum + correction` was rounded before the scientific count division, shifting the represented-input mean by one ULP | `verification-pending` | RED `84476aad...` + causal same-sign compensated-division repair `5f0d40b8...` + changelog `5763cde0...` + current #488 `184f4e2c...` | -| GAP-090 | Same-sign all-subnormal mean normalization could double-round the final represented bias by one ULP at scale restoration | `verification-pending` | RED `91abdb49...`; discarded direct-float repair `e89dc346...`; corrected exact-unit repair `1c0df8a7...`; halfway contract `f79a1b9a...`; regression fixture `eb29a79a...`; changelog `65ff502b...`; research lineage retained by current #488 `184f4e2c...` | -| GAP-091 | Mean signed bias pairwise subtraction roundoff could move the represented-input mean across a final binary64 midpoint | `verification-pending` | RED `a9d9bda3...` + insufficient first repair `96bff8e5...` + corrected tail/midpoint repair `676ccda0...` + changelog `cbcfa8d6...` + research `1f9e2631...` + two-direction edge `0bff5a8d...` + current #488 `184f4e2c...` | -| GAP-092 | Bias standard error could report false exact zero when two distinct represented-input residuals both round to the same pairwise binary64 subtraction | `verification-pending` | RED `c9c55ea5...` + causal two-observation expanded-difference repair `f6d7da96...` + changelog `ab7730ca...` + current #488 `184f4e2c...` | -| GAP-093 | Bias standard error could report false exact zero for n>2 when distinct represented-input residuals collapse to one rounded binary64 subtraction | `verification-pending` | RED `06a70e1c...` + common-high/error-free-low-term repair `04c62514...` + changelog `56d09154...` + oracle correction `62243204...` + current #488 `184f4e2c...` | -| GAP-094 | Bias standard error could shift a representable result by one ULP because `sqrt(sample_variance)` and `sqrt(n)` were rounded separately before division | `verification-pending` | corrected-oracle RED `62243204...` + direct normalized-SE repair `8b8f0a21...` + research correction `18ed3144...` + changelog/current #488 `184f4e2c...` | +| GAP-050 | Zero-multiplier SE-aware acceptance could erase a nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; current #488 `99a220db...` | +| GAP-051 | Exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; current #488 `99a220db...` | +| GAP-052 | All-covered Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; current #488 `99a220db...` | +| GAP-053 | Strict-interior Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; current #488 `99a220db...` | +| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; current #488 `99a220db...` | +| GAP-055 | Strict-interior Wilson lower endpoint could accept a nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; current #488 `99a220db...` | +| GAP-056 | Durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; current #488 `99a220db...` | +| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from a generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; current #488 `99a220db...` | +| GAP-058 | Generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; current #488 `99a220db...` | +| GAP-059 | Generic Monte Carlo summary could materially misstate positive SE relative to `SD / sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; current #488 `99a220db...` | +| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; current #488 `99a220db...` | +| GAP-061 | Generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; current #488 `99a220db...` | +| GAP-062 | Finite-tolerance matching could fail while the pair is deterministically outside every finite tolerance | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; current #488 `99a220db...` | +| GAP-063 | Exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; current #488 `99a220db...` | +| GAP-064 | Positive point RMSE could carry SE above the declared squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; current #488 `99a220db...` | +| GAP-065 | Positive Monte Carlo RMSE could carry spread/SE impossible for nonnegative replications | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; current #488 `99a220db...` | +| GAP-066 | RMSE Monte Carlo nearest-rank percentile could exceed total nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; current #488 `99a220db...` | +| GAP-067 | Generic nearest-rank percentile endpoint could be individually incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected over-strong repair `2798e4f9...`; causal repair `c7151b49...`; edge `dbef285b...`; changelog `c38a320c...`; research `2bbcbb24...`; current #488 `99a220db...` | +| GAP-068 | Distinct generic percentile endpoints could each pass individual radius checks while jointly exceeding the sample squared-deviation budget | `verification-pending` | RED `c4a13826...` + causal repair `cb3f80a2...` + changelog `f727450d...`; current #488 `99a220db...` | +| GAP-069 | Two-replication distinct nearest-rank endpoints could exhaust the retained sample while the stored mean or SD remained impossible | `verification-pending` | RED `81bf0d9e...` + causal repair `d48f8fef...` + mean coverage `fb314d8a...` + branch cleanup `440b78d8...` + changelog `45116498...`; current #488 `99a220db...` | +| GAP-070 | Stored Wilson bounds could contain empirical coverage while the lower/upper pair could not arise from one Wilson score interval for that same coverage | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...` + complementary edge `c1cb16a7...`; current #488 `99a220db...` | +| GAP-071 | Durable Wilson evidence lacked denominator and critical-value/sidedness provenance, preventing exact recomputation from a persisted artifact | `active-repair` | valid carrier RED `6f6e06d2...`; shared count/Wilson authority `ca517ed3...`; `WilsonCoverageEvidenceV1` `31e1ab2b...`; sidedness `e9c63926...`/`fdd24a1a...`; envelope RED `07766cb0...` + `ValidationEvidenceV1` repair `a16f22e6...`; current #488 `99a220db...`; remaining: hosted GREEN/review/main plus durable-consumer adoption | +| GAP-072 | Exact all-covered Wilson evidence could retain a zero lower endpoint even though the canonical non-empty finite-`z²` producer always emits `n/(n+z²) > 0` | `verification-pending` | RED `ce714f07...` + non-force source-restore RCA `18499052...` + repair `72e9d954...` + changelog `e3a2f4a2...`; current #488 `99a220db...` | +| GAP-073 | Durable Wilson count provenance could round one uncovered observation away above binary64's exact-integer range and expose a pointer-width-dependent count schema | `verification-pending` | RED `29d710a5...` + complement/count repair `29968c80...` + fixed-width carrier repair `91d9a3bb...` + exact ratio RED/repair `63ddfdd6...`/`11323c57...`; current #488 `99a220db...` | +| GAP-074 | Durable Wilson evidence could correctly retain exact `u64` counts yet pre-round `sample_count` before endpoint projection, shifting strict-interior endpoints or erasing all-covered finite-sample uncertainty | `verification-pending` | RED `f89e2467...` + all-covered edge `1a5180b2...` + stale-oracle correction `6254c498...` + causal reciprocal-scale repair `73bbb5cf...` + changelog `f2b5768b...` + research predecessor `7fc78a59...`; current #488 `99a220db...` | +| GAP-075 | Inexact durable all-covered Wilson evidence could round the complementary miss mass to exact one at extreme finite `z` and erase a representable positive lower endpoint | `verification-pending` | RED `059ce70d...`; transient duplicate-owner implementation `46f91f3f...` excluded; canonical repair `0f478392...`; single-writer cleanup `8e2058f2...`; exact-oracle correction `93d5d208...`; changelog correction `43b6562c...`; research predecessor `b03a719d...`; current #488 `99a220db...` | +| GAP-076 | Exactly representable all-covered Wilson counts could absorb a small positive `z²` in `n + z²` and falsely emit exact `1.0` although a lower binary64 endpoint is representable | `verification-pending` | RED `e0c4ec81...` + causal boundary repair `c9dcb9df...` + below-resolution edge `6140080d...` + changelog `09ebb482...` + research predecessor `fe89c438...`; current #488 `99a220db...` | +| GAP-077 | Exactly representable all-covered Wilson counts could form an inexact partial denominator `n + z²` whose rounded sum shifts the represented-input lower endpoint by one ULP even though neither operand is fully absorbed | `verification-pending` | RED `06e55653...` + causal TwoSum/FMA repair `6c084dbe...` + research `25cc1943...` + changelog `5acc894b...` + predecessor changelog correction `f89e36d1...` + correct-direct-rounding control `80a0a0ad...`; current #488 `99a220db...` | +| GAP-078 | Exact-count all-covered Wilson residual compensation could move a direct quotient by one ULP even when the represented-input rational remains on the same side of the adjacent midpoint | `verification-pending` | RED `d076d344...` + midpoint-selection repair `32314239...` + changelog `a75940c9...` + research predecessor `ef6441f7...`; current #488 `99a220db...` | +| GAP-079 | SE-aware acceptance could underflow a finite positive `k · SE` tolerance to exact zero by dividing `SE` by a much larger estimate/target scale before multiplication | `verification-pending` | RED `76067efc...` + causal direct-finite comparison repair `4ffdf366...` + changelog `d822c0ba...` + current #488 `99a220db...` | +| GAP-080 | SE-aware acceptance both-overflow fallback could normalize an exact strict rejection into an equal rounded residual/bound and falsely accept it | `verification-pending` | RED `a9a45714...` + exact significand/exponent repair `425e8963...` + changelog `e6270629...` + current #488 `99a220db...` | +| GAP-081 | SE-aware acceptance finite/finite multiplication could round an exact strict represented-input rejection into an equal residual/bound and falsely accept it | `verification-pending` | RED `23c3262c...` + tie repair `6a2add48...` + edge coverage `3656deb2...` + changelog `090f5124...` + current #488 `99a220db...` | +| GAP-082 | SE-aware acceptance finite subtraction could round an exact strict represented-input rejection onto an exact finite bound and falsely accept equality | `verification-pending` | RED `58cbc032...` + causal low-term comparison repair `68a6fd98...` + sign-symmetric edge `b2c06512...` + changelog `c4f752f3...` + current #488 `99a220db...` | +| GAP-083 | SE-aware acceptance product correction can fall below binary64 resolution even when the rounded finite bound is subnormal or minimum normal, erasing a strict represented-input rejection | `verification-pending` | RED `b55c5473...` + initial narrow repair `210cebc4...` + minimum-normal RED `c77ac440...` + corrected zero-projection repair `772ad8ed...` + changelog correction `ceb68825...` + current #488 `99a220db...` | +| GAP-084 | Legacy Wilson pair admission could accept an exact-zero/exact-one boundary even though the peer endpoint implied a representable non-boundary root | `verification-pending` | RED `c9d612f2...` + causal peer-root repair `88512417...` + branch-complete stable evaluation `6a4f89da...` + symmetry/serde/extreme-boundary contracts `0ce7639b...` + changelog `407b3645...` + current #488 `99a220db...` | +| GAP-085 | Equal nonzero SE-aware subtraction/FMA correction projections could conceal the exact represented-input ordering and turn a strict decision into rounded equality | `verification-pending` | RED `35ea85ba...` + exact product-roundoff repair `7d597a18...` + signed edge `b463a991...` + branch-scope refinement `ca8c2b86...` + changelog `702eec2f...` + current #488 `99a220db...` | +| GAP-086 | Mean signed bias could reject a representable result because individual `recovered - truth` residuals overflow before opposing represented terms cancel | `verification-pending` | RED `04e6e745...` + explicit-denominator cancellation `28b1d186...` + causal bias repair `d1cd5461...` + changelog `d68dde34...` + current #488 `99a220db...` | +| GAP-087 | Mean signed bias mixed-sign cancellation could discard repeated individually sub-ULP opposing residuals even though their combined represented mass changes the final bias | `verification-pending` | RED `63913727...` + error-free low-term repair `5697cca5...` + changelog `53f5c912...` + current #488 `99a220db...` | +| GAP-088 | Mean signed bias mixed-remainder compensation could be rounded into an intermediate numerator before the scientific count division, shifting the represented-input mean by one ULP | `verification-pending` | RED `8b4d19d1...` + causal compensated-division/FMA repair `7a33212b...` + changelog `bad698dd...` + current #488 `99a220db...` | +| GAP-089 | Mean signed bias exact opposite-sign cancellation could leave a same-sign compensated remainder whose `sum + correction` was rounded before the scientific count division, shifting the represented-input mean by one ULP | `verification-pending` | RED `84476aad...` + causal same-sign compensated-division repair `5f0d40b8...` + changelog `5763cde0...` + current #488 `99a220db...` | +| GAP-090 | Same-sign all-subnormal mean normalization could double-round the final represented bias by one ULP at scale restoration | `verification-pending` | RED `91abdb49...`; discarded direct-float repair `e89dc346...`; corrected exact-unit repair `1c0df8a7...`; halfway contract `f79a1b9a...`; regression fixture `eb29a79a...`; changelog `65ff502b...`; research lineage retained by current #488 `99a220db...` | +| GAP-091 | Mean signed bias pairwise subtraction roundoff could move the represented-input mean across a final binary64 midpoint | `verification-pending` | RED `a9d9bda3...` + insufficient first repair `96bff8e5...` + corrected tail/midpoint repair `676ccda0...` + changelog `cbcfa8d6...` + research `1f9e2631...` + two-direction edge `0bff5a8d...` + current #488 `99a220db...` | +| GAP-092 | Bias standard error could report false exact zero when two distinct represented-input residuals both round to the same pairwise binary64 subtraction | `verification-pending` | RED `c9c55ea5...` + causal two-observation expanded-difference repair `f6d7da96...` + changelog `ab7730ca...` + current #488 `99a220db...` | +| GAP-093 | Bias standard error could report false exact zero for n>2 when distinct represented-input residuals collapse to one rounded binary64 subtraction | `verification-pending` | RED `06a70e1c...` + common-high/error-free-low-term repair `04c62514...` + changelog `56d09154...` + corrected oracle `62243204...` + current #488 `99a220db...` | +| GAP-094 | Bias standard error could shift a representable result by one ULP because `sqrt(sample_variance)` and `sqrt(n)` were rounded separately before division | `verification-pending` | corrected-oracle RED `62243204...` + direct normalized-SE repair `8b8f0a21...` + dedicated exact-residual contract `89fd9ef0...` + research/current #488 `99a220db...` + changelog `184f4e2c...` | ## Release gate From 114f0f2711d80e91fd6791f60aae64874b0750ad Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 5 Sep 2026 06:38:23 +0900 Subject: [PATCH 188/235] docs(gaps): add distinct-high bias SE gap --- docs/product-technical-gap-baseline.md | 113 +++++++++++++------------ 1 file changed, 58 insertions(+), 55 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index c7f6daffa..cfffa8905 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-04T21:16:59Z +**Snapshot:** 2026-09-04T21:34:55Z **Protected-main evidence:** `a243f18da4a4ca8a8d068c39922537f1f8ed6ad0` **Workspace version:** `0.2.0` @@ -30,7 +30,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `99a220db45f98d557a9ba9e1688016f1349fcc43` | true | `main` | Validation Evidence landing vehicle, based on protected #490. GAP-093 preserves nonzero n>2 bias sampling uncertainty when distinct represented-input residuals collapse to one rounded subtraction. GAP-094 corrects the represented oracle to `0x3c72_79a7_4590_331c`, removes the subsequent one-ULP square-root decomposition error, and adds a direct exact-residual public contract. GAP-091–092, GAP-086–090, and prior Wilson, provenance, Monte Carlo, RMSE/SE, matching, serde/projection repairs remain inherited. Hosted exact-head gates and independent review remain required. | +| #488 | `b3d43ad3611163081fb8548cf0ce15ebcd8567ee` | true | `main` | Validation Evidence landing vehicle, based on protected #490. GAP-093 preserves nonzero n>2 bias sampling uncertainty when distinct represented-input residuals collapse to one rounded subtraction. GAP-094 corrects the represented oracle to `0x3c72_79a7_4590_331c` and removes a one-ULP square-root decomposition error. GAP-095 preserves represented-input dispersion when rounded residual highs differ but exact anchor-relative high/low deltas are representable; otherwise the predecessor path remains authoritative. GAP-091–092, GAP-086–090, and prior Wilson, provenance, Monte Carlo, RMSE/SE, matching, serde/projection repairs remain inherited. Hosted exact-head gates and independent review remain required. | | #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 | Validation / Analysis Run fold child. Unique evidence must be inherited by a conflict-resolving survivor; child-head CI does not transfer. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | @@ -62,7 +62,7 @@ The clock contract separates event/valid time, assertion time, document time, sy - Row arrival order is not scientific evidence. Fixed admitted observations must produce bit-identical means/centered results under permutation wherever the contract claims deterministic CPU `f64` reference behavior. - Known-truth component recovery follows bounded-context identity: stable `Between` is unit-level and uses canonical `occasion_index = 0`; `Within` retains actual `(unit, occasion)` identity. Duplicate identities or stable-Between occasion aliases are not weights. - A representable final scientific estimand is not rejected solely because an avoidable intermediate binary64 operation overflows/underflows. False exact 0/1/non-finite endpoints, erased finite bounds, cancellation residues, and double-rounded subnormal endpoints are not accepted when a bounded equivalent operation preserves the represented estimand or decision. -- Mean signed bias and bias SE remain Validation Evidence performance measures over admitted recovery units. `mean_bias` uses the direct residual path only when every pairwise subtraction is finite and does not discard represented low-order input mass. Overflowing or inexact finite pairwise subtraction redirects to the algebraically equivalent recovered-plus-negated-truth numerator, which is sign-cancelled before exact-power-of-two scale reduction and divided by the original recovery-unit count. During mixed-sign cancellation, error-free low terms are retained so repeated individually sub-ULP opposing residuals can still change the represented mean when their combined mass is material. Whether compensation comes from retained cancellation low terms or from a same-sign remainder left by exact opposite-sign cancellation, the canonical Neumaier high part, division residual, and correction are carried through the original scientific denominator before final scale restoration. For a same-sign all-subnormal remainder whose scientific divisor is at least the surviving term count, each represented magnitude is an exact integer number of `2^-1074` units; those units are summed in bounded integer arithmetic and quotient/remainder ties-to-even is applied once at the final subnormal grid. `bias_standard_error` still requires each individual signed residual to be representable. For exactly two observations, if either finite pairwise subtraction has error-free roundoff, TEPP evaluates `SE(mean) = |r1-r2| / 2` from expanded represented inputs. For larger samples in which subtraction roundoff exists and every rounded residual shares the same binary64 high part, that common high part is dispersion-invariant and the standard error is evaluated from the error-free subtraction low terms. The normalized standard error is formed as `sqrt(sum(d²) / (n * (n - 1)))` after scale reduction, avoiding separately rounded `sqrt(sample_variance)` and `sqrt(n)` operands. These are bounded repairs, not a claim of globally correctly rounded n>2 dispersion when rounded residual high parts differ. Mathematically nonzero final results below or above binary64 range fail closed. +- Mean signed bias and bias SE remain Validation Evidence performance measures over admitted recovery units. `mean_bias` uses the direct residual path only when every pairwise subtraction is finite and does not discard represented low-order input mass. Overflowing or inexact finite pairwise subtraction redirects to the algebraically equivalent recovered-plus-negated-truth numerator, which is sign-cancelled before exact-power-of-two scale reduction and divided by the original recovery-unit count. During mixed-sign cancellation, error-free low terms are retained so repeated individually sub-ULP opposing residuals can still change the represented mean when their combined mass is material. Whether compensation comes from retained cancellation low terms or from a same-sign remainder left by exact opposite-sign cancellation, the canonical Neumaier high part, division residual, and correction are carried through the original scientific denominator before final scale restoration. For a same-sign all-subnormal remainder whose scientific divisor is at least the surviving term count, each represented magnitude is an exact integer number of `2^-1074` units; those units are summed in bounded integer arithmetic and quotient/remainder ties-to-even is applied once at the final subnormal grid. `bias_standard_error` still requires each individual signed residual to be representable. For exactly two observations, if either finite pairwise subtraction has error-free roundoff, TEPP evaluates `SE(mean) = |r1-r2| / 2` from expanded represented inputs. For larger samples in which subtraction roundoff exists and every rounded residual shares the same binary64 high part, that common high part is dispersion-invariant and the standard error is evaluated from the error-free subtraction low terms. When rounded high parts differ, TEPP uses the same error-free `high + low` decomposition only if every anchor-relative high delta, low delta, and combined delta is itself exactly representable; translation leaves variance unchanged, so an O(n) translated second-moment evaluation preserves the represented residual geometry without an O(n²) pairwise expansion. If that exact-delta precondition cannot be established, the predecessor rounded-residual path remains authoritative rather than silently widening the numerical contract. The normalized standard error is formed as `sqrt(sum(d²) / (n * (n - 1)))` after scale reduction, avoiding separately rounded `sqrt(sample_variance)` and `sqrt(n)` operands. These are bounded repairs, not a claim of globally correctly rounded n>2 dispersion. Mathematically nonzero final results below or above binary64 range fail closed. - Generic Validation Evidence RMSE and its delta-method SE normalize before squaring. Exact-zero point RMSE requires exact-zero point RMSE SE. For positive RMSE, the declared producer satisfies `SE(RMSE) <= RMSE / 2`, with a small relative binary64 admission tolerance. - Generic `MonteCarloSummary` is sign-neutral. Zero SD requires zero SE and percentile endpoints equal to the represented mean. Positive SD requires positive SE coherent with represented `SD / sqrt(n)` within a small relative tolerance. Every inclusive nearest-rank endpoint is a retained observation and satisfies `|endpoint - mean| <= SD * sqrt(n - 1)`. Distinct lower/upper endpoint values share the same `(n - 1) * SD²` deviation budget. When `replication_count = 2` and endpoints are numerically distinct, those values exhaust the retained sample and the recorded represented mean/sample SD must match deterministic two-value reconstruction. Equal numeric endpoints do not prove two distinct ranks and are not subjected to that exhaustion rule. - When the generic carrier occupies `ValidationReport::monte_carlo_rmse`, retained replications are nonnegative; positive mean implies `SE(mean) <= mean`, and inclusive nearest-rank endpoints cannot exceed nonnegative sample-sum support `n * mean`. These typed bounds are not imposed on signed metrics such as bias. @@ -83,11 +83,13 @@ The clock contract separates event/valid time, assertion time, document time, sy ### #488 — Validation Evidence -#488 is the generic Validation Evidence landing vehicle at exact head `99a220db45f98d557a9ba9e1688016f1349fcc43`, based on protected #490. GAP-093 RED `06a70e1c01629f15f05efef48576a9cadb1f1b98` proves that `truth=[2^-54,2^-55,0]`, `recovered=[1,1,1]` contains three distinct represented-input residuals although every binary64 pairwise subtraction rounds to `1.0`; the predecessor therefore emitted false exact-zero uncertainty. First causal repair `04c62514a23722d63a62bd5d5af6e3a930cc3147` exposes the error-free subtraction low terms and, only when every rounded high part is equal, evaluates dispersion from those low terms in O(n). CHANGELOG `56d091544a5780567a6ef772568d62b0fc651747`. +#488 is the generic Validation Evidence landing vehicle at exact head `b3d43ad3611163081fb8548cf0ce15ebcd8567ee`, based on protected #490. GAP-093 RED `06a70e1c01629f15f05efef48576a9cadb1f1b98` proves that `truth=[2^-54,2^-55,0]`, `recovered=[1,1,1]` contains three distinct represented-input residuals although every binary64 pairwise subtraction rounds to `1.0`; the predecessor therefore emitted false exact-zero uncertainty. First causal repair `04c62514a23722d63a62bd5d5af6e3a930cc3147` exposes the error-free subtraction low terms and, only when every rounded high part is equal, evaluates dispersion from those low terms in O(n). CHANGELOG `56d091544a5780567a6ef772568d62b0fc651747`. -Oracle correction/RED `6224320410ccabb1cf16d36cc12f88e2b7a05bb1` then established GAP-094: exact high-precision evaluation of represented-input `SE=2^-55/sqrt(3)` rounds to `0x3c72_79a7_4590_331c`, not the `...331d` value produced by separately rounded `sqrt(sample_variance)/sqrt(n)`. Causal repair `8b8f0a21ccc825f355859cadbf20d83f04d2369f` forms the bounded normalized expression `sqrt(sum(d²)/(n(n-1)))`. Dedicated public contract `89fd9ef0add3930346900f75518708978ec9861e` reproduces the same one-ULP defect with exact residuals and no subtraction collapse; research/TRACEABILITY/current #488 `99a220db45f98d557a9ba9e1688016f1349fcc43`; CHANGELOG `184f4e2c109c7904027f782e91b8d9a01a1d46f1`. +Oracle correction/RED `6224320410ccabb1cf16d36cc12f88e2b7a05bb1` then established GAP-094: exact high-precision evaluation of represented-input `SE=2^-55/sqrt(3)` rounds to `0x3c72_79a7_4590_331c`, not the `...331d` value produced by separately rounded `sqrt(sample_variance)/sqrt(n)`. Causal repair `8b8f0a21ccc825f355859cadbf20d83f04d2369f` forms the bounded normalized expression `sqrt(sum(d²)/(n(n-1)))`. Dedicated public contract `89fd9ef0add3930346900f75518708978ec9861e` reproduces the same one-ULP defect with exact residuals and no subtraction collapse; CHANGELOG `184f4e2c109c7904027f782e91b8d9a01a1d46f1`. -GAP-092 remains inherited for the exact two-observation identity, and GAP-091 remains inherited for mean-bias subtraction roundoff. GAP-086–GAP-090 and earlier Wilson, provenance, Monte Carlo, RMSE/SE, matching, serde/projection repairs remain inherited. GAP-071/GAP-073–GAP-094 remain delivery-pending until current-head hosted gates, independent review, protected-main integration, and required durable-consumer adoption are verified. Bare legacy `ValidationReport` remains a backward-compatible compact projection and is not silently treated as v1 provenance. +GAP-095 RED `ae906ad609aa4eb948b8311c1cebd975f55eb2f6` proves the remaining distinct-high boundary: `truth=[2^-54,3*2^-54,0]`, `recovered=[1,1,1]` has exact represented residuals `[1-2^-54,1-3*2^-54,1]` with `SE=2^-54*sqrt(7)/3`, rounding to `0x3c8c_38aa_37c3_f68d`, while the predecessor rounded-residual vector yields `0x3c96_a09e_667f_3bcd`. Causal repair `d59b9c30bf810a6dc6fdceaba6d20e048fad985a` preserves the existing n=2/all-high-equal paths, reconstructs only provably exact anchor-relative `high+low` residual deltas, and evaluates their translation-invariant second moment in O(n). CHANGELOG `89c018630d5baadef04a8167034951b7e378a4b2`; research/current #488 `b3d43ad3611163081fb8548cf0ce15ebcd8567ee`. + +GAP-092 remains inherited for the exact two-observation identity, and GAP-091 remains inherited for mean-bias subtraction roundoff. GAP-086–GAP-090 and earlier Wilson, provenance, Monte Carlo, RMSE/SE, matching, serde/projection repairs remain inherited. GAP-071/GAP-073–GAP-095 remain delivery-pending until current-head hosted gates, independent review, protected-main integration, and required durable-consumer adoption are verified. Bare legacy `ValidationReport` remains a backward-compatible compact projection and is not silently treated as v1 provenance. ### #416 — Validation / Analysis Run consolidation @@ -145,56 +147,57 @@ GAP-092 remains inherited for the exact two-observation identity, and GAP-091 re | GAP-042 | Ratio-first logarithm could nearly double an adjacent-float irregular residual growth rate | `verification-pending` | RED `766ddc7a...` + `ln_1p` repair `16f21d9a...` | | GAP-043 | Duplicate known-truth component identities could silently reweight RMSE recovery evidence | `verification-pending` | RED `698f12f5...` + uniqueness repair `2fae4cb2...` | | GAP-044 | Known-truth RMSE alignment/accumulation depended on row order instead of component identity | `verification-pending` | RED `8ad72ac9...` / `5fb93c40...` + repairs `2dd9537e...` / `025dce7f...`; #310 `c6680450...` | -| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; current #488 `99a220db...` | -| GAP-046 | Bias SE could reject a representable SEM because raw squared deviations/intermediates overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; current #488 `99a220db...` | -| GAP-047 | Generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; current #488 `99a220db...` | -| GAP-048 | Mean signed bias could erase a representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; current #488 `99a220db...` | +| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; current #488 `b3d43ad3...` | +| GAP-046 | Bias SE could reject a representable SEM because raw squared deviations/intermediates overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; current #488 `b3d43ad3...` | +| GAP-047 | Generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; current #488 `b3d43ad3...` | +| GAP-048 | Mean signed bias could erase a representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; current #488 `b3d43ad3...` | | GAP-049 | Stable `Between` recovery could be aliased across occasion indices and reweight RMSE | `verification-pending` | RED `0a03041c...` + repair `ec2c1219...`; #310 `c6680450...` | -| GAP-050 | Zero-multiplier SE-aware acceptance could erase a nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; current #488 `99a220db...` | -| GAP-051 | Exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; current #488 `99a220db...` | -| GAP-052 | All-covered Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; current #488 `99a220db...` | -| GAP-053 | Strict-interior Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; current #488 `99a220db...` | -| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; current #488 `99a220db...` | -| GAP-055 | Strict-interior Wilson lower endpoint could accept a nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; current #488 `99a220db...` | -| GAP-056 | Durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; current #488 `99a220db...` | -| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from a generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; current #488 `99a220db...` | -| GAP-058 | Generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; current #488 `99a220db...` | -| GAP-059 | Generic Monte Carlo summary could materially misstate positive SE relative to `SD / sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; current #488 `99a220db...` | -| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; current #488 `99a220db...` | -| GAP-061 | Generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; current #488 `99a220db...` | -| GAP-062 | Finite-tolerance matching could fail while the pair is deterministically outside every finite tolerance | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; current #488 `99a220db...` | -| GAP-063 | Exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; current #488 `99a220db...` | -| GAP-064 | Positive point RMSE could carry SE above the declared squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; current #488 `99a220db...` | -| GAP-065 | Positive Monte Carlo RMSE could carry spread/SE impossible for nonnegative replications | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; current #488 `99a220db...` | -| GAP-066 | RMSE Monte Carlo nearest-rank percentile could exceed total nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; current #488 `99a220db...` | -| GAP-067 | Generic nearest-rank percentile endpoint could be individually incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected over-strong repair `2798e4f9...`; causal repair `c7151b49...`; edge `dbef285b...`; changelog `c38a320c...`; research `2bbcbb24...`; current #488 `99a220db...` | -| GAP-068 | Distinct generic percentile endpoints could each pass individual radius checks while jointly exceeding the sample squared-deviation budget | `verification-pending` | RED `c4a13826...` + causal repair `cb3f80a2...` + changelog `f727450d...`; current #488 `99a220db...` | -| GAP-069 | Two-replication distinct nearest-rank endpoints could exhaust the retained sample while the stored mean or SD remained impossible | `verification-pending` | RED `81bf0d9e...` + causal repair `d48f8fef...` + mean coverage `fb314d8a...` + branch cleanup `440b78d8...` + changelog `45116498...`; current #488 `99a220db...` | -| GAP-070 | Stored Wilson bounds could contain empirical coverage while the lower/upper pair could not arise from one Wilson score interval for that same coverage | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...` + complementary edge `c1cb16a7...`; current #488 `99a220db...` | -| GAP-071 | Durable Wilson evidence lacked denominator and critical-value/sidedness provenance, preventing exact recomputation from a persisted artifact | `active-repair` | valid carrier RED `6f6e06d2...`; shared count/Wilson authority `ca517ed3...`; `WilsonCoverageEvidenceV1` `31e1ab2b...`; sidedness `e9c63926...`/`fdd24a1a...`; envelope RED `07766cb0...` + `ValidationEvidenceV1` repair `a16f22e6...`; current #488 `99a220db...`; remaining: hosted GREEN/review/main plus durable-consumer adoption | -| GAP-072 | Exact all-covered Wilson evidence could retain a zero lower endpoint even though the canonical non-empty finite-`z²` producer always emits `n/(n+z²) > 0` | `verification-pending` | RED `ce714f07...` + non-force source-restore RCA `18499052...` + repair `72e9d954...` + changelog `e3a2f4a2...`; current #488 `99a220db...` | -| GAP-073 | Durable Wilson count provenance could round one uncovered observation away above binary64's exact-integer range and expose a pointer-width-dependent count schema | `verification-pending` | RED `29d710a5...` + complement/count repair `29968c80...` + fixed-width carrier repair `91d9a3bb...` + exact ratio RED/repair `63ddfdd6...`/`11323c57...`; current #488 `99a220db...` | -| GAP-074 | Durable Wilson evidence could correctly retain exact `u64` counts yet pre-round `sample_count` before endpoint projection, shifting strict-interior endpoints or erasing all-covered finite-sample uncertainty | `verification-pending` | RED `f89e2467...` + all-covered edge `1a5180b2...` + stale-oracle correction `6254c498...` + causal reciprocal-scale repair `73bbb5cf...` + changelog `f2b5768b...` + research predecessor `7fc78a59...`; current #488 `99a220db...` | -| GAP-075 | Inexact durable all-covered Wilson evidence could round the complementary miss mass to exact one at extreme finite `z` and erase a representable positive lower endpoint | `verification-pending` | RED `059ce70d...`; transient duplicate-owner implementation `46f91f3f...` excluded; canonical repair `0f478392...`; single-writer cleanup `8e2058f2...`; exact-oracle correction `93d5d208...`; changelog correction `43b6562c...`; research predecessor `b03a719d...`; current #488 `99a220db...` | -| GAP-076 | Exactly representable all-covered Wilson counts could absorb a small positive `z²` in `n + z²` and falsely emit exact `1.0` although a lower binary64 endpoint is representable | `verification-pending` | RED `e0c4ec81...` + causal boundary repair `c9dcb9df...` + below-resolution edge `6140080d...` + changelog `09ebb482...` + research predecessor `fe89c438...`; current #488 `99a220db...` | -| GAP-077 | Exactly representable all-covered Wilson counts could form an inexact partial denominator `n + z²` whose rounded sum shifts the represented-input lower endpoint by one ULP even though neither operand is fully absorbed | `verification-pending` | RED `06e55653...` + causal TwoSum/FMA repair `6c084dbe...` + research `25cc1943...` + changelog `5acc894b...` + predecessor changelog correction `f89e36d1...` + correct-direct-rounding control `80a0a0ad...`; current #488 `99a220db...` | -| GAP-078 | Exact-count all-covered Wilson residual compensation could move a direct quotient by one ULP even when the represented-input rational remains on the same side of the adjacent midpoint | `verification-pending` | RED `d076d344...` + midpoint-selection repair `32314239...` + changelog `a75940c9...` + research predecessor `ef6441f7...`; current #488 `99a220db...` | -| GAP-079 | SE-aware acceptance could underflow a finite positive `k · SE` tolerance to exact zero by dividing `SE` by a much larger estimate/target scale before multiplication | `verification-pending` | RED `76067efc...` + causal direct-finite comparison repair `4ffdf366...` + changelog `d822c0ba...` + current #488 `99a220db...` | -| GAP-080 | SE-aware acceptance both-overflow fallback could normalize an exact strict rejection into an equal rounded residual/bound and falsely accept it | `verification-pending` | RED `a9a45714...` + exact significand/exponent repair `425e8963...` + changelog `e6270629...` + current #488 `99a220db...` | -| GAP-081 | SE-aware acceptance finite/finite multiplication could round an exact strict represented-input rejection into an equal residual/bound and falsely accept it | `verification-pending` | RED `23c3262c...` + tie repair `6a2add48...` + edge coverage `3656deb2...` + changelog `090f5124...` + current #488 `99a220db...` | -| GAP-082 | SE-aware acceptance finite subtraction could round an exact strict represented-input rejection onto an exact finite bound and falsely accept equality | `verification-pending` | RED `58cbc032...` + causal low-term comparison repair `68a6fd98...` + sign-symmetric edge `b2c06512...` + changelog `c4f752f3...` + current #488 `99a220db...` | -| GAP-083 | SE-aware acceptance product correction can fall below binary64 resolution even when the rounded finite bound is subnormal or minimum normal, erasing a strict represented-input rejection | `verification-pending` | RED `b55c5473...` + initial narrow repair `210cebc4...` + minimum-normal RED `c77ac440...` + corrected zero-projection repair `772ad8ed...` + changelog correction `ceb68825...` + current #488 `99a220db...` | -| GAP-084 | Legacy Wilson pair admission could accept an exact-zero/exact-one boundary even though the peer endpoint implied a representable non-boundary root | `verification-pending` | RED `c9d612f2...` + causal peer-root repair `88512417...` + branch-complete stable evaluation `6a4f89da...` + symmetry/serde/extreme-boundary contracts `0ce7639b...` + changelog `407b3645...` + current #488 `99a220db...` | -| GAP-085 | Equal nonzero SE-aware subtraction/FMA correction projections could conceal the exact represented-input ordering and turn a strict decision into rounded equality | `verification-pending` | RED `35ea85ba...` + exact product-roundoff repair `7d597a18...` + signed edge `b463a991...` + branch-scope refinement `ca8c2b86...` + changelog `702eec2f...` + current #488 `99a220db...` | -| GAP-086 | Mean signed bias could reject a representable result because individual `recovered - truth` residuals overflow before opposing represented terms cancel | `verification-pending` | RED `04e6e745...` + explicit-denominator cancellation `28b1d186...` + causal bias repair `d1cd5461...` + changelog `d68dde34...` + current #488 `99a220db...` | -| GAP-087 | Mean signed bias mixed-sign cancellation could discard repeated individually sub-ULP opposing residuals even though their combined represented mass changes the final bias | `verification-pending` | RED `63913727...` + error-free low-term repair `5697cca5...` + changelog `53f5c912...` + current #488 `99a220db...` | -| GAP-088 | Mean signed bias mixed-remainder compensation could be rounded into an intermediate numerator before the scientific count division, shifting the represented-input mean by one ULP | `verification-pending` | RED `8b4d19d1...` + causal compensated-division/FMA repair `7a33212b...` + changelog `bad698dd...` + current #488 `99a220db...` | -| GAP-089 | Mean signed bias exact opposite-sign cancellation could leave a same-sign compensated remainder whose `sum + correction` was rounded before the scientific count division, shifting the represented-input mean by one ULP | `verification-pending` | RED `84476aad...` + causal same-sign compensated-division repair `5f0d40b8...` + changelog `5763cde0...` + current #488 `99a220db...` | -| GAP-090 | Same-sign all-subnormal mean normalization could double-round the final represented bias by one ULP at scale restoration | `verification-pending` | RED `91abdb49...`; discarded direct-float repair `e89dc346...`; corrected exact-unit repair `1c0df8a7...`; halfway contract `f79a1b9a...`; regression fixture `eb29a79a...`; changelog `65ff502b...`; research lineage retained by current #488 `99a220db...` | -| GAP-091 | Mean signed bias pairwise subtraction roundoff could move the represented-input mean across a final binary64 midpoint | `verification-pending` | RED `a9d9bda3...` + insufficient first repair `96bff8e5...` + corrected tail/midpoint repair `676ccda0...` + changelog `cbcfa8d6...` + research `1f9e2631...` + two-direction edge `0bff5a8d...` + current #488 `99a220db...` | -| GAP-092 | Bias standard error could report false exact zero when two distinct represented-input residuals both round to the same pairwise binary64 subtraction | `verification-pending` | RED `c9c55ea5...` + causal two-observation expanded-difference repair `f6d7da96...` + changelog `ab7730ca...` + current #488 `99a220db...` | -| GAP-093 | Bias standard error could report false exact zero for n>2 when distinct represented-input residuals collapse to one rounded binary64 subtraction | `verification-pending` | RED `06a70e1c...` + common-high/error-free-low-term repair `04c62514...` + changelog `56d09154...` + corrected oracle `62243204...` + current #488 `99a220db...` | -| GAP-094 | Bias standard error could shift a representable result by one ULP because `sqrt(sample_variance)` and `sqrt(n)` were rounded separately before division | `verification-pending` | corrected-oracle RED `62243204...` + direct normalized-SE repair `8b8f0a21...` + dedicated exact-residual contract `89fd9ef0...` + research/current #488 `99a220db...` + changelog `184f4e2c...` | +| GAP-050 | Zero-multiplier SE-aware acceptance could erase a nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; current #488 `b3d43ad3...` | +| GAP-051 | Exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; current #488 `b3d43ad3...` | +| GAP-052 | All-covered Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; current #488 `b3d43ad3...` | +| GAP-053 | Strict-interior Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; current #488 `b3d43ad3...` | +| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; current #488 `b3d43ad3...` | +| GAP-055 | Strict-interior Wilson lower endpoint could accept a nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; current #488 `b3d43ad3...` | +| GAP-056 | Durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; current #488 `b3d43ad3...` | +| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from a generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; current #488 `b3d43ad3...` | +| GAP-058 | Generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; current #488 `b3d43ad3...` | +| GAP-059 | Generic Monte Carlo summary could materially misstate positive SE relative to `SD / sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; current #488 `b3d43ad3...` | +| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; current #488 `b3d43ad3...` | +| GAP-061 | Generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; current #488 `b3d43ad3...` | +| GAP-062 | Finite-tolerance matching could fail while the pair is deterministically outside every finite tolerance | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; current #488 `b3d43ad3...` | +| GAP-063 | Exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; current #488 `b3d43ad3...` | +| GAP-064 | Positive point RMSE could carry SE above the declared squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; current #488 `b3d43ad3...` | +| GAP-065 | Positive Monte Carlo RMSE could carry spread/SE impossible for nonnegative replications | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; current #488 `b3d43ad3...` | +| GAP-066 | RMSE Monte Carlo nearest-rank percentile could exceed total nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; current #488 `b3d43ad3...` | +| GAP-067 | Generic nearest-rank percentile endpoint could be individually incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected over-strong repair `2798e4f9...`; causal repair `c7151b49...`; edge `dbef285b...`; changelog `c38a320c...`; research `2bbcbb24...`; current #488 `b3d43ad3...` | +| GAP-068 | Distinct generic percentile endpoints could each pass individual radius checks while jointly exceeding the sample squared-deviation budget | `verification-pending` | RED `c4a13826...` + causal repair `cb3f80a2...` + changelog `f727450d...`; current #488 `b3d43ad3...` | +| GAP-069 | Two-replication distinct nearest-rank endpoints could exhaust the retained sample while the stored mean or SD remained impossible | `verification-pending` | RED `81bf0d9e...` + causal repair `d48f8fef...` + mean coverage `fb314d8a...` + branch cleanup `440b78d8...` + changelog `45116498...`; current #488 `b3d43ad3...` | +| GAP-070 | Stored Wilson bounds could contain empirical coverage while the lower/upper pair could not arise from one Wilson score interval for that same coverage | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...` + complementary edge `c1cb16a7...`; current #488 `b3d43ad3...` | +| GAP-071 | Durable Wilson evidence lacked denominator and critical-value/sidedness provenance, preventing exact recomputation from a persisted artifact | `active-repair` | valid carrier RED `6f6e06d2...`; shared count/Wilson authority `ca517ed3...`; `WilsonCoverageEvidenceV1` `31e1ab2b...`; sidedness `e9c63926...`/`fdd24a1a...`; envelope RED `07766cb0...` + `ValidationEvidenceV1` repair `a16f22e6...`; current #488 `b3d43ad3...`; remaining: hosted GREEN/review/main plus durable-consumer adoption | +| GAP-072 | Exact all-covered Wilson evidence could retain a zero lower endpoint even though the canonical non-empty finite-`z²` producer always emits `n/(n+z²) > 0` | `verification-pending` | RED `ce714f07...` + non-force source-restore RCA `18499052...` + repair `72e9d954...` + changelog `e3a2f4a2...`; current #488 `b3d43ad3...` | +| GAP-073 | Durable Wilson count provenance could round one uncovered observation away above binary64's exact-integer range and expose a pointer-width-dependent count schema | `verification-pending` | RED `29d710a5...` + complement/count repair `29968c80...` + fixed-width carrier repair `91d9a3bb...` + exact ratio RED/repair `63ddfdd6...`/`11323c57...`; current #488 `b3d43ad3...` | +| GAP-074 | Durable Wilson evidence could correctly retain exact `u64` counts yet pre-round `sample_count` before endpoint projection, shifting strict-interior endpoints or erasing all-covered finite-sample uncertainty | `verification-pending` | RED `f89e2467...` + all-covered edge `1a5180b2...` + stale-oracle correction `6254c498...` + causal reciprocal-scale repair `73bbb5cf...` + changelog `f2b5768b...` + research predecessor `7fc78a59...`; current #488 `b3d43ad3...` | +| GAP-075 | Inexact durable all-covered Wilson evidence could round the complementary miss mass to exact one at extreme finite `z` and erase a representable positive lower endpoint | `verification-pending` | RED `059ce70d...`; transient duplicate-owner implementation `46f91f3f...` excluded; canonical repair `0f478392...`; single-writer cleanup `8e2058f2...`; exact-oracle correction `93d5d208...`; changelog correction `43b6562c...`; research predecessor `b03a719d...`; current #488 `b3d43ad3...` | +| GAP-076 | Exactly representable all-covered Wilson counts could absorb a small positive `z²` in `n + z²` and falsely emit exact `1.0` although a lower binary64 endpoint is representable | `verification-pending` | RED `e0c4ec81...` + causal boundary repair `c9dcb9df...` + below-resolution edge `6140080d...` + changelog `09ebb482...` + research predecessor `fe89c438...`; current #488 `b3d43ad3...` | +| GAP-077 | Exactly representable all-covered Wilson counts could form an inexact partial denominator `n + z²` whose rounded sum shifts the represented-input lower endpoint by one ULP even though neither operand is fully absorbed | `verification-pending` | RED `06e55653...` + causal TwoSum/FMA repair `6c084dbe...` + research `25cc1943...` + changelog `5acc894b...` + predecessor changelog correction `f89e36d1...` + correct-direct-rounding control `80a0a0ad...`; current #488 `b3d43ad3...` | +| GAP-078 | Exact-count all-covered Wilson residual compensation could move a direct quotient by one ULP even when the represented-input rational remains on the same side of the adjacent midpoint | `verification-pending` | RED `d076d344...` + midpoint-selection repair `32314239...` + changelog `a75940c9...` + research predecessor `ef6441f7...`; current #488 `b3d43ad3...` | +| GAP-079 | SE-aware acceptance could underflow a finite positive `k · SE` tolerance to exact zero by dividing `SE` by a much larger estimate/target scale before multiplication | `verification-pending` | RED `76067efc...` + causal direct-finite comparison repair `4ffdf366...` + changelog `d822c0ba...` + current #488 `b3d43ad3...` | +| GAP-080 | SE-aware acceptance both-overflow fallback could normalize an exact strict rejection into an equal rounded residual/bound and falsely accept it | `verification-pending` | RED `a9a45714...` + exact significand/exponent repair `425e8963...` + changelog `e6270629...` + current #488 `b3d43ad3...` | +| GAP-081 | SE-aware acceptance finite/finite multiplication could round an exact strict represented-input rejection into an equal residual/bound and falsely accept it | `verification-pending` | RED `23c3262c...` + tie repair `6a2add48...` + edge coverage `3656deb2...` + changelog `090f5124...` + current #488 `b3d43ad3...` | +| GAP-082 | SE-aware acceptance finite subtraction could round an exact strict represented-input rejection onto an exact finite bound and falsely accept equality | `verification-pending` | RED `58cbc032...` + causal low-term comparison repair `68a6fd98...` + sign-symmetric edge `b2c06512...` + changelog `c4f752f3...` + current #488 `b3d43ad3...` | +| GAP-083 | SE-aware acceptance product correction can fall below binary64 resolution even when the rounded finite bound is subnormal or minimum normal, erasing a strict represented-input rejection | `verification-pending` | RED `b55c5473...` + initial narrow repair `210cebc4...` + minimum-normal RED `c77ac440...` + corrected zero-projection repair `772ad8ed...` + changelog correction `ceb68825...` + current #488 `b3d43ad3...` | +| GAP-084 | Legacy Wilson pair admission could accept an exact-zero/exact-one boundary even though the peer endpoint implied a representable non-boundary root | `verification-pending` | RED `c9d612f2...` + causal peer-root repair `88512417...` + branch-complete stable evaluation `6a4f89da...` + symmetry/serde/extreme-boundary contracts `0ce7639b...` + changelog `407b3645...` + current #488 `b3d43ad3...` | +| GAP-085 | Equal nonzero SE-aware subtraction/FMA correction projections could conceal the exact represented-input ordering and turn a strict decision into rounded equality | `verification-pending` | RED `35ea85ba...` + exact product-roundoff repair `7d597a18...` + signed edge `b463a991...` + branch-scope refinement `ca8c2b86...` + changelog `702eec2f...` + current #488 `b3d43ad3...` | +| GAP-086 | Mean signed bias could reject a representable result because individual `recovered - truth` residuals overflow before opposing represented terms cancel | `verification-pending` | RED `04e6e745...` + explicit-denominator cancellation `28b1d186...` + causal bias repair `d1cd5461...` + changelog `d68dde34...` + current #488 `b3d43ad3...` | +| GAP-087 | Mean signed bias mixed-sign cancellation could discard repeated individually sub-ULP opposing residuals even though their combined represented mass changes the final bias | `verification-pending` | RED `63913727...` + error-free low-term repair `5697cca5...` + changelog `53f5c912...` + current #488 `b3d43ad3...` | +| GAP-088 | Mean signed bias mixed-remainder compensation could be rounded into an intermediate numerator before the scientific count division, shifting the represented-input mean by one ULP | `verification-pending` | RED `8b4d19d1...` + causal compensated-division/FMA repair `7a33212b...` + changelog `bad698dd...` + current #488 `b3d43ad3...` | +| GAP-089 | Mean signed bias exact opposite-sign cancellation could leave a same-sign compensated remainder whose `sum + correction` was rounded before the scientific count division, shifting the represented-input mean by one ULP | `verification-pending` | RED `84476aad...` + causal same-sign compensated-division repair `5f0d40b8...` + changelog `5763cde0...` + current #488 `b3d43ad3...` | +| GAP-090 | Same-sign all-subnormal mean normalization could double-round the final represented bias by one ULP at scale restoration | `verification-pending` | RED `91abdb49...`; discarded direct-float repair `e89dc346...`; corrected exact-unit repair `1c0df8a7...`; halfway contract `f79a1b9a...`; regression fixture `eb29a79a...`; changelog `65ff502b...`; research lineage retained by current #488 `b3d43ad3...` | +| GAP-091 | Mean signed bias pairwise subtraction roundoff could move the represented-input mean across a final binary64 midpoint | `verification-pending` | RED `a9d9bda3...` + insufficient first repair `96bff8e5...` + corrected tail/midpoint repair `676ccda0...` + changelog `cbcfa8d6...` + research `1f9e2631...` + two-direction edge `0bff5a8d...` + current #488 `b3d43ad3...` | +| GAP-092 | Bias standard error could report false exact zero when two distinct represented-input residuals both round to the same pairwise binary64 subtraction | `verification-pending` | RED `c9c55ea5...` + causal two-observation expanded-difference repair `f6d7da96...` + changelog `ab7730ca...` + current #488 `b3d43ad3...` | +| GAP-093 | Bias standard error could report false exact zero for n>2 when distinct represented-input residuals collapse to one rounded binary64 subtraction | `verification-pending` | RED `06a70e1c...` + common-high/error-free-low-term repair `04c62514...` + changelog `56d09154...` + corrected oracle `62243204...` + current #488 `b3d43ad3...` | +| GAP-094 | Bias standard error could shift a representable result by one ULP because `sqrt(sample_variance)` and `sqrt(n)` were rounded separately before division | `verification-pending` | corrected-oracle RED `62243204...` + direct normalized-SE repair `8b8f0a21...` + dedicated exact-residual contract `89fd9ef0...` + research `99a220db...` + changelog `184f4e2c...` + current #488 `b3d43ad3...` | +| GAP-095 | Bias standard error could materially overstate n>2 uncertainty when pairwise subtraction roundoff changes represented residual high parts instead of collapsing them all to one value | `verification-pending` | RED `ae906ad6...` + exact translated-residual repair `d59b9c30...` + changelog `89c01863...` + research/current #488 `b3d43ad3...`; exact-head hosted GREEN/review/main integration remain pending | ## Release gate From 4d22351b8c737b6728300d69727abfd9bc52b95a Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 5 Sep 2026 06:47:57 +0900 Subject: [PATCH 189/235] docs(gaps): add exact-residual bias SE gap --- docs/product-technical-gap-baseline.md | 117 +++++++++++++------------ 1 file changed, 60 insertions(+), 57 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index cfffa8905..988b11924 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-04T21:34:55Z +**Snapshot:** 2026-09-04T21:45:40Z **Protected-main evidence:** `a243f18da4a4ca8a8d068c39922537f1f8ed6ad0` **Workspace version:** `0.2.0` @@ -30,7 +30,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `b3d43ad3611163081fb8548cf0ce15ebcd8567ee` | true | `main` | Validation Evidence landing vehicle, based on protected #490. GAP-093 preserves nonzero n>2 bias sampling uncertainty when distinct represented-input residuals collapse to one rounded subtraction. GAP-094 corrects the represented oracle to `0x3c72_79a7_4590_331c` and removes a one-ULP square-root decomposition error. GAP-095 preserves represented-input dispersion when rounded residual highs differ but exact anchor-relative high/low deltas are representable; otherwise the predecessor path remains authoritative. GAP-091–092, GAP-086–090, and prior Wilson, provenance, Monte Carlo, RMSE/SE, matching, serde/projection repairs remain inherited. Hosted exact-head gates and independent review remain required. | +| #488 | `32f414603eacafccc034881d447c8fa7503a029a` | true | `main` | Validation Evidence landing vehicle, based on protected #490. GAP-093 preserves nonzero n>2 bias sampling uncertainty when residual subtraction low terms collapse under one rounded high. GAP-094 removes a one-ULP square-root decomposition error. GAP-095 preserves represented-input dispersion when rounded residual highs differ but exact anchor-relative `high+low` deltas are representable. GAP-096 extends that bounded translated-residual path to exact pairwise residuals so a rounded residual mean cannot change dispersion before centering. GAP-091–092, GAP-086–090, and prior Wilson, provenance, Monte Carlo, RMSE/SE, matching, serde/projection repairs remain inherited. Hosted exact-head gates and independent review remain required. | | #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 | Validation / Analysis Run fold child. Unique evidence must be inherited by a conflict-resolving survivor; child-head CI does not transfer. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | @@ -48,7 +48,7 @@ Exact-head evidence becomes stale after any source push. TEPP owns temporal/event composition, irregular time, time-varying multilevel/cross-classified/multiple-membership semantics, longitudinal invariance/drift/alignment, leakage-safe knowledge cutoff, temporal recovery, Validation Evidence, and Projection policy. `longitudinal_modeling` is the bounded context and `longitudinal_core` is its current Rust implementation path. -`psychometric_core` is not authority for new temporal/state composition. fast-mlsirm owns reusable static/generalized-mixed/dependence-aware psychometric specification and arithmetic. TEPP consumes only immutable released/versioned Published Language through an ACL; source copying and mutable sibling-head dependencies are prohibited. Fresh owner evidence is fast-mlsirm protected `main@b5a3a0c1057d4b53d7a4bb18e0de69f630c2b45c`; latest immutable release remains `v0.9.1`. +`psychometric_core` is not authority for new temporal/state composition. fast-mlsirm owns reusable static/generalized-mixed/dependence-aware psychometric specification and arithmetic. TEPP consumes only immutable released/versioned Published Language through an ACL; source copying and mutable sibling-head dependencies are prohibited. Fresh owner evidence is fast-mlsirm protected `main@493326f2de49ea1704da0ded19868ed05d2fe00f`; latest immutable release remains `v0.9.1`. The protected-main advance is a CI/concurrency change after that release and is evidence only, not a mutable TEPP dependency. contextual-orchestrator owns provider/model routing and semantic LLM execution. Fresh owner evidence is protected `main@2e414d15ba58f28597751b625a8a2f00fc9fadcf`, while GitHub releases remain zero. Semantic LLM work and model-backed Actions therefore continue to require a released/versioned contextual-orchestrator contract; Actions use `orchestrator/free` through the gateway credential and do not select providers/models/groups or consume direct provider keys. Mutable owner main is evidence, not a TEPP production contract. Protected-main `AGENTS.md` is stale on this point; #480 carries the owner-correct released-orchestrator wording and must be inherited by normal non-force integration rather than copied into unrelated scientific branches. Context Graph contracts are contract-only integration authority; EA Core owns enterprise-architecture decisions. No cross-service SQL. @@ -62,7 +62,7 @@ The clock contract separates event/valid time, assertion time, document time, sy - Row arrival order is not scientific evidence. Fixed admitted observations must produce bit-identical means/centered results under permutation wherever the contract claims deterministic CPU `f64` reference behavior. - Known-truth component recovery follows bounded-context identity: stable `Between` is unit-level and uses canonical `occasion_index = 0`; `Within` retains actual `(unit, occasion)` identity. Duplicate identities or stable-Between occasion aliases are not weights. - A representable final scientific estimand is not rejected solely because an avoidable intermediate binary64 operation overflows/underflows. False exact 0/1/non-finite endpoints, erased finite bounds, cancellation residues, and double-rounded subnormal endpoints are not accepted when a bounded equivalent operation preserves the represented estimand or decision. -- Mean signed bias and bias SE remain Validation Evidence performance measures over admitted recovery units. `mean_bias` uses the direct residual path only when every pairwise subtraction is finite and does not discard represented low-order input mass. Overflowing or inexact finite pairwise subtraction redirects to the algebraically equivalent recovered-plus-negated-truth numerator, which is sign-cancelled before exact-power-of-two scale reduction and divided by the original recovery-unit count. During mixed-sign cancellation, error-free low terms are retained so repeated individually sub-ULP opposing residuals can still change the represented mean when their combined mass is material. Whether compensation comes from retained cancellation low terms or from a same-sign remainder left by exact opposite-sign cancellation, the canonical Neumaier high part, division residual, and correction are carried through the original scientific denominator before final scale restoration. For a same-sign all-subnormal remainder whose scientific divisor is at least the surviving term count, each represented magnitude is an exact integer number of `2^-1074` units; those units are summed in bounded integer arithmetic and quotient/remainder ties-to-even is applied once at the final subnormal grid. `bias_standard_error` still requires each individual signed residual to be representable. For exactly two observations, if either finite pairwise subtraction has error-free roundoff, TEPP evaluates `SE(mean) = |r1-r2| / 2` from expanded represented inputs. For larger samples in which subtraction roundoff exists and every rounded residual shares the same binary64 high part, that common high part is dispersion-invariant and the standard error is evaluated from the error-free subtraction low terms. When rounded high parts differ, TEPP uses the same error-free `high + low` decomposition only if every anchor-relative high delta, low delta, and combined delta is itself exactly representable; translation leaves variance unchanged, so an O(n) translated second-moment evaluation preserves the represented residual geometry without an O(n²) pairwise expansion. If that exact-delta precondition cannot be established, the predecessor rounded-residual path remains authoritative rather than silently widening the numerical contract. The normalized standard error is formed as `sqrt(sum(d²) / (n * (n - 1)))` after scale reduction, avoiding separately rounded `sqrt(sample_variance)` and `sqrt(n)` operands. These are bounded repairs, not a claim of globally correctly rounded n>2 dispersion. Mathematically nonzero final results below or above binary64 range fail closed. +- Mean signed bias and bias SE remain Validation Evidence performance measures over admitted recovery units. `mean_bias` uses the direct residual path only when every pairwise subtraction is finite and does not discard represented low-order input mass. Overflowing or inexact finite pairwise subtraction redirects to the algebraically equivalent recovered-plus-negated-truth numerator, which is sign-cancelled before exact-power-of-two scale reduction and divided by the original recovery-unit count. During mixed-sign cancellation, error-free low terms are retained so repeated individually sub-ULP opposing residuals can still change the represented mean when their combined mass is material. Whether compensation comes from retained cancellation low terms or from a same-sign remainder left by exact opposite-sign cancellation, the canonical Neumaier high part, division residual, and correction are carried through the original scientific denominator before final scale restoration. For a same-sign all-subnormal remainder whose scientific divisor is at least the surviving term count, each represented magnitude is an exact integer number of `2^-1074` units; those units are summed in bounded integer arithmetic and quotient/remainder ties-to-even is applied once at the final subnormal grid. `bias_standard_error` still requires each individual signed residual to be representable. For exactly two observations, if either finite pairwise subtraction has error-free roundoff, TEPP evaluates `SE(mean) = |r1-r2| / 2` from expanded represented inputs. For larger samples in which subtraction roundoff exists and every rounded residual shares the same binary64 high part, that common high part is dispersion-invariant and the standard error is evaluated from the error-free subtraction low terms. For other `n > 2` samples, including exact pairwise residuals and distinct rounded highs, TEPP uses the error-free `high + low` representation only if every anchor-relative high delta, low delta, and combined residual delta is itself exactly representable. Translation leaves variance unchanged, so an O(n) translated second moment avoids making either rounded pairwise residuals or a rounded residual mean authoritative before dispersion is evaluated. If that exact-delta precondition cannot be established, the predecessor rounded-residual/rounded-mean path remains the bounded fallback rather than silently widening the contract. The normalized standard error is formed as `sqrt(sum(d²) / (n * (n - 1)))` after scale reduction, avoiding separately rounded `sqrt(sample_variance)` and `sqrt(n)` operands. These are bounded repairs, not a claim of globally correctly rounded n>2 dispersion. Mathematically nonzero final results below or above binary64 range fail closed. - Generic Validation Evidence RMSE and its delta-method SE normalize before squaring. Exact-zero point RMSE requires exact-zero point RMSE SE. For positive RMSE, the declared producer satisfies `SE(RMSE) <= RMSE / 2`, with a small relative binary64 admission tolerance. - Generic `MonteCarloSummary` is sign-neutral. Zero SD requires zero SE and percentile endpoints equal to the represented mean. Positive SD requires positive SE coherent with represented `SD / sqrt(n)` within a small relative tolerance. Every inclusive nearest-rank endpoint is a retained observation and satisfies `|endpoint - mean| <= SD * sqrt(n - 1)`. Distinct lower/upper endpoint values share the same `(n - 1) * SD²` deviation budget. When `replication_count = 2` and endpoints are numerically distinct, those values exhaust the retained sample and the recorded represented mean/sample SD must match deterministic two-value reconstruction. Equal numeric endpoints do not prove two distinct ranks and are not subjected to that exhaustion rule. - When the generic carrier occupies `ValidationReport::monte_carlo_rmse`, retained replications are nonnegative; positive mean implies `SE(mean) <= mean`, and inclusive nearest-rank endpoints cannot exceed nonnegative sample-sum support `n * mean`. These typed bounds are not imposed on signed metrics such as bias. @@ -83,13 +83,15 @@ The clock contract separates event/valid time, assertion time, document time, sy ### #488 — Validation Evidence -#488 is the generic Validation Evidence landing vehicle at exact head `b3d43ad3611163081fb8548cf0ce15ebcd8567ee`, based on protected #490. GAP-093 RED `06a70e1c01629f15f05efef48576a9cadb1f1b98` proves that `truth=[2^-54,2^-55,0]`, `recovered=[1,1,1]` contains three distinct represented-input residuals although every binary64 pairwise subtraction rounds to `1.0`; the predecessor therefore emitted false exact-zero uncertainty. First causal repair `04c62514a23722d63a62bd5d5af6e3a930cc3147` exposes the error-free subtraction low terms and, only when every rounded high part is equal, evaluates dispersion from those low terms in O(n). CHANGELOG `56d091544a5780567a6ef772568d62b0fc651747`. +#488 is the generic Validation Evidence landing vehicle at exact head `32f414603eacafccc034881d447c8fa7503a029a`, based on protected #490. GAP-093 RED `06a70e1c01629f15f05efef48576a9cadb1f1b98` proves that `truth=[2^-54,2^-55,0]`, `recovered=[1,1,1]` contains three distinct represented-input residuals although every binary64 pairwise subtraction rounds to `1.0`; the predecessor therefore emitted false exact-zero uncertainty. First causal repair `04c62514a23722d63a62bd5d5af6e3a930cc3147` exposes the error-free subtraction low terms and, only when every rounded high part is equal, evaluates dispersion from those low terms in O(n). CHANGELOG `56d091544a5780567a6ef772568d62b0fc651747`. Oracle correction/RED `6224320410ccabb1cf16d36cc12f88e2b7a05bb1` then established GAP-094: exact high-precision evaluation of represented-input `SE=2^-55/sqrt(3)` rounds to `0x3c72_79a7_4590_331c`, not the `...331d` value produced by separately rounded `sqrt(sample_variance)/sqrt(n)`. Causal repair `8b8f0a21ccc825f355859cadbf20d83f04d2369f` forms the bounded normalized expression `sqrt(sum(d²)/(n(n-1)))`. Dedicated public contract `89fd9ef0add3930346900f75518708978ec9861e` reproduces the same one-ULP defect with exact residuals and no subtraction collapse; CHANGELOG `184f4e2c109c7904027f782e91b8d9a01a1d46f1`. -GAP-095 RED `ae906ad609aa4eb948b8311c1cebd975f55eb2f6` proves the remaining distinct-high boundary: `truth=[2^-54,3*2^-54,0]`, `recovered=[1,1,1]` has exact represented residuals `[1-2^-54,1-3*2^-54,1]` with `SE=2^-54*sqrt(7)/3`, rounding to `0x3c8c_38aa_37c3_f68d`, while the predecessor rounded-residual vector yields `0x3c96_a09e_667f_3bcd`. Causal repair `d59b9c30bf810a6dc6fdceaba6d20e048fad985a` preserves the existing n=2/all-high-equal paths, reconstructs only provably exact anchor-relative `high+low` residual deltas, and evaluates their translation-invariant second moment in O(n). CHANGELOG `89c018630d5baadef04a8167034951b7e378a4b2`; research/current #488 `b3d43ad3611163081fb8548cf0ce15ebcd8567ee`. +GAP-095 RED `ae906ad609aa4eb948b8311c1cebd975f55eb2f6` proves the distinct-high boundary: `truth=[2^-54,3*2^-54,0]`, `recovered=[1,1,1]` has exact represented residuals `[1-2^-54,1-3*2^-54,1]` with `SE=2^-54*sqrt(7)/3`, rounding to `0x3c8c_38aa_37c3_f68d`, while the predecessor rounded-residual vector yields `0x3c96_a09e_667f_3bcd`. Causal repair `d59b9c30bf810a6dc6fdceaba6d20e048fad985a` preserves the existing n=2/common-high paths, reconstructs only provably exact anchor-relative `high+low` residual deltas, and evaluates their translation-invariant second moment in O(n). CHANGELOG `89c018630d5baadef04a8167034951b7e378a4b2`. -GAP-092 remains inherited for the exact two-observation identity, and GAP-091 remains inherited for mean-bias subtraction roundoff. GAP-086–GAP-090 and earlier Wilson, provenance, Monte Carlo, RMSE/SE, matching, serde/projection repairs remain inherited. GAP-071/GAP-073–GAP-095 remain delivery-pending until current-head hosted gates, independent review, protected-main integration, and required durable-consumer adoption are verified. Bare legacy `ValidationReport` remains a backward-compatible compact projection and is not silently treated as v1 provenance. +GAP-096 RED `9265b34a2163f45bd232d628c20f725d2844f50a` then proves a separate exact-residual failure. With `a=2^-52`, exact residuals `[1,1-a,1]` have represented-input `SE=a/3`, bits `0x3c95_5555_5555_5555`, but rounding their mean first produces deviations `[2^-53,-2^-53,2^-53]` and `0x3c96_a09e_667f_3bcd`. Causal repair `2fa266b21069460370f30243cfb498e2022888bf` reuses GAP-095's exact translated-residual path for all `n>2` samples satisfying its exact-delta preconditions, even when pairwise subtraction roundoff is zero. CHANGELOG `ab361b25ec4296165f89e4eff26e6d3521c00571`; research/current #488 `32f414603eacafccc034881d447c8fa7503a029a`. + +GAP-092 remains inherited for the exact two-observation subtraction-roundoff identity, and GAP-091 remains inherited for mean-bias subtraction roundoff. GAP-086–GAP-090 and earlier Wilson, provenance, Monte Carlo, RMSE/SE, matching, serde/projection repairs remain inherited. GAP-071/GAP-073–GAP-096 remain delivery-pending until current-head hosted gates, independent review, protected-main integration, and required durable-consumer adoption are verified. Bare legacy `ValidationReport` remains a backward-compatible compact projection and is not silently treated as v1 provenance. ### #416 — Validation / Analysis Run consolidation @@ -147,57 +149,58 @@ GAP-092 remains inherited for the exact two-observation identity, and GAP-091 re | GAP-042 | Ratio-first logarithm could nearly double an adjacent-float irregular residual growth rate | `verification-pending` | RED `766ddc7a...` + `ln_1p` repair `16f21d9a...` | | GAP-043 | Duplicate known-truth component identities could silently reweight RMSE recovery evidence | `verification-pending` | RED `698f12f5...` + uniqueness repair `2fae4cb2...` | | GAP-044 | Known-truth RMSE alignment/accumulation depended on row order instead of component identity | `verification-pending` | RED `8ad72ac9...` / `5fb93c40...` + repairs `2dd9537e...` / `025dce7f...`; #310 `c6680450...` | -| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; current #488 `b3d43ad3...` | -| GAP-046 | Bias SE could reject a representable SEM because raw squared deviations/intermediates overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; current #488 `b3d43ad3...` | -| GAP-047 | Generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; current #488 `b3d43ad3...` | -| GAP-048 | Mean signed bias could erase a representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; current #488 `b3d43ad3...` | +| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; current #488 `32f41460...` | +| GAP-046 | Bias SE could reject a representable SEM because raw squared deviations/intermediates overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; current #488 `32f41460...` | +| GAP-047 | Generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; current #488 `32f41460...` | +| GAP-048 | Mean signed bias could erase a representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; current #488 `32f41460...` | | GAP-049 | Stable `Between` recovery could be aliased across occasion indices and reweight RMSE | `verification-pending` | RED `0a03041c...` + repair `ec2c1219...`; #310 `c6680450...` | -| GAP-050 | Zero-multiplier SE-aware acceptance could erase a nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; current #488 `b3d43ad3...` | -| GAP-051 | Exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; current #488 `b3d43ad3...` | -| GAP-052 | All-covered Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; current #488 `b3d43ad3...` | -| GAP-053 | Strict-interior Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; current #488 `b3d43ad3...` | -| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; current #488 `b3d43ad3...` | -| GAP-055 | Strict-interior Wilson lower endpoint could accept a nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; current #488 `b3d43ad3...` | -| GAP-056 | Durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; current #488 `b3d43ad3...` | -| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from a generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; current #488 `b3d43ad3...` | -| GAP-058 | Generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; current #488 `b3d43ad3...` | -| GAP-059 | Generic Monte Carlo summary could materially misstate positive SE relative to `SD / sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; current #488 `b3d43ad3...` | -| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; current #488 `b3d43ad3...` | -| GAP-061 | Generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; current #488 `b3d43ad3...` | -| GAP-062 | Finite-tolerance matching could fail while the pair is deterministically outside every finite tolerance | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; current #488 `b3d43ad3...` | -| GAP-063 | Exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; current #488 `b3d43ad3...` | -| GAP-064 | Positive point RMSE could carry SE above the declared squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; current #488 `b3d43ad3...` | -| GAP-065 | Positive Monte Carlo RMSE could carry spread/SE impossible for nonnegative replications | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; current #488 `b3d43ad3...` | -| GAP-066 | RMSE Monte Carlo nearest-rank percentile could exceed total nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; current #488 `b3d43ad3...` | -| GAP-067 | Generic nearest-rank percentile endpoint could be individually incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected over-strong repair `2798e4f9...`; causal repair `c7151b49...`; edge `dbef285b...`; changelog `c38a320c...`; research `2bbcbb24...`; current #488 `b3d43ad3...` | -| GAP-068 | Distinct generic percentile endpoints could each pass individual radius checks while jointly exceeding the sample squared-deviation budget | `verification-pending` | RED `c4a13826...` + causal repair `cb3f80a2...` + changelog `f727450d...`; current #488 `b3d43ad3...` | -| GAP-069 | Two-replication distinct nearest-rank endpoints could exhaust the retained sample while the stored mean or SD remained impossible | `verification-pending` | RED `81bf0d9e...` + causal repair `d48f8fef...` + mean coverage `fb314d8a...` + branch cleanup `440b78d8...` + changelog `45116498...`; current #488 `b3d43ad3...` | -| GAP-070 | Stored Wilson bounds could contain empirical coverage while the lower/upper pair could not arise from one Wilson score interval for that same coverage | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...` + complementary edge `c1cb16a7...`; current #488 `b3d43ad3...` | -| GAP-071 | Durable Wilson evidence lacked denominator and critical-value/sidedness provenance, preventing exact recomputation from a persisted artifact | `active-repair` | valid carrier RED `6f6e06d2...`; shared count/Wilson authority `ca517ed3...`; `WilsonCoverageEvidenceV1` `31e1ab2b...`; sidedness `e9c63926...`/`fdd24a1a...`; envelope RED `07766cb0...` + `ValidationEvidenceV1` repair `a16f22e6...`; current #488 `b3d43ad3...`; remaining: hosted GREEN/review/main plus durable-consumer adoption | -| GAP-072 | Exact all-covered Wilson evidence could retain a zero lower endpoint even though the canonical non-empty finite-`z²` producer always emits `n/(n+z²) > 0` | `verification-pending` | RED `ce714f07...` + non-force source-restore RCA `18499052...` + repair `72e9d954...` + changelog `e3a2f4a2...`; current #488 `b3d43ad3...` | -| GAP-073 | Durable Wilson count provenance could round one uncovered observation away above binary64's exact-integer range and expose a pointer-width-dependent count schema | `verification-pending` | RED `29d710a5...` + complement/count repair `29968c80...` + fixed-width carrier repair `91d9a3bb...` + exact ratio RED/repair `63ddfdd6...`/`11323c57...`; current #488 `b3d43ad3...` | -| GAP-074 | Durable Wilson evidence could correctly retain exact `u64` counts yet pre-round `sample_count` before endpoint projection, shifting strict-interior endpoints or erasing all-covered finite-sample uncertainty | `verification-pending` | RED `f89e2467...` + all-covered edge `1a5180b2...` + stale-oracle correction `6254c498...` + causal reciprocal-scale repair `73bbb5cf...` + changelog `f2b5768b...` + research predecessor `7fc78a59...`; current #488 `b3d43ad3...` | -| GAP-075 | Inexact durable all-covered Wilson evidence could round the complementary miss mass to exact one at extreme finite `z` and erase a representable positive lower endpoint | `verification-pending` | RED `059ce70d...`; transient duplicate-owner implementation `46f91f3f...` excluded; canonical repair `0f478392...`; single-writer cleanup `8e2058f2...`; exact-oracle correction `93d5d208...`; changelog correction `43b6562c...`; research predecessor `b03a719d...`; current #488 `b3d43ad3...` | -| GAP-076 | Exactly representable all-covered Wilson counts could absorb a small positive `z²` in `n + z²` and falsely emit exact `1.0` although a lower binary64 endpoint is representable | `verification-pending` | RED `e0c4ec81...` + causal boundary repair `c9dcb9df...` + below-resolution edge `6140080d...` + changelog `09ebb482...` + research predecessor `fe89c438...`; current #488 `b3d43ad3...` | -| GAP-077 | Exactly representable all-covered Wilson counts could form an inexact partial denominator `n + z²` whose rounded sum shifts the represented-input lower endpoint by one ULP even though neither operand is fully absorbed | `verification-pending` | RED `06e55653...` + causal TwoSum/FMA repair `6c084dbe...` + research `25cc1943...` + changelog `5acc894b...` + predecessor changelog correction `f89e36d1...` + correct-direct-rounding control `80a0a0ad...`; current #488 `b3d43ad3...` | -| GAP-078 | Exact-count all-covered Wilson residual compensation could move a direct quotient by one ULP even when the represented-input rational remains on the same side of the adjacent midpoint | `verification-pending` | RED `d076d344...` + midpoint-selection repair `32314239...` + changelog `a75940c9...` + research predecessor `ef6441f7...`; current #488 `b3d43ad3...` | -| GAP-079 | SE-aware acceptance could underflow a finite positive `k · SE` tolerance to exact zero by dividing `SE` by a much larger estimate/target scale before multiplication | `verification-pending` | RED `76067efc...` + causal direct-finite comparison repair `4ffdf366...` + changelog `d822c0ba...` + current #488 `b3d43ad3...` | -| GAP-080 | SE-aware acceptance both-overflow fallback could normalize an exact strict rejection into an equal rounded residual/bound and falsely accept it | `verification-pending` | RED `a9a45714...` + exact significand/exponent repair `425e8963...` + changelog `e6270629...` + current #488 `b3d43ad3...` | -| GAP-081 | SE-aware acceptance finite/finite multiplication could round an exact strict represented-input rejection into an equal residual/bound and falsely accept it | `verification-pending` | RED `23c3262c...` + tie repair `6a2add48...` + edge coverage `3656deb2...` + changelog `090f5124...` + current #488 `b3d43ad3...` | -| GAP-082 | SE-aware acceptance finite subtraction could round an exact strict represented-input rejection onto an exact finite bound and falsely accept equality | `verification-pending` | RED `58cbc032...` + causal low-term comparison repair `68a6fd98...` + sign-symmetric edge `b2c06512...` + changelog `c4f752f3...` + current #488 `b3d43ad3...` | -| GAP-083 | SE-aware acceptance product correction can fall below binary64 resolution even when the rounded finite bound is subnormal or minimum normal, erasing a strict represented-input rejection | `verification-pending` | RED `b55c5473...` + initial narrow repair `210cebc4...` + minimum-normal RED `c77ac440...` + corrected zero-projection repair `772ad8ed...` + changelog correction `ceb68825...` + current #488 `b3d43ad3...` | -| GAP-084 | Legacy Wilson pair admission could accept an exact-zero/exact-one boundary even though the peer endpoint implied a representable non-boundary root | `verification-pending` | RED `c9d612f2...` + causal peer-root repair `88512417...` + branch-complete stable evaluation `6a4f89da...` + symmetry/serde/extreme-boundary contracts `0ce7639b...` + changelog `407b3645...` + current #488 `b3d43ad3...` | -| GAP-085 | Equal nonzero SE-aware subtraction/FMA correction projections could conceal the exact represented-input ordering and turn a strict decision into rounded equality | `verification-pending` | RED `35ea85ba...` + exact product-roundoff repair `7d597a18...` + signed edge `b463a991...` + branch-scope refinement `ca8c2b86...` + changelog `702eec2f...` + current #488 `b3d43ad3...` | -| GAP-086 | Mean signed bias could reject a representable result because individual `recovered - truth` residuals overflow before opposing represented terms cancel | `verification-pending` | RED `04e6e745...` + explicit-denominator cancellation `28b1d186...` + causal bias repair `d1cd5461...` + changelog `d68dde34...` + current #488 `b3d43ad3...` | -| GAP-087 | Mean signed bias mixed-sign cancellation could discard repeated individually sub-ULP opposing residuals even though their combined represented mass changes the final bias | `verification-pending` | RED `63913727...` + error-free low-term repair `5697cca5...` + changelog `53f5c912...` + current #488 `b3d43ad3...` | -| GAP-088 | Mean signed bias mixed-remainder compensation could be rounded into an intermediate numerator before the scientific count division, shifting the represented-input mean by one ULP | `verification-pending` | RED `8b4d19d1...` + causal compensated-division/FMA repair `7a33212b...` + changelog `bad698dd...` + current #488 `b3d43ad3...` | -| GAP-089 | Mean signed bias exact opposite-sign cancellation could leave a same-sign compensated remainder whose `sum + correction` was rounded before the scientific count division, shifting the represented-input mean by one ULP | `verification-pending` | RED `84476aad...` + causal same-sign compensated-division repair `5f0d40b8...` + changelog `5763cde0...` + current #488 `b3d43ad3...` | -| GAP-090 | Same-sign all-subnormal mean normalization could double-round the final represented bias by one ULP at scale restoration | `verification-pending` | RED `91abdb49...`; discarded direct-float repair `e89dc346...`; corrected exact-unit repair `1c0df8a7...`; halfway contract `f79a1b9a...`; regression fixture `eb29a79a...`; changelog `65ff502b...`; research lineage retained by current #488 `b3d43ad3...` | -| GAP-091 | Mean signed bias pairwise subtraction roundoff could move the represented-input mean across a final binary64 midpoint | `verification-pending` | RED `a9d9bda3...` + insufficient first repair `96bff8e5...` + corrected tail/midpoint repair `676ccda0...` + changelog `cbcfa8d6...` + research `1f9e2631...` + two-direction edge `0bff5a8d...` + current #488 `b3d43ad3...` | -| GAP-092 | Bias standard error could report false exact zero when two distinct represented-input residuals both round to the same pairwise binary64 subtraction | `verification-pending` | RED `c9c55ea5...` + causal two-observation expanded-difference repair `f6d7da96...` + changelog `ab7730ca...` + current #488 `b3d43ad3...` | -| GAP-093 | Bias standard error could report false exact zero for n>2 when distinct represented-input residuals collapse to one rounded binary64 subtraction | `verification-pending` | RED `06a70e1c...` + common-high/error-free-low-term repair `04c62514...` + changelog `56d09154...` + corrected oracle `62243204...` + current #488 `b3d43ad3...` | -| GAP-094 | Bias standard error could shift a representable result by one ULP because `sqrt(sample_variance)` and `sqrt(n)` were rounded separately before division | `verification-pending` | corrected-oracle RED `62243204...` + direct normalized-SE repair `8b8f0a21...` + dedicated exact-residual contract `89fd9ef0...` + research `99a220db...` + changelog `184f4e2c...` + current #488 `b3d43ad3...` | -| GAP-095 | Bias standard error could materially overstate n>2 uncertainty when pairwise subtraction roundoff changes represented residual high parts instead of collapsing them all to one value | `verification-pending` | RED `ae906ad6...` + exact translated-residual repair `d59b9c30...` + changelog `89c01863...` + research/current #488 `b3d43ad3...`; exact-head hosted GREEN/review/main integration remain pending | +| GAP-050 | Zero-multiplier SE-aware acceptance could erase a nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; current #488 `32f41460...` | +| GAP-051 | Exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; current #488 `32f41460...` | +| GAP-052 | All-covered Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; current #488 `32f41460...` | +| GAP-053 | Strict-interior Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; current #488 `32f41460...` | +| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; current #488 `32f41460...` | +| GAP-055 | Strict-interior Wilson lower endpoint could accept a nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; current #488 `32f41460...` | +| GAP-056 | Durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; current #488 `32f41460...` | +| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from a generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; current #488 `32f41460...` | +| GAP-058 | Generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; current #488 `32f41460...` | +| GAP-059 | Generic Monte Carlo summary could materially misstate positive SE relative to `SD / sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; current #488 `32f41460...` | +| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; current #488 `32f41460...` | +| GAP-061 | Generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; current #488 `32f41460...` | +| GAP-062 | Finite-tolerance matching could fail while the pair is deterministically outside every finite tolerance | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; current #488 `32f41460...` | +| GAP-063 | Exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; current #488 `32f41460...` | +| GAP-064 | Positive point RMSE could carry SE above the declared squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; current #488 `32f41460...` | +| GAP-065 | Positive Monte Carlo RMSE could carry spread/SE impossible for nonnegative replications | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; current #488 `32f41460...` | +| GAP-066 | RMSE Monte Carlo nearest-rank percentile could exceed total nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; current #488 `32f41460...` | +| GAP-067 | Generic nearest-rank percentile endpoint could be individually incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected over-strong repair `2798e4f9...`; causal repair `c7151b49...`; edge `dbef285b...`; changelog `c38a320c...`; research `2bbcbb24...`; current #488 `32f41460...` | +| GAP-068 | Distinct generic percentile endpoints could each pass individual radius checks while jointly exceeding the sample squared-deviation budget | `verification-pending` | RED `c4a13826...` + causal repair `cb3f80a2...` + changelog `f727450d...`; current #488 `32f41460...` | +| GAP-069 | Two-replication distinct nearest-rank endpoints could exhaust the retained sample while the stored mean or SD remained impossible | `verification-pending` | RED `81bf0d9e...` + causal repair `d48f8fef...` + mean coverage `fb314d8a...` + branch cleanup `440b78d8...` + changelog `45116498...`; current #488 `32f41460...` | +| GAP-070 | Stored Wilson bounds could contain empirical coverage while the lower/upper pair could not arise from one Wilson score interval for that same coverage | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...` + complementary edge `c1cb16a7...`; current #488 `32f41460...` | +| GAP-071 | Durable Wilson evidence lacked denominator and critical-value/sidedness provenance, preventing exact recomputation from a persisted artifact | `active-repair` | valid carrier RED `6f6e06d2...`; shared count/Wilson authority `ca517ed3...`; `WilsonCoverageEvidenceV1` `31e1ab2b...`; sidedness `e9c63926...`/`fdd24a1a...`; envelope RED `07766cb0...` + `ValidationEvidenceV1` repair `a16f22e6...`; current #488 `32f41460...`; remaining: hosted GREEN/review/main plus durable-consumer adoption | +| GAP-072 | Exact all-covered Wilson evidence could retain a zero lower endpoint even though the canonical non-empty finite-`z²` producer always emits `n/(n+z²) > 0` | `verification-pending` | RED `ce714f07...` + non-force source-restore RCA `18499052...` + repair `72e9d954...` + changelog `e3a2f4a2...`; current #488 `32f41460...` | +| GAP-073 | Durable Wilson count provenance could round one uncovered observation away above binary64's exact-integer range and expose a pointer-width-dependent count schema | `verification-pending` | RED `29d710a5...` + complement/count repair `29968c80...` + fixed-width carrier repair `91d9a3bb...` + exact ratio RED/repair `63ddfdd6...`/`11323c57...`; current #488 `32f41460...` | +| GAP-074 | Durable Wilson evidence could correctly retain exact `u64` counts yet pre-round `sample_count` before endpoint projection, shifting strict-interior endpoints or erasing all-covered finite-sample uncertainty | `verification-pending` | RED `f89e2467...` + all-covered edge `1a5180b2...` + stale-oracle correction `6254c498...` + causal reciprocal-scale repair `73bbb5cf...` + changelog `f2b5768b...` + research predecessor `7fc78a59...`; current #488 `32f41460...` | +| GAP-075 | Inexact durable all-covered Wilson evidence could round the complementary miss mass to exact one at extreme finite `z` and erase a representable positive lower endpoint | `verification-pending` | RED `059ce70d...`; transient duplicate-owner implementation `46f91f3f...` excluded; canonical repair `0f478392...`; single-writer cleanup `8e2058f2...`; exact-oracle correction `93d5d208...`; changelog correction `43b6562c...`; research predecessor `b03a719d...`; current #488 `32f41460...` | +| GAP-076 | Exactly representable all-covered Wilson counts could absorb a small positive `z²` in `n + z²` and falsely emit exact `1.0` although a lower binary64 endpoint is representable | `verification-pending` | RED `e0c4ec81...` + causal boundary repair `c9dcb9df...` + below-resolution edge `6140080d...` + changelog `09ebb482...` + research predecessor `fe89c438...`; current #488 `32f41460...` | +| GAP-077 | Exactly representable all-covered Wilson counts could form an inexact partial denominator `n + z²` whose rounded sum shifts the represented-input lower endpoint by one ULP even though neither operand is fully absorbed | `verification-pending` | RED `06e55653...` + causal TwoSum/FMA repair `6c084dbe...` + research `25cc1943...` + changelog `5acc894b...` + predecessor changelog correction `f89e36d1...` + correct-direct-rounding control `80a0a0ad...`; current #488 `32f41460...` | +| GAP-078 | Exact-count all-covered Wilson residual compensation could move a direct quotient by one ULP even when the represented-input rational remains on the same side of the adjacent midpoint | `verification-pending` | RED `d076d344...` + midpoint-selection repair `32314239...` + changelog `a75940c9...` + research predecessor `ef6441f7...`; current #488 `32f41460...` | +| GAP-079 | SE-aware acceptance could underflow a finite positive `k · SE` tolerance to exact zero by dividing `SE` by a much larger estimate/target scale before multiplication | `verification-pending` | RED `76067efc...` + causal direct-finite comparison repair `4ffdf366...` + changelog `d822c0ba...` + current #488 `32f41460...` | +| GAP-080 | SE-aware acceptance both-overflow fallback could normalize an exact strict rejection into an equal rounded residual/bound and falsely accept it | `verification-pending` | RED `a9a45714...` + exact significand/exponent repair `425e8963...` + changelog `e6270629...` + current #488 `32f41460...` | +| GAP-081 | SE-aware acceptance finite/finite multiplication could round an exact strict represented-input rejection into an equal residual/bound and falsely accept it | `verification-pending` | RED `23c3262c...` + tie repair `6a2add48...` + edge coverage `3656deb2...` + changelog `090f5124...` + current #488 `32f41460...` | +| GAP-082 | SE-aware acceptance finite subtraction could round an exact strict represented-input rejection onto an exact finite bound and falsely accept equality | `verification-pending` | RED `58cbc032...` + causal low-term comparison repair `68a6fd98...` + sign-symmetric edge `b2c06512...` + changelog `c4f752f3...` + current #488 `32f41460...` | +| GAP-083 | SE-aware acceptance product correction can fall below binary64 resolution even when the rounded finite bound is subnormal or minimum normal, erasing a strict represented-input rejection | `verification-pending` | RED `b55c5473...` + initial narrow repair `210cebc4...` + minimum-normal RED `c77ac440...` + corrected zero-projection repair `772ad8ed...` + changelog correction `ceb68825...` + current #488 `32f41460...` | +| GAP-084 | Legacy Wilson pair admission could accept an exact-zero/exact-one boundary even though the peer endpoint implied a representable non-boundary root | `verification-pending` | RED `c9d612f2...` + causal peer-root repair `88512417...` + branch-complete stable evaluation `6a4f89da...` + symmetry/serde/extreme-boundary contracts `0ce7639b...` + changelog `407b3645...` + current #488 `32f41460...` | +| GAP-085 | Equal nonzero SE-aware subtraction/FMA correction projections could conceal the exact represented-input ordering and turn a strict decision into rounded equality | `verification-pending` | RED `35ea85ba...` + exact product-roundoff repair `7d597a18...` + signed edge `b463a991...` + branch-scope refinement `ca8c2b86...` + changelog `702eec2f...` + current #488 `32f41460...` | +| GAP-086 | Mean signed bias could reject a representable result because individual `recovered - truth` residuals overflow before opposing represented terms cancel | `verification-pending` | RED `04e6e745...` + explicit-denominator cancellation `28b1d186...` + causal bias repair `d1cd5461...` + changelog `d68dde34...` + current #488 `32f41460...` | +| GAP-087 | Mean signed bias mixed-sign cancellation could discard repeated individually sub-ULP opposing residuals even though their combined represented mass changes the final bias | `verification-pending` | RED `63913727...` + error-free low-term repair `5697cca5...` + changelog `53f5c912...` + current #488 `32f41460...` | +| GAP-088 | Mean signed bias mixed-remainder compensation could be rounded into an intermediate numerator before the scientific count division, shifting the represented-input mean by one ULP | `verification-pending` | RED `8b4d19d1...` + causal compensated-division/FMA repair `7a33212b...` + changelog `bad698dd...` + current #488 `32f41460...` | +| GAP-089 | Mean signed bias exact opposite-sign cancellation could leave a same-sign compensated remainder whose `sum + correction` was rounded before the scientific count division, shifting the represented-input mean by one ULP | `verification-pending` | RED `84476aad...` + causal same-sign compensated-division repair `5f0d40b8...` + changelog `5763cde0...` + current #488 `32f41460...` | +| GAP-090 | Same-sign all-subnormal mean normalization could double-round the final represented bias by one ULP at scale restoration | `verification-pending` | RED `91abdb49...`; discarded direct-float repair `e89dc346...`; corrected exact-unit repair `1c0df8a7...`; halfway contract `f79a1b9a...`; regression fixture `eb29a79a...`; changelog `65ff502b...`; research lineage retained by current #488 `32f41460...` | +| GAP-091 | Mean signed bias pairwise subtraction roundoff could move the represented-input mean across a final binary64 midpoint | `verification-pending` | RED `a9d9bda3...` + insufficient first repair `96bff8e5...` + corrected tail/midpoint repair `676ccda0...` + changelog `cbcfa8d6...` + research `1f9e2631...` + two-direction edge `0bff5a8d...` + current #488 `32f41460...` | +| GAP-092 | Bias standard error could report false exact zero when two distinct represented-input residuals both round to the same pairwise binary64 subtraction | `verification-pending` | RED `c9c55ea5...` + causal two-observation expanded-difference repair `f6d7da96...` + changelog `ab7730ca...` + current #488 `32f41460...` | +| GAP-093 | Bias standard error could report false exact zero for n>2 when distinct represented-input residuals collapse to one rounded binary64 subtraction | `verification-pending` | RED `06a70e1c...` + common-high/error-free-low-term repair `04c62514...` + changelog `56d09154...` + corrected oracle `62243204...` + current #488 `32f41460...` | +| GAP-094 | Bias standard error could shift a representable result by one ULP because `sqrt(sample_variance)` and `sqrt(n)` were rounded separately before division | `verification-pending` | corrected-oracle RED `62243204...` + direct normalized-SE repair `8b8f0a21...` + dedicated exact-residual contract `89fd9ef0...` + research `99a220db...` + changelog `184f4e2c...` + current #488 `32f41460...` | +| GAP-095 | Bias standard error could materially overstate n>2 uncertainty when pairwise subtraction roundoff changes represented residual high parts instead of collapsing them all to one value | `verification-pending` | RED `ae906ad6...` + exact translated-residual repair `d59b9c30...` + changelog `89c01863...` + research `b3d43ad3...` + current #488 `32f41460...` | +| GAP-096 | Bias standard error could materially overstate n>2 uncertainty even with exact pairwise residuals because their mean was rounded before centering, changing the represented deviation geometry | `verification-pending` | RED `9265b34a...` + exact-residual translated-mean repair `2fa266b2...` + changelog `ab361b25...` + research/current #488 `32f41460...`; exact-head hosted GREEN/review/main integration remain pending | ## Release gate From f2139329eec2983eccc2ffd689141708e50ed83e Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 5 Sep 2026 07:07:28 +0900 Subject: [PATCH 190/235] docs(ddd): add GAP-097 validation authority --- docs/product-technical-gap-baseline.md | 117 +++++++++++++------------ 1 file changed, 60 insertions(+), 57 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 988b11924..2b7e058e4 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-04T21:45:40Z +**Snapshot:** 2026-09-04T22:02:12Z **Protected-main evidence:** `a243f18da4a4ca8a8d068c39922537f1f8ed6ad0` **Workspace version:** `0.2.0` @@ -30,7 +30,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `32f414603eacafccc034881d447c8fa7503a029a` | true | `main` | Validation Evidence landing vehicle, based on protected #490. GAP-093 preserves nonzero n>2 bias sampling uncertainty when residual subtraction low terms collapse under one rounded high. GAP-094 removes a one-ULP square-root decomposition error. GAP-095 preserves represented-input dispersion when rounded residual highs differ but exact anchor-relative `high+low` deltas are representable. GAP-096 extends that bounded translated-residual path to exact pairwise residuals so a rounded residual mean cannot change dispersion before centering. GAP-091–092, GAP-086–090, and prior Wilson, provenance, Monte Carlo, RMSE/SE, matching, serde/projection repairs remain inherited. Hosted exact-head gates and independent review remain required. | +| #488 | `57d85e58411afb02e910b8e4138960319dcd8bce` | true | `main` | Validation Evidence landing vehicle, based on protected #490. GAP-093 preserves nonzero n>2 bias sampling uncertainty when residual subtraction low terms collapse under one rounded high. GAP-094 removes a one-ULP square-root decomposition error. GAP-095 preserves represented-input dispersion when rounded residual highs differ but exact anchor-relative `high+low` deltas are representable. GAP-096 extends that bounded translated-residual path to exact pairwise residuals so a rounded residual mean cannot change dispersion before centering. GAP-097 applies the same translated-second-moment proof to common-high subtraction low terms so their rounded mean cannot shift the final SE. GAP-091–092, GAP-086–090, and prior Wilson, provenance, Monte Carlo, RMSE/SE, matching, serde/projection repairs remain inherited. Hosted exact-head gates and independent review remain required. | | #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 | Validation / Analysis Run fold child. Unique evidence must be inherited by a conflict-resolving survivor; child-head CI does not transfer. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | @@ -62,7 +62,7 @@ The clock contract separates event/valid time, assertion time, document time, sy - Row arrival order is not scientific evidence. Fixed admitted observations must produce bit-identical means/centered results under permutation wherever the contract claims deterministic CPU `f64` reference behavior. - Known-truth component recovery follows bounded-context identity: stable `Between` is unit-level and uses canonical `occasion_index = 0`; `Within` retains actual `(unit, occasion)` identity. Duplicate identities or stable-Between occasion aliases are not weights. - A representable final scientific estimand is not rejected solely because an avoidable intermediate binary64 operation overflows/underflows. False exact 0/1/non-finite endpoints, erased finite bounds, cancellation residues, and double-rounded subnormal endpoints are not accepted when a bounded equivalent operation preserves the represented estimand or decision. -- Mean signed bias and bias SE remain Validation Evidence performance measures over admitted recovery units. `mean_bias` uses the direct residual path only when every pairwise subtraction is finite and does not discard represented low-order input mass. Overflowing or inexact finite pairwise subtraction redirects to the algebraically equivalent recovered-plus-negated-truth numerator, which is sign-cancelled before exact-power-of-two scale reduction and divided by the original recovery-unit count. During mixed-sign cancellation, error-free low terms are retained so repeated individually sub-ULP opposing residuals can still change the represented mean when their combined mass is material. Whether compensation comes from retained cancellation low terms or from a same-sign remainder left by exact opposite-sign cancellation, the canonical Neumaier high part, division residual, and correction are carried through the original scientific denominator before final scale restoration. For a same-sign all-subnormal remainder whose scientific divisor is at least the surviving term count, each represented magnitude is an exact integer number of `2^-1074` units; those units are summed in bounded integer arithmetic and quotient/remainder ties-to-even is applied once at the final subnormal grid. `bias_standard_error` still requires each individual signed residual to be representable. For exactly two observations, if either finite pairwise subtraction has error-free roundoff, TEPP evaluates `SE(mean) = |r1-r2| / 2` from expanded represented inputs. For larger samples in which subtraction roundoff exists and every rounded residual shares the same binary64 high part, that common high part is dispersion-invariant and the standard error is evaluated from the error-free subtraction low terms. For other `n > 2` samples, including exact pairwise residuals and distinct rounded highs, TEPP uses the error-free `high + low` representation only if every anchor-relative high delta, low delta, and combined residual delta is itself exactly representable. Translation leaves variance unchanged, so an O(n) translated second moment avoids making either rounded pairwise residuals or a rounded residual mean authoritative before dispersion is evaluated. If that exact-delta precondition cannot be established, the predecessor rounded-residual/rounded-mean path remains the bounded fallback rather than silently widening the contract. The normalized standard error is formed as `sqrt(sum(d²) / (n * (n - 1)))` after scale reduction, avoiding separately rounded `sqrt(sample_variance)` and `sqrt(n)` operands. These are bounded repairs, not a claim of globally correctly rounded n>2 dispersion. Mathematically nonzero final results below or above binary64 range fail closed. +- Mean signed bias and bias SE remain Validation Evidence performance measures over admitted recovery units. `mean_bias` uses the direct residual path only when every pairwise subtraction is finite and does not discard represented low-order input mass. Overflowing or inexact finite pairwise subtraction redirects to the algebraically equivalent recovered-plus-negated-truth numerator, which is sign-cancelled before exact-power-of-two scale reduction and divided by the original recovery-unit count. During mixed-sign cancellation, error-free low terms are retained so repeated individually sub-ULP opposing residuals can still change the represented mean when their combined mass is material. Whether compensation comes from retained cancellation low terms or from a same-sign remainder left by exact opposite-sign cancellation, the canonical Neumaier high part, division residual, and correction are carried through the original scientific denominator before final scale restoration. For a same-sign all-subnormal remainder whose scientific divisor is at least the surviving term count, each represented magnitude is an exact integer number of `2^-1074` units; those units are summed in bounded integer arithmetic and quotient/remainder ties-to-even is applied once at the final subnormal grid. `bias_standard_error` still requires each individual signed residual to be representable. For exactly two observations, if either finite pairwise subtraction has error-free roundoff, TEPP evaluates `SE(mean) = |r1-r2| / 2` from expanded represented inputs. For larger samples in which subtraction roundoff exists and every rounded residual shares the same binary64 high part, that common high part is dispersion-invariant; TEPP evaluates the retained error-free subtraction low terms with the exact translated-residual second moment whenever every anchor-relative low-term delta is exactly representable, and otherwise retains the predecessor scaled low-term mean/deviation fallback. For other `n > 2` samples, including exact pairwise residuals and distinct rounded highs, TEPP uses the error-free `high + low` representation only if every anchor-relative high delta, low delta, and combined residual delta is itself exactly representable. Translation leaves variance unchanged, so an O(n) translated second moment avoids making either rounded pairwise residuals, a rounded residual mean, or a rounded low-term mean authoritative before dispersion is evaluated. If that exact-delta precondition cannot be established, the predecessor rounded-residual/rounded-mean path remains the bounded fallback rather than silently widening the contract. The normalized standard error is formed as `sqrt(sum(d²) / (n * (n - 1)))` after scale reduction, avoiding separately rounded `sqrt(sample_variance)` and `sqrt(n)` operands. These are bounded repairs, not a claim of globally correctly rounded n>2 dispersion. Mathematically nonzero final results below or above binary64 range fail closed. - Generic Validation Evidence RMSE and its delta-method SE normalize before squaring. Exact-zero point RMSE requires exact-zero point RMSE SE. For positive RMSE, the declared producer satisfies `SE(RMSE) <= RMSE / 2`, with a small relative binary64 admission tolerance. - Generic `MonteCarloSummary` is sign-neutral. Zero SD requires zero SE and percentile endpoints equal to the represented mean. Positive SD requires positive SE coherent with represented `SD / sqrt(n)` within a small relative tolerance. Every inclusive nearest-rank endpoint is a retained observation and satisfies `|endpoint - mean| <= SD * sqrt(n - 1)`. Distinct lower/upper endpoint values share the same `(n - 1) * SD²` deviation budget. When `replication_count = 2` and endpoints are numerically distinct, those values exhaust the retained sample and the recorded represented mean/sample SD must match deterministic two-value reconstruction. Equal numeric endpoints do not prove two distinct ranks and are not subjected to that exhaustion rule. - When the generic carrier occupies `ValidationReport::monte_carlo_rmse`, retained replications are nonnegative; positive mean implies `SE(mean) <= mean`, and inclusive nearest-rank endpoints cannot exceed nonnegative sample-sum support `n * mean`. These typed bounds are not imposed on signed metrics such as bias. @@ -83,15 +83,17 @@ The clock contract separates event/valid time, assertion time, document time, sy ### #488 — Validation Evidence -#488 is the generic Validation Evidence landing vehicle at exact head `32f414603eacafccc034881d447c8fa7503a029a`, based on protected #490. GAP-093 RED `06a70e1c01629f15f05efef48576a9cadb1f1b98` proves that `truth=[2^-54,2^-55,0]`, `recovered=[1,1,1]` contains three distinct represented-input residuals although every binary64 pairwise subtraction rounds to `1.0`; the predecessor therefore emitted false exact-zero uncertainty. First causal repair `04c62514a23722d63a62bd5d5af6e3a930cc3147` exposes the error-free subtraction low terms and, only when every rounded high part is equal, evaluates dispersion from those low terms in O(n). CHANGELOG `56d091544a5780567a6ef772568d62b0fc651747`. +#488 is the generic Validation Evidence landing vehicle at exact head `57d85e58411afb02e910b8e4138960319dcd8bce`, based on protected #490. GAP-093 RED `06a70e1c01629f15f05efef48576a9cadb1f1b98` proves that `truth=[2^-54,2^-55,0]`, `recovered=[1,1,1]` contains three distinct represented-input residuals although every binary64 pairwise subtraction rounds to `1.0`; the predecessor therefore emitted false exact-zero uncertainty. First causal repair `04c62514a23722d63a62bd5d5af6e3a930cc3147` exposes the error-free subtraction low terms and, only when every rounded high part is equal, evaluates dispersion from those low terms in O(n). CHANGELOG `56d091544a5780567a6ef772568d62b0fc651747`. Oracle correction/RED `6224320410ccabb1cf16d36cc12f88e2b7a05bb1` then established GAP-094: exact high-precision evaluation of represented-input `SE=2^-55/sqrt(3)` rounds to `0x3c72_79a7_4590_331c`, not the `...331d` value produced by separately rounded `sqrt(sample_variance)/sqrt(n)`. Causal repair `8b8f0a21ccc825f355859cadbf20d83f04d2369f` forms the bounded normalized expression `sqrt(sum(d²)/(n(n-1)))`. Dedicated public contract `89fd9ef0add3930346900f75518708978ec9861e` reproduces the same one-ULP defect with exact residuals and no subtraction collapse; CHANGELOG `184f4e2c109c7904027f782e91b8d9a01a1d46f1`. GAP-095 RED `ae906ad609aa4eb948b8311c1cebd975f55eb2f6` proves the distinct-high boundary: `truth=[2^-54,3*2^-54,0]`, `recovered=[1,1,1]` has exact represented residuals `[1-2^-54,1-3*2^-54,1]` with `SE=2^-54*sqrt(7)/3`, rounding to `0x3c8c_38aa_37c3_f68d`, while the predecessor rounded-residual vector yields `0x3c96_a09e_667f_3bcd`. Causal repair `d59b9c30bf810a6dc6fdceaba6d20e048fad985a` preserves the existing n=2/common-high paths, reconstructs only provably exact anchor-relative `high+low` residual deltas, and evaluates their translation-invariant second moment in O(n). CHANGELOG `89c018630d5baadef04a8167034951b7e378a4b2`. -GAP-096 RED `9265b34a2163f45bd232d628c20f725d2844f50a` then proves a separate exact-residual failure. With `a=2^-52`, exact residuals `[1,1-a,1]` have represented-input `SE=a/3`, bits `0x3c95_5555_5555_5555`, but rounding their mean first produces deviations `[2^-53,-2^-53,2^-53]` and `0x3c96_a09e_667f_3bcd`. Causal repair `2fa266b21069460370f30243cfb498e2022888bf` reuses GAP-095's exact translated-residual path for all `n>2` samples satisfying its exact-delta preconditions, even when pairwise subtraction roundoff is zero. CHANGELOG `ab361b25ec4296165f89e4eff26e6d3521c00571`; research/current #488 `32f414603eacafccc034881d447c8fa7503a029a`. +GAP-096 RED `9265b34a2163f45bd232d628c20f725d2844f50a` then proves a separate exact-residual failure. With `a=2^-52`, exact residuals `[1,1-a,1]` have represented-input `SE=a/3`, bits `0x3c95_5555_5555_5555`, but rounding their mean first produces deviations `[2^-53,-2^-53,2^-53]` and `0x3c96_a09e_667f_3bcd`. Causal repair `2fa266b21069460370f30243cfb498e2022888bf` reuses GAP-095's exact translated-residual path for all `n>2` samples satisfying its exact-delta preconditions, even when pairwise subtraction roundoff is zero. CHANGELOG `ab361b25ec4296165f89e4eff26e6d3521c00571`. -GAP-092 remains inherited for the exact two-observation subtraction-roundoff identity, and GAP-091 remains inherited for mean-bias subtraction roundoff. GAP-086–GAP-090 and earlier Wilson, provenance, Monte Carlo, RMSE/SE, matching, serde/projection repairs remain inherited. GAP-071/GAP-073–GAP-096 remain delivery-pending until current-head hosted gates, independent review, protected-main integration, and required durable-consumer adoption are verified. Bare legacy `ValidationReport` remains a backward-compatible compact projection and is not silently treated as v1 provenance. +GAP-097 RED `d48e2515d62dfbe0a807b5dba40fbb7034d4fa9d` proves that the GAP-093 common-high special path still had its own rounded-mean boundary. With `q=2^-54`, `truth=[q,0,0]`, and `recovered=[1,1,1]`, all rounded residual highs are `1.0`, but the exact represented low terms are `[-q,0,0]` and `SE(mean)=q/3`, bits `0x3c75_5555_5555_5555`. Rounding the low-term mean before centering moves the result one ULP upward. Causal repair `a63b8d7a8e79146cbb17ceb17855bcca312535a1` evaluates those low terms through GAP-095/096's exact translated-residual second moment when anchor-relative low-term deltas are exactly representable and otherwise retains the bounded predecessor fallback. CHANGELOG `6fc8e82839389f2f8c07e1cf7ba78a29f19d2510`; research/current #488 `57d85e58411afb02e910b8e4138960319dcd8bce`. + +GAP-092 remains inherited for the exact two-observation subtraction-roundoff identity, and GAP-091 remains inherited for mean-bias subtraction roundoff. GAP-086–GAP-090 and earlier Wilson, provenance, Monte Carlo, RMSE/SE, matching, serde/projection repairs remain inherited. GAP-071/GAP-073–GAP-097 remain delivery-pending until current-head hosted gates, independent review, protected-main integration, and required durable-consumer adoption are verified. Bare legacy `ValidationReport` remains a backward-compatible compact projection and is not silently treated as v1 provenance. ### #416 — Validation / Analysis Run consolidation @@ -149,58 +151,59 @@ GAP-092 remains inherited for the exact two-observation subtraction-roundoff ide | GAP-042 | Ratio-first logarithm could nearly double an adjacent-float irregular residual growth rate | `verification-pending` | RED `766ddc7a...` + `ln_1p` repair `16f21d9a...` | | GAP-043 | Duplicate known-truth component identities could silently reweight RMSE recovery evidence | `verification-pending` | RED `698f12f5...` + uniqueness repair `2fae4cb2...` | | GAP-044 | Known-truth RMSE alignment/accumulation depended on row order instead of component identity | `verification-pending` | RED `8ad72ac9...` / `5fb93c40...` + repairs `2dd9537e...` / `025dce7f...`; #310 `c6680450...` | -| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; current #488 `32f41460...` | -| GAP-046 | Bias SE could reject a representable SEM because raw squared deviations/intermediates overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; current #488 `32f41460...` | -| GAP-047 | Generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; current #488 `32f41460...` | -| GAP-048 | Mean signed bias could erase a representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; current #488 `32f41460...` | +| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; current #488 `57d85e58...` | +| GAP-046 | Bias SE could reject a representable SEM because raw squared deviations/intermediates overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; current #488 `57d85e58...` | +| GAP-047 | Generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; current #488 `57d85e58...` | +| GAP-048 | Mean signed bias could erase a representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; current #488 `57d85e58...` | | GAP-049 | Stable `Between` recovery could be aliased across occasion indices and reweight RMSE | `verification-pending` | RED `0a03041c...` + repair `ec2c1219...`; #310 `c6680450...` | -| GAP-050 | Zero-multiplier SE-aware acceptance could erase a nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; current #488 `32f41460...` | -| GAP-051 | Exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; current #488 `32f41460...` | -| GAP-052 | All-covered Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; current #488 `32f41460...` | -| GAP-053 | Strict-interior Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; current #488 `32f41460...` | -| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; current #488 `32f41460...` | -| GAP-055 | Strict-interior Wilson lower endpoint could accept a nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; current #488 `32f41460...` | -| GAP-056 | Durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; current #488 `32f41460...` | -| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from a generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; current #488 `32f41460...` | -| GAP-058 | Generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; current #488 `32f41460...` | -| GAP-059 | Generic Monte Carlo summary could materially misstate positive SE relative to `SD / sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; current #488 `32f41460...` | -| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; current #488 `32f41460...` | -| GAP-061 | Generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; current #488 `32f41460...` | -| GAP-062 | Finite-tolerance matching could fail while the pair is deterministically outside every finite tolerance | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; current #488 `32f41460...` | -| GAP-063 | Exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; current #488 `32f41460...` | -| GAP-064 | Positive point RMSE could carry SE above the declared squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; current #488 `32f41460...` | -| GAP-065 | Positive Monte Carlo RMSE could carry spread/SE impossible for nonnegative replications | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; current #488 `32f41460...` | -| GAP-066 | RMSE Monte Carlo nearest-rank percentile could exceed total nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; current #488 `32f41460...` | -| GAP-067 | Generic nearest-rank percentile endpoint could be individually incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected over-strong repair `2798e4f9...`; causal repair `c7151b49...`; edge `dbef285b...`; changelog `c38a320c...`; research `2bbcbb24...`; current #488 `32f41460...` | -| GAP-068 | Distinct generic percentile endpoints could each pass individual radius checks while jointly exceeding the sample squared-deviation budget | `verification-pending` | RED `c4a13826...` + causal repair `cb3f80a2...` + changelog `f727450d...`; current #488 `32f41460...` | -| GAP-069 | Two-replication distinct nearest-rank endpoints could exhaust the retained sample while the stored mean or SD remained impossible | `verification-pending` | RED `81bf0d9e...` + causal repair `d48f8fef...` + mean coverage `fb314d8a...` + branch cleanup `440b78d8...` + changelog `45116498...`; current #488 `32f41460...` | -| GAP-070 | Stored Wilson bounds could contain empirical coverage while the lower/upper pair could not arise from one Wilson score interval for that same coverage | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...` + complementary edge `c1cb16a7...`; current #488 `32f41460...` | -| GAP-071 | Durable Wilson evidence lacked denominator and critical-value/sidedness provenance, preventing exact recomputation from a persisted artifact | `active-repair` | valid carrier RED `6f6e06d2...`; shared count/Wilson authority `ca517ed3...`; `WilsonCoverageEvidenceV1` `31e1ab2b...`; sidedness `e9c63926...`/`fdd24a1a...`; envelope RED `07766cb0...` + `ValidationEvidenceV1` repair `a16f22e6...`; current #488 `32f41460...`; remaining: hosted GREEN/review/main plus durable-consumer adoption | -| GAP-072 | Exact all-covered Wilson evidence could retain a zero lower endpoint even though the canonical non-empty finite-`z²` producer always emits `n/(n+z²) > 0` | `verification-pending` | RED `ce714f07...` + non-force source-restore RCA `18499052...` + repair `72e9d954...` + changelog `e3a2f4a2...`; current #488 `32f41460...` | -| GAP-073 | Durable Wilson count provenance could round one uncovered observation away above binary64's exact-integer range and expose a pointer-width-dependent count schema | `verification-pending` | RED `29d710a5...` + complement/count repair `29968c80...` + fixed-width carrier repair `91d9a3bb...` + exact ratio RED/repair `63ddfdd6...`/`11323c57...`; current #488 `32f41460...` | -| GAP-074 | Durable Wilson evidence could correctly retain exact `u64` counts yet pre-round `sample_count` before endpoint projection, shifting strict-interior endpoints or erasing all-covered finite-sample uncertainty | `verification-pending` | RED `f89e2467...` + all-covered edge `1a5180b2...` + stale-oracle correction `6254c498...` + causal reciprocal-scale repair `73bbb5cf...` + changelog `f2b5768b...` + research predecessor `7fc78a59...`; current #488 `32f41460...` | -| GAP-075 | Inexact durable all-covered Wilson evidence could round the complementary miss mass to exact one at extreme finite `z` and erase a representable positive lower endpoint | `verification-pending` | RED `059ce70d...`; transient duplicate-owner implementation `46f91f3f...` excluded; canonical repair `0f478392...`; single-writer cleanup `8e2058f2...`; exact-oracle correction `93d5d208...`; changelog correction `43b6562c...`; research predecessor `b03a719d...`; current #488 `32f41460...` | -| GAP-076 | Exactly representable all-covered Wilson counts could absorb a small positive `z²` in `n + z²` and falsely emit exact `1.0` although a lower binary64 endpoint is representable | `verification-pending` | RED `e0c4ec81...` + causal boundary repair `c9dcb9df...` + below-resolution edge `6140080d...` + changelog `09ebb482...` + research predecessor `fe89c438...`; current #488 `32f41460...` | -| GAP-077 | Exactly representable all-covered Wilson counts could form an inexact partial denominator `n + z²` whose rounded sum shifts the represented-input lower endpoint by one ULP even though neither operand is fully absorbed | `verification-pending` | RED `06e55653...` + causal TwoSum/FMA repair `6c084dbe...` + research `25cc1943...` + changelog `5acc894b...` + predecessor changelog correction `f89e36d1...` + correct-direct-rounding control `80a0a0ad...`; current #488 `32f41460...` | -| GAP-078 | Exact-count all-covered Wilson residual compensation could move a direct quotient by one ULP even when the represented-input rational remains on the same side of the adjacent midpoint | `verification-pending` | RED `d076d344...` + midpoint-selection repair `32314239...` + changelog `a75940c9...` + research predecessor `ef6441f7...`; current #488 `32f41460...` | -| GAP-079 | SE-aware acceptance could underflow a finite positive `k · SE` tolerance to exact zero by dividing `SE` by a much larger estimate/target scale before multiplication | `verification-pending` | RED `76067efc...` + causal direct-finite comparison repair `4ffdf366...` + changelog `d822c0ba...` + current #488 `32f41460...` | -| GAP-080 | SE-aware acceptance both-overflow fallback could normalize an exact strict rejection into an equal rounded residual/bound and falsely accept it | `verification-pending` | RED `a9a45714...` + exact significand/exponent repair `425e8963...` + changelog `e6270629...` + current #488 `32f41460...` | -| GAP-081 | SE-aware acceptance finite/finite multiplication could round an exact strict represented-input rejection into an equal residual/bound and falsely accept it | `verification-pending` | RED `23c3262c...` + tie repair `6a2add48...` + edge coverage `3656deb2...` + changelog `090f5124...` + current #488 `32f41460...` | -| GAP-082 | SE-aware acceptance finite subtraction could round an exact strict represented-input rejection onto an exact finite bound and falsely accept equality | `verification-pending` | RED `58cbc032...` + causal low-term comparison repair `68a6fd98...` + sign-symmetric edge `b2c06512...` + changelog `c4f752f3...` + current #488 `32f41460...` | -| GAP-083 | SE-aware acceptance product correction can fall below binary64 resolution even when the rounded finite bound is subnormal or minimum normal, erasing a strict represented-input rejection | `verification-pending` | RED `b55c5473...` + initial narrow repair `210cebc4...` + minimum-normal RED `c77ac440...` + corrected zero-projection repair `772ad8ed...` + changelog correction `ceb68825...` + current #488 `32f41460...` | -| GAP-084 | Legacy Wilson pair admission could accept an exact-zero/exact-one boundary even though the peer endpoint implied a representable non-boundary root | `verification-pending` | RED `c9d612f2...` + causal peer-root repair `88512417...` + branch-complete stable evaluation `6a4f89da...` + symmetry/serde/extreme-boundary contracts `0ce7639b...` + changelog `407b3645...` + current #488 `32f41460...` | -| GAP-085 | Equal nonzero SE-aware subtraction/FMA correction projections could conceal the exact represented-input ordering and turn a strict decision into rounded equality | `verification-pending` | RED `35ea85ba...` + exact product-roundoff repair `7d597a18...` + signed edge `b463a991...` + branch-scope refinement `ca8c2b86...` + changelog `702eec2f...` + current #488 `32f41460...` | -| GAP-086 | Mean signed bias could reject a representable result because individual `recovered - truth` residuals overflow before opposing represented terms cancel | `verification-pending` | RED `04e6e745...` + explicit-denominator cancellation `28b1d186...` + causal bias repair `d1cd5461...` + changelog `d68dde34...` + current #488 `32f41460...` | -| GAP-087 | Mean signed bias mixed-sign cancellation could discard repeated individually sub-ULP opposing residuals even though their combined represented mass changes the final bias | `verification-pending` | RED `63913727...` + error-free low-term repair `5697cca5...` + changelog `53f5c912...` + current #488 `32f41460...` | -| GAP-088 | Mean signed bias mixed-remainder compensation could be rounded into an intermediate numerator before the scientific count division, shifting the represented-input mean by one ULP | `verification-pending` | RED `8b4d19d1...` + causal compensated-division/FMA repair `7a33212b...` + changelog `bad698dd...` + current #488 `32f41460...` | -| GAP-089 | Mean signed bias exact opposite-sign cancellation could leave a same-sign compensated remainder whose `sum + correction` was rounded before the scientific count division, shifting the represented-input mean by one ULP | `verification-pending` | RED `84476aad...` + causal same-sign compensated-division repair `5f0d40b8...` + changelog `5763cde0...` + current #488 `32f41460...` | -| GAP-090 | Same-sign all-subnormal mean normalization could double-round the final represented bias by one ULP at scale restoration | `verification-pending` | RED `91abdb49...`; discarded direct-float repair `e89dc346...`; corrected exact-unit repair `1c0df8a7...`; halfway contract `f79a1b9a...`; regression fixture `eb29a79a...`; changelog `65ff502b...`; research lineage retained by current #488 `32f41460...` | -| GAP-091 | Mean signed bias pairwise subtraction roundoff could move the represented-input mean across a final binary64 midpoint | `verification-pending` | RED `a9d9bda3...` + insufficient first repair `96bff8e5...` + corrected tail/midpoint repair `676ccda0...` + changelog `cbcfa8d6...` + research `1f9e2631...` + two-direction edge `0bff5a8d...` + current #488 `32f41460...` | -| GAP-092 | Bias standard error could report false exact zero when two distinct represented-input residuals both round to the same pairwise binary64 subtraction | `verification-pending` | RED `c9c55ea5...` + causal two-observation expanded-difference repair `f6d7da96...` + changelog `ab7730ca...` + current #488 `32f41460...` | -| GAP-093 | Bias standard error could report false exact zero for n>2 when distinct represented-input residuals collapse to one rounded binary64 subtraction | `verification-pending` | RED `06a70e1c...` + common-high/error-free-low-term repair `04c62514...` + changelog `56d09154...` + corrected oracle `62243204...` + current #488 `32f41460...` | -| GAP-094 | Bias standard error could shift a representable result by one ULP because `sqrt(sample_variance)` and `sqrt(n)` were rounded separately before division | `verification-pending` | corrected-oracle RED `62243204...` + direct normalized-SE repair `8b8f0a21...` + dedicated exact-residual contract `89fd9ef0...` + research `99a220db...` + changelog `184f4e2c...` + current #488 `32f41460...` | -| GAP-095 | Bias standard error could materially overstate n>2 uncertainty when pairwise subtraction roundoff changes represented residual high parts instead of collapsing them all to one value | `verification-pending` | RED `ae906ad6...` + exact translated-residual repair `d59b9c30...` + changelog `89c01863...` + research `b3d43ad3...` + current #488 `32f41460...` | -| GAP-096 | Bias standard error could materially overstate n>2 uncertainty even with exact pairwise residuals because their mean was rounded before centering, changing the represented deviation geometry | `verification-pending` | RED `9265b34a...` + exact-residual translated-mean repair `2fa266b2...` + changelog `ab361b25...` + research/current #488 `32f41460...`; exact-head hosted GREEN/review/main integration remain pending | +| GAP-050 | Zero-multiplier SE-aware acceptance could erase a nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; current #488 `57d85e58...` | +| GAP-051 | Exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; current #488 `57d85e58...` | +| GAP-052 | All-covered Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; current #488 `57d85e58...` | +| GAP-053 | Strict-interior Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; current #488 `57d85e58...` | +| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; current #488 `57d85e58...` | +| GAP-055 | Strict-interior Wilson lower endpoint could accept a nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; current #488 `57d85e58...` | +| GAP-056 | Durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; current #488 `57d85e58...` | +| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from a generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; current #488 `57d85e58...` | +| GAP-058 | Generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; current #488 `57d85e58...` | +| GAP-059 | Generic Monte Carlo summary could materially misstate positive SE relative to `SD / sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; current #488 `57d85e58...` | +| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; current #488 `57d85e58...` | +| GAP-061 | Generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; current #488 `57d85e58...` | +| GAP-062 | Finite-tolerance matching could fail while the pair is deterministically outside every finite tolerance | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; current #488 `57d85e58...` | +| GAP-063 | Exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; current #488 `57d85e58...` | +| GAP-064 | Positive point RMSE could carry SE above the declared squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; current #488 `57d85e58...` | +| GAP-065 | Positive Monte Carlo RMSE could carry spread/SE impossible for nonnegative replications | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; current #488 `57d85e58...` | +| GAP-066 | RMSE Monte Carlo nearest-rank percentile could exceed total nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; current #488 `57d85e58...` | +| GAP-067 | Generic nearest-rank percentile endpoint could be individually incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected over-strong repair `2798e4f9...`; causal repair `c7151b49...`; edge `dbef285b...`; changelog `c38a320c...`; research `2bbcbb24...`; current #488 `57d85e58...` | +| GAP-068 | Distinct generic percentile endpoints could each pass individual radius checks while jointly exceeding the sample squared-deviation budget | `verification-pending` | RED `c4a13826...` + causal repair `cb3f80a2...` + changelog `f727450d...`; current #488 `57d85e58...` | +| GAP-069 | Two-replication distinct nearest-rank endpoints could exhaust the retained sample while the stored mean or SD remained impossible | `verification-pending` | RED `81bf0d9e...` + causal repair `d48f8fef...` + mean coverage `fb314d8a...` + branch cleanup `440b78d8...` + changelog `45116498...`; current #488 `57d85e58...` | +| GAP-070 | Stored Wilson bounds could contain empirical coverage while the lower/upper pair could not arise from one Wilson score interval for that same coverage | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...` + complementary edge `c1cb16a7...`; current #488 `57d85e58...` | +| GAP-071 | Durable Wilson evidence lacked denominator and critical-value/sidedness provenance, preventing exact recomputation from a persisted artifact | `active-repair` | valid carrier RED `6f6e06d2...`; shared count/Wilson authority `ca517ed3...`; `WilsonCoverageEvidenceV1` `31e1ab2b...`; sidedness `e9c63926...`/`fdd24a1a...`; envelope RED `07766cb0...` + `ValidationEvidenceV1` repair `a16f22e6...`; current #488 `57d85e58...`; remaining: hosted GREEN/review/main plus durable-consumer adoption | +| GAP-072 | Exact all-covered Wilson evidence could retain a zero lower endpoint even though the canonical non-empty finite-`z²` producer always emits `n/(n+z²) > 0` | `verification-pending` | RED `ce714f07...` + non-force source-restore RCA `18499052...` + repair `72e9d954...` + changelog `e3a2f4a2...`; current #488 `57d85e58...` | +| GAP-073 | Durable Wilson count provenance could round one uncovered observation away above binary64's exact-integer range and expose a pointer-width-dependent count schema | `verification-pending` | RED `29d710a5...` + complement/count repair `29968c80...` + fixed-width carrier repair `91d9a3bb...` + exact ratio RED/repair `63ddfdd6...`/`11323c57...`; current #488 `57d85e58...` | +| GAP-074 | Durable Wilson evidence could correctly retain exact `u64` counts yet pre-round `sample_count` before endpoint projection, shifting strict-interior endpoints or erasing all-covered finite-sample uncertainty | `verification-pending` | RED `f89e2467...` + all-covered edge `1a5180b2...` + stale-oracle correction `6254c498...` + causal reciprocal-scale repair `73bbb5cf...` + changelog `f2b5768b...` + research predecessor `7fc78a59...`; current #488 `57d85e58...` | +| GAP-075 | Inexact durable all-covered Wilson evidence could round the complementary miss mass to exact one at extreme finite `z` and erase a representable positive lower endpoint | `verification-pending` | RED `059ce70d...`; transient duplicate-owner implementation `46f91f3f...` excluded; canonical repair `0f478392...`; single-writer cleanup `8e2058f2...`; exact-oracle correction `93d5d208...`; changelog correction `43b6562c...`; research predecessor `b03a719d...`; current #488 `57d85e58...` | +| GAP-076 | Exactly representable all-covered Wilson counts could absorb a small positive `z²` in `n + z²` and falsely emit exact `1.0` although a lower binary64 endpoint is representable | `verification-pending` | RED `e0c4ec81...` + causal boundary repair `c9dcb9df...` + below-resolution edge `6140080d...` + changelog `09ebb482...` + research predecessor `fe89c438...`; current #488 `57d85e58...` | +| GAP-077 | Exactly representable all-covered Wilson counts could form an inexact partial denominator `n + z²` whose rounded sum shifts the represented-input lower endpoint by one ULP even though neither operand is fully absorbed | `verification-pending` | RED `06e55653...` + causal TwoSum/FMA repair `6c084dbe...` + research `25cc1943...` + changelog `5acc894b...` + predecessor changelog correction `f89e36d1...` + correct-direct-rounding control `80a0a0ad...`; current #488 `57d85e58...` | +| GAP-078 | Exact-count all-covered Wilson residual compensation could move a direct quotient by one ULP even when the represented-input rational remains on the same side of the adjacent midpoint | `verification-pending` | RED `d076d344...` + midpoint-selection repair `32314239...` + changelog `a75940c9...` + research predecessor `ef6441f7...`; current #488 `57d85e58...` | +| GAP-079 | SE-aware acceptance could underflow a finite positive `k · SE` tolerance to exact zero by dividing `SE` by a much larger estimate/target scale before multiplication | `verification-pending` | RED `76067efc...` + causal direct-finite comparison repair `4ffdf366...` + changelog `d822c0ba...` + current #488 `57d85e58...` | +| GAP-080 | SE-aware acceptance both-overflow fallback could normalize an exact strict rejection into an equal rounded residual/bound and falsely accept it | `verification-pending` | RED `a9a45714...` + exact significand/exponent repair `425e8963...` + changelog `e6270629...` + current #488 `57d85e58...` | +| GAP-081 | SE-aware acceptance finite/finite multiplication could round an exact strict represented-input rejection into an equal residual/bound and falsely accept it | `verification-pending` | RED `23c3262c...` + tie repair `6a2add48...` + edge coverage `3656deb2...` + changelog `090f5124...` + current #488 `57d85e58...` | +| GAP-082 | SE-aware acceptance finite subtraction could round an exact strict represented-input rejection onto an exact finite bound and falsely accept equality | `verification-pending` | RED `58cbc032...` + causal low-term comparison repair `68a6fd98...` + sign-symmetric edge `b2c06512...` + changelog `c4f752f3...` + current #488 `57d85e58...` | +| GAP-083 | SE-aware acceptance product correction can fall below binary64 resolution even when the rounded finite bound is subnormal or minimum normal, erasing a strict represented-input rejection | `verification-pending` | RED `b55c5473...` + initial narrow repair `210cebc4...` + minimum-normal RED `c77ac440...` + corrected zero-projection repair `772ad8ed...` + changelog correction `ceb68825...` + current #488 `57d85e58...` | +| GAP-084 | Legacy Wilson pair admission could accept an exact-zero/exact-one boundary even though the peer endpoint implied a representable non-boundary root | `verification-pending` | RED `c9d612f2...` + causal peer-root repair `88512417...` + branch-complete stable evaluation `6a4f89da...` + symmetry/serde/extreme-boundary contracts `0ce7639b...` + changelog `407b3645...` + current #488 `57d85e58...` | +| GAP-085 | Equal nonzero SE-aware subtraction/FMA correction projections could conceal the exact represented-input ordering and turn a strict decision into rounded equality | `verification-pending` | RED `35ea85ba...` + exact product-roundoff repair `7d597a18...` + signed edge `b463a991...` + branch-scope refinement `ca8c2b86...` + changelog `702eec2f...` + current #488 `57d85e58...` | +| GAP-086 | Mean signed bias could reject a representable result because individual `recovered - truth` residuals overflow before opposing represented terms cancel | `verification-pending` | RED `04e6e745...` + explicit-denominator cancellation `28b1d186...` + causal bias repair `d1cd5461...` + changelog `d68dde34...` + current #488 `57d85e58...` | +| GAP-087 | Mean signed bias mixed-sign cancellation could discard repeated individually sub-ULP opposing residuals even though their combined represented mass changes the final bias | `verification-pending` | RED `63913727...` + error-free low-term repair `5697cca5...` + changelog `53f5c912...` + current #488 `57d85e58...` | +| GAP-088 | Mean signed bias mixed-remainder compensation could be rounded into an intermediate numerator before the scientific count division, shifting the represented-input mean by one ULP | `verification-pending` | RED `8b4d19d1...` + causal compensated-division/FMA repair `7a33212b...` + changelog `bad698dd...` + current #488 `57d85e58...` | +| GAP-089 | Mean signed bias exact opposite-sign cancellation could leave a same-sign compensated remainder whose `sum + correction` was rounded before the scientific count division, shifting the represented-input mean by one ULP | `verification-pending` | RED `84476aad...` + causal same-sign compensated-division repair `5f0d40b8...` + changelog `5763cde0...` + current #488 `57d85e58...` | +| GAP-090 | Same-sign all-subnormal mean normalization could double-round the final represented bias by one ULP at scale restoration | `verification-pending` | RED `91abdb49...`; discarded direct-float repair `e89dc346...`; corrected exact-unit repair `1c0df8a7...`; halfway contract `f79a1b9a...`; regression fixture `eb29a79a...`; changelog `65ff502b...`; research lineage retained by current #488 `57d85e58...` | +| GAP-091 | Mean signed bias pairwise subtraction roundoff could move the represented-input mean across a final binary64 midpoint | `verification-pending` | RED `a9d9bda3...` + insufficient first repair `96bff8e5...` + corrected tail/midpoint repair `676ccda0...` + changelog `cbcfa8d6...` + research `1f9e2631...` + two-direction edge `0bff5a8d...` + current #488 `57d85e58...` | +| GAP-092 | Bias standard error could report false exact zero when two distinct represented-input residuals both round to the same pairwise binary64 subtraction | `verification-pending` | RED `c9c55ea5...` + causal two-observation expanded-difference repair `f6d7da96...` + changelog `ab7730ca...` + current #488 `57d85e58...` | +| GAP-093 | Bias standard error could report false exact zero for n>2 when distinct represented-input residuals collapse to one rounded binary64 subtraction | `verification-pending` | RED `06a70e1c...` + common-high/error-free-low-term repair `04c62514...` + changelog `56d09154...` + corrected oracle `62243204...` + current #488 `57d85e58...` | +| GAP-094 | Bias standard error could shift a representable result by one ULP because `sqrt(sample_variance)` and `sqrt(n)` were rounded separately before division | `verification-pending` | corrected-oracle RED `62243204...` + direct normalized-SE repair `8b8f0a21...` + dedicated exact-residual contract `89fd9ef0...` + research `99a220db...` + changelog `184f4e2c...` + current #488 `57d85e58...` | +| GAP-095 | Bias standard error could materially overstate n>2 uncertainty when pairwise subtraction roundoff changes represented residual high parts instead of collapsing them all to one value | `verification-pending` | RED `ae906ad6...` + exact translated-residual repair `d59b9c30...` + changelog `89c01863...` + research `b3d43ad3...` + current #488 `57d85e58...` | +| GAP-096 | Bias standard error could materially overstate n>2 uncertainty even with exact pairwise residuals because their mean was rounded before centering, changing the represented deviation geometry | `verification-pending` | RED `9265b34a...` + exact-residual translated-mean repair `2fa266b2...` + changelog `ab361b25...` + research/current #488 `57d85e58...`; exact-head hosted GREEN/review/main integration remain pending | +| GAP-097 | Bias standard error common-high subtraction path could shift represented-input uncertainty by one ULP by rounding retained low-term mean before centering | `verification-pending` | RED `d48e2515...` + exact low-term translated-second-moment repair `a63b8d7a...` + changelog `6fc8e828...` + research/current #488 `57d85e58...`; exact-head hosted GREEN/review/main integration remain pending | ## Release gate From 3e6104385a88435f7337d6a6f5bd6a25388b67e5 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 5 Sep 2026 08:10:24 +0900 Subject: [PATCH 191/235] docs(ddd): add GAP-098 validation authority --- docs/product-technical-gap-baseline.md | 197 ++++++++++++------------- 1 file changed, 98 insertions(+), 99 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 2b7e058e4..ed27f96a4 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-04T22:02:12Z +**Snapshot:** 2026-09-04T23:09:06Z **Protected-main evidence:** `a243f18da4a4ca8a8d068c39922537f1f8ed6ad0` **Workspace version:** `0.2.0` @@ -30,7 +30,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `57d85e58411afb02e910b8e4138960319dcd8bce` | true | `main` | Validation Evidence landing vehicle, based on protected #490. GAP-093 preserves nonzero n>2 bias sampling uncertainty when residual subtraction low terms collapse under one rounded high. GAP-094 removes a one-ULP square-root decomposition error. GAP-095 preserves represented-input dispersion when rounded residual highs differ but exact anchor-relative `high+low` deltas are representable. GAP-096 extends that bounded translated-residual path to exact pairwise residuals so a rounded residual mean cannot change dispersion before centering. GAP-097 applies the same translated-second-moment proof to common-high subtraction low terms so their rounded mean cannot shift the final SE. GAP-091–092, GAP-086–090, and prior Wilson, provenance, Monte Carlo, RMSE/SE, matching, serde/projection repairs remain inherited. Hosted exact-head gates and independent review remain required. | +| #488 | `bcb484eab61d8f0198fec5c5119b76c4b0329678` | true | `main` | Validation Evidence landing vehicle, based on protected #490. GAP-093–097 preserve represented-input bias-SE dispersion across subtraction/mean-rounding boundaries. GAP-098 now prevents the exact translated-residual path from double-rounding through a non-power normalization scale by reusing the existing exact power-of-two scale. Earlier Wilson, provenance, Monte Carlo, RMSE/SE, matching, serde/projection repairs remain inherited. Hosted exact-head gates and independent review remain required. | | #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 | Validation / Analysis Run fold child. Unique evidence must be inherited by a conflict-resolving survivor; child-head CI does not transfer. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | @@ -39,8 +39,8 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | #480 | `5b2637f7b6142573ba1385a652c56632ecc9faa5` | true | `main` | Forward repair removed the repository-local hourly schedule reintroduced by predecessor `03876fb...`. The branch also corrects stale direct-provider guidance in `AGENTS.md`; it still needs conflict-resolving non-force inheritance of #489/#490 while immutable contextual-orchestrator release/deployment/auth provenance remains unavailable. | | #460 | `dfab4eab5ff733731e565a9348072b8dab2e4912` | true | #416 | Analysis Run fold child; typed cutoff equality and terminal-validation separation. | | #458 | `08165e3b3c929b4ae77396689549f72723ff8ff5` | true | #416 | Analysis Run fold child; typed cutoff equality and terminal-validation separation. | -| #416 | `aa730c63563eb4a33048d822b581036c8487bd47` | true | `main` | Validation / Analysis Run landing vehicle. Generic cutoff-before-identity repair `0b7155...` remains inherited; live branch head is six fast-forward commits beyond it. Branch is still based before #489/#490 and needs non-destructive consolidation/restack when fold scope is ready. | -| #310 | `c6680450152b1e0a2c9abb553772d74a23923335` | true | `main` | Longitudinal Modeling vehicle. Stable `Between` recovery is unit-level with canonical occasion `0`; `Within` retains actual occasion identity. Branch is still based before #489/#490 and remains a non-force restack finding, not a closure candidate. | +| #416 | `aa730c63563eb4a33048d822b581036c8487bd47` | true | `main` | Validation / Analysis Run landing vehicle. Generic cutoff-before-identity repair `0b7155...` remains inherited; branch still predates #489/#490 and needs non-destructive consolidation/restack. | +| #310 | `c6680450152b1e0a2c9abb553772d74a23923335` | true | `main` | Longitudinal Modeling vehicle. Stable `Between` recovery is unit-level with canonical occasion `0`; `Within` retains actual occasion identity. Branch predates #489/#490 and remains a non-force restack finding, not a closure candidate. | Exact-head evidence becomes stale after any source push. @@ -61,15 +61,15 @@ The clock contract separates event/valid time, assertion time, document time, sy - Occasion-mean deviations `p_it = x_it - μ_t` are not CWC residuals, sample-wide grand-mean residuals, or RI-CLPM within-person effects. Numeric event time defines occasion identity, so `-0.0` and `+0.0` are one occasion. - Row arrival order is not scientific evidence. Fixed admitted observations must produce bit-identical means/centered results under permutation wherever the contract claims deterministic CPU `f64` reference behavior. - Known-truth component recovery follows bounded-context identity: stable `Between` is unit-level and uses canonical `occasion_index = 0`; `Within` retains actual `(unit, occasion)` identity. Duplicate identities or stable-Between occasion aliases are not weights. -- A representable final scientific estimand is not rejected solely because an avoidable intermediate binary64 operation overflows/underflows. False exact 0/1/non-finite endpoints, erased finite bounds, cancellation residues, and double-rounded subnormal endpoints are not accepted when a bounded equivalent operation preserves the represented estimand or decision. -- Mean signed bias and bias SE remain Validation Evidence performance measures over admitted recovery units. `mean_bias` uses the direct residual path only when every pairwise subtraction is finite and does not discard represented low-order input mass. Overflowing or inexact finite pairwise subtraction redirects to the algebraically equivalent recovered-plus-negated-truth numerator, which is sign-cancelled before exact-power-of-two scale reduction and divided by the original recovery-unit count. During mixed-sign cancellation, error-free low terms are retained so repeated individually sub-ULP opposing residuals can still change the represented mean when their combined mass is material. Whether compensation comes from retained cancellation low terms or from a same-sign remainder left by exact opposite-sign cancellation, the canonical Neumaier high part, division residual, and correction are carried through the original scientific denominator before final scale restoration. For a same-sign all-subnormal remainder whose scientific divisor is at least the surviving term count, each represented magnitude is an exact integer number of `2^-1074` units; those units are summed in bounded integer arithmetic and quotient/remainder ties-to-even is applied once at the final subnormal grid. `bias_standard_error` still requires each individual signed residual to be representable. For exactly two observations, if either finite pairwise subtraction has error-free roundoff, TEPP evaluates `SE(mean) = |r1-r2| / 2` from expanded represented inputs. For larger samples in which subtraction roundoff exists and every rounded residual shares the same binary64 high part, that common high part is dispersion-invariant; TEPP evaluates the retained error-free subtraction low terms with the exact translated-residual second moment whenever every anchor-relative low-term delta is exactly representable, and otherwise retains the predecessor scaled low-term mean/deviation fallback. For other `n > 2` samples, including exact pairwise residuals and distinct rounded highs, TEPP uses the error-free `high + low` representation only if every anchor-relative high delta, low delta, and combined residual delta is itself exactly representable. Translation leaves variance unchanged, so an O(n) translated second moment avoids making either rounded pairwise residuals, a rounded residual mean, or a rounded low-term mean authoritative before dispersion is evaluated. If that exact-delta precondition cannot be established, the predecessor rounded-residual/rounded-mean path remains the bounded fallback rather than silently widening the contract. The normalized standard error is formed as `sqrt(sum(d²) / (n * (n - 1)))` after scale reduction, avoiding separately rounded `sqrt(sample_variance)` and `sqrt(n)` operands. These are bounded repairs, not a claim of globally correctly rounded n>2 dispersion. Mathematically nonzero final results below or above binary64 range fail closed. +- A representable final scientific estimand is not rejected solely because an avoidable intermediate binary64 operation overflows/underflows. False exact 0/1/non-finite endpoints, erased finite bounds, cancellation residues, and double-rounded endpoints are not accepted when a bounded equivalent operation preserves the represented estimand or decision. +- Mean signed bias and bias SE remain Validation Evidence performance measures over admitted recovery units. `mean_bias` uses the direct residual path only when every pairwise subtraction is finite and preserves represented low-order input mass; otherwise it uses the algebraically equivalent recovered-plus-negated-truth numerator, cancellation-safe exact-power-of-two scaling, and the original scientific denominator. `bias_standard_error` still requires each individual signed residual to be representable. For two observations with subtraction roundoff, TEPP evaluates `SE(mean)=|r1-r2|/2` from expanded represented inputs. For `n>2`, the exact translated-residual path is admitted only when anchor-relative high, low, and combined deltas are exactly representable. Translation-invariant dispersion is then evaluated before any rounded residual mean becomes authoritative. GAP-098 additionally requires this admitted path to normalize by the existing exact power-of-two scale rather than an arbitrary translated magnitude, so dyadic geometry is not double-rounded during scale restoration. The normalized standard error remains `sqrt(sum(d²)/(n(n-1)))`. Samples that cannot prove exact translated deltas retain the bounded predecessor fallback. These are bounded repairs, not a claim of globally correctly rounded n>2 dispersion. Mathematically nonzero final results outside binary64 range fail closed. - Generic Validation Evidence RMSE and its delta-method SE normalize before squaring. Exact-zero point RMSE requires exact-zero point RMSE SE. For positive RMSE, the declared producer satisfies `SE(RMSE) <= RMSE / 2`, with a small relative binary64 admission tolerance. -- Generic `MonteCarloSummary` is sign-neutral. Zero SD requires zero SE and percentile endpoints equal to the represented mean. Positive SD requires positive SE coherent with represented `SD / sqrt(n)` within a small relative tolerance. Every inclusive nearest-rank endpoint is a retained observation and satisfies `|endpoint - mean| <= SD * sqrt(n - 1)`. Distinct lower/upper endpoint values share the same `(n - 1) * SD²` deviation budget. When `replication_count = 2` and endpoints are numerically distinct, those values exhaust the retained sample and the recorded represented mean/sample SD must match deterministic two-value reconstruction. Equal numeric endpoints do not prove two distinct ranks and are not subjected to that exhaustion rule. +- Generic `MonteCarloSummary` is sign-neutral. Zero SD requires zero SE and percentile endpoints equal to the represented mean. Positive SD requires positive SE coherent with represented `SD / sqrt(n)` within a small relative tolerance. Every inclusive nearest-rank endpoint is a retained observation and satisfies `|endpoint - mean| <= SD * sqrt(n - 1)`. Distinct lower/upper endpoint values share the same `(n - 1) * SD²` deviation budget. When `replication_count=2` and endpoints are distinct, those endpoints exhaust the retained sample and must reconstruct the represented mean/sample SD. - When the generic carrier occupies `ValidationReport::monte_carlo_rmse`, retained replications are nonnegative; positive mean implies `SE(mean) <= mean`, and inclusive nearest-rank endpoints cannot exceed nonnegative sample-sum support `n * mean`. These typed bounds are not imposed on signed metrics such as bias. -- SE-aware acceptance is `|estimate - target| <= k * SE`. For `k = 0` or exact-zero SE, exact recovery is evaluated before any scale reduction; `-0.0` and `+0.0` are one numeric zero-valued scientific state. Finite represented residuals and finite represented `k · SE` bounds are compared directly. On a nonzero finite rounded tie, TEPP compares error-free subtraction and FMA product correction evidence; unresolved zero/equal projections use exact dyadic represented-input comparisons. If both direct operations overflow, exact rational magnitudes represented by the binary64 inputs are compared from integer significands and powers of two; independently rounded normalization is not decision evidence. +- SE-aware acceptance is `|estimate-target| <= k*SE`. Zero-multiplier/exact-zero-SE recovery is decided before scale reduction. Finite residual/bound ties use retained subtraction/FMA correction evidence and exact dyadic comparisons when projections are unresolved; both-overflow decisions compare represented binary64 rational magnitudes rather than independently rounded normalization. - `match_count` is a finite-threshold decision and does not require materializing an unrepresentable absolute residual; `absolute_residuals` remains fail closed when the magnitude itself is requested. - Wilson interval coverage preserves represented-input endpoints through stable rationalized/complementary/compensated forms. Durable `WilsonCoverageEvidenceV1` retains fixed-width counts, critical-value/sidedness provenance, represented coverage and canonical endpoints, validates through one crate-private authority, and does not infer missing v1 provenance from legacy endpoint algebra. -- Durable and human-facing Validation Evidence must preserve producing-metric invariants on explicit validation, serde ingress/egress, and human projection. Missing v1 provenance is never synthesized from endpoint algebra. +- Durable and human-facing Validation Evidence preserves producing-metric invariants on explicit validation, serde ingress/egress, and human projection. Missing v1 provenance is never synthesized from endpoint algebra. - Bias, RMSE, and Monte Carlo may share private deterministic scalar support inside `validation_core`, but metric-specific cancellation/normalization, denominator, uncertainty, and fail-closed semantics remain with their bounded modules. - Historical-cutoff admission occurs before duplicate-identity checks. Future-unavailable evidence cannot change an earlier run's conflicts, counts, or terminal state. - Supported temporal estimators require state/trajectory and claimed-structure recovery, bias/RMSE, interval coverage, convergence, uncertainty calibration, reproducibility, and leakage-safe rolling-origin evidence. @@ -83,28 +83,26 @@ The clock contract separates event/valid time, assertion time, document time, sy ### #488 — Validation Evidence -#488 is the generic Validation Evidence landing vehicle at exact head `57d85e58411afb02e910b8e4138960319dcd8bce`, based on protected #490. GAP-093 RED `06a70e1c01629f15f05efef48576a9cadb1f1b98` proves that `truth=[2^-54,2^-55,0]`, `recovered=[1,1,1]` contains three distinct represented-input residuals although every binary64 pairwise subtraction rounds to `1.0`; the predecessor therefore emitted false exact-zero uncertainty. First causal repair `04c62514a23722d63a62bd5d5af6e3a930cc3147` exposes the error-free subtraction low terms and, only when every rounded high part is equal, evaluates dispersion from those low terms in O(n). CHANGELOG `56d091544a5780567a6ef772568d62b0fc651747`. +#488 is the generic Validation Evidence landing vehicle at exact head `bcb484eab61d8f0198fec5c5119b76c4b0329678`, based on protected #490. GAP-093–097 remain inherited and executable. -Oracle correction/RED `6224320410ccabb1cf16d36cc12f88e2b7a05bb1` then established GAP-094: exact high-precision evaluation of represented-input `SE=2^-55/sqrt(3)` rounds to `0x3c72_79a7_4590_331c`, not the `...331d` value produced by separately rounded `sqrt(sample_variance)/sqrt(n)`. Causal repair `8b8f0a21ccc825f355859cadbf20d83f04d2369f` forms the bounded normalized expression `sqrt(sum(d²)/(n(n-1)))`. Dedicated public contract `89fd9ef0add3930346900f75518708978ec9861e` reproduces the same one-ULP defect with exact residuals and no subtraction collapse; CHANGELOG `184f4e2c109c7904027f782e91b8d9a01a1d46f1`. +GAP-098 RED `426fc5afd8aae8c2d5f81f53e5db074b480ac8b7` adds the exact three-observation boundary `u=2^-52`, `a=1-4u`, `b=1+u`, `truth=[0,0,0]`, `recovered=[a,a,b]`. The represented residual gap is exactly `d=5*2^-52`, and translation invariance gives `SE(mean)=d/3`, which rounds to bits `0x3cba_aaaa_aaaa_aaab`. The predecessor translated to `[0,0,d]`, chose the non-power normalization scale `d`, rounded the normalized square-root stage to the binary64 approximation of `1/3`, and restored with `d`, yielding adjacent lower bits `0x3cba_aaaa_aaaa_aaaa`. The sign mirror reproduces the defect. -GAP-095 RED `ae906ad609aa4eb948b8311c1cebd975f55eb2f6` proves the distinct-high boundary: `truth=[2^-54,3*2^-54,0]`, `recovered=[1,1,1]` has exact represented residuals `[1-2^-54,1-3*2^-54,1]` with `SE=2^-54*sqrt(7)/3`, rounding to `0x3c8c_38aa_37c3_f68d`, while the predecessor rounded-residual vector yields `0x3c96_a09e_667f_3bcd`. Causal repair `d59b9c30bf810a6dc6fdceaba6d20e048fad985a` preserves the existing n=2/common-high paths, reconstructs only provably exact anchor-relative `high+low` residual deltas, and evaluates their translation-invariant second moment in O(n). CHANGELOG `89c018630d5baadef04a8167034951b7e378a4b2`. +Shared prerequisite `d8b411f5dcf93ff21b18eaa4ff5ccd8d2863a6cd` makes the already-existing `numeric::exact_power_of_two_scale` helper crate-visible without changing its arithmetic. Causal repair `d536e3b1082c0f705a6ddd7722bf45c93ac594e3` reuses that helper in `bias::exact_translated_residual_standard_error`; exact power-of-two scaling preserves the dyadic translated geometry across normalization/restoration while retaining the existing nonzero-to-zero guard and bounded fallback. CHANGELOG `ebce979fdfb0ab2d94e3ba70145b0076a7ef07ca`; research/current #488 `bcb484eab61d8f0198fec5c5119b76c4b0329678`. -GAP-096 RED `9265b34a2163f45bd232d628c20f725d2844f50a` then proves a separate exact-residual failure. With `a=2^-52`, exact residuals `[1,1-a,1]` have represented-input `SE=a/3`, bits `0x3c95_5555_5555_5555`, but rounding their mean first produces deviations `[2^-53,-2^-53,2^-53]` and `0x3c96_a09e_667f_3bcd`. Causal repair `2fa266b21069460370f30243cfb498e2022888bf` reuses GAP-095's exact translated-residual path for all `n>2` samples satisfying its exact-delta preconditions, even when pairwise subtraction roundoff is zero. CHANGELOG `ab361b25ec4296165f89e4eff26e6d3521c00571`. - -GAP-097 RED `d48e2515d62dfbe0a807b5dba40fbb7034d4fa9d` proves that the GAP-093 common-high special path still had its own rounded-mean boundary. With `q=2^-54`, `truth=[q,0,0]`, and `recovered=[1,1,1]`, all rounded residual highs are `1.0`, but the exact represented low terms are `[-q,0,0]` and `SE(mean)=q/3`, bits `0x3c75_5555_5555_5555`. Rounding the low-term mean before centering moves the result one ULP upward. Causal repair `a63b8d7a8e79146cbb17ceb17855bcca312535a1` evaluates those low terms through GAP-095/096's exact translated-residual second moment when anchor-relative low-term deltas are exactly representable and otherwise retains the bounded predecessor fallback. CHANGELOG `6fc8e82839389f2f8c07e1cf7ba78a29f19d2510`; research/current #488 `57d85e58411afb02e910b8e4138960319dcd8bce`. - -GAP-092 remains inherited for the exact two-observation subtraction-roundoff identity, and GAP-091 remains inherited for mean-bias subtraction roundoff. GAP-086–GAP-090 and earlier Wilson, provenance, Monte Carlo, RMSE/SE, matching, serde/projection repairs remain inherited. GAP-071/GAP-073–GAP-097 remain delivery-pending until current-head hosted gates, independent review, protected-main integration, and required durable-consumer adoption are verified. Bare legacy `ValidationReport` remains a backward-compatible compact projection and is not silently treated as v1 provenance. +This does not claim globally correctly rounded n>2 bias standard errors. Exact translated-delta admission is unchanged; later binary64 square, compensated sum, division, square root, and fallback behavior require independent represented-input counterexamples before further widening. ### #416 — Validation / Analysis Run consolidation -#416 live branch head is `aa730c63563eb4a33048d822b581036c8487bd47`, six fast-forward commits beyond generic cutoff-before-identity repair `0b7155cc238defb1e55129ff3000658f04b343cf`. Its PR description distinguishes inherited repair identity from actual branch head. #458/#460/#482/#483/#484/#485/#487 remain fold children until every unique source/test/fixture/contract/doctoring delta is inherited by a conflict-resolving survivor. Child-head evidence does not transfer to #416. The vehicle is still based before #489/#490 and must be non-destructively restacked/consolidated rather than closed for staleness. +#416 live branch head is `aa730c63563eb4a33048d822b581036c8487bd47`; generic cutoff-before-identity repair `0b7155cc238defb1e55129ff3000658f04b343cf` remains inherited. #458/#460/#482/#483/#484/#485/#487 remain fold children until every unique source/test/fixture/contract/doctoring delta is inherited by a conflict-resolving survivor. Child-head evidence does not transfer. The vehicle still predates #489/#490 and must be non-destructively restacked/consolidated rather than closed for staleness. ### #480 — contextual-orchestrator boundary -#480 removes TEPP-owned provider discovery/ranking and requires a released contextual-orchestrator owner contract. Forward repair `5b2637f7b6142573ba1385a652c56632ecc9faa5` removed the local hourly `schedule` reintroduced by predecessor `03876fb3e4c727bb754125ce531d928450d78303` and carries owner-correct `AGENTS.md` guidance requiring released/versioned contextual-orchestrator, `orchestrator/free`, and no direct provider keys. The branch still diverges from protected main because #489/#490 workflow consolidation and admission marker must be conflict-resolved without regressing #480's valid released-owner routing delta. contextual-orchestrator protected main remains `2e414d15ba58f28597751b625a8a2f00fc9fadcf`, and GitHub releases remain zero. #480 therefore stays Draft until non-force restack plus immutable compatible release/deployment/auth/schema/artifact provenance prerequisites are resolved. Mutable owner main is evidence, not a production contract. +#480 removes TEPP-owned provider discovery/ranking and requires a released contextual-orchestrator owner contract. Forward repair `5b2637f7b6142573ba1385a652c56632ecc9faa5` removed the local hourly `schedule` reintroduced by predecessor `03876fb3e4c727bb754125ce531d928450d78303` and carries owner-correct `AGENTS.md` guidance requiring released/versioned contextual-orchestrator, `orchestrator/free`, and no direct provider keys. The branch still diverges from protected main because #489/#490 workflow consolidation and admission marker must be conflict-resolved without regressing #480's valid released-owner routing delta. contextual-orchestrator protected main remains `2e414d15ba58f28597751b625a8a2f00fc9fadcf`, and GitHub releases remain zero. #480 therefore stays Draft until non-force restack plus immutable compatible release/deployment/auth/schema/artifact provenance prerequisites are resolved. ## Gap register +GAP-001–GAP-044 retain their existing domain/release identities and closure lineage. They remain unchanged by the GAP-098 numerical repair; their authoritative source/test/ADR history remains in repository ancestry and the surviving landing vehicles listed above. The validation lineage from GAP-045 onward is restated here because #488 is its current single writer. + | ID | Gap | Maturity | Closure evidence | | --- | --- | --- | --- | | GAP-001 | PR authority fragmented across 134 open PRs | `release-blocking` | coherent landing vehicles, unique-evidence preservation, protected-main reduction | @@ -124,86 +122,87 @@ GAP-092 remains inherited for the exact two-observation subtraction-roundoff ide | GAP-015 | contextual-orchestrator lacks immutable released contract for current owner behavior | `release-blocking` | compatible immutable CO release, deployment provenance, safe gateway auth, exact TEPP ACL adoption | | GAP-016 | hourly LLM path needs released owner-only routing/authentication | `active-repair` | #480 Draft + released CO adoption + exact-head GREEN/review/main merge | | GAP-017 | dynamic evaluation item/rater/anchor drift monitoring | `owner-contract-active` | released/digest-pinned dynamic criterion/item/run contract, ACL conformance, no-anchor/no-linking refusal, evidence-gated temporal monitoring | -| GAP-018 | Longitudinal stable-mean logic had a separate decomposition implementation after CWC/occasion consolidation | `verification-pending` | RED `7dc87aa8...` + repair `97c8ad35...`; exact-head GREEN/review/main integration | -| GAP-019 | Longitudinal scientific instructions contradicted stationary-overflow implementation | `verification-pending` | RED `9d8a82d...` + repair `9c962205...`; exact-head documentation/review GREEN and protected-main integration | -| GAP-020 | Nonzero lagged covariance can be misreported as exact-zero correlation when standardized magnitude is unrepresentable | `verification-pending` | RED `c345ee7b...` + repair `5785e07a...`; exact-head integration | -| GAP-021 | Longitudinal irregular-rate facade duplicated public wrapper identities over one canonical implementation | `verification-pending` | RED `464863860...` + repair `7f0bea084...`; exact-head integration | -| GAP-022 | Architecture assigned Longitudinal Modeling semantics to `psychometric_core` and duplicated implementation responsibility rows | `verification-pending` | RED `fe5eb745...` + repair `7fadc757...`; exact-head integration | -| GAP-023 | `discreteDIFFUSIONstd` rejected a representable subnormal final ratio because `aΔt` underflowed before factor two | `verification-pending` | RED `d5107b198...` + repair `7164c7ce4...`; exact-head integration | -| GAP-024 | Contributor guidance re-authorized a direct provider credential after LLM ownership moved to contextual-orchestrator | `verification-pending` | RED `4248b335...` + repair `01f45a993...`; #480 additionally repairs stale protected-main `AGENTS.md`; released CO adoption + exact-head integration | -| GAP-025 | A singleton unit could satisfy the nominal CWC unit floor while all lag evidence came from one repeated unit | `verification-pending` | RED `671709bbc...` + repair `4784b370c...`; exact-head integration | -| GAP-026 | Scalar standardized longitudinal maps rejected representable finals when a cancelled stationary-variance intermediate lay outside binary64 range | `verification-pending` | RED `4a1f6c49...` / `96d8ed13...` + repairs `a4bc6230...` / `33f4b187...` / `26b03c32...` | -| GAP-027 | Finite-interval `discreteDIFFUSIONstd` could report exact unit diffusion after exponent saturation erased a nonzero remainder | `verification-pending` | RED `a8de3c9f...` + repair `c17e2ff8...` | -| GAP-028 | Actual stationary variance `p` could be misreported as exact zero when positive real `p` lies below binary64 range | `verification-pending` | RED `27d9fa39...` + repair `a0132b62...` | -| GAP-029 | Occasion-mean temporal composition arrived in the wrong bounded context with raw-bit event identity, naive mean summation, and order-dependent averaging | `verification-pending` | verified-successor #486 closure into #310 + release fragment `db335d90...` | -| GAP-030 | Prediction-contradiction Analysis Run treated four observed relation classes as mandatory design strata | `active-fold` | RED `a2892b6...` + repair `a6402015...` + Proposed ADR repair `e07b2ff9...`; fold into #416 | -| GAP-031 | Occasion-mean same-sign averaging double-rounded a representable minimum-subnormal ties-to-even mean | `verification-pending` | RED `9aff817f...` + repair `40e057b8...` | -| GAP-032 | CWC/irregular-residual same-sign averaging retained the same minimum-subnormal double-rounding defect | `verification-pending` | RED `23476f45...` + repair `b14eb6e8...` | -| GAP-033 | Arbitrary max-magnitude normalization introduced a second rounding and misrounded a 7.5-ULP subnormal mean | `verification-pending` | RED `b073f03f...` + repair `350b8d4e...` + consolidation `dd53eff6...` | -| GAP-034 | Mixed-sign cancellation rounded a retained-only mean before restoring the original denominator | `verification-pending` | RED `ae5e61f9...` + repair `39469067...` | -| GAP-035 | Within/between decomposition shadow running mean misrounded `[1 ULP, 2 ULP]` | `verification-pending` | RED `7dc87aa8...` + repair `97c8ad35...` | -| GAP-036 | Known-truth component RMSE could underflow a nonzero recovery error to exact zero | `verification-pending` | RED `496583c6...` + repair `a82b383b...` | -| GAP-037 | Strict-interior lagged covariance could round to false exact `±1` correlation | `verification-pending` | RED `683b28ee...` + repair `9eeb373d...` | -| GAP-038 | Exact Cauchy–Schwarz boundary covariance could round one ULP below `±1` | `verification-pending` | RED `c2500090...` + repair `d06259ec...` | -| GAP-039 | Exact zero lagged covariance could leak IEEE `-0.0` through public projection | `verification-pending` | RED `e15d0531...` + repair `fc61f7bd...` | -| GAP-040 | Exact zero within-person deviation could leak IEEE `-0.0` through public decomposition | `verification-pending` | RED `aeb008a3...` + repair `a9a70baa...` | -| GAP-041 | One-sign irregular residual log-rate mean could underflow to exact zero | `verification-pending` | RED `96f1c334...` + repair `ae5081d8...` | -| GAP-042 | Ratio-first logarithm could nearly double an adjacent-float irregular residual growth rate | `verification-pending` | RED `766ddc7a...` + `ln_1p` repair `16f21d9a...` | -| GAP-043 | Duplicate known-truth component identities could silently reweight RMSE recovery evidence | `verification-pending` | RED `698f12f5...` + uniqueness repair `2fae4cb2...` | -| GAP-044 | Known-truth RMSE alignment/accumulation depended on row order instead of component identity | `verification-pending` | RED `8ad72ac9...` / `5fb93c40...` + repairs `2dd9537e...` / `025dce7f...`; #310 `c6680450...` | -| GAP-045 | Mean signed bias could reject a representable recovery result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; current #488 `57d85e58...` | -| GAP-046 | Bias SE could reject a representable SEM because raw squared deviations/intermediates overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; current #488 `57d85e58...` | -| GAP-047 | Generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; current #488 `57d85e58...` | -| GAP-048 | Mean signed bias could erase a representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; current #488 `57d85e58...` | -| GAP-049 | Stable `Between` recovery could be aliased across occasion indices and reweight RMSE | `verification-pending` | RED `0a03041c...` + repair `ec2c1219...`; #310 `c6680450...` | -| GAP-050 | Zero-multiplier SE-aware acceptance could erase a nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; current #488 `57d85e58...` | -| GAP-051 | Exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; current #488 `57d85e58...` | -| GAP-052 | All-covered Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; current #488 `57d85e58...` | -| GAP-053 | Strict-interior Wilson lower endpoint could cancel a positive representable value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; current #488 `57d85e58...` | -| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; current #488 `57d85e58...` | -| GAP-055 | Strict-interior Wilson lower endpoint could accept a nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; current #488 `57d85e58...` | -| GAP-056 | Durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; current #488 `57d85e58...` | -| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from a generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; current #488 `57d85e58...` | -| GAP-058 | Generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; current #488 `57d85e58...` | -| GAP-059 | Generic Monte Carlo summary could materially misstate positive SE relative to `SD / sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; current #488 `57d85e58...` | -| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; current #488 `57d85e58...` | -| GAP-061 | Generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; current #488 `57d85e58...` | -| GAP-062 | Finite-tolerance matching could fail while the pair is deterministically outside every finite tolerance | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; current #488 `57d85e58...` | -| GAP-063 | Exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; current #488 `57d85e58...` | -| GAP-064 | Positive point RMSE could carry SE above the declared squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; current #488 `57d85e58...` | -| GAP-065 | Positive Monte Carlo RMSE could carry spread/SE impossible for nonnegative replications | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; current #488 `57d85e58...` | -| GAP-066 | RMSE Monte Carlo nearest-rank percentile could exceed total nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; current #488 `57d85e58...` | -| GAP-067 | Generic nearest-rank percentile endpoint could be individually incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected over-strong repair `2798e4f9...`; causal repair `c7151b49...`; edge `dbef285b...`; changelog `c38a320c...`; research `2bbcbb24...`; current #488 `57d85e58...` | -| GAP-068 | Distinct generic percentile endpoints could each pass individual radius checks while jointly exceeding the sample squared-deviation budget | `verification-pending` | RED `c4a13826...` + causal repair `cb3f80a2...` + changelog `f727450d...`; current #488 `57d85e58...` | -| GAP-069 | Two-replication distinct nearest-rank endpoints could exhaust the retained sample while the stored mean or SD remained impossible | `verification-pending` | RED `81bf0d9e...` + causal repair `d48f8fef...` + mean coverage `fb314d8a...` + branch cleanup `440b78d8...` + changelog `45116498...`; current #488 `57d85e58...` | -| GAP-070 | Stored Wilson bounds could contain empirical coverage while the lower/upper pair could not arise from one Wilson score interval for that same coverage | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...` + complementary edge `c1cb16a7...`; current #488 `57d85e58...` | -| GAP-071 | Durable Wilson evidence lacked denominator and critical-value/sidedness provenance, preventing exact recomputation from a persisted artifact | `active-repair` | valid carrier RED `6f6e06d2...`; shared count/Wilson authority `ca517ed3...`; `WilsonCoverageEvidenceV1` `31e1ab2b...`; sidedness `e9c63926...`/`fdd24a1a...`; envelope RED `07766cb0...` + `ValidationEvidenceV1` repair `a16f22e6...`; current #488 `57d85e58...`; remaining: hosted GREEN/review/main plus durable-consumer adoption | -| GAP-072 | Exact all-covered Wilson evidence could retain a zero lower endpoint even though the canonical non-empty finite-`z²` producer always emits `n/(n+z²) > 0` | `verification-pending` | RED `ce714f07...` + non-force source-restore RCA `18499052...` + repair `72e9d954...` + changelog `e3a2f4a2...`; current #488 `57d85e58...` | -| GAP-073 | Durable Wilson count provenance could round one uncovered observation away above binary64's exact-integer range and expose a pointer-width-dependent count schema | `verification-pending` | RED `29d710a5...` + complement/count repair `29968c80...` + fixed-width carrier repair `91d9a3bb...` + exact ratio RED/repair `63ddfdd6...`/`11323c57...`; current #488 `57d85e58...` | -| GAP-074 | Durable Wilson evidence could correctly retain exact `u64` counts yet pre-round `sample_count` before endpoint projection, shifting strict-interior endpoints or erasing all-covered finite-sample uncertainty | `verification-pending` | RED `f89e2467...` + all-covered edge `1a5180b2...` + stale-oracle correction `6254c498...` + causal reciprocal-scale repair `73bbb5cf...` + changelog `f2b5768b...` + research predecessor `7fc78a59...`; current #488 `57d85e58...` | -| GAP-075 | Inexact durable all-covered Wilson evidence could round the complementary miss mass to exact one at extreme finite `z` and erase a representable positive lower endpoint | `verification-pending` | RED `059ce70d...`; transient duplicate-owner implementation `46f91f3f...` excluded; canonical repair `0f478392...`; single-writer cleanup `8e2058f2...`; exact-oracle correction `93d5d208...`; changelog correction `43b6562c...`; research predecessor `b03a719d...`; current #488 `57d85e58...` | -| GAP-076 | Exactly representable all-covered Wilson counts could absorb a small positive `z²` in `n + z²` and falsely emit exact `1.0` although a lower binary64 endpoint is representable | `verification-pending` | RED `e0c4ec81...` + causal boundary repair `c9dcb9df...` + below-resolution edge `6140080d...` + changelog `09ebb482...` + research predecessor `fe89c438...`; current #488 `57d85e58...` | -| GAP-077 | Exactly representable all-covered Wilson counts could form an inexact partial denominator `n + z²` whose rounded sum shifts the represented-input lower endpoint by one ULP even though neither operand is fully absorbed | `verification-pending` | RED `06e55653...` + causal TwoSum/FMA repair `6c084dbe...` + research `25cc1943...` + changelog `5acc894b...` + predecessor changelog correction `f89e36d1...` + correct-direct-rounding control `80a0a0ad...`; current #488 `57d85e58...` | -| GAP-078 | Exact-count all-covered Wilson residual compensation could move a direct quotient by one ULP even when the represented-input rational remains on the same side of the adjacent midpoint | `verification-pending` | RED `d076d344...` + midpoint-selection repair `32314239...` + changelog `a75940c9...` + research predecessor `ef6441f7...`; current #488 `57d85e58...` | -| GAP-079 | SE-aware acceptance could underflow a finite positive `k · SE` tolerance to exact zero by dividing `SE` by a much larger estimate/target scale before multiplication | `verification-pending` | RED `76067efc...` + causal direct-finite comparison repair `4ffdf366...` + changelog `d822c0ba...` + current #488 `57d85e58...` | -| GAP-080 | SE-aware acceptance both-overflow fallback could normalize an exact strict rejection into an equal rounded residual/bound and falsely accept it | `verification-pending` | RED `a9a45714...` + exact significand/exponent repair `425e8963...` + changelog `e6270629...` + current #488 `57d85e58...` | -| GAP-081 | SE-aware acceptance finite/finite multiplication could round an exact strict represented-input rejection into an equal residual/bound and falsely accept it | `verification-pending` | RED `23c3262c...` + tie repair `6a2add48...` + edge coverage `3656deb2...` + changelog `090f5124...` + current #488 `57d85e58...` | -| GAP-082 | SE-aware acceptance finite subtraction could round an exact strict represented-input rejection onto an exact finite bound and falsely accept equality | `verification-pending` | RED `58cbc032...` + causal low-term comparison repair `68a6fd98...` + sign-symmetric edge `b2c06512...` + changelog `c4f752f3...` + current #488 `57d85e58...` | -| GAP-083 | SE-aware acceptance product correction can fall below binary64 resolution even when the rounded finite bound is subnormal or minimum normal, erasing a strict represented-input rejection | `verification-pending` | RED `b55c5473...` + initial narrow repair `210cebc4...` + minimum-normal RED `c77ac440...` + corrected zero-projection repair `772ad8ed...` + changelog correction `ceb68825...` + current #488 `57d85e58...` | -| GAP-084 | Legacy Wilson pair admission could accept an exact-zero/exact-one boundary even though the peer endpoint implied a representable non-boundary root | `verification-pending` | RED `c9d612f2...` + causal peer-root repair `88512417...` + branch-complete stable evaluation `6a4f89da...` + symmetry/serde/extreme-boundary contracts `0ce7639b...` + changelog `407b3645...` + current #488 `57d85e58...` | -| GAP-085 | Equal nonzero SE-aware subtraction/FMA correction projections could conceal the exact represented-input ordering and turn a strict decision into rounded equality | `verification-pending` | RED `35ea85ba...` + exact product-roundoff repair `7d597a18...` + signed edge `b463a991...` + branch-scope refinement `ca8c2b86...` + changelog `702eec2f...` + current #488 `57d85e58...` | -| GAP-086 | Mean signed bias could reject a representable result because individual `recovered - truth` residuals overflow before opposing represented terms cancel | `verification-pending` | RED `04e6e745...` + explicit-denominator cancellation `28b1d186...` + causal bias repair `d1cd5461...` + changelog `d68dde34...` + current #488 `57d85e58...` | -| GAP-087 | Mean signed bias mixed-sign cancellation could discard repeated individually sub-ULP opposing residuals even though their combined represented mass changes the final bias | `verification-pending` | RED `63913727...` + error-free low-term repair `5697cca5...` + changelog `53f5c912...` + current #488 `57d85e58...` | -| GAP-088 | Mean signed bias mixed-remainder compensation could be rounded into an intermediate numerator before the scientific count division, shifting the represented-input mean by one ULP | `verification-pending` | RED `8b4d19d1...` + causal compensated-division/FMA repair `7a33212b...` + changelog `bad698dd...` + current #488 `57d85e58...` | -| GAP-089 | Mean signed bias exact opposite-sign cancellation could leave a same-sign compensated remainder whose `sum + correction` was rounded before the scientific count division, shifting the represented-input mean by one ULP | `verification-pending` | RED `84476aad...` + causal same-sign compensated-division repair `5f0d40b8...` + changelog `5763cde0...` + current #488 `57d85e58...` | -| GAP-090 | Same-sign all-subnormal mean normalization could double-round the final represented bias by one ULP at scale restoration | `verification-pending` | RED `91abdb49...`; discarded direct-float repair `e89dc346...`; corrected exact-unit repair `1c0df8a7...`; halfway contract `f79a1b9a...`; regression fixture `eb29a79a...`; changelog `65ff502b...`; research lineage retained by current #488 `57d85e58...` | -| GAP-091 | Mean signed bias pairwise subtraction roundoff could move the represented-input mean across a final binary64 midpoint | `verification-pending` | RED `a9d9bda3...` + insufficient first repair `96bff8e5...` + corrected tail/midpoint repair `676ccda0...` + changelog `cbcfa8d6...` + research `1f9e2631...` + two-direction edge `0bff5a8d...` + current #488 `57d85e58...` | -| GAP-092 | Bias standard error could report false exact zero when two distinct represented-input residuals both round to the same pairwise binary64 subtraction | `verification-pending` | RED `c9c55ea5...` + causal two-observation expanded-difference repair `f6d7da96...` + changelog `ab7730ca...` + current #488 `57d85e58...` | -| GAP-093 | Bias standard error could report false exact zero for n>2 when distinct represented-input residuals collapse to one rounded binary64 subtraction | `verification-pending` | RED `06a70e1c...` + common-high/error-free-low-term repair `04c62514...` + changelog `56d09154...` + corrected oracle `62243204...` + current #488 `57d85e58...` | -| GAP-094 | Bias standard error could shift a representable result by one ULP because `sqrt(sample_variance)` and `sqrt(n)` were rounded separately before division | `verification-pending` | corrected-oracle RED `62243204...` + direct normalized-SE repair `8b8f0a21...` + dedicated exact-residual contract `89fd9ef0...` + research `99a220db...` + changelog `184f4e2c...` + current #488 `57d85e58...` | -| GAP-095 | Bias standard error could materially overstate n>2 uncertainty when pairwise subtraction roundoff changes represented residual high parts instead of collapsing them all to one value | `verification-pending` | RED `ae906ad6...` + exact translated-residual repair `d59b9c30...` + changelog `89c01863...` + research `b3d43ad3...` + current #488 `57d85e58...` | -| GAP-096 | Bias standard error could materially overstate n>2 uncertainty even with exact pairwise residuals because their mean was rounded before centering, changing the represented deviation geometry | `verification-pending` | RED `9265b34a...` + exact-residual translated-mean repair `2fa266b2...` + changelog `ab361b25...` + research/current #488 `57d85e58...`; exact-head hosted GREEN/review/main integration remain pending | -| GAP-097 | Bias standard error common-high subtraction path could shift represented-input uncertainty by one ULP by rounding retained low-term mean before centering | `verification-pending` | RED `d48e2515...` + exact low-term translated-second-moment repair `a63b8d7a...` + changelog `6fc8e828...` + research/current #488 `57d85e58...`; exact-head hosted GREEN/review/main integration remain pending | +| GAP-018 | Longitudinal stable-mean logic had separate decomposition implementation | `verification-pending` | RED `7dc87aa8...` + repair `97c8ad35...`; exact-head GREEN/review/main integration | +| GAP-019 | Longitudinal scientific instructions contradicted stationary-overflow implementation | `verification-pending` | RED `9d8a82d...` + repair `9c962205...`; exact-head integration | +| GAP-020 | nonzero lagged covariance could become false exact-zero correlation | `verification-pending` | RED `c345ee7b...` + repair `5785e07a...`; exact-head integration | +| GAP-021 | irregular-rate facade duplicated wrapper identities | `verification-pending` | RED `464863860...` + repair `7f0bea084...`; exact-head integration | +| GAP-022 | Architecture assigned Longitudinal semantics to wrong context | `verification-pending` | RED `fe5eb745...` + repair `7fadc757...`; exact-head integration | +| GAP-023 | `discreteDIFFUSIONstd` rejected representable subnormal ratio | `verification-pending` | RED `d5107b198...` + repair `7164c7ce4...` | +| GAP-024 | contributor guidance re-authorized direct provider credential | `verification-pending` | RED `4248b335...` + repair `01f45a993...`; #480 carries owner-correct follow-up | +| GAP-025 | singleton unit could satisfy nominal CWC unit floor | `verification-pending` | RED `671709bbc...` + repair `4784b370c...` | +| GAP-026 | standardized longitudinal maps rejected representable finals after cancelled overflow | `verification-pending` | RED `4a1f6c49...` / `96d8ed13...` + repairs `a4bc6230...` / `33f4b187...` / `26b03c32...` | +| GAP-027 | finite-interval diffusion could falsely saturate to unit diffusion | `verification-pending` | RED `a8de3c9f...` + repair `c17e2ff8...` | +| GAP-028 | positive stationary variance could become false exact zero | `verification-pending` | RED `27d9fa39...` + repair `a0132b62...` | +| GAP-029 | occasion-mean composition arrived in wrong bounded context | `verification-pending` | verified-successor #486 into #310 + release fragment `db335d90...` | +| GAP-030 | prediction-contradiction run treated observed classes as mandatory strata | `active-fold` | RED `a2892b6...` + repair `a6402015...` + Proposed ADR `e07b2ff9...`; fold into #416 | +| GAP-031 | occasion-mean same-sign averaging double-rounded minimum-subnormal tie | `verification-pending` | RED `9aff817f...` + repair `40e057b8...` | +| GAP-032 | CWC/irregular residual same-sign mean retained subnormal double rounding | `verification-pending` | RED `23476f45...` + repair `b14eb6e8...` | +| GAP-033 | arbitrary max normalization misrounded subnormal mean | `verification-pending` | RED `b073f03f...` + repair `350b8d4e...` + consolidation `dd53eff6...` | +| GAP-034 | mixed-sign cancellation rounded retained mean before original denominator | `verification-pending` | RED `ae5e61f9...` + repair `39469067...` | +| GAP-035 | within/between shadow running mean misrounded small residuals | `verification-pending` | RED `7dc87aa8...` + repair `97c8ad35...` | +| GAP-036 | known-truth component RMSE could underflow nonzero error to zero | `verification-pending` | RED `496583c6...` + repair `a82b383b...` | +| GAP-037 | strict-interior lagged covariance could round to false exact `±1` | `verification-pending` | RED `683b28ee...` + repair `9eeb373d...` | +| GAP-038 | exact Cauchy-Schwarz boundary could round below `±1` | `verification-pending` | RED `c2500090...` + repair `d06259ec...` | +| GAP-039 | exact-zero lagged covariance could leak `-0.0` | `verification-pending` | RED `e15d0531...` + repair `fc61f7bd...` | +| GAP-040 | exact-zero within-person deviation could leak `-0.0` | `verification-pending` | RED `aeb008a3...` + repair `a9a70baa...` | +| GAP-041 | one-sign irregular residual log-rate mean could underflow to zero | `verification-pending` | RED `96f1c334...` + repair `ae5081d8...` | +| GAP-042 | ratio-first logarithm inflated adjacent-float growth rate | `verification-pending` | RED `766ddc7a...` + `ln_1p` repair `16f21d9a...` | +| GAP-043 | duplicate known-truth identities could silently reweight RMSE | `verification-pending` | RED `698f12f5...` + repair `2fae4cb2...` | +| GAP-044 | known-truth RMSE alignment depended on row order | `verification-pending` | RED `8ad72ac9...` / `5fb93c40...` + repairs `2dd9537e...` / `025dce7f...`; #310 `c6680450...` | +| GAP-045 | mean signed bias could reject representable result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; inherited by #488 `bcb484ea...` | +| GAP-046 | bias SE could reject representable SEM because raw squared deviations overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; inherited by #488 `bcb484ea...` | +| GAP-047 | generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; inherited by #488 `bcb484ea...` | +| GAP-048 | mean signed bias could erase representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; inherited by #488 `bcb484ea...` | +| GAP-049 | stable `Between` recovery could be aliased across occasion indices and reweight RMSE | `verification-pending` | RED `0a03041c...` + repair `ec2c1219...`; #310 `c6680450...` | +| GAP-050 | zero-multiplier SE-aware acceptance could erase nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; inherited by #488 `bcb484ea...` | +| GAP-051 | exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; inherited by #488 `bcb484ea...` | +| GAP-052 | all-covered Wilson lower endpoint could cancel positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; inherited by #488 `bcb484ea...` | +| GAP-053 | strict-interior Wilson lower endpoint could cancel positive value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; inherited by #488 `bcb484ea...` | +| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; inherited by #488 `bcb484ea...` | +| GAP-055 | strict-interior Wilson lower endpoint could accept nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; inherited by #488 `bcb484ea...` | +| GAP-056 | durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; inherited by #488 `bcb484ea...` | +| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; inherited by #488 `bcb484ea...` | +| GAP-058 | generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; inherited by #488 `bcb484ea...` | +| GAP-059 | Monte Carlo summary could materially misstate positive SE relative to `SD/sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; inherited by #488 `bcb484ea...` | +| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; inherited by #488 `bcb484ea...` | +| GAP-061 | generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; inherited by #488 `bcb484ea...` | +| GAP-062 | finite-tolerance matching could fail for deterministically outside pair | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; inherited by #488 `bcb484ea...` | +| GAP-063 | exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; inherited by #488 `bcb484ea...` | +| GAP-064 | positive point RMSE could carry SE above squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; inherited by #488 `bcb484ea...` | +| GAP-065 | positive Monte Carlo RMSE could carry impossible spread/SE | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; inherited by #488 `bcb484ea...` | +| GAP-066 | RMSE nearest-rank percentile could exceed nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; inherited by #488 `bcb484ea...` | +| GAP-067 | generic nearest-rank endpoint could be incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected repair `2798e4f9...`; causal repair `c7151b49...`; inherited by #488 `bcb484ea...` | +| GAP-068 | distinct generic percentile endpoints could jointly exceed squared-deviation budget | `verification-pending` | RED `c4a13826...` + repair `cb3f80a2...`; inherited by #488 `bcb484ea...` | +| GAP-069 | two-replication endpoints could exhaust sample while mean/SD remained impossible | `verification-pending` | RED `81bf0d9e...` + repair `d48f8fef...`; inherited by #488 `bcb484ea...` | +| GAP-070 | stored Wilson pair could not arise from one score interval | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...`; inherited by #488 `bcb484ea...` | +| GAP-071 | durable Wilson evidence lacked denominator/critical-value/sidedness provenance | `active-repair` | carrier/authority/v1/envelope lineage; inherited by #488 `bcb484ea...`; durable-consumer adoption remains | +| GAP-072 | exact all-covered Wilson evidence could retain impossible zero lower endpoint | `verification-pending` | RED `ce714f07...` + repair `72e9d954...`; inherited by #488 `bcb484ea...` | +| GAP-073 | durable Wilson count provenance could lose one uncovered observation above exact-integer range | `verification-pending` | RED `29d710a5...` + count/fixed-width/exact-ratio repair lineage; inherited by #488 `bcb484ea...` | +| GAP-074 | durable exact count could be pre-rounded before endpoint projection | `verification-pending` | RED `f89e2467...` + reciprocal-scale repair `73bbb5cf...`; inherited by #488 `bcb484ea...` | +| GAP-075 | inexact all-covered Wilson miss mass could round to exact one | `verification-pending` | RED `059ce70d...` + canonical repair `0f478392...`; inherited by #488 `bcb484ea...` | +| GAP-076 | exact all-covered count could absorb small positive `z²` and emit exact `1.0` | `verification-pending` | RED `e0c4ec81...` + repair `c9dcb9df...`; inherited by #488 `bcb484ea...` | +| GAP-077 | inexact partial denominator could shift exact-count Wilson endpoint by one ULP | `verification-pending` | RED `06e55653...` + TwoSum/FMA repair `6c084dbe...`; inherited by #488 `bcb484ea...` | +| GAP-078 | Wilson residual compensation could move quotient across wrong midpoint | `verification-pending` | RED `d076d344...` + midpoint repair `32314239...`; inherited by #488 `bcb484ea...` | +| GAP-079 | SE-aware acceptance could underflow finite positive `k*SE` to zero through scale-first arithmetic | `verification-pending` | RED `76067efc...` + direct-finite repair `4ffdf366...`; inherited by #488 `bcb484ea...` | +| GAP-080 | both-overflow SE-aware fallback could round strict rejection into equality | `verification-pending` | RED `a9a45714...` + exact significand/exponent repair `425e8963...`; inherited by #488 `bcb484ea...` | +| GAP-081 | finite multiplication could round strict SE-aware rejection into equality | `verification-pending` | RED `23c3262c...` + tie repair `6a2add48...`; inherited by #488 `bcb484ea...` | +| GAP-082 | finite subtraction could round strict rejection onto exact bound | `verification-pending` | RED `58cbc032...` + low-term repair `68a6fd98...`; inherited by #488 `bcb484ea...` | +| GAP-083 | SE-aware product correction could fall below binary64 resolution | `verification-pending` | RED `b55c5473...` / `c77ac440...` + corrected repair `772ad8ed...`; inherited by #488 `bcb484ea...` | +| GAP-084 | legacy Wilson boundary could contradict peer endpoint root | `verification-pending` | RED `c9d612f2...` + peer-root repair `88512417...`; inherited by #488 `bcb484ea...` | +| GAP-085 | equal nonzero subtraction/FMA correction projections could conceal exact ordering | `verification-pending` | RED `35ea85ba...` + exact product-roundoff repair `7d597a18...`; inherited by #488 `bcb484ea...` | +| GAP-086 | mean bias could reject representable result because individual residuals overflow | `verification-pending` | RED `04e6e745...` + explicit-denominator cancellation/bias repair lineage; inherited by #488 `bcb484ea...` | +| GAP-087 | mixed-sign mean bias could discard repeated sub-ULP opposing mass | `verification-pending` | RED `63913727...` + low-term repair `5697cca5...`; inherited by #488 `bcb484ea...` | +| GAP-088 | mixed-remainder compensation could round before scientific count division | `verification-pending` | RED `8b4d19d1...` + compensated-division repair `7a33212b...`; inherited by #488 `bcb484ea...` | +| GAP-089 | exact cancellation could leave same-sign remainder rounded before division | `verification-pending` | RED `84476aad...` + repair `5f0d40b8...`; inherited by #488 `bcb484ea...` | +| GAP-090 | same-sign all-subnormal mean normalization could double-round final bias | `verification-pending` | RED `91abdb49...` + exact-unit repair `1c0df8a7...` + halfway coverage; inherited by #488 `bcb484ea...` | +| GAP-091 | pairwise subtraction roundoff could move mean bias across final midpoint | `verification-pending` | RED `a9d9bda3...` + corrected tail/midpoint repair `676ccda0...`; inherited by #488 `bcb484ea...` | +| GAP-092 | two distinct represented residuals could collapse to one subtraction and false-zero bias SE | `verification-pending` | RED `c9c55ea5...` + n=2 expanded-difference repair `f6d7da96...`; inherited by #488 `bcb484ea...` | +| GAP-093 | n>2 distinct represented residuals could collapse to one rounded high and false-zero bias SE | `verification-pending` | RED `06a70e1c...` + common-high/error-free-low repair `04c62514...`; inherited by #488 `bcb484ea...` | +| GAP-094 | separately rounded square roots could shift bias SE by one ULP | `verification-pending` | corrected RED `62243204...` + direct normalized-SE repair `8b8f0a21...`; inherited by #488 `bcb484ea...` | +| GAP-095 | distinct rounded residual highs could materially overstate uncertainty after subtraction roundoff | `verification-pending` | RED `ae906ad6...` + exact translated-residual repair `d59b9c30...`; inherited by #488 `bcb484ea...` | +| GAP-096 | exact residuals could be re-centered on rounded mean and distort dispersion | `verification-pending` | RED `9265b34a...` + exact-residual translated repair `2fa266b2...`; inherited by #488 `bcb484ea...` | +| GAP-097 | common-high subtraction path could round low-term mean before centering | `verification-pending` | RED `d48e2515...` + exact low-term translated-second-moment repair `a63b8d7a...`; inherited by #488 `bcb484ea...` | +| GAP-098 | exact translated-residual bias SE could double-round through a non-power normalization scale and move the final represented result by one ULP | `verification-pending` | RED `426fc5af...` + shared dyadic-scale prerequisite `d8b411f5...` + causal repair `d536e3b1...` + CHANGELOG `ebce979f...` + research/current #488 `bcb484ea...`; exact-head hosted GREEN/review/main integration remain pending | ## Release gate From 59564f12bff14ed99f9d71219a41e28860033aa0 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 5 Sep 2026 09:03:31 +0900 Subject: [PATCH 192/235] docs(gaps): record repeated-level SE repair --- docs/product-technical-gap-baseline.md | 123 +++++++++++++------------ 1 file changed, 62 insertions(+), 61 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index ed27f96a4..1ec91f4ee 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-04T23:09:06Z +**Snapshot:** 2026-09-05T00:00:23Z **Protected-main evidence:** `a243f18da4a4ca8a8d068c39922537f1f8ed6ad0` **Workspace version:** `0.2.0` @@ -30,7 +30,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `bcb484eab61d8f0198fec5c5119b76c4b0329678` | true | `main` | Validation Evidence landing vehicle, based on protected #490. GAP-093–097 preserve represented-input bias-SE dispersion across subtraction/mean-rounding boundaries. GAP-098 now prevents the exact translated-residual path from double-rounding through a non-power normalization scale by reusing the existing exact power-of-two scale. Earlier Wilson, provenance, Monte Carlo, RMSE/SE, matching, serde/projection repairs remain inherited. Hosted exact-head gates and independent review remain required. | +| #488 | `7741aaa50f7acabe52407696015025458ef98483` | true | `main` | Validation Evidence landing vehicle, based on protected #490. GAP-093–098 preserve represented-input bias-SE dispersion and exact translated geometry. GAP-099 now evaluates the exact three-observation two-level identity `SE(mean)=|level_gap|/3` directly instead of re-rounding the exact gap through square/second-moment/square-root projections. Earlier Wilson, provenance, Monte Carlo, RMSE/SE, matching, serde/projection repairs remain inherited. Hosted exact-head gates and independent review remain required. | | #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 | Validation / Analysis Run fold child. Unique evidence must be inherited by a conflict-resolving survivor; child-head CI does not transfer. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | @@ -62,7 +62,7 @@ The clock contract separates event/valid time, assertion time, document time, sy - Row arrival order is not scientific evidence. Fixed admitted observations must produce bit-identical means/centered results under permutation wherever the contract claims deterministic CPU `f64` reference behavior. - Known-truth component recovery follows bounded-context identity: stable `Between` is unit-level and uses canonical `occasion_index = 0`; `Within` retains actual `(unit, occasion)` identity. Duplicate identities or stable-Between occasion aliases are not weights. - A representable final scientific estimand is not rejected solely because an avoidable intermediate binary64 operation overflows/underflows. False exact 0/1/non-finite endpoints, erased finite bounds, cancellation residues, and double-rounded endpoints are not accepted when a bounded equivalent operation preserves the represented estimand or decision. -- Mean signed bias and bias SE remain Validation Evidence performance measures over admitted recovery units. `mean_bias` uses the direct residual path only when every pairwise subtraction is finite and preserves represented low-order input mass; otherwise it uses the algebraically equivalent recovered-plus-negated-truth numerator, cancellation-safe exact-power-of-two scaling, and the original scientific denominator. `bias_standard_error` still requires each individual signed residual to be representable. For two observations with subtraction roundoff, TEPP evaluates `SE(mean)=|r1-r2|/2` from expanded represented inputs. For `n>2`, the exact translated-residual path is admitted only when anchor-relative high, low, and combined deltas are exactly representable. Translation-invariant dispersion is then evaluated before any rounded residual mean becomes authoritative. GAP-098 additionally requires this admitted path to normalize by the existing exact power-of-two scale rather than an arbitrary translated magnitude, so dyadic geometry is not double-rounded during scale restoration. The normalized standard error remains `sqrt(sum(d²)/(n(n-1)))`. Samples that cannot prove exact translated deltas retain the bounded predecessor fallback. These are bounded repairs, not a claim of globally correctly rounded n>2 dispersion. Mathematically nonzero final results outside binary64 range fail closed. +- Mean signed bias and bias SE remain Validation Evidence performance measures over admitted recovery units. `mean_bias` uses the direct residual path only when every pairwise subtraction is finite and preserves represented low-order input mass; otherwise it uses the algebraically equivalent recovered-plus-negated-truth numerator, cancellation-safe exact-power-of-two scaling, and the original scientific denominator. `bias_standard_error` still requires each individual signed residual to be representable. For two observations with subtraction roundoff, TEPP evaluates `SE(mean)=|r1-r2|/2` from expanded represented inputs. For `n>2`, the exact translated-residual path is admitted only when anchor-relative high, low, and combined deltas are exactly representable. Translation-invariant dispersion is then evaluated before any rounded residual mean becomes authoritative. GAP-098 additionally requires this admitted path to normalize by the existing exact power-of-two scale rather than an arbitrary translated magnitude, so dyadic geometry is not double-rounded during scale restoration. GAP-099 further requires an admitted `n=3` sample with exactly two equal represented residual levels to use the exact identity `SE(mean)=|level_gap|/3` before the general squared-second-moment/square-root path. Other admitted samples retain `sqrt(sum(d²)/(n(n-1)))`. Samples that cannot prove exact translated deltas retain the bounded predecessor fallback. These are bounded repairs, not a claim of globally correctly rounded n>2 dispersion. Mathematically nonzero final results outside binary64 range fail closed. - Generic Validation Evidence RMSE and its delta-method SE normalize before squaring. Exact-zero point RMSE requires exact-zero point RMSE SE. For positive RMSE, the declared producer satisfies `SE(RMSE) <= RMSE / 2`, with a small relative binary64 admission tolerance. - Generic `MonteCarloSummary` is sign-neutral. Zero SD requires zero SE and percentile endpoints equal to the represented mean. Positive SD requires positive SE coherent with represented `SD / sqrt(n)` within a small relative tolerance. Every inclusive nearest-rank endpoint is a retained observation and satisfies `|endpoint - mean| <= SD * sqrt(n - 1)`. Distinct lower/upper endpoint values share the same `(n - 1) * SD²` deviation budget. When `replication_count=2` and endpoints are distinct, those endpoints exhaust the retained sample and must reconstruct the represented mean/sample SD. - When the generic carrier occupies `ValidationReport::monte_carlo_rmse`, retained replications are nonnegative; positive mean implies `SE(mean) <= mean`, and inclusive nearest-rank endpoints cannot exceed nonnegative sample-sum support `n * mean`. These typed bounds are not imposed on signed metrics such as bias. @@ -83,13 +83,13 @@ The clock contract separates event/valid time, assertion time, document time, sy ### #488 — Validation Evidence -#488 is the generic Validation Evidence landing vehicle at exact head `bcb484eab61d8f0198fec5c5119b76c4b0329678`, based on protected #490. GAP-093–097 remain inherited and executable. +#488 is the generic Validation Evidence landing vehicle at exact head `7741aaa50f7acabe52407696015025458ef98483`, based on protected #490. GAP-093–098 remain inherited and executable. -GAP-098 RED `426fc5afd8aae8c2d5f81f53e5db074b480ac8b7` adds the exact three-observation boundary `u=2^-52`, `a=1-4u`, `b=1+u`, `truth=[0,0,0]`, `recovered=[a,a,b]`. The represented residual gap is exactly `d=5*2^-52`, and translation invariance gives `SE(mean)=d/3`, which rounds to bits `0x3cba_aaaa_aaaa_aaab`. The predecessor translated to `[0,0,d]`, chose the non-power normalization scale `d`, rounded the normalized square-root stage to the binary64 approximation of `1/3`, and restored with `d`, yielding adjacent lower bits `0x3cba_aaaa_aaaa_aaaa`. The sign mirror reproduces the defect. +GAP-099 RED `fbcdb7fac40744c697debbbe6184d4e0ffd5e32a` adds `a=next_down(1.0)=0x1.fffffffffffffp-1`, `truth=[0,0,0]`, `recovered=[0,a,a]`. Every represented residual and translated delta is exact. For this three-observation two-level sample, `SE(mean)=|a|/3`, which correctly rounds to bits `0x3fd5_5555_5555_5555`. The predecessor exact-translated path instead projected the exact gap through normalized squares, the second-moment numerator, division, and square root, yielding adjacent lower bits `0x3fd5_5555_5555_5554`. Permutation and sign-mirror controls reproduce the same identity. -Shared prerequisite `d8b411f5dcf93ff21b18eaa4ff5ccd8d2863a6cd` makes the already-existing `numeric::exact_power_of_two_scale` helper crate-visible without changing its arithmetic. Causal repair `d536e3b1082c0f705a6ddd7722bf45c93ac594e3` reuses that helper in `bias::exact_translated_residual_standard_error`; exact power-of-two scaling preserves the dyadic translated geometry across normalization/restoration while retaining the existing nonzero-to-zero guard and bounded fallback. CHANGELOG `ebce979fdfb0ab2d94e3ba70145b0076a7ef07ca`; research/current #488 `bcb484eab61d8f0198fec5c5119b76c4b0329678`. +Causal repair `e0f2445d825f12817631ca8e5ef5fed77fcd113a` remains inside the existing exact translated-delta admission. For `n=3` with exactly two equal represented residual levels, it evaluates `|level_gap|/3` directly; a nonzero gap that would divide to false zero remains fail closed. The general translated second-moment path, GAP-098 dyadic normalization, and bounded fallbacks remain unchanged. CHANGELOG `ee81953e9ad39aede8d6dd8b4a7b8b1677d18d0`; research/current #488 `7741aaa50f7acabe52407696015025458ef98483`. -This does not claim globally correctly rounded n>2 bias standard errors. Exact translated-delta admission is unchanged; later binary64 square, compensated sum, division, square root, and fallback behavior require independent represented-input counterexamples before further widening. +GAP-098 remains inherited: RED `426fc5afd8aae8c2d5f81f53e5db074b480ac8b7` proves non-power normalization could move an exact translated `d/3` result by one ULP; prerequisite `d8b411f5dcf93ff21b18eaa4ff5ccd8d2863a6cd` and repair `d536e3b1082c0f705a6ddd7722bf45c93ac594e3` reuse the existing exact power-of-two scale. This does not claim globally correctly rounded n>2 bias standard errors. Three distinct levels, larger sample sizes, product/square accumulation, division, square root, and fallback behavior require independent represented-input counterexamples before further widening. ### #416 — Validation / Analysis Run consolidation @@ -101,7 +101,7 @@ This does not claim globally correctly rounded n>2 bias standard errors. Exact t ## Gap register -GAP-001–GAP-044 retain their existing domain/release identities and closure lineage. They remain unchanged by the GAP-098 numerical repair; their authoritative source/test/ADR history remains in repository ancestry and the surviving landing vehicles listed above. The validation lineage from GAP-045 onward is restated here because #488 is its current single writer. +GAP-001–GAP-044 retain their existing domain/release identities and closure lineage. They remain unchanged by the GAP-099 numerical repair; their authoritative source/test/ADR history remains in repository ancestry and the surviving landing vehicles listed above. The validation lineage from GAP-045 onward is restated here because #488 is its current single writer. | ID | Gap | Maturity | Closure evidence | | --- | --- | --- | --- | @@ -149,60 +149,61 @@ GAP-001–GAP-044 retain their existing domain/release identities and closure li | GAP-042 | ratio-first logarithm inflated adjacent-float growth rate | `verification-pending` | RED `766ddc7a...` + `ln_1p` repair `16f21d9a...` | | GAP-043 | duplicate known-truth identities could silently reweight RMSE | `verification-pending` | RED `698f12f5...` + repair `2fae4cb2...` | | GAP-044 | known-truth RMSE alignment depended on row order | `verification-pending` | RED `8ad72ac9...` / `5fb93c40...` + repairs `2dd9537e...` / `025dce7f...`; #310 `c6680450...` | -| GAP-045 | mean signed bias could reject representable result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; inherited by #488 `bcb484ea...` | -| GAP-046 | bias SE could reject representable SEM because raw squared deviations overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; inherited by #488 `bcb484ea...` | -| GAP-047 | generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; inherited by #488 `bcb484ea...` | -| GAP-048 | mean signed bias could erase representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; inherited by #488 `bcb484ea...` | +| GAP-045 | mean signed bias could reject representable result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; inherited by #488 `7741aaa...` | +| GAP-046 | bias SE could reject representable SEM because raw squared deviations overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; inherited by #488 `7741aaa...` | +| GAP-047 | generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; inherited by #488 `7741aaa...` | +| GAP-048 | mean signed bias could erase representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; inherited by #488 `7741aaa...` | | GAP-049 | stable `Between` recovery could be aliased across occasion indices and reweight RMSE | `verification-pending` | RED `0a03041c...` + repair `ec2c1219...`; #310 `c6680450...` | -| GAP-050 | zero-multiplier SE-aware acceptance could erase nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; inherited by #488 `bcb484ea...` | -| GAP-051 | exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; inherited by #488 `bcb484ea...` | -| GAP-052 | all-covered Wilson lower endpoint could cancel positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; inherited by #488 `bcb484ea...` | -| GAP-053 | strict-interior Wilson lower endpoint could cancel positive value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; inherited by #488 `bcb484ea...` | -| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; inherited by #488 `bcb484ea...` | -| GAP-055 | strict-interior Wilson lower endpoint could accept nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; inherited by #488 `bcb484ea...` | -| GAP-056 | durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; inherited by #488 `bcb484ea...` | -| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; inherited by #488 `bcb484ea...` | -| GAP-058 | generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; inherited by #488 `bcb484ea...` | -| GAP-059 | Monte Carlo summary could materially misstate positive SE relative to `SD/sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; inherited by #488 `bcb484ea...` | -| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; inherited by #488 `bcb484ea...` | -| GAP-061 | generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; inherited by #488 `bcb484ea...` | -| GAP-062 | finite-tolerance matching could fail for deterministically outside pair | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; inherited by #488 `bcb484ea...` | -| GAP-063 | exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; inherited by #488 `bcb484ea...` | -| GAP-064 | positive point RMSE could carry SE above squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; inherited by #488 `bcb484ea...` | -| GAP-065 | positive Monte Carlo RMSE could carry impossible spread/SE | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; inherited by #488 `bcb484ea...` | -| GAP-066 | RMSE nearest-rank percentile could exceed nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; inherited by #488 `bcb484ea...` | -| GAP-067 | generic nearest-rank endpoint could be incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected repair `2798e4f9...`; causal repair `c7151b49...`; inherited by #488 `bcb484ea...` | -| GAP-068 | distinct generic percentile endpoints could jointly exceed squared-deviation budget | `verification-pending` | RED `c4a13826...` + repair `cb3f80a2...`; inherited by #488 `bcb484ea...` | -| GAP-069 | two-replication endpoints could exhaust sample while mean/SD remained impossible | `verification-pending` | RED `81bf0d9e...` + repair `d48f8fef...`; inherited by #488 `bcb484ea...` | -| GAP-070 | stored Wilson pair could not arise from one score interval | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...`; inherited by #488 `bcb484ea...` | -| GAP-071 | durable Wilson evidence lacked denominator/critical-value/sidedness provenance | `active-repair` | carrier/authority/v1/envelope lineage; inherited by #488 `bcb484ea...`; durable-consumer adoption remains | -| GAP-072 | exact all-covered Wilson evidence could retain impossible zero lower endpoint | `verification-pending` | RED `ce714f07...` + repair `72e9d954...`; inherited by #488 `bcb484ea...` | -| GAP-073 | durable Wilson count provenance could lose one uncovered observation above exact-integer range | `verification-pending` | RED `29d710a5...` + count/fixed-width/exact-ratio repair lineage; inherited by #488 `bcb484ea...` | -| GAP-074 | durable exact count could be pre-rounded before endpoint projection | `verification-pending` | RED `f89e2467...` + reciprocal-scale repair `73bbb5cf...`; inherited by #488 `bcb484ea...` | -| GAP-075 | inexact all-covered Wilson miss mass could round to exact one | `verification-pending` | RED `059ce70d...` + canonical repair `0f478392...`; inherited by #488 `bcb484ea...` | -| GAP-076 | exact all-covered count could absorb small positive `z²` and emit exact `1.0` | `verification-pending` | RED `e0c4ec81...` + repair `c9dcb9df...`; inherited by #488 `bcb484ea...` | -| GAP-077 | inexact partial denominator could shift exact-count Wilson endpoint by one ULP | `verification-pending` | RED `06e55653...` + TwoSum/FMA repair `6c084dbe...`; inherited by #488 `bcb484ea...` | -| GAP-078 | Wilson residual compensation could move quotient across wrong midpoint | `verification-pending` | RED `d076d344...` + midpoint repair `32314239...`; inherited by #488 `bcb484ea...` | -| GAP-079 | SE-aware acceptance could underflow finite positive `k*SE` to zero through scale-first arithmetic | `verification-pending` | RED `76067efc...` + direct-finite repair `4ffdf366...`; inherited by #488 `bcb484ea...` | -| GAP-080 | both-overflow SE-aware fallback could round strict rejection into equality | `verification-pending` | RED `a9a45714...` + exact significand/exponent repair `425e8963...`; inherited by #488 `bcb484ea...` | -| GAP-081 | finite multiplication could round strict SE-aware rejection into equality | `verification-pending` | RED `23c3262c...` + tie repair `6a2add48...`; inherited by #488 `bcb484ea...` | -| GAP-082 | finite subtraction could round strict rejection onto exact bound | `verification-pending` | RED `58cbc032...` + low-term repair `68a6fd98...`; inherited by #488 `bcb484ea...` | -| GAP-083 | SE-aware product correction could fall below binary64 resolution | `verification-pending` | RED `b55c5473...` / `c77ac440...` + corrected repair `772ad8ed...`; inherited by #488 `bcb484ea...` | -| GAP-084 | legacy Wilson boundary could contradict peer endpoint root | `verification-pending` | RED `c9d612f2...` + peer-root repair `88512417...`; inherited by #488 `bcb484ea...` | -| GAP-085 | equal nonzero subtraction/FMA correction projections could conceal exact ordering | `verification-pending` | RED `35ea85ba...` + exact product-roundoff repair `7d597a18...`; inherited by #488 `bcb484ea...` | -| GAP-086 | mean bias could reject representable result because individual residuals overflow | `verification-pending` | RED `04e6e745...` + explicit-denominator cancellation/bias repair lineage; inherited by #488 `bcb484ea...` | -| GAP-087 | mixed-sign mean bias could discard repeated sub-ULP opposing mass | `verification-pending` | RED `63913727...` + low-term repair `5697cca5...`; inherited by #488 `bcb484ea...` | -| GAP-088 | mixed-remainder compensation could round before scientific count division | `verification-pending` | RED `8b4d19d1...` + compensated-division repair `7a33212b...`; inherited by #488 `bcb484ea...` | -| GAP-089 | exact cancellation could leave same-sign remainder rounded before division | `verification-pending` | RED `84476aad...` + repair `5f0d40b8...`; inherited by #488 `bcb484ea...` | -| GAP-090 | same-sign all-subnormal mean normalization could double-round final bias | `verification-pending` | RED `91abdb49...` + exact-unit repair `1c0df8a7...` + halfway coverage; inherited by #488 `bcb484ea...` | -| GAP-091 | pairwise subtraction roundoff could move mean bias across final midpoint | `verification-pending` | RED `a9d9bda3...` + corrected tail/midpoint repair `676ccda0...`; inherited by #488 `bcb484ea...` | -| GAP-092 | two distinct represented residuals could collapse to one subtraction and false-zero bias SE | `verification-pending` | RED `c9c55ea5...` + n=2 expanded-difference repair `f6d7da96...`; inherited by #488 `bcb484ea...` | -| GAP-093 | n>2 distinct represented residuals could collapse to one rounded high and false-zero bias SE | `verification-pending` | RED `06a70e1c...` + common-high/error-free-low repair `04c62514...`; inherited by #488 `bcb484ea...` | -| GAP-094 | separately rounded square roots could shift bias SE by one ULP | `verification-pending` | corrected RED `62243204...` + direct normalized-SE repair `8b8f0a21...`; inherited by #488 `bcb484ea...` | -| GAP-095 | distinct rounded residual highs could materially overstate uncertainty after subtraction roundoff | `verification-pending` | RED `ae906ad6...` + exact translated-residual repair `d59b9c30...`; inherited by #488 `bcb484ea...` | -| GAP-096 | exact residuals could be re-centered on rounded mean and distort dispersion | `verification-pending` | RED `9265b34a...` + exact-residual translated repair `2fa266b2...`; inherited by #488 `bcb484ea...` | -| GAP-097 | common-high subtraction path could round low-term mean before centering | `verification-pending` | RED `d48e2515...` + exact low-term translated-second-moment repair `a63b8d7a...`; inherited by #488 `bcb484ea...` | -| GAP-098 | exact translated-residual bias SE could double-round through a non-power normalization scale and move the final represented result by one ULP | `verification-pending` | RED `426fc5af...` + shared dyadic-scale prerequisite `d8b411f5...` + causal repair `d536e3b1...` + CHANGELOG `ebce979f...` + research/current #488 `bcb484ea...`; exact-head hosted GREEN/review/main integration remain pending | +| GAP-050 | zero-multiplier SE-aware acceptance could erase nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; inherited by #488 `7741aaa...` | +| GAP-051 | exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; inherited by #488 `7741aaa...` | +| GAP-052 | all-covered Wilson lower endpoint could cancel positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; inherited by #488 `7741aaa...` | +| GAP-053 | strict-interior Wilson lower endpoint could cancel positive value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; inherited by #488 `7741aaa...` | +| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; inherited by #488 `7741aaa...` | +| GAP-055 | strict-interior Wilson lower endpoint could accept nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; inherited by #488 `7741aaa...` | +| GAP-056 | durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; inherited by #488 `7741aaa...` | +| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; inherited by #488 `7741aaa...` | +| GAP-058 | generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; inherited by #488 `7741aaa...` | +| GAP-059 | Monte Carlo summary could materially misstate positive SE relative to `SD/sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; inherited by #488 `7741aaa...` | +| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; inherited by #488 `7741aaa...` | +| GAP-061 | generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; inherited by #488 `7741aaa...` | +| GAP-062 | finite-tolerance matching could fail for deterministically outside pair | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; inherited by #488 `7741aaa...` | +| GAP-063 | exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; inherited by #488 `7741aaa...` | +| GAP-064 | positive point RMSE could carry SE above squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; inherited by #488 `7741aaa...` | +| GAP-065 | positive Monte Carlo RMSE could carry impossible spread/SE | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; inherited by #488 `7741aaa...` | +| GAP-066 | RMSE nearest-rank percentile could exceed nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; inherited by #488 `7741aaa...` | +| GAP-067 | generic nearest-rank endpoint could be incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected repair `2798e4f9...`; causal repair `c7151b49...`; inherited by #488 `7741aaa...` | +| GAP-068 | distinct generic percentile endpoints could jointly exceed squared-deviation budget | `verification-pending` | RED `c4a13826...` + repair `cb3f80a2...`; inherited by #488 `7741aaa...` | +| GAP-069 | two-replication endpoints could exhaust sample while mean/SD remained impossible | `verification-pending` | RED `81bf0d9e...` + repair `d48f8fef...`; inherited by #488 `7741aaa...` | +| GAP-070 | stored Wilson pair could not arise from one score interval | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...`; inherited by #488 `7741aaa...` | +| GAP-071 | durable Wilson evidence lacked denominator/critical-value/sidedness provenance | `active-repair` | carrier/authority/v1/envelope lineage; inherited by #488 `7741aaa...`; durable-consumer adoption remains | +| GAP-072 | exact all-covered Wilson evidence could retain impossible zero lower endpoint | `verification-pending` | RED `ce714f07...` + repair `72e9d954...`; inherited by #488 `7741aaa...` | +| GAP-073 | durable Wilson count provenance could lose one uncovered observation above exact-integer range | `verification-pending` | RED `29d710a5...` + count/fixed-width/exact-ratio repair lineage; inherited by #488 `7741aaa...` | +| GAP-074 | durable exact count could be pre-rounded before endpoint projection | `verification-pending` | RED `f89e2467...` + reciprocal-scale repair `73bbb5cf...`; inherited by #488 `7741aaa...` | +| GAP-075 | inexact all-covered Wilson miss mass could round to exact one | `verification-pending` | RED `059ce70d...` + canonical repair `0f478392...`; inherited by #488 `7741aaa...` | +| GAP-076 | exact all-covered count could absorb small positive `z²` and emit exact `1.0` | `verification-pending` | RED `e0c4ec81...` + repair `c9dcb9df...`; inherited by #488 `7741aaa...` | +| GAP-077 | inexact partial denominator could shift exact-count Wilson endpoint by one ULP | `verification-pending` | RED `06e55653...` + TwoSum/FMA repair `6c084dbe...`; inherited by #488 `7741aaa...` | +| GAP-078 | Wilson residual compensation could move quotient across wrong midpoint | `verification-pending` | RED `d076d344...` + midpoint repair `32314239...`; inherited by #488 `7741aaa...` | +| GAP-079 | SE-aware acceptance could underflow finite positive `k*SE` to zero through scale-first arithmetic | `verification-pending` | RED `76067efc...` + direct-finite repair `4ffdf366...`; inherited by #488 `7741aaa...` | +| GAP-080 | both-overflow SE-aware fallback could round strict rejection into equality | `verification-pending` | RED `a9a45714...` + exact significand/exponent repair `425e8963...`; inherited by #488 `7741aaa...` | +| GAP-081 | finite multiplication could round strict SE-aware rejection into equality | `verification-pending` | RED `23c3262c...` + tie repair `6a2add48...`; inherited by #488 `7741aaa...` | +| GAP-082 | finite subtraction could round strict rejection onto exact bound | `verification-pending` | RED `58cbc032...` + low-term repair `68a6fd98...`; inherited by #488 `7741aaa...` | +| GAP-083 | SE-aware product correction could fall below binary64 resolution | `verification-pending` | RED `b55c5473...` / `c77ac440...` + corrected repair `772ad8ed...`; inherited by #488 `7741aaa...` | +| GAP-084 | legacy Wilson boundary could contradict peer endpoint root | `verification-pending` | RED `c9d612f2...` + peer-root repair `88512417...`; inherited by #488 `7741aaa...` | +| GAP-085 | equal nonzero subtraction/FMA correction projections could conceal exact ordering | `verification-pending` | RED `35ea85ba...` + exact product-roundoff repair `7d597a18...`; inherited by #488 `7741aaa...` | +| GAP-086 | mean bias could reject representable result because individual residuals overflow | `verification-pending` | RED `04e6e745...` + explicit-denominator cancellation/bias repair lineage; inherited by #488 `7741aaa...` | +| GAP-087 | mixed-sign mean bias could discard repeated sub-ULP opposing mass | `verification-pending` | RED `63913727...` + low-term repair `5697cca5...`; inherited by #488 `7741aaa...` | +| GAP-088 | mixed-remainder compensation could round before scientific count division | `verification-pending` | RED `8b4d19d1...` + compensated-division repair `7a33212b...`; inherited by #488 `7741aaa...` | +| GAP-089 | exact cancellation could leave same-sign remainder rounded before division | `verification-pending` | RED `84476aad...` + repair `5f0d40b8...`; inherited by #488 `7741aaa...` | +| GAP-090 | same-sign all-subnormal mean normalization could double-round final bias | `verification-pending` | RED `91abdb49...` + exact-unit repair `1c0df8a7...` + halfway coverage; inherited by #488 `7741aaa...` | +| GAP-091 | pairwise subtraction roundoff could move mean bias across final midpoint | `verification-pending` | RED `a9d9bda3...` + corrected tail/midpoint repair `676ccda0...`; inherited by #488 `7741aaa...` | +| GAP-092 | two distinct represented residuals could collapse to one subtraction and false-zero bias SE | `verification-pending` | RED `c9c55ea5...` + n=2 expanded-difference repair `f6d7da96...`; inherited by #488 `7741aaa...` | +| GAP-093 | n>2 distinct represented residuals could collapse to one rounded high and false-zero bias SE | `verification-pending` | RED `06a70e1c...` + common-high/error-free-low repair `04c62514...`; inherited by #488 `7741aaa...` | +| GAP-094 | separately rounded square roots could shift bias SE by one ULP | `verification-pending` | corrected RED `62243204...` + direct normalized-SE repair `8b8f0a21...`; inherited by #488 `7741aaa...` | +| GAP-095 | distinct rounded residual highs could materially overstate uncertainty after subtraction roundoff | `verification-pending` | RED `ae906ad6...` + exact translated-residual repair `d59b9c30...`; inherited by #488 `7741aaa...` | +| GAP-096 | exact residuals could be re-centered on rounded mean and distort dispersion | `verification-pending` | RED `9265b34a...` + exact-residual translated repair `2fa266b2...`; inherited by #488 `7741aaa...` | +| GAP-097 | common-high subtraction path could round low-term mean before centering | `verification-pending` | RED `d48e2515...` + exact low-term translated-second-moment repair `a63b8d7a...`; inherited by #488 `7741aaa...` | +| GAP-098 | exact translated-residual bias SE could double-round through a non-power normalization scale and move the final represented result by one ULP | `verification-pending` | RED `426fc5af...` + shared dyadic-scale prerequisite `d8b411f5...` + causal repair `d536e3b1...` + CHANGELOG `ebce979f...`; inherited by #488 `7741aaa...` | +| GAP-099 | exact translated three-observation two-level bias SE could re-round an exact gap through square/second-moment/square-root and move the represented result by one ULP | `verification-pending` | RED `fbcdb7fa...` + causal repair `e0f2445d...` + CHANGELOG `ee81953e...` + research/current #488 `7741aaa...`; exact-head hosted GREEN/review/main integration remain pending | ## Release gate From 8dc5c6551d46f403c29b8290062c21b6dc66f679 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 5 Sep 2026 10:09:51 +0900 Subject: [PATCH 193/235] docs(ddd): track GAP-100 singleton-level SE repair --- docs/product-technical-gap-baseline.md | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 1ec91f4ee..8960fa8c5 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-05T00:00:23Z +**Snapshot:** 2026-09-05T01:07:48Z **Protected-main evidence:** `a243f18da4a4ca8a8d068c39922537f1f8ed6ad0` **Workspace version:** `0.2.0` @@ -30,7 +30,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `7741aaa50f7acabe52407696015025458ef98483` | true | `main` | Validation Evidence landing vehicle, based on protected #490. GAP-093–098 preserve represented-input bias-SE dispersion and exact translated geometry. GAP-099 now evaluates the exact three-observation two-level identity `SE(mean)=|level_gap|/3` directly instead of re-rounding the exact gap through square/second-moment/square-root projections. Earlier Wilson, provenance, Monte Carlo, RMSE/SE, matching, serde/projection repairs remain inherited. Hosted exact-head gates and independent review remain required. | +| #488 | `944fac058a74b375fde86dbc2a860a4a4e386234` | true | `main` | Validation Evidence landing vehicle, based on protected #490. GAP-093–099 preserve represented-input bias-SE dispersion and exact translated geometry. GAP-100 extends the exact translated two-level closed form only when either represented level is a singleton: `SE(mean)=|level_gap|/n`. The four-row `[0,a,a,a]` counterexample proves the prior generic square/second-moment/square-root path could move the exact result by one ULP. Earlier Wilson, provenance, Monte Carlo, RMSE/SE, matching, serde/projection repairs remain inherited. Hosted exact-head gates and independent review remain required. | | #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 | Validation / Analysis Run fold child. Unique evidence must be inherited by a conflict-resolving survivor; child-head CI does not transfer. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | @@ -62,7 +62,7 @@ The clock contract separates event/valid time, assertion time, document time, sy - Row arrival order is not scientific evidence. Fixed admitted observations must produce bit-identical means/centered results under permutation wherever the contract claims deterministic CPU `f64` reference behavior. - Known-truth component recovery follows bounded-context identity: stable `Between` is unit-level and uses canonical `occasion_index = 0`; `Within` retains actual `(unit, occasion)` identity. Duplicate identities or stable-Between occasion aliases are not weights. - A representable final scientific estimand is not rejected solely because an avoidable intermediate binary64 operation overflows/underflows. False exact 0/1/non-finite endpoints, erased finite bounds, cancellation residues, and double-rounded endpoints are not accepted when a bounded equivalent operation preserves the represented estimand or decision. -- Mean signed bias and bias SE remain Validation Evidence performance measures over admitted recovery units. `mean_bias` uses the direct residual path only when every pairwise subtraction is finite and preserves represented low-order input mass; otherwise it uses the algebraically equivalent recovered-plus-negated-truth numerator, cancellation-safe exact-power-of-two scaling, and the original scientific denominator. `bias_standard_error` still requires each individual signed residual to be representable. For two observations with subtraction roundoff, TEPP evaluates `SE(mean)=|r1-r2|/2` from expanded represented inputs. For `n>2`, the exact translated-residual path is admitted only when anchor-relative high, low, and combined deltas are exactly representable. Translation-invariant dispersion is then evaluated before any rounded residual mean becomes authoritative. GAP-098 additionally requires this admitted path to normalize by the existing exact power-of-two scale rather than an arbitrary translated magnitude, so dyadic geometry is not double-rounded during scale restoration. GAP-099 further requires an admitted `n=3` sample with exactly two equal represented residual levels to use the exact identity `SE(mean)=|level_gap|/3` before the general squared-second-moment/square-root path. Other admitted samples retain `sqrt(sum(d²)/(n(n-1)))`. Samples that cannot prove exact translated deltas retain the bounded predecessor fallback. These are bounded repairs, not a claim of globally correctly rounded n>2 dispersion. Mathematically nonzero final results outside binary64 range fail closed. +- Mean signed bias and bias SE remain Validation Evidence performance measures over admitted recovery units. `mean_bias` uses the direct residual path only when every pairwise subtraction is finite and preserves represented low-order input mass; otherwise it uses the algebraically equivalent recovered-plus-negated-truth numerator, cancellation-safe exact-power-of-two scaling, and the original scientific denominator. `bias_standard_error` still requires each individual signed residual to be representable. For two observations with subtraction roundoff, TEPP evaluates `SE(mean)=|r1-r2|/2` from expanded represented inputs. For `n>2`, the exact translated-residual path is admitted only when anchor-relative high, low, and combined deltas are exactly representable. Translation-invariant dispersion is then evaluated before any rounded residual mean becomes authoritative. GAP-098 additionally requires this admitted path to normalize by the existing exact power-of-two scale rather than an arbitrary translated magnitude, so dyadic geometry is not double-rounded during scale restoration. GAP-099 established the exact `n=3` two-level identity. GAP-100 generalizes only the same proven algebraic structure: after exact translation, when exactly two represented levels remain and either level occurs once, evaluate `SE(mean)=|level_gap|/n` directly before the generic squared-second-moment/square-root path. Other admitted samples retain `sqrt(sum(d²)/(n(n-1)))`. Samples that cannot prove exact translated deltas retain the bounded predecessor fallback. These are bounded repairs, not a claim of globally correctly rounded n>2 dispersion. Mathematically nonzero final results outside binary64 range fail closed. - Generic Validation Evidence RMSE and its delta-method SE normalize before squaring. Exact-zero point RMSE requires exact-zero point RMSE SE. For positive RMSE, the declared producer satisfies `SE(RMSE) <= RMSE / 2`, with a small relative binary64 admission tolerance. - Generic `MonteCarloSummary` is sign-neutral. Zero SD requires zero SE and percentile endpoints equal to the represented mean. Positive SD requires positive SE coherent with represented `SD / sqrt(n)` within a small relative tolerance. Every inclusive nearest-rank endpoint is a retained observation and satisfies `|endpoint - mean| <= SD * sqrt(n - 1)`. Distinct lower/upper endpoint values share the same `(n - 1) * SD²` deviation budget. When `replication_count=2` and endpoints are distinct, those endpoints exhaust the retained sample and must reconstruct the represented mean/sample SD. - When the generic carrier occupies `ValidationReport::monte_carlo_rmse`, retained replications are nonnegative; positive mean implies `SE(mean) <= mean`, and inclusive nearest-rank endpoints cannot exceed nonnegative sample-sum support `n * mean`. These typed bounds are not imposed on signed metrics such as bias. @@ -83,13 +83,13 @@ The clock contract separates event/valid time, assertion time, document time, sy ### #488 — Validation Evidence -#488 is the generic Validation Evidence landing vehicle at exact head `7741aaa50f7acabe52407696015025458ef98483`, based on protected #490. GAP-093–098 remain inherited and executable. +#488 is the generic Validation Evidence landing vehicle at exact head `944fac058a74b375fde86dbc2a860a4a4e386234`, based on protected #490. GAP-093–099 remain inherited and executable. -GAP-099 RED `fbcdb7fac40744c697debbbe6184d4e0ffd5e32a` adds `a=next_down(1.0)=0x1.fffffffffffffp-1`, `truth=[0,0,0]`, `recovered=[0,a,a]`. Every represented residual and translated delta is exact. For this three-observation two-level sample, `SE(mean)=|a|/3`, which correctly rounds to bits `0x3fd5_5555_5555_5555`. The predecessor exact-translated path instead projected the exact gap through normalized squares, the second-moment numerator, division, and square root, yielding adjacent lower bits `0x3fd5_5555_5555_5554`. Permutation and sign-mirror controls reproduce the same identity. +GAP-100 RED `4386d9ace83cd54aa129067ddc589b1a628147a2` adds `a=next_down(1.0)=0x1.fffffffffffffp-1`, `truth=[0,0,0,0]`, `recovered=[0,a,a,a]`. Every represented residual and translated delta is exact. For this four-observation two-level singleton/repeated-level sample, `SE(mean)=|a|/4`, correctly represented as bits `0x3fcf_ffff_ffff_ffff`. The predecessor generic translated path squares and square-roots the exact gap and yields adjacent lower bits `0x3fcf_ffff_ffff_fffe`. Permutation and sign-mirror controls reproduce the same identity. -Causal repair `e0f2445d825f12817631ca8e5ef5fed77fcd113a` remains inside the existing exact translated-delta admission. For `n=3` with exactly two equal represented residual levels, it evaluates `|level_gap|/3` directly; a nonzero gap that would divide to false zero remains fail closed. The general translated second-moment path, GAP-098 dyadic normalization, and bounded fallbacks remain unchanged. CHANGELOG `ee81953e9ad39aede8d6dd8b4a7b8b1677d18d0`; research/current #488 `7741aaa50f7acabe52407696015025458ef98483`. +Causal repair `79ad03fae4364d6c364915a062eb0fc8615eaa43` remains inside the existing exact translated-delta admission. If an exactly translated sample contains exactly two represented levels and either level occurs once, it evaluates `|level_gap|/n` directly. Edge coverage `7fe4117c5666af08adbfda5d32beb12648f579c6` fixes minimum-subnormal false-zero refusal; CHANGELOG `017ad11ad974219a5a0e1cf91c1ecf55c44524c2`; research/current #488 `944fac058a74b375fde86dbc2a860a4a4e386234`. Two-level samples without a singleton, samples with three or more represented levels, and failed exact-translation admissions retain the bounded predecessor paths. -GAP-098 remains inherited: RED `426fc5afd8aae8c2d5f81f53e5db074b480ac8b7` proves non-power normalization could move an exact translated `d/3` result by one ULP; prerequisite `d8b411f5dcf93ff21b18eaa4ff5ccd8d2863a6cd` and repair `d536e3b1082c0f705a6ddd7722bf45c93ac594e3` reuse the existing exact power-of-two scale. This does not claim globally correctly rounded n>2 bias standard errors. Three distinct levels, larger sample sizes, product/square accumulation, division, square root, and fallback behavior require independent represented-input counterexamples before further widening. +GAP-099 remains inherited: RED `fbcdb7fac40744c697debbbe6184d4e0ffd5e32a` proved the `n=3` repeated-level instance and repair `e0f2445d825f12817631ca8e5ef5fed77fcd113a` established the original closed form. GAP-098 remains inherited: RED `426fc5afd8aae8c2d5f81f53e5db074b480ac8b7` proves non-power normalization could move an exact translated `d/3` result by one ULP; prerequisite `d8b411f5dcf93ff21b18eaa4ff5ccd8d2863a6cd` and repair `d536e3b1082c0f705a6ddd7722bf45c93ac594e3` reuse the existing exact power-of-two scale. This does not claim globally correctly rounded n>2 bias standard errors. ### #416 — Validation / Analysis Run consolidation @@ -101,7 +101,7 @@ GAP-098 remains inherited: RED `426fc5afd8aae8c2d5f81f53e5db074b480ac8b7` proves ## Gap register -GAP-001–GAP-044 retain their existing domain/release identities and closure lineage. They remain unchanged by the GAP-099 numerical repair; their authoritative source/test/ADR history remains in repository ancestry and the surviving landing vehicles listed above. The validation lineage from GAP-045 onward is restated here because #488 is its current single writer. +GAP-001–GAP-044 retain their existing domain/release identities and closure lineage. They remain unchanged by the GAP-100 numerical repair; their authoritative source/test/ADR history remains in repository ancestry and the surviving landing vehicles listed above. The validation lineage from GAP-045 onward is restated here because #488 is its current single writer. | ID | Gap | Maturity | Closure evidence | | --- | --- | --- | --- | @@ -203,7 +203,8 @@ GAP-001–GAP-044 retain their existing domain/release identities and closure li | GAP-096 | exact residuals could be re-centered on rounded mean and distort dispersion | `verification-pending` | RED `9265b34a...` + exact-residual translated repair `2fa266b2...`; inherited by #488 `7741aaa...` | | GAP-097 | common-high subtraction path could round low-term mean before centering | `verification-pending` | RED `d48e2515...` + exact low-term translated-second-moment repair `a63b8d7a...`; inherited by #488 `7741aaa...` | | GAP-098 | exact translated-residual bias SE could double-round through a non-power normalization scale and move the final represented result by one ULP | `verification-pending` | RED `426fc5af...` + shared dyadic-scale prerequisite `d8b411f5...` + causal repair `d536e3b1...` + CHANGELOG `ebce979f...`; inherited by #488 `7741aaa...` | -| GAP-099 | exact translated three-observation two-level bias SE could re-round an exact gap through square/second-moment/square-root and move the represented result by one ULP | `verification-pending` | RED `fbcdb7fa...` + causal repair `e0f2445d...` + CHANGELOG `ee81953e...` + research/current #488 `7741aaa...`; exact-head hosted GREEN/review/main integration remain pending | +| GAP-099 | exact translated three-observation two-level bias SE could re-round an exact gap through square/second-moment/square-root and move the represented result by one ULP | `verification-pending` | RED `fbcdb7fa...` + causal repair `e0f2445d...` + CHANGELOG `ee81953e...` + research/ancestor #488 `7741aaa...`; exact-head hosted GREEN/review/main integration remain pending | +| GAP-100 | exact translated two-level bias SE with one singleton could re-round an exact gap through square/second-moment/square-root beyond the n=3 case | `verification-pending` | RED `4386d9ac...` + causal repair `79ad03fa...` + edge `7fe4117c...` + CHANGELOG `017ad11...` + research/current #488 `944fac05...`; exact-head hosted GREEN/review/main integration remain pending | ## Release gate From 4e0c0e60c0deb0030ee4293d79b18872b643b7d6 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 5 Sep 2026 11:03:15 +0900 Subject: [PATCH 194/235] docs(ddd): advance Validation Evidence baseline through GAP-101 --- docs/product-technical-gap-baseline.md | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 8960fa8c5..e37c5da09 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-05T01:07:48Z +**Snapshot:** 2026-09-05T02:03:00Z **Protected-main evidence:** `a243f18da4a4ca8a8d068c39922537f1f8ed6ad0` **Workspace version:** `0.2.0` @@ -30,7 +30,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `944fac058a74b375fde86dbc2a860a4a4e386234` | true | `main` | Validation Evidence landing vehicle, based on protected #490. GAP-093–099 preserve represented-input bias-SE dispersion and exact translated geometry. GAP-100 extends the exact translated two-level closed form only when either represented level is a singleton: `SE(mean)=|level_gap|/n`. The four-row `[0,a,a,a]` counterexample proves the prior generic square/second-moment/square-root path could move the exact result by one ULP. Earlier Wilson, provenance, Monte Carlo, RMSE/SE, matching, serde/projection repairs remain inherited. Hosted exact-head gates and independent review remain required. | +| #488 | `905addcce450f6c7ef307d4bcb694109f23d879e` | true | `main` | Validation Evidence landing vehicle, based on protected #490. GAP-101 proves that even exact two-observation residual subtractions can have their dispersion distorted when a midpoint residual mean is rounded before centering; all two-observation cases now use the exact identity `SE(mean)=|r1-r2|/2`, retaining the expanded-input path when subtraction roundoff exists. GAP-100 and earlier represented-input bias-SE, Wilson, provenance, Monte Carlo, RMSE/SE, matching, serde/projection repairs remain inherited. Hosted exact-head gates and independent review remain required. | | #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 | Validation / Analysis Run fold child. Unique evidence must be inherited by a conflict-resolving survivor; child-head CI does not transfer. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | @@ -62,7 +62,7 @@ The clock contract separates event/valid time, assertion time, document time, sy - Row arrival order is not scientific evidence. Fixed admitted observations must produce bit-identical means/centered results under permutation wherever the contract claims deterministic CPU `f64` reference behavior. - Known-truth component recovery follows bounded-context identity: stable `Between` is unit-level and uses canonical `occasion_index = 0`; `Within` retains actual `(unit, occasion)` identity. Duplicate identities or stable-Between occasion aliases are not weights. - A representable final scientific estimand is not rejected solely because an avoidable intermediate binary64 operation overflows/underflows. False exact 0/1/non-finite endpoints, erased finite bounds, cancellation residues, and double-rounded endpoints are not accepted when a bounded equivalent operation preserves the represented estimand or decision. -- Mean signed bias and bias SE remain Validation Evidence performance measures over admitted recovery units. `mean_bias` uses the direct residual path only when every pairwise subtraction is finite and preserves represented low-order input mass; otherwise it uses the algebraically equivalent recovered-plus-negated-truth numerator, cancellation-safe exact-power-of-two scaling, and the original scientific denominator. `bias_standard_error` still requires each individual signed residual to be representable. For two observations with subtraction roundoff, TEPP evaluates `SE(mean)=|r1-r2|/2` from expanded represented inputs. For `n>2`, the exact translated-residual path is admitted only when anchor-relative high, low, and combined deltas are exactly representable. Translation-invariant dispersion is then evaluated before any rounded residual mean becomes authoritative. GAP-098 additionally requires this admitted path to normalize by the existing exact power-of-two scale rather than an arbitrary translated magnitude, so dyadic geometry is not double-rounded during scale restoration. GAP-099 established the exact `n=3` two-level identity. GAP-100 generalizes only the same proven algebraic structure: after exact translation, when exactly two represented levels remain and either level occurs once, evaluate `SE(mean)=|level_gap|/n` directly before the generic squared-second-moment/square-root path. Other admitted samples retain `sqrt(sum(d²)/(n(n-1)))`. Samples that cannot prove exact translated deltas retain the bounded predecessor fallback. These are bounded repairs, not a claim of globally correctly rounded n>2 dispersion. Mathematically nonzero final results outside binary64 range fail closed. +- Mean signed bias and bias SE remain Validation Evidence performance measures over admitted recovery units. `mean_bias` uses the direct residual path only when every pairwise subtraction is finite and preserves represented low-order input mass; otherwise it uses the algebraically equivalent recovered-plus-negated-truth numerator, cancellation-safe exact-power-of-two scaling, and the original scientific denominator. `bias_standard_error` still requires each individual signed residual to be representable. For every two-observation sample, TEPP evaluates `SE(mean)=|r1-r2|/2` before a rounded residual mean can become authoritative; subtraction-roundoff cases use expanded represented inputs, while exact-subtraction cases use the represented residual difference through the cancellation/overflow-safe scientific denominator. For `n>2`, the exact translated-residual path is admitted only when anchor-relative high, low, and combined deltas are exactly representable. Translation-invariant dispersion is then evaluated before any rounded residual mean becomes authoritative. GAP-098 additionally requires this admitted path to normalize by the existing exact power-of-two scale rather than an arbitrary translated magnitude, so dyadic geometry is not double-rounded during scale restoration. GAP-099 established the exact `n=3` two-level identity. GAP-100 generalizes only the same proven algebraic structure: after exact translation, when exactly two represented levels remain and either level occurs once, evaluate `SE(mean)=|level_gap|/n` directly before the generic squared-second-moment/square-root path. Other admitted samples retain `sqrt(sum(d²)/(n(n-1)))`. Samples that cannot prove exact translated deltas retain the bounded predecessor fallback. These are bounded repairs, not a claim of globally correctly rounded n>2 dispersion. Mathematically nonzero final results outside binary64 range fail closed. - Generic Validation Evidence RMSE and its delta-method SE normalize before squaring. Exact-zero point RMSE requires exact-zero point RMSE SE. For positive RMSE, the declared producer satisfies `SE(RMSE) <= RMSE / 2`, with a small relative binary64 admission tolerance. - Generic `MonteCarloSummary` is sign-neutral. Zero SD requires zero SE and percentile endpoints equal to the represented mean. Positive SD requires positive SE coherent with represented `SD / sqrt(n)` within a small relative tolerance. Every inclusive nearest-rank endpoint is a retained observation and satisfies `|endpoint - mean| <= SD * sqrt(n - 1)`. Distinct lower/upper endpoint values share the same `(n - 1) * SD²` deviation budget. When `replication_count=2` and endpoints are distinct, those endpoints exhaust the retained sample and must reconstruct the represented mean/sample SD. - When the generic carrier occupies `ValidationReport::monte_carlo_rmse`, retained replications are nonnegative; positive mean implies `SE(mean) <= mean`, and inclusive nearest-rank endpoints cannot exceed nonnegative sample-sum support `n * mean`. These typed bounds are not imposed on signed metrics such as bias. @@ -83,13 +83,13 @@ The clock contract separates event/valid time, assertion time, document time, sy ### #488 — Validation Evidence -#488 is the generic Validation Evidence landing vehicle at exact head `944fac058a74b375fde86dbc2a860a4a4e386234`, based on protected #490. GAP-093–099 remain inherited and executable. +#488 is the generic Validation Evidence landing vehicle at exact head `905addcce450f6c7ef307d4bcb694109f23d879e`, based on protected #490. GAP-092–100 remain inherited and executable. -GAP-100 RED `4386d9ace83cd54aa129067ddc589b1a628147a2` adds `a=next_down(1.0)=0x1.fffffffffffffp-1`, `truth=[0,0,0,0]`, `recovered=[0,a,a,a]`. Every represented residual and translated delta is exact. For this four-observation two-level singleton/repeated-level sample, `SE(mean)=|a|/4`, correctly represented as bits `0x3fcf_ffff_ffff_ffff`. The predecessor generic translated path squares and square-roots the exact gap and yields adjacent lower bits `0x3fcf_ffff_ffff_fffe`. Permutation and sign-mirror controls reproduce the same identity. +GAP-101 RED `d3dcd918bece928ae4103dffda8e7dc654927da0` adds `truth=[0,0]`, `recovered=[1,next_down(1)]`, with `next_down(1)=0x1.fffffffffffffp-1`. Both residual subtractions are exact, but their exact mean is the midpoint `1-2^-54` and rounds to `1`. The predecessor generic rounded-mean path therefore used deviations `[0,-2^-53]` and returned `0x3c96_a09e_667f_3bcd` instead of the two-observation identity `SE(mean)=|r1-r2|/2=2^-54`, bits `0x3c90_0000_0000_0000`. Sign-mirror and equal-residual controls preserve the same scientific boundary. -Causal repair `79ad03fae4364d6c364915a062eb0fc8615eaa43` remains inside the existing exact translated-delta admission. If an exactly translated sample contains exactly two represented levels and either level occurs once, it evaluates `|level_gap|/n` directly. Edge coverage `7fe4117c5666af08adbfda5d32beb12648f579c6` fixes minimum-subnormal false-zero refusal; CHANGELOG `017ad11ad974219a5a0e1cf91c1ecf55c44524c2`; research/current #488 `944fac058a74b375fde86dbc2a860a4a4e386234`. Two-level samples without a singleton, samples with three or more represented levels, and failed exact-translation admissions retain the bounded predecessor paths. +Causal repair `02b0a178154ea0ae7da87289756897d7c2f361e3` evaluates the exact two-observation identity for all finite represented residual pairs. Cases with subtraction roundoff retain the expanded recovered/truth difference from GAP-092; exact residuals use `[r1,-r2]` through `deterministic_representable_sum_over_count(...,2)` so opposite extremes do not require an overflowing raw difference. CHANGELOG `5603b12d2aedb6dfcc0aa4203d57047a98aee789`; research/current #488 `905addcce450f6c7ef307d4bcb694109f23d879e`. This does not widen the general `n>2` correct-rounding claim. -GAP-099 remains inherited: RED `fbcdb7fac40744c697debbbe6184d4e0ffd5e32a` proved the `n=3` repeated-level instance and repair `e0f2445d825f12817631ca8e5ef5fed77fcd113a` established the original closed form. GAP-098 remains inherited: RED `426fc5afd8aae8c2d5f81f53e5db074b480ac8b7` proves non-power normalization could move an exact translated `d/3` result by one ULP; prerequisite `d8b411f5dcf93ff21b18eaa4ff5ccd8d2863a6cd` and repair `d536e3b1082c0f705a6ddd7722bf45c93ac594e3` reuse the existing exact power-of-two scale. This does not claim globally correctly rounded n>2 bias standard errors. +GAP-100 remains inherited: RED `4386d9ace83cd54aa129067ddc589b1a628147a2` + repair `79ad03fae4364d6c364915a062eb0fc8615eaa43` preserve the exact translated two-level singleton identity `SE(mean)=|level_gap|/n`. GAP-099 and GAP-098 remain inherited with their n=3 and dyadic-normalization repairs. Two-level samples without a singleton, samples with three or more represented levels, and failed exact-translation admissions retain the bounded predecessor paths. ### #416 — Validation / Analysis Run consolidation @@ -101,7 +101,7 @@ GAP-099 remains inherited: RED `fbcdb7fac40744c697debbbe6184d4e0ffd5e32a` proved ## Gap register -GAP-001–GAP-044 retain their existing domain/release identities and closure lineage. They remain unchanged by the GAP-100 numerical repair; their authoritative source/test/ADR history remains in repository ancestry and the surviving landing vehicles listed above. The validation lineage from GAP-045 onward is restated here because #488 is its current single writer. +GAP-001–GAP-044 retain their existing domain/release identities and closure lineage. They remain unchanged by the GAP-101 numerical repair; their authoritative source/test/ADR history remains in repository ancestry and the surviving landing vehicles listed above. The validation lineage from GAP-045 onward is restated here because #488 is its current single writer. | ID | Gap | Maturity | Closure evidence | | --- | --- | --- | --- | @@ -204,7 +204,8 @@ GAP-001–GAP-044 retain their existing domain/release identities and closure li | GAP-097 | common-high subtraction path could round low-term mean before centering | `verification-pending` | RED `d48e2515...` + exact low-term translated-second-moment repair `a63b8d7a...`; inherited by #488 `7741aaa...` | | GAP-098 | exact translated-residual bias SE could double-round through a non-power normalization scale and move the final represented result by one ULP | `verification-pending` | RED `426fc5af...` + shared dyadic-scale prerequisite `d8b411f5...` + causal repair `d536e3b1...` + CHANGELOG `ebce979f...`; inherited by #488 `7741aaa...` | | GAP-099 | exact translated three-observation two-level bias SE could re-round an exact gap through square/second-moment/square-root and move the represented result by one ULP | `verification-pending` | RED `fbcdb7fa...` + causal repair `e0f2445d...` + CHANGELOG `ee81953e...` + research/ancestor #488 `7741aaa...`; exact-head hosted GREEN/review/main integration remain pending | -| GAP-100 | exact translated two-level bias SE with one singleton could re-round an exact gap through square/second-moment/square-root beyond the n=3 case | `verification-pending` | RED `4386d9ac...` + causal repair `79ad03fa...` + edge `7fe4117c...` + CHANGELOG `017ad11...` + research/current #488 `944fac05...`; exact-head hosted GREEN/review/main integration remain pending | +| GAP-100 | exact translated two-level bias SE with one singleton could re-round an exact gap through square/second-moment/square-root beyond the n=3 case | `verification-pending` | RED `4386d9ac...` + causal repair `79ad03fa...` + edge `7fe4117c...` + CHANGELOG `017ad11...` + research/ancestor #488 `944fac05...`; exact-head hosted GREEN/review/main integration remain pending | +| GAP-101 | exact two-observation residuals could be re-centered on a rounded midpoint mean and materially distort `SE(mean)` despite exact pairwise subtraction | `verification-pending` | RED `d3dcd918...` + causal repair `02b0a178...` + CHANGELOG `5603b12d...` + research/current #488 `905addcc...`; exact-head hosted GREEN/review/main integration remain pending | ## Release gate From ae2e89b0b0ef4d3bca1577bbb3bed72bfcba08ef Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 5 Sep 2026 12:07:36 +0900 Subject: [PATCH 195/235] docs(gaps): advance Validation Evidence through GAP-102 --- docs/product-technical-gap-baseline.md | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index e37c5da09..a024323d5 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-05T02:03:00Z +**Snapshot:** 2026-09-05T03:06:00Z **Protected-main evidence:** `a243f18da4a4ca8a8d068c39922537f1f8ed6ad0` **Workspace version:** `0.2.0` @@ -30,7 +30,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `905addcce450f6c7ef307d4bcb694109f23d879e` | true | `main` | Validation Evidence landing vehicle, based on protected #490. GAP-101 proves that even exact two-observation residual subtractions can have their dispersion distorted when a midpoint residual mean is rounded before centering; all two-observation cases now use the exact identity `SE(mean)=|r1-r2|/2`, retaining the expanded-input path when subtraction roundoff exists. GAP-100 and earlier represented-input bias-SE, Wilson, provenance, Monte Carlo, RMSE/SE, matching, serde/projection repairs remain inherited. Hosted exact-head gates and independent review remain required. | +| #488 | `9d7bb5c207e19f1d22305566b92ea92139b2a3f0` | true | `main` | Validation Evidence landing vehicle, based on protected #490. GAP-102 proves that an exactly translated two-level sample can still be re-rounded by the generic moment path even when its count geometry reduces exactly to a dyadic scale. The 6/10 split of 16 observations has `SE(mean)=|level_gap|/8`; exact integer count admission now applies that reciprocal power-of-two scale directly, while non-dyadic two-level and general multi-level samples retain the bounded translated second-moment path. GAP-101 and earlier represented-input bias-SE, Wilson, provenance, Monte Carlo, RMSE/SE, matching, serde/projection repairs remain inherited. Hosted exact-head gates and independent review remain required. | | #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 | Validation / Analysis Run fold child. Unique evidence must be inherited by a conflict-resolving survivor; child-head CI does not transfer. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | @@ -62,7 +62,7 @@ The clock contract separates event/valid time, assertion time, document time, sy - Row arrival order is not scientific evidence. Fixed admitted observations must produce bit-identical means/centered results under permutation wherever the contract claims deterministic CPU `f64` reference behavior. - Known-truth component recovery follows bounded-context identity: stable `Between` is unit-level and uses canonical `occasion_index = 0`; `Within` retains actual `(unit, occasion)` identity. Duplicate identities or stable-Between occasion aliases are not weights. - A representable final scientific estimand is not rejected solely because an avoidable intermediate binary64 operation overflows/underflows. False exact 0/1/non-finite endpoints, erased finite bounds, cancellation residues, and double-rounded endpoints are not accepted when a bounded equivalent operation preserves the represented estimand or decision. -- Mean signed bias and bias SE remain Validation Evidence performance measures over admitted recovery units. `mean_bias` uses the direct residual path only when every pairwise subtraction is finite and preserves represented low-order input mass; otherwise it uses the algebraically equivalent recovered-plus-negated-truth numerator, cancellation-safe exact-power-of-two scaling, and the original scientific denominator. `bias_standard_error` still requires each individual signed residual to be representable. For every two-observation sample, TEPP evaluates `SE(mean)=|r1-r2|/2` before a rounded residual mean can become authoritative; subtraction-roundoff cases use expanded represented inputs, while exact-subtraction cases use the represented residual difference through the cancellation/overflow-safe scientific denominator. For `n>2`, the exact translated-residual path is admitted only when anchor-relative high, low, and combined deltas are exactly representable. Translation-invariant dispersion is then evaluated before any rounded residual mean becomes authoritative. GAP-098 additionally requires this admitted path to normalize by the existing exact power-of-two scale rather than an arbitrary translated magnitude, so dyadic geometry is not double-rounded during scale restoration. GAP-099 established the exact `n=3` two-level identity. GAP-100 generalizes only the same proven algebraic structure: after exact translation, when exactly two represented levels remain and either level occurs once, evaluate `SE(mean)=|level_gap|/n` directly before the generic squared-second-moment/square-root path. Other admitted samples retain `sqrt(sum(d²)/(n(n-1)))`. Samples that cannot prove exact translated deltas retain the bounded predecessor fallback. These are bounded repairs, not a claim of globally correctly rounded n>2 dispersion. Mathematically nonzero final results outside binary64 range fail closed. +- Mean signed bias and bias SE remain Validation Evidence performance measures over admitted recovery units. `mean_bias` uses the direct residual path only when every pairwise subtraction is finite and preserves represented low-order input mass; otherwise it uses the algebraically equivalent recovered-plus-negated-truth numerator, cancellation-safe exact-power-of-two scaling, and the original scientific denominator. `bias_standard_error` still requires each individual signed residual to be representable. For every two-observation sample, TEPP evaluates `SE(mean)=|r1-r2|/2` before a rounded residual mean can become authoritative; subtraction-roundoff cases use expanded represented inputs, while exact-subtraction cases use the represented residual difference through the cancellation/overflow-safe scientific denominator. For `n>2`, the exact translated-residual path is admitted only when anchor-relative high, low, and combined deltas are exactly representable. Translation-invariant dispersion is then evaluated before any rounded residual mean becomes authoritative. GAP-098 additionally requires this admitted path to normalize by the existing exact power-of-two scale rather than an arbitrary translated magnitude, so dyadic geometry is not double-rounded during scale restoration. GAP-099 established the exact `n=3` two-level identity. GAP-100 generalizes the singleton/repeated-level identity: after exact translation, when exactly two represented levels remain and either level occurs once, evaluate `SE(mean)=|level_gap|/n` directly. GAP-102 extends only another algebraically exact subset: for non-singleton two-level samples, if exact integer counts prove `m(n-m) * d^2 = n^2(n-1)` for power-of-two `d`, evaluate `SE(mean)=|level_gap|/d` before generic moment reconstruction. Other admitted samples retain `sqrt(sum(d²)/(n(n-1)))`; samples that cannot prove exact translated deltas retain the bounded predecessor fallback. These are bounded repairs, not a claim of globally correctly rounded n>2 dispersion. Mathematically nonzero final results outside binary64 range fail closed. - Generic Validation Evidence RMSE and its delta-method SE normalize before squaring. Exact-zero point RMSE requires exact-zero point RMSE SE. For positive RMSE, the declared producer satisfies `SE(RMSE) <= RMSE / 2`, with a small relative binary64 admission tolerance. - Generic `MonteCarloSummary` is sign-neutral. Zero SD requires zero SE and percentile endpoints equal to the represented mean. Positive SD requires positive SE coherent with represented `SD / sqrt(n)` within a small relative tolerance. Every inclusive nearest-rank endpoint is a retained observation and satisfies `|endpoint - mean| <= SD * sqrt(n - 1)`. Distinct lower/upper endpoint values share the same `(n - 1) * SD²` deviation budget. When `replication_count=2` and endpoints are distinct, those endpoints exhaust the retained sample and must reconstruct the represented mean/sample SD. - When the generic carrier occupies `ValidationReport::monte_carlo_rmse`, retained replications are nonnegative; positive mean implies `SE(mean) <= mean`, and inclusive nearest-rank endpoints cannot exceed nonnegative sample-sum support `n * mean`. These typed bounds are not imposed on signed metrics such as bias. @@ -83,13 +83,13 @@ The clock contract separates event/valid time, assertion time, document time, sy ### #488 — Validation Evidence -#488 is the generic Validation Evidence landing vehicle at exact head `905addcce450f6c7ef307d4bcb694109f23d879e`, based on protected #490. GAP-092–100 remain inherited and executable. +#488 is the generic Validation Evidence landing vehicle at exact head `9d7bb5c207e19f1d22305566b92ea92139b2a3f0`, based on protected #490. GAP-092–101 remain inherited and executable. -GAP-101 RED `d3dcd918bece928ae4103dffda8e7dc654927da0` adds `truth=[0,0]`, `recovered=[1,next_down(1)]`, with `next_down(1)=0x1.fffffffffffffp-1`. Both residual subtractions are exact, but their exact mean is the midpoint `1-2^-54` and rounds to `1`. The predecessor generic rounded-mean path therefore used deviations `[0,-2^-53]` and returned `0x3c96_a09e_667f_3bcd` instead of the two-observation identity `SE(mean)=|r1-r2|/2=2^-54`, bits `0x3c90_0000_0000_0000`. Sign-mirror and equal-residual controls preserve the same scientific boundary. +GAP-102 RED `3bc43da21784d3bf2f506c2ffdaa66c90a76d85d` adds an exactly translated two-level sample with `n=16`, six residuals at `0`, ten at `g=next_down(1)=0x1.fffffffffffffp-1`. For two levels, `SE(mean)=|g|*sqrt(m(n-m)/(n^2(n-1)))`; here `6*10/15=4`, so the exact represented-input result is `|g|/8`, bits `0x3fbf_ffff_ffff_ffff`. The predecessor translated sum/square/square-root path returned `0.125`, bits `0x3fc0_0000_0000_0000`, one ULP high. Permutation and sign mirror preserve the same dispersion; the minimum-subnormal counterpart remains fail closed rather than becoming false zero. -Causal repair `02b0a178154ea0ae7da87289756897d7c2f361e3` evaluates the exact two-observation identity for all finite represented residual pairs. Cases with subtraction roundoff retain the expanded recovered/truth difference from GAP-092; exact residuals use `[r1,-r2]` through `deterministic_representable_sum_over_count(...,2)` so opposite extremes do not require an overflowing raw difference. CHANGELOG `5603b12d2aedb6dfcc0aa4203d57047a98aee789`; research/current #488 `905addcce450f6c7ef307d4bcb694109f23d879e`. This does not widen the general `n>2` correct-rounding claim. +Causal repair `77ba10026d23252314f04d95a67ce1cfeb5e54a0` keeps the existing exact translated-residual admission and uses checked integer counts to admit a direct path only when `m(n-m) * d^2 = n^2(n-1)` for a power-of-two divisor `d`. The resulting `|g|/d` is applied before rounded moment reconstruction. Singleton two-level behavior from GAP-100 is unchanged; non-dyadic two-level and general multi-level cases retain the prior bounded translated second-moment path. CHANGELOG `f165914eaceb17780370ca4f2e446c22efcf15ea`; research/current #488 `9d7bb5c207e19f1d22305566b92ea92139b2a3f0`. The RED commit's hosted workflows were cancelled after branch advancement and are not counted as completed RED execution evidence. -GAP-100 remains inherited: RED `4386d9ace83cd54aa129067ddc589b1a628147a2` + repair `79ad03fae4364d6c364915a062eb0fc8615eaa43` preserve the exact translated two-level singleton identity `SE(mean)=|level_gap|/n`. GAP-099 and GAP-098 remain inherited with their n=3 and dyadic-normalization repairs. Two-level samples without a singleton, samples with three or more represented levels, and failed exact-translation admissions retain the bounded predecessor paths. +GAP-101 remains inherited: RED `d3dcd918bece928ae4103dffda8e7dc654927da0` + repair `02b0a178154ea0ae7da87289756897d7c2f361e3` preserve the exact two-observation identity `SE(mean)=|r1-r2|/2`. GAP-100 remains inherited: RED `4386d9ace83cd54aa129067ddc589b1a628147a2` + repair `79ad03fae4364d6c364915a062eb0fc8615eaa43` preserve the exact translated two-level singleton identity `SE(mean)=|level_gap|/n`. GAP-099 and GAP-098 retain their n=3 and dyadic-normalization repairs. GAP-102 does not widen the general n>2 correct-rounding claim. ### #416 — Validation / Analysis Run consolidation @@ -101,7 +101,7 @@ GAP-100 remains inherited: RED `4386d9ace83cd54aa129067ddc589b1a628147a2` + repa ## Gap register -GAP-001–GAP-044 retain their existing domain/release identities and closure lineage. They remain unchanged by the GAP-101 numerical repair; their authoritative source/test/ADR history remains in repository ancestry and the surviving landing vehicles listed above. The validation lineage from GAP-045 onward is restated here because #488 is its current single writer. +GAP-001–GAP-044 retain their existing domain/release identities and closure lineage. They remain unchanged by the GAP-102 numerical repair; their authoritative source/test/ADR history remains in repository ancestry and the surviving landing vehicles listed above. The validation lineage from GAP-045 onward is restated here because #488 is its current single writer. | ID | Gap | Maturity | Closure evidence | | --- | --- | --- | --- | @@ -205,7 +205,8 @@ GAP-001–GAP-044 retain their existing domain/release identities and closure li | GAP-098 | exact translated-residual bias SE could double-round through a non-power normalization scale and move the final represented result by one ULP | `verification-pending` | RED `426fc5af...` + shared dyadic-scale prerequisite `d8b411f5...` + causal repair `d536e3b1...` + CHANGELOG `ebce979f...`; inherited by #488 `7741aaa...` | | GAP-099 | exact translated three-observation two-level bias SE could re-round an exact gap through square/second-moment/square-root and move the represented result by one ULP | `verification-pending` | RED `fbcdb7fa...` + causal repair `e0f2445d...` + CHANGELOG `ee81953e...` + research/ancestor #488 `7741aaa...`; exact-head hosted GREEN/review/main integration remain pending | | GAP-100 | exact translated two-level bias SE with one singleton could re-round an exact gap through square/second-moment/square-root beyond the n=3 case | `verification-pending` | RED `4386d9ac...` + causal repair `79ad03fa...` + edge `7fe4117c...` + CHANGELOG `017ad11...` + research/ancestor #488 `944fac05...`; exact-head hosted GREEN/review/main integration remain pending | -| GAP-101 | exact two-observation residuals could be re-centered on a rounded midpoint mean and materially distort `SE(mean)` despite exact pairwise subtraction | `verification-pending` | RED `d3dcd918...` + causal repair `02b0a178...` + CHANGELOG `5603b12d...` + research/current #488 `905addcc...`; exact-head hosted GREEN/review/main integration remain pending | +| GAP-101 | exact two-observation residuals could be re-centered on a rounded midpoint mean and materially distort `SE(mean)` despite exact pairwise subtraction | `verification-pending` | RED `d3dcd918...` + causal repair `02b0a178...` + CHANGELOG `5603b12d...` + research/ancestor #488 `905addcc...`; exact-head hosted GREEN/review/main integration remain pending | +| GAP-102 | exact translated non-singleton two-level bias SE could re-round a dyadic count identity through translated sums/squares/square-root | `verification-pending` | RED `3bc43da2...` + causal repair `77ba1002...` + CHANGELOG `f165914e...` + research/current #488 `9d7bb5c2...`; exact-head hosted GREEN/review/main integration remain pending | ## Release gate From bc45b505e8aad707cbbdbbfb6dedccd042d65c90 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 5 Sep 2026 13:10:07 +0900 Subject: [PATCH 196/235] docs(gap): advance Validation Evidence baseline through GAP-103 --- docs/product-technical-gap-baseline.md | 125 +++++++++++++------------ 1 file changed, 63 insertions(+), 62 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index a024323d5..e41ecbe3d 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-05T03:06:00Z +**Snapshot:** 2026-09-05T04:00:10Z **Protected-main evidence:** `a243f18da4a4ca8a8d068c39922537f1f8ed6ad0` **Workspace version:** `0.2.0` @@ -30,7 +30,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `9d7bb5c207e19f1d22305566b92ea92139b2a3f0` | true | `main` | Validation Evidence landing vehicle, based on protected #490. GAP-102 proves that an exactly translated two-level sample can still be re-rounded by the generic moment path even when its count geometry reduces exactly to a dyadic scale. The 6/10 split of 16 observations has `SE(mean)=|level_gap|/8`; exact integer count admission now applies that reciprocal power-of-two scale directly, while non-dyadic two-level and general multi-level samples retain the bounded translated second-moment path. GAP-101 and earlier represented-input bias-SE, Wilson, provenance, Monte Carlo, RMSE/SE, matching, serde/projection repairs remain inherited. Hosted exact-head gates and independent review remain required. | +| #488 | `11b8fd5417398c778cf9e7b83473fe984abf31c5` | true | `main` | Validation Evidence landing vehicle, based on protected #490. GAP-103 proves that GAP-102's power-of-two-only two-level count admission was narrower than the exact estimator algebra: a 3/6 split of nine observations has `SE(mean)=|level_gap|/6`. Checked integer count algebra now admits only exact reciprocal-integer-square factors with an exactly representable integer divisor; non-square two-level and general multi-level samples retain the bounded translated second-moment path. GAP-102 and earlier represented-input bias-SE, Wilson, provenance, Monte Carlo, RMSE/SE, matching, serde/projection repairs remain inherited. Hosted exact-head gates and independent review remain required. | | #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 | Validation / Analysis Run fold child. Unique evidence must be inherited by a conflict-resolving survivor; child-head CI does not transfer. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | @@ -62,7 +62,7 @@ The clock contract separates event/valid time, assertion time, document time, sy - Row arrival order is not scientific evidence. Fixed admitted observations must produce bit-identical means/centered results under permutation wherever the contract claims deterministic CPU `f64` reference behavior. - Known-truth component recovery follows bounded-context identity: stable `Between` is unit-level and uses canonical `occasion_index = 0`; `Within` retains actual `(unit, occasion)` identity. Duplicate identities or stable-Between occasion aliases are not weights. - A representable final scientific estimand is not rejected solely because an avoidable intermediate binary64 operation overflows/underflows. False exact 0/1/non-finite endpoints, erased finite bounds, cancellation residues, and double-rounded endpoints are not accepted when a bounded equivalent operation preserves the represented estimand or decision. -- Mean signed bias and bias SE remain Validation Evidence performance measures over admitted recovery units. `mean_bias` uses the direct residual path only when every pairwise subtraction is finite and preserves represented low-order input mass; otherwise it uses the algebraically equivalent recovered-plus-negated-truth numerator, cancellation-safe exact-power-of-two scaling, and the original scientific denominator. `bias_standard_error` still requires each individual signed residual to be representable. For every two-observation sample, TEPP evaluates `SE(mean)=|r1-r2|/2` before a rounded residual mean can become authoritative; subtraction-roundoff cases use expanded represented inputs, while exact-subtraction cases use the represented residual difference through the cancellation/overflow-safe scientific denominator. For `n>2`, the exact translated-residual path is admitted only when anchor-relative high, low, and combined deltas are exactly representable. Translation-invariant dispersion is then evaluated before any rounded residual mean becomes authoritative. GAP-098 additionally requires this admitted path to normalize by the existing exact power-of-two scale rather than an arbitrary translated magnitude, so dyadic geometry is not double-rounded during scale restoration. GAP-099 established the exact `n=3` two-level identity. GAP-100 generalizes the singleton/repeated-level identity: after exact translation, when exactly two represented levels remain and either level occurs once, evaluate `SE(mean)=|level_gap|/n` directly. GAP-102 extends only another algebraically exact subset: for non-singleton two-level samples, if exact integer counts prove `m(n-m) * d^2 = n^2(n-1)` for power-of-two `d`, evaluate `SE(mean)=|level_gap|/d` before generic moment reconstruction. Other admitted samples retain `sqrt(sum(d²)/(n(n-1)))`; samples that cannot prove exact translated deltas retain the bounded predecessor fallback. These are bounded repairs, not a claim of globally correctly rounded n>2 dispersion. Mathematically nonzero final results outside binary64 range fail closed. +- Mean signed bias and bias SE remain Validation Evidence performance measures over admitted recovery units. `mean_bias` uses the direct residual path only when every pairwise subtraction is finite and preserves represented low-order input mass; otherwise it uses the algebraically equivalent recovered-plus-negated-truth numerator, cancellation-safe exact-power-of-two scaling, and the original scientific denominator. `bias_standard_error` still requires each individual signed residual to be representable. For every two-observation sample, TEPP evaluates `SE(mean)=|r1-r2|/2` before a rounded residual mean can become authoritative; subtraction-roundoff cases use expanded represented inputs, while exact-subtraction cases use the represented residual difference through the cancellation/overflow-safe scientific denominator. For `n>2`, the exact translated-residual path is admitted only when anchor-relative high, low, and combined deltas are exactly representable. Translation-invariant dispersion is then evaluated before any rounded residual mean becomes authoritative. GAP-098 additionally requires this admitted path to normalize by the existing exact power-of-two scale rather than an arbitrary translated magnitude, so dyadic geometry is not double-rounded during scale restoration. GAP-099 established the exact `n=3` two-level identity. GAP-100 generalizes the singleton/repeated-level identity: after exact translation, when exactly two represented levels remain and either level occurs once, evaluate `SE(mean)=|level_gap|/n` directly. GAP-102 established a non-singleton exact count shortcut for reciprocal power-of-two factors. GAP-103 generalizes only the algebraically exact reciprocal-integer-square subset: if checked counts prove `m(n-m) * d^2 = n^2(n-1)` for an exactly representable integer divisor `d`, evaluate `SE(mean)=|level_gap|/d` before generic moment reconstruction. Count factors that are not exact reciprocal integer squares and general multi-level samples retain `sqrt(sum(d²)/(n(n-1)))`; samples that cannot prove exact translated deltas retain the bounded predecessor fallback. These are bounded repairs, not a claim of globally correctly rounded n>2 dispersion. Mathematically nonzero final results outside binary64 range fail closed. - Generic Validation Evidence RMSE and its delta-method SE normalize before squaring. Exact-zero point RMSE requires exact-zero point RMSE SE. For positive RMSE, the declared producer satisfies `SE(RMSE) <= RMSE / 2`, with a small relative binary64 admission tolerance. - Generic `MonteCarloSummary` is sign-neutral. Zero SD requires zero SE and percentile endpoints equal to the represented mean. Positive SD requires positive SE coherent with represented `SD / sqrt(n)` within a small relative tolerance. Every inclusive nearest-rank endpoint is a retained observation and satisfies `|endpoint - mean| <= SD * sqrt(n - 1)`. Distinct lower/upper endpoint values share the same `(n - 1) * SD²` deviation budget. When `replication_count=2` and endpoints are distinct, those endpoints exhaust the retained sample and must reconstruct the represented mean/sample SD. - When the generic carrier occupies `ValidationReport::monte_carlo_rmse`, retained replications are nonnegative; positive mean implies `SE(mean) <= mean`, and inclusive nearest-rank endpoints cannot exceed nonnegative sample-sum support `n * mean`. These typed bounds are not imposed on signed metrics such as bias. @@ -83,13 +83,13 @@ The clock contract separates event/valid time, assertion time, document time, sy ### #488 — Validation Evidence -#488 is the generic Validation Evidence landing vehicle at exact head `9d7bb5c207e19f1d22305566b92ea92139b2a3f0`, based on protected #490. GAP-092–101 remain inherited and executable. +#488 is the generic Validation Evidence landing vehicle at exact head `11b8fd5417398c778cf9e7b83473fe984abf31c5`, based on protected #490. GAP-092–102 remain inherited and executable. -GAP-102 RED `3bc43da21784d3bf2f506c2ffdaa66c90a76d85d` adds an exactly translated two-level sample with `n=16`, six residuals at `0`, ten at `g=next_down(1)=0x1.fffffffffffffp-1`. For two levels, `SE(mean)=|g|*sqrt(m(n-m)/(n^2(n-1)))`; here `6*10/15=4`, so the exact represented-input result is `|g|/8`, bits `0x3fbf_ffff_ffff_ffff`. The predecessor translated sum/square/square-root path returned `0.125`, bits `0x3fc0_0000_0000_0000`, one ULP high. Permutation and sign mirror preserve the same dispersion; the minimum-subnormal counterpart remains fail closed rather than becoming false zero. +GAP-103 RED `d793f7f9ada68d5976effa6539182ba7037bf8d0` adds an exactly translated two-level sample with `n=9`, three residuals at `0`, and six at `g=0x1.ffffffffffffdp-1`. For two levels, `SE(mean)^2 = g^2*m(n-m)/(n^2(n-1))`; here `3*6/(9^2*8)=1/36`, so the exact represented-input result is `|g|/6`, bits `0x3fc5_5555_5555_5553`. GAP-102's power-of-two-only predicate does not admit divisor `6`, so the predecessor falls through to translated sum/square/square-root reconstruction and returns adjacent upper bits `0x3fc5_5555_5555_5554`. Permutation and sign mirror preserve the same dispersion; the minimum-subnormal counterpart remains fail closed rather than becoming false zero. -Causal repair `77ba10026d23252314f04d95a67ce1cfeb5e54a0` keeps the existing exact translated-residual admission and uses checked integer counts to admit a direct path only when `m(n-m) * d^2 = n^2(n-1)` for a power-of-two divisor `d`. The resulting `|g|/d` is applied before rounded moment reconstruction. Singleton two-level behavior from GAP-100 is unchanged; non-dyadic two-level and general multi-level cases retain the prior bounded translated second-moment path. CHANGELOG `f165914eaceb17780370ca4f2e446c22efcf15ea`; research/current #488 `9d7bb5c207e19f1d22305566b92ea92139b2a3f0`. The RED commit's hosted workflows were cancelled after branch advancement and are not counted as completed RED execution evidence. +Causal repair `0a4bfcd52defe8912afa8269576395803d451bb3` keeps exact translated-residual admission and generalizes only the count identity. Checked `u128` arithmetic verifies exact divisibility of `n^2(n-1)` by `m(n-m)`, verifies that quotient is an exact integer square, and admits direct `|g|/d` only when the integer divisor `d` is exactly representable as binary64. GAP-102's divisor `8` remains admitted; non-square count factors and general multi-level cases retain the prior bounded translated second-moment path. CHANGELOG `9651dfd123b71b14c58e34dfca4800a92e298a99`; research/current #488 `11b8fd5417398c778cf9e7b83473fe984abf31c5`. Fresh exact-head hosted execution and qualifying independent review remain required. -GAP-101 remains inherited: RED `d3dcd918bece928ae4103dffda8e7dc654927da0` + repair `02b0a178154ea0ae7da87289756897d7c2f361e3` preserve the exact two-observation identity `SE(mean)=|r1-r2|/2`. GAP-100 remains inherited: RED `4386d9ace83cd54aa129067ddc589b1a628147a2` + repair `79ad03fae4364d6c364915a062eb0fc8615eaa43` preserve the exact translated two-level singleton identity `SE(mean)=|level_gap|/n`. GAP-099 and GAP-098 retain their n=3 and dyadic-normalization repairs. GAP-102 does not widen the general n>2 correct-rounding claim. +GAP-102 remains inherited: RED `3bc43da21784d3bf2f506c2ffdaa66c90a76d85d` + repair `77ba10026d23252314f04d95a67ce1cfeb5e54a0` preserve the exact 6/10-of-16 dyadic count case. GAP-101 preserves the exact two-observation identity `SE(mean)=|r1-r2|/2`; GAP-100 preserves the exact translated two-level singleton identity `SE(mean)=|level_gap|/n`; GAP-099 and GAP-098 retain their n=3 and dyadic-normalization repairs. GAP-103 does not widen the general n>2 correct-rounding claim. ### #416 — Validation / Analysis Run consolidation @@ -101,7 +101,7 @@ GAP-101 remains inherited: RED `d3dcd918bece928ae4103dffda8e7dc654927da0` + repa ## Gap register -GAP-001–GAP-044 retain their existing domain/release identities and closure lineage. They remain unchanged by the GAP-102 numerical repair; their authoritative source/test/ADR history remains in repository ancestry and the surviving landing vehicles listed above. The validation lineage from GAP-045 onward is restated here because #488 is its current single writer. +GAP-001–GAP-044 retain their existing domain/release identities and closure lineage. They remain unchanged by the GAP-103 numerical repair; their authoritative source/test/ADR history remains in repository ancestry and the surviving landing vehicles listed above. The validation lineage from GAP-045 onward is restated here because #488 is its current single writer. | ID | Gap | Maturity | Closure evidence | | --- | --- | --- | --- | @@ -149,64 +149,65 @@ GAP-001–GAP-044 retain their existing domain/release identities and closure li | GAP-042 | ratio-first logarithm inflated adjacent-float growth rate | `verification-pending` | RED `766ddc7a...` + `ln_1p` repair `16f21d9a...` | | GAP-043 | duplicate known-truth identities could silently reweight RMSE | `verification-pending` | RED `698f12f5...` + repair `2fae4cb2...` | | GAP-044 | known-truth RMSE alignment depended on row order | `verification-pending` | RED `8ad72ac9...` / `5fb93c40...` + repairs `2dd9537e...` / `025dce7f...`; #310 `c6680450...` | -| GAP-045 | mean signed bias could reject representable result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; inherited by #488 `7741aaa...` | -| GAP-046 | bias SE could reject representable SEM because raw squared deviations overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; inherited by #488 `7741aaa...` | -| GAP-047 | generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; inherited by #488 `7741aaa...` | -| GAP-048 | mean signed bias could erase representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; inherited by #488 `7741aaa...` | +| GAP-045 | mean signed bias could reject representable result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; inherited by #488 `11b8fd54...` | +| GAP-046 | bias SE could reject representable SEM because raw squared deviations overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; inherited by #488 `11b8fd54...` | +| GAP-047 | generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; inherited by #488 `11b8fd54...` | +| GAP-048 | mean signed bias could erase representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; inherited by #488 `11b8fd54...` | | GAP-049 | stable `Between` recovery could be aliased across occasion indices and reweight RMSE | `verification-pending` | RED `0a03041c...` + repair `ec2c1219...`; #310 `c6680450...` | -| GAP-050 | zero-multiplier SE-aware acceptance could erase nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; inherited by #488 `7741aaa...` | -| GAP-051 | exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; inherited by #488 `7741aaa...` | -| GAP-052 | all-covered Wilson lower endpoint could cancel positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; inherited by #488 `7741aaa...` | -| GAP-053 | strict-interior Wilson lower endpoint could cancel positive value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; inherited by #488 `7741aaa...` | -| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; inherited by #488 `7741aaa...` | -| GAP-055 | strict-interior Wilson lower endpoint could accept nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; inherited by #488 `7741aaa...` | -| GAP-056 | durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; inherited by #488 `7741aaa...` | -| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; inherited by #488 `7741aaa...` | -| GAP-058 | generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; inherited by #488 `7741aaa...` | -| GAP-059 | Monte Carlo summary could materially misstate positive SE relative to `SD/sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; inherited by #488 `7741aaa...` | -| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; inherited by #488 `7741aaa...` | -| GAP-061 | generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; inherited by #488 `7741aaa...` | -| GAP-062 | finite-tolerance matching could fail for deterministically outside pair | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; inherited by #488 `7741aaa...` | -| GAP-063 | exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; inherited by #488 `7741aaa...` | -| GAP-064 | positive point RMSE could carry SE above squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; inherited by #488 `7741aaa...` | -| GAP-065 | positive Monte Carlo RMSE could carry impossible spread/SE | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; inherited by #488 `7741aaa...` | -| GAP-066 | RMSE nearest-rank percentile could exceed nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; inherited by #488 `7741aaa...` | -| GAP-067 | generic nearest-rank endpoint could be incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected repair `2798e4f9...`; causal repair `c7151b49...`; inherited by #488 `7741aaa...` | -| GAP-068 | distinct generic percentile endpoints could jointly exceed squared-deviation budget | `verification-pending` | RED `c4a13826...` + repair `cb3f80a2...`; inherited by #488 `7741aaa...` | -| GAP-069 | two-replication endpoints could exhaust sample while mean/SD remained impossible | `verification-pending` | RED `81bf0d9e...` + repair `d48f8fef...`; inherited by #488 `7741aaa...` | -| GAP-070 | stored Wilson pair could not arise from one score interval | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...`; inherited by #488 `7741aaa...` | -| GAP-071 | durable Wilson evidence lacked denominator/critical-value/sidedness provenance | `active-repair` | carrier/authority/v1/envelope lineage; inherited by #488 `7741aaa...`; durable-consumer adoption remains | -| GAP-072 | exact all-covered Wilson evidence could retain impossible zero lower endpoint | `verification-pending` | RED `ce714f07...` + repair `72e9d954...`; inherited by #488 `7741aaa...` | -| GAP-073 | durable Wilson count provenance could lose one uncovered observation above exact-integer range | `verification-pending` | RED `29d710a5...` + count/fixed-width/exact-ratio repair lineage; inherited by #488 `7741aaa...` | -| GAP-074 | durable exact count could be pre-rounded before endpoint projection | `verification-pending` | RED `f89e2467...` + reciprocal-scale repair `73bbb5cf...`; inherited by #488 `7741aaa...` | -| GAP-075 | inexact all-covered Wilson miss mass could round to exact one | `verification-pending` | RED `059ce70d...` + canonical repair `0f478392...`; inherited by #488 `7741aaa...` | -| GAP-076 | exact all-covered count could absorb small positive `z²` and emit exact `1.0` | `verification-pending` | RED `e0c4ec81...` + repair `c9dcb9df...`; inherited by #488 `7741aaa...` | -| GAP-077 | inexact partial denominator could shift exact-count Wilson endpoint by one ULP | `verification-pending` | RED `06e55653...` + TwoSum/FMA repair `6c084dbe...`; inherited by #488 `7741aaa...` | -| GAP-078 | Wilson residual compensation could move quotient across wrong midpoint | `verification-pending` | RED `d076d344...` + midpoint repair `32314239...`; inherited by #488 `7741aaa...` | -| GAP-079 | SE-aware acceptance could underflow finite positive `k*SE` to zero through scale-first arithmetic | `verification-pending` | RED `76067efc...` + direct-finite repair `4ffdf366...`; inherited by #488 `7741aaa...` | -| GAP-080 | both-overflow SE-aware fallback could round strict rejection into equality | `verification-pending` | RED `a9a45714...` + exact significand/exponent repair `425e8963...`; inherited by #488 `7741aaa...` | -| GAP-081 | finite multiplication could round strict SE-aware rejection into equality | `verification-pending` | RED `23c3262c...` + tie repair `6a2add48...`; inherited by #488 `7741aaa...` | -| GAP-082 | finite subtraction could round strict rejection onto exact bound | `verification-pending` | RED `58cbc032...` + low-term repair `68a6fd98...`; inherited by #488 `7741aaa...` | -| GAP-083 | SE-aware product correction could fall below binary64 resolution | `verification-pending` | RED `b55c5473...` / `c77ac440...` + corrected repair `772ad8ed...`; inherited by #488 `7741aaa...` | -| GAP-084 | legacy Wilson boundary could contradict peer endpoint root | `verification-pending` | RED `c9d612f2...` + peer-root repair `88512417...`; inherited by #488 `7741aaa...` | -| GAP-085 | equal nonzero subtraction/FMA correction projections could conceal exact ordering | `verification-pending` | RED `35ea85ba...` + exact product-roundoff repair `7d597a18...`; inherited by #488 `7741aaa...` | -| GAP-086 | mean bias could reject representable result because individual residuals overflow | `verification-pending` | RED `04e6e745...` + explicit-denominator cancellation/bias repair lineage; inherited by #488 `7741aaa...` | -| GAP-087 | mixed-sign mean bias could discard repeated sub-ULP opposing mass | `verification-pending` | RED `63913727...` + low-term repair `5697cca5...`; inherited by #488 `7741aaa...` | -| GAP-088 | mixed-remainder compensation could round before scientific count division | `verification-pending` | RED `8b4d19d1...` + compensated-division repair `7a33212b...`; inherited by #488 `7741aaa...` | -| GAP-089 | exact cancellation could leave same-sign remainder rounded before division | `verification-pending` | RED `84476aad...` + repair `5f0d40b8...`; inherited by #488 `7741aaa...` | -| GAP-090 | same-sign all-subnormal mean normalization could double-round final bias | `verification-pending` | RED `91abdb49...` + exact-unit repair `1c0df8a7...` + halfway coverage; inherited by #488 `7741aaa...` | -| GAP-091 | pairwise subtraction roundoff could move mean bias across final midpoint | `verification-pending` | RED `a9d9bda3...` + corrected tail/midpoint repair `676ccda0...`; inherited by #488 `7741aaa...` | -| GAP-092 | two distinct represented residuals could collapse to one subtraction and false-zero bias SE | `verification-pending` | RED `c9c55ea5...` + n=2 expanded-difference repair `f6d7da96...`; inherited by #488 `7741aaa...` | -| GAP-093 | n>2 distinct represented residuals could collapse to one rounded high and false-zero bias SE | `verification-pending` | RED `06a70e1c...` + common-high/error-free-low repair `04c62514...`; inherited by #488 `7741aaa...` | -| GAP-094 | separately rounded square roots could shift bias SE by one ULP | `verification-pending` | corrected RED `62243204...` + direct normalized-SE repair `8b8f0a21...`; inherited by #488 `7741aaa...` | -| GAP-095 | distinct rounded residual highs could materially overstate uncertainty after subtraction roundoff | `verification-pending` | RED `ae906ad6...` + exact translated-residual repair `d59b9c30...`; inherited by #488 `7741aaa...` | -| GAP-096 | exact residuals could be re-centered on rounded mean and distort dispersion | `verification-pending` | RED `9265b34a...` + exact-residual translated repair `2fa266b2...`; inherited by #488 `7741aaa...` | -| GAP-097 | common-high subtraction path could round low-term mean before centering | `verification-pending` | RED `d48e2515...` + exact low-term translated-second-moment repair `a63b8d7a...`; inherited by #488 `7741aaa...` | -| GAP-098 | exact translated-residual bias SE could double-round through a non-power normalization scale and move the final represented result by one ULP | `verification-pending` | RED `426fc5af...` + shared dyadic-scale prerequisite `d8b411f5...` + causal repair `d536e3b1...` + CHANGELOG `ebce979f...`; inherited by #488 `7741aaa...` | +| GAP-050 | zero-multiplier SE-aware acceptance could erase nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; inherited by #488 `11b8fd54...` | +| GAP-051 | exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; inherited by #488 `11b8fd54...` | +| GAP-052 | all-covered Wilson lower endpoint could cancel positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; inherited by #488 `11b8fd54...` | +| GAP-053 | strict-interior Wilson lower endpoint could cancel positive value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; inherited by #488 `11b8fd54...` | +| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; inherited by #488 `11b8fd54...` | +| GAP-055 | strict-interior Wilson lower endpoint could accept nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; inherited by #488 `11b8fd54...` | +| GAP-056 | durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; inherited by #488 `11b8fd54...` | +| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; inherited by #488 `11b8fd54...` | +| GAP-058 | generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; inherited by #488 `11b8fd54...` | +| GAP-059 | Monte Carlo summary could materially misstate positive SE relative to `SD/sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; inherited by #488 `11b8fd54...` | +| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; inherited by #488 `11b8fd54...` | +| GAP-061 | generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; inherited by #488 `11b8fd54...` | +| GAP-062 | finite-tolerance matching could fail for deterministically outside pair | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; inherited by #488 `11b8fd54...` | +| GAP-063 | exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; inherited by #488 `11b8fd54...` | +| GAP-064 | positive point RMSE could carry SE above squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; inherited by #488 `11b8fd54...` | +| GAP-065 | positive Monte Carlo RMSE could carry impossible spread/SE | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; inherited by #488 `11b8fd54...` | +| GAP-066 | RMSE nearest-rank percentile could exceed nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; inherited by #488 `11b8fd54...` | +| GAP-067 | generic nearest-rank endpoint could be incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected repair `2798e4f9...`; causal repair `c7151b49...`; inherited by #488 `11b8fd54...` | +| GAP-068 | distinct generic percentile endpoints could jointly exceed squared-deviation budget | `verification-pending` | RED `c4a13826...` + repair `cb3f80a2...`; inherited by #488 `11b8fd54...` | +| GAP-069 | two-replication endpoints could exhaust sample while mean/SD remained impossible | `verification-pending` | RED `81bf0d9e...` + repair `d48f8fef...`; inherited by #488 `11b8fd54...` | +| GAP-070 | stored Wilson pair could not arise from one score interval | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...`; inherited by #488 `11b8fd54...` | +| GAP-071 | durable Wilson evidence lacked denominator/critical-value/sidedness provenance | `active-repair` | carrier/authority/v1/envelope lineage; inherited by #488 `11b8fd54...`; durable-consumer adoption remains | +| GAP-072 | exact all-covered Wilson evidence could retain impossible zero lower endpoint | `verification-pending` | RED `ce714f07...` + repair `72e9d954...`; inherited by #488 `11b8fd54...` | +| GAP-073 | durable Wilson count provenance could lose one uncovered observation above exact-integer range | `verification-pending` | RED `29d710a5...` + count/fixed-width/exact-ratio repair lineage; inherited by #488 `11b8fd54...` | +| GAP-074 | durable exact count could be pre-rounded before endpoint projection | `verification-pending` | RED `f89e2467...` + reciprocal-scale repair `73bbb5cf...`; inherited by #488 `11b8fd54...` | +| GAP-075 | inexact all-covered Wilson miss mass could round to exact one | `verification-pending` | RED `059ce70d...` + canonical repair `0f478392...`; inherited by #488 `11b8fd54...` | +| GAP-076 | exact all-covered count could absorb small positive `z²` and emit exact `1.0` | `verification-pending` | RED `e0c4ec81...` + repair `c9dcb9df...`; inherited by #488 `11b8fd54...` | +| GAP-077 | inexact partial denominator could shift exact-count Wilson endpoint by one ULP | `verification-pending` | RED `06e55653...` + TwoSum/FMA repair `6c084dbe...`; inherited by #488 `11b8fd54...` | +| GAP-078 | Wilson residual compensation could move quotient across wrong midpoint | `verification-pending` | RED `d076d344...` + midpoint repair `32314239...`; inherited by #488 `11b8fd54...` | +| GAP-079 | SE-aware acceptance could underflow finite positive `k*SE` to zero through scale-first arithmetic | `verification-pending` | RED `76067efc...` + direct-finite repair `4ffdf366...`; inherited by #488 `11b8fd54...` | +| GAP-080 | both-overflow SE-aware fallback could round strict rejection into equality | `verification-pending` | RED `a9a45714...` + exact significand/exponent repair `425e8963...`; inherited by #488 `11b8fd54...` | +| GAP-081 | finite multiplication could round strict SE-aware rejection into equality | `verification-pending` | RED `23c3262c...` + tie repair `6a2add48...`; inherited by #488 `11b8fd54...` | +| GAP-082 | finite subtraction could round strict rejection onto exact bound | `verification-pending` | RED `58cbc032...` + low-term repair `68a6fd98...`; inherited by #488 `11b8fd54...` | +| GAP-083 | SE-aware product correction could fall below binary64 resolution | `verification-pending` | RED `b55c5473...` / `c77ac440...` + corrected repair `772ad8ed...`; inherited by #488 `11b8fd54...` | +| GAP-084 | legacy Wilson boundary could contradict peer endpoint root | `verification-pending` | RED `c9d612f2...` + peer-root repair `88512417...`; inherited by #488 `11b8fd54...` | +| GAP-085 | equal nonzero subtraction/FMA correction projections could conceal exact ordering | `verification-pending` | RED `35ea85ba...` + exact product-roundoff repair `7d597a18...`; inherited by #488 `11b8fd54...` | +| GAP-086 | mean bias could reject representable result because individual residuals overflow | `verification-pending` | RED `04e6e745...` + explicit-denominator cancellation/bias repair lineage; inherited by #488 `11b8fd54...` | +| GAP-087 | mixed-sign mean bias could discard repeated sub-ULP opposing mass | `verification-pending` | RED `63913727...` + low-term repair `5697cca5...`; inherited by #488 `11b8fd54...` | +| GAP-088 | mixed-remainder compensation could round before scientific count division | `verification-pending` | RED `8b4d19d1...` + compensated-division repair `7a33212b...`; inherited by #488 `11b8fd54...` | +| GAP-089 | exact cancellation could leave same-sign remainder rounded before division | `verification-pending` | RED `84476aad...` + repair `5f0d40b8...`; inherited by #488 `11b8fd54...` | +| GAP-090 | same-sign all-subnormal mean normalization could double-round final bias | `verification-pending` | RED `91abdb49...` + exact-unit repair `1c0df8a7...` + halfway coverage; inherited by #488 `11b8fd54...` | +| GAP-091 | pairwise subtraction roundoff could move mean bias across final midpoint | `verification-pending` | RED `a9d9bda3...` + corrected tail/midpoint repair `676ccda0...`; inherited by #488 `11b8fd54...` | +| GAP-092 | two distinct represented residuals could collapse to one subtraction and false-zero bias SE | `verification-pending` | RED `c9c55ea5...` + n=2 expanded-difference repair `f6d7da96...`; inherited by #488 `11b8fd54...` | +| GAP-093 | n>2 distinct represented residuals could collapse to one rounded high and false-zero bias SE | `verification-pending` | RED `06a70e1c...` + common-high/error-free-low repair `04c62514...`; inherited by #488 `11b8fd54...` | +| GAP-094 | separately rounded square roots could shift bias SE by one ULP | `verification-pending` | corrected RED `62243204...` + direct normalized-SE repair `8b8f0a21...`; inherited by #488 `11b8fd54...` | +| GAP-095 | distinct rounded residual highs could materially overstate uncertainty after subtraction roundoff | `verification-pending` | RED `ae906ad6...` + exact translated-residual repair `d59b9c30...`; inherited by #488 `11b8fd54...` | +| GAP-096 | exact residuals could be re-centered on rounded mean and distort dispersion | `verification-pending` | RED `9265b34a...` + exact-residual translated repair `2fa266b2...`; inherited by #488 `11b8fd54...` | +| GAP-097 | common-high subtraction path could round low-term mean before centering | `verification-pending` | RED `d48e2515...` + exact low-term translated-second-moment repair `a63b8d7a...`; inherited by #488 `11b8fd54...` | +| GAP-098 | exact translated-residual bias SE could double-round through a non-power normalization scale and move the final represented result by one ULP | `verification-pending` | RED `426fc5af...` + shared dyadic-scale prerequisite `d8b411f5...` + causal repair `d536e3b1...` + CHANGELOG `ebce979f...`; inherited by #488 `11b8fd54...` | | GAP-099 | exact translated three-observation two-level bias SE could re-round an exact gap through square/second-moment/square-root and move the represented result by one ULP | `verification-pending` | RED `fbcdb7fa...` + causal repair `e0f2445d...` + CHANGELOG `ee81953e...` + research/ancestor #488 `7741aaa...`; exact-head hosted GREEN/review/main integration remain pending | | GAP-100 | exact translated two-level bias SE with one singleton could re-round an exact gap through square/second-moment/square-root beyond the n=3 case | `verification-pending` | RED `4386d9ac...` + causal repair `79ad03fa...` + edge `7fe4117c...` + CHANGELOG `017ad11...` + research/ancestor #488 `944fac05...`; exact-head hosted GREEN/review/main integration remain pending | | GAP-101 | exact two-observation residuals could be re-centered on a rounded midpoint mean and materially distort `SE(mean)` despite exact pairwise subtraction | `verification-pending` | RED `d3dcd918...` + causal repair `02b0a178...` + CHANGELOG `5603b12d...` + research/ancestor #488 `905addcc...`; exact-head hosted GREEN/review/main integration remain pending | -| GAP-102 | exact translated non-singleton two-level bias SE could re-round a dyadic count identity through translated sums/squares/square-root | `verification-pending` | RED `3bc43da2...` + causal repair `77ba1002...` + CHANGELOG `f165914e...` + research/current #488 `9d7bb5c2...`; exact-head hosted GREEN/review/main integration remain pending | +| GAP-102 | exact translated non-singleton two-level bias SE could re-round a dyadic count identity through translated sums/squares/square-root | `verification-pending` | RED `3bc43da2...` + causal repair `77ba1002...` + CHANGELOG `f165914e...` + research/ancestor #488 `9d7bb5c2...`; exact-head hosted GREEN/review/main integration remain pending | +| GAP-103 | exact translated non-singleton two-level bias SE with a reciprocal-integer but non-power-of-two count factor could be re-rounded through translated moments | `verification-pending` | RED `d793f7f9...` + causal repair `0a4bfcd5...` + CHANGELOG `9651dfd1...` + research/current #488 `11b8fd54...`; exact-head hosted GREEN/review/main integration remain pending | ## Release gate From 1f8ec701f903a1e0cef2daa8f61151bfc0479b39 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 5 Sep 2026 14:04:54 +0900 Subject: [PATCH 197/235] docs(ddd): advance Validation Evidence baseline through GAP-104 --- docs/product-technical-gap-baseline.md | 125 +++++++++++++------------ 1 file changed, 63 insertions(+), 62 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index e41ecbe3d..e54b27583 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-05T04:00:10Z +**Snapshot:** 2026-09-05T05:03:11Z **Protected-main evidence:** `a243f18da4a4ca8a8d068c39922537f1f8ed6ad0` **Workspace version:** `0.2.0` @@ -30,7 +30,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `11b8fd5417398c778cf9e7b83473fe984abf31c5` | true | `main` | Validation Evidence landing vehicle, based on protected #490. GAP-103 proves that GAP-102's power-of-two-only two-level count admission was narrower than the exact estimator algebra: a 3/6 split of nine observations has `SE(mean)=|level_gap|/6`. Checked integer count algebra now admits only exact reciprocal-integer-square factors with an exactly representable integer divisor; non-square two-level and general multi-level samples retain the bounded translated second-moment path. GAP-102 and earlier represented-input bias-SE, Wilson, provenance, Monte Carlo, RMSE/SE, matching, serde/projection repairs remain inherited. Hosted exact-head gates and independent review remain required. | +| #488 | `c5cbf6f08b5892ab21b687e99446239915947a65` | true | `main` | Validation Evidence landing vehicle, based on protected #490. GAP-104 proves that GAP-103's reciprocal-integer-square admission was narrower than the exact estimator algebra: a 2/8 split of ten exactly translated residuals has `SE(mean)=2*|level_gap|/15`. Checked `u128` count reduction now admits only reduced count factors that are exact rational squares and evaluates the represented rational scale through the deterministic sum-over-count primitive; non-square two-level and general multi-level samples retain the bounded translated second-moment path. GAP-103 and earlier represented-input bias-SE, Wilson, provenance, Monte Carlo, RMSE/SE, matching, serde/projection repairs remain inherited. Hosted exact-head gates and independent review remain required. | | #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 | Validation / Analysis Run fold child. Unique evidence must be inherited by a conflict-resolving survivor; child-head CI does not transfer. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | @@ -62,7 +62,7 @@ The clock contract separates event/valid time, assertion time, document time, sy - Row arrival order is not scientific evidence. Fixed admitted observations must produce bit-identical means/centered results under permutation wherever the contract claims deterministic CPU `f64` reference behavior. - Known-truth component recovery follows bounded-context identity: stable `Between` is unit-level and uses canonical `occasion_index = 0`; `Within` retains actual `(unit, occasion)` identity. Duplicate identities or stable-Between occasion aliases are not weights. - A representable final scientific estimand is not rejected solely because an avoidable intermediate binary64 operation overflows/underflows. False exact 0/1/non-finite endpoints, erased finite bounds, cancellation residues, and double-rounded endpoints are not accepted when a bounded equivalent operation preserves the represented estimand or decision. -- Mean signed bias and bias SE remain Validation Evidence performance measures over admitted recovery units. `mean_bias` uses the direct residual path only when every pairwise subtraction is finite and preserves represented low-order input mass; otherwise it uses the algebraically equivalent recovered-plus-negated-truth numerator, cancellation-safe exact-power-of-two scaling, and the original scientific denominator. `bias_standard_error` still requires each individual signed residual to be representable. For every two-observation sample, TEPP evaluates `SE(mean)=|r1-r2|/2` before a rounded residual mean can become authoritative; subtraction-roundoff cases use expanded represented inputs, while exact-subtraction cases use the represented residual difference through the cancellation/overflow-safe scientific denominator. For `n>2`, the exact translated-residual path is admitted only when anchor-relative high, low, and combined deltas are exactly representable. Translation-invariant dispersion is then evaluated before any rounded residual mean becomes authoritative. GAP-098 additionally requires this admitted path to normalize by the existing exact power-of-two scale rather than an arbitrary translated magnitude, so dyadic geometry is not double-rounded during scale restoration. GAP-099 established the exact `n=3` two-level identity. GAP-100 generalizes the singleton/repeated-level identity: after exact translation, when exactly two represented levels remain and either level occurs once, evaluate `SE(mean)=|level_gap|/n` directly. GAP-102 established a non-singleton exact count shortcut for reciprocal power-of-two factors. GAP-103 generalizes only the algebraically exact reciprocal-integer-square subset: if checked counts prove `m(n-m) * d^2 = n^2(n-1)` for an exactly representable integer divisor `d`, evaluate `SE(mean)=|level_gap|/d` before generic moment reconstruction. Count factors that are not exact reciprocal integer squares and general multi-level samples retain `sqrt(sum(d²)/(n(n-1)))`; samples that cannot prove exact translated deltas retain the bounded predecessor fallback. These are bounded repairs, not a claim of globally correctly rounded n>2 dispersion. Mathematically nonzero final results outside binary64 range fail closed. +- Mean signed bias and bias SE remain Validation Evidence performance measures over admitted recovery units. `mean_bias` uses the direct residual path only when every pairwise subtraction is finite and preserves represented low-order input mass; otherwise it uses the algebraically equivalent recovered-plus-negated-truth numerator, cancellation-safe exact-power-of-two scaling, and the original scientific denominator. `bias_standard_error` still requires each individual signed residual to be representable. For every two-observation sample, TEPP evaluates `SE(mean)=|r1-r2|/2` before a rounded residual mean can become authoritative; subtraction-roundoff cases use expanded represented inputs, while exact-subtraction cases use the represented residual difference through the cancellation/overflow-safe scientific denominator. For `n>2`, the exact translated-residual path is admitted only when anchor-relative high, low, and combined deltas are exactly representable. Translation-invariant dispersion is then evaluated before any rounded residual mean becomes authoritative. GAP-098 additionally requires this admitted path to normalize by the existing exact power-of-two scale rather than an arbitrary translated magnitude, so dyadic geometry is not double-rounded during scale restoration. GAP-099 established the exact `n=3` two-level identity. GAP-100 generalizes the singleton/repeated-level identity: after exact translation, when exactly two represented levels remain and either level occurs once, evaluate `SE(mean)=|level_gap|/n` directly. GAP-102 established a non-singleton exact count shortcut for reciprocal power-of-two factors. GAP-103 widened that to exact reciprocal-integer-square factors. GAP-104 generalizes the same bounded algebraic rule to any reduced count factor that is an exact rational square: if checked `u128` reduction yields `m(n-m)/(n^2(n-1))=(a/b)^2` with integer roots `a,b` fitting `usize`, evaluate the represented scale `a*|level_gap|/b` through the deterministic sum-over-count primitive before generic moment reconstruction. Count factors that are not exact rational squares and general multi-level samples retain `sqrt(sum(d²)/(n(n-1)))`; samples that cannot prove exact translated deltas retain the bounded predecessor fallback. These are bounded repairs, not a claim of globally correctly rounded n>2 dispersion. Mathematically nonzero final results outside binary64 range fail closed. - Generic Validation Evidence RMSE and its delta-method SE normalize before squaring. Exact-zero point RMSE requires exact-zero point RMSE SE. For positive RMSE, the declared producer satisfies `SE(RMSE) <= RMSE / 2`, with a small relative binary64 admission tolerance. - Generic `MonteCarloSummary` is sign-neutral. Zero SD requires zero SE and percentile endpoints equal to the represented mean. Positive SD requires positive SE coherent with represented `SD / sqrt(n)` within a small relative tolerance. Every inclusive nearest-rank endpoint is a retained observation and satisfies `|endpoint - mean| <= SD * sqrt(n - 1)`. Distinct lower/upper endpoint values share the same `(n - 1) * SD²` deviation budget. When `replication_count=2` and endpoints are distinct, those endpoints exhaust the retained sample and must reconstruct the represented mean/sample SD. - When the generic carrier occupies `ValidationReport::monte_carlo_rmse`, retained replications are nonnegative; positive mean implies `SE(mean) <= mean`, and inclusive nearest-rank endpoints cannot exceed nonnegative sample-sum support `n * mean`. These typed bounds are not imposed on signed metrics such as bias. @@ -83,13 +83,13 @@ The clock contract separates event/valid time, assertion time, document time, sy ### #488 — Validation Evidence -#488 is the generic Validation Evidence landing vehicle at exact head `11b8fd5417398c778cf9e7b83473fe984abf31c5`, based on protected #490. GAP-092–102 remain inherited and executable. +#488 is the generic Validation Evidence landing vehicle at exact head `c5cbf6f08b5892ab21b687e99446239915947a65`, based on protected #490. GAP-092–103 remain inherited and executable. -GAP-103 RED `d793f7f9ada68d5976effa6539182ba7037bf8d0` adds an exactly translated two-level sample with `n=9`, three residuals at `0`, and six at `g=0x1.ffffffffffffdp-1`. For two levels, `SE(mean)^2 = g^2*m(n-m)/(n^2(n-1))`; here `3*6/(9^2*8)=1/36`, so the exact represented-input result is `|g|/6`, bits `0x3fc5_5555_5555_5553`. GAP-102's power-of-two-only predicate does not admit divisor `6`, so the predecessor falls through to translated sum/square/square-root reconstruction and returns adjacent upper bits `0x3fc5_5555_5555_5554`. Permutation and sign mirror preserve the same dispersion; the minimum-subnormal counterpart remains fail closed rather than becoming false zero. +GAP-104 RED `6dc8116c89fa44a7ff1d58a8f9a51c876993d33f` adds an exactly translated two-level sample with `n=10`, two residuals at `0`, and eight at `g=0x1.ffffffffffffep-1`. For two levels, `SE(mean)^2 = g^2*m(n-m)/(n^2(n-1))`; here `2*8/(10^2*9)=4/225=(2/15)^2`, so the exact represented-input result is `2*|g|/15`, bits `0x3fc1_1111_1111_1110`. GAP-103's reciprocal-integer-square predicate does not admit numerator `2`, so the predecessor falls through to translated sum/square/FMA/square-root reconstruction and returns adjacent upper bits `0x3fc1_1111_1111_1111`. Permutation and sign mirror preserve the same dispersion; the minimum-subnormal counterpart remains fail closed rather than becoming false zero. -Causal repair `0a4bfcd52defe8912afa8269576395803d451bb3` keeps exact translated-residual admission and generalizes only the count identity. Checked `u128` arithmetic verifies exact divisibility of `n^2(n-1)` by `m(n-m)`, verifies that quotient is an exact integer square, and admits direct `|g|/d` only when the integer divisor `d` is exactly representable as binary64. GAP-102's divisor `8` remains admitted; non-square count factors and general multi-level cases retain the prior bounded translated second-moment path. CHANGELOG `9651dfd123b71b14c58e34dfca4800a92e298a99`; research/current #488 `11b8fd5417398c778cf9e7b83473fe984abf31c5`. Fresh exact-head hosted execution and qualifying independent review remain required. +Causal repair `8f2803c874568877e20e4c0f267ec5ce613daa3d` keeps exact translated-residual admission and generalizes only the count identity. Checked `u128` arithmetic reduces `m(n-m)/(n^2(n-1))` by GCD, verifies that both reduced numerator and denominator are perfect squares, and admits the direct path only when both integer roots fit `usize`. The represented rational scale is evaluated with `deterministic_representable_sum_over_count`, using the numerator root as the repeated-gap count and the denominator root as the scientific divisor. This avoids multiply-first overflow and divide-first subnormal loss. GAP-103's `1/6` and GAP-102's `1/8` remain admitted; non-square count factors and general multi-level cases retain the prior bounded translated second-moment path. CHANGELOG `f0bb7af91c08b7766f43fec4c8d7984b68a3599f`; research/current #488 `c5cbf6f08b5892ab21b687e99446239915947a65`. Fresh exact-head hosted execution and qualifying independent review remain required. -GAP-102 remains inherited: RED `3bc43da21784d3bf2f506c2ffdaa66c90a76d85d` + repair `77ba10026d23252314f04d95a67ce1cfeb5e54a0` preserve the exact 6/10-of-16 dyadic count case. GAP-101 preserves the exact two-observation identity `SE(mean)=|r1-r2|/2`; GAP-100 preserves the exact translated two-level singleton identity `SE(mean)=|level_gap|/n`; GAP-099 and GAP-098 retain their n=3 and dyadic-normalization repairs. GAP-103 does not widen the general n>2 correct-rounding claim. +GAP-103 remains inherited: RED `d793f7f9ada68d5976effa6539182ba7037bf8d0` + repair `0a4bfcd52defe8912afa8269576395803d451bb3` preserve the exact 3/6-of-9 reciprocal-integer case. GAP-102 preserves the exact 6/10-of-16 dyadic count case. GAP-101 preserves the exact two-observation identity `SE(mean)=|r1-r2|/2`; GAP-100 preserves the exact translated two-level singleton identity `SE(mean)=|level_gap|/n`; GAP-099 and GAP-098 retain their n=3 and dyadic-normalization repairs. GAP-104 does not widen the general n>2 correct-rounding claim. ### #416 — Validation / Analysis Run consolidation @@ -101,7 +101,7 @@ GAP-102 remains inherited: RED `3bc43da21784d3bf2f506c2ffdaa66c90a76d85d` + repa ## Gap register -GAP-001–GAP-044 retain their existing domain/release identities and closure lineage. They remain unchanged by the GAP-103 numerical repair; their authoritative source/test/ADR history remains in repository ancestry and the surviving landing vehicles listed above. The validation lineage from GAP-045 onward is restated here because #488 is its current single writer. +GAP-001–GAP-044 retain their existing domain/release identities and closure lineage. They remain unchanged by the GAP-104 numerical repair; their authoritative source/test/ADR history remains in repository ancestry and the surviving landing vehicles listed above. The validation lineage from GAP-045 onward is restated here because #488 is its current single writer. | ID | Gap | Maturity | Closure evidence | | --- | --- | --- | --- | @@ -149,65 +149,66 @@ GAP-001–GAP-044 retain their existing domain/release identities and closure li | GAP-042 | ratio-first logarithm inflated adjacent-float growth rate | `verification-pending` | RED `766ddc7a...` + `ln_1p` repair `16f21d9a...` | | GAP-043 | duplicate known-truth identities could silently reweight RMSE | `verification-pending` | RED `698f12f5...` + repair `2fae4cb2...` | | GAP-044 | known-truth RMSE alignment depended on row order | `verification-pending` | RED `8ad72ac9...` / `5fb93c40...` + repairs `2dd9537e...` / `025dce7f...`; #310 `c6680450...` | -| GAP-045 | mean signed bias could reject representable result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; inherited by #488 `11b8fd54...` | -| GAP-046 | bias SE could reject representable SEM because raw squared deviations overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; inherited by #488 `11b8fd54...` | -| GAP-047 | generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; inherited by #488 `11b8fd54...` | -| GAP-048 | mean signed bias could erase representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; inherited by #488 `11b8fd54...` | +| GAP-045 | mean signed bias could reject representable result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; inherited by #488 `c5cbf6f0...` | +| GAP-046 | bias SE could reject representable SEM because raw squared deviations overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; inherited by #488 `c5cbf6f0...` | +| GAP-047 | generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; inherited by #488 `c5cbf6f0...` | +| GAP-048 | mean signed bias could erase representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; inherited by #488 `c5cbf6f0...` | | GAP-049 | stable `Between` recovery could be aliased across occasion indices and reweight RMSE | `verification-pending` | RED `0a03041c...` + repair `ec2c1219...`; #310 `c6680450...` | -| GAP-050 | zero-multiplier SE-aware acceptance could erase nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; inherited by #488 `11b8fd54...` | -| GAP-051 | exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; inherited by #488 `11b8fd54...` | -| GAP-052 | all-covered Wilson lower endpoint could cancel positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; inherited by #488 `11b8fd54...` | -| GAP-053 | strict-interior Wilson lower endpoint could cancel positive value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; inherited by #488 `11b8fd54...` | -| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; inherited by #488 `11b8fd54...` | -| GAP-055 | strict-interior Wilson lower endpoint could accept nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; inherited by #488 `11b8fd54...` | -| GAP-056 | durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; inherited by #488 `11b8fd54...` | -| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; inherited by #488 `11b8fd54...` | -| GAP-058 | generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; inherited by #488 `11b8fd54...` | -| GAP-059 | Monte Carlo summary could materially misstate positive SE relative to `SD/sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; inherited by #488 `11b8fd54...` | -| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; inherited by #488 `11b8fd54...` | -| GAP-061 | generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; inherited by #488 `11b8fd54...` | -| GAP-062 | finite-tolerance matching could fail for deterministically outside pair | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; inherited by #488 `11b8fd54...` | -| GAP-063 | exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; inherited by #488 `11b8fd54...` | -| GAP-064 | positive point RMSE could carry SE above squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; inherited by #488 `11b8fd54...` | -| GAP-065 | positive Monte Carlo RMSE could carry impossible spread/SE | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; inherited by #488 `11b8fd54...` | -| GAP-066 | RMSE nearest-rank percentile could exceed nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; inherited by #488 `11b8fd54...` | -| GAP-067 | generic nearest-rank endpoint could be incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected repair `2798e4f9...`; causal repair `c7151b49...`; inherited by #488 `11b8fd54...` | -| GAP-068 | distinct generic percentile endpoints could jointly exceed squared-deviation budget | `verification-pending` | RED `c4a13826...` + repair `cb3f80a2...`; inherited by #488 `11b8fd54...` | -| GAP-069 | two-replication endpoints could exhaust sample while mean/SD remained impossible | `verification-pending` | RED `81bf0d9e...` + repair `d48f8fef...`; inherited by #488 `11b8fd54...` | -| GAP-070 | stored Wilson pair could not arise from one score interval | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...`; inherited by #488 `11b8fd54...` | -| GAP-071 | durable Wilson evidence lacked denominator/critical-value/sidedness provenance | `active-repair` | carrier/authority/v1/envelope lineage; inherited by #488 `11b8fd54...`; durable-consumer adoption remains | -| GAP-072 | exact all-covered Wilson evidence could retain impossible zero lower endpoint | `verification-pending` | RED `ce714f07...` + repair `72e9d954...`; inherited by #488 `11b8fd54...` | -| GAP-073 | durable Wilson count provenance could lose one uncovered observation above exact-integer range | `verification-pending` | RED `29d710a5...` + count/fixed-width/exact-ratio repair lineage; inherited by #488 `11b8fd54...` | -| GAP-074 | durable exact count could be pre-rounded before endpoint projection | `verification-pending` | RED `f89e2467...` + reciprocal-scale repair `73bbb5cf...`; inherited by #488 `11b8fd54...` | -| GAP-075 | inexact all-covered Wilson miss mass could round to exact one | `verification-pending` | RED `059ce70d...` + canonical repair `0f478392...`; inherited by #488 `11b8fd54...` | -| GAP-076 | exact all-covered count could absorb small positive `z²` and emit exact `1.0` | `verification-pending` | RED `e0c4ec81...` + repair `c9dcb9df...`; inherited by #488 `11b8fd54...` | -| GAP-077 | inexact partial denominator could shift exact-count Wilson endpoint by one ULP | `verification-pending` | RED `06e55653...` + TwoSum/FMA repair `6c084dbe...`; inherited by #488 `11b8fd54...` | -| GAP-078 | Wilson residual compensation could move quotient across wrong midpoint | `verification-pending` | RED `d076d344...` + midpoint repair `32314239...`; inherited by #488 `11b8fd54...` | -| GAP-079 | SE-aware acceptance could underflow finite positive `k*SE` to zero through scale-first arithmetic | `verification-pending` | RED `76067efc...` + direct-finite repair `4ffdf366...`; inherited by #488 `11b8fd54...` | -| GAP-080 | both-overflow SE-aware fallback could round strict rejection into equality | `verification-pending` | RED `a9a45714...` + exact significand/exponent repair `425e8963...`; inherited by #488 `11b8fd54...` | -| GAP-081 | finite multiplication could round strict SE-aware rejection into equality | `verification-pending` | RED `23c3262c...` + tie repair `6a2add48...`; inherited by #488 `11b8fd54...` | -| GAP-082 | finite subtraction could round strict rejection onto exact bound | `verification-pending` | RED `58cbc032...` + low-term repair `68a6fd98...`; inherited by #488 `11b8fd54...` | -| GAP-083 | SE-aware product correction could fall below binary64 resolution | `verification-pending` | RED `b55c5473...` / `c77ac440...` + corrected repair `772ad8ed...`; inherited by #488 `11b8fd54...` | -| GAP-084 | legacy Wilson boundary could contradict peer endpoint root | `verification-pending` | RED `c9d612f2...` + peer-root repair `88512417...`; inherited by #488 `11b8fd54...` | -| GAP-085 | equal nonzero subtraction/FMA correction projections could conceal exact ordering | `verification-pending` | RED `35ea85ba...` + exact product-roundoff repair `7d597a18...`; inherited by #488 `11b8fd54...` | -| GAP-086 | mean bias could reject representable result because individual residuals overflow | `verification-pending` | RED `04e6e745...` + explicit-denominator cancellation/bias repair lineage; inherited by #488 `11b8fd54...` | -| GAP-087 | mixed-sign mean bias could discard repeated sub-ULP opposing mass | `verification-pending` | RED `63913727...` + low-term repair `5697cca5...`; inherited by #488 `11b8fd54...` | -| GAP-088 | mixed-remainder compensation could round before scientific count division | `verification-pending` | RED `8b4d19d1...` + compensated-division repair `7a33212b...`; inherited by #488 `11b8fd54...` | -| GAP-089 | exact cancellation could leave same-sign remainder rounded before division | `verification-pending` | RED `84476aad...` + repair `5f0d40b8...`; inherited by #488 `11b8fd54...` | -| GAP-090 | same-sign all-subnormal mean normalization could double-round final bias | `verification-pending` | RED `91abdb49...` + exact-unit repair `1c0df8a7...` + halfway coverage; inherited by #488 `11b8fd54...` | -| GAP-091 | pairwise subtraction roundoff could move mean bias across final midpoint | `verification-pending` | RED `a9d9bda3...` + corrected tail/midpoint repair `676ccda0...`; inherited by #488 `11b8fd54...` | -| GAP-092 | two distinct represented residuals could collapse to one subtraction and false-zero bias SE | `verification-pending` | RED `c9c55ea5...` + n=2 expanded-difference repair `f6d7da96...`; inherited by #488 `11b8fd54...` | -| GAP-093 | n>2 distinct represented residuals could collapse to one rounded high and false-zero bias SE | `verification-pending` | RED `06a70e1c...` + common-high/error-free-low repair `04c62514...`; inherited by #488 `11b8fd54...` | -| GAP-094 | separately rounded square roots could shift bias SE by one ULP | `verification-pending` | corrected RED `62243204...` + direct normalized-SE repair `8b8f0a21...`; inherited by #488 `11b8fd54...` | -| GAP-095 | distinct rounded residual highs could materially overstate uncertainty after subtraction roundoff | `verification-pending` | RED `ae906ad6...` + exact translated-residual repair `d59b9c30...`; inherited by #488 `11b8fd54...` | -| GAP-096 | exact residuals could be re-centered on rounded mean and distort dispersion | `verification-pending` | RED `9265b34a...` + exact-residual translated repair `2fa266b2...`; inherited by #488 `11b8fd54...` | -| GAP-097 | common-high subtraction path could round low-term mean before centering | `verification-pending` | RED `d48e2515...` + exact low-term translated-second-moment repair `a63b8d7a...`; inherited by #488 `11b8fd54...` | -| GAP-098 | exact translated-residual bias SE could double-round through a non-power normalization scale and move the final represented result by one ULP | `verification-pending` | RED `426fc5af...` + shared dyadic-scale prerequisite `d8b411f5...` + causal repair `d536e3b1...` + CHANGELOG `ebce979f...`; inherited by #488 `11b8fd54...` | +| GAP-050 | zero-multiplier SE-aware acceptance could erase nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; inherited by #488 `c5cbf6f0...` | +| GAP-051 | exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; inherited by #488 `c5cbf6f0...` | +| GAP-052 | all-covered Wilson lower endpoint could cancel positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; inherited by #488 `c5cbf6f0...` | +| GAP-053 | strict-interior Wilson lower endpoint could cancel positive value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; inherited by #488 `c5cbf6f0...` | +| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; inherited by #488 `c5cbf6f0...` | +| GAP-055 | strict-interior Wilson lower endpoint could accept nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; inherited by #488 `c5cbf6f0...` | +| GAP-056 | durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; inherited by #488 `c5cbf6f0...` | +| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; inherited by #488 `c5cbf6f0...` | +| GAP-058 | generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; inherited by #488 `c5cbf6f0...` | +| GAP-059 | Monte Carlo summary could materially misstate positive SE relative to `SD/sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; inherited by #488 `c5cbf6f0...` | +| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; inherited by #488 `c5cbf6f0...` | +| GAP-061 | generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; inherited by #488 `c5cbf6f0...` | +| GAP-062 | finite-tolerance matching could fail for deterministically outside pair | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; inherited by #488 `c5cbf6f0...` | +| GAP-063 | exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; inherited by #488 `c5cbf6f0...` | +| GAP-064 | positive point RMSE could carry SE above squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; inherited by #488 `c5cbf6f0...` | +| GAP-065 | positive Monte Carlo RMSE could carry impossible spread/SE | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; inherited by #488 `c5cbf6f0...` | +| GAP-066 | RMSE nearest-rank percentile could exceed nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; inherited by #488 `c5cbf6f0...` | +| GAP-067 | generic nearest-rank endpoint could be incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected repair `2798e4f9...`; causal repair `c7151b49...`; inherited by #488 `c5cbf6f0...` | +| GAP-068 | distinct generic percentile endpoints could jointly exceed squared-deviation budget | `verification-pending` | RED `c4a13826...` + repair `cb3f80a2...`; inherited by #488 `c5cbf6f0...` | +| GAP-069 | two-replication endpoints could exhaust sample while mean/SD remained impossible | `verification-pending` | RED `81bf0d9e...` + repair `d48f8fef...`; inherited by #488 `c5cbf6f0...` | +| GAP-070 | stored Wilson pair could not arise from one score interval | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...`; inherited by #488 `c5cbf6f0...` | +| GAP-071 | durable Wilson evidence lacked denominator/critical-value/sidedness provenance | `active-repair` | carrier/authority/v1/envelope lineage; inherited by #488 `c5cbf6f0...`; durable-consumer adoption remains | +| GAP-072 | exact all-covered Wilson evidence could retain impossible zero lower endpoint | `verification-pending` | RED `ce714f07...` + repair `72e9d954...`; inherited by #488 `c5cbf6f0...` | +| GAP-073 | durable Wilson count provenance could lose one uncovered observation above exact-integer range | `verification-pending` | RED `29d710a5...` + count/fixed-width/exact-ratio repair lineage; inherited by #488 `c5cbf6f0...` | +| GAP-074 | durable exact count could be pre-rounded before endpoint projection | `verification-pending` | RED `f89e2467...` + reciprocal-scale repair `73bbb5cf...`; inherited by #488 `c5cbf6f0...` | +| GAP-075 | inexact all-covered Wilson miss mass could round to exact one | `verification-pending` | RED `059ce70d...` + canonical repair `0f478392...`; inherited by #488 `c5cbf6f0...` | +| GAP-076 | exact all-covered count could absorb small positive `z²` and emit exact `1.0` | `verification-pending` | RED `e0c4ec81...` + repair `c9dcb9df...`; inherited by #488 `c5cbf6f0...` | +| GAP-077 | inexact partial denominator could shift exact-count Wilson endpoint by one ULP | `verification-pending` | RED `06e55653...` + TwoSum/FMA repair `6c084dbe...`; inherited by #488 `c5cbf6f0...` | +| GAP-078 | Wilson residual compensation could move quotient across wrong midpoint | `verification-pending` | RED `d076d344...` + midpoint repair `32314239...`; inherited by #488 `c5cbf6f0...` | +| GAP-079 | SE-aware acceptance could underflow finite positive `k*SE` to zero through scale-first arithmetic | `verification-pending` | RED `76067efc...` + direct-finite repair `4ffdf366...`; inherited by #488 `c5cbf6f0...` | +| GAP-080 | both-overflow SE-aware fallback could round strict rejection into equality | `verification-pending` | RED `a9a45714...` + exact significand/exponent repair `425e8963...`; inherited by #488 `c5cbf6f0...` | +| GAP-081 | finite multiplication could round strict SE-aware rejection into equality | `verification-pending` | RED `23c3262c...` + tie repair `6a2add48...`; inherited by #488 `c5cbf6f0...` | +| GAP-082 | finite subtraction could round strict rejection onto exact bound | `verification-pending` | RED `58cbc032...` + low-term repair `68a6fd98...`; inherited by #488 `c5cbf6f0...` | +| GAP-083 | SE-aware product correction could fall below binary64 resolution | `verification-pending` | RED `b55c5473...` / `c77ac440...` + corrected repair `772ad8ed...`; inherited by #488 `c5cbf6f0...` | +| GAP-084 | legacy Wilson boundary could contradict peer endpoint root | `verification-pending` | RED `c9d612f2...` + peer-root repair `88512417...`; inherited by #488 `c5cbf6f0...` | +| GAP-085 | equal nonzero subtraction/FMA correction projections could conceal exact ordering | `verification-pending` | RED `35ea85ba...` + exact product-roundoff repair `7d597a18...`; inherited by #488 `c5cbf6f0...` | +| GAP-086 | mean bias could reject representable result because individual residuals overflow | `verification-pending` | RED `04e6e745...` + explicit-denominator cancellation/bias repair lineage; inherited by #488 `c5cbf6f0...` | +| GAP-087 | mixed-sign mean bias could discard repeated sub-ULP opposing mass | `verification-pending` | RED `63913727...` + low-term repair `5697cca5...`; inherited by #488 `c5cbf6f0...` | +| GAP-088 | mixed-remainder compensation could round before scientific count division | `verification-pending` | RED `8b4d19d1...` + compensated-division repair `7a33212b...`; inherited by #488 `c5cbf6f0...` | +| GAP-089 | exact cancellation could leave same-sign remainder rounded before division | `verification-pending` | RED `84476aad...` + repair `5f0d40b8...`; inherited by #488 `c5cbf6f0...` | +| GAP-090 | same-sign all-subnormal mean normalization could double-round final bias | `verification-pending` | RED `91abdb49...` + exact-unit repair `1c0df8a7...` + halfway coverage; inherited by #488 `c5cbf6f0...` | +| GAP-091 | pairwise subtraction roundoff could move mean bias across final midpoint | `verification-pending` | RED `a9d9bda3...` + corrected tail/midpoint repair `676ccda0...`; inherited by #488 `c5cbf6f0...` | +| GAP-092 | two distinct represented residuals could collapse to one subtraction and false-zero bias SE | `verification-pending` | RED `c9c55ea5...` + n=2 expanded-difference repair `f6d7da96...`; inherited by #488 `c5cbf6f0...` | +| GAP-093 | n>2 distinct represented residuals could collapse to one rounded high and false-zero bias SE | `verification-pending` | RED `06a70e1c...` + common-high/error-free-low repair `04c62514...`; inherited by #488 `c5cbf6f0...` | +| GAP-094 | separately rounded square roots could shift bias SE by one ULP | `verification-pending` | corrected RED `62243204...` + direct normalized-SE repair `8b8f0a21...`; inherited by #488 `c5cbf6f0...` | +| GAP-095 | distinct rounded residual highs could materially overstate uncertainty after subtraction roundoff | `verification-pending` | RED `ae906ad6...` + exact translated-residual repair `d59b9c30...`; inherited by #488 `c5cbf6f0...` | +| GAP-096 | exact residuals could be re-centered on rounded mean and distort dispersion | `verification-pending` | RED `9265b34a...` + exact-residual translated repair `2fa266b2...`; inherited by #488 `c5cbf6f0...` | +| GAP-097 | common-high subtraction path could round low-term mean before centering | `verification-pending` | RED `d48e2515...` + exact low-term translated-second-moment repair `a63b8d7a...`; inherited by #488 `c5cbf6f0...` | +| GAP-098 | exact translated-residual bias SE could double-round through a non-power normalization scale and move the final represented result by one ULP | `verification-pending` | RED `426fc5af...` + shared dyadic-scale prerequisite `d8b411f5...` + causal repair `d536e3b1...` + CHANGELOG `ebce979f...`; inherited by #488 `c5cbf6f0...` | | GAP-099 | exact translated three-observation two-level bias SE could re-round an exact gap through square/second-moment/square-root and move the represented result by one ULP | `verification-pending` | RED `fbcdb7fa...` + causal repair `e0f2445d...` + CHANGELOG `ee81953e...` + research/ancestor #488 `7741aaa...`; exact-head hosted GREEN/review/main integration remain pending | | GAP-100 | exact translated two-level bias SE with one singleton could re-round an exact gap through square/second-moment/square-root beyond the n=3 case | `verification-pending` | RED `4386d9ac...` + causal repair `79ad03fa...` + edge `7fe4117c...` + CHANGELOG `017ad11...` + research/ancestor #488 `944fac05...`; exact-head hosted GREEN/review/main integration remain pending | | GAP-101 | exact two-observation residuals could be re-centered on a rounded midpoint mean and materially distort `SE(mean)` despite exact pairwise subtraction | `verification-pending` | RED `d3dcd918...` + causal repair `02b0a178...` + CHANGELOG `5603b12d...` + research/ancestor #488 `905addcc...`; exact-head hosted GREEN/review/main integration remain pending | | GAP-102 | exact translated non-singleton two-level bias SE could re-round a dyadic count identity through translated sums/squares/square-root | `verification-pending` | RED `3bc43da2...` + causal repair `77ba1002...` + CHANGELOG `f165914e...` + research/ancestor #488 `9d7bb5c2...`; exact-head hosted GREEN/review/main integration remain pending | -| GAP-103 | exact translated non-singleton two-level bias SE with a reciprocal-integer but non-power-of-two count factor could be re-rounded through translated moments | `verification-pending` | RED `d793f7f9...` + causal repair `0a4bfcd5...` + CHANGELOG `9651dfd1...` + research/current #488 `11b8fd54...`; exact-head hosted GREEN/review/main integration remain pending | +| GAP-103 | exact translated non-singleton two-level bias SE with a reciprocal-integer but non-power-of-two count factor could be re-rounded through translated moments | `verification-pending` | RED `d793f7f9...` + causal repair `0a4bfcd5...` + CHANGELOG `9651dfd1...` + research/ancestor #488 `11b8fd54...`; exact-head hosted GREEN/review/main integration remain pending | +| GAP-104 | exact translated non-singleton two-level bias SE with a non-unit rational-square count factor could be re-rounded through translated moments | `verification-pending` | RED `6dc8116c...` + causal repair `8f2803c8...` + CHANGELOG `f0bb7af9...` + research/current #488 `c5cbf6f0...`; exact-head hosted GREEN/review/main integration remain pending | ## Release gate From 68166ef5c5225840e64c5c4615087b3638b1fabd Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 5 Sep 2026 15:13:52 +0900 Subject: [PATCH 198/235] docs(ddd): advance Validation Evidence baseline through GAP-105 --- docs/product-technical-gap-baseline.md | 125 +++++++++++++------------ 1 file changed, 63 insertions(+), 62 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index e54b27583..7e1e9d8d1 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-05T05:03:11Z +**Snapshot:** 2026-09-05T06:09:19Z **Protected-main evidence:** `a243f18da4a4ca8a8d068c39922537f1f8ed6ad0` **Workspace version:** `0.2.0` @@ -30,7 +30,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `c5cbf6f08b5892ab21b687e99446239915947a65` | true | `main` | Validation Evidence landing vehicle, based on protected #490. GAP-104 proves that GAP-103's reciprocal-integer-square admission was narrower than the exact estimator algebra: a 2/8 split of ten exactly translated residuals has `SE(mean)=2*|level_gap|/15`. Checked `u128` count reduction now admits only reduced count factors that are exact rational squares and evaluates the represented rational scale through the deterministic sum-over-count primitive; non-square two-level and general multi-level samples retain the bounded translated second-moment path. GAP-103 and earlier represented-input bias-SE, Wilson, provenance, Monte Carlo, RMSE/SE, matching, serde/projection repairs remain inherited. Hosted exact-head gates and independent review remain required. | +| #488 | `022797f7ca823d7bebe5a68be869ae641f1ccc01` | true | `main` | Validation Evidence landing vehicle, based on protected #490. GAP-105 proves that GAP-104's exact rational-square count identity could still double-round when normalized rational scaling restored a normal gap into a subnormal final `SE(mean)`. The bounded repair rounds exact minimum-subnormal units once when that boundary applies, while normal results retain the existing overflow-safe represented sum-over-count path. GAP-104 and earlier represented-input bias-SE, Wilson, provenance, Monte Carlo, RMSE/SE, matching, serde/projection repairs remain inherited. Hosted exact-head gates and independent review remain required. | | #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 | Validation / Analysis Run fold child. Unique evidence must be inherited by a conflict-resolving survivor; child-head CI does not transfer. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | @@ -62,7 +62,7 @@ The clock contract separates event/valid time, assertion time, document time, sy - Row arrival order is not scientific evidence. Fixed admitted observations must produce bit-identical means/centered results under permutation wherever the contract claims deterministic CPU `f64` reference behavior. - Known-truth component recovery follows bounded-context identity: stable `Between` is unit-level and uses canonical `occasion_index = 0`; `Within` retains actual `(unit, occasion)` identity. Duplicate identities or stable-Between occasion aliases are not weights. - A representable final scientific estimand is not rejected solely because an avoidable intermediate binary64 operation overflows/underflows. False exact 0/1/non-finite endpoints, erased finite bounds, cancellation residues, and double-rounded endpoints are not accepted when a bounded equivalent operation preserves the represented estimand or decision. -- Mean signed bias and bias SE remain Validation Evidence performance measures over admitted recovery units. `mean_bias` uses the direct residual path only when every pairwise subtraction is finite and preserves represented low-order input mass; otherwise it uses the algebraically equivalent recovered-plus-negated-truth numerator, cancellation-safe exact-power-of-two scaling, and the original scientific denominator. `bias_standard_error` still requires each individual signed residual to be representable. For every two-observation sample, TEPP evaluates `SE(mean)=|r1-r2|/2` before a rounded residual mean can become authoritative; subtraction-roundoff cases use expanded represented inputs, while exact-subtraction cases use the represented residual difference through the cancellation/overflow-safe scientific denominator. For `n>2`, the exact translated-residual path is admitted only when anchor-relative high, low, and combined deltas are exactly representable. Translation-invariant dispersion is then evaluated before any rounded residual mean becomes authoritative. GAP-098 additionally requires this admitted path to normalize by the existing exact power-of-two scale rather than an arbitrary translated magnitude, so dyadic geometry is not double-rounded during scale restoration. GAP-099 established the exact `n=3` two-level identity. GAP-100 generalizes the singleton/repeated-level identity: after exact translation, when exactly two represented levels remain and either level occurs once, evaluate `SE(mean)=|level_gap|/n` directly. GAP-102 established a non-singleton exact count shortcut for reciprocal power-of-two factors. GAP-103 widened that to exact reciprocal-integer-square factors. GAP-104 generalizes the same bounded algebraic rule to any reduced count factor that is an exact rational square: if checked `u128` reduction yields `m(n-m)/(n^2(n-1))=(a/b)^2` with integer roots `a,b` fitting `usize`, evaluate the represented scale `a*|level_gap|/b` through the deterministic sum-over-count primitive before generic moment reconstruction. Count factors that are not exact rational squares and general multi-level samples retain `sqrt(sum(d²)/(n(n-1)))`; samples that cannot prove exact translated deltas retain the bounded predecessor fallback. These are bounded repairs, not a claim of globally correctly rounded n>2 dispersion. Mathematically nonzero final results outside binary64 range fail closed. +- Mean signed bias and bias SE remain Validation Evidence performance measures over admitted recovery units. `mean_bias` uses the direct residual path only when every pairwise subtraction is finite and preserves represented low-order input mass; otherwise it uses the algebraically equivalent recovered-plus-negated-truth numerator, cancellation-safe exact-power-of-two scaling, and the original scientific denominator. `bias_standard_error` still requires each individual signed residual to be representable. For every two-observation sample, TEPP evaluates `SE(mean)=|r1-r2|/2` before a rounded residual mean can become authoritative; subtraction-roundoff cases use expanded represented inputs, while exact-subtraction cases use the represented residual difference through the cancellation/overflow-safe scientific denominator. For `n>2`, the exact translated-residual path is admitted only when anchor-relative high, low, and combined deltas are exactly representable. Translation-invariant dispersion is then evaluated before any rounded residual mean becomes authoritative. GAP-098 requires exact power-of-two normalization; GAP-099 established the exact `n=3` two-level identity; GAP-100 generalized singleton/repeated-level geometry; GAP-102 established a reciprocal-power-of-two count shortcut; GAP-103 widened that to reciprocal-integer-square factors; GAP-104 generalized it to any reduced count factor satisfying `m(n-m)/(n^2(n-1))=(a/b)^2` with checked integer roots. GAP-105 additionally requires an admitted exact rational scale whose final represented value is subnormal to be rounded once in exact minimum-subnormal units rather than through normalized quotient plus scale restoration. Results outside that bounded subnormal projection retain the existing overflow-safe represented sum-over-count path. Count factors that are not exact rational squares and general multi-level samples retain `sqrt(sum(d²)/(n(n-1)))`; samples that cannot prove exact translated deltas retain the bounded predecessor fallback. These are bounded repairs, not a claim of globally correctly rounded n>2 dispersion. Mathematically nonzero final results outside binary64 range fail closed. - Generic Validation Evidence RMSE and its delta-method SE normalize before squaring. Exact-zero point RMSE requires exact-zero point RMSE SE. For positive RMSE, the declared producer satisfies `SE(RMSE) <= RMSE / 2`, with a small relative binary64 admission tolerance. - Generic `MonteCarloSummary` is sign-neutral. Zero SD requires zero SE and percentile endpoints equal to the represented mean. Positive SD requires positive SE coherent with represented `SD / sqrt(n)` within a small relative tolerance. Every inclusive nearest-rank endpoint is a retained observation and satisfies `|endpoint - mean| <= SD * sqrt(n - 1)`. Distinct lower/upper endpoint values share the same `(n - 1) * SD²` deviation budget. When `replication_count=2` and endpoints are distinct, those endpoints exhaust the retained sample and must reconstruct the represented mean/sample SD. - When the generic carrier occupies `ValidationReport::monte_carlo_rmse`, retained replications are nonnegative; positive mean implies `SE(mean) <= mean`, and inclusive nearest-rank endpoints cannot exceed nonnegative sample-sum support `n * mean`. These typed bounds are not imposed on signed metrics such as bias. @@ -83,13 +83,13 @@ The clock contract separates event/valid time, assertion time, document time, sy ### #488 — Validation Evidence -#488 is the generic Validation Evidence landing vehicle at exact head `c5cbf6f08b5892ab21b687e99446239915947a65`, based on protected #490. GAP-092–103 remain inherited and executable. +#488 is the generic Validation Evidence landing vehicle at exact head `022797f7ca823d7bebe5a68be869ae641f1ccc01`, based on protected #490. GAP-092–104 remain inherited and executable. -GAP-104 RED `6dc8116c89fa44a7ff1d58a8f9a51c876993d33f` adds an exactly translated two-level sample with `n=10`, two residuals at `0`, and eight at `g=0x1.ffffffffffffep-1`. For two levels, `SE(mean)^2 = g^2*m(n-m)/(n^2(n-1))`; here `2*8/(10^2*9)=4/225=(2/15)^2`, so the exact represented-input result is `2*|g|/15`, bits `0x3fc1_1111_1111_1110`. GAP-103's reciprocal-integer-square predicate does not admit numerator `2`, so the predecessor falls through to translated sum/square/FMA/square-root reconstruction and returns adjacent upper bits `0x3fc1_1111_1111_1111`. Permutation and sign mirror preserve the same dispersion; the minimum-subnormal counterpart remains fail closed rather than becoming false zero. +GAP-105 RED `8b7995d2320cf256b3a38991ae1f8a230ca00146` adds an exactly translated two-level sample with `n=33`, six residuals at `0`, and 27 at `g=f64::from_bits(0x004a_2c74_6ac3_028e)`. Here `6*27/(33^2*32)=9/1936=(3/44)^2`, so the exact represented-input result is `3*|g|/44`, correctly rounded to bits `0x000e_46cb_22f6_0165`. GAP-104 already admits the exact rational-square geometry, but its normalized represented sum-over-count path restores the quotient across the normal/subnormal boundary and returns adjacent lower bits `0x000e_46cb_22f6_0164`. Permutation and sign mirror preserve the same dispersion; a minimum-subnormal gap with the same count scale is mathematically nonzero but below binary64 and therefore remains fail closed. -Causal repair `8f2803c874568877e20e4c0f267ec5ce613daa3d` keeps exact translated-residual admission and generalizes only the count identity. Checked `u128` arithmetic reduces `m(n-m)/(n^2(n-1))` by GCD, verifies that both reduced numerator and denominator are perfect squares, and admits the direct path only when both integer roots fit `usize`. The represented rational scale is evaluated with `deterministic_representable_sum_over_count`, using the numerator root as the repeated-gap count and the denominator root as the scientific divisor. This avoids multiply-first overflow and divide-first subnormal loss. GAP-103's `1/6` and GAP-102's `1/8` remain admitted; non-square count factors and general multi-level cases retain the prior bounded translated second-moment path. CHANGELOG `f0bb7af91c08b7766f43fec4c8d7984b68a3599f`; research/current #488 `c5cbf6f08b5892ab21b687e99446239915947a65`. Fresh exact-head hosted execution and qualifying independent review remain required. +Causal repair `ab0f0df1b8f36647f67239a5c628daed9023210e` keeps exact translated-residual and rational-square admission unchanged. For the bounded normal/subnormal boundary it reconstructs the represented gap in exact minimum-subnormal units from the binary64 significand/exponent, applies the proven integer numerator and denominator with checked `u128`, and rounds once with round-to-nearest, ties-to-even. Values above that boundary retain the existing overflow-safe represented sum-over-count path; mathematically nonzero results below one minimum-subnormal unit return `InvalidInput`. CHANGELOG `900b2091d572c9a984e350d2795ec58bfdd3177c`; research/current #488 `022797f7ca823d7bebe5a68be869ae641f1ccc01`. Fresh exact-head hosted execution and qualifying independent review remain required. -GAP-103 remains inherited: RED `d793f7f9ada68d5976effa6539182ba7037bf8d0` + repair `0a4bfcd52defe8912afa8269576395803d451bb3` preserve the exact 3/6-of-9 reciprocal-integer case. GAP-102 preserves the exact 6/10-of-16 dyadic count case. GAP-101 preserves the exact two-observation identity `SE(mean)=|r1-r2|/2`; GAP-100 preserves the exact translated two-level singleton identity `SE(mean)=|level_gap|/n`; GAP-099 and GAP-098 retain their n=3 and dyadic-normalization repairs. GAP-104 does not widen the general n>2 correct-rounding claim. +GAP-104 remains inherited: RED `6dc8116c89fa44a7ff1d58a8f9a51c876993d33f` + repair `8f2803c874568877e20e4c0f267ec5ce613daa3d` preserve exact reduced rational-square count geometry such as `2/15`. GAP-103 preserves the exact `1/6` reciprocal-integer case; GAP-102 the exact `1/8` dyadic case; GAP-101 the exact two-observation identity `SE(mean)=|r1-r2|/2`; GAP-100 the exact translated two-level singleton identity `SE(mean)=|level_gap|/n`; GAP-099 and GAP-098 retain their n=3 and dyadic-normalization repairs. GAP-105 does not widen the general n>2 correct-rounding claim. ### #416 — Validation / Analysis Run consolidation @@ -101,7 +101,7 @@ GAP-103 remains inherited: RED `d793f7f9ada68d5976effa6539182ba7037bf8d0` + repa ## Gap register -GAP-001–GAP-044 retain their existing domain/release identities and closure lineage. They remain unchanged by the GAP-104 numerical repair; their authoritative source/test/ADR history remains in repository ancestry and the surviving landing vehicles listed above. The validation lineage from GAP-045 onward is restated here because #488 is its current single writer. +GAP-001–GAP-044 retain their existing domain/release identities and closure lineage. They remain unchanged by the GAP-105 numerical repair; their authoritative source/test/ADR history remains in repository ancestry and the surviving landing vehicles listed above. The validation lineage from GAP-045 onward is restated here because #488 is its current single writer. | ID | Gap | Maturity | Closure evidence | | --- | --- | --- | --- | @@ -149,66 +149,67 @@ GAP-001–GAP-044 retain their existing domain/release identities and closure li | GAP-042 | ratio-first logarithm inflated adjacent-float growth rate | `verification-pending` | RED `766ddc7a...` + `ln_1p` repair `16f21d9a...` | | GAP-043 | duplicate known-truth identities could silently reweight RMSE | `verification-pending` | RED `698f12f5...` + repair `2fae4cb2...` | | GAP-044 | known-truth RMSE alignment depended on row order | `verification-pending` | RED `8ad72ac9...` / `5fb93c40...` + repairs `2dd9537e...` / `025dce7f...`; #310 `c6680450...` | -| GAP-045 | mean signed bias could reject representable result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; inherited by #488 `c5cbf6f0...` | -| GAP-046 | bias SE could reject representable SEM because raw squared deviations overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; inherited by #488 `c5cbf6f0...` | -| GAP-047 | generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; inherited by #488 `c5cbf6f0...` | -| GAP-048 | mean signed bias could erase representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; inherited by #488 `c5cbf6f0...` | +| GAP-045 | mean signed bias could reject representable result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; inherited by #488 `022797f7...` | +| GAP-046 | bias SE could reject representable SEM because raw squared deviations overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; inherited by #488 `022797f7...` | +| GAP-047 | generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; inherited by #488 `022797f7...` | +| GAP-048 | mean signed bias could erase representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; inherited by #488 `022797f7...` | | GAP-049 | stable `Between` recovery could be aliased across occasion indices and reweight RMSE | `verification-pending` | RED `0a03041c...` + repair `ec2c1219...`; #310 `c6680450...` | -| GAP-050 | zero-multiplier SE-aware acceptance could erase nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; inherited by #488 `c5cbf6f0...` | -| GAP-051 | exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; inherited by #488 `c5cbf6f0...` | -| GAP-052 | all-covered Wilson lower endpoint could cancel positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; inherited by #488 `c5cbf6f0...` | -| GAP-053 | strict-interior Wilson lower endpoint could cancel positive value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; inherited by #488 `c5cbf6f0...` | -| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; inherited by #488 `c5cbf6f0...` | -| GAP-055 | strict-interior Wilson lower endpoint could accept nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; inherited by #488 `c5cbf6f0...` | -| GAP-056 | durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; inherited by #488 `c5cbf6f0...` | -| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; inherited by #488 `c5cbf6f0...` | -| GAP-058 | generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; inherited by #488 `c5cbf6f0...` | -| GAP-059 | Monte Carlo summary could materially misstate positive SE relative to `SD/sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; inherited by #488 `c5cbf6f0...` | -| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; inherited by #488 `c5cbf6f0...` | -| GAP-061 | generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; inherited by #488 `c5cbf6f0...` | -| GAP-062 | finite-tolerance matching could fail for deterministically outside pair | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; inherited by #488 `c5cbf6f0...` | -| GAP-063 | exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; inherited by #488 `c5cbf6f0...` | -| GAP-064 | positive point RMSE could carry SE above squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; inherited by #488 `c5cbf6f0...` | -| GAP-065 | positive Monte Carlo RMSE could carry impossible spread/SE | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; inherited by #488 `c5cbf6f0...` | -| GAP-066 | RMSE nearest-rank percentile could exceed nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; inherited by #488 `c5cbf6f0...` | -| GAP-067 | generic nearest-rank endpoint could be incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected repair `2798e4f9...`; causal repair `c7151b49...`; inherited by #488 `c5cbf6f0...` | -| GAP-068 | distinct generic percentile endpoints could jointly exceed squared-deviation budget | `verification-pending` | RED `c4a13826...` + repair `cb3f80a2...`; inherited by #488 `c5cbf6f0...` | -| GAP-069 | two-replication endpoints could exhaust sample while mean/SD remained impossible | `verification-pending` | RED `81bf0d9e...` + repair `d48f8fef...`; inherited by #488 `c5cbf6f0...` | -| GAP-070 | stored Wilson pair could not arise from one score interval | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...`; inherited by #488 `c5cbf6f0...` | -| GAP-071 | durable Wilson evidence lacked denominator/critical-value/sidedness provenance | `active-repair` | carrier/authority/v1/envelope lineage; inherited by #488 `c5cbf6f0...`; durable-consumer adoption remains | -| GAP-072 | exact all-covered Wilson evidence could retain impossible zero lower endpoint | `verification-pending` | RED `ce714f07...` + repair `72e9d954...`; inherited by #488 `c5cbf6f0...` | -| GAP-073 | durable Wilson count provenance could lose one uncovered observation above exact-integer range | `verification-pending` | RED `29d710a5...` + count/fixed-width/exact-ratio repair lineage; inherited by #488 `c5cbf6f0...` | -| GAP-074 | durable exact count could be pre-rounded before endpoint projection | `verification-pending` | RED `f89e2467...` + reciprocal-scale repair `73bbb5cf...`; inherited by #488 `c5cbf6f0...` | -| GAP-075 | inexact all-covered Wilson miss mass could round to exact one | `verification-pending` | RED `059ce70d...` + canonical repair `0f478392...`; inherited by #488 `c5cbf6f0...` | -| GAP-076 | exact all-covered count could absorb small positive `z²` and emit exact `1.0` | `verification-pending` | RED `e0c4ec81...` + repair `c9dcb9df...`; inherited by #488 `c5cbf6f0...` | -| GAP-077 | inexact partial denominator could shift exact-count Wilson endpoint by one ULP | `verification-pending` | RED `06e55653...` + TwoSum/FMA repair `6c084dbe...`; inherited by #488 `c5cbf6f0...` | -| GAP-078 | Wilson residual compensation could move quotient across wrong midpoint | `verification-pending` | RED `d076d344...` + midpoint repair `32314239...`; inherited by #488 `c5cbf6f0...` | -| GAP-079 | SE-aware acceptance could underflow finite positive `k*SE` to zero through scale-first arithmetic | `verification-pending` | RED `76067efc...` + direct-finite repair `4ffdf366...`; inherited by #488 `c5cbf6f0...` | -| GAP-080 | both-overflow SE-aware fallback could round strict rejection into equality | `verification-pending` | RED `a9a45714...` + exact significand/exponent repair `425e8963...`; inherited by #488 `c5cbf6f0...` | -| GAP-081 | finite multiplication could round strict SE-aware rejection into equality | `verification-pending` | RED `23c3262c...` + tie repair `6a2add48...`; inherited by #488 `c5cbf6f0...` | -| GAP-082 | finite subtraction could round strict rejection onto exact bound | `verification-pending` | RED `58cbc032...` + low-term repair `68a6fd98...`; inherited by #488 `c5cbf6f0...` | -| GAP-083 | SE-aware product correction could fall below binary64 resolution | `verification-pending` | RED `b55c5473...` / `c77ac440...` + corrected repair `772ad8ed...`; inherited by #488 `c5cbf6f0...` | -| GAP-084 | legacy Wilson boundary could contradict peer endpoint root | `verification-pending` | RED `c9d612f2...` + peer-root repair `88512417...`; inherited by #488 `c5cbf6f0...` | -| GAP-085 | equal nonzero subtraction/FMA correction projections could conceal exact ordering | `verification-pending` | RED `35ea85ba...` + exact product-roundoff repair `7d597a18...`; inherited by #488 `c5cbf6f0...` | -| GAP-086 | mean bias could reject representable result because individual residuals overflow | `verification-pending` | RED `04e6e745...` + explicit-denominator cancellation/bias repair lineage; inherited by #488 `c5cbf6f0...` | -| GAP-087 | mixed-sign mean bias could discard repeated sub-ULP opposing mass | `verification-pending` | RED `63913727...` + low-term repair `5697cca5...`; inherited by #488 `c5cbf6f0...` | -| GAP-088 | mixed-remainder compensation could round before scientific count division | `verification-pending` | RED `8b4d19d1...` + compensated-division repair `7a33212b...`; inherited by #488 `c5cbf6f0...` | -| GAP-089 | exact cancellation could leave same-sign remainder rounded before division | `verification-pending` | RED `84476aad...` + repair `5f0d40b8...`; inherited by #488 `c5cbf6f0...` | -| GAP-090 | same-sign all-subnormal mean normalization could double-round final bias | `verification-pending` | RED `91abdb49...` + exact-unit repair `1c0df8a7...` + halfway coverage; inherited by #488 `c5cbf6f0...` | -| GAP-091 | pairwise subtraction roundoff could move mean bias across final midpoint | `verification-pending` | RED `a9d9bda3...` + corrected tail/midpoint repair `676ccda0...`; inherited by #488 `c5cbf6f0...` | -| GAP-092 | two distinct represented residuals could collapse to one subtraction and false-zero bias SE | `verification-pending` | RED `c9c55ea5...` + n=2 expanded-difference repair `f6d7da96...`; inherited by #488 `c5cbf6f0...` | -| GAP-093 | n>2 distinct represented residuals could collapse to one rounded high and false-zero bias SE | `verification-pending` | RED `06a70e1c...` + common-high/error-free-low repair `04c62514...`; inherited by #488 `c5cbf6f0...` | -| GAP-094 | separately rounded square roots could shift bias SE by one ULP | `verification-pending` | corrected RED `62243204...` + direct normalized-SE repair `8b8f0a21...`; inherited by #488 `c5cbf6f0...` | -| GAP-095 | distinct rounded residual highs could materially overstate uncertainty after subtraction roundoff | `verification-pending` | RED `ae906ad6...` + exact translated-residual repair `d59b9c30...`; inherited by #488 `c5cbf6f0...` | -| GAP-096 | exact residuals could be re-centered on rounded mean and distort dispersion | `verification-pending` | RED `9265b34a...` + exact-residual translated repair `2fa266b2...`; inherited by #488 `c5cbf6f0...` | -| GAP-097 | common-high subtraction path could round low-term mean before centering | `verification-pending` | RED `d48e2515...` + exact low-term translated-second-moment repair `a63b8d7a...`; inherited by #488 `c5cbf6f0...` | -| GAP-098 | exact translated-residual bias SE could double-round through a non-power normalization scale and move the final represented result by one ULP | `verification-pending` | RED `426fc5af...` + shared dyadic-scale prerequisite `d8b411f5...` + causal repair `d536e3b1...` + CHANGELOG `ebce979f...`; inherited by #488 `c5cbf6f0...` | +| GAP-050 | zero-multiplier SE-aware acceptance could erase nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; inherited by #488 `022797f7...` | +| GAP-051 | exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; inherited by #488 `022797f7...` | +| GAP-052 | all-covered Wilson lower endpoint could cancel positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; inherited by #488 `022797f7...` | +| GAP-053 | strict-interior Wilson lower endpoint could cancel positive value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; inherited by #488 `022797f7...` | +| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; inherited by #488 `022797f7...` | +| GAP-055 | strict-interior Wilson lower endpoint could accept nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; inherited by #488 `022797f7...` | +| GAP-056 | durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; inherited by #488 `022797f7...` | +| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; inherited by #488 `022797f7...` | +| GAP-058 | generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; inherited by #488 `022797f7...` | +| GAP-059 | Monte Carlo summary could materially misstate positive SE relative to `SD/sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; inherited by #488 `022797f7...` | +| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; inherited by #488 `022797f7...` | +| GAP-061 | generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; inherited by #488 `022797f7...` | +| GAP-062 | finite-tolerance matching could fail for deterministically outside pair | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; inherited by #488 `022797f7...` | +| GAP-063 | exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; inherited by #488 `022797f7...` | +| GAP-064 | positive point RMSE could carry SE above squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; inherited by #488 `022797f7...` | +| GAP-065 | positive Monte Carlo RMSE could carry impossible spread/SE | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; inherited by #488 `022797f7...` | +| GAP-066 | RMSE nearest-rank percentile could exceed nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; inherited by #488 `022797f7...` | +| GAP-067 | generic nearest-rank endpoint could be incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected repair `2798e4f9...`; causal repair `c7151b49...`; inherited by #488 `022797f7...` | +| GAP-068 | distinct generic percentile endpoints could jointly exceed squared-deviation budget | `verification-pending` | RED `c4a13826...` + repair `cb3f80a2...`; inherited by #488 `022797f7...` | +| GAP-069 | two-replication endpoints could exhaust sample while mean/SD remained impossible | `verification-pending` | RED `81bf0d9e...` + repair `d48f8fef...`; inherited by #488 `022797f7...` | +| GAP-070 | stored Wilson pair could not arise from one score interval | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...`; inherited by #488 `022797f7...` | +| GAP-071 | durable Wilson evidence lacked denominator/critical-value/sidedness provenance | `active-repair` | carrier/authority/v1/envelope lineage; inherited by #488 `022797f7...`; durable-consumer adoption remains | +| GAP-072 | exact all-covered Wilson evidence could retain impossible zero lower endpoint | `verification-pending` | RED `ce714f07...` + repair `72e9d954...`; inherited by #488 `022797f7...` | +| GAP-073 | durable Wilson count provenance could lose one uncovered observation above exact-integer range | `verification-pending` | RED `29d710a5...` + count/fixed-width/exact-ratio repair lineage; inherited by #488 `022797f7...` | +| GAP-074 | durable exact count could be pre-rounded before endpoint projection | `verification-pending` | RED `f89e2467...` + reciprocal-scale repair `73bbb5cf...`; inherited by #488 `022797f7...` | +| GAP-075 | inexact all-covered Wilson miss mass could round to exact one | `verification-pending` | RED `059ce70d...` + canonical repair `0f478392...`; inherited by #488 `022797f7...` | +| GAP-076 | exact all-covered count could absorb small positive `z²` and emit exact `1.0` | `verification-pending` | RED `e0c4ec81...` + repair `c9dcb9df...`; inherited by #488 `022797f7...` | +| GAP-077 | inexact partial denominator could shift exact-count Wilson endpoint by one ULP | `verification-pending` | RED `06e55653...` + TwoSum/FMA repair `6c084dbe...`; inherited by #488 `022797f7...` | +| GAP-078 | Wilson residual compensation could move quotient across wrong midpoint | `verification-pending` | RED `d076d344...` + midpoint repair `32314239...`; inherited by #488 `022797f7...` | +| GAP-079 | SE-aware acceptance could underflow finite positive `k*SE` to zero through scale-first arithmetic | `verification-pending` | RED `76067efc...` + direct-finite repair `4ffdf366...`; inherited by #488 `022797f7...` | +| GAP-080 | both-overflow SE-aware fallback could round strict rejection into equality | `verification-pending` | RED `a9a45714...` + exact significand/exponent repair `425e8963...`; inherited by #488 `022797f7...` | +| GAP-081 | finite multiplication could round strict SE-aware rejection into equality | `verification-pending` | RED `23c3262c...` + tie repair `6a2add48...`; inherited by #488 `022797f7...` | +| GAP-082 | finite subtraction could round strict rejection onto exact bound | `verification-pending` | RED `58cbc032...` + low-term repair `68a6fd98...`; inherited by #488 `022797f7...` | +| GAP-083 | SE-aware product correction could fall below binary64 resolution | `verification-pending` | RED `b55c5473...` / `c77ac440...` + corrected repair `772ad8ed...`; inherited by #488 `022797f7...` | +| GAP-084 | legacy Wilson boundary could contradict peer endpoint root | `verification-pending` | RED `c9d612f2...` + peer-root repair `88512417...`; inherited by #488 `022797f7...` | +| GAP-085 | equal nonzero subtraction/FMA correction projections could conceal exact ordering | `verification-pending` | RED `35ea85ba...` + exact product-roundoff repair `7d597a18...`; inherited by #488 `022797f7...` | +| GAP-086 | mean bias could reject representable result because individual residuals overflow | `verification-pending` | RED `04e6e745...` + explicit-denominator cancellation/bias repair lineage; inherited by #488 `022797f7...` | +| GAP-087 | mixed-sign mean bias could discard repeated sub-ULP opposing mass | `verification-pending` | RED `63913727...` + low-term repair `5697cca5...`; inherited by #488 `022797f7...` | +| GAP-088 | mixed-remainder compensation could round before scientific count division | `verification-pending` | RED `8b4d19d1...` + compensated-division repair `7a33212b...`; inherited by #488 `022797f7...` | +| GAP-089 | exact cancellation could leave same-sign remainder rounded before division | `verification-pending` | RED `84476aad...` + repair `5f0d40b8...`; inherited by #488 `022797f7...` | +| GAP-090 | same-sign all-subnormal mean normalization could double-round final bias | `verification-pending` | RED `91abdb49...` + exact-unit repair `1c0df8a7...` + halfway coverage; inherited by #488 `022797f7...` | +| GAP-091 | pairwise subtraction roundoff could move mean bias across final midpoint | `verification-pending` | RED `a9d9bda3...` + corrected tail/midpoint repair `676ccda0...`; inherited by #488 `022797f7...` | +| GAP-092 | two distinct represented residuals could collapse to one subtraction and false-zero bias SE | `verification-pending` | RED `c9c55ea5...` + n=2 expanded-difference repair `f6d7da96...`; inherited by #488 `022797f7...` | +| GAP-093 | n>2 distinct represented residuals could collapse to one rounded high and false-zero bias SE | `verification-pending` | RED `06a70e1c...` + common-high/error-free-low repair `04c62514...`; inherited by #488 `022797f7...` | +| GAP-094 | separately rounded square roots could shift bias SE by one ULP | `verification-pending` | corrected RED `62243204...` + direct normalized-SE repair `8b8f0a21...`; inherited by #488 `022797f7...` | +| GAP-095 | distinct rounded residual highs could materially overstate uncertainty after subtraction roundoff | `verification-pending` | RED `ae906ad6...` + exact translated-residual repair `d59b9c30...`; inherited by #488 `022797f7...` | +| GAP-096 | exact residuals could be re-centered on rounded mean and distort dispersion | `verification-pending` | RED `9265b34a...` + exact-residual translated repair `2fa266b2...`; inherited by #488 `022797f7...` | +| GAP-097 | common-high subtraction path could round low-term mean before centering | `verification-pending` | RED `d48e2515...` + exact low-term translated-second-moment repair `a63b8d7a...`; inherited by #488 `022797f7...` | +| GAP-098 | exact translated-residual bias SE could double-round through a non-power normalization scale and move the final represented result by one ULP | `verification-pending` | RED `426fc5af...` + shared dyadic-scale prerequisite `d8b411f5...` + causal repair `d536e3b1...` + CHANGELOG `ebce979f...`; inherited by #488 `022797f7...` | | GAP-099 | exact translated three-observation two-level bias SE could re-round an exact gap through square/second-moment/square-root and move the represented result by one ULP | `verification-pending` | RED `fbcdb7fa...` + causal repair `e0f2445d...` + CHANGELOG `ee81953e...` + research/ancestor #488 `7741aaa...`; exact-head hosted GREEN/review/main integration remain pending | | GAP-100 | exact translated two-level bias SE with one singleton could re-round an exact gap through square/second-moment/square-root beyond the n=3 case | `verification-pending` | RED `4386d9ac...` + causal repair `79ad03fa...` + edge `7fe4117c...` + CHANGELOG `017ad11...` + research/ancestor #488 `944fac05...`; exact-head hosted GREEN/review/main integration remain pending | | GAP-101 | exact two-observation residuals could be re-centered on a rounded midpoint mean and materially distort `SE(mean)` despite exact pairwise subtraction | `verification-pending` | RED `d3dcd918...` + causal repair `02b0a178...` + CHANGELOG `5603b12d...` + research/ancestor #488 `905addcc...`; exact-head hosted GREEN/review/main integration remain pending | | GAP-102 | exact translated non-singleton two-level bias SE could re-round a dyadic count identity through translated sums/squares/square-root | `verification-pending` | RED `3bc43da2...` + causal repair `77ba1002...` + CHANGELOG `f165914e...` + research/ancestor #488 `9d7bb5c2...`; exact-head hosted GREEN/review/main integration remain pending | | GAP-103 | exact translated non-singleton two-level bias SE with a reciprocal-integer but non-power-of-two count factor could be re-rounded through translated moments | `verification-pending` | RED `d793f7f9...` + causal repair `0a4bfcd5...` + CHANGELOG `9651dfd1...` + research/ancestor #488 `11b8fd54...`; exact-head hosted GREEN/review/main integration remain pending | -| GAP-104 | exact translated non-singleton two-level bias SE with a non-unit rational-square count factor could be re-rounded through translated moments | `verification-pending` | RED `6dc8116c...` + causal repair `8f2803c8...` + CHANGELOG `f0bb7af9...` + research/current #488 `c5cbf6f0...`; exact-head hosted GREEN/review/main integration remain pending | +| GAP-104 | exact translated non-singleton two-level bias SE with a non-unit rational-square count factor could be re-rounded through translated moments | `verification-pending` | RED `6dc8116c...` + causal repair `8f2803c8...` + CHANGELOG `f0bb7af9...` + research/ancestor #488 `c5cbf6f0...`; exact-head hosted GREEN/review/main integration remain pending | +| GAP-105 | exact rational-square two-level bias SE could double-round when normal rational scaling restored into the subnormal result range | `verification-pending` | RED `8b7995d2...` + causal repair `ab0f0df1...` + CHANGELOG `900b2091...` + research/current #488 `022797f7...`; exact-head hosted GREEN/review/main integration remain pending | ## Release gate From a3628320e9c03e06a9db355db3235109f3c15641 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 5 Sep 2026 15:22:06 +0900 Subject: [PATCH 199/235] docs(ddd): synchronize GAP-105 boundary evidence --- docs/product-technical-gap-baseline.md | 116 ++++++++++++------------- 1 file changed, 58 insertions(+), 58 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 7e1e9d8d1..39b48b610 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-05T06:09:19Z +**Snapshot:** 2026-09-05T06:19:21Z **Protected-main evidence:** `a243f18da4a4ca8a8d068c39922537f1f8ed6ad0` **Workspace version:** `0.2.0` @@ -30,7 +30,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `022797f7ca823d7bebe5a68be869ae641f1ccc01` | true | `main` | Validation Evidence landing vehicle, based on protected #490. GAP-105 proves that GAP-104's exact rational-square count identity could still double-round when normalized rational scaling restored a normal gap into a subnormal final `SE(mean)`. The bounded repair rounds exact minimum-subnormal units once when that boundary applies, while normal results retain the existing overflow-safe represented sum-over-count path. GAP-104 and earlier represented-input bias-SE, Wilson, provenance, Monte Carlo, RMSE/SE, matching, serde/projection repairs remain inherited. Hosted exact-head gates and independent review remain required. | +| #488 | `edb84949cda68749025b1c0b3ae66ba24acc000c` | true | `main` | Validation Evidence landing vehicle, based on protected #490. GAP-105 proves that GAP-104's exact rational-square count identity could still double-round when normalized rational scaling restored a normal gap into a subnormal final `SE(mean)`. The bounded repair rounds exact minimum-subnormal units once when that boundary applies; public boundary tests fix both midpoint directions, minimum-normal transition, permutation/sign mirror and false-zero refusal, while private branch tests exercise bounded helper admission/fallback. GAP-104 and earlier represented-input bias-SE, Wilson, provenance, Monte Carlo, RMSE/SE, matching, serde/projection repairs remain inherited. Hosted exact-head gates and independent review remain required. | | #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 | Validation / Analysis Run fold child. Unique evidence must be inherited by a conflict-resolving survivor; child-head CI does not transfer. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | @@ -83,11 +83,11 @@ The clock contract separates event/valid time, assertion time, document time, sy ### #488 — Validation Evidence -#488 is the generic Validation Evidence landing vehicle at exact head `022797f7ca823d7bebe5a68be869ae641f1ccc01`, based on protected #490. GAP-092–104 remain inherited and executable. +#488 is the generic Validation Evidence landing vehicle at exact head `edb84949cda68749025b1c0b3ae66ba24acc000c`, based on protected #490. GAP-092–104 remain inherited and executable. GAP-105 RED `8b7995d2320cf256b3a38991ae1f8a230ca00146` adds an exactly translated two-level sample with `n=33`, six residuals at `0`, and 27 at `g=f64::from_bits(0x004a_2c74_6ac3_028e)`. Here `6*27/(33^2*32)=9/1936=(3/44)^2`, so the exact represented-input result is `3*|g|/44`, correctly rounded to bits `0x000e_46cb_22f6_0165`. GAP-104 already admits the exact rational-square geometry, but its normalized represented sum-over-count path restores the quotient across the normal/subnormal boundary and returns adjacent lower bits `0x000e_46cb_22f6_0164`. Permutation and sign mirror preserve the same dispersion; a minimum-subnormal gap with the same count scale is mathematically nonzero but below binary64 and therefore remains fail closed. -Causal repair `ab0f0df1b8f36647f67239a5c628daed9023210e` keeps exact translated-residual and rational-square admission unchanged. For the bounded normal/subnormal boundary it reconstructs the represented gap in exact minimum-subnormal units from the binary64 significand/exponent, applies the proven integer numerator and denominator with checked `u128`, and rounds once with round-to-nearest, ties-to-even. Values above that boundary retain the existing overflow-safe represented sum-over-count path; mathematically nonzero results below one minimum-subnormal unit return `InvalidInput`. CHANGELOG `900b2091d572c9a984e350d2795ec58bfdd3177c`; research/current #488 `022797f7ca823d7bebe5a68be869ae641f1ccc01`. Fresh exact-head hosted execution and qualifying independent review remain required. +Causal repair `ab0f0df1b8f36647f67239a5c628daed9023210e` keeps exact translated-residual and rational-square admission unchanged. At the bounded normal/subnormal boundary it reconstructs the represented gap in exact minimum-subnormal units from the binary64 significand/exponent, applies the proven integer numerator and denominator, and rounds once with round-to-nearest, ties-to-even. Values above that boundary retain the existing overflow-safe represented sum-over-count path; mathematically nonzero results below one minimum-subnormal unit return `InvalidInput`. Public boundary coverage `4daeb65daee98b25fdc5a29744a710752e229a50` fixes both midpoint directions, the minimum-normal transition, permutation/sign mirror and false-zero refusal; source/branch-coverage hardening `8f6916dda1bc241e6bfd5dab0840e621769f995b` exercises private admission/fallback branches. CHANGELOG `900b2091d572c9a984e350d2795ec58bfdd3177c`; research/current #488 `edb84949cda68749025b1c0b3ae66ba24acc000c`. Fresh exact-head hosted execution and qualifying independent review remain required. GAP-104 remains inherited: RED `6dc8116c89fa44a7ff1d58a8f9a51c876993d33f` + repair `8f2803c874568877e20e4c0f267ec5ce613daa3d` preserve exact reduced rational-square count geometry such as `2/15`. GAP-103 preserves the exact `1/6` reciprocal-integer case; GAP-102 the exact `1/8` dyadic case; GAP-101 the exact two-observation identity `SE(mean)=|r1-r2|/2`; GAP-100 the exact translated two-level singleton identity `SE(mean)=|level_gap|/n`; GAP-099 and GAP-098 retain their n=3 and dyadic-normalization repairs. GAP-105 does not widen the general n>2 correct-rounding claim. @@ -149,67 +149,67 @@ GAP-001–GAP-044 retain their existing domain/release identities and closure li | GAP-042 | ratio-first logarithm inflated adjacent-float growth rate | `verification-pending` | RED `766ddc7a...` + `ln_1p` repair `16f21d9a...` | | GAP-043 | duplicate known-truth identities could silently reweight RMSE | `verification-pending` | RED `698f12f5...` + repair `2fae4cb2...` | | GAP-044 | known-truth RMSE alignment depended on row order | `verification-pending` | RED `8ad72ac9...` / `5fb93c40...` + repairs `2dd9537e...` / `025dce7f...`; #310 `c6680450...` | -| GAP-045 | mean signed bias could reject representable result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; inherited by #488 `022797f7...` | -| GAP-046 | bias SE could reject representable SEM because raw squared deviations overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; inherited by #488 `022797f7...` | -| GAP-047 | generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; inherited by #488 `022797f7...` | -| GAP-048 | mean signed bias could erase representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; inherited by #488 `022797f7...` | +| GAP-045 | mean signed bias could reject representable result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; inherited by #488 `edb84949...` | +| GAP-046 | bias SE could reject representable SEM because raw squared deviations overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; inherited by #488 `edb84949...` | +| GAP-047 | generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; inherited by #488 `edb84949...` | +| GAP-048 | mean signed bias could erase representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; inherited by #488 `edb84949...` | | GAP-049 | stable `Between` recovery could be aliased across occasion indices and reweight RMSE | `verification-pending` | RED `0a03041c...` + repair `ec2c1219...`; #310 `c6680450...` | -| GAP-050 | zero-multiplier SE-aware acceptance could erase nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; inherited by #488 `022797f7...` | -| GAP-051 | exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; inherited by #488 `022797f7...` | -| GAP-052 | all-covered Wilson lower endpoint could cancel positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; inherited by #488 `022797f7...` | -| GAP-053 | strict-interior Wilson lower endpoint could cancel positive value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; inherited by #488 `022797f7...` | -| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; inherited by #488 `022797f7...` | -| GAP-055 | strict-interior Wilson lower endpoint could accept nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; inherited by #488 `022797f7...` | -| GAP-056 | durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; inherited by #488 `022797f7...` | -| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; inherited by #488 `022797f7...` | -| GAP-058 | generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; inherited by #488 `022797f7...` | -| GAP-059 | Monte Carlo summary could materially misstate positive SE relative to `SD/sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; inherited by #488 `022797f7...` | -| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; inherited by #488 `022797f7...` | -| GAP-061 | generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; inherited by #488 `022797f7...` | -| GAP-062 | finite-tolerance matching could fail for deterministically outside pair | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; inherited by #488 `022797f7...` | -| GAP-063 | exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; inherited by #488 `022797f7...` | -| GAP-064 | positive point RMSE could carry SE above squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; inherited by #488 `022797f7...` | -| GAP-065 | positive Monte Carlo RMSE could carry impossible spread/SE | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; inherited by #488 `022797f7...` | -| GAP-066 | RMSE nearest-rank percentile could exceed nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; inherited by #488 `022797f7...` | -| GAP-067 | generic nearest-rank endpoint could be incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected repair `2798e4f9...`; causal repair `c7151b49...`; inherited by #488 `022797f7...` | -| GAP-068 | distinct generic percentile endpoints could jointly exceed squared-deviation budget | `verification-pending` | RED `c4a13826...` + repair `cb3f80a2...`; inherited by #488 `022797f7...` | -| GAP-069 | two-replication endpoints could exhaust sample while mean/SD remained impossible | `verification-pending` | RED `81bf0d9e...` + repair `d48f8fef...`; inherited by #488 `022797f7...` | -| GAP-070 | stored Wilson pair could not arise from one score interval | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...`; inherited by #488 `022797f7...` | -| GAP-071 | durable Wilson evidence lacked denominator/critical-value/sidedness provenance | `active-repair` | carrier/authority/v1/envelope lineage; inherited by #488 `022797f7...`; durable-consumer adoption remains | -| GAP-072 | exact all-covered Wilson evidence could retain impossible zero lower endpoint | `verification-pending` | RED `ce714f07...` + repair `72e9d954...`; inherited by #488 `022797f7...` | -| GAP-073 | durable Wilson count provenance could lose one uncovered observation above exact-integer range | `verification-pending` | RED `29d710a5...` + count/fixed-width/exact-ratio repair lineage; inherited by #488 `022797f7...` | -| GAP-074 | durable exact count could be pre-rounded before endpoint projection | `verification-pending` | RED `f89e2467...` + reciprocal-scale repair `73bbb5cf...`; inherited by #488 `022797f7...` | -| GAP-075 | inexact all-covered Wilson miss mass could round to exact one | `verification-pending` | RED `059ce70d...` + canonical repair `0f478392...`; inherited by #488 `022797f7...` | -| GAP-076 | exact all-covered count could absorb small positive `z²` and emit exact `1.0` | `verification-pending` | RED `e0c4ec81...` + repair `c9dcb9df...`; inherited by #488 `022797f7...` | -| GAP-077 | inexact partial denominator could shift exact-count Wilson endpoint by one ULP | `verification-pending` | RED `06e55653...` + TwoSum/FMA repair `6c084dbe...`; inherited by #488 `022797f7...` | -| GAP-078 | Wilson residual compensation could move quotient across wrong midpoint | `verification-pending` | RED `d076d344...` + midpoint repair `32314239...`; inherited by #488 `022797f7...` | -| GAP-079 | SE-aware acceptance could underflow finite positive `k*SE` to zero through scale-first arithmetic | `verification-pending` | RED `76067efc...` + direct-finite repair `4ffdf366...`; inherited by #488 `022797f7...` | -| GAP-080 | both-overflow SE-aware fallback could round strict rejection into equality | `verification-pending` | RED `a9a45714...` + exact significand/exponent repair `425e8963...`; inherited by #488 `022797f7...` | -| GAP-081 | finite multiplication could round strict SE-aware rejection into equality | `verification-pending` | RED `23c3262c...` + tie repair `6a2add48...`; inherited by #488 `022797f7...` | -| GAP-082 | finite subtraction could round strict rejection onto exact bound | `verification-pending` | RED `58cbc032...` + low-term repair `68a6fd98...`; inherited by #488 `022797f7...` | -| GAP-083 | SE-aware product correction could fall below binary64 resolution | `verification-pending` | RED `b55c5473...` / `c77ac440...` + corrected repair `772ad8ed...`; inherited by #488 `022797f7...` | -| GAP-084 | legacy Wilson boundary could contradict peer endpoint root | `verification-pending` | RED `c9d612f2...` + peer-root repair `88512417...`; inherited by #488 `022797f7...` | -| GAP-085 | equal nonzero subtraction/FMA correction projections could conceal exact ordering | `verification-pending` | RED `35ea85ba...` + exact product-roundoff repair `7d597a18...`; inherited by #488 `022797f7...` | -| GAP-086 | mean bias could reject representable result because individual residuals overflow | `verification-pending` | RED `04e6e745...` + explicit-denominator cancellation/bias repair lineage; inherited by #488 `022797f7...` | -| GAP-087 | mixed-sign mean bias could discard repeated sub-ULP opposing mass | `verification-pending` | RED `63913727...` + low-term repair `5697cca5...`; inherited by #488 `022797f7...` | -| GAP-088 | mixed-remainder compensation could round before scientific count division | `verification-pending` | RED `8b4d19d1...` + compensated-division repair `7a33212b...`; inherited by #488 `022797f7...` | -| GAP-089 | exact cancellation could leave same-sign remainder rounded before division | `verification-pending` | RED `84476aad...` + repair `5f0d40b8...`; inherited by #488 `022797f7...` | -| GAP-090 | same-sign all-subnormal mean normalization could double-round final bias | `verification-pending` | RED `91abdb49...` + exact-unit repair `1c0df8a7...` + halfway coverage; inherited by #488 `022797f7...` | -| GAP-091 | pairwise subtraction roundoff could move mean bias across final midpoint | `verification-pending` | RED `a9d9bda3...` + corrected tail/midpoint repair `676ccda0...`; inherited by #488 `022797f7...` | -| GAP-092 | two distinct represented residuals could collapse to one subtraction and false-zero bias SE | `verification-pending` | RED `c9c55ea5...` + n=2 expanded-difference repair `f6d7da96...`; inherited by #488 `022797f7...` | -| GAP-093 | n>2 distinct represented residuals could collapse to one rounded high and false-zero bias SE | `verification-pending` | RED `06a70e1c...` + common-high/error-free-low repair `04c62514...`; inherited by #488 `022797f7...` | -| GAP-094 | separately rounded square roots could shift bias SE by one ULP | `verification-pending` | corrected RED `62243204...` + direct normalized-SE repair `8b8f0a21...`; inherited by #488 `022797f7...` | -| GAP-095 | distinct rounded residual highs could materially overstate uncertainty after subtraction roundoff | `verification-pending` | RED `ae906ad6...` + exact translated-residual repair `d59b9c30...`; inherited by #488 `022797f7...` | -| GAP-096 | exact residuals could be re-centered on rounded mean and distort dispersion | `verification-pending` | RED `9265b34a...` + exact-residual translated repair `2fa266b2...`; inherited by #488 `022797f7...` | -| GAP-097 | common-high subtraction path could round low-term mean before centering | `verification-pending` | RED `d48e2515...` + exact low-term translated-second-moment repair `a63b8d7a...`; inherited by #488 `022797f7...` | -| GAP-098 | exact translated-residual bias SE could double-round through a non-power normalization scale and move the final represented result by one ULP | `verification-pending` | RED `426fc5af...` + shared dyadic-scale prerequisite `d8b411f5...` + causal repair `d536e3b1...` + CHANGELOG `ebce979f...`; inherited by #488 `022797f7...` | +| GAP-050 | zero-multiplier SE-aware acceptance could erase nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; inherited by #488 `edb84949...` | +| GAP-051 | exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; inherited by #488 `edb84949...` | +| GAP-052 | all-covered Wilson lower endpoint could cancel positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; inherited by #488 `edb84949...` | +| GAP-053 | strict-interior Wilson lower endpoint could cancel positive value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; inherited by #488 `edb84949...` | +| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; inherited by #488 `edb84949...` | +| GAP-055 | strict-interior Wilson lower endpoint could accept nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; inherited by #488 `edb84949...` | +| GAP-056 | durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; inherited by #488 `edb84949...` | +| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; inherited by #488 `edb84949...` | +| GAP-058 | generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; inherited by #488 `edb84949...` | +| GAP-059 | Monte Carlo summary could materially misstate positive SE relative to `SD/sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; inherited by #488 `edb84949...` | +| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; inherited by #488 `edb84949...` | +| GAP-061 | generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; inherited by #488 `edb84949...` | +| GAP-062 | finite-tolerance matching could fail for deterministically outside pair | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; inherited by #488 `edb84949...` | +| GAP-063 | exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; inherited by #488 `edb84949...` | +| GAP-064 | positive point RMSE could carry SE above squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; inherited by #488 `edb84949...` | +| GAP-065 | positive Monte Carlo RMSE could carry impossible spread/SE | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; inherited by #488 `edb84949...` | +| GAP-066 | RMSE nearest-rank percentile could exceed nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; inherited by #488 `edb84949...` | +| GAP-067 | generic nearest-rank endpoint could be incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected repair `2798e4f9...`; causal repair `c7151b49...`; inherited by #488 `edb84949...` | +| GAP-068 | distinct generic percentile endpoints could jointly exceed squared-deviation budget | `verification-pending` | RED `c4a13826...` + repair `cb3f80a2...`; inherited by #488 `edb84949...` | +| GAP-069 | two-replication endpoints could exhaust sample while mean/SD remained impossible | `verification-pending` | RED `81bf0d9e...` + repair `d48f8fef...`; inherited by #488 `edb84949...` | +| GAP-070 | stored Wilson pair could not arise from one score interval | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...`; inherited by #488 `edb84949...` | +| GAP-071 | durable Wilson evidence lacked denominator/critical-value/sidedness provenance | `active-repair` | carrier/authority/v1/envelope lineage; inherited by #488 `edb84949...`; durable-consumer adoption remains | +| GAP-072 | exact all-covered Wilson evidence could retain impossible zero lower endpoint | `verification-pending` | RED `ce714f07...` + repair `72e9d954...`; inherited by #488 `edb84949...` | +| GAP-073 | durable Wilson count provenance could lose one uncovered observation above exact-integer range | `verification-pending` | RED `29d710a5...` + count/fixed-width/exact-ratio repair lineage; inherited by #488 `edb84949...` | +| GAP-074 | durable exact count could be pre-rounded before endpoint projection | `verification-pending` | RED `f89e2467...` + reciprocal-scale repair `73bbb5cf...`; inherited by #488 `edb84949...` | +| GAP-075 | inexact all-covered Wilson miss mass could round to exact one | `verification-pending` | RED `059ce70d...` + canonical repair `0f478392...`; inherited by #488 `edb84949...` | +| GAP-076 | exact all-covered count could absorb small positive `z²` and emit exact `1.0` | `verification-pending` | RED `e0c4ec81...` + repair `c9dcb9df...`; inherited by #488 `edb84949...` | +| GAP-077 | inexact partial denominator could shift exact-count Wilson endpoint by one ULP | `verification-pending` | RED `06e55653...` + TwoSum/FMA repair `6c084dbe...`; inherited by #488 `edb84949...` | +| GAP-078 | Wilson residual compensation could move quotient across wrong midpoint | `verification-pending` | RED `d076d344...` + midpoint repair `32314239...`; inherited by #488 `edb84949...` | +| GAP-079 | SE-aware acceptance could underflow finite positive `k*SE` to zero through scale-first arithmetic | `verification-pending` | RED `76067efc...` + direct-finite repair `4ffdf366...`; inherited by #488 `edb84949...` | +| GAP-080 | both-overflow SE-aware fallback could round strict rejection into equality | `verification-pending` | RED `a9a45714...` + exact significand/exponent repair `425e8963...`; inherited by #488 `edb84949...` | +| GAP-081 | finite multiplication could round strict SE-aware rejection into equality | `verification-pending` | RED `23c3262c...` + tie repair `6a2add48...`; inherited by #488 `edb84949...` | +| GAP-082 | finite subtraction could round strict rejection onto exact bound | `verification-pending` | RED `58cbc032...` + low-term repair `68a6fd98...`; inherited by #488 `edb84949...` | +| GAP-083 | SE-aware product correction could fall below binary64 resolution | `verification-pending` | RED `b55c5473...` / `c77ac440...` + corrected repair `772ad8ed...`; inherited by #488 `edb84949...` | +| GAP-084 | legacy Wilson boundary could contradict peer endpoint root | `verification-pending` | RED `c9d612f2...` + peer-root repair `88512417...`; inherited by #488 `edb84949...` | +| GAP-085 | equal nonzero subtraction/FMA correction projections could conceal exact ordering | `verification-pending` | RED `35ea85ba...` + exact product-roundoff repair `7d597a18...`; inherited by #488 `edb84949...` | +| GAP-086 | mean bias could reject representable result because individual residuals overflow | `verification-pending` | RED `04e6e745...` + explicit-denominator cancellation/bias repair lineage; inherited by #488 `edb84949...` | +| GAP-087 | mixed-sign mean bias could discard repeated sub-ULP opposing mass | `verification-pending` | RED `63913727...` + low-term repair `5697cca5...`; inherited by #488 `edb84949...` | +| GAP-088 | mixed-remainder compensation could round before scientific count division | `verification-pending` | RED `8b4d19d1...` + compensated-division repair `7a33212b...`; inherited by #488 `edb84949...` | +| GAP-089 | exact cancellation could leave same-sign remainder rounded before division | `verification-pending` | RED `84476aad...` + repair `5f0d40b8...`; inherited by #488 `edb84949...` | +| GAP-090 | same-sign all-subnormal mean normalization could double-round final bias | `verification-pending` | RED `91abdb49...` + exact-unit repair `1c0df8a7...` + halfway coverage; inherited by #488 `edb84949...` | +| GAP-091 | pairwise subtraction roundoff could move mean bias across final midpoint | `verification-pending` | RED `a9d9bda3...` + corrected tail/midpoint repair `676ccda0...`; inherited by #488 `edb84949...` | +| GAP-092 | two distinct represented residuals could collapse to one subtraction and false-zero bias SE | `verification-pending` | RED `c9c55ea5...` + n=2 expanded-difference repair `f6d7da96...`; inherited by #488 `edb84949...` | +| GAP-093 | n>2 distinct represented residuals could collapse to one rounded high and false-zero bias SE | `verification-pending` | RED `06a70e1c...` + common-high/error-free-low repair `04c62514...`; inherited by #488 `edb84949...` | +| GAP-094 | separately rounded square roots could shift bias SE by one ULP | `verification-pending` | corrected RED `62243204...` + direct normalized-SE repair `8b8f0a21...`; inherited by #488 `edb84949...` | +| GAP-095 | distinct rounded residual highs could materially overstate uncertainty after subtraction roundoff | `verification-pending` | RED `ae906ad6...` + exact translated-residual repair `d59b9c30...`; inherited by #488 `edb84949...` | +| GAP-096 | exact residuals could be re-centered on rounded mean and distort dispersion | `verification-pending` | RED `9265b34a...` + exact-residual translated repair `2fa266b2...`; inherited by #488 `edb84949...` | +| GAP-097 | common-high subtraction path could round low-term mean before centering | `verification-pending` | RED `d48e2515...` + exact low-term translated-second-moment repair `a63b8d7a...`; inherited by #488 `edb84949...` | +| GAP-098 | exact translated-residual bias SE could double-round through a non-power normalization scale and move the final represented result by one ULP | `verification-pending` | RED `426fc5af...` + shared dyadic-scale prerequisite `d8b411f5...` + causal repair `d536e3b1...` + CHANGELOG `ebce979f...`; inherited by #488 `edb84949...` | | GAP-099 | exact translated three-observation two-level bias SE could re-round an exact gap through square/second-moment/square-root and move the represented result by one ULP | `verification-pending` | RED `fbcdb7fa...` + causal repair `e0f2445d...` + CHANGELOG `ee81953e...` + research/ancestor #488 `7741aaa...`; exact-head hosted GREEN/review/main integration remain pending | | GAP-100 | exact translated two-level bias SE with one singleton could re-round an exact gap through square/second-moment/square-root beyond the n=3 case | `verification-pending` | RED `4386d9ac...` + causal repair `79ad03fa...` + edge `7fe4117c...` + CHANGELOG `017ad11...` + research/ancestor #488 `944fac05...`; exact-head hosted GREEN/review/main integration remain pending | | GAP-101 | exact two-observation residuals could be re-centered on a rounded midpoint mean and materially distort `SE(mean)` despite exact pairwise subtraction | `verification-pending` | RED `d3dcd918...` + causal repair `02b0a178...` + CHANGELOG `5603b12d...` + research/ancestor #488 `905addcc...`; exact-head hosted GREEN/review/main integration remain pending | | GAP-102 | exact translated non-singleton two-level bias SE could re-round a dyadic count identity through translated sums/squares/square-root | `verification-pending` | RED `3bc43da2...` + causal repair `77ba1002...` + CHANGELOG `f165914e...` + research/ancestor #488 `9d7bb5c2...`; exact-head hosted GREEN/review/main integration remain pending | | GAP-103 | exact translated non-singleton two-level bias SE with a reciprocal-integer but non-power-of-two count factor could be re-rounded through translated moments | `verification-pending` | RED `d793f7f9...` + causal repair `0a4bfcd5...` + CHANGELOG `9651dfd1...` + research/ancestor #488 `11b8fd54...`; exact-head hosted GREEN/review/main integration remain pending | | GAP-104 | exact translated non-singleton two-level bias SE with a non-unit rational-square count factor could be re-rounded through translated moments | `verification-pending` | RED `6dc8116c...` + causal repair `8f2803c8...` + CHANGELOG `f0bb7af9...` + research/ancestor #488 `c5cbf6f0...`; exact-head hosted GREEN/review/main integration remain pending | -| GAP-105 | exact rational-square two-level bias SE could double-round when normal rational scaling restored into the subnormal result range | `verification-pending` | RED `8b7995d2...` + causal repair `ab0f0df1...` + CHANGELOG `900b2091...` + research/current #488 `022797f7...`; exact-head hosted GREEN/review/main integration remain pending | +| GAP-105 | exact rational-square two-level bias SE could double-round when normal rational scaling restored into the subnormal result range | `verification-pending` | RED `8b7995d2...` + causal repair `ab0f0df1...` + public boundary `4daeb65d...` + branch coverage `8f6916dd...` + CHANGELOG `900b2091...` + research/current #488 `edb84949...`; exact-head hosted GREEN/review/main integration remain pending | ## Release gate From 570b04879a4f7d94ba07e6d1734acc3e816a3109 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 5 Sep 2026 15:36:57 +0900 Subject: [PATCH 200/235] docs(ddd): advance validation gap baseline through GAP-106 --- docs/product-technical-gap-baseline.md | 125 +++++++++++++------------ 1 file changed, 63 insertions(+), 62 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 39b48b610..caff40e2c 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-05T06:19:21Z +**Snapshot:** 2026-09-05T06:34:31Z **Protected-main evidence:** `a243f18da4a4ca8a8d068c39922537f1f8ed6ad0` **Workspace version:** `0.2.0` @@ -30,7 +30,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `edb84949cda68749025b1c0b3ae66ba24acc000c` | true | `main` | Validation Evidence landing vehicle, based on protected #490. GAP-105 proves that GAP-104's exact rational-square count identity could still double-round when normalized rational scaling restored a normal gap into a subnormal final `SE(mean)`. The bounded repair rounds exact minimum-subnormal units once when that boundary applies; public boundary tests fix both midpoint directions, minimum-normal transition, permutation/sign mirror and false-zero refusal, while private branch tests exercise bounded helper admission/fallback. GAP-104 and earlier represented-input bias-SE, Wilson, provenance, Monte Carlo, RMSE/SE, matching, serde/projection repairs remain inherited. Hosted exact-head gates and independent review remain required. | +| #488 | `229fdd6eaffad5adf8cc2964cb506c6dd1191611` | true | `main` | Validation Evidence landing vehicle, based on protected #490. GAP-106 proves that exact translated-residual admission was still observation-order dependent because `diffs[0]` was the sole anchor. A represented three-residual sample has a viable exact middle anchor but inexact extreme anchors; the predecessor therefore returned adjacent lower `SE(mean)` bits for low/high-first permutations. The bounded repair searches anchors in canonical represented `(high, low)` order and uses the first candidate whose high, low, and recombined deltas are all exact; if none exists, the predecessor fallback remains authoritative. GAP-105 and earlier represented-input bias-SE, Wilson, provenance, Monte Carlo, RMSE/SE, matching, serde/projection repairs remain inherited. Hosted exact-head gates and independent review remain required. | | #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 | Validation / Analysis Run fold child. Unique evidence must be inherited by a conflict-resolving survivor; child-head CI does not transfer. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | @@ -62,7 +62,7 @@ The clock contract separates event/valid time, assertion time, document time, sy - Row arrival order is not scientific evidence. Fixed admitted observations must produce bit-identical means/centered results under permutation wherever the contract claims deterministic CPU `f64` reference behavior. - Known-truth component recovery follows bounded-context identity: stable `Between` is unit-level and uses canonical `occasion_index = 0`; `Within` retains actual `(unit, occasion)` identity. Duplicate identities or stable-Between occasion aliases are not weights. - A representable final scientific estimand is not rejected solely because an avoidable intermediate binary64 operation overflows/underflows. False exact 0/1/non-finite endpoints, erased finite bounds, cancellation residues, and double-rounded endpoints are not accepted when a bounded equivalent operation preserves the represented estimand or decision. -- Mean signed bias and bias SE remain Validation Evidence performance measures over admitted recovery units. `mean_bias` uses the direct residual path only when every pairwise subtraction is finite and preserves represented low-order input mass; otherwise it uses the algebraically equivalent recovered-plus-negated-truth numerator, cancellation-safe exact-power-of-two scaling, and the original scientific denominator. `bias_standard_error` still requires each individual signed residual to be representable. For every two-observation sample, TEPP evaluates `SE(mean)=|r1-r2|/2` before a rounded residual mean can become authoritative; subtraction-roundoff cases use expanded represented inputs, while exact-subtraction cases use the represented residual difference through the cancellation/overflow-safe scientific denominator. For `n>2`, the exact translated-residual path is admitted only when anchor-relative high, low, and combined deltas are exactly representable. Translation-invariant dispersion is then evaluated before any rounded residual mean becomes authoritative. GAP-098 requires exact power-of-two normalization; GAP-099 established the exact `n=3` two-level identity; GAP-100 generalized singleton/repeated-level geometry; GAP-102 established a reciprocal-power-of-two count shortcut; GAP-103 widened that to reciprocal-integer-square factors; GAP-104 generalized it to any reduced count factor satisfying `m(n-m)/(n^2(n-1))=(a/b)^2` with checked integer roots. GAP-105 additionally requires an admitted exact rational scale whose final represented value is subnormal to be rounded once in exact minimum-subnormal units rather than through normalized quotient plus scale restoration. Results outside that bounded subnormal projection retain the existing overflow-safe represented sum-over-count path. Count factors that are not exact rational squares and general multi-level samples retain `sqrt(sum(d²)/(n(n-1)))`; samples that cannot prove exact translated deltas retain the bounded predecessor fallback. These are bounded repairs, not a claim of globally correctly rounded n>2 dispersion. Mathematically nonzero final results outside binary64 range fail closed. +- Mean signed bias and bias SE remain Validation Evidence performance measures over admitted recovery units. `mean_bias` uses the direct residual path only when every pairwise subtraction is finite and preserves represented low-order input mass; otherwise it uses the algebraically equivalent recovered-plus-negated-truth numerator, cancellation-safe exact-power-of-two scaling, and the original scientific denominator. `bias_standard_error` still requires each individual signed residual to be representable. For every two-observation sample, TEPP evaluates `SE(mean)=|r1-r2|/2` before a rounded residual mean can become authoritative; subtraction-roundoff cases use expanded represented inputs, while exact-subtraction cases use the represented residual difference through the cancellation/overflow-safe scientific denominator. For `n>2`, the exact translated-residual path is admitted only when anchor-relative high, low, and combined deltas are exactly representable. Candidate anchors are searched in canonical represented `(high, low)` order so an incidental first observation cannot make exact translated geometry available in one permutation and unavailable in another. Translation-invariant dispersion is then evaluated before any rounded residual mean becomes authoritative. GAP-098 requires exact power-of-two normalization; GAP-099 established the exact `n=3` two-level identity; GAP-100 generalized singleton/repeated-level geometry; GAP-102 established a reciprocal-power-of-two count shortcut; GAP-103 widened that to reciprocal-integer-square factors; GAP-104 generalized it to any reduced count factor satisfying `m(n-m)/(n^2(n-1))=(a/b)^2` with checked integer roots. GAP-105 additionally requires an admitted exact rational scale whose final represented value is subnormal to be rounded once in exact minimum-subnormal units rather than through normalized quotient plus scale restoration. GAP-106 requires exact-anchor admission itself to be permutation-invariant whenever at least one represented observation is a valid exact anchor. Results outside the bounded subnormal projection retain the existing overflow-safe represented sum-over-count path. Count factors that are not exact rational squares and general multi-level samples retain `sqrt(sum(d²)/(n(n-1)))`; samples for which no candidate anchor proves exact translated deltas retain the bounded predecessor fallback. These are bounded repairs, not a claim of globally correctly rounded n>2 dispersion. Mathematically nonzero final results outside binary64 range fail closed. - Generic Validation Evidence RMSE and its delta-method SE normalize before squaring. Exact-zero point RMSE requires exact-zero point RMSE SE. For positive RMSE, the declared producer satisfies `SE(RMSE) <= RMSE / 2`, with a small relative binary64 admission tolerance. - Generic `MonteCarloSummary` is sign-neutral. Zero SD requires zero SE and percentile endpoints equal to the represented mean. Positive SD requires positive SE coherent with represented `SD / sqrt(n)` within a small relative tolerance. Every inclusive nearest-rank endpoint is a retained observation and satisfies `|endpoint - mean| <= SD * sqrt(n - 1)`. Distinct lower/upper endpoint values share the same `(n - 1) * SD²` deviation budget. When `replication_count=2` and endpoints are distinct, those endpoints exhaust the retained sample and must reconstruct the represented mean/sample SD. - When the generic carrier occupies `ValidationReport::monte_carlo_rmse`, retained replications are nonnegative; positive mean implies `SE(mean) <= mean`, and inclusive nearest-rank endpoints cannot exceed nonnegative sample-sum support `n * mean`. These typed bounds are not imposed on signed metrics such as bias. @@ -83,13 +83,13 @@ The clock contract separates event/valid time, assertion time, document time, sy ### #488 — Validation Evidence -#488 is the generic Validation Evidence landing vehicle at exact head `edb84949cda68749025b1c0b3ae66ba24acc000c`, based on protected #490. GAP-092–104 remain inherited and executable. +#488 is the generic Validation Evidence landing vehicle at exact head `229fdd6eaffad5adf8cc2964cb506c6dd1191611`, based on protected #490. GAP-092–105 remain inherited and executable. -GAP-105 RED `8b7995d2320cf256b3a38991ae1f8a230ca00146` adds an exactly translated two-level sample with `n=33`, six residuals at `0`, and 27 at `g=f64::from_bits(0x004a_2c74_6ac3_028e)`. Here `6*27/(33^2*32)=9/1936=(3/44)^2`, so the exact represented-input result is `3*|g|/44`, correctly rounded to bits `0x000e_46cb_22f6_0165`. GAP-104 already admits the exact rational-square geometry, but its normalized represented sum-over-count path restores the quotient across the normal/subnormal boundary and returns adjacent lower bits `0x000e_46cb_22f6_0164`. Permutation and sign mirror preserve the same dispersion; a minimum-subnormal gap with the same count scale is mathematically nonzero but below binary64 and therefore remains fail closed. +GAP-106 RED `5cb45a4f204ab4fbcd5581c4d4504e82f0339a30` fixes a three-residual represented multiset with `low=0x4194_f788_9184_b980`, `middle=0x420c_409f_fce3_8390`, and `high=0x4222_70c4_634c_c6b6`. Its exact represented-input squared `SE(mean)` is `327877142843256291246417577647793 / 2473901162496`, whose correctly rounded binary64 square root is `0x4205_7185_8078_f946`. The predecessor used `diffs[0]` as the only translation anchor: middle-first admitted exact translated deltas and returned `...f946`, while low-first or high-first encountered mirrored `±2^-19` subtraction tails on the extreme delta, abandoned the translated path, and returned adjacent lower `...f945`. -Causal repair `ab0f0df1b8f36647f67239a5c628daed9023210e` keeps exact translated-residual and rational-square admission unchanged. At the bounded normal/subnormal boundary it reconstructs the represented gap in exact minimum-subnormal units from the binary64 significand/exponent, applies the proven integer numerator and denominator, and rounds once with round-to-nearest, ties-to-even. Values above that boundary retain the existing overflow-safe represented sum-over-count path; mathematically nonzero results below one minimum-subnormal unit return `InvalidInput`. Public boundary coverage `4daeb65daee98b25fdc5a29744a710752e229a50` fixes both midpoint directions, the minimum-normal transition, permutation/sign mirror and false-zero refusal; source/branch-coverage hardening `8f6916dda1bc241e6bfd5dab0840e621769f995b` exercises private admission/fallback branches. CHANGELOG `900b2091d572c9a984e350d2795ec58bfdd3177c`; research/current #488 `edb84949cda68749025b1c0b3ae66ba24acc000c`. Fresh exact-head hosted execution and qualifying independent review remain required. +Causal repair `159659a9510a7ced437ad872d02e26619abc8236` leaves all existing exactness tests intact but examines candidate anchors in canonical represented `(high, low)` `total_cmp` order. The first anchor for which every high delta, low delta, and recombined delta is finite and error-free supplies the translated vector; if no exact anchor exists, the predecessor rounded-residual fallback remains authoritative. Public permutations and sign mirrors are fixed in `bias_standard_error_anchor_permutation_contract.rs`. CHANGELOG `7e57b930daebb01b3583b4a5108ce3c1a89a06a6`; research/current #488 `229fdd6eaffad5adf8cc2964cb506c6dd1191611`. Fresh exact-head hosted execution and qualifying independent review remain required. -GAP-104 remains inherited: RED `6dc8116c89fa44a7ff1d58a8f9a51c876993d33f` + repair `8f2803c874568877e20e4c0f267ec5ce613daa3d` preserve exact reduced rational-square count geometry such as `2/15`. GAP-103 preserves the exact `1/6` reciprocal-integer case; GAP-102 the exact `1/8` dyadic case; GAP-101 the exact two-observation identity `SE(mean)=|r1-r2|/2`; GAP-100 the exact translated two-level singleton identity `SE(mean)=|level_gap|/n`; GAP-099 and GAP-098 retain their n=3 and dyadic-normalization repairs. GAP-105 does not widen the general n>2 correct-rounding claim. +GAP-105 remains inherited: RED `8b7995d2320cf256b3a38991ae1f8a230ca00146` + repair `ab0f0df1b8f36647f67239a5c628daed9023210e` preserve exact rational-square subnormal projection, with public boundary `4daeb65d...`, branch hardening `8f6916dd...`, and CHANGELOG `900b2091...`. GAP-104 preserves exact reduced rational-square count geometry such as `2/15`; GAP-103 the exact `1/6` reciprocal-integer case; GAP-102 the exact `1/8` dyadic case; GAP-101 the exact two-observation identity `SE(mean)=|r1-r2|/2`; GAP-100 the exact translated two-level singleton identity `SE(mean)=|level_gap|/n`; GAP-099 and GAP-098 retain their n=3 and dyadic-normalization repairs. GAP-106 does not widen the general n>2 correct-rounding claim or reclassify inexact deltas as exact. ### #416 — Validation / Analysis Run consolidation @@ -101,7 +101,7 @@ GAP-104 remains inherited: RED `6dc8116c89fa44a7ff1d58a8f9a51c876993d33f` + repa ## Gap register -GAP-001–GAP-044 retain their existing domain/release identities and closure lineage. They remain unchanged by the GAP-105 numerical repair; their authoritative source/test/ADR history remains in repository ancestry and the surviving landing vehicles listed above. The validation lineage from GAP-045 onward is restated here because #488 is its current single writer. +GAP-001–GAP-044 retain their existing domain/release identities and closure lineage. They remain unchanged by the GAP-106 numerical repair; their authoritative source/test/ADR history remains in repository ancestry and the surviving landing vehicles listed above. The validation lineage from GAP-045 onward is restated here because #488 is its current single writer. | ID | Gap | Maturity | Closure evidence | | --- | --- | --- | --- | @@ -149,67 +149,68 @@ GAP-001–GAP-044 retain their existing domain/release identities and closure li | GAP-042 | ratio-first logarithm inflated adjacent-float growth rate | `verification-pending` | RED `766ddc7a...` + `ln_1p` repair `16f21d9a...` | | GAP-043 | duplicate known-truth identities could silently reweight RMSE | `verification-pending` | RED `698f12f5...` + repair `2fae4cb2...` | | GAP-044 | known-truth RMSE alignment depended on row order | `verification-pending` | RED `8ad72ac9...` / `5fb93c40...` + repairs `2dd9537e...` / `025dce7f...`; #310 `c6680450...` | -| GAP-045 | mean signed bias could reject representable result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; inherited by #488 `edb84949...` | -| GAP-046 | bias SE could reject representable SEM because raw squared deviations overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; inherited by #488 `edb84949...` | -| GAP-047 | generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; inherited by #488 `edb84949...` | -| GAP-048 | mean signed bias could erase representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; inherited by #488 `edb84949...` | +| GAP-045 | mean signed bias could reject representable result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; inherited by #488 `229fdd6e...` | +| GAP-046 | bias SE could reject representable SEM because raw squared deviations overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; inherited by #488 `229fdd6e...` | +| GAP-047 | generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; inherited by #488 `229fdd6e...` | +| GAP-048 | mean signed bias could erase representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; inherited by #488 `229fdd6e...` | | GAP-049 | stable `Between` recovery could be aliased across occasion indices and reweight RMSE | `verification-pending` | RED `0a03041c...` + repair `ec2c1219...`; #310 `c6680450...` | -| GAP-050 | zero-multiplier SE-aware acceptance could erase nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; inherited by #488 `edb84949...` | -| GAP-051 | exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; inherited by #488 `edb84949...` | -| GAP-052 | all-covered Wilson lower endpoint could cancel positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; inherited by #488 `edb84949...` | -| GAP-053 | strict-interior Wilson lower endpoint could cancel positive value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; inherited by #488 `edb84949...` | -| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; inherited by #488 `edb84949...` | -| GAP-055 | strict-interior Wilson lower endpoint could accept nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; inherited by #488 `edb84949...` | -| GAP-056 | durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; inherited by #488 `edb84949...` | -| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; inherited by #488 `edb84949...` | -| GAP-058 | generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; inherited by #488 `edb84949...` | -| GAP-059 | Monte Carlo summary could materially misstate positive SE relative to `SD/sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; inherited by #488 `edb84949...` | -| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; inherited by #488 `edb84949...` | -| GAP-061 | generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; inherited by #488 `edb84949...` | -| GAP-062 | finite-tolerance matching could fail for deterministically outside pair | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; inherited by #488 `edb84949...` | -| GAP-063 | exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; inherited by #488 `edb84949...` | -| GAP-064 | positive point RMSE could carry SE above squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; inherited by #488 `edb84949...` | -| GAP-065 | positive Monte Carlo RMSE could carry impossible spread/SE | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; inherited by #488 `edb84949...` | -| GAP-066 | RMSE nearest-rank percentile could exceed nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; inherited by #488 `edb84949...` | -| GAP-067 | generic nearest-rank endpoint could be incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected repair `2798e4f9...`; causal repair `c7151b49...`; inherited by #488 `edb84949...` | -| GAP-068 | distinct generic percentile endpoints could jointly exceed squared-deviation budget | `verification-pending` | RED `c4a13826...` + repair `cb3f80a2...`; inherited by #488 `edb84949...` | -| GAP-069 | two-replication endpoints could exhaust sample while mean/SD remained impossible | `verification-pending` | RED `81bf0d9e...` + repair `d48f8fef...`; inherited by #488 `edb84949...` | -| GAP-070 | stored Wilson pair could not arise from one score interval | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...`; inherited by #488 `edb84949...` | -| GAP-071 | durable Wilson evidence lacked denominator/critical-value/sidedness provenance | `active-repair` | carrier/authority/v1/envelope lineage; inherited by #488 `edb84949...`; durable-consumer adoption remains | -| GAP-072 | exact all-covered Wilson evidence could retain impossible zero lower endpoint | `verification-pending` | RED `ce714f07...` + repair `72e9d954...`; inherited by #488 `edb84949...` | -| GAP-073 | durable Wilson count provenance could lose one uncovered observation above exact-integer range | `verification-pending` | RED `29d710a5...` + count/fixed-width/exact-ratio repair lineage; inherited by #488 `edb84949...` | -| GAP-074 | durable exact count could be pre-rounded before endpoint projection | `verification-pending` | RED `f89e2467...` + reciprocal-scale repair `73bbb5cf...`; inherited by #488 `edb84949...` | -| GAP-075 | inexact all-covered Wilson miss mass could round to exact one | `verification-pending` | RED `059ce70d...` + canonical repair `0f478392...`; inherited by #488 `edb84949...` | -| GAP-076 | exact all-covered count could absorb small positive `z²` and emit exact `1.0` | `verification-pending` | RED `e0c4ec81...` + repair `c9dcb9df...`; inherited by #488 `edb84949...` | -| GAP-077 | inexact partial denominator could shift exact-count Wilson endpoint by one ULP | `verification-pending` | RED `06e55653...` + TwoSum/FMA repair `6c084dbe...`; inherited by #488 `edb84949...` | -| GAP-078 | Wilson residual compensation could move quotient across wrong midpoint | `verification-pending` | RED `d076d344...` + midpoint repair `32314239...`; inherited by #488 `edb84949...` | -| GAP-079 | SE-aware acceptance could underflow finite positive `k*SE` to zero through scale-first arithmetic | `verification-pending` | RED `76067efc...` + direct-finite repair `4ffdf366...`; inherited by #488 `edb84949...` | -| GAP-080 | both-overflow SE-aware fallback could round strict rejection into equality | `verification-pending` | RED `a9a45714...` + exact significand/exponent repair `425e8963...`; inherited by #488 `edb84949...` | -| GAP-081 | finite multiplication could round strict SE-aware rejection into equality | `verification-pending` | RED `23c3262c...` + tie repair `6a2add48...`; inherited by #488 `edb84949...` | -| GAP-082 | finite subtraction could round strict rejection onto exact bound | `verification-pending` | RED `58cbc032...` + low-term repair `68a6fd98...`; inherited by #488 `edb84949...` | -| GAP-083 | SE-aware product correction could fall below binary64 resolution | `verification-pending` | RED `b55c5473...` / `c77ac440...` + corrected repair `772ad8ed...`; inherited by #488 `edb84949...` | -| GAP-084 | legacy Wilson boundary could contradict peer endpoint root | `verification-pending` | RED `c9d612f2...` + peer-root repair `88512417...`; inherited by #488 `edb84949...` | -| GAP-085 | equal nonzero subtraction/FMA correction projections could conceal exact ordering | `verification-pending` | RED `35ea85ba...` + exact product-roundoff repair `7d597a18...`; inherited by #488 `edb84949...` | -| GAP-086 | mean bias could reject representable result because individual residuals overflow | `verification-pending` | RED `04e6e745...` + explicit-denominator cancellation/bias repair lineage; inherited by #488 `edb84949...` | -| GAP-087 | mixed-sign mean bias could discard repeated sub-ULP opposing mass | `verification-pending` | RED `63913727...` + low-term repair `5697cca5...`; inherited by #488 `edb84949...` | -| GAP-088 | mixed-remainder compensation could round before scientific count division | `verification-pending` | RED `8b4d19d1...` + compensated-division repair `7a33212b...`; inherited by #488 `edb84949...` | -| GAP-089 | exact cancellation could leave same-sign remainder rounded before division | `verification-pending` | RED `84476aad...` + repair `5f0d40b8...`; inherited by #488 `edb84949...` | -| GAP-090 | same-sign all-subnormal mean normalization could double-round final bias | `verification-pending` | RED `91abdb49...` + exact-unit repair `1c0df8a7...` + halfway coverage; inherited by #488 `edb84949...` | -| GAP-091 | pairwise subtraction roundoff could move mean bias across final midpoint | `verification-pending` | RED `a9d9bda3...` + corrected tail/midpoint repair `676ccda0...`; inherited by #488 `edb84949...` | -| GAP-092 | two distinct represented residuals could collapse to one subtraction and false-zero bias SE | `verification-pending` | RED `c9c55ea5...` + n=2 expanded-difference repair `f6d7da96...`; inherited by #488 `edb84949...` | -| GAP-093 | n>2 distinct represented residuals could collapse to one rounded high and false-zero bias SE | `verification-pending` | RED `06a70e1c...` + common-high/error-free-low repair `04c62514...`; inherited by #488 `edb84949...` | -| GAP-094 | separately rounded square roots could shift bias SE by one ULP | `verification-pending` | corrected RED `62243204...` + direct normalized-SE repair `8b8f0a21...`; inherited by #488 `edb84949...` | -| GAP-095 | distinct rounded residual highs could materially overstate uncertainty after subtraction roundoff | `verification-pending` | RED `ae906ad6...` + exact translated-residual repair `d59b9c30...`; inherited by #488 `edb84949...` | -| GAP-096 | exact residuals could be re-centered on rounded mean and distort dispersion | `verification-pending` | RED `9265b34a...` + exact-residual translated repair `2fa266b2...`; inherited by #488 `edb84949...` | -| GAP-097 | common-high subtraction path could round low-term mean before centering | `verification-pending` | RED `d48e2515...` + exact low-term translated-second-moment repair `a63b8d7a...`; inherited by #488 `edb84949...` | -| GAP-098 | exact translated-residual bias SE could double-round through a non-power normalization scale and move the final represented result by one ULP | `verification-pending` | RED `426fc5af...` + shared dyadic-scale prerequisite `d8b411f5...` + causal repair `d536e3b1...` + CHANGELOG `ebce979f...`; inherited by #488 `edb84949...` | +| GAP-050 | zero-multiplier SE-aware acceptance could erase nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; inherited by #488 `229fdd6e...` | +| GAP-051 | exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; inherited by #488 `229fdd6e...` | +| GAP-052 | all-covered Wilson lower endpoint could cancel positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; inherited by #488 `229fdd6e...` | +| GAP-053 | strict-interior Wilson lower endpoint could cancel positive value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; inherited by #488 `229fdd6e...` | +| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; inherited by #488 `229fdd6e...` | +| GAP-055 | strict-interior Wilson lower endpoint could accept nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; inherited by #488 `229fdd6e...` | +| GAP-056 | durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; inherited by #488 `229fdd6e...` | +| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; inherited by #488 `229fdd6e...` | +| GAP-058 | generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; inherited by #488 `229fdd6e...` | +| GAP-059 | Monte Carlo summary could materially misstate positive SE relative to `SD/sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; inherited by #488 `229fdd6e...` | +| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; inherited by #488 `229fdd6e...` | +| GAP-061 | generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; inherited by #488 `229fdd6e...` | +| GAP-062 | finite-tolerance matching could fail for deterministically outside pair | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; inherited by #488 `229fdd6e...` | +| GAP-063 | exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; inherited by #488 `229fdd6e...` | +| GAP-064 | positive point RMSE could carry SE above squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; inherited by #488 `229fdd6e...` | +| GAP-065 | positive Monte Carlo RMSE could carry impossible spread/SE | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; inherited by #488 `229fdd6e...` | +| GAP-066 | RMSE nearest-rank percentile could exceed nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; inherited by #488 `229fdd6e...` | +| GAP-067 | generic nearest-rank endpoint could be incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected repair `2798e4f9...`; causal repair `c7151b49...`; inherited by #488 `229fdd6e...` | +| GAP-068 | distinct generic percentile endpoints could jointly exceed squared-deviation budget | `verification-pending` | RED `c4a13826...` + repair `cb3f80a2...`; inherited by #488 `229fdd6e...` | +| GAP-069 | two-replication endpoints could exhaust sample while mean/SD remained impossible | `verification-pending` | RED `81bf0d9e...` + repair `d48f8fef...`; inherited by #488 `229fdd6e...` | +| GAP-070 | stored Wilson pair could not arise from one score interval | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...`; inherited by #488 `229fdd6e...` | +| GAP-071 | durable Wilson evidence lacked denominator/critical-value/sidedness provenance | `active-repair` | carrier/authority/v1/envelope lineage; inherited by #488 `229fdd6e...`; durable-consumer adoption remains | +| GAP-072 | exact all-covered Wilson evidence could retain impossible zero lower endpoint | `verification-pending` | RED `ce714f07...` + repair `72e9d954...`; inherited by #488 `229fdd6e...` | +| GAP-073 | durable Wilson count provenance could lose one uncovered observation above exact-integer range | `verification-pending` | RED `29d710a5...` + count/fixed-width/exact-ratio repair lineage; inherited by #488 `229fdd6e...` | +| GAP-074 | durable exact count could be pre-rounded before endpoint projection | `verification-pending` | RED `f89e2467...` + reciprocal-scale repair `73bbb5cf...`; inherited by #488 `229fdd6e...` | +| GAP-075 | inexact all-covered Wilson miss mass could round to exact one | `verification-pending` | RED `059ce70d...` + canonical repair `0f478392...`; inherited by #488 `229fdd6e...` | +| GAP-076 | exact all-covered count could absorb small positive `z²` and emit exact `1.0` | `verification-pending` | RED `e0c4ec81...` + repair `c9dcb9df...`; inherited by #488 `229fdd6e...` | +| GAP-077 | inexact partial denominator could shift exact-count Wilson endpoint by one ULP | `verification-pending` | RED `06e55653...` + TwoSum/FMA repair `6c084dbe...`; inherited by #488 `229fdd6e...` | +| GAP-078 | Wilson residual compensation could move quotient across wrong midpoint | `verification-pending` | RED `d076d344...` + midpoint repair `32314239...`; inherited by #488 `229fdd6e...` | +| GAP-079 | SE-aware acceptance could underflow finite positive `k*SE` to zero through scale-first arithmetic | `verification-pending` | RED `76067efc...` + direct-finite repair `4ffdf366...`; inherited by #488 `229fdd6e...` | +| GAP-080 | both-overflow SE-aware fallback could round strict rejection into equality | `verification-pending` | RED `a9a45714...` + exact significand/exponent repair `425e8963...`; inherited by #488 `229fdd6e...` | +| GAP-081 | finite multiplication could round strict SE-aware rejection into equality | `verification-pending` | RED `23c3262c...` + tie repair `6a2add48...`; inherited by #488 `229fdd6e...` | +| GAP-082 | finite subtraction could round strict rejection onto exact bound | `verification-pending` | RED `58cbc032...` + low-term repair `68a6fd98...`; inherited by #488 `229fdd6e...` | +| GAP-083 | SE-aware product correction could fall below binary64 resolution | `verification-pending` | RED `b55c5473...` / `c77ac440...` + corrected repair `772ad8ed...`; inherited by #488 `229fdd6e...` | +| GAP-084 | legacy Wilson boundary could contradict peer endpoint root | `verification-pending` | RED `c9d612f2...` + peer-root repair `88512417...`; inherited by #488 `229fdd6e...` | +| GAP-085 | equal nonzero subtraction/FMA correction projections could conceal exact ordering | `verification-pending` | RED `35ea85ba...` + exact product-roundoff repair `7d597a18...`; inherited by #488 `229fdd6e...` | +| GAP-086 | mean bias could reject representable result because individual residuals overflow | `verification-pending` | RED `04e6e745...` + explicit-denominator cancellation/bias repair lineage; inherited by #488 `229fdd6e...` | +| GAP-087 | mixed-sign mean bias could discard repeated sub-ULP opposing mass | `verification-pending` | RED `63913727...` + low-term repair `5697cca5...`; inherited by #488 `229fdd6e...` | +| GAP-088 | mixed-remainder compensation could round before scientific count division | `verification-pending` | RED `8b4d19d1...` + compensated-division repair `7a33212b...`; inherited by #488 `229fdd6e...` | +| GAP-089 | exact cancellation could leave same-sign remainder rounded before division | `verification-pending` | RED `84476aad...` + repair `5f0d40b8...`; inherited by #488 `229fdd6e...` | +| GAP-090 | same-sign all-subnormal mean normalization could double-round final bias | `verification-pending` | RED `91abdb49...` + exact-unit repair `1c0df8a7...` + halfway coverage; inherited by #488 `229fdd6e...` | +| GAP-091 | pairwise subtraction roundoff could move mean bias across final midpoint | `verification-pending` | RED `a9d9bda3...` + corrected tail/midpoint repair `676ccda0...`; inherited by #488 `229fdd6e...` | +| GAP-092 | two distinct represented residuals could collapse to one subtraction and false-zero bias SE | `verification-pending` | RED `c9c55ea5...` + n=2 expanded-difference repair `f6d7da96...`; inherited by #488 `229fdd6e...` | +| GAP-093 | n>2 distinct represented residuals could collapse to one rounded high and false-zero bias SE | `verification-pending` | RED `06a70e1c...` + common-high/error-free-low repair `04c62514...`; inherited by #488 `229fdd6e...` | +| GAP-094 | separately rounded square roots could shift bias SE by one ULP | `verification-pending` | corrected RED `62243204...` + direct normalized-SE repair `8b8f0a21...`; inherited by #488 `229fdd6e...` | +| GAP-095 | distinct rounded residual highs could materially overstate uncertainty after subtraction roundoff | `verification-pending` | RED `ae906ad6...` + exact translated-residual repair `d59b9c30...`; inherited by #488 `229fdd6e...` | +| GAP-096 | exact residuals could be re-centered on rounded mean and distort dispersion | `verification-pending` | RED `9265b34a...` + exact-residual translated repair `2fa266b2...`; inherited by #488 `229fdd6e...` | +| GAP-097 | common-high subtraction path could round low-term mean before centering | `verification-pending` | RED `d48e2515...` + exact low-term translated-second-moment repair `a63b8d7a...`; inherited by #488 `229fdd6e...` | +| GAP-098 | exact translated-residual bias SE could double-round through a non-power normalization scale and move the final represented result by one ULP | `verification-pending` | RED `426fc5af...` + shared dyadic-scale prerequisite `d8b411f5...` + causal repair `d536e3b1...` + CHANGELOG `ebce979f...`; inherited by #488 `229fdd6e...` | | GAP-099 | exact translated three-observation two-level bias SE could re-round an exact gap through square/second-moment/square-root and move the represented result by one ULP | `verification-pending` | RED `fbcdb7fa...` + causal repair `e0f2445d...` + CHANGELOG `ee81953e...` + research/ancestor #488 `7741aaa...`; exact-head hosted GREEN/review/main integration remain pending | | GAP-100 | exact translated two-level bias SE with one singleton could re-round an exact gap through square/second-moment/square-root beyond the n=3 case | `verification-pending` | RED `4386d9ac...` + causal repair `79ad03fa...` + edge `7fe4117c...` + CHANGELOG `017ad11...` + research/ancestor #488 `944fac05...`; exact-head hosted GREEN/review/main integration remain pending | | GAP-101 | exact two-observation residuals could be re-centered on a rounded midpoint mean and materially distort `SE(mean)` despite exact pairwise subtraction | `verification-pending` | RED `d3dcd918...` + causal repair `02b0a178...` + CHANGELOG `5603b12d...` + research/ancestor #488 `905addcc...`; exact-head hosted GREEN/review/main integration remain pending | | GAP-102 | exact translated non-singleton two-level bias SE could re-round a dyadic count identity through translated sums/squares/square-root | `verification-pending` | RED `3bc43da2...` + causal repair `77ba1002...` + CHANGELOG `f165914e...` + research/ancestor #488 `9d7bb5c2...`; exact-head hosted GREEN/review/main integration remain pending | | GAP-103 | exact translated non-singleton two-level bias SE with a reciprocal-integer but non-power-of-two count factor could be re-rounded through translated moments | `verification-pending` | RED `d793f7f9...` + causal repair `0a4bfcd5...` + CHANGELOG `9651dfd1...` + research/ancestor #488 `11b8fd54...`; exact-head hosted GREEN/review/main integration remain pending | | GAP-104 | exact translated non-singleton two-level bias SE with a non-unit rational-square count factor could be re-rounded through translated moments | `verification-pending` | RED `6dc8116c...` + causal repair `8f2803c8...` + CHANGELOG `f0bb7af9...` + research/ancestor #488 `c5cbf6f0...`; exact-head hosted GREEN/review/main integration remain pending | -| GAP-105 | exact rational-square two-level bias SE could double-round when normal rational scaling restored into the subnormal result range | `verification-pending` | RED `8b7995d2...` + causal repair `ab0f0df1...` + public boundary `4daeb65d...` + branch coverage `8f6916dd...` + CHANGELOG `900b2091...` + research/current #488 `edb84949...`; exact-head hosted GREEN/review/main integration remain pending | +| GAP-105 | exact rational-square two-level bias SE could double-round when normal rational scaling restored into the subnormal result range | `verification-pending` | RED `8b7995d2...` + causal repair `ab0f0df1...` + public boundary `4daeb65d...` + branch coverage `8f6916dd...` + CHANGELOG `900b2091...` + research/ancestor #488 `edb84949...`; exact-head hosted GREEN/review/main integration remain pending | +| GAP-106 | exact translated-residual bias SE could select a different numerical path solely because the first observation was or was not a viable exact translation anchor | `verification-pending` | RED `5cb45a4f...` + causal repair `159659a9...` + CHANGELOG `7e57b930...` + research/current #488 `229fdd6e...`; permutation/sign-mirror contract added; exact-head hosted GREEN/review/main integration remain pending | ## Release gate From 1ac1c7aa46733d0e74fae234295cf2983a036260 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 5 Sep 2026 16:11:01 +0900 Subject: [PATCH 201/235] docs(ddd): advance Validation Evidence baseline through GAP-107 --- docs/product-technical-gap-baseline.md | 129 +++++++++++++------------ 1 file changed, 65 insertions(+), 64 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index caff40e2c..0f6136f36 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-05T06:34:31Z +**Snapshot:** 2026-09-05T07:08:59Z **Protected-main evidence:** `a243f18da4a4ca8a8d068c39922537f1f8ed6ad0` **Workspace version:** `0.2.0` @@ -30,7 +30,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `229fdd6eaffad5adf8cc2964cb506c6dd1191611` | true | `main` | Validation Evidence landing vehicle, based on protected #490. GAP-106 proves that exact translated-residual admission was still observation-order dependent because `diffs[0]` was the sole anchor. A represented three-residual sample has a viable exact middle anchor but inexact extreme anchors; the predecessor therefore returned adjacent lower `SE(mean)` bits for low/high-first permutations. The bounded repair searches anchors in canonical represented `(high, low)` order and uses the first candidate whose high, low, and recombined deltas are all exact; if none exists, the predecessor fallback remains authoritative. GAP-105 and earlier represented-input bias-SE, Wilson, provenance, Monte Carlo, RMSE/SE, matching, serde/projection repairs remain inherited. Hosted exact-head gates and independent review remain required. | +| #488 | `e3ab276574e439c4e4f5fdab1009dde7711e72dc` | true | `main` | Validation Evidence landing vehicle, based on protected #490. GAP-107 proves that canonical lexical choice among several already-exact translated-residual anchors could still expose a wider square/square-root working range and move `SE(mean)` by one ULP. The bounded repair evaluates every anchor satisfying the existing exact high/low/recombined-delta proofs, selects the one with the smallest maximum translated magnitude, and uses canonical represented `(high, low)` only as a deterministic tie-breaker. GAP-106 permutation-invariant admission and all earlier represented-input bias-SE, Wilson, provenance, Monte Carlo, RMSE/SE, matching, serde/projection repairs remain inherited. Hosted exact-head gates and independent review remain required. | | #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 | Validation / Analysis Run fold child. Unique evidence must be inherited by a conflict-resolving survivor; child-head CI does not transfer. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | @@ -50,7 +50,7 @@ TEPP owns temporal/event composition, irregular time, time-varying multilevel/cr `psychometric_core` is not authority for new temporal/state composition. fast-mlsirm owns reusable static/generalized-mixed/dependence-aware psychometric specification and arithmetic. TEPP consumes only immutable released/versioned Published Language through an ACL; source copying and mutable sibling-head dependencies are prohibited. Fresh owner evidence is fast-mlsirm protected `main@493326f2de49ea1704da0ded19868ed05d2fe00f`; latest immutable release remains `v0.9.1`. The protected-main advance is a CI/concurrency change after that release and is evidence only, not a mutable TEPP dependency. -contextual-orchestrator owns provider/model routing and semantic LLM execution. Fresh owner evidence is protected `main@2e414d15ba58f28597751b625a8a2f00fc9fadcf`, while GitHub releases remain zero. Semantic LLM work and model-backed Actions therefore continue to require a released/versioned contextual-orchestrator contract; Actions use `orchestrator/free` through the gateway credential and do not select providers/models/groups or consume direct provider keys. Mutable owner main is evidence, not a TEPP production contract. Protected-main `AGENTS.md` is stale on this point; #480 carries the owner-correct released-orchestrator wording and must be inherited by normal non-force integration rather than copied into unrelated scientific branches. Context Graph contracts are contract-only integration authority; EA Core owns enterprise-architecture decisions. No cross-service SQL. +contextual-orchestrator owns provider/model routing and semantic LLM execution. Fresh owner evidence is protected `main@a080297d2546bb61e89520d637cabc202db331ec`, while GitHub releases remain zero. Semantic LLM work and model-backed Actions therefore continue to require a released/versioned contextual-orchestrator contract; Actions use `orchestrator/free` through the gateway credential and do not select providers/models/groups or consume direct provider keys. Mutable owner main is evidence, not a TEPP production contract. Protected-main `AGENTS.md` is stale on this point; #480 carries the owner-correct released-orchestrator wording and must be inherited by normal non-force integration rather than copied into unrelated scientific branches. Context Graph contracts are contract-only integration authority; EA Core owns enterprise-architecture decisions. No cross-service SQL. The clock contract separates event/valid time, assertion time, document time, system time, availability time, and knowledge cutoff. Retrospective evidence may describe an earlier event but cannot enter an earlier knowledge cutoff. Forward state/transition edges remain distinct from retrospective/citation/revision/provenance relations. @@ -62,7 +62,7 @@ The clock contract separates event/valid time, assertion time, document time, sy - Row arrival order is not scientific evidence. Fixed admitted observations must produce bit-identical means/centered results under permutation wherever the contract claims deterministic CPU `f64` reference behavior. - Known-truth component recovery follows bounded-context identity: stable `Between` is unit-level and uses canonical `occasion_index = 0`; `Within` retains actual `(unit, occasion)` identity. Duplicate identities or stable-Between occasion aliases are not weights. - A representable final scientific estimand is not rejected solely because an avoidable intermediate binary64 operation overflows/underflows. False exact 0/1/non-finite endpoints, erased finite bounds, cancellation residues, and double-rounded endpoints are not accepted when a bounded equivalent operation preserves the represented estimand or decision. -- Mean signed bias and bias SE remain Validation Evidence performance measures over admitted recovery units. `mean_bias` uses the direct residual path only when every pairwise subtraction is finite and preserves represented low-order input mass; otherwise it uses the algebraically equivalent recovered-plus-negated-truth numerator, cancellation-safe exact-power-of-two scaling, and the original scientific denominator. `bias_standard_error` still requires each individual signed residual to be representable. For every two-observation sample, TEPP evaluates `SE(mean)=|r1-r2|/2` before a rounded residual mean can become authoritative; subtraction-roundoff cases use expanded represented inputs, while exact-subtraction cases use the represented residual difference through the cancellation/overflow-safe scientific denominator. For `n>2`, the exact translated-residual path is admitted only when anchor-relative high, low, and combined deltas are exactly representable. Candidate anchors are searched in canonical represented `(high, low)` order so an incidental first observation cannot make exact translated geometry available in one permutation and unavailable in another. Translation-invariant dispersion is then evaluated before any rounded residual mean becomes authoritative. GAP-098 requires exact power-of-two normalization; GAP-099 established the exact `n=3` two-level identity; GAP-100 generalized singleton/repeated-level geometry; GAP-102 established a reciprocal-power-of-two count shortcut; GAP-103 widened that to reciprocal-integer-square factors; GAP-104 generalized it to any reduced count factor satisfying `m(n-m)/(n^2(n-1))=(a/b)^2` with checked integer roots. GAP-105 additionally requires an admitted exact rational scale whose final represented value is subnormal to be rounded once in exact minimum-subnormal units rather than through normalized quotient plus scale restoration. GAP-106 requires exact-anchor admission itself to be permutation-invariant whenever at least one represented observation is a valid exact anchor. Results outside the bounded subnormal projection retain the existing overflow-safe represented sum-over-count path. Count factors that are not exact rational squares and general multi-level samples retain `sqrt(sum(d²)/(n(n-1)))`; samples for which no candidate anchor proves exact translated deltas retain the bounded predecessor fallback. These are bounded repairs, not a claim of globally correctly rounded n>2 dispersion. Mathematically nonzero final results outside binary64 range fail closed. +- Mean signed bias and bias SE remain Validation Evidence performance measures over admitted recovery units. `mean_bias` uses the direct residual path only when every pairwise subtraction is finite and preserves represented low-order input mass; otherwise it uses the algebraically equivalent recovered-plus-negated-truth numerator, cancellation-safe exact-power-of-two scaling, and the original scientific denominator. `bias_standard_error` still requires each individual signed residual to be representable. For every two-observation sample, TEPP evaluates `SE(mean)=|r1-r2|/2` before a rounded residual mean can become authoritative; subtraction-roundoff cases use expanded represented inputs, while exact-subtraction cases use the represented residual difference through the cancellation/overflow-safe scientific denominator. For `n>2`, the exact translated-residual path is admitted only when anchor-relative high, low, and combined deltas are exactly representable. Every exact candidate anchor is evaluated; the candidate with the smallest maximum translated magnitude is selected, with canonical represented `(high, low)` order only as a deterministic tie-breaker. This retains GAP-106 permutation invariance while GAP-107 prevents an avoidably wide exact representation from becoming authoritative. Translation-invariant dispersion is then evaluated before any rounded residual mean becomes authoritative. GAP-098 requires exact power-of-two normalization; GAP-099 established the exact `n=3` two-level identity; GAP-100 generalized singleton/repeated-level geometry; GAP-102 established a reciprocal-power-of-two count shortcut; GAP-103 widened that to reciprocal-integer-square factors; GAP-104 generalized it to any reduced count factor satisfying `m(n-m)/(n^2(n-1))=(a/b)^2` with checked integer roots. GAP-105 additionally requires an admitted exact rational scale whose final represented value is subnormal to be rounded once in exact minimum-subnormal units rather than through normalized quotient plus scale restoration. Results outside the bounded subnormal projection retain the existing overflow-safe represented sum-over-count path. Count factors that are not exact rational squares and general multi-level samples retain `sqrt(sum(d²)/(n(n-1)))`; samples for which no candidate anchor proves exact translated deltas retain the bounded predecessor fallback. These are bounded repairs, not a claim of globally correctly rounded n>2 dispersion. Mathematically nonzero final results outside binary64 range fail closed. - Generic Validation Evidence RMSE and its delta-method SE normalize before squaring. Exact-zero point RMSE requires exact-zero point RMSE SE. For positive RMSE, the declared producer satisfies `SE(RMSE) <= RMSE / 2`, with a small relative binary64 admission tolerance. - Generic `MonteCarloSummary` is sign-neutral. Zero SD requires zero SE and percentile endpoints equal to the represented mean. Positive SD requires positive SE coherent with represented `SD / sqrt(n)` within a small relative tolerance. Every inclusive nearest-rank endpoint is a retained observation and satisfies `|endpoint - mean| <= SD * sqrt(n - 1)`. Distinct lower/upper endpoint values share the same `(n - 1) * SD²` deviation budget. When `replication_count=2` and endpoints are distinct, those endpoints exhaust the retained sample and must reconstruct the represented mean/sample SD. - When the generic carrier occupies `ValidationReport::monte_carlo_rmse`, retained replications are nonnegative; positive mean implies `SE(mean) <= mean`, and inclusive nearest-rank endpoints cannot exceed nonnegative sample-sum support `n * mean`. These typed bounds are not imposed on signed metrics such as bias. @@ -83,13 +83,13 @@ The clock contract separates event/valid time, assertion time, document time, sy ### #488 — Validation Evidence -#488 is the generic Validation Evidence landing vehicle at exact head `229fdd6eaffad5adf8cc2964cb506c6dd1191611`, based on protected #490. GAP-092–105 remain inherited and executable. +#488 is the generic Validation Evidence landing vehicle at exact head `e3ab276574e439c4e4f5fdab1009dde7711e72dc`, based on protected #490. GAP-092–106 remain inherited and executable. -GAP-106 RED `5cb45a4f204ab4fbcd5581c4d4504e82f0339a30` fixes a three-residual represented multiset with `low=0x4194_f788_9184_b980`, `middle=0x420c_409f_fce3_8390`, and `high=0x4222_70c4_634c_c6b6`. Its exact represented-input squared `SE(mean)` is `327877142843256291246417577647793 / 2473901162496`, whose correctly rounded binary64 square root is `0x4205_7185_8078_f946`. The predecessor used `diffs[0]` as the only translation anchor: middle-first admitted exact translated deltas and returned `...f946`, while low-first or high-first encountered mirrored `±2^-19` subtraction tails on the extreme delta, abandoned the translated path, and returned adjacent lower `...f945`. +GAP-107 RED `49343ab6e7f1a4cadc0b9c71e0757edea0256add` fixes an exact three-residual represented multiset with `middle=0x3ff7_c8a6_308f_7624`, `low=0x3ff0_4284_fcf1_21a0`, and `high=0x3fff_659d_6d25_7410`. Its exact represented-input squared `SE(mean)` is `850963186800334380866421373237 / 11408855402054064613470328848384`, whose correctly rounded binary64 square root is `0x3fd1_7a99_c875_b980`. GAP-106's canonical-low exact anchor is valid but exposes maximum translated magnitude `0x1.e4630e068a4e0p-1` and returns adjacent upper `...b981`; the represented middle exact anchor exposes only `0x1.e73dcf257f7b0p-2` and returns the correct `...b980`. -Causal repair `159659a9510a7ced437ad872d02e26619abc8236` leaves all existing exactness tests intact but examines candidate anchors in canonical represented `(high, low)` `total_cmp` order. The first anchor for which every high delta, low delta, and recombined delta is finite and error-free supplies the translated vector; if no exact anchor exists, the predecessor rounded-residual fallback remains authoritative. Public permutations and sign mirrors are fixed in `bias_standard_error_anchor_permutation_contract.rs`. CHANGELOG `7e57b930daebb01b3583b4a5108ce3c1a89a06a6`; research/current #488 `229fdd6eaffad5adf8cc2964cb506c6dd1191611`. Fresh exact-head hosted execution and qualifying independent review remain required. +Causal repair `0fc3ea97106f5156a6d68d4db8fd6f4a2ace0ac4` leaves every existing exactness test intact, evaluates every exact anchor, minimizes the maximum translated magnitude, and uses represented `(high, low)` order only to break equal-conditioning ties. Public low/middle/high-first permutations and sign mirrors are fixed in `bias_standard_error_anchor_conditioning_contract.rs`; no inexact delta is promoted. CHANGELOG `2793ff5927ed3b79886cd3d4daa2369357c1710b`; research/current #488 `e3ab276574e439c4e4f5fdab1009dde7711e72dc`. Fresh exact-head hosted execution and qualifying independent review remain required. -GAP-105 remains inherited: RED `8b7995d2320cf256b3a38991ae1f8a230ca00146` + repair `ab0f0df1b8f36647f67239a5c628daed9023210e` preserve exact rational-square subnormal projection, with public boundary `4daeb65d...`, branch hardening `8f6916dd...`, and CHANGELOG `900b2091...`. GAP-104 preserves exact reduced rational-square count geometry such as `2/15`; GAP-103 the exact `1/6` reciprocal-integer case; GAP-102 the exact `1/8` dyadic case; GAP-101 the exact two-observation identity `SE(mean)=|r1-r2|/2`; GAP-100 the exact translated two-level singleton identity `SE(mean)=|level_gap|/n`; GAP-099 and GAP-098 retain their n=3 and dyadic-normalization repairs. GAP-106 does not widen the general n>2 correct-rounding claim or reclassify inexact deltas as exact. +GAP-106 remains inherited: RED `5cb45a4f204ab4fbcd5581c4d4504e82f0339a30` + repair `159659a9510a7ced437ad872d02e26619abc8236` established permutation-invariant exact-anchor admission. GAP-105 preserves exact rational-square subnormal projection; GAP-104 exact reduced rational-square count geometry such as `2/15`; GAP-103 the exact `1/6` reciprocal-integer case; GAP-102 the exact `1/8` dyadic case; GAP-101 the exact two-observation identity `SE(mean)=|r1-r2|/2`; GAP-100 the exact translated two-level singleton identity `SE(mean)=|level_gap|/n`; GAP-099 and GAP-098 retain their n=3 and dyadic-normalization repairs. GAP-107 does not widen the general n>2 correct-rounding claim or reclassify inexact deltas as exact. ### #416 — Validation / Analysis Run consolidation @@ -97,11 +97,11 @@ GAP-105 remains inherited: RED `8b7995d2320cf256b3a38991ae1f8a230ca00146` + repa ### #480 — contextual-orchestrator boundary -#480 removes TEPP-owned provider discovery/ranking and requires a released contextual-orchestrator owner contract. Forward repair `5b2637f7b6142573ba1385a652c56632ecc9faa5` removed the local hourly `schedule` reintroduced by predecessor `03876fb3e4c727bb754125ce531d928450d78303` and carries owner-correct `AGENTS.md` guidance requiring released/versioned contextual-orchestrator, `orchestrator/free`, and no direct provider keys. The branch still diverges from protected main because #489/#490 workflow consolidation and admission marker must be conflict-resolved without regressing #480's valid released-owner routing delta. contextual-orchestrator protected main remains `2e414d15ba58f28597751b625a8a2f00fc9fadcf`, and GitHub releases remain zero. #480 therefore stays Draft until non-force restack plus immutable compatible release/deployment/auth/schema/artifact provenance prerequisites are resolved. +#480 removes TEPP-owned provider discovery/ranking and requires a released contextual-orchestrator owner contract. Forward repair `5b2637f7b6142573ba1385a652c56632ecc9faa5` removed the local hourly `schedule` reintroduced by predecessor `03876fb3e4c727bb754125ce531d928450d78303` and carries owner-correct `AGENTS.md` guidance requiring released/versioned contextual-orchestrator, `orchestrator/free`, and no direct provider keys. The branch still diverges from protected main because #489/#490 workflow consolidation and admission marker must be conflict-resolved without regressing #480's valid released-owner routing delta. contextual-orchestrator protected main is `a080297d2546bb61e89520d637cabc202db331ec`, and GitHub releases remain zero. #480 therefore stays Draft until non-force restack plus immutable compatible release/deployment/auth/schema/artifact provenance prerequisites are resolved. ## Gap register -GAP-001–GAP-044 retain their existing domain/release identities and closure lineage. They remain unchanged by the GAP-106 numerical repair; their authoritative source/test/ADR history remains in repository ancestry and the surviving landing vehicles listed above. The validation lineage from GAP-045 onward is restated here because #488 is its current single writer. +GAP-001–GAP-044 retain their existing domain/release identities and closure lineage. They remain unchanged by the GAP-107 numerical repair; their authoritative source/test/ADR history remains in repository ancestry and the surviving landing vehicles listed above. The validation lineage from GAP-045 onward is restated here because #488 is its current single writer. | ID | Gap | Maturity | Closure evidence | | --- | --- | --- | --- | @@ -149,60 +149,60 @@ GAP-001–GAP-044 retain their existing domain/release identities and closure li | GAP-042 | ratio-first logarithm inflated adjacent-float growth rate | `verification-pending` | RED `766ddc7a...` + `ln_1p` repair `16f21d9a...` | | GAP-043 | duplicate known-truth identities could silently reweight RMSE | `verification-pending` | RED `698f12f5...` + repair `2fae4cb2...` | | GAP-044 | known-truth RMSE alignment depended on row order | `verification-pending` | RED `8ad72ac9...` / `5fb93c40...` + repairs `2dd9537e...` / `025dce7f...`; #310 `c6680450...` | -| GAP-045 | mean signed bias could reject representable result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; inherited by #488 `229fdd6e...` | -| GAP-046 | bias SE could reject representable SEM because raw squared deviations overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; inherited by #488 `229fdd6e...` | -| GAP-047 | generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; inherited by #488 `229fdd6e...` | -| GAP-048 | mean signed bias could erase representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; inherited by #488 `229fdd6e...` | +| GAP-045 | mean signed bias could reject representable result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; inherited by #488 `e3ab2765...` | +| GAP-046 | bias SE could reject representable SEM because raw squared deviations overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; inherited by #488 `e3ab2765...` | +| GAP-047 | generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; inherited by #488 `e3ab2765...` | +| GAP-048 | mean signed bias could erase representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; inherited by #488 `e3ab2765...` | | GAP-049 | stable `Between` recovery could be aliased across occasion indices and reweight RMSE | `verification-pending` | RED `0a03041c...` + repair `ec2c1219...`; #310 `c6680450...` | -| GAP-050 | zero-multiplier SE-aware acceptance could erase nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; inherited by #488 `229fdd6e...` | -| GAP-051 | exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; inherited by #488 `229fdd6e...` | -| GAP-052 | all-covered Wilson lower endpoint could cancel positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; inherited by #488 `229fdd6e...` | -| GAP-053 | strict-interior Wilson lower endpoint could cancel positive value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; inherited by #488 `229fdd6e...` | -| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; inherited by #488 `229fdd6e...` | -| GAP-055 | strict-interior Wilson lower endpoint could accept nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; inherited by #488 `229fdd6e...` | -| GAP-056 | durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; inherited by #488 `229fdd6e...` | -| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; inherited by #488 `229fdd6e...` | -| GAP-058 | generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; inherited by #488 `229fdd6e...` | -| GAP-059 | Monte Carlo summary could materially misstate positive SE relative to `SD/sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; inherited by #488 `229fdd6e...` | -| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; inherited by #488 `229fdd6e...` | -| GAP-061 | generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; inherited by #488 `229fdd6e...` | -| GAP-062 | finite-tolerance matching could fail for deterministically outside pair | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; inherited by #488 `229fdd6e...` | -| GAP-063 | exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; inherited by #488 `229fdd6e...` | -| GAP-064 | positive point RMSE could carry SE above squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; inherited by #488 `229fdd6e...` | -| GAP-065 | positive Monte Carlo RMSE could carry impossible spread/SE | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; inherited by #488 `229fdd6e...` | -| GAP-066 | RMSE nearest-rank percentile could exceed nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; inherited by #488 `229fdd6e...` | -| GAP-067 | generic nearest-rank endpoint could be incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected repair `2798e4f9...`; causal repair `c7151b49...`; inherited by #488 `229fdd6e...` | -| GAP-068 | distinct generic percentile endpoints could jointly exceed squared-deviation budget | `verification-pending` | RED `c4a13826...` + repair `cb3f80a2...`; inherited by #488 `229fdd6e...` | -| GAP-069 | two-replication endpoints could exhaust sample while mean/SD remained impossible | `verification-pending` | RED `81bf0d9e...` + repair `d48f8fef...`; inherited by #488 `229fdd6e...` | -| GAP-070 | stored Wilson pair could not arise from one score interval | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...`; inherited by #488 `229fdd6e...` | -| GAP-071 | durable Wilson evidence lacked denominator/critical-value/sidedness provenance | `active-repair` | carrier/authority/v1/envelope lineage; inherited by #488 `229fdd6e...`; durable-consumer adoption remains | -| GAP-072 | exact all-covered Wilson evidence could retain impossible zero lower endpoint | `verification-pending` | RED `ce714f07...` + repair `72e9d954...`; inherited by #488 `229fdd6e...` | -| GAP-073 | durable Wilson count provenance could lose one uncovered observation above exact-integer range | `verification-pending` | RED `29d710a5...` + count/fixed-width/exact-ratio repair lineage; inherited by #488 `229fdd6e...` | -| GAP-074 | durable exact count could be pre-rounded before endpoint projection | `verification-pending` | RED `f89e2467...` + reciprocal-scale repair `73bbb5cf...`; inherited by #488 `229fdd6e...` | -| GAP-075 | inexact all-covered Wilson miss mass could round to exact one | `verification-pending` | RED `059ce70d...` + canonical repair `0f478392...`; inherited by #488 `229fdd6e...` | -| GAP-076 | exact all-covered count could absorb small positive `z²` and emit exact `1.0` | `verification-pending` | RED `e0c4ec81...` + repair `c9dcb9df...`; inherited by #488 `229fdd6e...` | -| GAP-077 | inexact partial denominator could shift exact-count Wilson endpoint by one ULP | `verification-pending` | RED `06e55653...` + TwoSum/FMA repair `6c084dbe...`; inherited by #488 `229fdd6e...` | -| GAP-078 | Wilson residual compensation could move quotient across wrong midpoint | `verification-pending` | RED `d076d344...` + midpoint repair `32314239...`; inherited by #488 `229fdd6e...` | -| GAP-079 | SE-aware acceptance could underflow finite positive `k*SE` to zero through scale-first arithmetic | `verification-pending` | RED `76067efc...` + direct-finite repair `4ffdf366...`; inherited by #488 `229fdd6e...` | -| GAP-080 | both-overflow SE-aware fallback could round strict rejection into equality | `verification-pending` | RED `a9a45714...` + exact significand/exponent repair `425e8963...`; inherited by #488 `229fdd6e...` | -| GAP-081 | finite multiplication could round strict SE-aware rejection into equality | `verification-pending` | RED `23c3262c...` + tie repair `6a2add48...`; inherited by #488 `229fdd6e...` | -| GAP-082 | finite subtraction could round strict rejection onto exact bound | `verification-pending` | RED `58cbc032...` + low-term repair `68a6fd98...`; inherited by #488 `229fdd6e...` | -| GAP-083 | SE-aware product correction could fall below binary64 resolution | `verification-pending` | RED `b55c5473...` / `c77ac440...` + corrected repair `772ad8ed...`; inherited by #488 `229fdd6e...` | -| GAP-084 | legacy Wilson boundary could contradict peer endpoint root | `verification-pending` | RED `c9d612f2...` + peer-root repair `88512417...`; inherited by #488 `229fdd6e...` | -| GAP-085 | equal nonzero subtraction/FMA correction projections could conceal exact ordering | `verification-pending` | RED `35ea85ba...` + exact product-roundoff repair `7d597a18...`; inherited by #488 `229fdd6e...` | -| GAP-086 | mean bias could reject representable result because individual residuals overflow | `verification-pending` | RED `04e6e745...` + explicit-denominator cancellation/bias repair lineage; inherited by #488 `229fdd6e...` | -| GAP-087 | mixed-sign mean bias could discard repeated sub-ULP opposing mass | `verification-pending` | RED `63913727...` + low-term repair `5697cca5...`; inherited by #488 `229fdd6e...` | -| GAP-088 | mixed-remainder compensation could round before scientific count division | `verification-pending` | RED `8b4d19d1...` + compensated-division repair `7a33212b...`; inherited by #488 `229fdd6e...` | -| GAP-089 | exact cancellation could leave same-sign remainder rounded before division | `verification-pending` | RED `84476aad...` + repair `5f0d40b8...`; inherited by #488 `229fdd6e...` | -| GAP-090 | same-sign all-subnormal mean normalization could double-round final bias | `verification-pending` | RED `91abdb49...` + exact-unit repair `1c0df8a7...` + halfway coverage; inherited by #488 `229fdd6e...` | -| GAP-091 | pairwise subtraction roundoff could move mean bias across final midpoint | `verification-pending` | RED `a9d9bda3...` + corrected tail/midpoint repair `676ccda0...`; inherited by #488 `229fdd6e...` | -| GAP-092 | two distinct represented residuals could collapse to one subtraction and false-zero bias SE | `verification-pending` | RED `c9c55ea5...` + n=2 expanded-difference repair `f6d7da96...`; inherited by #488 `229fdd6e...` | -| GAP-093 | n>2 distinct represented residuals could collapse to one rounded high and false-zero bias SE | `verification-pending` | RED `06a70e1c...` + common-high/error-free-low repair `04c62514...`; inherited by #488 `229fdd6e...` | -| GAP-094 | separately rounded square roots could shift bias SE by one ULP | `verification-pending` | corrected RED `62243204...` + direct normalized-SE repair `8b8f0a21...`; inherited by #488 `229fdd6e...` | -| GAP-095 | distinct rounded residual highs could materially overstate uncertainty after subtraction roundoff | `verification-pending` | RED `ae906ad6...` + exact translated-residual repair `d59b9c30...`; inherited by #488 `229fdd6e...` | -| GAP-096 | exact residuals could be re-centered on rounded mean and distort dispersion | `verification-pending` | RED `9265b34a...` + exact-residual translated repair `2fa266b2...`; inherited by #488 `229fdd6e...` | -| GAP-097 | common-high subtraction path could round low-term mean before centering | `verification-pending` | RED `d48e2515...` + exact low-term translated-second-moment repair `a63b8d7a...`; inherited by #488 `229fdd6e...` | -| GAP-098 | exact translated-residual bias SE could double-round through a non-power normalization scale and move the final represented result by one ULP | `verification-pending` | RED `426fc5af...` + shared dyadic-scale prerequisite `d8b411f5...` + causal repair `d536e3b1...` + CHANGELOG `ebce979f...`; inherited by #488 `229fdd6e...` | +| GAP-050 | zero-multiplier SE-aware acceptance could erase nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; inherited by #488 `e3ab2765...` | +| GAP-051 | exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; inherited by #488 `e3ab2765...` | +| GAP-052 | all-covered Wilson lower endpoint could cancel positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; inherited by #488 `e3ab2765...` | +| GAP-053 | strict-interior Wilson lower endpoint could cancel positive value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; inherited by #488 `e3ab2765...` | +| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; inherited by #488 `e3ab2765...` | +| GAP-055 | strict-interior Wilson lower endpoint could accept nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; inherited by #488 `e3ab2765...` | +| GAP-056 | durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; inherited by #488 `e3ab2765...` | +| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; inherited by #488 `e3ab2765...` | +| GAP-058 | generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; inherited by #488 `e3ab2765...` | +| GAP-059 | Monte Carlo summary could materially misstate positive SE relative to `SD/sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; inherited by #488 `e3ab2765...` | +| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; inherited by #488 `e3ab2765...` | +| GAP-061 | generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; inherited by #488 `e3ab2765...` | +| GAP-062 | finite-tolerance matching could fail for deterministically outside pair | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; inherited by #488 `e3ab2765...` | +| GAP-063 | exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; inherited by #488 `e3ab2765...` | +| GAP-064 | positive point RMSE could carry SE above squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; inherited by #488 `e3ab2765...` | +| GAP-065 | positive Monte Carlo RMSE could carry impossible spread/SE | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; inherited by #488 `e3ab2765...` | +| GAP-066 | RMSE nearest-rank percentile could exceed nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; inherited by #488 `e3ab2765...` | +| GAP-067 | generic nearest-rank endpoint could be incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected repair `2798e4f9...`; causal repair `c7151b49...`; inherited by #488 `e3ab2765...` | +| GAP-068 | distinct generic percentile endpoints could jointly exceed squared-deviation budget | `verification-pending` | RED `c4a13826...` + repair `cb3f80a2...`; inherited by #488 `e3ab2765...` | +| GAP-069 | two-replication endpoints could exhaust sample while mean/SD remained impossible | `verification-pending` | RED `81bf0d9e...` + repair `d48f8fef...`; inherited by #488 `e3ab2765...` | +| GAP-070 | stored Wilson pair could not arise from one score interval | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...`; inherited by #488 `e3ab2765...` | +| GAP-071 | durable Wilson evidence lacked denominator/critical-value/sidedness provenance | `active-repair` | carrier/authority/v1/envelope lineage; inherited by #488 `e3ab2765...`; durable-consumer adoption remains | +| GAP-072 | exact all-covered Wilson evidence could retain impossible zero lower endpoint | `verification-pending` | RED `ce714f07...` + repair `72e9d954...`; inherited by #488 `e3ab2765...` | +| GAP-073 | durable Wilson count provenance could lose one uncovered observation above exact-integer range | `verification-pending` | RED `29d710a5...` + count/fixed-width/exact-ratio repair lineage; inherited by #488 `e3ab2765...` | +| GAP-074 | durable exact count could be pre-rounded before endpoint projection | `verification-pending` | RED `f89e2467...` + reciprocal-scale repair `73bbb5cf...`; inherited by #488 `e3ab2765...` | +| GAP-075 | inexact all-covered Wilson miss mass could round to exact one | `verification-pending` | RED `059ce70d...` + canonical repair `0f478392...`; inherited by #488 `e3ab2765...` | +| GAP-076 | exact all-covered count could absorb small positive `z²` and emit exact `1.0` | `verification-pending` | RED `e0c4ec81...` + repair `c9dcb9df...`; inherited by #488 `e3ab2765...` | +| GAP-077 | inexact partial denominator could shift exact-count Wilson endpoint by one ULP | `verification-pending` | RED `06e55653...` + TwoSum/FMA repair `6c084dbe...`; inherited by #488 `e3ab2765...` | +| GAP-078 | Wilson residual compensation could move quotient across wrong midpoint | `verification-pending` | RED `d076d344...` + midpoint repair `32314239...`; inherited by #488 `e3ab2765...` | +| GAP-079 | SE-aware acceptance could underflow finite positive `k*SE` to zero through scale-first arithmetic | `verification-pending` | RED `76067efc...` + direct-finite repair `4ffdf366...`; inherited by #488 `e3ab2765...` | +| GAP-080 | both-overflow SE-aware fallback could round strict rejection into equality | `verification-pending` | RED `a9a45714...` + exact significand/exponent repair `425e8963...`; inherited by #488 `e3ab2765...` | +| GAP-081 | finite multiplication could round strict SE-aware rejection into equality | `verification-pending` | RED `23c3262c...` + tie repair `6a2add48...`; inherited by #488 `e3ab2765...` | +| GAP-082 | finite subtraction could round strict rejection onto exact bound | `verification-pending` | RED `58cbc032...` + low-term repair `68a6fd98...`; inherited by #488 `e3ab2765...` | +| GAP-083 | SE-aware product correction could fall below binary64 resolution | `verification-pending` | RED `b55c5473...` / `c77ac440...` + corrected repair `772ad8ed...`; inherited by #488 `e3ab2765...` | +| GAP-084 | legacy Wilson boundary could contradict peer endpoint root | `verification-pending` | RED `c9d612f2...` + peer-root repair `88512417...`; inherited by #488 `e3ab2765...` | +| GAP-085 | equal nonzero subtraction/FMA correction projections could conceal exact ordering | `verification-pending` | RED `35ea85ba...` + exact product-roundoff repair `7d597a18...`; inherited by #488 `e3ab2765...` | +| GAP-086 | mean bias could reject representable result because individual residuals overflow | `verification-pending` | RED `04e6e745...` + explicit-denominator cancellation/bias repair lineage; inherited by #488 `e3ab2765...` | +| GAP-087 | mixed-sign mean bias could discard repeated sub-ULP opposing mass | `verification-pending` | RED `63913727...` + low-term repair `5697cca5...`; inherited by #488 `e3ab2765...` | +| GAP-088 | mixed-remainder compensation could round before scientific count division | `verification-pending` | RED `8b4d19d1...` + compensated-division repair `7a33212b...`; inherited by #488 `e3ab2765...` | +| GAP-089 | exact cancellation could leave same-sign remainder rounded before division | `verification-pending` | RED `84476aad...` + repair `5f0d40b8...`; inherited by #488 `e3ab2765...` | +| GAP-090 | same-sign all-subnormal mean normalization could double-round final bias | `verification-pending` | RED `91abdb49...` + exact-unit repair `1c0df8a7...` + halfway coverage; inherited by #488 `e3ab2765...` | +| GAP-091 | pairwise subtraction roundoff could move mean bias across final midpoint | `verification-pending` | RED `a9d9bda3...` + corrected tail/midpoint repair `676ccda0...`; inherited by #488 `e3ab2765...` | +| GAP-092 | two distinct represented residuals could collapse to one subtraction and false-zero bias SE | `verification-pending` | RED `c9c55ea5...` + n=2 expanded-difference repair `f6d7da96...`; inherited by #488 `e3ab2765...` | +| GAP-093 | n>2 distinct represented residuals could collapse to one rounded high and false-zero bias SE | `verification-pending` | RED `06a70e1c...` + common-high/error-free-low repair `04c62514...`; inherited by #488 `e3ab2765...` | +| GAP-094 | separately rounded square roots could shift bias SE by one ULP | `verification-pending` | corrected RED `62243204...` + direct normalized-SE repair `8b8f0a21...`; inherited by #488 `e3ab2765...` | +| GAP-095 | distinct rounded residual highs could materially overstate uncertainty after subtraction roundoff | `verification-pending` | RED `ae906ad6...` + exact translated-residual repair `d59b9c30...`; inherited by #488 `e3ab2765...` | +| GAP-096 | exact residuals could be re-centered on rounded mean and distort dispersion | `verification-pending` | RED `9265b34a...` + exact-residual translated repair `2fa266b2...`; inherited by #488 `e3ab2765...` | +| GAP-097 | common-high subtraction path could round low-term mean before centering | `verification-pending` | RED `d48e2515...` + exact low-term translated-second-moment repair `a63b8d7a...`; inherited by #488 `e3ab2765...` | +| GAP-098 | exact translated-residual bias SE could double-round through a non-power normalization scale and move the final represented result by one ULP | `verification-pending` | RED `426fc5af...` + shared dyadic-scale prerequisite `d8b411f5...` + causal repair `d536e3b1...` + CHANGELOG `ebce979f...`; inherited by #488 `e3ab2765...` | | GAP-099 | exact translated three-observation two-level bias SE could re-round an exact gap through square/second-moment/square-root and move the represented result by one ULP | `verification-pending` | RED `fbcdb7fa...` + causal repair `e0f2445d...` + CHANGELOG `ee81953e...` + research/ancestor #488 `7741aaa...`; exact-head hosted GREEN/review/main integration remain pending | | GAP-100 | exact translated two-level bias SE with one singleton could re-round an exact gap through square/second-moment/square-root beyond the n=3 case | `verification-pending` | RED `4386d9ac...` + causal repair `79ad03fa...` + edge `7fe4117c...` + CHANGELOG `017ad11...` + research/ancestor #488 `944fac05...`; exact-head hosted GREEN/review/main integration remain pending | | GAP-101 | exact two-observation residuals could be re-centered on a rounded midpoint mean and materially distort `SE(mean)` despite exact pairwise subtraction | `verification-pending` | RED `d3dcd918...` + causal repair `02b0a178...` + CHANGELOG `5603b12d...` + research/ancestor #488 `905addcc...`; exact-head hosted GREEN/review/main integration remain pending | @@ -210,7 +210,8 @@ GAP-001–GAP-044 retain their existing domain/release identities and closure li | GAP-103 | exact translated non-singleton two-level bias SE with a reciprocal-integer but non-power-of-two count factor could be re-rounded through translated moments | `verification-pending` | RED `d793f7f9...` + causal repair `0a4bfcd5...` + CHANGELOG `9651dfd1...` + research/ancestor #488 `11b8fd54...`; exact-head hosted GREEN/review/main integration remain pending | | GAP-104 | exact translated non-singleton two-level bias SE with a non-unit rational-square count factor could be re-rounded through translated moments | `verification-pending` | RED `6dc8116c...` + causal repair `8f2803c8...` + CHANGELOG `f0bb7af9...` + research/ancestor #488 `c5cbf6f0...`; exact-head hosted GREEN/review/main integration remain pending | | GAP-105 | exact rational-square two-level bias SE could double-round when normal rational scaling restored into the subnormal result range | `verification-pending` | RED `8b7995d2...` + causal repair `ab0f0df1...` + public boundary `4daeb65d...` + branch coverage `8f6916dd...` + CHANGELOG `900b2091...` + research/ancestor #488 `edb84949...`; exact-head hosted GREEN/review/main integration remain pending | -| GAP-106 | exact translated-residual bias SE could select a different numerical path solely because the first observation was or was not a viable exact translation anchor | `verification-pending` | RED `5cb45a4f...` + causal repair `159659a9...` + CHANGELOG `7e57b930...` + research/current #488 `229fdd6e...`; permutation/sign-mirror contract added; exact-head hosted GREEN/review/main integration remain pending | +| GAP-106 | exact translated-residual bias SE could select a different numerical path solely because the first observation was or was not a viable exact translation anchor | `verification-pending` | RED `5cb45a4f...` + causal repair `159659a9...` + CHANGELOG `7e57b930...` + research/ancestor #488 `229fdd6e...`; permutation/sign-mirror contract added; exact-head hosted GREEN/review/main integration remain pending | +| GAP-107 | several exact translated-residual anchors could expose different square/square-root conditioning and shift bias SE by one ULP even after permutation-invariant admission | `verification-pending` | RED `49343ab6...` + causal repair `0fc3ea97...` + CHANGELOG `2793ff59...` + research/current #488 `e3ab2765...`; conditioning/permutation/sign-mirror contract added; exact-head hosted GREEN/review/main integration remain pending | ## Release gate From 574368371491d70bf48338da50640723b26c662e Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 5 Sep 2026 17:13:29 +0900 Subject: [PATCH 202/235] docs(gap): advance Validation Evidence through GAP-108 --- docs/product-technical-gap-baseline.md | 125 +++++++++++++------------ 1 file changed, 63 insertions(+), 62 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 0f6136f36..2548e7356 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-05T07:08:59Z +**Snapshot:** 2026-09-05T08:10:22Z **Protected-main evidence:** `a243f18da4a4ca8a8d068c39922537f1f8ed6ad0` **Workspace version:** `0.2.0` @@ -30,7 +30,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `e3ab276574e439c4e4f5fdab1009dde7711e72dc` | true | `main` | Validation Evidence landing vehicle, based on protected #490. GAP-107 proves that canonical lexical choice among several already-exact translated-residual anchors could still expose a wider square/square-root working range and move `SE(mean)` by one ULP. The bounded repair evaluates every anchor satisfying the existing exact high/low/recombined-delta proofs, selects the one with the smallest maximum translated magnitude, and uses canonical represented `(high, low)` only as a deterministic tie-breaker. GAP-106 permutation-invariant admission and all earlier represented-input bias-SE, Wilson, provenance, Monte Carlo, RMSE/SE, matching, serde/projection repairs remain inherited. Hosted exact-head gates and independent review remain required. | +| #488 | `4514a07331d62417f6b9fcf8e52d9800d185eff6` | true | `main` | Validation Evidence landing vehicle, based on protected #490. GAP-108 proves that an exactly translated three-observation, three-level sample can have an exact rational-square dispersion numerator yet still move `SE(mean)` by one ULP when the generic translated-moment path rounds the squared ratio before `sqrt`. The bounded repair uses `SE(mean)^2=(x²+y²-xy)/9` only when FMA/subtraction residuals prove every product/addition error-free and the numerator has an exact represented square root, then divides that root by three through the existing representable denominator primitive. GAP-107 anchor conditioning, GAP-106 permutation invariance, and all earlier represented-input bias-SE, Wilson, provenance, Monte Carlo, RMSE/SE, matching, serde/projection repairs remain inherited. Hosted exact-head gates and independent review remain required. | | #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 | Validation / Analysis Run fold child. Unique evidence must be inherited by a conflict-resolving survivor; child-head CI does not transfer. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | @@ -62,7 +62,7 @@ The clock contract separates event/valid time, assertion time, document time, sy - Row arrival order is not scientific evidence. Fixed admitted observations must produce bit-identical means/centered results under permutation wherever the contract claims deterministic CPU `f64` reference behavior. - Known-truth component recovery follows bounded-context identity: stable `Between` is unit-level and uses canonical `occasion_index = 0`; `Within` retains actual `(unit, occasion)` identity. Duplicate identities or stable-Between occasion aliases are not weights. - A representable final scientific estimand is not rejected solely because an avoidable intermediate binary64 operation overflows/underflows. False exact 0/1/non-finite endpoints, erased finite bounds, cancellation residues, and double-rounded endpoints are not accepted when a bounded equivalent operation preserves the represented estimand or decision. -- Mean signed bias and bias SE remain Validation Evidence performance measures over admitted recovery units. `mean_bias` uses the direct residual path only when every pairwise subtraction is finite and preserves represented low-order input mass; otherwise it uses the algebraically equivalent recovered-plus-negated-truth numerator, cancellation-safe exact-power-of-two scaling, and the original scientific denominator. `bias_standard_error` still requires each individual signed residual to be representable. For every two-observation sample, TEPP evaluates `SE(mean)=|r1-r2|/2` before a rounded residual mean can become authoritative; subtraction-roundoff cases use expanded represented inputs, while exact-subtraction cases use the represented residual difference through the cancellation/overflow-safe scientific denominator. For `n>2`, the exact translated-residual path is admitted only when anchor-relative high, low, and combined deltas are exactly representable. Every exact candidate anchor is evaluated; the candidate with the smallest maximum translated magnitude is selected, with canonical represented `(high, low)` order only as a deterministic tie-breaker. This retains GAP-106 permutation invariance while GAP-107 prevents an avoidably wide exact representation from becoming authoritative. Translation-invariant dispersion is then evaluated before any rounded residual mean becomes authoritative. GAP-098 requires exact power-of-two normalization; GAP-099 established the exact `n=3` two-level identity; GAP-100 generalized singleton/repeated-level geometry; GAP-102 established a reciprocal-power-of-two count shortcut; GAP-103 widened that to reciprocal-integer-square factors; GAP-104 generalized it to any reduced count factor satisfying `m(n-m)/(n^2(n-1))=(a/b)^2` with checked integer roots. GAP-105 additionally requires an admitted exact rational scale whose final represented value is subnormal to be rounded once in exact minimum-subnormal units rather than through normalized quotient plus scale restoration. Results outside the bounded subnormal projection retain the existing overflow-safe represented sum-over-count path. Count factors that are not exact rational squares and general multi-level samples retain `sqrt(sum(d²)/(n(n-1)))`; samples for which no candidate anchor proves exact translated deltas retain the bounded predecessor fallback. These are bounded repairs, not a claim of globally correctly rounded n>2 dispersion. Mathematically nonzero final results outside binary64 range fail closed. +- Mean signed bias and bias SE remain Validation Evidence performance measures over admitted recovery units. `mean_bias` uses the direct residual path only when every pairwise subtraction is finite and preserves represented low-order input mass; otherwise it uses the algebraically equivalent recovered-plus-negated-truth numerator, cancellation-safe exact-power-of-two scaling, and the original scientific denominator. `bias_standard_error` still requires each individual signed residual to be representable. For every two-observation sample, TEPP evaluates `SE(mean)=|r1-r2|/2` before a rounded residual mean can become authoritative; subtraction-roundoff cases use expanded represented inputs, while exact-subtraction cases use the represented residual difference through the cancellation/overflow-safe scientific denominator. For `n>2`, the exact translated-residual path is admitted only when anchor-relative high, low, and combined deltas are exactly representable. Every exact candidate anchor is evaluated; the candidate with the smallest maximum translated magnitude is selected, with canonical represented `(high, low)` order only as a deterministic tie-breaker. This retains GAP-106 permutation invariance while GAP-107 prevents an avoidably wide exact representation from becoming authoritative. Translation-invariant dispersion is then evaluated before any rounded residual mean becomes authoritative. GAP-098 requires exact power-of-two normalization; GAP-099 established the exact `n=3` two-level identity; GAP-100 generalized singleton/repeated-level geometry; GAP-102 established a reciprocal-power-of-two count shortcut; GAP-103 widened that to reciprocal-integer-square factors; GAP-104 generalized it to any reduced count factor satisfying `m(n-m)/(n^2(n-1))=(a/b)^2` with checked integer roots. GAP-105 additionally requires an admitted exact rational scale whose final represented value is subnormal to be rounded once in exact minimum-subnormal units rather than through normalized quotient plus scale restoration. GAP-108 adds the exact three-observation, three-level identity `SE(mean)^2=(x²+y²-xy)/9` only when the two nonzero translated offsets have error-free represented squares/cross-product, the sum/subtraction is error-free, and the numerator has an exact represented square root; only that proved root is divided by three once. Results outside these bounded identities retain the existing translated second-moment or overflow-safe represented sum-over-count path. Count factors that are not exact rational squares and general multi-level samples retain `sqrt(sum(d²)/(n(n-1)))`; samples for which no candidate anchor proves exact translated deltas retain the bounded predecessor fallback. These are bounded repairs, not a claim of globally correctly rounded n>2 dispersion. Mathematically nonzero final results outside binary64 range fail closed. - Generic Validation Evidence RMSE and its delta-method SE normalize before squaring. Exact-zero point RMSE requires exact-zero point RMSE SE. For positive RMSE, the declared producer satisfies `SE(RMSE) <= RMSE / 2`, with a small relative binary64 admission tolerance. - Generic `MonteCarloSummary` is sign-neutral. Zero SD requires zero SE and percentile endpoints equal to the represented mean. Positive SD requires positive SE coherent with represented `SD / sqrt(n)` within a small relative tolerance. Every inclusive nearest-rank endpoint is a retained observation and satisfies `|endpoint - mean| <= SD * sqrt(n - 1)`. Distinct lower/upper endpoint values share the same `(n - 1) * SD²` deviation budget. When `replication_count=2` and endpoints are distinct, those endpoints exhaust the retained sample and must reconstruct the represented mean/sample SD. - When the generic carrier occupies `ValidationReport::monte_carlo_rmse`, retained replications are nonnegative; positive mean implies `SE(mean) <= mean`, and inclusive nearest-rank endpoints cannot exceed nonnegative sample-sum support `n * mean`. These typed bounds are not imposed on signed metrics such as bias. @@ -83,13 +83,13 @@ The clock contract separates event/valid time, assertion time, document time, sy ### #488 — Validation Evidence -#488 is the generic Validation Evidence landing vehicle at exact head `e3ab276574e439c4e4f5fdab1009dde7711e72dc`, based on protected #490. GAP-092–106 remain inherited and executable. +#488 is the generic Validation Evidence landing vehicle at exact head `4514a07331d62417f6b9fcf8e52d9800d185eff6`, based on protected #490. GAP-092–107 remain inherited and executable. -GAP-107 RED `49343ab6e7f1a4cadc0b9c71e0757edea0256add` fixes an exact three-residual represented multiset with `middle=0x3ff7_c8a6_308f_7624`, `low=0x3ff0_4284_fcf1_21a0`, and `high=0x3fff_659d_6d25_7410`. Its exact represented-input squared `SE(mean)` is `850963186800334380866421373237 / 11408855402054064613470328848384`, whose correctly rounded binary64 square root is `0x3fd1_7a99_c875_b980`. GAP-106's canonical-low exact anchor is valid but exposes maximum translated magnitude `0x1.e4630e068a4e0p-1` and returns adjacent upper `...b981`; the represented middle exact anchor exposes only `0x1.e73dcf257f7b0p-2` and returns the correct `...b980`. +GAP-108 RED `32dcab8434a9676854f3a470094aadfc4f3f417d` fixes the exactly represented sample `truth=[0,0,0]`, `recovered=[0,5/1024,21/1024]`. Its minimax exact translation is `[-5/1024,0,16/1024]`. Because `25+256+80=361=19²`, the exact three-level identity gives `SE(mean)=19/3072`, correctly rounded to bits `0x3f79_5555_5555_5555`; the predecessor normalized translated-moment reconstruction returns adjacent upper `0x3f79_5555_5555_5556`. -Causal repair `0fc3ea97106f5156a6d68d4db8fd6f4a2ace0ac4` leaves every existing exactness test intact, evaluates every exact anchor, minimizes the maximum translated magnitude, and uses represented `(high, low)` order only to break equal-conditioning ties. Public low/middle/high-first permutations and sign mirrors are fixed in `bias_standard_error_anchor_conditioning_contract.rs`; no inexact delta is promoted. CHANGELOG `2793ff5927ed3b79886cd3d4daa2369357c1710b`; research/current #488 `e3ab276574e439c4e4f5fdab1009dde7711e72dc`. Fresh exact-head hosted execution and qualifying independent review remain required. +Causal source repair `bee85e3df044e13a2df6c077cc87706b6cd78402` keeps the existing exact-translation admission and only applies `SE(mean)^2=(x²+y²-xy)/9` when FMA and subtraction residuals prove the constituent represented operations error-free and the resulting numerator has an exact represented square root. The exact root is divided by three through the existing representable denominator primitive, with the existing subnormal rational path retained; failed proofs remain on the predecessor translated path. Contract completion `8260bc0bff11abae2b05e0a85b5c1c374b8cbd49` covers all six permutations and sign mirrors. CHANGELOG `5757dda1dc2699618d12c0f8a33913aedde67ad4`; research/current #488 `4514a07331d62417f6b9fcf8e52d9800d185eff6`. Fresh exact-head hosted execution and qualifying independent review remain required. -GAP-106 remains inherited: RED `5cb45a4f204ab4fbcd5581c4d4504e82f0339a30` + repair `159659a9510a7ced437ad872d02e26619abc8236` established permutation-invariant exact-anchor admission. GAP-105 preserves exact rational-square subnormal projection; GAP-104 exact reduced rational-square count geometry such as `2/15`; GAP-103 the exact `1/6` reciprocal-integer case; GAP-102 the exact `1/8` dyadic case; GAP-101 the exact two-observation identity `SE(mean)=|r1-r2|/2`; GAP-100 the exact translated two-level singleton identity `SE(mean)=|level_gap|/n`; GAP-099 and GAP-098 retain their n=3 and dyadic-normalization repairs. GAP-107 does not widen the general n>2 correct-rounding claim or reclassify inexact deltas as exact. +GAP-107 remains inherited: RED `49343ab6e7f1a4cadc0b9c71e0757edea0256add` + repair `0fc3ea97106f5156a6d68d4db8fd6f4a2ace0ac4` established conditioning-minimized exact-anchor selection after GAP-106 permutation-invariant admission. GAP-105 preserves exact rational-square subnormal projection; GAP-104 exact reduced rational-square count geometry such as `2/15`; GAP-103 the exact `1/6` reciprocal-integer case; GAP-102 the exact `1/8` dyadic case; GAP-101 the exact two-observation identity `SE(mean)=|r1-r2|/2`; GAP-100 the exact translated two-level singleton identity `SE(mean)=|level_gap|/n`; GAP-099 and GAP-098 retain their n=3 and dyadic-normalization repairs. GAP-108 does not widen the general n>2 correct-rounding claim or reclassify inexact deltas as exact. ### #416 — Validation / Analysis Run consolidation @@ -101,7 +101,7 @@ GAP-106 remains inherited: RED `5cb45a4f204ab4fbcd5581c4d4504e82f0339a30` + repa ## Gap register -GAP-001–GAP-044 retain their existing domain/release identities and closure lineage. They remain unchanged by the GAP-107 numerical repair; their authoritative source/test/ADR history remains in repository ancestry and the surviving landing vehicles listed above. The validation lineage from GAP-045 onward is restated here because #488 is its current single writer. +GAP-001–GAP-044 retain their existing domain/release identities and closure lineage. They remain unchanged by the GAP-108 numerical repair; their authoritative source/test/ADR history remains in repository ancestry and the surviving landing vehicles listed above. The validation lineage from GAP-045 onward is restated here because #488 is its current single writer. | ID | Gap | Maturity | Closure evidence | | --- | --- | --- | --- | @@ -149,60 +149,60 @@ GAP-001–GAP-044 retain their existing domain/release identities and closure li | GAP-042 | ratio-first logarithm inflated adjacent-float growth rate | `verification-pending` | RED `766ddc7a...` + `ln_1p` repair `16f21d9a...` | | GAP-043 | duplicate known-truth identities could silently reweight RMSE | `verification-pending` | RED `698f12f5...` + repair `2fae4cb2...` | | GAP-044 | known-truth RMSE alignment depended on row order | `verification-pending` | RED `8ad72ac9...` / `5fb93c40...` + repairs `2dd9537e...` / `025dce7f...`; #310 `c6680450...` | -| GAP-045 | mean signed bias could reject representable result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; inherited by #488 `e3ab2765...` | -| GAP-046 | bias SE could reject representable SEM because raw squared deviations overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; inherited by #488 `e3ab2765...` | -| GAP-047 | generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; inherited by #488 `e3ab2765...` | -| GAP-048 | mean signed bias could erase representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; inherited by #488 `e3ab2765...` | +| GAP-045 | mean signed bias could reject representable result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; inherited by #488 `4514a073...` | +| GAP-046 | bias SE could reject representable SEM because raw squared deviations overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; inherited by #488 `4514a073...` | +| GAP-047 | generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; inherited by #488 `4514a073...` | +| GAP-048 | mean signed bias could erase representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; inherited by #488 `4514a073...` | | GAP-049 | stable `Between` recovery could be aliased across occasion indices and reweight RMSE | `verification-pending` | RED `0a03041c...` + repair `ec2c1219...`; #310 `c6680450...` | -| GAP-050 | zero-multiplier SE-aware acceptance could erase nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; inherited by #488 `e3ab2765...` | -| GAP-051 | exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; inherited by #488 `e3ab2765...` | -| GAP-052 | all-covered Wilson lower endpoint could cancel positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; inherited by #488 `e3ab2765...` | -| GAP-053 | strict-interior Wilson lower endpoint could cancel positive value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; inherited by #488 `e3ab2765...` | -| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; inherited by #488 `e3ab2765...` | -| GAP-055 | strict-interior Wilson lower endpoint could accept nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; inherited by #488 `e3ab2765...` | -| GAP-056 | durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; inherited by #488 `e3ab2765...` | -| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; inherited by #488 `e3ab2765...` | -| GAP-058 | generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; inherited by #488 `e3ab2765...` | -| GAP-059 | Monte Carlo summary could materially misstate positive SE relative to `SD/sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; inherited by #488 `e3ab2765...` | -| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; inherited by #488 `e3ab2765...` | -| GAP-061 | generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; inherited by #488 `e3ab2765...` | -| GAP-062 | finite-tolerance matching could fail for deterministically outside pair | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; inherited by #488 `e3ab2765...` | -| GAP-063 | exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; inherited by #488 `e3ab2765...` | -| GAP-064 | positive point RMSE could carry SE above squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; inherited by #488 `e3ab2765...` | -| GAP-065 | positive Monte Carlo RMSE could carry impossible spread/SE | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; inherited by #488 `e3ab2765...` | -| GAP-066 | RMSE nearest-rank percentile could exceed nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; inherited by #488 `e3ab2765...` | -| GAP-067 | generic nearest-rank endpoint could be incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected repair `2798e4f9...`; causal repair `c7151b49...`; inherited by #488 `e3ab2765...` | -| GAP-068 | distinct generic percentile endpoints could jointly exceed squared-deviation budget | `verification-pending` | RED `c4a13826...` + repair `cb3f80a2...`; inherited by #488 `e3ab2765...` | -| GAP-069 | two-replication endpoints could exhaust sample while mean/SD remained impossible | `verification-pending` | RED `81bf0d9e...` + repair `d48f8fef...`; inherited by #488 `e3ab2765...` | -| GAP-070 | stored Wilson pair could not arise from one score interval | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...`; inherited by #488 `e3ab2765...` | -| GAP-071 | durable Wilson evidence lacked denominator/critical-value/sidedness provenance | `active-repair` | carrier/authority/v1/envelope lineage; inherited by #488 `e3ab2765...`; durable-consumer adoption remains | -| GAP-072 | exact all-covered Wilson evidence could retain impossible zero lower endpoint | `verification-pending` | RED `ce714f07...` + repair `72e9d954...`; inherited by #488 `e3ab2765...` | -| GAP-073 | durable Wilson count provenance could lose one uncovered observation above exact-integer range | `verification-pending` | RED `29d710a5...` + count/fixed-width/exact-ratio repair lineage; inherited by #488 `e3ab2765...` | -| GAP-074 | durable exact count could be pre-rounded before endpoint projection | `verification-pending` | RED `f89e2467...` + reciprocal-scale repair `73bbb5cf...`; inherited by #488 `e3ab2765...` | -| GAP-075 | inexact all-covered Wilson miss mass could round to exact one | `verification-pending` | RED `059ce70d...` + canonical repair `0f478392...`; inherited by #488 `e3ab2765...` | -| GAP-076 | exact all-covered count could absorb small positive `z²` and emit exact `1.0` | `verification-pending` | RED `e0c4ec81...` + repair `c9dcb9df...`; inherited by #488 `e3ab2765...` | -| GAP-077 | inexact partial denominator could shift exact-count Wilson endpoint by one ULP | `verification-pending` | RED `06e55653...` + TwoSum/FMA repair `6c084dbe...`; inherited by #488 `e3ab2765...` | -| GAP-078 | Wilson residual compensation could move quotient across wrong midpoint | `verification-pending` | RED `d076d344...` + midpoint repair `32314239...`; inherited by #488 `e3ab2765...` | -| GAP-079 | SE-aware acceptance could underflow finite positive `k*SE` to zero through scale-first arithmetic | `verification-pending` | RED `76067efc...` + direct-finite repair `4ffdf366...`; inherited by #488 `e3ab2765...` | -| GAP-080 | both-overflow SE-aware fallback could round strict rejection into equality | `verification-pending` | RED `a9a45714...` + exact significand/exponent repair `425e8963...`; inherited by #488 `e3ab2765...` | -| GAP-081 | finite multiplication could round strict SE-aware rejection into equality | `verification-pending` | RED `23c3262c...` + tie repair `6a2add48...`; inherited by #488 `e3ab2765...` | -| GAP-082 | finite subtraction could round strict rejection onto exact bound | `verification-pending` | RED `58cbc032...` + low-term repair `68a6fd98...`; inherited by #488 `e3ab2765...` | -| GAP-083 | SE-aware product correction could fall below binary64 resolution | `verification-pending` | RED `b55c5473...` / `c77ac440...` + corrected repair `772ad8ed...`; inherited by #488 `e3ab2765...` | -| GAP-084 | legacy Wilson boundary could contradict peer endpoint root | `verification-pending` | RED `c9d612f2...` + peer-root repair `88512417...`; inherited by #488 `e3ab2765...` | -| GAP-085 | equal nonzero subtraction/FMA correction projections could conceal exact ordering | `verification-pending` | RED `35ea85ba...` + exact product-roundoff repair `7d597a18...`; inherited by #488 `e3ab2765...` | -| GAP-086 | mean bias could reject representable result because individual residuals overflow | `verification-pending` | RED `04e6e745...` + explicit-denominator cancellation/bias repair lineage; inherited by #488 `e3ab2765...` | -| GAP-087 | mixed-sign mean bias could discard repeated sub-ULP opposing mass | `verification-pending` | RED `63913727...` + low-term repair `5697cca5...`; inherited by #488 `e3ab2765...` | -| GAP-088 | mixed-remainder compensation could round before scientific count division | `verification-pending` | RED `8b4d19d1...` + compensated-division repair `7a33212b...`; inherited by #488 `e3ab2765...` | -| GAP-089 | exact cancellation could leave same-sign remainder rounded before division | `verification-pending` | RED `84476aad...` + repair `5f0d40b8...`; inherited by #488 `e3ab2765...` | -| GAP-090 | same-sign all-subnormal mean normalization could double-round final bias | `verification-pending` | RED `91abdb49...` + exact-unit repair `1c0df8a7...` + halfway coverage; inherited by #488 `e3ab2765...` | -| GAP-091 | pairwise subtraction roundoff could move mean bias across final midpoint | `verification-pending` | RED `a9d9bda3...` + corrected tail/midpoint repair `676ccda0...`; inherited by #488 `e3ab2765...` | -| GAP-092 | two distinct represented residuals could collapse to one subtraction and false-zero bias SE | `verification-pending` | RED `c9c55ea5...` + n=2 expanded-difference repair `f6d7da96...`; inherited by #488 `e3ab2765...` | -| GAP-093 | n>2 distinct represented residuals could collapse to one rounded high and false-zero bias SE | `verification-pending` | RED `06a70e1c...` + common-high/error-free-low repair `04c62514...`; inherited by #488 `e3ab2765...` | -| GAP-094 | separately rounded square roots could shift bias SE by one ULP | `verification-pending` | corrected RED `62243204...` + direct normalized-SE repair `8b8f0a21...`; inherited by #488 `e3ab2765...` | -| GAP-095 | distinct rounded residual highs could materially overstate uncertainty after subtraction roundoff | `verification-pending` | RED `ae906ad6...` + exact translated-residual repair `d59b9c30...`; inherited by #488 `e3ab2765...` | -| GAP-096 | exact residuals could be re-centered on rounded mean and distort dispersion | `verification-pending` | RED `9265b34a...` + exact-residual translated repair `2fa266b2...`; inherited by #488 `e3ab2765...` | -| GAP-097 | common-high subtraction path could round low-term mean before centering | `verification-pending` | RED `d48e2515...` + exact low-term translated-second-moment repair `a63b8d7a...`; inherited by #488 `e3ab2765...` | -| GAP-098 | exact translated-residual bias SE could double-round through a non-power normalization scale and move the final represented result by one ULP | `verification-pending` | RED `426fc5af...` + shared dyadic-scale prerequisite `d8b411f5...` + causal repair `d536e3b1...` + CHANGELOG `ebce979f...`; inherited by #488 `e3ab2765...` | +| GAP-050 | zero-multiplier SE-aware acceptance could erase nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; inherited by #488 `4514a073...` | +| GAP-051 | exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; inherited by #488 `4514a073...` | +| GAP-052 | all-covered Wilson lower endpoint could cancel positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; inherited by #488 `4514a073...` | +| GAP-053 | strict-interior Wilson lower endpoint could cancel positive value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; inherited by #488 `4514a073...` | +| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; inherited by #488 `4514a073...` | +| GAP-055 | strict-interior Wilson lower endpoint could accept nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; inherited by #488 `4514a073...` | +| GAP-056 | durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; inherited by #488 `4514a073...` | +| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; inherited by #488 `4514a073...` | +| GAP-058 | generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; inherited by #488 `4514a073...` | +| GAP-059 | Monte Carlo summary could materially misstate positive SE relative to `SD/sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; inherited by #488 `4514a073...` | +| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; inherited by #488 `4514a073...` | +| GAP-061 | generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; inherited by #488 `4514a073...` | +| GAP-062 | finite-tolerance matching could fail for deterministically outside pair | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; inherited by #488 `4514a073...` | +| GAP-063 | exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; inherited by #488 `4514a073...` | +| GAP-064 | positive point RMSE could carry SE above squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; inherited by #488 `4514a073...` | +| GAP-065 | positive Monte Carlo RMSE could carry impossible spread/SE | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; inherited by #488 `4514a073...` | +| GAP-066 | RMSE nearest-rank percentile could exceed nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; inherited by #488 `4514a073...` | +| GAP-067 | generic nearest-rank endpoint could be incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected repair `2798e4f9...`; causal repair `c7151b49...`; inherited by #488 `4514a073...` | +| GAP-068 | distinct generic percentile endpoints could jointly exceed squared-deviation budget | `verification-pending` | RED `c4a13826...` + repair `cb3f80a2...`; inherited by #488 `4514a073...` | +| GAP-069 | two-replication endpoints could exhaust sample while mean/SD remained impossible | `verification-pending` | RED `81bf0d9e...` + repair `d48f8fef...`; inherited by #488 `4514a073...` | +| GAP-070 | stored Wilson pair could not arise from one score interval | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...`; inherited by #488 `4514a073...` | +| GAP-071 | durable Wilson evidence lacked denominator/critical-value/sidedness provenance | `active-repair` | carrier/authority/v1/envelope lineage; inherited by #488 `4514a073...`; durable-consumer adoption remains | +| GAP-072 | exact all-covered Wilson evidence could retain impossible zero lower endpoint | `verification-pending` | RED `ce714f07...` + repair `72e9d954...`; inherited by #488 `4514a073...` | +| GAP-073 | durable Wilson count provenance could lose one uncovered observation above exact-integer range | `verification-pending` | RED `29d710a5...` + count/fixed-width/exact-ratio repair lineage; inherited by #488 `4514a073...` | +| GAP-074 | durable exact count could be pre-rounded before endpoint projection | `verification-pending` | RED `f89e2467...` + reciprocal-scale repair `73bbb5cf...`; inherited by #488 `4514a073...` | +| GAP-075 | inexact all-covered Wilson miss mass could round to exact one | `verification-pending` | RED `059ce70d...` + canonical repair `0f478392...`; inherited by #488 `4514a073...` | +| GAP-076 | exact all-covered count could absorb small positive `z²` and emit exact `1.0` | `verification-pending` | RED `e0c4ec81...` + repair `c9dcb9df...`; inherited by #488 `4514a073...` | +| GAP-077 | inexact partial denominator could shift exact-count Wilson endpoint by one ULP | `verification-pending` | RED `06e55653...` + TwoSum/FMA repair `6c084dbe...`; inherited by #488 `4514a073...` | +| GAP-078 | Wilson residual compensation could move quotient across wrong midpoint | `verification-pending` | RED `d076d344...` + midpoint repair `32314239...`; inherited by #488 `4514a073...` | +| GAP-079 | SE-aware acceptance could underflow finite positive `k*SE` to zero through scale-first arithmetic | `verification-pending` | RED `76067efc...` + direct-finite repair `4ffdf366...`; inherited by #488 `4514a073...` | +| GAP-080 | both-overflow SE-aware fallback could round strict rejection into equality | `verification-pending` | RED `a9a45714...` + exact significand/exponent repair `425e8963...`; inherited by #488 `4514a073...` | +| GAP-081 | finite multiplication could round strict SE-aware rejection into equality | `verification-pending` | RED `23c3262c...` + tie repair `6a2add48...`; inherited by #488 `4514a073...` | +| GAP-082 | finite subtraction could round strict rejection onto exact bound | `verification-pending` | RED `58cbc032...` + low-term repair `68a6fd98...`; inherited by #488 `4514a073...` | +| GAP-083 | SE-aware product correction could fall below binary64 resolution | `verification-pending` | RED `b55c5473...` / `c77ac440...` + corrected repair `772ad8ed...`; inherited by #488 `4514a073...` | +| GAP-084 | legacy Wilson boundary could contradict peer endpoint root | `verification-pending` | RED `c9d612f2...` + peer-root repair `88512417...`; inherited by #488 `4514a073...` | +| GAP-085 | equal nonzero subtraction/FMA correction projections could conceal exact ordering | `verification-pending` | RED `35ea85ba...` + exact product-roundoff repair `7d597a18...`; inherited by #488 `4514a073...` | +| GAP-086 | mean bias could reject representable result because individual residuals overflow | `verification-pending` | RED `04e6e745...` + explicit-denominator cancellation/bias repair lineage; inherited by #488 `4514a073...` | +| GAP-087 | mixed-sign mean bias could discard repeated sub-ULP opposing mass | `verification-pending` | RED `63913727...` + low-term repair `5697cca5...`; inherited by #488 `4514a073...` | +| GAP-088 | mixed-remainder compensation could round before scientific count division | `verification-pending` | RED `8b4d19d1...` + compensated-division repair `7a33212b...`; inherited by #488 `4514a073...` | +| GAP-089 | exact cancellation could leave same-sign remainder rounded before division | `verification-pending` | RED `84476aad...` + repair `5f0d40b8...`; inherited by #488 `4514a073...` | +| GAP-090 | same-sign all-subnormal mean normalization could double-round final bias | `verification-pending` | RED `91abdb49...` + exact-unit repair `1c0df8a7...` + halfway coverage; inherited by #488 `4514a073...` | +| GAP-091 | pairwise subtraction roundoff could move mean bias across final midpoint | `verification-pending` | RED `a9d9bda3...` + corrected tail/midpoint repair `676ccda0...`; inherited by #488 `4514a073...` | +| GAP-092 | two distinct represented residuals could collapse to one subtraction and false-zero bias SE | `verification-pending` | RED `c9c55ea5...` + n=2 expanded-difference repair `f6d7da96...`; inherited by #488 `4514a073...` | +| GAP-093 | n>2 distinct represented residuals could collapse to one rounded high and false-zero bias SE | `verification-pending` | RED `06a70e1c...` + common-high/error-free-low repair `04c62514...`; inherited by #488 `4514a073...` | +| GAP-094 | separately rounded square roots could shift bias SE by one ULP | `verification-pending` | corrected RED `62243204...` + direct normalized-SE repair `8b8f0a21...`; inherited by #488 `4514a073...` | +| GAP-095 | distinct rounded residual highs could materially overstate uncertainty after subtraction roundoff | `verification-pending` | RED `ae906ad6...` + exact translated-residual repair `d59b9c30...`; inherited by #488 `4514a073...` | +| GAP-096 | exact residuals could be re-centered on rounded mean and distort dispersion | `verification-pending` | RED `9265b34a...` + exact-residual translated repair `2fa266b2...`; inherited by #488 `4514a073...` | +| GAP-097 | common-high subtraction path could round low-term mean before centering | `verification-pending` | RED `d48e2515...` + exact low-term translated-second-moment repair `a63b8d7a...`; inherited by #488 `4514a073...` | +| GAP-098 | exact translated-residual bias SE could double-round through a non-power normalization scale and move the final represented result by one ULP | `verification-pending` | RED `426fc5af...` + shared dyadic-scale prerequisite `d8b411f5...` + causal repair `d536e3b1...` + CHANGELOG `ebce979f...`; inherited by #488 `4514a073...` | | GAP-099 | exact translated three-observation two-level bias SE could re-round an exact gap through square/second-moment/square-root and move the represented result by one ULP | `verification-pending` | RED `fbcdb7fa...` + causal repair `e0f2445d...` + CHANGELOG `ee81953e...` + research/ancestor #488 `7741aaa...`; exact-head hosted GREEN/review/main integration remain pending | | GAP-100 | exact translated two-level bias SE with one singleton could re-round an exact gap through square/second-moment/square-root beyond the n=3 case | `verification-pending` | RED `4386d9ac...` + causal repair `79ad03fa...` + edge `7fe4117c...` + CHANGELOG `017ad11...` + research/ancestor #488 `944fac05...`; exact-head hosted GREEN/review/main integration remain pending | | GAP-101 | exact two-observation residuals could be re-centered on a rounded midpoint mean and materially distort `SE(mean)` despite exact pairwise subtraction | `verification-pending` | RED `d3dcd918...` + causal repair `02b0a178...` + CHANGELOG `5603b12d...` + research/ancestor #488 `905addcc...`; exact-head hosted GREEN/review/main integration remain pending | @@ -211,7 +211,8 @@ GAP-001–GAP-044 retain their existing domain/release identities and closure li | GAP-104 | exact translated non-singleton two-level bias SE with a non-unit rational-square count factor could be re-rounded through translated moments | `verification-pending` | RED `6dc8116c...` + causal repair `8f2803c8...` + CHANGELOG `f0bb7af9...` + research/ancestor #488 `c5cbf6f0...`; exact-head hosted GREEN/review/main integration remain pending | | GAP-105 | exact rational-square two-level bias SE could double-round when normal rational scaling restored into the subnormal result range | `verification-pending` | RED `8b7995d2...` + causal repair `ab0f0df1...` + public boundary `4daeb65d...` + branch coverage `8f6916dd...` + CHANGELOG `900b2091...` + research/ancestor #488 `edb84949...`; exact-head hosted GREEN/review/main integration remain pending | | GAP-106 | exact translated-residual bias SE could select a different numerical path solely because the first observation was or was not a viable exact translation anchor | `verification-pending` | RED `5cb45a4f...` + causal repair `159659a9...` + CHANGELOG `7e57b930...` + research/ancestor #488 `229fdd6e...`; permutation/sign-mirror contract added; exact-head hosted GREEN/review/main integration remain pending | -| GAP-107 | several exact translated-residual anchors could expose different square/square-root conditioning and shift bias SE by one ULP even after permutation-invariant admission | `verification-pending` | RED `49343ab6...` + causal repair `0fc3ea97...` + CHANGELOG `2793ff59...` + research/current #488 `e3ab2765...`; conditioning/permutation/sign-mirror contract added; exact-head hosted GREEN/review/main integration remain pending | +| GAP-107 | several exact translated-residual anchors could expose different square/square-root conditioning and shift bias SE by one ULP even after permutation-invariant admission | `verification-pending` | RED `49343ab6...` + causal repair `0fc3ea97...` + CHANGELOG `2793ff59...` + research/ancestor #488 `e3ab2765...`; conditioning/permutation/sign-mirror contract added; exact-head hosted GREEN/review/main integration remain pending | +| GAP-108 | exact translated three-observation, three-level rational-square dispersion could be re-rounded through normalized moments and `sqrt` even after best-anchor selection | `verification-pending` | RED `32dcab84...` + causal repair `bee85e3d...` + all-permutation/sign-mirror contract `8260bc0b...` + CHANGELOG `5757dda1...` + research/current #488 `4514a073...`; exact-head hosted GREEN/review/main integration remain pending | ## Release gate From cafc4e0680dee7a9be80ed4e73d797167ba9dcf2 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 5 Sep 2026 18:11:16 +0900 Subject: [PATCH 203/235] docs(gaps): record GAP-109 scale-invariant bias SE --- docs/product-technical-gap-baseline.md | 127 +++++++++++++------------ 1 file changed, 64 insertions(+), 63 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 2548e7356..123e2e955 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-05T08:10:22Z +**Snapshot:** 2026-09-05T08:58:14Z **Protected-main evidence:** `a243f18da4a4ca8a8d068c39922537f1f8ed6ad0` **Workspace version:** `0.2.0` @@ -30,7 +30,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `4514a07331d62417f6b9fcf8e52d9800d185eff6` | true | `main` | Validation Evidence landing vehicle, based on protected #490. GAP-108 proves that an exactly translated three-observation, three-level sample can have an exact rational-square dispersion numerator yet still move `SE(mean)` by one ULP when the generic translated-moment path rounds the squared ratio before `sqrt`. The bounded repair uses `SE(mean)^2=(x²+y²-xy)/9` only when FMA/subtraction residuals prove every product/addition error-free and the numerator has an exact represented square root, then divides that root by three through the existing representable denominator primitive. GAP-107 anchor conditioning, GAP-106 permutation invariance, and all earlier represented-input bias-SE, Wilson, provenance, Monte Carlo, RMSE/SE, matching, serde/projection repairs remain inherited. Hosted exact-head gates and independent review remain required. | +| #488 | `1eaac11e715144127048fc20033719777528c692` | true | `main` | Validation Evidence landing vehicle, based on protected #490. GAP-109 proves that GAP-108's exact three-observation rational-square identity must remain admissible under exact power-of-two scaling: raw square/cross-product overflow is not scientific evidence that the represented geometry changed. The bounded repair retries the same FMA/subtraction/root proof only after exactly reversible dyadic normalization when raw products overflow, then restores the proved root with the same exact scale. GAP-108 three-level rational-square dispersion, GAP-107 anchor conditioning, GAP-106 permutation invariance, and all earlier represented-input bias-SE, Wilson, provenance, Monte Carlo, RMSE/SE, matching, serde/projection repairs remain inherited. Hosted exact-head gates and independent review remain required. | | #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 | Validation / Analysis Run fold child. Unique evidence must be inherited by a conflict-resolving survivor; child-head CI does not transfer. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | @@ -62,7 +62,7 @@ The clock contract separates event/valid time, assertion time, document time, sy - Row arrival order is not scientific evidence. Fixed admitted observations must produce bit-identical means/centered results under permutation wherever the contract claims deterministic CPU `f64` reference behavior. - Known-truth component recovery follows bounded-context identity: stable `Between` is unit-level and uses canonical `occasion_index = 0`; `Within` retains actual `(unit, occasion)` identity. Duplicate identities or stable-Between occasion aliases are not weights. - A representable final scientific estimand is not rejected solely because an avoidable intermediate binary64 operation overflows/underflows. False exact 0/1/non-finite endpoints, erased finite bounds, cancellation residues, and double-rounded endpoints are not accepted when a bounded equivalent operation preserves the represented estimand or decision. -- Mean signed bias and bias SE remain Validation Evidence performance measures over admitted recovery units. `mean_bias` uses the direct residual path only when every pairwise subtraction is finite and preserves represented low-order input mass; otherwise it uses the algebraically equivalent recovered-plus-negated-truth numerator, cancellation-safe exact-power-of-two scaling, and the original scientific denominator. `bias_standard_error` still requires each individual signed residual to be representable. For every two-observation sample, TEPP evaluates `SE(mean)=|r1-r2|/2` before a rounded residual mean can become authoritative; subtraction-roundoff cases use expanded represented inputs, while exact-subtraction cases use the represented residual difference through the cancellation/overflow-safe scientific denominator. For `n>2`, the exact translated-residual path is admitted only when anchor-relative high, low, and combined deltas are exactly representable. Every exact candidate anchor is evaluated; the candidate with the smallest maximum translated magnitude is selected, with canonical represented `(high, low)` order only as a deterministic tie-breaker. This retains GAP-106 permutation invariance while GAP-107 prevents an avoidably wide exact representation from becoming authoritative. Translation-invariant dispersion is then evaluated before any rounded residual mean becomes authoritative. GAP-098 requires exact power-of-two normalization; GAP-099 established the exact `n=3` two-level identity; GAP-100 generalized singleton/repeated-level geometry; GAP-102 established a reciprocal-power-of-two count shortcut; GAP-103 widened that to reciprocal-integer-square factors; GAP-104 generalized it to any reduced count factor satisfying `m(n-m)/(n^2(n-1))=(a/b)^2` with checked integer roots. GAP-105 additionally requires an admitted exact rational scale whose final represented value is subnormal to be rounded once in exact minimum-subnormal units rather than through normalized quotient plus scale restoration. GAP-108 adds the exact three-observation, three-level identity `SE(mean)^2=(x²+y²-xy)/9` only when the two nonzero translated offsets have error-free represented squares/cross-product, the sum/subtraction is error-free, and the numerator has an exact represented square root; only that proved root is divided by three once. Results outside these bounded identities retain the existing translated second-moment or overflow-safe represented sum-over-count path. Count factors that are not exact rational squares and general multi-level samples retain `sqrt(sum(d²)/(n(n-1)))`; samples for which no candidate anchor proves exact translated deltas retain the bounded predecessor fallback. These are bounded repairs, not a claim of globally correctly rounded n>2 dispersion. Mathematically nonzero final results outside binary64 range fail closed. +- Mean signed bias and bias SE remain Validation Evidence performance measures over admitted recovery units. `mean_bias` uses the direct residual path only when every pairwise subtraction is finite and preserves represented low-order input mass; otherwise it uses the algebraically equivalent recovered-plus-negated-truth numerator, cancellation-safe exact-power-of-two scaling, and the original scientific denominator. `bias_standard_error` still requires each individual signed residual to be representable. For every two-observation sample, TEPP evaluates `SE(mean)=|r1-r2|/2` before a rounded residual mean can become authoritative; subtraction-roundoff cases use expanded represented inputs, while exact-subtraction cases use the represented residual difference through the cancellation/overflow-safe scientific denominator. For `n>2`, the exact translated-residual path is admitted only when anchor-relative high, low, and combined deltas are exactly representable. Every exact candidate anchor is evaluated; the candidate with the smallest maximum translated magnitude is selected, with canonical represented `(high, low)` order only as a deterministic tie-breaker. This retains GAP-106 permutation invariance while GAP-107 prevents an avoidably wide exact representation from becoming authoritative. Translation-invariant dispersion is then evaluated before any rounded residual mean becomes authoritative. GAP-098 requires exact power-of-two normalization; GAP-099 established the exact `n=3` two-level identity; GAP-100 generalized singleton/repeated-level geometry; GAP-102 established a reciprocal-power-of-two count shortcut; GAP-103 widened that to reciprocal-integer-square factors; GAP-104 generalized it to any reduced count factor satisfying `m(n-m)/(n^2(n-1))=(a/b)^2` with checked integer roots. GAP-105 additionally requires an admitted exact rational scale whose final represented value is subnormal to be rounded once in exact minimum-subnormal units rather than through normalized quotient plus scale restoration. GAP-108 adds the exact three-observation, three-level identity `SE(mean)^2=(x²+y²-xy)/9` only when the two nonzero translated offsets have error-free represented squares/cross-product, the sum/subtraction is error-free, and the numerator has an exact represented square root; only that proved root is divided by three once. GAP-109 makes that proof invariant to exact dyadic unit scaling: if raw square/cross-product intermediates overflow, the same proof is retried only after an exactly reversible power-of-two normalization, with exact reconstruction required before the normalized result can become authoritative. Results outside these bounded identities retain the existing translated second-moment or overflow-safe represented sum-over-count path. Count factors that are not exact rational squares and general multi-level samples retain `sqrt(sum(d²)/(n(n-1)))`; samples for which no candidate anchor proves exact translated deltas retain the bounded predecessor fallback. These are bounded repairs, not a claim of globally correctly rounded n>2 dispersion. Mathematically nonzero final results outside binary64 range fail closed. - Generic Validation Evidence RMSE and its delta-method SE normalize before squaring. Exact-zero point RMSE requires exact-zero point RMSE SE. For positive RMSE, the declared producer satisfies `SE(RMSE) <= RMSE / 2`, with a small relative binary64 admission tolerance. - Generic `MonteCarloSummary` is sign-neutral. Zero SD requires zero SE and percentile endpoints equal to the represented mean. Positive SD requires positive SE coherent with represented `SD / sqrt(n)` within a small relative tolerance. Every inclusive nearest-rank endpoint is a retained observation and satisfies `|endpoint - mean| <= SD * sqrt(n - 1)`. Distinct lower/upper endpoint values share the same `(n - 1) * SD²` deviation budget. When `replication_count=2` and endpoints are distinct, those endpoints exhaust the retained sample and must reconstruct the represented mean/sample SD. - When the generic carrier occupies `ValidationReport::monte_carlo_rmse`, retained replications are nonnegative; positive mean implies `SE(mean) <= mean`, and inclusive nearest-rank endpoints cannot exceed nonnegative sample-sum support `n * mean`. These typed bounds are not imposed on signed metrics such as bias. @@ -83,13 +83,13 @@ The clock contract separates event/valid time, assertion time, document time, sy ### #488 — Validation Evidence -#488 is the generic Validation Evidence landing vehicle at exact head `4514a07331d62417f6b9fcf8e52d9800d185eff6`, based on protected #490. GAP-092–107 remain inherited and executable. +#488 is the generic Validation Evidence landing vehicle at exact head `1eaac11e715144127048fc20033719777528c692`, based on protected #490. GAP-092–108 remain inherited and executable. -GAP-108 RED `32dcab8434a9676854f3a470094aadfc4f3f417d` fixes the exactly represented sample `truth=[0,0,0]`, `recovered=[0,5/1024,21/1024]`. Its minimax exact translation is `[-5/1024,0,16/1024]`. Because `25+256+80=361=19²`, the exact three-level identity gives `SE(mean)=19/3072`, correctly rounded to bits `0x3f79_5555_5555_5555`; the predecessor normalized translated-moment reconstruction returns adjacent upper `0x3f79_5555_5555_5556`. +GAP-109 RED `67fa485248a8673f90bb71a43c2a58865a764383` fixes the exact `2^600` scaling of GAP-108: `truth=[0,0,0]`, `recovered=[0,5*2^590,21*2^590]`, represented as `0x0000000000000000`, `0x64f4000000000000`, `0x6515000000000000`. Its minimax exact translation is `[-5*2^590,0,16*2^590]`. The exact target is `(19/3072)*2^600`, bits `0x64f9_5555_5555_5555`; GAP-108's raw-product proof overflows and the predecessor fallback reconstructs normalized moments and `sqrt`, returning adjacent upper `0x64f9_5555_5555_5556`. -Causal source repair `bee85e3df044e13a2df6c077cc87706b6cd78402` keeps the existing exact-translation admission and only applies `SE(mean)^2=(x²+y²-xy)/9` when FMA and subtraction residuals prove the constituent represented operations error-free and the resulting numerator has an exact represented square root. The exact root is divided by three through the existing representable denominator primitive, with the existing subnormal rational path retained; failed proofs remain on the predecessor translated path. Contract completion `8260bc0bff11abae2b05e0a85b5c1c374b8cbd49` covers all six permutations and sign mirrors. CHANGELOG `5757dda1dc2699618d12c0f8a33913aedde67ad4`; research/current #488 `4514a07331d62417f6b9fcf8e52d9800d185eff6`. Fresh exact-head hosted execution and qualifying independent review remain required. +Causal source repair `dcaf25b37d9860e7956de5429d3ef5894b129b49` retains the finite-product GAP-108 admission and retries the same proof after `exact_power_of_two_scale` normalization only when a raw square/cross-product overflows. Admission requires finite/nonzero preservation, exact scale reconstruction of both represented offsets, FMA-proven normalized products, error-free sum/subtraction, and an exact represented root. The normalized root is divided by three through the existing denominator primitive and restored by the exact dyadic scale. The public contract covers all six permutations and sign mirrors; failed proofs retain the predecessor translated path. CHANGELOG `31b1aff811703a41e3524e804d095be32621b004`; research/current #488 `1eaac11e715144127048fc20033719777528c692`. Fresh exact-head hosted execution and qualifying independent review remain required. -GAP-107 remains inherited: RED `49343ab6e7f1a4cadc0b9c71e0757edea0256add` + repair `0fc3ea97106f5156a6d68d4db8fd6f4a2ace0ac4` established conditioning-minimized exact-anchor selection after GAP-106 permutation-invariant admission. GAP-105 preserves exact rational-square subnormal projection; GAP-104 exact reduced rational-square count geometry such as `2/15`; GAP-103 the exact `1/6` reciprocal-integer case; GAP-102 the exact `1/8` dyadic case; GAP-101 the exact two-observation identity `SE(mean)=|r1-r2|/2`; GAP-100 the exact translated two-level singleton identity `SE(mean)=|level_gap|/n`; GAP-099 and GAP-098 retain their n=3 and dyadic-normalization repairs. GAP-108 does not widen the general n>2 correct-rounding claim or reclassify inexact deltas as exact. +GAP-108 remains inherited: RED `32dcab8434a9676854f3a470094aadfc4f3f417d` + causal repair `bee85e3df044e13a2df6c077cc87706b6cd78402` + all-permutation/sign-mirror contract `8260bc0bff11abae2b05e0a85b5c1c374b8cbd49` established the bounded three-level rational-square identity. GAP-107 remains inherited: RED `49343ab6e7f1a4cadc0b9c71e0757edea0256add` + repair `0fc3ea97106f5156a6d68d4db8fd6f4a2ace0ac4` established conditioning-minimized exact-anchor selection after GAP-106 permutation-invariant admission. GAP-105 preserves exact rational-square subnormal projection; GAP-104 exact reduced rational-square count geometry such as `2/15`; GAP-103 the exact `1/6` reciprocal-integer case; GAP-102 the exact `1/8` dyadic case; GAP-101 the exact two-observation identity `SE(mean)=|r1-r2|/2`; GAP-100 the exact translated two-level singleton identity `SE(mean)=|level_gap|/n`; GAP-099 and GAP-098 retain their n=3 and dyadic-normalization repairs. GAP-109 does not widen the general n>2 correct-rounding claim or reclassify inexact deltas as exact. ### #416 — Validation / Analysis Run consolidation @@ -101,7 +101,7 @@ GAP-107 remains inherited: RED `49343ab6e7f1a4cadc0b9c71e0757edea0256add` + repa ## Gap register -GAP-001–GAP-044 retain their existing domain/release identities and closure lineage. They remain unchanged by the GAP-108 numerical repair; their authoritative source/test/ADR history remains in repository ancestry and the surviving landing vehicles listed above. The validation lineage from GAP-045 onward is restated here because #488 is its current single writer. +GAP-001–GAP-044 retain their existing domain/release identities and closure lineage. They remain unchanged by the GAP-109 numerical repair; their authoritative source/test/ADR history remains in repository ancestry and the surviving landing vehicles listed above. The validation lineage from GAP-045 onward is restated here because #488 is its current single writer. | ID | Gap | Maturity | Closure evidence | | --- | --- | --- | --- | @@ -149,60 +149,60 @@ GAP-001–GAP-044 retain their existing domain/release identities and closure li | GAP-042 | ratio-first logarithm inflated adjacent-float growth rate | `verification-pending` | RED `766ddc7a...` + `ln_1p` repair `16f21d9a...` | | GAP-043 | duplicate known-truth identities could silently reweight RMSE | `verification-pending` | RED `698f12f5...` + repair `2fae4cb2...` | | GAP-044 | known-truth RMSE alignment depended on row order | `verification-pending` | RED `8ad72ac9...` / `5fb93c40...` + repairs `2dd9537e...` / `025dce7f...`; #310 `c6680450...` | -| GAP-045 | mean signed bias could reject representable result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; inherited by #488 `4514a073...` | -| GAP-046 | bias SE could reject representable SEM because raw squared deviations overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; inherited by #488 `4514a073...` | -| GAP-047 | generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; inherited by #488 `4514a073...` | -| GAP-048 | mean signed bias could erase representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; inherited by #488 `4514a073...` | +| GAP-045 | mean signed bias could reject representable result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; inherited by #488 `1eaac11e...` | +| GAP-046 | bias SE could reject representable SEM because raw squared deviations overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; inherited by #488 `1eaac11e...` | +| GAP-047 | generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; inherited by #488 `1eaac11e...` | +| GAP-048 | mean signed bias could erase representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; inherited by #488 `1eaac11e...` | | GAP-049 | stable `Between` recovery could be aliased across occasion indices and reweight RMSE | `verification-pending` | RED `0a03041c...` + repair `ec2c1219...`; #310 `c6680450...` | -| GAP-050 | zero-multiplier SE-aware acceptance could erase nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; inherited by #488 `4514a073...` | -| GAP-051 | exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; inherited by #488 `4514a073...` | -| GAP-052 | all-covered Wilson lower endpoint could cancel positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; inherited by #488 `4514a073...` | -| GAP-053 | strict-interior Wilson lower endpoint could cancel positive value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; inherited by #488 `4514a073...` | -| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; inherited by #488 `4514a073...` | -| GAP-055 | strict-interior Wilson lower endpoint could accept nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; inherited by #488 `4514a073...` | -| GAP-056 | durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; inherited by #488 `4514a073...` | -| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; inherited by #488 `4514a073...` | -| GAP-058 | generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; inherited by #488 `4514a073...` | -| GAP-059 | Monte Carlo summary could materially misstate positive SE relative to `SD/sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; inherited by #488 `4514a073...` | -| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; inherited by #488 `4514a073...` | -| GAP-061 | generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; inherited by #488 `4514a073...` | -| GAP-062 | finite-tolerance matching could fail for deterministically outside pair | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; inherited by #488 `4514a073...` | -| GAP-063 | exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; inherited by #488 `4514a073...` | -| GAP-064 | positive point RMSE could carry SE above squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; inherited by #488 `4514a073...` | -| GAP-065 | positive Monte Carlo RMSE could carry impossible spread/SE | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; inherited by #488 `4514a073...` | -| GAP-066 | RMSE nearest-rank percentile could exceed nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; inherited by #488 `4514a073...` | -| GAP-067 | generic nearest-rank endpoint could be incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected repair `2798e4f9...`; causal repair `c7151b49...`; inherited by #488 `4514a073...` | -| GAP-068 | distinct generic percentile endpoints could jointly exceed squared-deviation budget | `verification-pending` | RED `c4a13826...` + repair `cb3f80a2...`; inherited by #488 `4514a073...` | -| GAP-069 | two-replication endpoints could exhaust sample while mean/SD remained impossible | `verification-pending` | RED `81bf0d9e...` + repair `d48f8fef...`; inherited by #488 `4514a073...` | -| GAP-070 | stored Wilson pair could not arise from one score interval | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...`; inherited by #488 `4514a073...` | -| GAP-071 | durable Wilson evidence lacked denominator/critical-value/sidedness provenance | `active-repair` | carrier/authority/v1/envelope lineage; inherited by #488 `4514a073...`; durable-consumer adoption remains | -| GAP-072 | exact all-covered Wilson evidence could retain impossible zero lower endpoint | `verification-pending` | RED `ce714f07...` + repair `72e9d954...`; inherited by #488 `4514a073...` | -| GAP-073 | durable Wilson count provenance could lose one uncovered observation above exact-integer range | `verification-pending` | RED `29d710a5...` + count/fixed-width/exact-ratio repair lineage; inherited by #488 `4514a073...` | -| GAP-074 | durable exact count could be pre-rounded before endpoint projection | `verification-pending` | RED `f89e2467...` + reciprocal-scale repair `73bbb5cf...`; inherited by #488 `4514a073...` | -| GAP-075 | inexact all-covered Wilson miss mass could round to exact one | `verification-pending` | RED `059ce70d...` + canonical repair `0f478392...`; inherited by #488 `4514a073...` | -| GAP-076 | exact all-covered count could absorb small positive `z²` and emit exact `1.0` | `verification-pending` | RED `e0c4ec81...` + repair `c9dcb9df...`; inherited by #488 `4514a073...` | -| GAP-077 | inexact partial denominator could shift exact-count Wilson endpoint by one ULP | `verification-pending` | RED `06e55653...` + TwoSum/FMA repair `6c084dbe...`; inherited by #488 `4514a073...` | -| GAP-078 | Wilson residual compensation could move quotient across wrong midpoint | `verification-pending` | RED `d076d344...` + midpoint repair `32314239...`; inherited by #488 `4514a073...` | -| GAP-079 | SE-aware acceptance could underflow finite positive `k*SE` to zero through scale-first arithmetic | `verification-pending` | RED `76067efc...` + direct-finite repair `4ffdf366...`; inherited by #488 `4514a073...` | -| GAP-080 | both-overflow SE-aware fallback could round strict rejection into equality | `verification-pending` | RED `a9a45714...` + exact significand/exponent repair `425e8963...`; inherited by #488 `4514a073...` | -| GAP-081 | finite multiplication could round strict SE-aware rejection into equality | `verification-pending` | RED `23c3262c...` + tie repair `6a2add48...`; inherited by #488 `4514a073...` | -| GAP-082 | finite subtraction could round strict rejection onto exact bound | `verification-pending` | RED `58cbc032...` + low-term repair `68a6fd98...`; inherited by #488 `4514a073...` | -| GAP-083 | SE-aware product correction could fall below binary64 resolution | `verification-pending` | RED `b55c5473...` / `c77ac440...` + corrected repair `772ad8ed...`; inherited by #488 `4514a073...` | -| GAP-084 | legacy Wilson boundary could contradict peer endpoint root | `verification-pending` | RED `c9d612f2...` + peer-root repair `88512417...`; inherited by #488 `4514a073...` | -| GAP-085 | equal nonzero subtraction/FMA correction projections could conceal exact ordering | `verification-pending` | RED `35ea85ba...` + exact product-roundoff repair `7d597a18...`; inherited by #488 `4514a073...` | -| GAP-086 | mean bias could reject representable result because individual residuals overflow | `verification-pending` | RED `04e6e745...` + explicit-denominator cancellation/bias repair lineage; inherited by #488 `4514a073...` | -| GAP-087 | mixed-sign mean bias could discard repeated sub-ULP opposing mass | `verification-pending` | RED `63913727...` + low-term repair `5697cca5...`; inherited by #488 `4514a073...` | -| GAP-088 | mixed-remainder compensation could round before scientific count division | `verification-pending` | RED `8b4d19d1...` + compensated-division repair `7a33212b...`; inherited by #488 `4514a073...` | -| GAP-089 | exact cancellation could leave same-sign remainder rounded before division | `verification-pending` | RED `84476aad...` + repair `5f0d40b8...`; inherited by #488 `4514a073...` | -| GAP-090 | same-sign all-subnormal mean normalization could double-round final bias | `verification-pending` | RED `91abdb49...` + exact-unit repair `1c0df8a7...` + halfway coverage; inherited by #488 `4514a073...` | -| GAP-091 | pairwise subtraction roundoff could move mean bias across final midpoint | `verification-pending` | RED `a9d9bda3...` + corrected tail/midpoint repair `676ccda0...`; inherited by #488 `4514a073...` | -| GAP-092 | two distinct represented residuals could collapse to one subtraction and false-zero bias SE | `verification-pending` | RED `c9c55ea5...` + n=2 expanded-difference repair `f6d7da96...`; inherited by #488 `4514a073...` | -| GAP-093 | n>2 distinct represented residuals could collapse to one rounded high and false-zero bias SE | `verification-pending` | RED `06a70e1c...` + common-high/error-free-low repair `04c62514...`; inherited by #488 `4514a073...` | -| GAP-094 | separately rounded square roots could shift bias SE by one ULP | `verification-pending` | corrected RED `62243204...` + direct normalized-SE repair `8b8f0a21...`; inherited by #488 `4514a073...` | -| GAP-095 | distinct rounded residual highs could materially overstate uncertainty after subtraction roundoff | `verification-pending` | RED `ae906ad6...` + exact translated-residual repair `d59b9c30...`; inherited by #488 `4514a073...` | -| GAP-096 | exact residuals could be re-centered on rounded mean and distort dispersion | `verification-pending` | RED `9265b34a...` + exact-residual translated repair `2fa266b2...`; inherited by #488 `4514a073...` | -| GAP-097 | common-high subtraction path could round low-term mean before centering | `verification-pending` | RED `d48e2515...` + exact low-term translated-second-moment repair `a63b8d7a...`; inherited by #488 `4514a073...` | -| GAP-098 | exact translated-residual bias SE could double-round through a non-power normalization scale and move the final represented result by one ULP | `verification-pending` | RED `426fc5af...` + shared dyadic-scale prerequisite `d8b411f5...` + causal repair `d536e3b1...` + CHANGELOG `ebce979f...`; inherited by #488 `4514a073...` | +| GAP-050 | zero-multiplier SE-aware acceptance could erase nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; inherited by #488 `1eaac11e...` | +| GAP-051 | exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; inherited by #488 `1eaac11e...` | +| GAP-052 | all-covered Wilson lower endpoint could cancel positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; inherited by #488 `1eaac11e...` | +| GAP-053 | strict-interior Wilson lower endpoint could cancel positive value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; inherited by #488 `1eaac11e...` | +| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; inherited by #488 `1eaac11e...` | +| GAP-055 | strict-interior Wilson lower endpoint could accept nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; inherited by #488 `1eaac11e...` | +| GAP-056 | durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; inherited by #488 `1eaac11e...` | +| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; inherited by #488 `1eaac11e...` | +| GAP-058 | generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; inherited by #488 `1eaac11e...` | +| GAP-059 | Monte Carlo summary could materially misstate positive SE relative to `SD/sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; inherited by #488 `1eaac11e...` | +| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; inherited by #488 `1eaac11e...` | +| GAP-061 | generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; inherited by #488 `1eaac11e...` | +| GAP-062 | finite-tolerance matching could fail for deterministically outside pair | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; inherited by #488 `1eaac11e...` | +| GAP-063 | exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; inherited by #488 `1eaac11e...` | +| GAP-064 | positive point RMSE could carry SE above squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; inherited by #488 `1eaac11e...` | +| GAP-065 | positive Monte Carlo RMSE could carry impossible spread/SE | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; inherited by #488 `1eaac11e...` | +| GAP-066 | RMSE nearest-rank percentile could exceed nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; inherited by #488 `1eaac11e...` | +| GAP-067 | generic nearest-rank endpoint could be incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected repair `2798e4f9...`; causal repair `c7151b49...`; inherited by #488 `1eaac11e...` | +| GAP-068 | distinct generic percentile endpoints could jointly exceed squared-deviation budget | `verification-pending` | RED `c4a13826...` + repair `cb3f80a2...`; inherited by #488 `1eaac11e...` | +| GAP-069 | two-replication endpoints could exhaust sample while mean/SD remained impossible | `verification-pending` | RED `81bf0d9e...` + repair `d48f8fef...`; inherited by #488 `1eaac11e...` | +| GAP-070 | stored Wilson pair could not arise from one score interval | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...`; inherited by #488 `1eaac11e...` | +| GAP-071 | durable Wilson evidence lacked denominator/critical-value/sidedness provenance | `active-repair` | carrier/authority/v1/envelope lineage; inherited by #488 `1eaac11e...`; durable-consumer adoption remains | +| GAP-072 | exact all-covered Wilson evidence could retain impossible zero lower endpoint | `verification-pending` | RED `ce714f07...` + repair `72e9d954...`; inherited by #488 `1eaac11e...` | +| GAP-073 | durable Wilson count provenance could lose one uncovered observation above exact-integer range | `verification-pending` | RED `29d710a5...` + count/fixed-width/exact-ratio repair lineage; inherited by #488 `1eaac11e...` | +| GAP-074 | durable exact count could be pre-rounded before endpoint projection | `verification-pending` | RED `f89e2467...` + reciprocal-scale repair `73bbb5cf...`; inherited by #488 `1eaac11e...` | +| GAP-075 | inexact all-covered Wilson miss mass could round to exact one | `verification-pending` | RED `059ce70d...` + canonical repair `0f478392...`; inherited by #488 `1eaac11e...` | +| GAP-076 | exact all-covered count could absorb small positive `z²` and emit exact `1.0` | `verification-pending` | RED `e0c4ec81...` + repair `c9dcb9df...`; inherited by #488 `1eaac11e...` | +| GAP-077 | inexact partial denominator could shift exact-count Wilson endpoint by one ULP | `verification-pending` | RED `06e55653...` + TwoSum/FMA repair `6c084dbe...`; inherited by #488 `1eaac11e...` | +| GAP-078 | Wilson residual compensation could move quotient across wrong midpoint | `verification-pending` | RED `d076d344...` + midpoint repair `32314239...`; inherited by #488 `1eaac11e...` | +| GAP-079 | SE-aware acceptance could underflow finite positive `k*SE` to zero through scale-first arithmetic | `verification-pending` | RED `76067efc...` + direct-finite repair `4ffdf366...`; inherited by #488 `1eaac11e...` | +| GAP-080 | both-overflow SE-aware fallback could round strict rejection into equality | `verification-pending` | RED `a9a45714...` + exact significand/exponent repair `425e8963...`; inherited by #488 `1eaac11e...` | +| GAP-081 | finite multiplication could round strict SE-aware rejection into equality | `verification-pending` | RED `23c3262c...` + tie repair `6a2add48...`; inherited by #488 `1eaac11e...` | +| GAP-082 | finite subtraction could round strict rejection onto exact bound | `verification-pending` | RED `58cbc032...` + low-term repair `68a6fd98...`; inherited by #488 `1eaac11e...` | +| GAP-083 | SE-aware product correction could fall below binary64 resolution | `verification-pending` | RED `b55c5473...` / `c77ac440...` + corrected repair `772ad8ed...`; inherited by #488 `1eaac11e...` | +| GAP-084 | legacy Wilson boundary could contradict peer endpoint root | `verification-pending` | RED `c9d612f2...` + peer-root repair `88512417...`; inherited by #488 `1eaac11e...` | +| GAP-085 | equal nonzero subtraction/FMA correction projections could conceal exact ordering | `verification-pending` | RED `35ea85ba...` + exact product-roundoff repair `7d597a18...`; inherited by #488 `1eaac11e...` | +| GAP-086 | mean bias could reject representable result because individual residuals overflow | `verification-pending` | RED `04e6e745...` + explicit-denominator cancellation/bias repair lineage; inherited by #488 `1eaac11e...` | +| GAP-087 | mixed-sign mean bias could discard repeated sub-ULP opposing mass | `verification-pending` | RED `63913727...` + low-term repair `5697cca5...`; inherited by #488 `1eaac11e...` | +| GAP-088 | mixed-remainder compensation could round before scientific count division | `verification-pending` | RED `8b4d19d1...` + compensated-division repair `7a33212b...`; inherited by #488 `1eaac11e...` | +| GAP-089 | exact cancellation could leave same-sign remainder rounded before division | `verification-pending` | RED `84476aad...` + repair `5f0d40b8...`; inherited by #488 `1eaac11e...` | +| GAP-090 | same-sign all-subnormal mean normalization could double-round final bias | `verification-pending` | RED `91abdb49...` + exact-unit repair `1c0df8a7...` + halfway coverage; inherited by #488 `1eaac11e...` | +| GAP-091 | pairwise subtraction roundoff could move mean bias across final midpoint | `verification-pending` | RED `a9d9bda3...` + corrected tail/midpoint repair `676ccda0...`; inherited by #488 `1eaac11e...` | +| GAP-092 | two distinct represented residuals could collapse to one subtraction and false-zero bias SE | `verification-pending` | RED `c9c55ea5...` + n=2 expanded-difference repair `f6d7da96...`; inherited by #488 `1eaac11e...` | +| GAP-093 | n>2 distinct represented residuals could collapse to one rounded high and false-zero bias SE | `verification-pending` | RED `06a70e1c...` + common-high/error-free-low repair `04c62514...`; inherited by #488 `1eaac11e...` | +| GAP-094 | separately rounded square roots could shift bias SE by one ULP | `verification-pending` | corrected RED `62243204...` + direct normalized-SE repair `8b8f0a21...`; inherited by #488 `1eaac11e...` | +| GAP-095 | distinct rounded residual highs could materially overstate uncertainty after subtraction roundoff | `verification-pending` | RED `ae906ad6...` + exact translated-residual repair `d59b9c30...`; inherited by #488 `1eaac11e...` | +| GAP-096 | exact residuals could be re-centered on rounded mean and distort dispersion | `verification-pending` | RED `9265b34a...` + exact-residual translated repair `2fa266b2...`; inherited by #488 `1eaac11e...` | +| GAP-097 | common-high subtraction path could round low-term mean before centering | `verification-pending` | RED `d48e2515...` + exact low-term translated-second-moment repair `a63b8d7a...`; inherited by #488 `1eaac11e...` | +| GAP-098 | exact translated-residual bias SE could double-round through a non-power normalization scale and move the final represented result by one ULP | `verification-pending` | RED `426fc5af...` + shared dyadic-scale prerequisite `d8b411f5...` + causal repair `d536e3b1...` + CHANGELOG `ebce979f...`; inherited by #488 `1eaac11e...` | | GAP-099 | exact translated three-observation two-level bias SE could re-round an exact gap through square/second-moment/square-root and move the represented result by one ULP | `verification-pending` | RED `fbcdb7fa...` + causal repair `e0f2445d...` + CHANGELOG `ee81953e...` + research/ancestor #488 `7741aaa...`; exact-head hosted GREEN/review/main integration remain pending | | GAP-100 | exact translated two-level bias SE with one singleton could re-round an exact gap through square/second-moment/square-root beyond the n=3 case | `verification-pending` | RED `4386d9ac...` + causal repair `79ad03fa...` + edge `7fe4117c...` + CHANGELOG `017ad11...` + research/ancestor #488 `944fac05...`; exact-head hosted GREEN/review/main integration remain pending | | GAP-101 | exact two-observation residuals could be re-centered on a rounded midpoint mean and materially distort `SE(mean)` despite exact pairwise subtraction | `verification-pending` | RED `d3dcd918...` + causal repair `02b0a178...` + CHANGELOG `5603b12d...` + research/ancestor #488 `905addcc...`; exact-head hosted GREEN/review/main integration remain pending | @@ -212,8 +212,9 @@ GAP-001–GAP-044 retain their existing domain/release identities and closure li | GAP-105 | exact rational-square two-level bias SE could double-round when normal rational scaling restored into the subnormal result range | `verification-pending` | RED `8b7995d2...` + causal repair `ab0f0df1...` + public boundary `4daeb65d...` + branch coverage `8f6916dd...` + CHANGELOG `900b2091...` + research/ancestor #488 `edb84949...`; exact-head hosted GREEN/review/main integration remain pending | | GAP-106 | exact translated-residual bias SE could select a different numerical path solely because the first observation was or was not a viable exact translation anchor | `verification-pending` | RED `5cb45a4f...` + causal repair `159659a9...` + CHANGELOG `7e57b930...` + research/ancestor #488 `229fdd6e...`; permutation/sign-mirror contract added; exact-head hosted GREEN/review/main integration remain pending | | GAP-107 | several exact translated-residual anchors could expose different square/square-root conditioning and shift bias SE by one ULP even after permutation-invariant admission | `verification-pending` | RED `49343ab6...` + causal repair `0fc3ea97...` + CHANGELOG `2793ff59...` + research/ancestor #488 `e3ab2765...`; conditioning/permutation/sign-mirror contract added; exact-head hosted GREEN/review/main integration remain pending | -| GAP-108 | exact translated three-observation, three-level rational-square dispersion could be re-rounded through normalized moments and `sqrt` even after best-anchor selection | `verification-pending` | RED `32dcab84...` + causal repair `bee85e3d...` + all-permutation/sign-mirror contract `8260bc0b...` + CHANGELOG `5757dda1...` + research/current #488 `4514a073...`; exact-head hosted GREEN/review/main integration remain pending | +| GAP-108 | exact translated three-observation, three-level rational-square dispersion could be re-rounded through normalized moments and `sqrt` even after best-anchor selection | `verification-pending` | RED `32dcab84...` + causal repair `bee85e3d...` + all-permutation/sign-mirror contract `8260bc0b...` + CHANGELOG `5757dda1...` + research/ancestor #488 `4514a073...`; exact-head hosted GREEN/review/main integration remain pending | +| GAP-109 | exact translated three-observation rational-square bias-SE proof could reject the same represented geometry solely because exact power-of-two scaling overflowed raw square/cross-product intermediates | `verification-pending` | RED `67fa4852...` + causal repair `dcaf25b3...` + CHANGELOG `31b1aff8...` + research/current #488 `1eaac11e...`; all-permutation/sign-mirror scale-invariance contract; exact-head hosted GREEN/review/main integration remain pending | ## Release gate -TEPP currently has no GitHub release. Release is permitted only after a clean coherent vertical reaches protected main with exact protected-head CI/security evidence, scientific/recovery acceptance, reproducible package/build artifacts with SBOM and provenance, validated migrations/upgrade/rollback/recovery where applicable, consistent version metadata and current `CHANGELOG.md`, accessibility/operability evidence for user-facing components, no unresolved scientific/privacy/security/supply-chain blockers, and released integration contracts where deployment depends on them. Queued/pending/startup-failed/skipped or predecessor-head evidence is not GREEN. +TEPP currently has no GitHub release. Release is permitted only after a clean coherent vertical reaches protected main with exact protected-head CI/security evidence, scientific/recovery acceptance, reproducible package/build artifacts with SBOM and provenance, validated migrations/upgrade/rollback/recovery where applicable, consistent version metadata and current `CHANGELOG.md`, accessibility/operability evidence for user-facing components, no unresolved scientific/privacy/security/supply-chain blockers, and released integration contracts where deployment depends on them. Queued/pending/startup-failed/skipped or predecessor-head evidence is not GREEN. \ No newline at end of file From 06ec94ca2122922ab42083eab2c7ff895c99cea5 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 5 Sep 2026 19:11:34 +0900 Subject: [PATCH 204/235] docs(gaps): advance Validation Evidence to GAP-110 --- docs/product-technical-gap-baseline.md | 125 +++++++++++++------------ 1 file changed, 63 insertions(+), 62 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 123e2e955..ddc3fa5cc 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-05T08:58:14Z +**Snapshot:** 2026-09-05T10:07:30Z **Protected-main evidence:** `a243f18da4a4ca8a8d068c39922537f1f8ed6ad0` **Workspace version:** `0.2.0` @@ -30,7 +30,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `1eaac11e715144127048fc20033719777528c692` | true | `main` | Validation Evidence landing vehicle, based on protected #490. GAP-109 proves that GAP-108's exact three-observation rational-square identity must remain admissible under exact power-of-two scaling: raw square/cross-product overflow is not scientific evidence that the represented geometry changed. The bounded repair retries the same FMA/subtraction/root proof only after exactly reversible dyadic normalization when raw products overflow, then restores the proved root with the same exact scale. GAP-108 three-level rational-square dispersion, GAP-107 anchor conditioning, GAP-106 permutation invariance, and all earlier represented-input bias-SE, Wilson, provenance, Monte Carlo, RMSE/SE, matching, serde/projection repairs remain inherited. Hosted exact-head gates and independent review remain required. | +| #488 | `8bb3557298c77abb3dcbfed6844abf829531a727` | true | `main` | Validation Evidence landing vehicle, based on protected #490. GAP-110 proves that a nonzero exact three-observation dispersion must not become false zero merely because raw square/cross-product intermediates underflow below binary64 minimum-subnormal range. The bounded repair reuses GAP-109's exactly reversible dyadic proof retry when a mathematically nonzero product rounds to zero as well as when it overflows; if the normalized exact-root proof still fails, the existing translated second-moment path remains authoritative. GAP-109 scale invariance, GAP-108 three-level rational-square dispersion, GAP-107 anchor conditioning, GAP-106 permutation invariance, and all earlier represented-input bias-SE, Wilson, provenance, Monte Carlo, RMSE/SE, matching, serde/projection repairs remain inherited. Hosted exact-head gates and independent review remain required. | | #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 | Validation / Analysis Run fold child. Unique evidence must be inherited by a conflict-resolving survivor; child-head CI does not transfer. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | @@ -62,7 +62,7 @@ The clock contract separates event/valid time, assertion time, document time, sy - Row arrival order is not scientific evidence. Fixed admitted observations must produce bit-identical means/centered results under permutation wherever the contract claims deterministic CPU `f64` reference behavior. - Known-truth component recovery follows bounded-context identity: stable `Between` is unit-level and uses canonical `occasion_index = 0`; `Within` retains actual `(unit, occasion)` identity. Duplicate identities or stable-Between occasion aliases are not weights. - A representable final scientific estimand is not rejected solely because an avoidable intermediate binary64 operation overflows/underflows. False exact 0/1/non-finite endpoints, erased finite bounds, cancellation residues, and double-rounded endpoints are not accepted when a bounded equivalent operation preserves the represented estimand or decision. -- Mean signed bias and bias SE remain Validation Evidence performance measures over admitted recovery units. `mean_bias` uses the direct residual path only when every pairwise subtraction is finite and preserves represented low-order input mass; otherwise it uses the algebraically equivalent recovered-plus-negated-truth numerator, cancellation-safe exact-power-of-two scaling, and the original scientific denominator. `bias_standard_error` still requires each individual signed residual to be representable. For every two-observation sample, TEPP evaluates `SE(mean)=|r1-r2|/2` before a rounded residual mean can become authoritative; subtraction-roundoff cases use expanded represented inputs, while exact-subtraction cases use the represented residual difference through the cancellation/overflow-safe scientific denominator. For `n>2`, the exact translated-residual path is admitted only when anchor-relative high, low, and combined deltas are exactly representable. Every exact candidate anchor is evaluated; the candidate with the smallest maximum translated magnitude is selected, with canonical represented `(high, low)` order only as a deterministic tie-breaker. This retains GAP-106 permutation invariance while GAP-107 prevents an avoidably wide exact representation from becoming authoritative. Translation-invariant dispersion is then evaluated before any rounded residual mean becomes authoritative. GAP-098 requires exact power-of-two normalization; GAP-099 established the exact `n=3` two-level identity; GAP-100 generalized singleton/repeated-level geometry; GAP-102 established a reciprocal-power-of-two count shortcut; GAP-103 widened that to reciprocal-integer-square factors; GAP-104 generalized it to any reduced count factor satisfying `m(n-m)/(n^2(n-1))=(a/b)^2` with checked integer roots. GAP-105 additionally requires an admitted exact rational scale whose final represented value is subnormal to be rounded once in exact minimum-subnormal units rather than through normalized quotient plus scale restoration. GAP-108 adds the exact three-observation, three-level identity `SE(mean)^2=(x²+y²-xy)/9` only when the two nonzero translated offsets have error-free represented squares/cross-product, the sum/subtraction is error-free, and the numerator has an exact represented square root; only that proved root is divided by three once. GAP-109 makes that proof invariant to exact dyadic unit scaling: if raw square/cross-product intermediates overflow, the same proof is retried only after an exactly reversible power-of-two normalization, with exact reconstruction required before the normalized result can become authoritative. Results outside these bounded identities retain the existing translated second-moment or overflow-safe represented sum-over-count path. Count factors that are not exact rational squares and general multi-level samples retain `sqrt(sum(d²)/(n(n-1)))`; samples for which no candidate anchor proves exact translated deltas retain the bounded predecessor fallback. These are bounded repairs, not a claim of globally correctly rounded n>2 dispersion. Mathematically nonzero final results outside binary64 range fail closed. +- Mean signed bias and bias SE remain Validation Evidence performance measures over admitted recovery units. `mean_bias` uses the direct residual path only when every pairwise subtraction is finite and preserves represented low-order input mass; otherwise it uses the algebraically equivalent recovered-plus-negated-truth numerator, cancellation-safe exact-power-of-two scaling, and the original scientific denominator. `bias_standard_error` still requires each individual signed residual to be representable. For every two-observation sample, TEPP evaluates `SE(mean)=|r1-r2|/2` before a rounded residual mean can become authoritative; subtraction-roundoff cases use expanded represented inputs, while exact-subtraction cases use the represented residual difference through the cancellation/overflow-safe scientific denominator. For `n>2`, the exact translated-residual path is admitted only when anchor-relative high, low, and combined deltas are exactly representable. Every exact candidate anchor is evaluated; the candidate with the smallest maximum translated magnitude is selected, with canonical represented `(high, low)` order only as a deterministic tie-breaker. This retains GAP-106 permutation invariance while GAP-107 prevents an avoidably wide exact representation from becoming authoritative. Translation-invariant dispersion is then evaluated before any rounded residual mean becomes authoritative. GAP-098 requires exact power-of-two normalization; GAP-099 established the exact `n=3` two-level identity; GAP-100 generalized singleton/repeated-level geometry; GAP-102 established a reciprocal-power-of-two count shortcut; GAP-103 widened that to reciprocal-integer-square factors; GAP-104 generalized it to any reduced count factor satisfying `m(n-m)/(n^2(n-1))=(a/b)^2` with checked integer roots. GAP-105 additionally requires an admitted exact rational scale whose final represented value is subnormal to be rounded once in exact minimum-subnormal units rather than through normalized quotient plus scale restoration. GAP-108 adds the exact three-observation, three-level identity `SE(mean)^2=(x²+y²-xy)/9` only when the two nonzero translated offsets have error-free represented squares/cross-product, the sum/subtraction is error-free, and the numerator has an exact represented square root; only that proved root is divided by three once. GAP-109 makes that proof invariant to exact dyadic unit scaling: if raw square/cross-product intermediates overflow, the same proof is retried only after an exactly reversible power-of-two normalization, with exact reconstruction required before the normalized result can become authoritative. GAP-110 applies the same bounded retry when a mathematically nonzero raw square/cross-product underflows to represented zero; a zero FMA residual at a product already outside the destination range is not evidence of an exact-zero product. If the normalized exact-root proof still fails, the existing translated second-moment path is retained, preserving representable nonzero subnormal dispersion without widening the exact-identity claim. Results outside these bounded identities retain the existing translated second-moment or overflow-safe represented sum-over-count path. Count factors that are not exact rational squares and general multi-level samples retain `sqrt(sum(d²)/(n(n-1)))`; samples for which no candidate anchor proves exact translated deltas retain the bounded predecessor fallback. These are bounded repairs, not a claim of globally correctly rounded n>2 dispersion. Mathematically nonzero final results outside binary64 range fail closed. - Generic Validation Evidence RMSE and its delta-method SE normalize before squaring. Exact-zero point RMSE requires exact-zero point RMSE SE. For positive RMSE, the declared producer satisfies `SE(RMSE) <= RMSE / 2`, with a small relative binary64 admission tolerance. - Generic `MonteCarloSummary` is sign-neutral. Zero SD requires zero SE and percentile endpoints equal to the represented mean. Positive SD requires positive SE coherent with represented `SD / sqrt(n)` within a small relative tolerance. Every inclusive nearest-rank endpoint is a retained observation and satisfies `|endpoint - mean| <= SD * sqrt(n - 1)`. Distinct lower/upper endpoint values share the same `(n - 1) * SD²` deviation budget. When `replication_count=2` and endpoints are distinct, those endpoints exhaust the retained sample and must reconstruct the represented mean/sample SD. - When the generic carrier occupies `ValidationReport::monte_carlo_rmse`, retained replications are nonnegative; positive mean implies `SE(mean) <= mean`, and inclusive nearest-rank endpoints cannot exceed nonnegative sample-sum support `n * mean`. These typed bounds are not imposed on signed metrics such as bias. @@ -83,13 +83,13 @@ The clock contract separates event/valid time, assertion time, document time, sy ### #488 — Validation Evidence -#488 is the generic Validation Evidence landing vehicle at exact head `1eaac11e715144127048fc20033719777528c692`, based on protected #490. GAP-092–108 remain inherited and executable. +#488 is the generic Validation Evidence landing vehicle at exact head `8bb3557298c77abb3dcbfed6844abf829531a727`, based on protected #490. GAP-092–109 remain inherited and executable. -GAP-109 RED `67fa485248a8673f90bb71a43c2a58865a764383` fixes the exact `2^600` scaling of GAP-108: `truth=[0,0,0]`, `recovered=[0,5*2^590,21*2^590]`, represented as `0x0000000000000000`, `0x64f4000000000000`, `0x6515000000000000`. Its minimax exact translation is `[-5*2^590,0,16*2^590]`. The exact target is `(19/3072)*2^600`, bits `0x64f9_5555_5555_5555`; GAP-108's raw-product proof overflows and the predecessor fallback reconstructs normalized moments and `sqrt`, returning adjacent upper `0x64f9_5555_5555_5556`. +GAP-110 RED `fe013e7dbd9b6c99371fe28ff3f6aa2cb2915408` fixes the minimum-normal-scale sample `truth=[0,0,0]`, `recovered=[0,f64::MIN_POSITIVE,2*f64::MIN_POSITIVE]`. Its canonical exact translation is `[-m,0,m]`, `m=2^-1022`; exact `SE(mean)=m/sqrt(3)` is a nonzero subnormal with correctly rounded bits `0x0009_3cd3_a2c8_198e`. The GAP-109 helper formed raw squares/cross-product first. Their mathematically nonzero exact values lie below minimum-subnormal magnitude, round to signed zero, and their FMA residual checks also round to zero, allowing a false exact-zero radicand and `SE(mean)=0`. -Causal source repair `dcaf25b37d9860e7956de5429d3ef5894b129b49` retains the finite-product GAP-108 admission and retries the same proof after `exact_power_of_two_scale` normalization only when a raw square/cross-product overflows. Admission requires finite/nonzero preservation, exact scale reconstruction of both represented offsets, FMA-proven normalized products, error-free sum/subtraction, and an exact represented root. The normalized root is divided by three through the existing denominator primitive and restored by the exact dyadic scale. The public contract covers all six permutations and sign mirrors; failed proofs retain the predecessor translated path. CHANGELOG `31b1aff811703a41e3524e804d095be32621b004`; research/current #488 `1eaac11e715144127048fc20033719777528c692`. Fresh exact-head hosted execution and qualifying independent review remain required. +Causal source repair `d3660d44f1bc315e2e34ecfcfa74c26b8f1cd257` extends the existing GAP-109 normalization trigger only to nonzero square/cross-product results that leave represented range by underflowing to zero. The same exactly reversible `exact_power_of_two_scale` proof is retried; admission still requires exact offset reconstruction, finite/nonzero preservation, FMA-proven normalized products, error-free sum/subtraction, and an exact represented root. For GAP-110 the normalized radicand is `3`, so the direct identity declines and the predecessor translated second-moment path returns the correct nonzero subnormal. The public contract covers all six permutations and sign mirrors. CHANGELOG commit `ac833ec1a771586496a14083b62ca7c919e7f708`; research/current #488 `8bb3557298c77abb3dcbfed6844abf829531a727`. Fresh exact-head hosted execution and qualifying independent review remain required. -GAP-108 remains inherited: RED `32dcab8434a9676854f3a470094aadfc4f3f417d` + causal repair `bee85e3df044e13a2df6c077cc87706b6cd78402` + all-permutation/sign-mirror contract `8260bc0bff11abae2b05e0a85b5c1c374b8cbd49` established the bounded three-level rational-square identity. GAP-107 remains inherited: RED `49343ab6e7f1a4cadc0b9c71e0757edea0256add` + repair `0fc3ea97106f5156a6d68d4db8fd6f4a2ace0ac4` established conditioning-minimized exact-anchor selection after GAP-106 permutation-invariant admission. GAP-105 preserves exact rational-square subnormal projection; GAP-104 exact reduced rational-square count geometry such as `2/15`; GAP-103 the exact `1/6` reciprocal-integer case; GAP-102 the exact `1/8` dyadic case; GAP-101 the exact two-observation identity `SE(mean)=|r1-r2|/2`; GAP-100 the exact translated two-level singleton identity `SE(mean)=|level_gap|/n`; GAP-099 and GAP-098 retain their n=3 and dyadic-normalization repairs. GAP-109 does not widen the general n>2 correct-rounding claim or reclassify inexact deltas as exact. +GAP-109 remains inherited: RED `67fa485248a8673f90bb71a43c2a58865a764383` + repair `dcaf25b37d9860e7956de5429d3ef5894b129b49` + CHANGELOG `31b1aff811703a41e3524e804d095be32621b004` + research ancestor `1eaac11e715144127048fc20033719777528c692` established exact dyadic scale invariance for overflowing raw products. GAP-108 remains inherited: RED `32dcab8434a9676854f3a470094aadfc4f3f417d` + causal repair `bee85e3df044e13a2df6c077cc87706b6cd78402` + all-permutation/sign-mirror contract `8260bc0bff11abae2b05e0a85b5c1c374b8cbd49` established the bounded three-level rational-square identity. GAP-107 remains inherited: RED `49343ab6e7f1a4cadc0b9c71e0757edea0256add` + repair `0fc3ea97106f5156a6d68d4db8fd6f4a2ace0ac4` established conditioning-minimized exact-anchor selection after GAP-106 permutation-invariant admission. GAP-105 preserves exact rational-square subnormal projection; GAP-104 exact reduced rational-square count geometry such as `2/15`; GAP-103 the exact `1/6` reciprocal-integer case; GAP-102 the exact `1/8` dyadic case; GAP-101 the exact two-observation identity `SE(mean)=|r1-r2|/2`; GAP-100 the exact translated two-level singleton identity `SE(mean)=|level_gap|/n`; GAP-099 and GAP-098 retain their n=3 and dyadic-normalization repairs. GAP-110 does not widen the general n>2 correct-rounding claim or reclassify inexact deltas as exact. ### #416 — Validation / Analysis Run consolidation @@ -101,7 +101,7 @@ GAP-108 remains inherited: RED `32dcab8434a9676854f3a470094aadfc4f3f417d` + caus ## Gap register -GAP-001–GAP-044 retain their existing domain/release identities and closure lineage. They remain unchanged by the GAP-109 numerical repair; their authoritative source/test/ADR history remains in repository ancestry and the surviving landing vehicles listed above. The validation lineage from GAP-045 onward is restated here because #488 is its current single writer. +GAP-001–GAP-044 retain their existing domain/release identities and closure lineage. They remain unchanged by the GAP-110 numerical repair; their authoritative source/test/ADR history remains in repository ancestry and the surviving landing vehicles listed above. The validation lineage from GAP-045 onward is restated here because #488 is its current single writer. | ID | Gap | Maturity | Closure evidence | | --- | --- | --- | --- | @@ -149,60 +149,60 @@ GAP-001–GAP-044 retain their existing domain/release identities and closure li | GAP-042 | ratio-first logarithm inflated adjacent-float growth rate | `verification-pending` | RED `766ddc7a...` + `ln_1p` repair `16f21d9a...` | | GAP-043 | duplicate known-truth identities could silently reweight RMSE | `verification-pending` | RED `698f12f5...` + repair `2fae4cb2...` | | GAP-044 | known-truth RMSE alignment depended on row order | `verification-pending` | RED `8ad72ac9...` / `5fb93c40...` + repairs `2dd9537e...` / `025dce7f...`; #310 `c6680450...` | -| GAP-045 | mean signed bias could reject representable result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; inherited by #488 `1eaac11e...` | -| GAP-046 | bias SE could reject representable SEM because raw squared deviations overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; inherited by #488 `1eaac11e...` | -| GAP-047 | generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; inherited by #488 `1eaac11e...` | -| GAP-048 | mean signed bias could erase representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; inherited by #488 `1eaac11e...` | +| GAP-045 | mean signed bias could reject representable result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; inherited by #488 `8bb35572...` | +| GAP-046 | bias SE could reject representable SEM because raw squared deviations overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; inherited by #488 `8bb35572...` | +| GAP-047 | generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; inherited by #488 `8bb35572...` | +| GAP-048 | mean signed bias could erase representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; inherited by #488 `8bb35572...` | | GAP-049 | stable `Between` recovery could be aliased across occasion indices and reweight RMSE | `verification-pending` | RED `0a03041c...` + repair `ec2c1219...`; #310 `c6680450...` | -| GAP-050 | zero-multiplier SE-aware acceptance could erase nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; inherited by #488 `1eaac11e...` | -| GAP-051 | exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; inherited by #488 `1eaac11e...` | -| GAP-052 | all-covered Wilson lower endpoint could cancel positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; inherited by #488 `1eaac11e...` | -| GAP-053 | strict-interior Wilson lower endpoint could cancel positive value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; inherited by #488 `1eaac11e...` | -| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; inherited by #488 `1eaac11e...` | -| GAP-055 | strict-interior Wilson lower endpoint could accept nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; inherited by #488 `1eaac11e...` | -| GAP-056 | durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; inherited by #488 `1eaac11e...` | -| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; inherited by #488 `1eaac11e...` | -| GAP-058 | generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; inherited by #488 `1eaac11e...` | -| GAP-059 | Monte Carlo summary could materially misstate positive SE relative to `SD/sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; inherited by #488 `1eaac11e...` | -| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; inherited by #488 `1eaac11e...` | -| GAP-061 | generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; inherited by #488 `1eaac11e...` | -| GAP-062 | finite-tolerance matching could fail for deterministically outside pair | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; inherited by #488 `1eaac11e...` | -| GAP-063 | exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; inherited by #488 `1eaac11e...` | -| GAP-064 | positive point RMSE could carry SE above squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; inherited by #488 `1eaac11e...` | -| GAP-065 | positive Monte Carlo RMSE could carry impossible spread/SE | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; inherited by #488 `1eaac11e...` | -| GAP-066 | RMSE nearest-rank percentile could exceed nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; inherited by #488 `1eaac11e...` | -| GAP-067 | generic nearest-rank endpoint could be incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected repair `2798e4f9...`; causal repair `c7151b49...`; inherited by #488 `1eaac11e...` | -| GAP-068 | distinct generic percentile endpoints could jointly exceed squared-deviation budget | `verification-pending` | RED `c4a13826...` + repair `cb3f80a2...`; inherited by #488 `1eaac11e...` | -| GAP-069 | two-replication endpoints could exhaust sample while mean/SD remained impossible | `verification-pending` | RED `81bf0d9e...` + repair `d48f8fef...`; inherited by #488 `1eaac11e...` | -| GAP-070 | stored Wilson pair could not arise from one score interval | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...`; inherited by #488 `1eaac11e...` | -| GAP-071 | durable Wilson evidence lacked denominator/critical-value/sidedness provenance | `active-repair` | carrier/authority/v1/envelope lineage; inherited by #488 `1eaac11e...`; durable-consumer adoption remains | -| GAP-072 | exact all-covered Wilson evidence could retain impossible zero lower endpoint | `verification-pending` | RED `ce714f07...` + repair `72e9d954...`; inherited by #488 `1eaac11e...` | -| GAP-073 | durable Wilson count provenance could lose one uncovered observation above exact-integer range | `verification-pending` | RED `29d710a5...` + count/fixed-width/exact-ratio repair lineage; inherited by #488 `1eaac11e...` | -| GAP-074 | durable exact count could be pre-rounded before endpoint projection | `verification-pending` | RED `f89e2467...` + reciprocal-scale repair `73bbb5cf...`; inherited by #488 `1eaac11e...` | -| GAP-075 | inexact all-covered Wilson miss mass could round to exact one | `verification-pending` | RED `059ce70d...` + canonical repair `0f478392...`; inherited by #488 `1eaac11e...` | -| GAP-076 | exact all-covered count could absorb small positive `z²` and emit exact `1.0` | `verification-pending` | RED `e0c4ec81...` + repair `c9dcb9df...`; inherited by #488 `1eaac11e...` | -| GAP-077 | inexact partial denominator could shift exact-count Wilson endpoint by one ULP | `verification-pending` | RED `06e55653...` + TwoSum/FMA repair `6c084dbe...`; inherited by #488 `1eaac11e...` | -| GAP-078 | Wilson residual compensation could move quotient across wrong midpoint | `verification-pending` | RED `d076d344...` + midpoint repair `32314239...`; inherited by #488 `1eaac11e...` | -| GAP-079 | SE-aware acceptance could underflow finite positive `k*SE` to zero through scale-first arithmetic | `verification-pending` | RED `76067efc...` + direct-finite repair `4ffdf366...`; inherited by #488 `1eaac11e...` | -| GAP-080 | both-overflow SE-aware fallback could round strict rejection into equality | `verification-pending` | RED `a9a45714...` + exact significand/exponent repair `425e8963...`; inherited by #488 `1eaac11e...` | -| GAP-081 | finite multiplication could round strict SE-aware rejection into equality | `verification-pending` | RED `23c3262c...` + tie repair `6a2add48...`; inherited by #488 `1eaac11e...` | -| GAP-082 | finite subtraction could round strict rejection onto exact bound | `verification-pending` | RED `58cbc032...` + low-term repair `68a6fd98...`; inherited by #488 `1eaac11e...` | -| GAP-083 | SE-aware product correction could fall below binary64 resolution | `verification-pending` | RED `b55c5473...` / `c77ac440...` + corrected repair `772ad8ed...`; inherited by #488 `1eaac11e...` | -| GAP-084 | legacy Wilson boundary could contradict peer endpoint root | `verification-pending` | RED `c9d612f2...` + peer-root repair `88512417...`; inherited by #488 `1eaac11e...` | -| GAP-085 | equal nonzero subtraction/FMA correction projections could conceal exact ordering | `verification-pending` | RED `35ea85ba...` + exact product-roundoff repair `7d597a18...`; inherited by #488 `1eaac11e...` | -| GAP-086 | mean bias could reject representable result because individual residuals overflow | `verification-pending` | RED `04e6e745...` + explicit-denominator cancellation/bias repair lineage; inherited by #488 `1eaac11e...` | -| GAP-087 | mixed-sign mean bias could discard repeated sub-ULP opposing mass | `verification-pending` | RED `63913727...` + low-term repair `5697cca5...`; inherited by #488 `1eaac11e...` | -| GAP-088 | mixed-remainder compensation could round before scientific count division | `verification-pending` | RED `8b4d19d1...` + compensated-division repair `7a33212b...`; inherited by #488 `1eaac11e...` | -| GAP-089 | exact cancellation could leave same-sign remainder rounded before division | `verification-pending` | RED `84476aad...` + repair `5f0d40b8...`; inherited by #488 `1eaac11e...` | -| GAP-090 | same-sign all-subnormal mean normalization could double-round final bias | `verification-pending` | RED `91abdb49...` + exact-unit repair `1c0df8a7...` + halfway coverage; inherited by #488 `1eaac11e...` | -| GAP-091 | pairwise subtraction roundoff could move mean bias across final midpoint | `verification-pending` | RED `a9d9bda3...` + corrected tail/midpoint repair `676ccda0...`; inherited by #488 `1eaac11e...` | -| GAP-092 | two distinct represented residuals could collapse to one subtraction and false-zero bias SE | `verification-pending` | RED `c9c55ea5...` + n=2 expanded-difference repair `f6d7da96...`; inherited by #488 `1eaac11e...` | -| GAP-093 | n>2 distinct represented residuals could collapse to one rounded high and false-zero bias SE | `verification-pending` | RED `06a70e1c...` + common-high/error-free-low repair `04c62514...`; inherited by #488 `1eaac11e...` | -| GAP-094 | separately rounded square roots could shift bias SE by one ULP | `verification-pending` | corrected RED `62243204...` + direct normalized-SE repair `8b8f0a21...`; inherited by #488 `1eaac11e...` | -| GAP-095 | distinct rounded residual highs could materially overstate uncertainty after subtraction roundoff | `verification-pending` | RED `ae906ad6...` + exact translated-residual repair `d59b9c30...`; inherited by #488 `1eaac11e...` | -| GAP-096 | exact residuals could be re-centered on rounded mean and distort dispersion | `verification-pending` | RED `9265b34a...` + exact-residual translated repair `2fa266b2...`; inherited by #488 `1eaac11e...` | -| GAP-097 | common-high subtraction path could round low-term mean before centering | `verification-pending` | RED `d48e2515...` + exact low-term translated-second-moment repair `a63b8d7a...`; inherited by #488 `1eaac11e...` | -| GAP-098 | exact translated-residual bias SE could double-round through a non-power normalization scale and move the final represented result by one ULP | `verification-pending` | RED `426fc5af...` + shared dyadic-scale prerequisite `d8b411f5...` + causal repair `d536e3b1...` + CHANGELOG `ebce979f...`; inherited by #488 `1eaac11e...` | +| GAP-050 | zero-multiplier SE-aware acceptance could erase nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; inherited by #488 `8bb35572...` | +| GAP-051 | exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; inherited by #488 `8bb35572...` | +| GAP-052 | all-covered Wilson lower endpoint could cancel positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; inherited by #488 `8bb35572...` | +| GAP-053 | strict-interior Wilson lower endpoint could cancel positive value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; inherited by #488 `8bb35572...` | +| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; inherited by #488 `8bb35572...` | +| GAP-055 | strict-interior Wilson lower endpoint could accept nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; inherited by #488 `8bb35572...` | +| GAP-056 | durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; inherited by #488 `8bb35572...` | +| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; inherited by #488 `8bb35572...` | +| GAP-058 | generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; inherited by #488 `8bb35572...` | +| GAP-059 | Monte Carlo summary could materially misstate positive SE relative to `SD/sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; inherited by #488 `8bb35572...` | +| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; inherited by #488 `8bb35572...` | +| GAP-061 | generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; inherited by #488 `8bb35572...` | +| GAP-062 | finite-tolerance matching could fail for deterministically outside pair | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; inherited by #488 `8bb35572...` | +| GAP-063 | exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; inherited by #488 `8bb35572...` | +| GAP-064 | positive point RMSE could carry SE above squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; inherited by #488 `8bb35572...` | +| GAP-065 | positive Monte Carlo RMSE could carry impossible spread/SE | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; inherited by #488 `8bb35572...` | +| GAP-066 | RMSE nearest-rank percentile could exceed nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; inherited by #488 `8bb35572...` | +| GAP-067 | generic nearest-rank endpoint could be incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected repair `2798e4f9...`; causal repair `c7151b49...`; inherited by #488 `8bb35572...` | +| GAP-068 | distinct generic percentile endpoints could jointly exceed squared-deviation budget | `verification-pending` | RED `c4a13826...` + repair `cb3f80a2...`; inherited by #488 `8bb35572...` | +| GAP-069 | two-replication endpoints could exhaust sample while mean/SD remained impossible | `verification-pending` | RED `81bf0d9e...` + repair `d48f8fef...`; inherited by #488 `8bb35572...` | +| GAP-070 | stored Wilson pair could not arise from one score interval | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...`; inherited by #488 `8bb35572...` | +| GAP-071 | durable Wilson evidence lacked denominator/critical-value/sidedness provenance | `active-repair` | carrier/authority/v1/envelope lineage; inherited by #488 `8bb35572...`; durable-consumer adoption remains | +| GAP-072 | exact all-covered Wilson evidence could retain impossible zero lower endpoint | `verification-pending` | RED `ce714f07...` + repair `72e9d954...`; inherited by #488 `8bb35572...` | +| GAP-073 | durable Wilson count provenance could lose one uncovered observation above exact-integer range | `verification-pending` | RED `29d710a5...` + count/fixed-width/exact-ratio repair lineage; inherited by #488 `8bb35572...` | +| GAP-074 | durable exact count could be pre-rounded before endpoint projection | `verification-pending` | RED `f89e2467...` + reciprocal-scale repair `73bbb5cf...`; inherited by #488 `8bb35572...` | +| GAP-075 | inexact all-covered Wilson miss mass could round to exact one | `verification-pending` | RED `059ce70d...` + canonical repair `0f478392...`; inherited by #488 `8bb35572...` | +| GAP-076 | exact all-covered count could absorb small positive `z²` and emit exact `1.0` | `verification-pending` | RED `e0c4ec81...` + repair `c9dcb9df...`; inherited by #488 `8bb35572...` | +| GAP-077 | inexact partial denominator could shift exact-count Wilson endpoint by one ULP | `verification-pending` | RED `06e55653...` + TwoSum/FMA repair `6c084dbe...`; inherited by #488 `8bb35572...` | +| GAP-078 | Wilson residual compensation could move quotient across wrong midpoint | `verification-pending` | RED `d076d344...` + midpoint repair `32314239...`; inherited by #488 `8bb35572...` | +| GAP-079 | SE-aware acceptance could underflow finite positive `k*SE` to zero through scale-first arithmetic | `verification-pending` | RED `76067efc...` + direct-finite repair `4ffdf366...`; inherited by #488 `8bb35572...` | +| GAP-080 | both-overflow SE-aware fallback could round strict rejection into equality | `verification-pending` | RED `a9a45714...` + exact significand/exponent repair `425e8963...`; inherited by #488 `8bb35572...` | +| GAP-081 | finite multiplication could round strict SE-aware rejection into equality | `verification-pending` | RED `23c3262c...` + tie repair `6a2add48...`; inherited by #488 `8bb35572...` | +| GAP-082 | finite subtraction could round strict rejection onto exact bound | `verification-pending` | RED `58cbc032...` + low-term repair `68a6fd98...`; inherited by #488 `8bb35572...` | +| GAP-083 | SE-aware product correction could fall below binary64 resolution | `verification-pending` | RED `b55c5473...` / `c77ac440...` + corrected repair `772ad8ed...`; inherited by #488 `8bb35572...` | +| GAP-084 | legacy Wilson boundary could contradict peer endpoint root | `verification-pending` | RED `c9d612f2...` + peer-root repair `88512417...`; inherited by #488 `8bb35572...` | +| GAP-085 | equal nonzero subtraction/FMA correction projections could conceal exact ordering | `verification-pending` | RED `35ea85ba...` + exact product-roundoff repair `7d597a18...`; inherited by #488 `8bb35572...` | +| GAP-086 | mean bias could reject representable result because individual residuals overflow | `verification-pending` | RED `04e6e745...` + explicit-denominator cancellation/bias repair lineage; inherited by #488 `8bb35572...` | +| GAP-087 | mixed-sign mean bias could discard repeated sub-ULP opposing mass | `verification-pending` | RED `63913727...` + low-term repair `5697cca5...`; inherited by #488 `8bb35572...` | +| GAP-088 | mixed-remainder compensation could round before scientific count division | `verification-pending` | RED `8b4d19d1...` + compensated-division repair `7a33212b...`; inherited by #488 `8bb35572...` | +| GAP-089 | exact cancellation could leave same-sign remainder rounded before division | `verification-pending` | RED `84476aad...` + repair `5f0d40b8...`; inherited by #488 `8bb35572...` | +| GAP-090 | same-sign all-subnormal mean normalization could double-round final bias | `verification-pending` | RED `91abdb49...` + exact-unit repair `1c0df8a7...` + halfway coverage; inherited by #488 `8bb35572...` | +| GAP-091 | pairwise subtraction roundoff could move mean bias across final midpoint | `verification-pending` | RED `a9d9bda3...` + corrected tail/midpoint repair `676ccda0...`; inherited by #488 `8bb35572...` | +| GAP-092 | two distinct represented residuals could collapse to one subtraction and false-zero bias SE | `verification-pending` | RED `c9c55ea5...` + n=2 expanded-difference repair `f6d7da96...`; inherited by #488 `8bb35572...` | +| GAP-093 | n>2 distinct represented residuals could collapse to one rounded high and false-zero bias SE | `verification-pending` | RED `06a70e1c...` + common-high/error-free-low repair `04c62514...`; inherited by #488 `8bb35572...` | +| GAP-094 | separately rounded square roots could shift bias SE by one ULP | `verification-pending` | corrected RED `62243204...` + direct normalized-SE repair `8b8f0a21...`; inherited by #488 `8bb35572...` | +| GAP-095 | distinct rounded residual highs could materially overstate uncertainty after subtraction roundoff | `verification-pending` | RED `ae906ad6...` + exact translated-residual repair `d59b9c30...`; inherited by #488 `8bb35572...` | +| GAP-096 | exact residuals could be re-centered on rounded mean and distort dispersion | `verification-pending` | RED `9265b34a...` + exact-residual translated repair `2fa266b2...`; inherited by #488 `8bb35572...` | +| GAP-097 | common-high subtraction path could round low-term mean before centering | `verification-pending` | RED `d48e2515...` + exact low-term translated-second-moment repair `a63b8d7a...`; inherited by #488 `8bb35572...` | +| GAP-098 | exact translated-residual bias SE could double-round through a non-power normalization scale and move the final represented result by one ULP | `verification-pending` | RED `426fc5af...` + shared dyadic-scale prerequisite `d8b411f5...` + causal repair `d536e3b1...` + CHANGELOG `ebce979f...`; inherited by #488 `8bb35572...` | | GAP-099 | exact translated three-observation two-level bias SE could re-round an exact gap through square/second-moment/square-root and move the represented result by one ULP | `verification-pending` | RED `fbcdb7fa...` + causal repair `e0f2445d...` + CHANGELOG `ee81953e...` + research/ancestor #488 `7741aaa...`; exact-head hosted GREEN/review/main integration remain pending | | GAP-100 | exact translated two-level bias SE with one singleton could re-round an exact gap through square/second-moment/square-root beyond the n=3 case | `verification-pending` | RED `4386d9ac...` + causal repair `79ad03fa...` + edge `7fe4117c...` + CHANGELOG `017ad11...` + research/ancestor #488 `944fac05...`; exact-head hosted GREEN/review/main integration remain pending | | GAP-101 | exact two-observation residuals could be re-centered on a rounded midpoint mean and materially distort `SE(mean)` despite exact pairwise subtraction | `verification-pending` | RED `d3dcd918...` + causal repair `02b0a178...` + CHANGELOG `5603b12d...` + research/ancestor #488 `905addcc...`; exact-head hosted GREEN/review/main integration remain pending | @@ -213,7 +213,8 @@ GAP-001–GAP-044 retain their existing domain/release identities and closure li | GAP-106 | exact translated-residual bias SE could select a different numerical path solely because the first observation was or was not a viable exact translation anchor | `verification-pending` | RED `5cb45a4f...` + causal repair `159659a9...` + CHANGELOG `7e57b930...` + research/ancestor #488 `229fdd6e...`; permutation/sign-mirror contract added; exact-head hosted GREEN/review/main integration remain pending | | GAP-107 | several exact translated-residual anchors could expose different square/square-root conditioning and shift bias SE by one ULP even after permutation-invariant admission | `verification-pending` | RED `49343ab6...` + causal repair `0fc3ea97...` + CHANGELOG `2793ff59...` + research/ancestor #488 `e3ab2765...`; conditioning/permutation/sign-mirror contract added; exact-head hosted GREEN/review/main integration remain pending | | GAP-108 | exact translated three-observation, three-level rational-square dispersion could be re-rounded through normalized moments and `sqrt` even after best-anchor selection | `verification-pending` | RED `32dcab84...` + causal repair `bee85e3d...` + all-permutation/sign-mirror contract `8260bc0b...` + CHANGELOG `5757dda1...` + research/ancestor #488 `4514a073...`; exact-head hosted GREEN/review/main integration remain pending | -| GAP-109 | exact translated three-observation rational-square bias-SE proof could reject the same represented geometry solely because exact power-of-two scaling overflowed raw square/cross-product intermediates | `verification-pending` | RED `67fa4852...` + causal repair `dcaf25b3...` + CHANGELOG `31b1aff8...` + research/current #488 `1eaac11e...`; all-permutation/sign-mirror scale-invariance contract; exact-head hosted GREEN/review/main integration remain pending | +| GAP-109 | exact translated three-observation rational-square bias-SE proof could reject the same represented geometry solely because exact power-of-two scaling overflowed raw square/cross-product intermediates | `verification-pending` | RED `67fa4852...` + causal repair `dcaf25b3...` + CHANGELOG `31b1aff8...` + research/ancestor #488 `1eaac11e...`; all-permutation/sign-mirror scale-invariance contract; exact-head hosted GREEN/review/main integration remain pending | +| GAP-110 | exact translated three-observation bias SE could falsely become zero when mathematically nonzero square/cross-product intermediates underflowed below binary64 range before the bounded exact proof | `verification-pending` | RED `fe013e7d...` + causal repair `d3660d44...` + CHANGELOG `ac833ec1...` + research/current #488 `8bb35572...`; all-permutation/sign-mirror underflow-scale contract; exact-head hosted GREEN/review/main integration remain pending | ## Release gate From a83a332431a568c27dff507d9996e1d7824058b7 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 5 Sep 2026 20:22:14 +0900 Subject: [PATCH 205/235] docs(gaps): advance Validation Evidence baseline through GAP-111 --- docs/product-technical-gap-baseline.md | 125 +++++++++++++------------ 1 file changed, 63 insertions(+), 62 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index ddc3fa5cc..50aed09b0 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-05T10:07:30Z +**Snapshot:** 2026-09-05T11:18:30Z **Protected-main evidence:** `a243f18da4a4ca8a8d068c39922537f1f8ed6ad0` **Workspace version:** `0.2.0` @@ -30,7 +30,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `8bb3557298c77abb3dcbfed6844abf829531a727` | true | `main` | Validation Evidence landing vehicle, based on protected #490. GAP-110 proves that a nonzero exact three-observation dispersion must not become false zero merely because raw square/cross-product intermediates underflow below binary64 minimum-subnormal range. The bounded repair reuses GAP-109's exactly reversible dyadic proof retry when a mathematically nonzero product rounds to zero as well as when it overflows; if the normalized exact-root proof still fails, the existing translated second-moment path remains authoritative. GAP-109 scale invariance, GAP-108 three-level rational-square dispersion, GAP-107 anchor conditioning, GAP-106 permutation invariance, and all earlier represented-input bias-SE, Wilson, provenance, Monte Carlo, RMSE/SE, matching, serde/projection repairs remain inherited. Hosted exact-head gates and independent review remain required. | +| #488 | `0857d5a432e86ca13193886babece6396c98b7f3` | true | `main` | Validation Evidence landing vehicle, based on protected #490. GAP-111 proves that an exact four-observation pair-distance dispersion can still be shifted by one ULP when the exact rational radicand is rounded before `sqrt`. The bounded repair admits `SE(mean)^2 = Σ pair_distance² / 48` only when represented residuals and pairwise differences are error-free and the dyadic integer/midpoint proof fits bounded `u128`; otherwise the established GAP-110 fallback remains authoritative. GAP-110 underflow protection, GAP-109 scale invariance, GAP-108 three-level rational-square dispersion, GAP-107 anchor conditioning, GAP-106 permutation invariance, and all earlier represented-input bias-SE, Wilson, provenance, Monte Carlo, RMSE/SE, matching, serde/projection repairs remain inherited. Hosted exact-head gates and independent review remain required. | | #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 | Validation / Analysis Run fold child. Unique evidence must be inherited by a conflict-resolving survivor; child-head CI does not transfer. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | @@ -62,7 +62,7 @@ The clock contract separates event/valid time, assertion time, document time, sy - Row arrival order is not scientific evidence. Fixed admitted observations must produce bit-identical means/centered results under permutation wherever the contract claims deterministic CPU `f64` reference behavior. - Known-truth component recovery follows bounded-context identity: stable `Between` is unit-level and uses canonical `occasion_index = 0`; `Within` retains actual `(unit, occasion)` identity. Duplicate identities or stable-Between occasion aliases are not weights. - A representable final scientific estimand is not rejected solely because an avoidable intermediate binary64 operation overflows/underflows. False exact 0/1/non-finite endpoints, erased finite bounds, cancellation residues, and double-rounded endpoints are not accepted when a bounded equivalent operation preserves the represented estimand or decision. -- Mean signed bias and bias SE remain Validation Evidence performance measures over admitted recovery units. `mean_bias` uses the direct residual path only when every pairwise subtraction is finite and preserves represented low-order input mass; otherwise it uses the algebraically equivalent recovered-plus-negated-truth numerator, cancellation-safe exact-power-of-two scaling, and the original scientific denominator. `bias_standard_error` still requires each individual signed residual to be representable. For every two-observation sample, TEPP evaluates `SE(mean)=|r1-r2|/2` before a rounded residual mean can become authoritative; subtraction-roundoff cases use expanded represented inputs, while exact-subtraction cases use the represented residual difference through the cancellation/overflow-safe scientific denominator. For `n>2`, the exact translated-residual path is admitted only when anchor-relative high, low, and combined deltas are exactly representable. Every exact candidate anchor is evaluated; the candidate with the smallest maximum translated magnitude is selected, with canonical represented `(high, low)` order only as a deterministic tie-breaker. This retains GAP-106 permutation invariance while GAP-107 prevents an avoidably wide exact representation from becoming authoritative. Translation-invariant dispersion is then evaluated before any rounded residual mean becomes authoritative. GAP-098 requires exact power-of-two normalization; GAP-099 established the exact `n=3` two-level identity; GAP-100 generalized singleton/repeated-level geometry; GAP-102 established a reciprocal-power-of-two count shortcut; GAP-103 widened that to reciprocal-integer-square factors; GAP-104 generalized it to any reduced count factor satisfying `m(n-m)/(n^2(n-1))=(a/b)^2` with checked integer roots. GAP-105 additionally requires an admitted exact rational scale whose final represented value is subnormal to be rounded once in exact minimum-subnormal units rather than through normalized quotient plus scale restoration. GAP-108 adds the exact three-observation, three-level identity `SE(mean)^2=(x²+y²-xy)/9` only when the two nonzero translated offsets have error-free represented squares/cross-product, the sum/subtraction is error-free, and the numerator has an exact represented square root; only that proved root is divided by three once. GAP-109 makes that proof invariant to exact dyadic unit scaling: if raw square/cross-product intermediates overflow, the same proof is retried only after an exactly reversible power-of-two normalization, with exact reconstruction required before the normalized result can become authoritative. GAP-110 applies the same bounded retry when a mathematically nonzero raw square/cross-product underflows to represented zero; a zero FMA residual at a product already outside the destination range is not evidence of an exact-zero product. If the normalized exact-root proof still fails, the existing translated second-moment path is retained, preserving representable nonzero subnormal dispersion without widening the exact-identity claim. Results outside these bounded identities retain the existing translated second-moment or overflow-safe represented sum-over-count path. Count factors that are not exact rational squares and general multi-level samples retain `sqrt(sum(d²)/(n(n-1)))`; samples for which no candidate anchor proves exact translated deltas retain the bounded predecessor fallback. These are bounded repairs, not a claim of globally correctly rounded n>2 dispersion. Mathematically nonzero final results outside binary64 range fail closed. +- Mean signed bias and bias SE remain Validation Evidence performance measures over admitted recovery units. `mean_bias` uses the direct residual path only when every pairwise subtraction is finite and preserves represented low-order input mass; otherwise it uses the algebraically equivalent recovered-plus-negated-truth numerator, cancellation-safe exact-power-of-two scaling, and the original scientific denominator. `bias_standard_error` still requires each individual signed residual to be representable. For every two-observation sample, TEPP evaluates `SE(mean)=|r1-r2|/2` before a rounded residual mean can become authoritative; subtraction-roundoff cases use expanded represented inputs, while exact-subtraction cases use the represented residual difference through the cancellation/overflow-safe scientific denominator. For `n>2`, the exact translated-residual path is admitted only when anchor-relative high, low, and combined deltas are exactly representable. Every exact candidate anchor is evaluated; the candidate with the smallest maximum translated magnitude is selected, with canonical represented `(high, low)` order only as a deterministic tie-breaker. This retains GAP-106 permutation invariance while GAP-107 prevents an avoidably wide exact representation from becoming authoritative. Translation-invariant dispersion is then evaluated before any rounded residual mean becomes authoritative. GAP-098 requires exact power-of-two normalization; GAP-099 established the exact `n=3` two-level identity; GAP-100 generalized singleton/repeated-level geometry; GAP-102 established a reciprocal-power-of-two count shortcut; GAP-103 widened that to reciprocal-integer-square factors; GAP-104 generalized it to any reduced count factor satisfying `m(n-m)/(n^2(n-1))=(a/b)^2` with checked integer roots. GAP-105 additionally requires an admitted exact rational scale whose final represented value is subnormal to be rounded once in exact minimum-subnormal units rather than through normalized quotient plus scale restoration. GAP-108 adds the exact three-observation, three-level identity `SE(mean)^2=(x²+y²-xy)/9` only when the two nonzero translated offsets have error-free represented squares/cross-product, the sum/subtraction is error-free, and the numerator has an exact represented square root; only that proved root is divided by three once. GAP-109 makes that proof invariant to exact dyadic unit scaling: if raw square/cross-product intermediates overflow, the same proof is retried only after an exactly reversible power-of-two normalization, with exact reconstruction required before the normalized result can become authoritative. GAP-110 applies the same bounded retry when a mathematically nonzero raw square/cross-product underflows to represented zero; a zero FMA residual at a product already outside the destination range is not evidence of an exact-zero product. GAP-111 adds an exact four-observation pair-distance identity `SE(mean)^2=Σ_{i2 dispersion. Mathematically nonzero final results outside binary64 range fail closed. - Generic Validation Evidence RMSE and its delta-method SE normalize before squaring. Exact-zero point RMSE requires exact-zero point RMSE SE. For positive RMSE, the declared producer satisfies `SE(RMSE) <= RMSE / 2`, with a small relative binary64 admission tolerance. - Generic `MonteCarloSummary` is sign-neutral. Zero SD requires zero SE and percentile endpoints equal to the represented mean. Positive SD requires positive SE coherent with represented `SD / sqrt(n)` within a small relative tolerance. Every inclusive nearest-rank endpoint is a retained observation and satisfies `|endpoint - mean| <= SD * sqrt(n - 1)`. Distinct lower/upper endpoint values share the same `(n - 1) * SD²` deviation budget. When `replication_count=2` and endpoints are distinct, those endpoints exhaust the retained sample and must reconstruct the represented mean/sample SD. - When the generic carrier occupies `ValidationReport::monte_carlo_rmse`, retained replications are nonnegative; positive mean implies `SE(mean) <= mean`, and inclusive nearest-rank endpoints cannot exceed nonnegative sample-sum support `n * mean`. These typed bounds are not imposed on signed metrics such as bias. @@ -83,13 +83,13 @@ The clock contract separates event/valid time, assertion time, document time, sy ### #488 — Validation Evidence -#488 is the generic Validation Evidence landing vehicle at exact head `8bb3557298c77abb3dcbfed6844abf829531a727`, based on protected #490. GAP-092–109 remain inherited and executable. +#488 is the generic Validation Evidence landing vehicle at exact head `0857d5a432e86ca13193886babece6396c98b7f3`, based on protected #490. GAP-092–110 remain inherited and executable. -GAP-110 RED `fe013e7dbd9b6c99371fe28ff3f6aa2cb2915408` fixes the minimum-normal-scale sample `truth=[0,0,0]`, `recovered=[0,f64::MIN_POSITIVE,2*f64::MIN_POSITIVE]`. Its canonical exact translation is `[-m,0,m]`, `m=2^-1022`; exact `SE(mean)=m/sqrt(3)` is a nonzero subnormal with correctly rounded bits `0x0009_3cd3_a2c8_198e`. The GAP-109 helper formed raw squares/cross-product first. Their mathematically nonzero exact values lie below minimum-subnormal magnitude, round to signed zero, and their FMA residual checks also round to zero, allowing a false exact-zero radicand and `SE(mean)=0`. +GAP-111 RED `978c422cbdccff02605b5d220bd2564900a830d5` fixes the exact four-observation sample `truth=[0,0,0,0]`, `recovered=[0,1,2,7]`. Its six squared pair distances sum to `116`; because `n=4`, exact `SE(mean)^2=116/48=29/12`. The correctly rounded exact real `sqrt(29/12)` has bits `0x3ff8_df7d_a2e6_6e88`, while the GAP-110 general translated path rounded the rational radicand before `sqrt` and returned adjacent lower `0x3ff8_df7d_a2e6_6e87`. -Causal source repair `d3660d44f1bc315e2e34ecfcfa74c26b8f1cd257` extends the existing GAP-109 normalization trigger only to nonzero square/cross-product results that leave represented range by underflowing to zero. The same exactly reversible `exact_power_of_two_scale` proof is retried; admission still requires exact offset reconstruction, finite/nonzero preservation, FMA-proven normalized products, error-free sum/subtraction, and an exact represented root. For GAP-110 the normalized radicand is `3`, so the direct identity declines and the predecessor translated second-moment path returns the correct nonzero subnormal. The public contract covers all six permutations and sign mirrors. CHANGELOG commit `ac833ec1a771586496a14083b62ca7c919e7f708`; research/current #488 `8bb3557298c77abb3dcbfed6844abf829531a727`. Fresh exact-head hosted execution and qualifying independent review remain required. +The bounded repair routes `validation_core::bias_standard_error` through `crates/validation_core/src/bias_se.rs` before the established `bias.rs` fallback. Admission requires exactly four observations, exact represented residual subtraction, exact pairwise residual differences, a common dyadic unit with pair-distance square numerator fitting the bounded integer proof, and exact comparison against the adjacent binary64 midpoint square. The ordinary ratio-first `sqrt` is a candidate only; midpoint comparison chooses the correctly rounded neighbor including ties-to-even. Any unproved/out-of-range case returns to the predecessor implementation. Source/test lineage is `3de7a737...` → `ea609474...` → `2c689095...` → `622d1681...` → `170f77ee...` → `b92a4d63...` → `c8032493...`; CHANGELOG `49c46aa4...`; research/current #488 `0857d5a4...`. The public contract includes permutations/sign mirrors; unit coverage exercises upward and downward one-ULP correction, exact-square, dyadic-scale, zero, non-finite, subtraction-roundoff, pair-difference overflow and bounded-numerator refusal paths. Fresh exact-head hosted execution and qualifying independent review remain required. -GAP-109 remains inherited: RED `67fa485248a8673f90bb71a43c2a58865a764383` + repair `dcaf25b37d9860e7956de5429d3ef5894b129b49` + CHANGELOG `31b1aff811703a41e3524e804d095be32621b004` + research ancestor `1eaac11e715144127048fc20033719777528c692` established exact dyadic scale invariance for overflowing raw products. GAP-108 remains inherited: RED `32dcab8434a9676854f3a470094aadfc4f3f417d` + causal repair `bee85e3df044e13a2df6c077cc87706b6cd78402` + all-permutation/sign-mirror contract `8260bc0bff11abae2b05e0a85b5c1c374b8cbd49` established the bounded three-level rational-square identity. GAP-107 remains inherited: RED `49343ab6e7f1a4cadc0b9c71e0757edea0256add` + repair `0fc3ea97106f5156a6d68d4db8fd6f4a2ace0ac4` established conditioning-minimized exact-anchor selection after GAP-106 permutation-invariant admission. GAP-105 preserves exact rational-square subnormal projection; GAP-104 exact reduced rational-square count geometry such as `2/15`; GAP-103 the exact `1/6` reciprocal-integer case; GAP-102 the exact `1/8` dyadic case; GAP-101 the exact two-observation identity `SE(mean)=|r1-r2|/2`; GAP-100 the exact translated two-level singleton identity `SE(mean)=|level_gap|/n`; GAP-099 and GAP-098 retain their n=3 and dyadic-normalization repairs. GAP-110 does not widen the general n>2 correct-rounding claim or reclassify inexact deltas as exact. +GAP-110 remains inherited: RED `fe013e7dbd9b6c99371fe28ff3f6aa2cb2915408` + repair `d3660d44f1bc315e2e34ecfcfa74c26b8f1cd257` + CHANGELOG `ac833ec1a771586496a14083b62ca7c919e7f708` + research ancestor `8bb3557298c77abb3dcbfed6844abf829531a727` protects the minimum-normal-scale three-observation sample from false-zero raw-product underflow. GAP-109 remains inherited: RED `67fa485248a8673f90bb71a43c2a58865a764383` + repair `dcaf25b37d9860e7956de5429d3ef5894b129b49` + CHANGELOG `31b1aff811703a41e3524e804d095be32621b004` + research ancestor `1eaac11e715144127048fc20033719777528c692` established exact dyadic scale invariance for overflowing raw products. GAP-108 remains inherited: RED `32dcab8434a9676854f3a470094aadfc4f3f417d` + causal repair `bee85e3df044e13a2df6c077cc87706b6cd78402` + all-permutation/sign-mirror contract `8260bc0bff11abae2b05e0a85b5c1c374b8cbd49` established the bounded three-level rational-square identity. GAP-107 remains inherited: RED `49343ab6e7f1a4cadc0b9c71e0757edea0256add` + repair `0fc3ea97106f5156a6d68d4db8fd6f4a2ace0ac4` established conditioning-minimized exact-anchor selection after GAP-106 permutation-invariant admission. GAP-105 preserves exact rational-square subnormal projection; GAP-104 exact reduced rational-square count geometry such as `2/15`; GAP-103 the exact `1/6` reciprocal-integer case; GAP-102 the exact `1/8` dyadic case; GAP-101 the exact two-observation identity `SE(mean)=|r1-r2|/2`; GAP-100 the exact translated two-level singleton identity `SE(mean)=|level_gap|/n`; GAP-099 and GAP-098 retain their n=3 and dyadic-normalization repairs. GAP-111 does not widen the general n>2 correct-rounding claim or reclassify inexact deltas as exact. ### #416 — Validation / Analysis Run consolidation @@ -101,7 +101,7 @@ GAP-109 remains inherited: RED `67fa485248a8673f90bb71a43c2a58865a764383` + repa ## Gap register -GAP-001–GAP-044 retain their existing domain/release identities and closure lineage. They remain unchanged by the GAP-110 numerical repair; their authoritative source/test/ADR history remains in repository ancestry and the surviving landing vehicles listed above. The validation lineage from GAP-045 onward is restated here because #488 is its current single writer. +GAP-001–GAP-044 retain their existing domain/release identities and closure lineage. They remain unchanged by the GAP-111 numerical repair; their authoritative source/test/ADR history remains in repository ancestry and the surviving landing vehicles listed above. The validation lineage from GAP-045 onward is restated here because #488 is its current single writer. | ID | Gap | Maturity | Closure evidence | | --- | --- | --- | --- | @@ -149,60 +149,60 @@ GAP-001–GAP-044 retain their existing domain/release identities and closure li | GAP-042 | ratio-first logarithm inflated adjacent-float growth rate | `verification-pending` | RED `766ddc7a...` + `ln_1p` repair `16f21d9a...` | | GAP-043 | duplicate known-truth identities could silently reweight RMSE | `verification-pending` | RED `698f12f5...` + repair `2fae4cb2...` | | GAP-044 | known-truth RMSE alignment depended on row order | `verification-pending` | RED `8ad72ac9...` / `5fb93c40...` + repairs `2dd9537e...` / `025dce7f...`; #310 `c6680450...` | -| GAP-045 | mean signed bias could reject representable result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; inherited by #488 `8bb35572...` | -| GAP-046 | bias SE could reject representable SEM because raw squared deviations overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; inherited by #488 `8bb35572...` | -| GAP-047 | generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; inherited by #488 `8bb35572...` | -| GAP-048 | mean signed bias could erase representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; inherited by #488 `8bb35572...` | +| GAP-045 | mean signed bias could reject representable result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; inherited by #488 `0857d5a4...` | +| GAP-046 | bias SE could reject representable SEM because raw squared deviations overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; inherited by #488 `0857d5a4...` | +| GAP-047 | generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; inherited by #488 `0857d5a4...` | +| GAP-048 | mean signed bias could erase representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; inherited by #488 `0857d5a4...` | | GAP-049 | stable `Between` recovery could be aliased across occasion indices and reweight RMSE | `verification-pending` | RED `0a03041c...` + repair `ec2c1219...`; #310 `c6680450...` | -| GAP-050 | zero-multiplier SE-aware acceptance could erase nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; inherited by #488 `8bb35572...` | -| GAP-051 | exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; inherited by #488 `8bb35572...` | -| GAP-052 | all-covered Wilson lower endpoint could cancel positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; inherited by #488 `8bb35572...` | -| GAP-053 | strict-interior Wilson lower endpoint could cancel positive value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; inherited by #488 `8bb35572...` | -| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; inherited by #488 `8bb35572...` | -| GAP-055 | strict-interior Wilson lower endpoint could accept nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; inherited by #488 `8bb35572...` | -| GAP-056 | durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; inherited by #488 `8bb35572...` | -| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; inherited by #488 `8bb35572...` | -| GAP-058 | generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; inherited by #488 `8bb35572...` | -| GAP-059 | Monte Carlo summary could materially misstate positive SE relative to `SD/sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; inherited by #488 `8bb35572...` | -| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; inherited by #488 `8bb35572...` | -| GAP-061 | generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; inherited by #488 `8bb35572...` | -| GAP-062 | finite-tolerance matching could fail for deterministically outside pair | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; inherited by #488 `8bb35572...` | -| GAP-063 | exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; inherited by #488 `8bb35572...` | -| GAP-064 | positive point RMSE could carry SE above squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; inherited by #488 `8bb35572...` | -| GAP-065 | positive Monte Carlo RMSE could carry impossible spread/SE | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; inherited by #488 `8bb35572...` | -| GAP-066 | RMSE nearest-rank percentile could exceed nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; inherited by #488 `8bb35572...` | -| GAP-067 | generic nearest-rank endpoint could be incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected repair `2798e4f9...`; causal repair `c7151b49...`; inherited by #488 `8bb35572...` | -| GAP-068 | distinct generic percentile endpoints could jointly exceed squared-deviation budget | `verification-pending` | RED `c4a13826...` + repair `cb3f80a2...`; inherited by #488 `8bb35572...` | -| GAP-069 | two-replication endpoints could exhaust sample while mean/SD remained impossible | `verification-pending` | RED `81bf0d9e...` + repair `d48f8fef...`; inherited by #488 `8bb35572...` | -| GAP-070 | stored Wilson pair could not arise from one score interval | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...`; inherited by #488 `8bb35572...` | -| GAP-071 | durable Wilson evidence lacked denominator/critical-value/sidedness provenance | `active-repair` | carrier/authority/v1/envelope lineage; inherited by #488 `8bb35572...`; durable-consumer adoption remains | -| GAP-072 | exact all-covered Wilson evidence could retain impossible zero lower endpoint | `verification-pending` | RED `ce714f07...` + repair `72e9d954...`; inherited by #488 `8bb35572...` | -| GAP-073 | durable Wilson count provenance could lose one uncovered observation above exact-integer range | `verification-pending` | RED `29d710a5...` + count/fixed-width/exact-ratio repair lineage; inherited by #488 `8bb35572...` | -| GAP-074 | durable exact count could be pre-rounded before endpoint projection | `verification-pending` | RED `f89e2467...` + reciprocal-scale repair `73bbb5cf...`; inherited by #488 `8bb35572...` | -| GAP-075 | inexact all-covered Wilson miss mass could round to exact one | `verification-pending` | RED `059ce70d...` + canonical repair `0f478392...`; inherited by #488 `8bb35572...` | -| GAP-076 | exact all-covered count could absorb small positive `z²` and emit exact `1.0` | `verification-pending` | RED `e0c4ec81...` + repair `c9dcb9df...`; inherited by #488 `8bb35572...` | -| GAP-077 | inexact partial denominator could shift exact-count Wilson endpoint by one ULP | `verification-pending` | RED `06e55653...` + TwoSum/FMA repair `6c084dbe...`; inherited by #488 `8bb35572...` | -| GAP-078 | Wilson residual compensation could move quotient across wrong midpoint | `verification-pending` | RED `d076d344...` + midpoint repair `32314239...`; inherited by #488 `8bb35572...` | -| GAP-079 | SE-aware acceptance could underflow finite positive `k*SE` to zero through scale-first arithmetic | `verification-pending` | RED `76067efc...` + direct-finite repair `4ffdf366...`; inherited by #488 `8bb35572...` | -| GAP-080 | both-overflow SE-aware fallback could round strict rejection into equality | `verification-pending` | RED `a9a45714...` + exact significand/exponent repair `425e8963...`; inherited by #488 `8bb35572...` | -| GAP-081 | finite multiplication could round strict SE-aware rejection into equality | `verification-pending` | RED `23c3262c...` + tie repair `6a2add48...`; inherited by #488 `8bb35572...` | -| GAP-082 | finite subtraction could round strict rejection onto exact bound | `verification-pending` | RED `58cbc032...` + low-term repair `68a6fd98...`; inherited by #488 `8bb35572...` | -| GAP-083 | SE-aware product correction could fall below binary64 resolution | `verification-pending` | RED `b55c5473...` / `c77ac440...` + corrected repair `772ad8ed...`; inherited by #488 `8bb35572...` | -| GAP-084 | legacy Wilson boundary could contradict peer endpoint root | `verification-pending` | RED `c9d612f2...` + peer-root repair `88512417...`; inherited by #488 `8bb35572...` | -| GAP-085 | equal nonzero subtraction/FMA correction projections could conceal exact ordering | `verification-pending` | RED `35ea85ba...` + exact product-roundoff repair `7d597a18...`; inherited by #488 `8bb35572...` | -| GAP-086 | mean bias could reject representable result because individual residuals overflow | `verification-pending` | RED `04e6e745...` + explicit-denominator cancellation/bias repair lineage; inherited by #488 `8bb35572...` | -| GAP-087 | mixed-sign mean bias could discard repeated sub-ULP opposing mass | `verification-pending` | RED `63913727...` + low-term repair `5697cca5...`; inherited by #488 `8bb35572...` | -| GAP-088 | mixed-remainder compensation could round before scientific count division | `verification-pending` | RED `8b4d19d1...` + compensated-division repair `7a33212b...`; inherited by #488 `8bb35572...` | -| GAP-089 | exact cancellation could leave same-sign remainder rounded before division | `verification-pending` | RED `84476aad...` + repair `5f0d40b8...`; inherited by #488 `8bb35572...` | -| GAP-090 | same-sign all-subnormal mean normalization could double-round final bias | `verification-pending` | RED `91abdb49...` + exact-unit repair `1c0df8a7...` + halfway coverage; inherited by #488 `8bb35572...` | -| GAP-091 | pairwise subtraction roundoff could move mean bias across final midpoint | `verification-pending` | RED `a9d9bda3...` + corrected tail/midpoint repair `676ccda0...`; inherited by #488 `8bb35572...` | -| GAP-092 | two distinct represented residuals could collapse to one subtraction and false-zero bias SE | `verification-pending` | RED `c9c55ea5...` + n=2 expanded-difference repair `f6d7da96...`; inherited by #488 `8bb35572...` | -| GAP-093 | n>2 distinct represented residuals could collapse to one rounded high and false-zero bias SE | `verification-pending` | RED `06a70e1c...` + common-high/error-free-low repair `04c62514...`; inherited by #488 `8bb35572...` | -| GAP-094 | separately rounded square roots could shift bias SE by one ULP | `verification-pending` | corrected RED `62243204...` + direct normalized-SE repair `8b8f0a21...`; inherited by #488 `8bb35572...` | -| GAP-095 | distinct rounded residual highs could materially overstate uncertainty after subtraction roundoff | `verification-pending` | RED `ae906ad6...` + exact translated-residual repair `d59b9c30...`; inherited by #488 `8bb35572...` | -| GAP-096 | exact residuals could be re-centered on rounded mean and distort dispersion | `verification-pending` | RED `9265b34a...` + exact-residual translated repair `2fa266b2...`; inherited by #488 `8bb35572...` | -| GAP-097 | common-high subtraction path could round low-term mean before centering | `verification-pending` | RED `d48e2515...` + exact low-term translated-second-moment repair `a63b8d7a...`; inherited by #488 `8bb35572...` | -| GAP-098 | exact translated-residual bias SE could double-round through a non-power normalization scale and move the final represented result by one ULP | `verification-pending` | RED `426fc5af...` + shared dyadic-scale prerequisite `d8b411f5...` + causal repair `d536e3b1...` + CHANGELOG `ebce979f...`; inherited by #488 `8bb35572...` | +| GAP-050 | zero-multiplier SE-aware acceptance could erase nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; inherited by #488 `0857d5a4...` | +| GAP-051 | exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; inherited by #488 `0857d5a4...` | +| GAP-052 | all-covered Wilson lower endpoint could cancel positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; inherited by #488 `0857d5a4...` | +| GAP-053 | strict-interior Wilson lower endpoint could cancel positive value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; inherited by #488 `0857d5a4...` | +| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; inherited by #488 `0857d5a4...` | +| GAP-055 | strict-interior Wilson lower endpoint could accept nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; inherited by #488 `0857d5a4...` | +| GAP-056 | durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; inherited by #488 `0857d5a4...` | +| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; inherited by #488 `0857d5a4...` | +| GAP-058 | generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; inherited by #488 `0857d5a4...` | +| GAP-059 | Monte Carlo summary could materially misstate positive SE relative to `SD/sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; inherited by #488 `0857d5a4...` | +| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; inherited by #488 `0857d5a4...` | +| GAP-061 | generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; inherited by #488 `0857d5a4...` | +| GAP-062 | finite-tolerance matching could fail for deterministically outside pair | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; inherited by #488 `0857d5a4...` | +| GAP-063 | exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; inherited by #488 `0857d5a4...` | +| GAP-064 | positive point RMSE could carry SE above squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; inherited by #488 `0857d5a4...` | +| GAP-065 | positive Monte Carlo RMSE could carry impossible spread/SE | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; inherited by #488 `0857d5a4...` | +| GAP-066 | RMSE nearest-rank percentile could exceed nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; inherited by #488 `0857d5a4...` | +| GAP-067 | generic nearest-rank endpoint could be incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected repair `2798e4f9...`; causal repair `c7151b49...`; inherited by #488 `0857d5a4...` | +| GAP-068 | distinct generic percentile endpoints could jointly exceed squared-deviation budget | `verification-pending` | RED `c4a13826...` + repair `cb3f80a2...`; inherited by #488 `0857d5a4...` | +| GAP-069 | two-replication endpoints could exhaust sample while mean/SD remained impossible | `verification-pending` | RED `81bf0d9e...` + repair `d48f8fef...`; inherited by #488 `0857d5a4...` | +| GAP-070 | stored Wilson pair could not arise from one score interval | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...`; inherited by #488 `0857d5a4...` | +| GAP-071 | durable Wilson evidence lacked denominator/critical-value/sidedness provenance | `active-repair` | carrier/authority/v1/envelope lineage; inherited by #488 `0857d5a4...`; durable-consumer adoption remains | +| GAP-072 | exact all-covered Wilson evidence could retain impossible zero lower endpoint | `verification-pending` | RED `ce714f07...` + repair `72e9d954...`; inherited by #488 `0857d5a4...` | +| GAP-073 | durable Wilson count provenance could lose one uncovered observation above exact-integer range | `verification-pending` | RED `29d710a5...` + count/fixed-width/exact-ratio repair lineage; inherited by #488 `0857d5a4...` | +| GAP-074 | durable exact count could be pre-rounded before endpoint projection | `verification-pending` | RED `f89e2467...` + reciprocal-scale repair `73bbb5cf...`; inherited by #488 `0857d5a4...` | +| GAP-075 | inexact all-covered Wilson miss mass could round to exact one | `verification-pending` | RED `059ce70d...` + canonical repair `0f478392...`; inherited by #488 `0857d5a4...` | +| GAP-076 | exact all-covered count could absorb small positive `z²` and emit exact `1.0` | `verification-pending` | RED `e0c4ec81...` + repair `c9dcb9df...`; inherited by #488 `0857d5a4...` | +| GAP-077 | inexact partial denominator could shift exact-count Wilson endpoint by one ULP | `verification-pending` | RED `06e55653...` + TwoSum/FMA repair `6c084dbe...`; inherited by #488 `0857d5a4...` | +| GAP-078 | Wilson residual compensation could move quotient across wrong midpoint | `verification-pending` | RED `d076d344...` + midpoint repair `32314239...`; inherited by #488 `0857d5a4...` | +| GAP-079 | SE-aware acceptance could underflow finite positive `k*SE` to zero through scale-first arithmetic | `verification-pending` | RED `76067efc...` + direct-finite repair `4ffdf366...`; inherited by #488 `0857d5a4...` | +| GAP-080 | both-overflow SE-aware fallback could round strict rejection into equality | `verification-pending` | RED `a9a45714...` + exact significand/exponent repair `425e8963...`; inherited by #488 `0857d5a4...` | +| GAP-081 | finite multiplication could round strict SE-aware rejection into equality | `verification-pending` | RED `23c3262c...` + tie repair `6a2add48...`; inherited by #488 `0857d5a4...` | +| GAP-082 | finite subtraction could round strict rejection onto exact bound | `verification-pending` | RED `58cbc032...` + low-term repair `68a6fd98...`; inherited by #488 `0857d5a4...` | +| GAP-083 | SE-aware product correction could fall below binary64 resolution | `verification-pending` | RED `b55c5473...` / `c77ac440...` + corrected repair `772ad8ed...`; inherited by #488 `0857d5a4...` | +| GAP-084 | legacy Wilson boundary could contradict peer endpoint root | `verification-pending` | RED `c9d612f2...` + peer-root repair `88512417...`; inherited by #488 `0857d5a4...` | +| GAP-085 | equal nonzero subtraction/FMA correction projections could conceal exact ordering | `verification-pending` | RED `35ea85ba...` + exact product-roundoff repair `7d597a18...`; inherited by #488 `0857d5a4...` | +| GAP-086 | mean bias could reject representable result because individual residuals overflow | `verification-pending` | RED `04e6e745...` + explicit-denominator cancellation/bias repair lineage; inherited by #488 `0857d5a4...` | +| GAP-087 | mixed-sign mean bias could discard repeated sub-ULP opposing mass | `verification-pending` | RED `63913727...` + low-term repair `5697cca5...`; inherited by #488 `0857d5a4...` | +| GAP-088 | mixed-remainder compensation could round before scientific count division | `verification-pending` | RED `8b4d19d1...` + compensated-division repair `7a33212b...`; inherited by #488 `0857d5a4...` | +| GAP-089 | exact cancellation could leave same-sign remainder rounded before division | `verification-pending` | RED `84476aad...` + repair `5f0d40b8...`; inherited by #488 `0857d5a4...` | +| GAP-090 | same-sign all-subnormal mean normalization could double-round final bias | `verification-pending` | RED `91abdb49...` + exact-unit repair `1c0df8a7...` + halfway coverage; inherited by #488 `0857d5a4...` | +| GAP-091 | pairwise subtraction roundoff could move mean bias across final midpoint | `verification-pending` | RED `a9d9bda3...` + corrected tail/midpoint repair `676ccda0...`; inherited by #488 `0857d5a4...` | +| GAP-092 | two distinct represented residuals could collapse to one subtraction and false-zero bias SE | `verification-pending` | RED `c9c55ea5...` + n=2 expanded-difference repair `f6d7da96...`; inherited by #488 `0857d5a4...` | +| GAP-093 | n>2 distinct represented residuals could collapse to one rounded high and false-zero bias SE | `verification-pending` | RED `06a70e1c...` + common-high/error-free-low repair `04c62514...`; inherited by #488 `0857d5a4...` | +| GAP-094 | separately rounded square roots could shift bias SE by one ULP | `verification-pending` | corrected RED `62243204...` + direct normalized-SE repair `8b8f0a21...`; inherited by #488 `0857d5a4...` | +| GAP-095 | distinct rounded residual highs could materially overstate uncertainty after subtraction roundoff | `verification-pending` | RED `ae906ad6...` + exact translated-residual repair `d59b9c30...`; inherited by #488 `0857d5a4...` | +| GAP-096 | exact residuals could be re-centered on rounded mean and distort dispersion | `verification-pending` | RED `9265b34a...` + exact-residual translated repair `2fa266b2...`; inherited by #488 `0857d5a4...` | +| GAP-097 | common-high subtraction path could round low-term mean before centering | `verification-pending` | RED `d48e2515...` + exact low-term translated-second-moment repair `a63b8d7a...`; inherited by #488 `0857d5a4...` | +| GAP-098 | exact translated-residual bias SE could double-round through a non-power normalization scale and move the final represented result by one ULP | `verification-pending` | RED `426fc5af...` + shared dyadic-scale prerequisite `d8b411f5...` + causal repair `d536e3b1...` + CHANGELOG `ebce979f...`; inherited by #488 `0857d5a4...` | | GAP-099 | exact translated three-observation two-level bias SE could re-round an exact gap through square/second-moment/square-root and move the represented result by one ULP | `verification-pending` | RED `fbcdb7fa...` + causal repair `e0f2445d...` + CHANGELOG `ee81953e...` + research/ancestor #488 `7741aaa...`; exact-head hosted GREEN/review/main integration remain pending | | GAP-100 | exact translated two-level bias SE with one singleton could re-round an exact gap through square/second-moment/square-root beyond the n=3 case | `verification-pending` | RED `4386d9ac...` + causal repair `79ad03fa...` + edge `7fe4117c...` + CHANGELOG `017ad11...` + research/ancestor #488 `944fac05...`; exact-head hosted GREEN/review/main integration remain pending | | GAP-101 | exact two-observation residuals could be re-centered on a rounded midpoint mean and materially distort `SE(mean)` despite exact pairwise subtraction | `verification-pending` | RED `d3dcd918...` + causal repair `02b0a178...` + CHANGELOG `5603b12d...` + research/ancestor #488 `905addcc...`; exact-head hosted GREEN/review/main integration remain pending | @@ -214,7 +214,8 @@ GAP-001–GAP-044 retain their existing domain/release identities and closure li | GAP-107 | several exact translated-residual anchors could expose different square/square-root conditioning and shift bias SE by one ULP even after permutation-invariant admission | `verification-pending` | RED `49343ab6...` + causal repair `0fc3ea97...` + CHANGELOG `2793ff59...` + research/ancestor #488 `e3ab2765...`; conditioning/permutation/sign-mirror contract added; exact-head hosted GREEN/review/main integration remain pending | | GAP-108 | exact translated three-observation, three-level rational-square dispersion could be re-rounded through normalized moments and `sqrt` even after best-anchor selection | `verification-pending` | RED `32dcab84...` + causal repair `bee85e3d...` + all-permutation/sign-mirror contract `8260bc0b...` + CHANGELOG `5757dda1...` + research/ancestor #488 `4514a073...`; exact-head hosted GREEN/review/main integration remain pending | | GAP-109 | exact translated three-observation rational-square bias-SE proof could reject the same represented geometry solely because exact power-of-two scaling overflowed raw square/cross-product intermediates | `verification-pending` | RED `67fa4852...` + causal repair `dcaf25b3...` + CHANGELOG `31b1aff8...` + research/ancestor #488 `1eaac11e...`; all-permutation/sign-mirror scale-invariance contract; exact-head hosted GREEN/review/main integration remain pending | -| GAP-110 | exact translated three-observation bias SE could falsely become zero when mathematically nonzero square/cross-product intermediates underflowed below binary64 range before the bounded exact proof | `verification-pending` | RED `fe013e7d...` + causal repair `d3660d44...` + CHANGELOG `ac833ec1...` + research/current #488 `8bb35572...`; all-permutation/sign-mirror underflow-scale contract; exact-head hosted GREEN/review/main integration remain pending | +| GAP-110 | exact translated three-observation bias SE could falsely become zero when mathematically nonzero square/cross-product intermediates underflowed below binary64 range before the bounded exact proof | `verification-pending` | RED `fe013e7d...` + causal repair `d3660d44...` + CHANGELOG `ac833ec1...` + research/ancestor #488 `8bb35572...`; all-permutation/sign-mirror underflow-scale contract; exact-head hosted GREEN/review/main integration remain pending | +| GAP-111 | exact four-observation pair-distance dispersion could move one ULP because the exact rational radicand was rounded before `sqrt` | `verification-pending` | RED `978c422c...` + bounded pair-distance/midpoint repair lineage `3de7a737...` → `c8032493...` + CHANGELOG `49c46aa4...` + research/current #488 `0857d5a4...`; permutation/sign-mirror and proof-edge contracts added; exact-head hosted GREEN/review/main integration remain pending | ## Release gate From c8e18359f5ed5077aa758fc3d00990d1cea3036e Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 5 Sep 2026 20:37:16 +0900 Subject: [PATCH 206/235] docs(ddd): advance product gap baseline through GAP-112 --- docs/product-technical-gap-baseline.md | 125 +++++++++++++------------ 1 file changed, 63 insertions(+), 62 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 50aed09b0..a52268a45 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-05T11:18:30Z +**Snapshot:** 2026-09-05T11:29:34Z **Protected-main evidence:** `a243f18da4a4ca8a8d068c39922537f1f8ed6ad0` **Workspace version:** `0.2.0` @@ -30,7 +30,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `0857d5a432e86ca13193886babece6396c98b7f3` | true | `main` | Validation Evidence landing vehicle, based on protected #490. GAP-111 proves that an exact four-observation pair-distance dispersion can still be shifted by one ULP when the exact rational radicand is rounded before `sqrt`. The bounded repair admits `SE(mean)^2 = Σ pair_distance² / 48` only when represented residuals and pairwise differences are error-free and the dyadic integer/midpoint proof fits bounded `u128`; otherwise the established GAP-110 fallback remains authoritative. GAP-110 underflow protection, GAP-109 scale invariance, GAP-108 three-level rational-square dispersion, GAP-107 anchor conditioning, GAP-106 permutation invariance, and all earlier represented-input bias-SE, Wilson, provenance, Monte Carlo, RMSE/SE, matching, serde/projection repairs remain inherited. Hosted exact-head gates and independent review remain required. | +| #488 | `f62b56d26f07098b683e2f31c21a7df1367ea67e` | true | `main` | Validation Evidence landing vehicle, based on protected #490. GAP-112 fixes proof admission for exact four-observation pair-distance dispersion whose unreduced numerator exceeds the exact-binary64 integer bound even though the identical reduced rational fits it. RED `4f223135...` uses `[0,14099687,16729100,94045527]`: pair-square sum `21699306139092196`, denominator `48`, gcd `4`, reduced ratio `5424826534773049/12`; fallback returns adjacent-lower `0x4174_46e5_76f8_7444` while the bounded exact midpoint proof returns `0x4174_46e5_76f8_7445`. Repair `ed1a8763...` reduces the exact rational before the existing bounded proof. GAP-111 and all earlier represented-input Validation Evidence repairs remain inherited. Hosted exact-head gates and independent review remain required. | | #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 | Validation / Analysis Run fold child. Unique evidence must be inherited by a conflict-resolving survivor; child-head CI does not transfer. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | @@ -62,7 +62,7 @@ The clock contract separates event/valid time, assertion time, document time, sy - Row arrival order is not scientific evidence. Fixed admitted observations must produce bit-identical means/centered results under permutation wherever the contract claims deterministic CPU `f64` reference behavior. - Known-truth component recovery follows bounded-context identity: stable `Between` is unit-level and uses canonical `occasion_index = 0`; `Within` retains actual `(unit, occasion)` identity. Duplicate identities or stable-Between occasion aliases are not weights. - A representable final scientific estimand is not rejected solely because an avoidable intermediate binary64 operation overflows/underflows. False exact 0/1/non-finite endpoints, erased finite bounds, cancellation residues, and double-rounded endpoints are not accepted when a bounded equivalent operation preserves the represented estimand or decision. -- Mean signed bias and bias SE remain Validation Evidence performance measures over admitted recovery units. `mean_bias` uses the direct residual path only when every pairwise subtraction is finite and preserves represented low-order input mass; otherwise it uses the algebraically equivalent recovered-plus-negated-truth numerator, cancellation-safe exact-power-of-two scaling, and the original scientific denominator. `bias_standard_error` still requires each individual signed residual to be representable. For every two-observation sample, TEPP evaluates `SE(mean)=|r1-r2|/2` before a rounded residual mean can become authoritative; subtraction-roundoff cases use expanded represented inputs, while exact-subtraction cases use the represented residual difference through the cancellation/overflow-safe scientific denominator. For `n>2`, the exact translated-residual path is admitted only when anchor-relative high, low, and combined deltas are exactly representable. Every exact candidate anchor is evaluated; the candidate with the smallest maximum translated magnitude is selected, with canonical represented `(high, low)` order only as a deterministic tie-breaker. This retains GAP-106 permutation invariance while GAP-107 prevents an avoidably wide exact representation from becoming authoritative. Translation-invariant dispersion is then evaluated before any rounded residual mean becomes authoritative. GAP-098 requires exact power-of-two normalization; GAP-099 established the exact `n=3` two-level identity; GAP-100 generalized singleton/repeated-level geometry; GAP-102 established a reciprocal-power-of-two count shortcut; GAP-103 widened that to reciprocal-integer-square factors; GAP-104 generalized it to any reduced count factor satisfying `m(n-m)/(n^2(n-1))=(a/b)^2` with checked integer roots. GAP-105 additionally requires an admitted exact rational scale whose final represented value is subnormal to be rounded once in exact minimum-subnormal units rather than through normalized quotient plus scale restoration. GAP-108 adds the exact three-observation, three-level identity `SE(mean)^2=(x²+y²-xy)/9` only when the two nonzero translated offsets have error-free represented squares/cross-product, the sum/subtraction is error-free, and the numerator has an exact represented square root; only that proved root is divided by three once. GAP-109 makes that proof invariant to exact dyadic unit scaling: if raw square/cross-product intermediates overflow, the same proof is retried only after an exactly reversible power-of-two normalization, with exact reconstruction required before the normalized result can become authoritative. GAP-110 applies the same bounded retry when a mathematically nonzero raw square/cross-product underflows to represented zero; a zero FMA residual at a product already outside the destination range is not evidence of an exact-zero product. GAP-111 adds an exact four-observation pair-distance identity `SE(mean)^2=Σ_{i2 dispersion. Mathematically nonzero final results outside binary64 range fail closed. +- Mean signed bias and bias SE remain Validation Evidence performance measures over admitted recovery units. `mean_bias` uses the direct residual path only when every pairwise subtraction is finite and preserves represented low-order input mass; otherwise it uses the algebraically equivalent recovered-plus-negated-truth numerator, cancellation-safe exact-power-of-two scaling, and the original scientific denominator. `bias_standard_error` still requires each individual signed residual to be representable. For every two-observation sample, TEPP evaluates `SE(mean)=|r1-r2|/2` before a rounded residual mean can become authoritative; subtraction-roundoff cases use expanded represented inputs, while exact-subtraction cases use the represented residual difference through the cancellation/overflow-safe scientific denominator. For `n>2`, the exact translated-residual path is admitted only when anchor-relative high, low, and combined deltas are exactly representable. Every exact candidate anchor is evaluated; the candidate with the smallest maximum translated magnitude is selected, with canonical represented `(high, low)` order only as a deterministic tie-breaker. This retains GAP-106 permutation invariance while GAP-107 prevents an avoidably wide exact representation from becoming authoritative. Translation-invariant dispersion is then evaluated before any rounded residual mean becomes authoritative. GAP-098 requires exact power-of-two normalization; GAP-099 established the exact `n=3` two-level identity; GAP-100 generalized singleton/repeated-level geometry; GAP-102 established a reciprocal-power-of-two count shortcut; GAP-103 widened that to reciprocal-integer-square factors; GAP-104 generalized it to any reduced count factor satisfying `m(n-m)/(n^2(n-1))=(a/b)^2` with checked integer roots. GAP-105 additionally requires an admitted exact rational scale whose final represented value is subnormal to be rounded once in exact minimum-subnormal units rather than through normalized quotient plus scale restoration. GAP-108 adds the exact three-observation, three-level identity `SE(mean)^2=(x²+y²-xy)/9` only when the two nonzero translated offsets have error-free represented squares/cross-product, the sum/subtraction is error-free, and the numerator has an exact represented square root; only that proved root is divided by three once. GAP-109 makes that proof invariant to exact dyadic unit scaling: if raw square/cross-product intermediates overflow, the same proof is retried only after an exactly reversible power-of-two normalization, with exact reconstruction required before the normalized result can become authoritative. GAP-110 applies the same bounded retry when a mathematically nonzero raw square/cross-product underflows to represented zero; a zero FMA residual at a product already outside the destination range is not evidence of an exact-zero product. GAP-111 adds an exact four-observation pair-distance identity `SE(mean)^2=Σ_{i2 dispersion. Mathematically nonzero final results outside binary64 range fail closed. - Generic Validation Evidence RMSE and its delta-method SE normalize before squaring. Exact-zero point RMSE requires exact-zero point RMSE SE. For positive RMSE, the declared producer satisfies `SE(RMSE) <= RMSE / 2`, with a small relative binary64 admission tolerance. - Generic `MonteCarloSummary` is sign-neutral. Zero SD requires zero SE and percentile endpoints equal to the represented mean. Positive SD requires positive SE coherent with represented `SD / sqrt(n)` within a small relative tolerance. Every inclusive nearest-rank endpoint is a retained observation and satisfies `|endpoint - mean| <= SD * sqrt(n - 1)`. Distinct lower/upper endpoint values share the same `(n - 1) * SD²` deviation budget. When `replication_count=2` and endpoints are distinct, those endpoints exhaust the retained sample and must reconstruct the represented mean/sample SD. - When the generic carrier occupies `ValidationReport::monte_carlo_rmse`, retained replications are nonnegative; positive mean implies `SE(mean) <= mean`, and inclusive nearest-rank endpoints cannot exceed nonnegative sample-sum support `n * mean`. These typed bounds are not imposed on signed metrics such as bias. @@ -83,13 +83,13 @@ The clock contract separates event/valid time, assertion time, document time, sy ### #488 — Validation Evidence -#488 is the generic Validation Evidence landing vehicle at exact head `0857d5a432e86ca13193886babece6396c98b7f3`, based on protected #490. GAP-092–110 remain inherited and executable. +#488 is the generic Validation Evidence landing vehicle at exact head `f62b56d26f07098b683e2f31c21a7df1367ea67e`, based on protected #490. GAP-092–111 remain inherited and executable. -GAP-111 RED `978c422cbdccff02605b5d220bd2564900a830d5` fixes the exact four-observation sample `truth=[0,0,0,0]`, `recovered=[0,1,2,7]`. Its six squared pair distances sum to `116`; because `n=4`, exact `SE(mean)^2=116/48=29/12`. The correctly rounded exact real `sqrt(29/12)` has bits `0x3ff8_df7d_a2e6_6e88`, while the GAP-110 general translated path rounded the rational radicand before `sqrt` and returned adjacent lower `0x3ff8_df7d_a2e6_6e87`. +GAP-112 RED `4f2231354fa0ad3e0c646bbb100b3cc83566d033` fixes the exact four-observation sample `truth=[0,0,0,0]`, `recovered=[0,14_099_687,16_729_100,94_045_527]`. Its six squared pair distances sum to `21699306139092196`; because `n=4`, exact `SE(mean)^2=N/48`. `gcd(N,48)=4`, so the identical rational is `5424826534773049/12`. The GAP-111 admission rejected the unreduced numerator because it exceeds `2^53` and fell back to a translated floating path that returns adjacent lower bits `0x4174_46e5_76f8_7444`; the reduced numerator fits the existing exact midpoint-square proof and returns correctly rounded `0x4174_46e5_76f8_7445`. -The bounded repair routes `validation_core::bias_standard_error` through `crates/validation_core/src/bias_se.rs` before the established `bias.rs` fallback. Admission requires exactly four observations, exact represented residual subtraction, exact pairwise residual differences, a common dyadic unit with pair-distance square numerator fitting the bounded integer proof, and exact comparison against the adjacent binary64 midpoint square. The ordinary ratio-first `sqrt` is a candidate only; midpoint comparison chooses the correctly rounded neighbor including ties-to-even. Any unproved/out-of-range case returns to the predecessor implementation. Source/test lineage is `3de7a737...` → `ea609474...` → `2c689095...` → `622d1681...` → `170f77ee...` → `b92a4d63...` → `c8032493...`; CHANGELOG `49c46aa4...`; research/current #488 `0857d5a4...`. The public contract includes permutations/sign mirrors; unit coverage exercises upward and downward one-ULP correction, exact-square, dyadic-scale, zero, non-finite, subtraction-roundoff, pair-difference overflow and bounded-numerator refusal paths. Fresh exact-head hosted execution and qualifying independent review remain required. +Causal repair `ed1a8763c198fbe478de5ec8be72e3436e5918e3` changes only the exact four-observation admission: after the checked `u128` pair-square sum is formed, numerator and scientific denominator `48` are reduced by their integer GCD before the existing bounded candidate/neighbor midpoint-square comparison. The rational radicand, exactness proof, fail-closed fallback, and owner boundary are unchanged. Public RED includes permutations and sign mirrors; CHANGELOG begins at `28dde0f1e8e3a0f8e8614ed449733b98f2d65c1c`; research/TRACEABILITY current #488 is `f62b56d26f07098b683e2f31c21a7df1367ea67e`. GAP-112 does not widen the general n>2 correct-rounding claim. -GAP-110 remains inherited: RED `fe013e7dbd9b6c99371fe28ff3f6aa2cb2915408` + repair `d3660d44f1bc315e2e34ecfcfa74c26b8f1cd257` + CHANGELOG `ac833ec1a771586496a14083b62ca7c919e7f708` + research ancestor `8bb3557298c77abb3dcbfed6844abf829531a727` protects the minimum-normal-scale three-observation sample from false-zero raw-product underflow. GAP-109 remains inherited: RED `67fa485248a8673f90bb71a43c2a58865a764383` + repair `dcaf25b37d9860e7956de5429d3ef5894b129b49` + CHANGELOG `31b1aff811703a41e3524e804d095be32621b004` + research ancestor `1eaac11e715144127048fc20033719777528c692` established exact dyadic scale invariance for overflowing raw products. GAP-108 remains inherited: RED `32dcab8434a9676854f3a470094aadfc4f3f417d` + causal repair `bee85e3df044e13a2df6c077cc87706b6cd78402` + all-permutation/sign-mirror contract `8260bc0bff11abae2b05e0a85b5c1c374b8cbd49` established the bounded three-level rational-square identity. GAP-107 remains inherited: RED `49343ab6e7f1a4cadc0b9c71e0757edea0256add` + repair `0fc3ea97106f5156a6d68d4db8fd6f4a2ace0ac4` established conditioning-minimized exact-anchor selection after GAP-106 permutation-invariant admission. GAP-105 preserves exact rational-square subnormal projection; GAP-104 exact reduced rational-square count geometry such as `2/15`; GAP-103 the exact `1/6` reciprocal-integer case; GAP-102 the exact `1/8` dyadic case; GAP-101 the exact two-observation identity `SE(mean)=|r1-r2|/2`; GAP-100 the exact translated two-level singleton identity `SE(mean)=|level_gap|/n`; GAP-099 and GAP-098 retain their n=3 and dyadic-normalization repairs. GAP-111 does not widen the general n>2 correct-rounding claim or reclassify inexact deltas as exact. +GAP-111 remains inherited: RED `978c422cbdccff02605b5d220bd2564900a830d5` fixes `[0,1,2,7]`, with exact `SE(mean)^2=116/48=29/12` and target bits `0x3ff8_df7d_a2e6_6e88`. Bounded pair-distance/midpoint repair lineage is `3de7a737...` → `ea609474...` → `2c689095...` → `622d1681...` → `170f77ee...` → `b92a4d63...` → `c8032493...`; CHANGELOG `49c46aa4...`; research ancestor `0857d5a4...`. GAP-110 underflow protection, GAP-109 scale invariance, GAP-108 exact three-level rational-square dispersion, GAP-107 conditioning-minimized exact-anchor selection, GAP-106 permutation-invariant admission, GAP-105 exact rational-square subnormal projection, GAP-104 reduced rational-square count geometry, GAP-103 reciprocal-integer-square cases, GAP-102 exact dyadic count geometry, GAP-101 `SE(mean)=|r1-r2|/2`, GAP-100 translated two-level singleton identity, GAP-099 and GAP-098 remain inherited. ### #416 — Validation / Analysis Run consolidation @@ -101,7 +101,7 @@ GAP-110 remains inherited: RED `fe013e7dbd9b6c99371fe28ff3f6aa2cb2915408` + repa ## Gap register -GAP-001–GAP-044 retain their existing domain/release identities and closure lineage. They remain unchanged by the GAP-111 numerical repair; their authoritative source/test/ADR history remains in repository ancestry and the surviving landing vehicles listed above. The validation lineage from GAP-045 onward is restated here because #488 is its current single writer. +GAP-001–GAP-044 retain their existing domain/release identities and closure lineage. They remain unchanged by the GAP-112 numerical repair; their authoritative source/test/ADR history remains in repository ancestry and the surviving landing vehicles listed above. The validation lineage from GAP-045 onward is restated here because #488 is its current single writer. | ID | Gap | Maturity | Closure evidence | | --- | --- | --- | --- | @@ -149,60 +149,60 @@ GAP-001–GAP-044 retain their existing domain/release identities and closure li | GAP-042 | ratio-first logarithm inflated adjacent-float growth rate | `verification-pending` | RED `766ddc7a...` + `ln_1p` repair `16f21d9a...` | | GAP-043 | duplicate known-truth identities could silently reweight RMSE | `verification-pending` | RED `698f12f5...` + repair `2fae4cb2...` | | GAP-044 | known-truth RMSE alignment depended on row order | `verification-pending` | RED `8ad72ac9...` / `5fb93c40...` + repairs `2dd9537e...` / `025dce7f...`; #310 `c6680450...` | -| GAP-045 | mean signed bias could reject representable result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; inherited by #488 `0857d5a4...` | -| GAP-046 | bias SE could reject representable SEM because raw squared deviations overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; inherited by #488 `0857d5a4...` | -| GAP-047 | generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; inherited by #488 `0857d5a4...` | -| GAP-048 | mean signed bias could erase representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; inherited by #488 `0857d5a4...` | +| GAP-045 | mean signed bias could reject representable result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; inherited by #488 `f62b56d2...` | +| GAP-046 | bias SE could reject representable SEM because raw squared deviations overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; inherited by #488 `f62b56d2...` | +| GAP-047 | generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; inherited by #488 `f62b56d2...` | +| GAP-048 | mean signed bias could erase representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; inherited by #488 `f62b56d2...` | | GAP-049 | stable `Between` recovery could be aliased across occasion indices and reweight RMSE | `verification-pending` | RED `0a03041c...` + repair `ec2c1219...`; #310 `c6680450...` | -| GAP-050 | zero-multiplier SE-aware acceptance could erase nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; inherited by #488 `0857d5a4...` | -| GAP-051 | exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; inherited by #488 `0857d5a4...` | -| GAP-052 | all-covered Wilson lower endpoint could cancel positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; inherited by #488 `0857d5a4...` | -| GAP-053 | strict-interior Wilson lower endpoint could cancel positive value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; inherited by #488 `0857d5a4...` | -| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; inherited by #488 `0857d5a4...` | -| GAP-055 | strict-interior Wilson lower endpoint could accept nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; inherited by #488 `0857d5a4...` | -| GAP-056 | durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; inherited by #488 `0857d5a4...` | -| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; inherited by #488 `0857d5a4...` | -| GAP-058 | generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; inherited by #488 `0857d5a4...` | -| GAP-059 | Monte Carlo summary could materially misstate positive SE relative to `SD/sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; inherited by #488 `0857d5a4...` | -| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; inherited by #488 `0857d5a4...` | -| GAP-061 | generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; inherited by #488 `0857d5a4...` | -| GAP-062 | finite-tolerance matching could fail for deterministically outside pair | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; inherited by #488 `0857d5a4...` | -| GAP-063 | exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; inherited by #488 `0857d5a4...` | -| GAP-064 | positive point RMSE could carry SE above squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; inherited by #488 `0857d5a4...` | -| GAP-065 | positive Monte Carlo RMSE could carry impossible spread/SE | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; inherited by #488 `0857d5a4...` | -| GAP-066 | RMSE nearest-rank percentile could exceed nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; inherited by #488 `0857d5a4...` | -| GAP-067 | generic nearest-rank endpoint could be incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected repair `2798e4f9...`; causal repair `c7151b49...`; inherited by #488 `0857d5a4...` | -| GAP-068 | distinct generic percentile endpoints could jointly exceed squared-deviation budget | `verification-pending` | RED `c4a13826...` + repair `cb3f80a2...`; inherited by #488 `0857d5a4...` | -| GAP-069 | two-replication endpoints could exhaust sample while mean/SD remained impossible | `verification-pending` | RED `81bf0d9e...` + repair `d48f8fef...`; inherited by #488 `0857d5a4...` | -| GAP-070 | stored Wilson pair could not arise from one score interval | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...`; inherited by #488 `0857d5a4...` | -| GAP-071 | durable Wilson evidence lacked denominator/critical-value/sidedness provenance | `active-repair` | carrier/authority/v1/envelope lineage; inherited by #488 `0857d5a4...`; durable-consumer adoption remains | -| GAP-072 | exact all-covered Wilson evidence could retain impossible zero lower endpoint | `verification-pending` | RED `ce714f07...` + repair `72e9d954...`; inherited by #488 `0857d5a4...` | -| GAP-073 | durable Wilson count provenance could lose one uncovered observation above exact-integer range | `verification-pending` | RED `29d710a5...` + count/fixed-width/exact-ratio repair lineage; inherited by #488 `0857d5a4...` | -| GAP-074 | durable exact count could be pre-rounded before endpoint projection | `verification-pending` | RED `f89e2467...` + reciprocal-scale repair `73bbb5cf...`; inherited by #488 `0857d5a4...` | -| GAP-075 | inexact all-covered Wilson miss mass could round to exact one | `verification-pending` | RED `059ce70d...` + canonical repair `0f478392...`; inherited by #488 `0857d5a4...` | -| GAP-076 | exact all-covered count could absorb small positive `z²` and emit exact `1.0` | `verification-pending` | RED `e0c4ec81...` + repair `c9dcb9df...`; inherited by #488 `0857d5a4...` | -| GAP-077 | inexact partial denominator could shift exact-count Wilson endpoint by one ULP | `verification-pending` | RED `06e55653...` + TwoSum/FMA repair `6c084dbe...`; inherited by #488 `0857d5a4...` | -| GAP-078 | Wilson residual compensation could move quotient across wrong midpoint | `verification-pending` | RED `d076d344...` + midpoint repair `32314239...`; inherited by #488 `0857d5a4...` | -| GAP-079 | SE-aware acceptance could underflow finite positive `k*SE` to zero through scale-first arithmetic | `verification-pending` | RED `76067efc...` + direct-finite repair `4ffdf366...`; inherited by #488 `0857d5a4...` | -| GAP-080 | both-overflow SE-aware fallback could round strict rejection into equality | `verification-pending` | RED `a9a45714...` + exact significand/exponent repair `425e8963...`; inherited by #488 `0857d5a4...` | -| GAP-081 | finite multiplication could round strict SE-aware rejection into equality | `verification-pending` | RED `23c3262c...` + tie repair `6a2add48...`; inherited by #488 `0857d5a4...` | -| GAP-082 | finite subtraction could round strict rejection onto exact bound | `verification-pending` | RED `58cbc032...` + low-term repair `68a6fd98...`; inherited by #488 `0857d5a4...` | -| GAP-083 | SE-aware product correction could fall below binary64 resolution | `verification-pending` | RED `b55c5473...` / `c77ac440...` + corrected repair `772ad8ed...`; inherited by #488 `0857d5a4...` | -| GAP-084 | legacy Wilson boundary could contradict peer endpoint root | `verification-pending` | RED `c9d612f2...` + peer-root repair `88512417...`; inherited by #488 `0857d5a4...` | -| GAP-085 | equal nonzero subtraction/FMA correction projections could conceal exact ordering | `verification-pending` | RED `35ea85ba...` + exact product-roundoff repair `7d597a18...`; inherited by #488 `0857d5a4...` | -| GAP-086 | mean bias could reject representable result because individual residuals overflow | `verification-pending` | RED `04e6e745...` + explicit-denominator cancellation/bias repair lineage; inherited by #488 `0857d5a4...` | -| GAP-087 | mixed-sign mean bias could discard repeated sub-ULP opposing mass | `verification-pending` | RED `63913727...` + low-term repair `5697cca5...`; inherited by #488 `0857d5a4...` | -| GAP-088 | mixed-remainder compensation could round before scientific count division | `verification-pending` | RED `8b4d19d1...` + compensated-division repair `7a33212b...`; inherited by #488 `0857d5a4...` | -| GAP-089 | exact cancellation could leave same-sign remainder rounded before division | `verification-pending` | RED `84476aad...` + repair `5f0d40b8...`; inherited by #488 `0857d5a4...` | -| GAP-090 | same-sign all-subnormal mean normalization could double-round final bias | `verification-pending` | RED `91abdb49...` + exact-unit repair `1c0df8a7...` + halfway coverage; inherited by #488 `0857d5a4...` | -| GAP-091 | pairwise subtraction roundoff could move mean bias across final midpoint | `verification-pending` | RED `a9d9bda3...` + corrected tail/midpoint repair `676ccda0...`; inherited by #488 `0857d5a4...` | -| GAP-092 | two distinct represented residuals could collapse to one subtraction and false-zero bias SE | `verification-pending` | RED `c9c55ea5...` + n=2 expanded-difference repair `f6d7da96...`; inherited by #488 `0857d5a4...` | -| GAP-093 | n>2 distinct represented residuals could collapse to one rounded high and false-zero bias SE | `verification-pending` | RED `06a70e1c...` + common-high/error-free-low repair `04c62514...`; inherited by #488 `0857d5a4...` | -| GAP-094 | separately rounded square roots could shift bias SE by one ULP | `verification-pending` | corrected RED `62243204...` + direct normalized-SE repair `8b8f0a21...`; inherited by #488 `0857d5a4...` | -| GAP-095 | distinct rounded residual highs could materially overstate uncertainty after subtraction roundoff | `verification-pending` | RED `ae906ad6...` + exact translated-residual repair `d59b9c30...`; inherited by #488 `0857d5a4...` | -| GAP-096 | exact residuals could be re-centered on rounded mean and distort dispersion | `verification-pending` | RED `9265b34a...` + exact-residual translated repair `2fa266b2...`; inherited by #488 `0857d5a4...` | -| GAP-097 | common-high subtraction path could round low-term mean before centering | `verification-pending` | RED `d48e2515...` + exact low-term translated-second-moment repair `a63b8d7a...`; inherited by #488 `0857d5a4...` | -| GAP-098 | exact translated-residual bias SE could double-round through a non-power normalization scale and move the final represented result by one ULP | `verification-pending` | RED `426fc5af...` + shared dyadic-scale prerequisite `d8b411f5...` + causal repair `d536e3b1...` + CHANGELOG `ebce979f...`; inherited by #488 `0857d5a4...` | +| GAP-050 | zero-multiplier SE-aware acceptance could erase nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; inherited by #488 `f62b56d2...` | +| GAP-051 | exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; inherited by #488 `f62b56d2...` | +| GAP-052 | all-covered Wilson lower endpoint could cancel positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; inherited by #488 `f62b56d2...` | +| GAP-053 | strict-interior Wilson lower endpoint could cancel positive value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; inherited by #488 `f62b56d2...` | +| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; inherited by #488 `f62b56d2...` | +| GAP-055 | strict-interior Wilson lower endpoint could accept nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; inherited by #488 `f62b56d2...` | +| GAP-056 | durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; inherited by #488 `f62b56d2...` | +| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; inherited by #488 `f62b56d2...` | +| GAP-058 | generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; inherited by #488 `f62b56d2...` | +| GAP-059 | Monte Carlo summary could materially misstate positive SE relative to `SD/sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; inherited by #488 `f62b56d2...` | +| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; inherited by #488 `f62b56d2...` | +| GAP-061 | generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; inherited by #488 `f62b56d2...` | +| GAP-062 | finite-tolerance matching could fail for deterministically outside pair | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; inherited by #488 `f62b56d2...` | +| GAP-063 | exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; inherited by #488 `f62b56d2...` | +| GAP-064 | positive point RMSE could carry SE above squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; inherited by #488 `f62b56d2...` | +| GAP-065 | positive Monte Carlo RMSE could carry impossible spread/SE | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; inherited by #488 `f62b56d2...` | +| GAP-066 | RMSE nearest-rank percentile could exceed nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; inherited by #488 `f62b56d2...` | +| GAP-067 | generic nearest-rank endpoint could be incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected repair `2798e4f9...`; causal repair `c7151b49...`; inherited by #488 `f62b56d2...` | +| GAP-068 | distinct generic percentile endpoints could jointly exceed squared-deviation budget | `verification-pending` | RED `c4a13826...` + repair `cb3f80a2...`; inherited by #488 `f62b56d2...` | +| GAP-069 | two-replication endpoints could exhaust sample while mean/SD remained impossible | `verification-pending` | RED `81bf0d9e...` + repair `d48f8fef...`; inherited by #488 `f62b56d2...` | +| GAP-070 | stored Wilson pair could not arise from one score interval | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...`; inherited by #488 `f62b56d2...` | +| GAP-071 | durable Wilson evidence lacked denominator/critical-value/sidedness provenance | `active-repair` | carrier/authority/v1/envelope lineage; inherited by #488 `f62b56d2...`; durable-consumer adoption remains | +| GAP-072 | exact all-covered Wilson evidence could retain impossible zero lower endpoint | `verification-pending` | RED `ce714f07...` + repair `72e9d954...`; inherited by #488 `f62b56d2...` | +| GAP-073 | durable Wilson count provenance could lose one uncovered observation above exact-integer range | `verification-pending` | RED `29d710a5...` + count/fixed-width/exact-ratio repair lineage; inherited by #488 `f62b56d2...` | +| GAP-074 | durable exact count could be pre-rounded before endpoint projection | `verification-pending` | RED `f89e2467...` + reciprocal-scale repair `73bbb5cf...`; inherited by #488 `f62b56d2...` | +| GAP-075 | inexact all-covered Wilson miss mass could round to exact one | `verification-pending` | RED `059ce70d...` + canonical repair `0f478392...`; inherited by #488 `f62b56d2...` | +| GAP-076 | exact all-covered count could absorb small positive `z²` and emit exact `1.0` | `verification-pending` | RED `e0c4ec81...` + repair `c9dcb9df...`; inherited by #488 `f62b56d2...` | +| GAP-077 | inexact partial denominator could shift exact-count Wilson endpoint by one ULP | `verification-pending` | RED `06e55653...` + TwoSum/FMA repair `6c084dbe...`; inherited by #488 `f62b56d2...` | +| GAP-078 | Wilson residual compensation could move quotient across wrong midpoint | `verification-pending` | RED `d076d344...` + midpoint repair `32314239...`; inherited by #488 `f62b56d2...` | +| GAP-079 | SE-aware acceptance could underflow finite positive `k*SE` to zero through scale-first arithmetic | `verification-pending` | RED `76067efc...` + direct-finite repair `4ffdf366...`; inherited by #488 `f62b56d2...` | +| GAP-080 | both-overflow SE-aware fallback could round strict rejection into equality | `verification-pending` | RED `a9a45714...` + exact significand/exponent repair `425e8963...`; inherited by #488 `f62b56d2...` | +| GAP-081 | finite multiplication could round strict SE-aware rejection into equality | `verification-pending` | RED `23c3262c...` + tie repair `6a2add48...`; inherited by #488 `f62b56d2...` | +| GAP-082 | finite subtraction could round strict rejection onto exact bound | `verification-pending` | RED `58cbc032...` + low-term repair `68a6fd98...`; inherited by #488 `f62b56d2...` | +| GAP-083 | SE-aware product correction could fall below binary64 resolution | `verification-pending` | RED `b55c5473...` / `c77ac440...` + corrected repair `772ad8ed...`; inherited by #488 `f62b56d2...` | +| GAP-084 | legacy Wilson boundary could contradict peer endpoint root | `verification-pending` | RED `c9d612f2...` + peer-root repair `88512417...`; inherited by #488 `f62b56d2...` | +| GAP-085 | equal nonzero subtraction/FMA correction projections could conceal exact ordering | `verification-pending` | RED `35ea85ba...` + exact product-roundoff repair `7d597a18...`; inherited by #488 `f62b56d2...` | +| GAP-086 | mean bias could reject representable result because individual residuals overflow | `verification-pending` | RED `04e6e745...` + explicit-denominator cancellation/bias repair lineage; inherited by #488 `f62b56d2...` | +| GAP-087 | mixed-sign mean bias could discard repeated sub-ULP opposing mass | `verification-pending` | RED `63913727...` + low-term repair `5697cca5...`; inherited by #488 `f62b56d2...` | +| GAP-088 | mixed-remainder compensation could round before scientific count division | `verification-pending` | RED `8b4d19d1...` + compensated-division repair `7a33212b...`; inherited by #488 `f62b56d2...` | +| GAP-089 | exact cancellation could leave same-sign remainder rounded before division | `verification-pending` | RED `84476aad...` + repair `5f0d40b8...`; inherited by #488 `f62b56d2...` | +| GAP-090 | same-sign all-subnormal mean normalization could double-round final bias | `verification-pending` | RED `91abdb49...` + exact-unit repair `1c0df8a7...` + halfway coverage; inherited by #488 `f62b56d2...` | +| GAP-091 | pairwise subtraction roundoff could move mean bias across final midpoint | `verification-pending` | RED `a9d9bda3...` + corrected tail/midpoint repair `676ccda0...`; inherited by #488 `f62b56d2...` | +| GAP-092 | two distinct represented residuals could collapse to one subtraction and false-zero bias SE | `verification-pending` | RED `c9c55ea5...` + n=2 expanded-difference repair `f6d7da96...`; inherited by #488 `f62b56d2...` | +| GAP-093 | n>2 distinct represented residuals could collapse to one rounded high and false-zero bias SE | `verification-pending` | RED `06a70e1c...` + common-high/error-free-low repair `04c62514...`; inherited by #488 `f62b56d2...` | +| GAP-094 | separately rounded square roots could shift bias SE by one ULP | `verification-pending` | corrected RED `62243204...` + direct normalized-SE repair `8b8f0a21...`; inherited by #488 `f62b56d2...` | +| GAP-095 | distinct rounded residual highs could materially overstate uncertainty after subtraction roundoff | `verification-pending` | RED `ae906ad6...` + exact translated-residual repair `d59b9c30...`; inherited by #488 `f62b56d2...` | +| GAP-096 | exact residuals could be re-centered on rounded mean and distort dispersion | `verification-pending` | RED `9265b34a...` + exact-residual translated repair `2fa266b2...`; inherited by #488 `f62b56d2...` | +| GAP-097 | common-high subtraction path could round low-term mean before centering | `verification-pending` | RED `d48e2515...` + exact low-term translated-second-moment repair `a63b8d7a...`; inherited by #488 `f62b56d2...` | +| GAP-098 | exact translated-residual bias SE could double-round through a non-power normalization scale and move the final represented result by one ULP | `verification-pending` | RED `426fc5af...` + shared dyadic-scale prerequisite `d8b411f5...` + causal repair `d536e3b1...` + CHANGELOG `ebce979f...`; inherited by #488 `f62b56d2...` | | GAP-099 | exact translated three-observation two-level bias SE could re-round an exact gap through square/second-moment/square-root and move the represented result by one ULP | `verification-pending` | RED `fbcdb7fa...` + causal repair `e0f2445d...` + CHANGELOG `ee81953e...` + research/ancestor #488 `7741aaa...`; exact-head hosted GREEN/review/main integration remain pending | | GAP-100 | exact translated two-level bias SE with one singleton could re-round an exact gap through square/second-moment/square-root beyond the n=3 case | `verification-pending` | RED `4386d9ac...` + causal repair `79ad03fa...` + edge `7fe4117c...` + CHANGELOG `017ad11...` + research/ancestor #488 `944fac05...`; exact-head hosted GREEN/review/main integration remain pending | | GAP-101 | exact two-observation residuals could be re-centered on a rounded midpoint mean and materially distort `SE(mean)` despite exact pairwise subtraction | `verification-pending` | RED `d3dcd918...` + causal repair `02b0a178...` + CHANGELOG `5603b12d...` + research/ancestor #488 `905addcc...`; exact-head hosted GREEN/review/main integration remain pending | @@ -215,7 +215,8 @@ GAP-001–GAP-044 retain their existing domain/release identities and closure li | GAP-108 | exact translated three-observation, three-level rational-square dispersion could be re-rounded through normalized moments and `sqrt` even after best-anchor selection | `verification-pending` | RED `32dcab84...` + causal repair `bee85e3d...` + all-permutation/sign-mirror contract `8260bc0b...` + CHANGELOG `5757dda1...` + research/ancestor #488 `4514a073...`; exact-head hosted GREEN/review/main integration remain pending | | GAP-109 | exact translated three-observation rational-square bias-SE proof could reject the same represented geometry solely because exact power-of-two scaling overflowed raw square/cross-product intermediates | `verification-pending` | RED `67fa4852...` + causal repair `dcaf25b3...` + CHANGELOG `31b1aff8...` + research/ancestor #488 `1eaac11e...`; all-permutation/sign-mirror scale-invariance contract; exact-head hosted GREEN/review/main integration remain pending | | GAP-110 | exact translated three-observation bias SE could falsely become zero when mathematically nonzero square/cross-product intermediates underflowed below binary64 range before the bounded exact proof | `verification-pending` | RED `fe013e7d...` + causal repair `d3660d44...` + CHANGELOG `ac833ec1...` + research/ancestor #488 `8bb35572...`; all-permutation/sign-mirror underflow-scale contract; exact-head hosted GREEN/review/main integration remain pending | -| GAP-111 | exact four-observation pair-distance dispersion could move one ULP because the exact rational radicand was rounded before `sqrt` | `verification-pending` | RED `978c422c...` + bounded pair-distance/midpoint repair lineage `3de7a737...` → `c8032493...` + CHANGELOG `49c46aa4...` + research/current #488 `0857d5a4...`; permutation/sign-mirror and proof-edge contracts added; exact-head hosted GREEN/review/main integration remain pending | +| GAP-111 | exact four-observation pair-distance dispersion could move one ULP because the exact rational radicand was rounded before `sqrt` | `verification-pending` | RED `978c422c...` + bounded pair-distance/midpoint repair lineage `3de7a737...` → `c8032493...` + CHANGELOG `49c46aa4...` + research/ancestor #488 `0857d5a4...`; permutation/sign-mirror and proof-edge contracts added; exact-head hosted GREEN/review/main integration remain pending | +| GAP-112 | exact four-observation pair-distance proof could reject an equivalent bounded rational solely because the unreduced numerator exceeded the exact-binary64 integer admission | `verification-pending` | RED `4f223135...` + causal repair `ed1a8763...` + CHANGELOG `28dde0f1...` + research/current #488 `f62b56d2...`; permutation/sign-mirror contract added; exact-head hosted GREEN/review/main integration remain pending | ## Release gate From 8a908a080fb622e3ef1e0e35961b4d38cebf254e Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 5 Sep 2026 21:15:21 +0900 Subject: [PATCH 207/235] docs(ddd): advance Validation Evidence baseline through GAP-113 --- docs/product-technical-gap-baseline.md | 125 +++++++++++++------------ 1 file changed, 63 insertions(+), 62 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index a52268a45..d2696fd25 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-05T11:29:34Z +**Snapshot:** 2026-09-05T12:10:02Z **Protected-main evidence:** `a243f18da4a4ca8a8d068c39922537f1f8ed6ad0` **Workspace version:** `0.2.0` @@ -30,7 +30,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `f62b56d26f07098b683e2f31c21a7df1367ea67e` | true | `main` | Validation Evidence landing vehicle, based on protected #490. GAP-112 fixes proof admission for exact four-observation pair-distance dispersion whose unreduced numerator exceeds the exact-binary64 integer bound even though the identical reduced rational fits it. RED `4f223135...` uses `[0,14099687,16729100,94045527]`: pair-square sum `21699306139092196`, denominator `48`, gcd `4`, reduced ratio `5424826534773049/12`; fallback returns adjacent-lower `0x4174_46e5_76f8_7444` while the bounded exact midpoint proof returns `0x4174_46e5_76f8_7445`. Repair `ed1a8763...` reduces the exact rational before the existing bounded proof. GAP-111 and all earlier represented-input Validation Evidence repairs remain inherited. Hosted exact-head gates and independent review remain required. | +| #488 | `37e3defb3bde29a8d1ac852456ba05f787aee1f3` | true | `main` | Validation Evidence landing vehicle, based on protected #490. GAP-113 keeps a GCD-reduced exact four-observation pair-distance radicand in the bounded midpoint proof even when the reduced `u128` numerator exceeds `2^53`: RED `50153a1c...` uses `[19274968,693729138,711353557,1625519116]`, pair-square sum `5218123316274976251`, denominator `48`, gcd `3`, reduced ratio `1739374438758325417/16`; the fallback returns adjacent-lower `0x41b3_a706_d408_9e31` while exact midpoint comparison returns `0x41b3_a706_d408_9e32`. Repair `dbf6b409...` treats the rounded binary64 numerator only as a candidate seed and retains exact checked `u128` square/midpoint comparisons as authority. GAP-112 and all earlier represented-input Validation Evidence repairs remain inherited. Hosted exact-head gates and independent review remain required. | | #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 | Validation / Analysis Run fold child. Unique evidence must be inherited by a conflict-resolving survivor; child-head CI does not transfer. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | @@ -62,7 +62,7 @@ The clock contract separates event/valid time, assertion time, document time, sy - Row arrival order is not scientific evidence. Fixed admitted observations must produce bit-identical means/centered results under permutation wherever the contract claims deterministic CPU `f64` reference behavior. - Known-truth component recovery follows bounded-context identity: stable `Between` is unit-level and uses canonical `occasion_index = 0`; `Within` retains actual `(unit, occasion)` identity. Duplicate identities or stable-Between occasion aliases are not weights. - A representable final scientific estimand is not rejected solely because an avoidable intermediate binary64 operation overflows/underflows. False exact 0/1/non-finite endpoints, erased finite bounds, cancellation residues, and double-rounded endpoints are not accepted when a bounded equivalent operation preserves the represented estimand or decision. -- Mean signed bias and bias SE remain Validation Evidence performance measures over admitted recovery units. `mean_bias` uses the direct residual path only when every pairwise subtraction is finite and preserves represented low-order input mass; otherwise it uses the algebraically equivalent recovered-plus-negated-truth numerator, cancellation-safe exact-power-of-two scaling, and the original scientific denominator. `bias_standard_error` still requires each individual signed residual to be representable. For every two-observation sample, TEPP evaluates `SE(mean)=|r1-r2|/2` before a rounded residual mean can become authoritative; subtraction-roundoff cases use expanded represented inputs, while exact-subtraction cases use the represented residual difference through the cancellation/overflow-safe scientific denominator. For `n>2`, the exact translated-residual path is admitted only when anchor-relative high, low, and combined deltas are exactly representable. Every exact candidate anchor is evaluated; the candidate with the smallest maximum translated magnitude is selected, with canonical represented `(high, low)` order only as a deterministic tie-breaker. This retains GAP-106 permutation invariance while GAP-107 prevents an avoidably wide exact representation from becoming authoritative. Translation-invariant dispersion is then evaluated before any rounded residual mean becomes authoritative. GAP-098 requires exact power-of-two normalization; GAP-099 established the exact `n=3` two-level identity; GAP-100 generalized singleton/repeated-level geometry; GAP-102 established a reciprocal-power-of-two count shortcut; GAP-103 widened that to reciprocal-integer-square factors; GAP-104 generalized it to any reduced count factor satisfying `m(n-m)/(n^2(n-1))=(a/b)^2` with checked integer roots. GAP-105 additionally requires an admitted exact rational scale whose final represented value is subnormal to be rounded once in exact minimum-subnormal units rather than through normalized quotient plus scale restoration. GAP-108 adds the exact three-observation, three-level identity `SE(mean)^2=(x²+y²-xy)/9` only when the two nonzero translated offsets have error-free represented squares/cross-product, the sum/subtraction is error-free, and the numerator has an exact represented square root; only that proved root is divided by three once. GAP-109 makes that proof invariant to exact dyadic unit scaling: if raw square/cross-product intermediates overflow, the same proof is retried only after an exactly reversible power-of-two normalization, with exact reconstruction required before the normalized result can become authoritative. GAP-110 applies the same bounded retry when a mathematically nonzero raw square/cross-product underflows to represented zero; a zero FMA residual at a product already outside the destination range is not evidence of an exact-zero product. GAP-111 adds an exact four-observation pair-distance identity `SE(mean)^2=Σ_{i2 dispersion. Mathematically nonzero final results outside binary64 range fail closed. +- Mean signed bias and bias SE remain Validation Evidence performance measures over admitted recovery units. `mean_bias` uses the direct residual path only when every pairwise subtraction is finite and preserves represented low-order input mass; otherwise it uses the algebraically equivalent recovered-plus-negated-truth numerator, cancellation-safe exact-power-of-two scaling, and the original scientific denominator. `bias_standard_error` still requires each individual signed residual to be representable. For every two-observation sample, TEPP evaluates `SE(mean)=|r1-r2|/2` before a rounded residual mean can become authoritative; subtraction-roundoff cases use expanded represented inputs, while exact-subtraction cases use the represented residual difference through the cancellation/overflow-safe scientific denominator. For `n>2`, the exact translated-residual path is admitted only when anchor-relative high, low, and combined deltas are exactly representable. Every exact candidate anchor is evaluated; the candidate with the smallest maximum translated magnitude is selected, with canonical represented `(high, low)` order only as a deterministic tie-breaker. This retains GAP-106 permutation invariance while GAP-107 prevents an avoidably wide exact representation from becoming authoritative. Translation-invariant dispersion is then evaluated before any rounded residual mean becomes authoritative. GAP-098 requires exact power-of-two normalization; GAP-099 established the exact `n=3` two-level identity; GAP-100 generalized singleton/repeated-level geometry; GAP-102 established a reciprocal-power-of-two count shortcut; GAP-103 widened that to reciprocal-integer-square factors; GAP-104 generalized it to any reduced count factor satisfying `m(n-m)/(n^2(n-1))=(a/b)^2` with checked integer roots. GAP-105 additionally requires an admitted exact rational scale whose final represented value is subnormal to be rounded once in exact minimum-subnormal units rather than through normalized quotient plus scale restoration. GAP-108 adds the exact three-observation, three-level identity `SE(mean)^2=(x²+y²-xy)/9` only when the two nonzero translated offsets have error-free represented squares/cross-product, the sum/subtraction is error-free, and the numerator has an exact represented square root; only that proved root is divided by three once. GAP-109 makes that proof invariant to exact dyadic unit scaling: if raw square/cross-product intermediates overflow, the same proof is retried only after an exactly reversible power-of-two normalization, with exact reconstruction required before the normalized result can become authoritative. GAP-110 applies the same bounded retry when a mathematically nonzero raw square/cross-product underflows to represented zero; a zero FMA residual at a product already outside the destination range is not evidence of an exact-zero product. GAP-111 adds an exact four-observation pair-distance identity `SE(mean)^2=Σ_{i2 dispersion. Mathematically nonzero final results outside binary64 range fail closed. - Generic Validation Evidence RMSE and its delta-method SE normalize before squaring. Exact-zero point RMSE requires exact-zero point RMSE SE. For positive RMSE, the declared producer satisfies `SE(RMSE) <= RMSE / 2`, with a small relative binary64 admission tolerance. - Generic `MonteCarloSummary` is sign-neutral. Zero SD requires zero SE and percentile endpoints equal to the represented mean. Positive SD requires positive SE coherent with represented `SD / sqrt(n)` within a small relative tolerance. Every inclusive nearest-rank endpoint is a retained observation and satisfies `|endpoint - mean| <= SD * sqrt(n - 1)`. Distinct lower/upper endpoint values share the same `(n - 1) * SD²` deviation budget. When `replication_count=2` and endpoints are distinct, those endpoints exhaust the retained sample and must reconstruct the represented mean/sample SD. - When the generic carrier occupies `ValidationReport::monte_carlo_rmse`, retained replications are nonnegative; positive mean implies `SE(mean) <= mean`, and inclusive nearest-rank endpoints cannot exceed nonnegative sample-sum support `n * mean`. These typed bounds are not imposed on signed metrics such as bias. @@ -83,13 +83,13 @@ The clock contract separates event/valid time, assertion time, document time, sy ### #488 — Validation Evidence -#488 is the generic Validation Evidence landing vehicle at exact head `f62b56d26f07098b683e2f31c21a7df1367ea67e`, based on protected #490. GAP-092–111 remain inherited and executable. +#488 is the generic Validation Evidence landing vehicle at exact head `37e3defb3bde29a8d1ac852456ba05f787aee1f3`, based on protected #490. GAP-092–112 remain inherited and executable. -GAP-112 RED `4f2231354fa0ad3e0c646bbb100b3cc83566d033` fixes the exact four-observation sample `truth=[0,0,0,0]`, `recovered=[0,14_099_687,16_729_100,94_045_527]`. Its six squared pair distances sum to `21699306139092196`; because `n=4`, exact `SE(mean)^2=N/48`. `gcd(N,48)=4`, so the identical rational is `5424826534773049/12`. The GAP-111 admission rejected the unreduced numerator because it exceeds `2^53` and fell back to a translated floating path that returns adjacent lower bits `0x4174_46e5_76f8_7444`; the reduced numerator fits the existing exact midpoint-square proof and returns correctly rounded `0x4174_46e5_76f8_7445`. +GAP-113 RED `50153a1c4452d780c23b58fd34c695db9048e603` fixes the exact four-observation sample `truth=[0,0,0,0]`, `recovered=[19_274_968,693_729_138,711_353_557,1_625_519_116]`. Its six squared pair distances sum to `5218123316274976251`; because `n=4`, exact `SE(mean)^2=N/48`. `gcd(N,48)=3`, so the exact reduced radicand is `1739374438758325417/16`. The GAP-112 admission rejected this reduced numerator because it exceeds `2^53` and fell back to a translated floating path that returns adjacent lower bits `0x41b3_a706_d408_9e31`; exact checked midpoint comparison returns correctly rounded `0x41b3_a706_d408_9e32`. -Causal repair `ed1a8763c198fbe478de5ec8be72e3436e5918e3` changes only the exact four-observation admission: after the checked `u128` pair-square sum is formed, numerator and scientific denominator `48` are reduced by their integer GCD before the existing bounded candidate/neighbor midpoint-square comparison. The rational radicand, exactness proof, fail-closed fallback, and owner boundary are unchanged. Public RED includes permutations and sign mirrors; CHANGELOG begins at `28dde0f1e8e3a0f8e8614ed449733b98f2d65c1c`; research/TRACEABILITY current #488 is `f62b56d26f07098b683e2f31c21a7df1367ea67e`. GAP-112 does not widen the general n>2 correct-rounding claim. +Causal repair `dbf6b40946c0940c8b088f376a6dc1750401350e` changes only the bounded four-observation square-root proof. The reduced numerator remains an exact `u128` authority even above `2^53`; its binary64 conversion seeds the initial candidate but never authorizes it. Existing checked exact candidate-square and adjacent-midpoint comparisons decide the result, and any comparison overflow or unsettled candidate still fails closed to the established fallback. Public RED includes permutations and sign mirrors; CHANGELOG begins at `ca85765f7fce56c238641bffa57f4eb19547efb7`; research/TRACEABILITY current #488 is `37e3defb3bde29a8d1ac852456ba05f787aee1f3`. GAP-113 does not widen the general n>2 correct-rounding claim. -GAP-111 remains inherited: RED `978c422cbdccff02605b5d220bd2564900a830d5` fixes `[0,1,2,7]`, with exact `SE(mean)^2=116/48=29/12` and target bits `0x3ff8_df7d_a2e6_6e88`. Bounded pair-distance/midpoint repair lineage is `3de7a737...` → `ea609474...` → `2c689095...` → `622d1681...` → `170f77ee...` → `b92a4d63...` → `c8032493...`; CHANGELOG `49c46aa4...`; research ancestor `0857d5a4...`. GAP-110 underflow protection, GAP-109 scale invariance, GAP-108 exact three-level rational-square dispersion, GAP-107 conditioning-minimized exact-anchor selection, GAP-106 permutation-invariant admission, GAP-105 exact rational-square subnormal projection, GAP-104 reduced rational-square count geometry, GAP-103 reciprocal-integer-square cases, GAP-102 exact dyadic count geometry, GAP-101 `SE(mean)=|r1-r2|/2`, GAP-100 translated two-level singleton identity, GAP-099 and GAP-098 remain inherited. +GAP-112 remains inherited: RED `4f2231354fa0ad3e0c646bbb100b3cc83566d033`, GCD-reduction repair `ed1a8763c198fbe478de5ec8be72e3436e5918e3`, CHANGELOG `28dde0f1e8e3a0f8e8614ed449733b98f2d65c1c`, and research ancestor `f62b56d26f07098b683e2f31c21a7df1367ea67e`. GAP-111 bounded pair-distance/midpoint repair, GAP-110 underflow protection, GAP-109 scale invariance, GAP-108 exact three-level rational-square dispersion, GAP-107 conditioning-minimized exact-anchor selection, GAP-106 permutation-invariant admission, GAP-105 exact rational-square subnormal projection, GAP-104 reduced rational-square count geometry, GAP-103 reciprocal-integer-square cases, GAP-102 exact dyadic count geometry, GAP-101 `SE(mean)=|r1-r2|/2`, GAP-100 translated two-level singleton identity, GAP-099 and GAP-098 remain inherited. ### #416 — Validation / Analysis Run consolidation @@ -101,7 +101,7 @@ GAP-111 remains inherited: RED `978c422cbdccff02605b5d220bd2564900a830d5` fixes ## Gap register -GAP-001–GAP-044 retain their existing domain/release identities and closure lineage. They remain unchanged by the GAP-112 numerical repair; their authoritative source/test/ADR history remains in repository ancestry and the surviving landing vehicles listed above. The validation lineage from GAP-045 onward is restated here because #488 is its current single writer. +GAP-001–GAP-044 retain their existing domain/release identities and closure lineage. They remain unchanged by the GAP-113 numerical repair; their authoritative source/test/ADR history remains in repository ancestry and the surviving landing vehicles listed above. The validation lineage from GAP-045 onward is restated here because #488 is its current single writer. | ID | Gap | Maturity | Closure evidence | | --- | --- | --- | --- | @@ -149,60 +149,60 @@ GAP-001–GAP-044 retain their existing domain/release identities and closure li | GAP-042 | ratio-first logarithm inflated adjacent-float growth rate | `verification-pending` | RED `766ddc7a...` + `ln_1p` repair `16f21d9a...` | | GAP-043 | duplicate known-truth identities could silently reweight RMSE | `verification-pending` | RED `698f12f5...` + repair `2fae4cb2...` | | GAP-044 | known-truth RMSE alignment depended on row order | `verification-pending` | RED `8ad72ac9...` / `5fb93c40...` + repairs `2dd9537e...` / `025dce7f...`; #310 `c6680450...` | -| GAP-045 | mean signed bias could reject representable result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; inherited by #488 `f62b56d2...` | -| GAP-046 | bias SE could reject representable SEM because raw squared deviations overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; inherited by #488 `f62b56d2...` | -| GAP-047 | generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; inherited by #488 `f62b56d2...` | -| GAP-048 | mean signed bias could erase representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; inherited by #488 `f62b56d2...` | +| GAP-045 | mean signed bias could reject representable result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; inherited by #488 `37e3defb...` | +| GAP-046 | bias SE could reject representable SEM because raw squared deviations overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; inherited by #488 `37e3defb...` | +| GAP-047 | generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; inherited by #488 `37e3defb...` | +| GAP-048 | mean signed bias could erase representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; inherited by #488 `37e3defb...` | | GAP-049 | stable `Between` recovery could be aliased across occasion indices and reweight RMSE | `verification-pending` | RED `0a03041c...` + repair `ec2c1219...`; #310 `c6680450...` | -| GAP-050 | zero-multiplier SE-aware acceptance could erase nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; inherited by #488 `f62b56d2...` | -| GAP-051 | exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; inherited by #488 `f62b56d2...` | -| GAP-052 | all-covered Wilson lower endpoint could cancel positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; inherited by #488 `f62b56d2...` | -| GAP-053 | strict-interior Wilson lower endpoint could cancel positive value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; inherited by #488 `f62b56d2...` | -| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; inherited by #488 `f62b56d2...` | -| GAP-055 | strict-interior Wilson lower endpoint could accept nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; inherited by #488 `f62b56d2...` | -| GAP-056 | durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; inherited by #488 `f62b56d2...` | -| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; inherited by #488 `f62b56d2...` | -| GAP-058 | generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; inherited by #488 `f62b56d2...` | -| GAP-059 | Monte Carlo summary could materially misstate positive SE relative to `SD/sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; inherited by #488 `f62b56d2...` | -| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; inherited by #488 `f62b56d2...` | -| GAP-061 | generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; inherited by #488 `f62b56d2...` | -| GAP-062 | finite-tolerance matching could fail for deterministically outside pair | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; inherited by #488 `f62b56d2...` | -| GAP-063 | exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; inherited by #488 `f62b56d2...` | -| GAP-064 | positive point RMSE could carry SE above squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; inherited by #488 `f62b56d2...` | -| GAP-065 | positive Monte Carlo RMSE could carry impossible spread/SE | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; inherited by #488 `f62b56d2...` | -| GAP-066 | RMSE nearest-rank percentile could exceed nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; inherited by #488 `f62b56d2...` | -| GAP-067 | generic nearest-rank endpoint could be incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected repair `2798e4f9...`; causal repair `c7151b49...`; inherited by #488 `f62b56d2...` | -| GAP-068 | distinct generic percentile endpoints could jointly exceed squared-deviation budget | `verification-pending` | RED `c4a13826...` + repair `cb3f80a2...`; inherited by #488 `f62b56d2...` | -| GAP-069 | two-replication endpoints could exhaust sample while mean/SD remained impossible | `verification-pending` | RED `81bf0d9e...` + repair `d48f8fef...`; inherited by #488 `f62b56d2...` | -| GAP-070 | stored Wilson pair could not arise from one score interval | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...`; inherited by #488 `f62b56d2...` | -| GAP-071 | durable Wilson evidence lacked denominator/critical-value/sidedness provenance | `active-repair` | carrier/authority/v1/envelope lineage; inherited by #488 `f62b56d2...`; durable-consumer adoption remains | -| GAP-072 | exact all-covered Wilson evidence could retain impossible zero lower endpoint | `verification-pending` | RED `ce714f07...` + repair `72e9d954...`; inherited by #488 `f62b56d2...` | -| GAP-073 | durable Wilson count provenance could lose one uncovered observation above exact-integer range | `verification-pending` | RED `29d710a5...` + count/fixed-width/exact-ratio repair lineage; inherited by #488 `f62b56d2...` | -| GAP-074 | durable exact count could be pre-rounded before endpoint projection | `verification-pending` | RED `f89e2467...` + reciprocal-scale repair `73bbb5cf...`; inherited by #488 `f62b56d2...` | -| GAP-075 | inexact all-covered Wilson miss mass could round to exact one | `verification-pending` | RED `059ce70d...` + canonical repair `0f478392...`; inherited by #488 `f62b56d2...` | -| GAP-076 | exact all-covered count could absorb small positive `z²` and emit exact `1.0` | `verification-pending` | RED `e0c4ec81...` + repair `c9dcb9df...`; inherited by #488 `f62b56d2...` | -| GAP-077 | inexact partial denominator could shift exact-count Wilson endpoint by one ULP | `verification-pending` | RED `06e55653...` + TwoSum/FMA repair `6c084dbe...`; inherited by #488 `f62b56d2...` | -| GAP-078 | Wilson residual compensation could move quotient across wrong midpoint | `verification-pending` | RED `d076d344...` + midpoint repair `32314239...`; inherited by #488 `f62b56d2...` | -| GAP-079 | SE-aware acceptance could underflow finite positive `k*SE` to zero through scale-first arithmetic | `verification-pending` | RED `76067efc...` + direct-finite repair `4ffdf366...`; inherited by #488 `f62b56d2...` | -| GAP-080 | both-overflow SE-aware fallback could round strict rejection into equality | `verification-pending` | RED `a9a45714...` + exact significand/exponent repair `425e8963...`; inherited by #488 `f62b56d2...` | -| GAP-081 | finite multiplication could round strict SE-aware rejection into equality | `verification-pending` | RED `23c3262c...` + tie repair `6a2add48...`; inherited by #488 `f62b56d2...` | -| GAP-082 | finite subtraction could round strict rejection onto exact bound | `verification-pending` | RED `58cbc032...` + low-term repair `68a6fd98...`; inherited by #488 `f62b56d2...` | -| GAP-083 | SE-aware product correction could fall below binary64 resolution | `verification-pending` | RED `b55c5473...` / `c77ac440...` + corrected repair `772ad8ed...`; inherited by #488 `f62b56d2...` | -| GAP-084 | legacy Wilson boundary could contradict peer endpoint root | `verification-pending` | RED `c9d612f2...` + peer-root repair `88512417...`; inherited by #488 `f62b56d2...` | -| GAP-085 | equal nonzero subtraction/FMA correction projections could conceal exact ordering | `verification-pending` | RED `35ea85ba...` + exact product-roundoff repair `7d597a18...`; inherited by #488 `f62b56d2...` | -| GAP-086 | mean bias could reject representable result because individual residuals overflow | `verification-pending` | RED `04e6e745...` + explicit-denominator cancellation/bias repair lineage; inherited by #488 `f62b56d2...` | -| GAP-087 | mixed-sign mean bias could discard repeated sub-ULP opposing mass | `verification-pending` | RED `63913727...` + low-term repair `5697cca5...`; inherited by #488 `f62b56d2...` | -| GAP-088 | mixed-remainder compensation could round before scientific count division | `verification-pending` | RED `8b4d19d1...` + compensated-division repair `7a33212b...`; inherited by #488 `f62b56d2...` | -| GAP-089 | exact cancellation could leave same-sign remainder rounded before division | `verification-pending` | RED `84476aad...` + repair `5f0d40b8...`; inherited by #488 `f62b56d2...` | -| GAP-090 | same-sign all-subnormal mean normalization could double-round final bias | `verification-pending` | RED `91abdb49...` + exact-unit repair `1c0df8a7...` + halfway coverage; inherited by #488 `f62b56d2...` | -| GAP-091 | pairwise subtraction roundoff could move mean bias across final midpoint | `verification-pending` | RED `a9d9bda3...` + corrected tail/midpoint repair `676ccda0...`; inherited by #488 `f62b56d2...` | -| GAP-092 | two distinct represented residuals could collapse to one subtraction and false-zero bias SE | `verification-pending` | RED `c9c55ea5...` + n=2 expanded-difference repair `f6d7da96...`; inherited by #488 `f62b56d2...` | -| GAP-093 | n>2 distinct represented residuals could collapse to one rounded high and false-zero bias SE | `verification-pending` | RED `06a70e1c...` + common-high/error-free-low repair `04c62514...`; inherited by #488 `f62b56d2...` | -| GAP-094 | separately rounded square roots could shift bias SE by one ULP | `verification-pending` | corrected RED `62243204...` + direct normalized-SE repair `8b8f0a21...`; inherited by #488 `f62b56d2...` | -| GAP-095 | distinct rounded residual highs could materially overstate uncertainty after subtraction roundoff | `verification-pending` | RED `ae906ad6...` + exact translated-residual repair `d59b9c30...`; inherited by #488 `f62b56d2...` | -| GAP-096 | exact residuals could be re-centered on rounded mean and distort dispersion | `verification-pending` | RED `9265b34a...` + exact-residual translated repair `2fa266b2...`; inherited by #488 `f62b56d2...` | -| GAP-097 | common-high subtraction path could round low-term mean before centering | `verification-pending` | RED `d48e2515...` + exact low-term translated-second-moment repair `a63b8d7a...`; inherited by #488 `f62b56d2...` | -| GAP-098 | exact translated-residual bias SE could double-round through a non-power normalization scale and move the final represented result by one ULP | `verification-pending` | RED `426fc5af...` + shared dyadic-scale prerequisite `d8b411f5...` + causal repair `d536e3b1...` + CHANGELOG `ebce979f...`; inherited by #488 `f62b56d2...` | +| GAP-050 | zero-multiplier SE-aware acceptance could erase nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; inherited by #488 `37e3defb...` | +| GAP-051 | exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; inherited by #488 `37e3defb...` | +| GAP-052 | all-covered Wilson lower endpoint could cancel positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; inherited by #488 `37e3defb...` | +| GAP-053 | strict-interior Wilson lower endpoint could cancel positive value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; inherited by #488 `37e3defb...` | +| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; inherited by #488 `37e3defb...` | +| GAP-055 | strict-interior Wilson lower endpoint could accept nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; inherited by #488 `37e3defb...` | +| GAP-056 | durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; inherited by #488 `37e3defb...` | +| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; inherited by #488 `37e3defb...` | +| GAP-058 | generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; inherited by #488 `37e3defb...` | +| GAP-059 | Monte Carlo summary could materially misstate positive SE relative to `SD/sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; inherited by #488 `37e3defb...` | +| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; inherited by #488 `37e3defb...` | +| GAP-061 | generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; inherited by #488 `37e3defb...` | +| GAP-062 | finite-tolerance matching could fail for deterministically outside pair | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; inherited by #488 `37e3defb...` | +| GAP-063 | exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; inherited by #488 `37e3defb...` | +| GAP-064 | positive point RMSE could carry SE above squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; inherited by #488 `37e3defb...` | +| GAP-065 | positive Monte Carlo RMSE could carry impossible spread/SE | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; inherited by #488 `37e3defb...` | +| GAP-066 | RMSE nearest-rank percentile could exceed nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; inherited by #488 `37e3defb...` | +| GAP-067 | generic nearest-rank endpoint could be incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected repair `2798e4f9...`; causal repair `c7151b49...`; inherited by #488 `37e3defb...` | +| GAP-068 | distinct generic percentile endpoints could jointly exceed squared-deviation budget | `verification-pending` | RED `c4a13826...` + repair `cb3f80a2...`; inherited by #488 `37e3defb...` | +| GAP-069 | two-replication endpoints could exhaust sample while mean/SD remained impossible | `verification-pending` | RED `81bf0d9e...` + repair `d48f8fef...`; inherited by #488 `37e3defb...` | +| GAP-070 | stored Wilson pair could not arise from one score interval | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...`; inherited by #488 `37e3defb...` | +| GAP-071 | durable Wilson evidence lacked denominator/critical-value/sidedness provenance | `active-repair` | carrier/authority/v1/envelope lineage; inherited by #488 `37e3defb...`; durable-consumer adoption remains | +| GAP-072 | exact all-covered Wilson evidence could retain impossible zero lower endpoint | `verification-pending` | RED `ce714f07...` + repair `72e9d954...`; inherited by #488 `37e3defb...` | +| GAP-073 | durable Wilson count provenance could lose one uncovered observation above exact-integer range | `verification-pending` | RED `29d710a5...` + count/fixed-width/exact-ratio repair lineage; inherited by #488 `37e3defb...` | +| GAP-074 | durable exact count could be pre-rounded before endpoint projection | `verification-pending` | RED `f89e2467...` + reciprocal-scale repair `73bbb5cf...`; inherited by #488 `37e3defb...` | +| GAP-075 | inexact all-covered Wilson miss mass could round to exact one | `verification-pending` | RED `059ce70d...` + canonical repair `0f478392...`; inherited by #488 `37e3defb...` | +| GAP-076 | exact all-covered count could absorb small positive `z²` and emit exact `1.0` | `verification-pending` | RED `e0c4ec81...` + repair `c9dcb9df...`; inherited by #488 `37e3defb...` | +| GAP-077 | inexact partial denominator could shift exact-count Wilson endpoint by one ULP | `verification-pending` | RED `06e55653...` + TwoSum/FMA repair `6c084dbe...`; inherited by #488 `37e3defb...` | +| GAP-078 | Wilson residual compensation could move quotient across wrong midpoint | `verification-pending` | RED `d076d344...` + midpoint repair `32314239...`; inherited by #488 `37e3defb...` | +| GAP-079 | SE-aware acceptance could underflow finite positive `k*SE` to zero through scale-first arithmetic | `verification-pending` | RED `76067efc...` + direct-finite repair `4ffdf366...`; inherited by #488 `37e3defb...` | +| GAP-080 | both-overflow SE-aware fallback could round strict rejection into equality | `verification-pending` | RED `a9a45714...` + exact significand/exponent repair `425e8963...`; inherited by #488 `37e3defb...` | +| GAP-081 | finite multiplication could round strict SE-aware rejection into equality | `verification-pending` | RED `23c3262c...` + tie repair `6a2add48...`; inherited by #488 `37e3defb...` | +| GAP-082 | finite subtraction could round strict rejection onto exact bound | `verification-pending` | RED `58cbc032...` + low-term repair `68a6fd98...`; inherited by #488 `37e3defb...` | +| GAP-083 | SE-aware product correction could fall below binary64 resolution | `verification-pending` | RED `b55c5473...` / `c77ac440...` + corrected repair `772ad8ed...`; inherited by #488 `37e3defb...` | +| GAP-084 | legacy Wilson boundary could contradict peer endpoint root | `verification-pending` | RED `c9d612f2...` + peer-root repair `88512417...`; inherited by #488 `37e3defb...` | +| GAP-085 | equal nonzero subtraction/FMA correction projections could conceal exact ordering | `verification-pending` | RED `35ea85ba...` + exact product-roundoff repair `7d597a18...`; inherited by #488 `37e3defb...` | +| GAP-086 | mean bias could reject representable result because individual residuals overflow | `verification-pending` | RED `04e6e745...` + explicit-denominator cancellation/bias repair lineage; inherited by #488 `37e3defb...` | +| GAP-087 | mixed-sign mean bias could discard repeated sub-ULP opposing mass | `verification-pending` | RED `63913727...` + low-term repair `5697cca5...`; inherited by #488 `37e3defb...` | +| GAP-088 | mixed-remainder compensation could round before scientific count division | `verification-pending` | RED `8b4d19d1...` + compensated-division repair `7a33212b...`; inherited by #488 `37e3defb...` | +| GAP-089 | exact cancellation could leave same-sign remainder rounded before division | `verification-pending` | RED `84476aad...` + repair `5f0d40b8...`; inherited by #488 `37e3defb...` | +| GAP-090 | same-sign all-subnormal mean normalization could double-round final bias | `verification-pending` | RED `91abdb49...` + exact-unit repair `1c0df8a7...` + halfway coverage; inherited by #488 `37e3defb...` | +| GAP-091 | pairwise subtraction roundoff could move mean bias across final midpoint | `verification-pending` | RED `a9d9bda3...` + corrected tail/midpoint repair `676ccda0...`; inherited by #488 `37e3defb...` | +| GAP-092 | two distinct represented residuals could collapse to one subtraction and false-zero bias SE | `verification-pending` | RED `c9c55ea5...` + n=2 expanded-difference repair `f6d7da96...`; inherited by #488 `37e3defb...` | +| GAP-093 | n>2 distinct represented residuals could collapse to one rounded high and false-zero bias SE | `verification-pending` | RED `06a70e1c...` + common-high/error-free-low repair `04c62514...`; inherited by #488 `37e3defb...` | +| GAP-094 | separately rounded square roots could shift bias SE by one ULP | `verification-pending` | corrected RED `62243204...` + direct normalized-SE repair `8b8f0a21...`; inherited by #488 `37e3defb...` | +| GAP-095 | distinct rounded residual highs could materially overstate uncertainty after subtraction roundoff | `verification-pending` | RED `ae906ad6...` + exact translated-residual repair `d59b9c30...`; inherited by #488 `37e3defb...` | +| GAP-096 | exact residuals could be re-centered on rounded mean and distort dispersion | `verification-pending` | RED `9265b34a...` + exact-residual translated repair `2fa266b2...`; inherited by #488 `37e3defb...` | +| GAP-097 | common-high subtraction path could round low-term mean before centering | `verification-pending` | RED `d48e2515...` + exact low-term translated-second-moment repair `a63b8d7a...`; inherited by #488 `37e3defb...` | +| GAP-098 | exact translated-residual bias SE could double-round through a non-power normalization scale and move the final represented result by one ULP | `verification-pending` | RED `426fc5af...` + shared dyadic-scale prerequisite `d8b411f5...` + causal repair `d536e3b1...` + CHANGELOG `ebce979f...`; inherited by #488 `37e3defb...` | | GAP-099 | exact translated three-observation two-level bias SE could re-round an exact gap through square/second-moment/square-root and move the represented result by one ULP | `verification-pending` | RED `fbcdb7fa...` + causal repair `e0f2445d...` + CHANGELOG `ee81953e...` + research/ancestor #488 `7741aaa...`; exact-head hosted GREEN/review/main integration remain pending | | GAP-100 | exact translated two-level bias SE with one singleton could re-round an exact gap through square/second-moment/square-root beyond the n=3 case | `verification-pending` | RED `4386d9ac...` + causal repair `79ad03fa...` + edge `7fe4117c...` + CHANGELOG `017ad11...` + research/ancestor #488 `944fac05...`; exact-head hosted GREEN/review/main integration remain pending | | GAP-101 | exact two-observation residuals could be re-centered on a rounded midpoint mean and materially distort `SE(mean)` despite exact pairwise subtraction | `verification-pending` | RED `d3dcd918...` + causal repair `02b0a178...` + CHANGELOG `5603b12d...` + research/ancestor #488 `905addcc...`; exact-head hosted GREEN/review/main integration remain pending | @@ -216,7 +216,8 @@ GAP-001–GAP-044 retain their existing domain/release identities and closure li | GAP-109 | exact translated three-observation rational-square bias-SE proof could reject the same represented geometry solely because exact power-of-two scaling overflowed raw square/cross-product intermediates | `verification-pending` | RED `67fa4852...` + causal repair `dcaf25b3...` + CHANGELOG `31b1aff8...` + research/ancestor #488 `1eaac11e...`; all-permutation/sign-mirror scale-invariance contract; exact-head hosted GREEN/review/main integration remain pending | | GAP-110 | exact translated three-observation bias SE could falsely become zero when mathematically nonzero square/cross-product intermediates underflowed below binary64 range before the bounded exact proof | `verification-pending` | RED `fe013e7d...` + causal repair `d3660d44...` + CHANGELOG `ac833ec1...` + research/ancestor #488 `8bb35572...`; all-permutation/sign-mirror underflow-scale contract; exact-head hosted GREEN/review/main integration remain pending | | GAP-111 | exact four-observation pair-distance dispersion could move one ULP because the exact rational radicand was rounded before `sqrt` | `verification-pending` | RED `978c422c...` + bounded pair-distance/midpoint repair lineage `3de7a737...` → `c8032493...` + CHANGELOG `49c46aa4...` + research/ancestor #488 `0857d5a4...`; permutation/sign-mirror and proof-edge contracts added; exact-head hosted GREEN/review/main integration remain pending | -| GAP-112 | exact four-observation pair-distance proof could reject an equivalent bounded rational solely because the unreduced numerator exceeded the exact-binary64 integer admission | `verification-pending` | RED `4f223135...` + causal repair `ed1a8763...` + CHANGELOG `28dde0f1...` + research/current #488 `f62b56d2...`; permutation/sign-mirror contract added; exact-head hosted GREEN/review/main integration remain pending | +| GAP-112 | exact four-observation pair-distance proof could reject an equivalent bounded rational solely because the unreduced numerator exceeded the exact-binary64 integer admission | `verification-pending` | RED `4f223135...` + causal repair `ed1a8763...` + CHANGELOG `28dde0f1...` + research/ancestor #488 `f62b56d2...`; permutation/sign-mirror contract added; exact-head hosted GREEN/review/main integration remain pending | +| GAP-113 | exact four-observation pair-distance proof could reject a GCD-reduced exact rational solely because its exact `u128` numerator exceeded `2^53` even though the rounded numerator was only a candidate seed | `verification-pending` | RED `50153a1c...` + causal repair `dbf6b409...` + CHANGELOG `ca85765f...` + research/current #488 `37e3defb...`; permutation/sign-mirror contract added; exact-head hosted GREEN/review/main integration remain pending | ## Release gate From a182b54c065aac18b93f950fa1bd02dfc7b6ce46 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 5 Sep 2026 21:38:55 +0900 Subject: [PATCH 208/235] docs(gaps): carry Validation Evidence through GAP-114 --- docs/product-technical-gap-baseline.md | 21 +++++++++++---------- 1 file changed, 11 insertions(+), 10 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index d2696fd25..06c361df3 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-05T12:10:02Z +**Snapshot:** 2026-09-05T12:35:02Z **Protected-main evidence:** `a243f18da4a4ca8a8d068c39922537f1f8ed6ad0` **Workspace version:** `0.2.0` @@ -30,7 +30,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `37e3defb3bde29a8d1ac852456ba05f787aee1f3` | true | `main` | Validation Evidence landing vehicle, based on protected #490. GAP-113 keeps a GCD-reduced exact four-observation pair-distance radicand in the bounded midpoint proof even when the reduced `u128` numerator exceeds `2^53`: RED `50153a1c...` uses `[19274968,693729138,711353557,1625519116]`, pair-square sum `5218123316274976251`, denominator `48`, gcd `3`, reduced ratio `1739374438758325417/16`; the fallback returns adjacent-lower `0x41b3_a706_d408_9e31` while exact midpoint comparison returns `0x41b3_a706_d408_9e32`. Repair `dbf6b409...` treats the rounded binary64 numerator only as a candidate seed and retains exact checked `u128` square/midpoint comparisons as authority. GAP-112 and all earlier represented-input Validation Evidence repairs remain inherited. Hosted exact-head gates and independent review remain required. | +| #488 | `8f7dbf8843ce5c9a2f48e3f67779382e0096d3c2` | true | `main` | Validation Evidence landing vehicle, based on protected #490. GAP-114 extends the existing bounded exact pair-distance/midpoint proof from four to five observations only: RED `5878ec10...` uses `[1342748146,1434848064,1525257611,1685877224,1771341094]`, pair-square sum `621298477313343404`, denominator `100`, gcd `4`, reduced ratio `155324619328335851/25`; the translated floating moment/`sqrt` fallback returns adjacent-upper `0x4192_caf1_6406_5ad1`, while exact midpoint comparison returns `0x4192_caf1_6406_5ad0`. Repair `41298270...` retains checked residual/pair-difference exactness, checked `u128`, GCD reduction, and exact candidate/neighbor midpoint authority; it deliberately does not generalize O(n²) pair distances to arbitrary sample counts. GAP-113 and all earlier represented-input Validation Evidence repairs remain inherited. Hosted exact-head gates and independent review remain required. | | #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 | Validation / Analysis Run fold child. Unique evidence must be inherited by a conflict-resolving survivor; child-head CI does not transfer. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | @@ -62,7 +62,7 @@ The clock contract separates event/valid time, assertion time, document time, sy - Row arrival order is not scientific evidence. Fixed admitted observations must produce bit-identical means/centered results under permutation wherever the contract claims deterministic CPU `f64` reference behavior. - Known-truth component recovery follows bounded-context identity: stable `Between` is unit-level and uses canonical `occasion_index = 0`; `Within` retains actual `(unit, occasion)` identity. Duplicate identities or stable-Between occasion aliases are not weights. - A representable final scientific estimand is not rejected solely because an avoidable intermediate binary64 operation overflows/underflows. False exact 0/1/non-finite endpoints, erased finite bounds, cancellation residues, and double-rounded endpoints are not accepted when a bounded equivalent operation preserves the represented estimand or decision. -- Mean signed bias and bias SE remain Validation Evidence performance measures over admitted recovery units. `mean_bias` uses the direct residual path only when every pairwise subtraction is finite and preserves represented low-order input mass; otherwise it uses the algebraically equivalent recovered-plus-negated-truth numerator, cancellation-safe exact-power-of-two scaling, and the original scientific denominator. `bias_standard_error` still requires each individual signed residual to be representable. For every two-observation sample, TEPP evaluates `SE(mean)=|r1-r2|/2` before a rounded residual mean can become authoritative; subtraction-roundoff cases use expanded represented inputs, while exact-subtraction cases use the represented residual difference through the cancellation/overflow-safe scientific denominator. For `n>2`, the exact translated-residual path is admitted only when anchor-relative high, low, and combined deltas are exactly representable. Every exact candidate anchor is evaluated; the candidate with the smallest maximum translated magnitude is selected, with canonical represented `(high, low)` order only as a deterministic tie-breaker. This retains GAP-106 permutation invariance while GAP-107 prevents an avoidably wide exact representation from becoming authoritative. Translation-invariant dispersion is then evaluated before any rounded residual mean becomes authoritative. GAP-098 requires exact power-of-two normalization; GAP-099 established the exact `n=3` two-level identity; GAP-100 generalized singleton/repeated-level geometry; GAP-102 established a reciprocal-power-of-two count shortcut; GAP-103 widened that to reciprocal-integer-square factors; GAP-104 generalized it to any reduced count factor satisfying `m(n-m)/(n^2(n-1))=(a/b)^2` with checked integer roots. GAP-105 additionally requires an admitted exact rational scale whose final represented value is subnormal to be rounded once in exact minimum-subnormal units rather than through normalized quotient plus scale restoration. GAP-108 adds the exact three-observation, three-level identity `SE(mean)^2=(x²+y²-xy)/9` only when the two nonzero translated offsets have error-free represented squares/cross-product, the sum/subtraction is error-free, and the numerator has an exact represented square root; only that proved root is divided by three once. GAP-109 makes that proof invariant to exact dyadic unit scaling: if raw square/cross-product intermediates overflow, the same proof is retried only after an exactly reversible power-of-two normalization, with exact reconstruction required before the normalized result can become authoritative. GAP-110 applies the same bounded retry when a mathematically nonzero raw square/cross-product underflows to represented zero; a zero FMA residual at a product already outside the destination range is not evidence of an exact-zero product. GAP-111 adds an exact four-observation pair-distance identity `SE(mean)^2=Σ_{i2 dispersion. Mathematically nonzero final results outside binary64 range fail closed. +- Mean signed bias and bias SE remain Validation Evidence performance measures over admitted recovery units. `mean_bias` uses the direct residual path only when every pairwise subtraction is finite and preserves represented low-order input mass; otherwise it uses the algebraically equivalent recovered-plus-negated-truth numerator, cancellation-safe exact-power-of-two scaling, and the original scientific denominator. `bias_standard_error` still requires each individual signed residual to be representable. For every two-observation sample, TEPP evaluates `SE(mean)=|r1-r2|/2` before a rounded residual mean can become authoritative; subtraction-roundoff cases use expanded represented inputs, while exact-subtraction cases use the represented residual difference through the cancellation/overflow-safe scientific denominator. For `n>2`, the exact translated-residual path is admitted only when anchor-relative high, low, and combined deltas are exactly representable. Every exact candidate anchor is evaluated; the candidate with the smallest maximum translated magnitude is selected, with canonical represented `(high, low)` order only as a deterministic tie-breaker. This retains GAP-106 permutation invariance while GAP-107 prevents an avoidably wide exact representation from becoming authoritative. Translation-invariant dispersion is then evaluated before any rounded residual mean becomes authoritative. GAP-098 requires exact power-of-two normalization; GAP-099 established the exact `n=3` two-level identity; GAP-100 generalized singleton/repeated-level geometry; GAP-102 established a reciprocal-power-of-two count shortcut; GAP-103 widened that to reciprocal-integer-square factors; GAP-104 generalized it to any reduced count factor satisfying `m(n-m)/(n^2(n-1))=(a/b)^2` with checked integer roots. GAP-105 additionally requires an admitted exact rational scale whose final represented value is subnormal to be rounded once in exact minimum-subnormal units rather than through normalized quotient plus scale restoration. GAP-108 adds the exact three-observation, three-level identity `SE(mean)^2=(x²+y²-xy)/9` only when the two nonzero translated offsets have error-free represented squares/cross-product, the sum/subtraction is error-free, and the numerator has an exact represented square root; only that proved root is divided by three once. GAP-109 makes that proof invariant to exact dyadic unit scaling: if raw square/cross-product intermediates overflow, the same proof is retried only after an exactly reversible power-of-two normalization, with exact reconstruction required before the normalized result can become authoritative. GAP-110 applies the same bounded retry when a mathematically nonzero raw square/cross-product underflows to represented zero; a zero FMA residual at a product already outside the destination range is not evidence of an exact-zero product. GAP-111 adds an exact four-observation pair-distance identity `SE(mean)^2=Σ_{i2 dispersion. Mathematically nonzero final results outside binary64 range fail closed. - Generic Validation Evidence RMSE and its delta-method SE normalize before squaring. Exact-zero point RMSE requires exact-zero point RMSE SE. For positive RMSE, the declared producer satisfies `SE(RMSE) <= RMSE / 2`, with a small relative binary64 admission tolerance. - Generic `MonteCarloSummary` is sign-neutral. Zero SD requires zero SE and percentile endpoints equal to the represented mean. Positive SD requires positive SE coherent with represented `SD / sqrt(n)` within a small relative tolerance. Every inclusive nearest-rank endpoint is a retained observation and satisfies `|endpoint - mean| <= SD * sqrt(n - 1)`. Distinct lower/upper endpoint values share the same `(n - 1) * SD²` deviation budget. When `replication_count=2` and endpoints are distinct, those endpoints exhaust the retained sample and must reconstruct the represented mean/sample SD. - When the generic carrier occupies `ValidationReport::monte_carlo_rmse`, retained replications are nonnegative; positive mean implies `SE(mean) <= mean`, and inclusive nearest-rank endpoints cannot exceed nonnegative sample-sum support `n * mean`. These typed bounds are not imposed on signed metrics such as bias. @@ -83,13 +83,13 @@ The clock contract separates event/valid time, assertion time, document time, sy ### #488 — Validation Evidence -#488 is the generic Validation Evidence landing vehicle at exact head `37e3defb3bde29a8d1ac852456ba05f787aee1f3`, based on protected #490. GAP-092–112 remain inherited and executable. +#488 is the generic Validation Evidence landing vehicle at exact head `8f7dbf8843ce5c9a2f48e3f67779382e0096d3c2`, based on protected #490. GAP-092–113 remain inherited and executable. -GAP-113 RED `50153a1c4452d780c23b58fd34c695db9048e603` fixes the exact four-observation sample `truth=[0,0,0,0]`, `recovered=[19_274_968,693_729_138,711_353_557,1_625_519_116]`. Its six squared pair distances sum to `5218123316274976251`; because `n=4`, exact `SE(mean)^2=N/48`. `gcd(N,48)=3`, so the exact reduced radicand is `1739374438758325417/16`. The GAP-112 admission rejected this reduced numerator because it exceeds `2^53` and fell back to a translated floating path that returns adjacent lower bits `0x41b3_a706_d408_9e31`; exact checked midpoint comparison returns correctly rounded `0x41b3_a706_d408_9e32`. +GAP-114 RED `5878ec10f458efb5f070446dcb3ead30900ef707` fixes the exact five-observation sample `truth=[0,0,0,0,0]`, `recovered=[1_342_748_146,1_434_848_064,1_525_257_611,1_685_877_224,1_771_341_094]`. Its ten squared pair distances sum to `621298477313343404`; because `n=5`, exact `SE(mean)^2=N/100`. `gcd(N,100)=4`, so the exact reduced radicand is `155324619328335851/25`. The predecessor four-observation-only admission falls back to translated floating moments and returns adjacent upper bits `0x4192_caf1_6406_5ad1`; exact checked midpoint comparison returns correctly rounded `0x4192_caf1_6406_5ad0`. -Causal repair `dbf6b40946c0940c8b088f376a6dc1750401350e` changes only the bounded four-observation square-root proof. The reduced numerator remains an exact `u128` authority even above `2^53`; its binary64 conversion seeds the initial candidate but never authorizes it. Existing checked exact candidate-square and adjacent-midpoint comparisons decide the result, and any comparison overflow or unsettled candidate still fails closed to the established fallback. Public RED includes permutations and sign mirrors; CHANGELOG begins at `ca85765f7fce56c238641bffa57f4eb19547efb7`; research/TRACEABILITY current #488 is `37e3defb3bde29a8d1ac852456ba05f787aee1f3`. GAP-113 does not widen the general n>2 correct-rounding claim. +Causal repair `41298270e8e3d4476ba1bbad9f22ea94752a9e6a` changes only the bounded small-sample pair-distance square-root proof. Four and five observations share the exact identity `SE(mean)^2=Σ_{i2 correct-rounding claim. -GAP-112 remains inherited: RED `4f2231354fa0ad3e0c646bbb100b3cc83566d033`, GCD-reduction repair `ed1a8763c198fbe478de5ec8be72e3436e5918e3`, CHANGELOG `28dde0f1e8e3a0f8e8614ed449733b98f2d65c1c`, and research ancestor `f62b56d26f07098b683e2f31c21a7df1367ea67e`. GAP-111 bounded pair-distance/midpoint repair, GAP-110 underflow protection, GAP-109 scale invariance, GAP-108 exact three-level rational-square dispersion, GAP-107 conditioning-minimized exact-anchor selection, GAP-106 permutation-invariant admission, GAP-105 exact rational-square subnormal projection, GAP-104 reduced rational-square count geometry, GAP-103 reciprocal-integer-square cases, GAP-102 exact dyadic count geometry, GAP-101 `SE(mean)=|r1-r2|/2`, GAP-100 translated two-level singleton identity, GAP-099 and GAP-098 remain inherited. +GAP-113 remains inherited: RED `50153a1c4452d780c23b58fd34c695db9048e603`, causal repair `dbf6b40946c0940c8b088f376a6dc1750401350e`, CHANGELOG `ca85765f7fce56c238641bffa57f4eb19547efb7`, and research ancestor `37e3defb3bde29a8d1ac852456ba05f787aee1f3`. GAP-112 GCD-reduction repair, GAP-111 bounded pair-distance/midpoint repair, GAP-110 underflow protection, GAP-109 scale invariance, GAP-108 exact three-level rational-square dispersion, GAP-107 conditioning-minimized exact-anchor selection, GAP-106 permutation-invariant admission, GAP-105 exact rational-square subnormal projection, GAP-104 reduced rational-square count geometry, GAP-103 reciprocal-integer-square cases, GAP-102 exact dyadic count geometry, GAP-101 `SE(mean)=|r1-r2|/2`, GAP-100 translated two-level singleton identity, GAP-099 and GAP-098 remain inherited. ### #416 — Validation / Analysis Run consolidation @@ -101,7 +101,7 @@ GAP-112 remains inherited: RED `4f2231354fa0ad3e0c646bbb100b3cc83566d033`, GCD-r ## Gap register -GAP-001–GAP-044 retain their existing domain/release identities and closure lineage. They remain unchanged by the GAP-113 numerical repair; their authoritative source/test/ADR history remains in repository ancestry and the surviving landing vehicles listed above. The validation lineage from GAP-045 onward is restated here because #488 is its current single writer. +GAP-001–GAP-044 retain their existing domain/release identities and closure lineage. They remain unchanged by the GAP-114 numerical repair; their authoritative source/test/ADR history remains in repository ancestry and the surviving landing vehicles listed above. The validation lineage from GAP-045 onward is restated here because #488 is its current single writer. | ID | Gap | Maturity | Closure evidence | | --- | --- | --- | --- | @@ -217,8 +217,9 @@ GAP-001–GAP-044 retain their existing domain/release identities and closure li | GAP-110 | exact translated three-observation bias SE could falsely become zero when mathematically nonzero square/cross-product intermediates underflowed below binary64 range before the bounded exact proof | `verification-pending` | RED `fe013e7d...` + causal repair `d3660d44...` + CHANGELOG `ac833ec1...` + research/ancestor #488 `8bb35572...`; all-permutation/sign-mirror underflow-scale contract; exact-head hosted GREEN/review/main integration remain pending | | GAP-111 | exact four-observation pair-distance dispersion could move one ULP because the exact rational radicand was rounded before `sqrt` | `verification-pending` | RED `978c422c...` + bounded pair-distance/midpoint repair lineage `3de7a737...` → `c8032493...` + CHANGELOG `49c46aa4...` + research/ancestor #488 `0857d5a4...`; permutation/sign-mirror and proof-edge contracts added; exact-head hosted GREEN/review/main integration remain pending | | GAP-112 | exact four-observation pair-distance proof could reject an equivalent bounded rational solely because the unreduced numerator exceeded the exact-binary64 integer admission | `verification-pending` | RED `4f223135...` + causal repair `ed1a8763...` + CHANGELOG `28dde0f1...` + research/ancestor #488 `f62b56d2...`; permutation/sign-mirror contract added; exact-head hosted GREEN/review/main integration remain pending | -| GAP-113 | exact four-observation pair-distance proof could reject a GCD-reduced exact rational solely because its exact `u128` numerator exceeded `2^53` even though the rounded numerator was only a candidate seed | `verification-pending` | RED `50153a1c...` + causal repair `dbf6b409...` + CHANGELOG `ca85765f...` + research/current #488 `37e3defb...`; permutation/sign-mirror contract added; exact-head hosted GREEN/review/main integration remain pending | +| GAP-113 | exact four-observation pair-distance proof could reject a GCD-reduced exact rational solely because its exact `u128` numerator exceeded `2^53` even though the rounded numerator was only a candidate seed | `verification-pending` | RED `50153a1c...` + causal repair `dbf6b409...` + CHANGELOG `ca85765f...` + research/ancestor #488 `37e3defb...`; permutation/sign-mirror contract added; exact-head hosted GREEN/review/main integration remain pending | +| GAP-114 | exact five-observation pair-distance dispersion could move one ULP because the bounded midpoint proof stopped at four observations | `verification-pending` | RED `5878ec10...` + causal repair `41298270...` + CHANGELOG `4f6f61d3...` + research/current #488 `8f7dbf88...`; permutation/sign-mirror contract added; exact-head hosted GREEN/review/main integration remain pending | ## Release gate -TEPP currently has no GitHub release. Release is permitted only after a clean coherent vertical reaches protected main with exact protected-head CI/security evidence, scientific/recovery acceptance, reproducible package/build artifacts with SBOM and provenance, validated migrations/upgrade/rollback/recovery where applicable, consistent version metadata and current `CHANGELOG.md`, accessibility/operability evidence for user-facing components, no unresolved scientific/privacy/security/supply-chain blockers, and released integration contracts where deployment depends on them. Queued/pending/startup-failed/skipped or predecessor-head evidence is not GREEN. \ No newline at end of file +TEPP currently has no GitHub release. Release is permitted only after a clean coherent vertical reaches protected main with exact protected-head CI/security evidence, scientific/recovery acceptance, reproducible package/build artifacts with SBOM and provenance, validated migrations/upgrade/rollback/recovery where applicable, consistent version metadata and current `CHANGELOG.md`, accessibility/operability evidence for user-facing components, no unresolved scientific/privacy/security/supply-chain blockers, and released integration contracts where deployment depends on them. Queued/pending/startup-failed/skipped or predecessor-head evidence is not GREEN. From 547014c89eed3dda8da4a2c9d78b6e0012645d27 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 5 Sep 2026 21:48:10 +0900 Subject: [PATCH 209/235] docs(gaps): carry Validation Evidence through GAP-115 --- docs/product-technical-gap-baseline.md | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 06c361df3..b826a3ff3 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-05T12:35:02Z +**Snapshot:** 2026-09-05T12:46:00Z **Protected-main evidence:** `a243f18da4a4ca8a8d068c39922537f1f8ed6ad0` **Workspace version:** `0.2.0` @@ -30,7 +30,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `8f7dbf8843ce5c9a2f48e3f67779382e0096d3c2` | true | `main` | Validation Evidence landing vehicle, based on protected #490. GAP-114 extends the existing bounded exact pair-distance/midpoint proof from four to five observations only: RED `5878ec10...` uses `[1342748146,1434848064,1525257611,1685877224,1771341094]`, pair-square sum `621298477313343404`, denominator `100`, gcd `4`, reduced ratio `155324619328335851/25`; the translated floating moment/`sqrt` fallback returns adjacent-upper `0x4192_caf1_6406_5ad1`, while exact midpoint comparison returns `0x4192_caf1_6406_5ad0`. Repair `41298270...` retains checked residual/pair-difference exactness, checked `u128`, GCD reduction, and exact candidate/neighbor midpoint authority; it deliberately does not generalize O(n²) pair distances to arbitrary sample counts. GAP-113 and all earlier represented-input Validation Evidence repairs remain inherited. Hosted exact-head gates and independent review remain required. | +| #488 | `d2d8617bdd47ce027074c1561121a2e3baab340c` | true | `main` | Validation Evidence landing vehicle, based on protected #490. GAP-115 extends the bounded exact pair-distance/midpoint proof through six observations: RED `cb07b89b...` uses `[1120315269,1513609015,1569037659,1789057504,1807936669,1914796738]`, pair-square sum `2486413148856729212`, denominator `180`, gcd `4`, reduced ratio `621603287214182303/45`; the translated floating moment/`sqrt` fallback returns adjacent-upper `0x419c_057d_42fc_5858`, while exact midpoint comparison returns `0x419c_057d_42fc_5857`. Repair `8e194dc1...` keeps checked residual/pair-difference exactness, checked `u128`, GCD reduction, and exact candidate/neighbor midpoint authority, and deliberately keeps the O(n²) proof bounded to `n=4..=6`. GAP-114 and all earlier represented-input Validation Evidence repairs remain inherited. Hosted exact-head gates and independent review remain required. | | #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 | Validation / Analysis Run fold child. Unique evidence must be inherited by a conflict-resolving survivor; child-head CI does not transfer. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | @@ -62,7 +62,7 @@ The clock contract separates event/valid time, assertion time, document time, sy - Row arrival order is not scientific evidence. Fixed admitted observations must produce bit-identical means/centered results under permutation wherever the contract claims deterministic CPU `f64` reference behavior. - Known-truth component recovery follows bounded-context identity: stable `Between` is unit-level and uses canonical `occasion_index = 0`; `Within` retains actual `(unit, occasion)` identity. Duplicate identities or stable-Between occasion aliases are not weights. - A representable final scientific estimand is not rejected solely because an avoidable intermediate binary64 operation overflows/underflows. False exact 0/1/non-finite endpoints, erased finite bounds, cancellation residues, and double-rounded endpoints are not accepted when a bounded equivalent operation preserves the represented estimand or decision. -- Mean signed bias and bias SE remain Validation Evidence performance measures over admitted recovery units. `mean_bias` uses the direct residual path only when every pairwise subtraction is finite and preserves represented low-order input mass; otherwise it uses the algebraically equivalent recovered-plus-negated-truth numerator, cancellation-safe exact-power-of-two scaling, and the original scientific denominator. `bias_standard_error` still requires each individual signed residual to be representable. For every two-observation sample, TEPP evaluates `SE(mean)=|r1-r2|/2` before a rounded residual mean can become authoritative; subtraction-roundoff cases use expanded represented inputs, while exact-subtraction cases use the represented residual difference through the cancellation/overflow-safe scientific denominator. For `n>2`, the exact translated-residual path is admitted only when anchor-relative high, low, and combined deltas are exactly representable. Every exact candidate anchor is evaluated; the candidate with the smallest maximum translated magnitude is selected, with canonical represented `(high, low)` order only as a deterministic tie-breaker. This retains GAP-106 permutation invariance while GAP-107 prevents an avoidably wide exact representation from becoming authoritative. Translation-invariant dispersion is then evaluated before any rounded residual mean becomes authoritative. GAP-098 requires exact power-of-two normalization; GAP-099 established the exact `n=3` two-level identity; GAP-100 generalized singleton/repeated-level geometry; GAP-102 established a reciprocal-power-of-two count shortcut; GAP-103 widened that to reciprocal-integer-square factors; GAP-104 generalized it to any reduced count factor satisfying `m(n-m)/(n^2(n-1))=(a/b)^2` with checked integer roots. GAP-105 additionally requires an admitted exact rational scale whose final represented value is subnormal to be rounded once in exact minimum-subnormal units rather than through normalized quotient plus scale restoration. GAP-108 adds the exact three-observation, three-level identity `SE(mean)^2=(x²+y²-xy)/9` only when the two nonzero translated offsets have error-free represented squares/cross-product, the sum/subtraction is error-free, and the numerator has an exact represented square root; only that proved root is divided by three once. GAP-109 makes that proof invariant to exact dyadic unit scaling: if raw square/cross-product intermediates overflow, the same proof is retried only after an exactly reversible power-of-two normalization, with exact reconstruction required before the normalized result can become authoritative. GAP-110 applies the same bounded retry when a mathematically nonzero raw square/cross-product underflows to represented zero; a zero FMA residual at a product already outside the destination range is not evidence of an exact-zero product. GAP-111 adds an exact four-observation pair-distance identity `SE(mean)^2=Σ_{i2 dispersion. Mathematically nonzero final results outside binary64 range fail closed. +- Mean signed bias and bias SE remain Validation Evidence performance measures over admitted recovery units. `mean_bias` uses the direct residual path only when every pairwise subtraction is finite and preserves represented low-order input mass; otherwise it uses the algebraically equivalent recovered-plus-negated-truth numerator, cancellation-safe exact-power-of-two scaling, and the original scientific denominator. `bias_standard_error` still requires each individual signed residual to be representable. For every two-observation sample, TEPP evaluates `SE(mean)=|r1-r2|/2` before a rounded residual mean can become authoritative; subtraction-roundoff cases use expanded represented inputs, while exact-subtraction cases use the represented residual difference through the cancellation/overflow-safe scientific denominator. For `n>2`, the exact translated-residual path is admitted only when anchor-relative high, low, and combined deltas are exactly representable. Every exact candidate anchor is evaluated; the candidate with the smallest maximum translated magnitude is selected, with canonical represented `(high, low)` order only as a deterministic tie-breaker. This retains GAP-106 permutation invariance while GAP-107 prevents an avoidably wide exact representation from becoming authoritative. Translation-invariant dispersion is then evaluated before any rounded residual mean becomes authoritative. GAP-098 requires exact power-of-two normalization; GAP-099 established the exact `n=3` two-level identity; GAP-100 generalized singleton/repeated-level geometry; GAP-102 established a reciprocal-power-of-two count shortcut; GAP-103 widened that to reciprocal-integer-square factors; GAP-104 generalized it to any reduced count factor satisfying `m(n-m)/(n^2(n-1))=(a/b)^2` with checked integer roots. GAP-105 additionally requires an admitted exact rational scale whose final represented value is subnormal to be rounded once in exact minimum-subnormal units rather than through normalized quotient plus scale restoration. GAP-108 adds the exact three-observation, three-level identity `SE(mean)^2=(x²+y²-xy)/9` only when the two nonzero translated offsets have error-free represented squares/cross-product, the sum/subtraction is error-free, and the numerator has an exact represented square root; only that proved root is divided by three once. GAP-109 makes that proof invariant to exact dyadic unit scaling: if raw square/cross-product intermediates overflow, the same proof is retried only after an exactly reversible power-of-two normalization, with exact reconstruction required before the normalized result can become authoritative. GAP-110 applies the same bounded retry when a mathematically nonzero raw square/cross-product underflows to represented zero; a zero FMA residual at a product already outside the destination range is not evidence of an exact-zero product. GAP-111 adds an exact four-observation pair-distance identity `SE(mean)^2=Σ_{i2 dispersion. Mathematically nonzero final results outside binary64 range fail closed. - Generic Validation Evidence RMSE and its delta-method SE normalize before squaring. Exact-zero point RMSE requires exact-zero point RMSE SE. For positive RMSE, the declared producer satisfies `SE(RMSE) <= RMSE / 2`, with a small relative binary64 admission tolerance. - Generic `MonteCarloSummary` is sign-neutral. Zero SD requires zero SE and percentile endpoints equal to the represented mean. Positive SD requires positive SE coherent with represented `SD / sqrt(n)` within a small relative tolerance. Every inclusive nearest-rank endpoint is a retained observation and satisfies `|endpoint - mean| <= SD * sqrt(n - 1)`. Distinct lower/upper endpoint values share the same `(n - 1) * SD²` deviation budget. When `replication_count=2` and endpoints are distinct, those endpoints exhaust the retained sample and must reconstruct the represented mean/sample SD. - When the generic carrier occupies `ValidationReport::monte_carlo_rmse`, retained replications are nonnegative; positive mean implies `SE(mean) <= mean`, and inclusive nearest-rank endpoints cannot exceed nonnegative sample-sum support `n * mean`. These typed bounds are not imposed on signed metrics such as bias. @@ -83,13 +83,13 @@ The clock contract separates event/valid time, assertion time, document time, sy ### #488 — Validation Evidence -#488 is the generic Validation Evidence landing vehicle at exact head `8f7dbf8843ce5c9a2f48e3f67779382e0096d3c2`, based on protected #490. GAP-092–113 remain inherited and executable. +#488 is the generic Validation Evidence landing vehicle at exact head `d2d8617bdd47ce027074c1561121a2e3baab340c`, based on protected #490. GAP-092–114 remain inherited and executable. -GAP-114 RED `5878ec10f458efb5f070446dcb3ead30900ef707` fixes the exact five-observation sample `truth=[0,0,0,0,0]`, `recovered=[1_342_748_146,1_434_848_064,1_525_257_611,1_685_877_224,1_771_341_094]`. Its ten squared pair distances sum to `621298477313343404`; because `n=5`, exact `SE(mean)^2=N/100`. `gcd(N,100)=4`, so the exact reduced radicand is `155324619328335851/25`. The predecessor four-observation-only admission falls back to translated floating moments and returns adjacent upper bits `0x4192_caf1_6406_5ad1`; exact checked midpoint comparison returns correctly rounded `0x4192_caf1_6406_5ad0`. +GAP-115 RED `cb07b89bac926bbe0b0c69318310fe78642e62cb` fixes the exact six-observation sample `truth=[0,0,0,0,0,0]`, `recovered=[1_120_315_269,1_513_609_015,1_569_037_659,1_789_057_504,1_807_936_669,1_914_796_738]`. Its fifteen squared pair distances sum to `2486413148856729212`; because `n=6`, exact `SE(mean)^2=N/180`. `gcd(N,180)=4`, so the exact reduced radicand is `621603287214182303/45`. The GAP-114 admission stops at five observations and therefore falls back to translated floating moments, which return adjacent upper `0x419c_057d_42fc_5858`; exact checked midpoint comparison returns correctly rounded `0x419c_057d_42fc_5857`. -Causal repair `41298270e8e3d4476ba1bbad9f22ea94752a9e6a` changes only the bounded small-sample pair-distance square-root proof. Four and five observations share the exact identity `SE(mean)^2=Σ_{i2 correct-rounding claim. +Causal repair `8e194dc1b0fa66cc923c5cb939bf3319ed0b4554` changes only the bounded pair-distance proof admission to `n=4..=6`. Residual and pairwise-difference exactness, checked dyadic/u128 construction, scientific denominator `n²(n-1)`, GCD reduction, candidate/adjacent-midpoint comparison, and fail-closed fallback remain mandatory. The proof stays bounded instead of making the ordinary estimator O(n²). Public RED includes permutations and sign mirrors; CHANGELOG `d709199bfccca6d70f2cd91d7115474a0f8e04cd`; research/TRACEABILITY current #488 is `d2d8617bdd47ce027074c1561121a2e3baab340c`. GAP-115 does not widen the general n>2 correct-rounding claim. -GAP-113 remains inherited: RED `50153a1c4452d780c23b58fd34c695db9048e603`, causal repair `dbf6b40946c0940c8b088f376a6dc1750401350e`, CHANGELOG `ca85765f7fce56c238641bffa57f4eb19547efb7`, and research ancestor `37e3defb3bde29a8d1ac852456ba05f787aee1f3`. GAP-112 GCD-reduction repair, GAP-111 bounded pair-distance/midpoint repair, GAP-110 underflow protection, GAP-109 scale invariance, GAP-108 exact three-level rational-square dispersion, GAP-107 conditioning-minimized exact-anchor selection, GAP-106 permutation-invariant admission, GAP-105 exact rational-square subnormal projection, GAP-104 reduced rational-square count geometry, GAP-103 reciprocal-integer-square cases, GAP-102 exact dyadic count geometry, GAP-101 `SE(mean)=|r1-r2|/2`, GAP-100 translated two-level singleton identity, GAP-099 and GAP-098 remain inherited. +GAP-114 remains inherited: RED `5878ec10f458efb5f070446dcb3ead30900ef707`, causal repair `41298270e8e3d4476ba1bbad9f22ea94752a9e6a`, CHANGELOG `4f6f61d398667936ecfa1d9209755e4c0d775e1f`, and research ancestor `8f7dbf8843ce5c9a2f48e3f67779382e0096d3c2`. GAP-113 and GAP-112 through GAP-092 plus earlier mean-bias, Wilson, provenance, Monte Carlo, RMSE/SE, acceptance, matching, serde, and projection lineages remain inherited. ### #416 — Validation / Analysis Run consolidation @@ -101,7 +101,7 @@ GAP-113 remains inherited: RED `50153a1c4452d780c23b58fd34c695db9048e603`, causa ## Gap register -GAP-001–GAP-044 retain their existing domain/release identities and closure lineage. They remain unchanged by the GAP-114 numerical repair; their authoritative source/test/ADR history remains in repository ancestry and the surviving landing vehicles listed above. The validation lineage from GAP-045 onward is restated here because #488 is its current single writer. +GAP-001–GAP-044 retain their existing domain/release identities and closure lineage. They remain unchanged by the GAP-115 numerical repair; their authoritative source/test/ADR history remains in repository ancestry and the surviving landing vehicles listed above. The validation lineage from GAP-045 onward is restated here because #488 is its current single writer. | ID | Gap | Maturity | Closure evidence | | --- | --- | --- | --- | @@ -218,7 +218,8 @@ GAP-001–GAP-044 retain their existing domain/release identities and closure li | GAP-111 | exact four-observation pair-distance dispersion could move one ULP because the exact rational radicand was rounded before `sqrt` | `verification-pending` | RED `978c422c...` + bounded pair-distance/midpoint repair lineage `3de7a737...` → `c8032493...` + CHANGELOG `49c46aa4...` + research/ancestor #488 `0857d5a4...`; permutation/sign-mirror and proof-edge contracts added; exact-head hosted GREEN/review/main integration remain pending | | GAP-112 | exact four-observation pair-distance proof could reject an equivalent bounded rational solely because the unreduced numerator exceeded the exact-binary64 integer admission | `verification-pending` | RED `4f223135...` + causal repair `ed1a8763...` + CHANGELOG `28dde0f1...` + research/ancestor #488 `f62b56d2...`; permutation/sign-mirror contract added; exact-head hosted GREEN/review/main integration remain pending | | GAP-113 | exact four-observation pair-distance proof could reject a GCD-reduced exact rational solely because its exact `u128` numerator exceeded `2^53` even though the rounded numerator was only a candidate seed | `verification-pending` | RED `50153a1c...` + causal repair `dbf6b409...` + CHANGELOG `ca85765f...` + research/ancestor #488 `37e3defb...`; permutation/sign-mirror contract added; exact-head hosted GREEN/review/main integration remain pending | -| GAP-114 | exact five-observation pair-distance dispersion could move one ULP because the bounded midpoint proof stopped at four observations | `verification-pending` | RED `5878ec10...` + causal repair `41298270...` + CHANGELOG `4f6f61d3...` + research/current #488 `8f7dbf88...`; permutation/sign-mirror contract added; exact-head hosted GREEN/review/main integration remain pending | +| GAP-114 | exact five-observation pair-distance dispersion could move one ULP because the bounded midpoint proof stopped at four observations | `verification-pending` | RED `5878ec10...` + causal repair `41298270...` + CHANGELOG `4f6f61d3...` + research/ancestor #488 `8f7dbf88...`; permutation/sign-mirror contract added; exact-head hosted GREEN/review/main integration remain pending | +| GAP-115 | exact six-observation pair-distance dispersion could move one ULP because the bounded midpoint proof stopped at five observations | `verification-pending` | RED `cb07b89b...` + causal repair `8e194dc1...` + CHANGELOG `d709199b...` + research/current #488 `d2d8617b...`; permutation/sign-mirror contract added; exact-head hosted GREEN/review/main integration remain pending | ## Release gate From 415bc69a02de7cce8c862734dbe3c1bfc4a4537c Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 5 Sep 2026 22:07:08 +0900 Subject: [PATCH 210/235] docs(ddd): advance Validation Evidence baseline to GAP-116 --- docs/product-technical-gap-baseline.md | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index b826a3ff3..184276776 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-05T12:46:00Z +**Snapshot:** 2026-09-05T13:04:16Z **Protected-main evidence:** `a243f18da4a4ca8a8d068c39922537f1f8ed6ad0` **Workspace version:** `0.2.0` @@ -30,7 +30,7 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `d2d8617bdd47ce027074c1561121a2e3baab340c` | true | `main` | Validation Evidence landing vehicle, based on protected #490. GAP-115 extends the bounded exact pair-distance/midpoint proof through six observations: RED `cb07b89b...` uses `[1120315269,1513609015,1569037659,1789057504,1807936669,1914796738]`, pair-square sum `2486413148856729212`, denominator `180`, gcd `4`, reduced ratio `621603287214182303/45`; the translated floating moment/`sqrt` fallback returns adjacent-upper `0x419c_057d_42fc_5858`, while exact midpoint comparison returns `0x419c_057d_42fc_5857`. Repair `8e194dc1...` keeps checked residual/pair-difference exactness, checked `u128`, GCD reduction, and exact candidate/neighbor midpoint authority, and deliberately keeps the O(n²) proof bounded to `n=4..=6`. GAP-114 and all earlier represented-input Validation Evidence repairs remain inherited. Hosted exact-head gates and independent review remain required. | +| #488 | `4efe2421e24a964093d5bc63e4abef9e2664c330` | true | `main` | Validation Evidence landing vehicle, based on protected #490. GAP-116 extends the bounded exact pair-distance/midpoint proof through seven observations: RED `a1de7ae9...` uses `[912628433,991631865,1109185293,1253685899,1354619842,1368206500,1611374925]`, pair-square sum `2469379766402987422`, denominator `294`, gcd `2`, reduced ratio `1234689883201493711/147`; the translated floating moment/`sqrt` fallback returns adjacent-upper `0x4195_d9b7_0ca9_e6ef`, while exact midpoint comparison returns `0x4195_d9b7_0ca9_e6ee`. Repair `2907e468...` keeps checked residual/pair-difference exactness, checked `u128`, GCD reduction, and exact candidate/neighbor midpoint authority, and deliberately keeps the O(n²) proof bounded to `n=4..=7`. GAP-115 and all earlier represented-input Validation Evidence repairs remain inherited. Hosted exact-head gates and independent review remain required. | | #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 | Validation / Analysis Run fold child. Unique evidence must be inherited by a conflict-resolving survivor; child-head CI does not transfer. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | @@ -62,7 +62,7 @@ The clock contract separates event/valid time, assertion time, document time, sy - Row arrival order is not scientific evidence. Fixed admitted observations must produce bit-identical means/centered results under permutation wherever the contract claims deterministic CPU `f64` reference behavior. - Known-truth component recovery follows bounded-context identity: stable `Between` is unit-level and uses canonical `occasion_index = 0`; `Within` retains actual `(unit, occasion)` identity. Duplicate identities or stable-Between occasion aliases are not weights. - A representable final scientific estimand is not rejected solely because an avoidable intermediate binary64 operation overflows/underflows. False exact 0/1/non-finite endpoints, erased finite bounds, cancellation residues, and double-rounded endpoints are not accepted when a bounded equivalent operation preserves the represented estimand or decision. -- Mean signed bias and bias SE remain Validation Evidence performance measures over admitted recovery units. `mean_bias` uses the direct residual path only when every pairwise subtraction is finite and preserves represented low-order input mass; otherwise it uses the algebraically equivalent recovered-plus-negated-truth numerator, cancellation-safe exact-power-of-two scaling, and the original scientific denominator. `bias_standard_error` still requires each individual signed residual to be representable. For every two-observation sample, TEPP evaluates `SE(mean)=|r1-r2|/2` before a rounded residual mean can become authoritative; subtraction-roundoff cases use expanded represented inputs, while exact-subtraction cases use the represented residual difference through the cancellation/overflow-safe scientific denominator. For `n>2`, the exact translated-residual path is admitted only when anchor-relative high, low, and combined deltas are exactly representable. Every exact candidate anchor is evaluated; the candidate with the smallest maximum translated magnitude is selected, with canonical represented `(high, low)` order only as a deterministic tie-breaker. This retains GAP-106 permutation invariance while GAP-107 prevents an avoidably wide exact representation from becoming authoritative. Translation-invariant dispersion is then evaluated before any rounded residual mean becomes authoritative. GAP-098 requires exact power-of-two normalization; GAP-099 established the exact `n=3` two-level identity; GAP-100 generalized singleton/repeated-level geometry; GAP-102 established a reciprocal-power-of-two count shortcut; GAP-103 widened that to reciprocal-integer-square factors; GAP-104 generalized it to any reduced count factor satisfying `m(n-m)/(n^2(n-1))=(a/b)^2` with checked integer roots. GAP-105 additionally requires an admitted exact rational scale whose final represented value is subnormal to be rounded once in exact minimum-subnormal units rather than through normalized quotient plus scale restoration. GAP-108 adds the exact three-observation, three-level identity `SE(mean)^2=(x²+y²-xy)/9` only when the two nonzero translated offsets have error-free represented squares/cross-product, the sum/subtraction is error-free, and the numerator has an exact represented square root; only that proved root is divided by three once. GAP-109 makes that proof invariant to exact dyadic unit scaling: if raw square/cross-product intermediates overflow, the same proof is retried only after an exactly reversible power-of-two normalization, with exact reconstruction required before the normalized result can become authoritative. GAP-110 applies the same bounded retry when a mathematically nonzero raw square/cross-product underflows to represented zero; a zero FMA residual at a product already outside the destination range is not evidence of an exact-zero product. GAP-111 adds an exact four-observation pair-distance identity `SE(mean)^2=Σ_{i2 dispersion. Mathematically nonzero final results outside binary64 range fail closed. +- Mean signed bias and bias SE remain Validation Evidence performance measures over admitted recovery units. `mean_bias` uses the direct residual path only when every pairwise subtraction is finite and preserves represented low-order input mass; otherwise it uses the algebraically equivalent recovered-plus-negated-truth numerator, cancellation-safe exact-power-of-two scaling, and the original scientific denominator. `bias_standard_error` still requires each individual signed residual to be representable. For every two-observation sample, TEPP evaluates `SE(mean)=|r1-r2|/2` before a rounded residual mean can become authoritative; subtraction-roundoff cases use expanded represented inputs, while exact-subtraction cases use the represented residual difference through the cancellation/overflow-safe scientific denominator. For `n>2`, the exact translated-residual path is admitted only when anchor-relative high, low, and combined deltas are exactly representable. Every exact candidate anchor is evaluated; the candidate with the smallest maximum translated magnitude is selected, with canonical represented `(high, low)` order only as a deterministic tie-breaker. This retains GAP-106 permutation invariance while GAP-107 prevents an avoidably wide exact representation from becoming authoritative. Translation-invariant dispersion is then evaluated before any rounded residual mean becomes authoritative. GAP-098 requires exact power-of-two normalization; GAP-099 established the exact `n=3` two-level identity; GAP-100 generalized singleton/repeated-level geometry; GAP-102 established a reciprocal-power-of-two count shortcut; GAP-103 widened that to reciprocal-integer-square factors; GAP-104 generalized it to any reduced count factor satisfying `m(n-m)/(n^2(n-1))=(a/b)^2` with checked integer roots. GAP-105 additionally requires an admitted exact rational scale whose final represented value is subnormal to be rounded once in exact minimum-subnormal units rather than through normalized quotient plus scale restoration. GAP-108 adds the exact three-observation, three-level identity `SE(mean)^2=(x²+y²-xy)/9` only when the two nonzero translated offsets have error-free represented squares/cross-product, the sum/subtraction is error-free, and the numerator has an exact represented square root; only that proved root is divided by three once. GAP-109 makes that proof invariant to exact dyadic unit scaling: if raw square/cross-product intermediates overflow, the same proof is retried only after an exactly reversible power-of-two normalization, with exact reconstruction required before the normalized result can become authoritative. GAP-110 applies the same bounded retry when a mathematically nonzero raw square/cross-product underflows to represented zero; a zero FMA residual at a product already outside the destination range is not evidence of an exact-zero product. GAP-111 adds an exact four-observation pair-distance identity `SE(mean)^2=Σ_{i2 dispersion. Mathematically nonzero final results outside binary64 range fail closed. - Generic Validation Evidence RMSE and its delta-method SE normalize before squaring. Exact-zero point RMSE requires exact-zero point RMSE SE. For positive RMSE, the declared producer satisfies `SE(RMSE) <= RMSE / 2`, with a small relative binary64 admission tolerance. - Generic `MonteCarloSummary` is sign-neutral. Zero SD requires zero SE and percentile endpoints equal to the represented mean. Positive SD requires positive SE coherent with represented `SD / sqrt(n)` within a small relative tolerance. Every inclusive nearest-rank endpoint is a retained observation and satisfies `|endpoint - mean| <= SD * sqrt(n - 1)`. Distinct lower/upper endpoint values share the same `(n - 1) * SD²` deviation budget. When `replication_count=2` and endpoints are distinct, those endpoints exhaust the retained sample and must reconstruct the represented mean/sample SD. - When the generic carrier occupies `ValidationReport::monte_carlo_rmse`, retained replications are nonnegative; positive mean implies `SE(mean) <= mean`, and inclusive nearest-rank endpoints cannot exceed nonnegative sample-sum support `n * mean`. These typed bounds are not imposed on signed metrics such as bias. @@ -83,13 +83,13 @@ The clock contract separates event/valid time, assertion time, document time, sy ### #488 — Validation Evidence -#488 is the generic Validation Evidence landing vehicle at exact head `d2d8617bdd47ce027074c1561121a2e3baab340c`, based on protected #490. GAP-092–114 remain inherited and executable. +#488 is the generic Validation Evidence landing vehicle at exact head `4efe2421e24a964093d5bc63e4abef9e2664c330`, based on protected #490. GAP-092–115 remain inherited and executable. -GAP-115 RED `cb07b89bac926bbe0b0c69318310fe78642e62cb` fixes the exact six-observation sample `truth=[0,0,0,0,0,0]`, `recovered=[1_120_315_269,1_513_609_015,1_569_037_659,1_789_057_504,1_807_936_669,1_914_796_738]`. Its fifteen squared pair distances sum to `2486413148856729212`; because `n=6`, exact `SE(mean)^2=N/180`. `gcd(N,180)=4`, so the exact reduced radicand is `621603287214182303/45`. The GAP-114 admission stops at five observations and therefore falls back to translated floating moments, which return adjacent upper `0x419c_057d_42fc_5858`; exact checked midpoint comparison returns correctly rounded `0x419c_057d_42fc_5857`. +GAP-116 RED `a1de7ae90ae57e0eb55d7efe0b8bf6d9f5a6f3f3` fixes the exact seven-observation sample `truth=[0,0,0,0,0,0,0]`, `recovered=[912_628_433,991_631_865,1_109_185_293,1_253_685_899,1_354_619_842,1_368_206_500,1_611_374_925]`. Its twenty-one squared pair distances sum to `2469379766402987422`; because `n=7`, exact `SE(mean)^2=N/294`. `gcd(N,294)=2`, so the exact reduced radicand is `1234689883201493711/147`. The GAP-115 admission stops at six observations and therefore falls back to translated floating moments, which return adjacent upper `0x4195_d9b7_0ca9_e6ef`; exact checked midpoint comparison returns correctly rounded `0x4195_d9b7_0ca9_e6ee`. -Causal repair `8e194dc1b0fa66cc923c5cb939bf3319ed0b4554` changes only the bounded pair-distance proof admission to `n=4..=6`. Residual and pairwise-difference exactness, checked dyadic/u128 construction, scientific denominator `n²(n-1)`, GCD reduction, candidate/adjacent-midpoint comparison, and fail-closed fallback remain mandatory. The proof stays bounded instead of making the ordinary estimator O(n²). Public RED includes permutations and sign mirrors; CHANGELOG `d709199bfccca6d70f2cd91d7115474a0f8e04cd`; research/TRACEABILITY current #488 is `d2d8617bdd47ce027074c1561121a2e3baab340c`. GAP-115 does not widen the general n>2 correct-rounding claim. +Causal repair `2907e468363040a435fde4dd14e74ca32cc3b082` changes only the bounded pair-distance proof admission to `n=4..=7`. Residual and pairwise-difference exactness, checked dyadic/u128 construction, scientific denominator `n²(n-1)`, GCD reduction, candidate/adjacent-midpoint comparison, and fail-closed fallback remain mandatory. The proof stays bounded instead of making the ordinary estimator O(n²). Public RED includes permutations and sign mirrors; CHANGELOG `78d5ed3fb81765edbc4ee662dacabe6ec631265f`; research/TRACEABILITY current #488 is `4efe2421e24a964093d5bc63e4abef9e2664c330`. GAP-116 does not widen the general n>2 correct-rounding claim. -GAP-114 remains inherited: RED `5878ec10f458efb5f070446dcb3ead30900ef707`, causal repair `41298270e8e3d4476ba1bbad9f22ea94752a9e6a`, CHANGELOG `4f6f61d398667936ecfa1d9209755e4c0d775e1f`, and research ancestor `8f7dbf8843ce5c9a2f48e3f67779382e0096d3c2`. GAP-113 and GAP-112 through GAP-092 plus earlier mean-bias, Wilson, provenance, Monte Carlo, RMSE/SE, acceptance, matching, serde, and projection lineages remain inherited. +GAP-115 remains inherited: RED `cb07b89bac926bbe0b0c69318310fe78642e62cb`, causal repair `8e194dc1b0fa66cc923c5cb939bf3319ed0b4554`, CHANGELOG `d709199bfccca6d70f2cd91d7115474a0f8e04cd`, and research ancestor `d2d8617bdd47ce027074c1561121a2e3baab340c`. GAP-114 and GAP-113 through GAP-092 plus earlier mean-bias, Wilson, provenance, Monte Carlo, RMSE/SE, acceptance, matching, serde, and projection lineages remain inherited. ### #416 — Validation / Analysis Run consolidation @@ -101,7 +101,7 @@ GAP-114 remains inherited: RED `5878ec10f458efb5f070446dcb3ead30900ef707`, causa ## Gap register -GAP-001–GAP-044 retain their existing domain/release identities and closure lineage. They remain unchanged by the GAP-115 numerical repair; their authoritative source/test/ADR history remains in repository ancestry and the surviving landing vehicles listed above. The validation lineage from GAP-045 onward is restated here because #488 is its current single writer. +GAP-001–GAP-044 retain their existing domain/release identities and closure lineage. They remain unchanged by the GAP-116 numerical repair; their authoritative source/test/ADR history remains in repository ancestry and the surviving landing vehicles listed above. The validation lineage from GAP-045 onward is restated here because #488 is its current single writer. | ID | Gap | Maturity | Closure evidence | | --- | --- | --- | --- | @@ -219,7 +219,8 @@ GAP-001–GAP-044 retain their existing domain/release identities and closure li | GAP-112 | exact four-observation pair-distance proof could reject an equivalent bounded rational solely because the unreduced numerator exceeded the exact-binary64 integer admission | `verification-pending` | RED `4f223135...` + causal repair `ed1a8763...` + CHANGELOG `28dde0f1...` + research/ancestor #488 `f62b56d2...`; permutation/sign-mirror contract added; exact-head hosted GREEN/review/main integration remain pending | | GAP-113 | exact four-observation pair-distance proof could reject a GCD-reduced exact rational solely because its exact `u128` numerator exceeded `2^53` even though the rounded numerator was only a candidate seed | `verification-pending` | RED `50153a1c...` + causal repair `dbf6b409...` + CHANGELOG `ca85765f...` + research/ancestor #488 `37e3defb...`; permutation/sign-mirror contract added; exact-head hosted GREEN/review/main integration remain pending | | GAP-114 | exact five-observation pair-distance dispersion could move one ULP because the bounded midpoint proof stopped at four observations | `verification-pending` | RED `5878ec10...` + causal repair `41298270...` + CHANGELOG `4f6f61d3...` + research/ancestor #488 `8f7dbf88...`; permutation/sign-mirror contract added; exact-head hosted GREEN/review/main integration remain pending | -| GAP-115 | exact six-observation pair-distance dispersion could move one ULP because the bounded midpoint proof stopped at five observations | `verification-pending` | RED `cb07b89b...` + causal repair `8e194dc1...` + CHANGELOG `d709199b...` + research/current #488 `d2d8617b...`; permutation/sign-mirror contract added; exact-head hosted GREEN/review/main integration remain pending | +| GAP-115 | exact six-observation pair-distance dispersion could move one ULP because the bounded midpoint proof stopped at five observations | `verification-pending` | RED `cb07b89b...` + causal repair `8e194dc1...` + CHANGELOG `d709199b...` + research/ancestor #488 `d2d8617b...`; permutation/sign-mirror contract added; exact-head hosted GREEN/review/main integration remain pending | +| GAP-116 | exact seven-observation pair-distance dispersion could move one ULP because the bounded midpoint proof stopped at six observations | `verification-pending` | RED `a1de7ae9...` + causal repair `2907e468...` + CHANGELOG `78d5ed3f...` + research/current #488 `4efe2421...`; permutation/sign-mirror contract added; exact-head hosted GREEN/review/main integration remain pending | ## Release gate From 2a1611201817192b2582c60310330e539b86fad1 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 5 Sep 2026 23:12:43 +0900 Subject: [PATCH 211/235] docs(gaps): register GAP-117 eight-observation bias SE --- docs/product-technical-gap-baseline.md | 216 ++++++------------------- 1 file changed, 52 insertions(+), 164 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 184276776..2cc3ed606 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,27 +2,27 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-05T13:04:16Z +**Snapshot:** 2026-09-05T14:08:00Z **Protected-main evidence:** `a243f18da4a4ca8a8d068c39922537f1f8ed6ad0` **Workspace version:** `0.2.0` -**Delivery authority:** issue [#175](https://github.com/ContextualWisdomLab/TEPP/issues/175), PR [#435](https://github.com/ContextualWisdomLab/TEPP/pull/435), and [`docs/delivery/pr-queue-authority-2026-09-01.md`](delivery/pr-queue-authority-2026-09-01.md). +**Delivery authority:** issue [#175](https://github.com/ContextualWisdomLab/TEPP/issues/175), PR [#435](https://github.com/ContextualWisdomLab/TEPP/pull/435), and [`docs/delivery/pr-queue-authority-2026-09-01.md`](delivery/pr-queue-authority-2026-09-01.md). Historical exact source/test/fixture/contract/ADR evidence remains in repository ancestry, `docs/research/`, `docs/TRACEABILITY.md`, and the surviving landing vehicles; this live register is an operator-oriented current-state index rather than a second copy of every predecessor narrative. ## Delivery truth A planning document, mergeable branch, local/source inspection, predecessor-head result, queued/skipped check, ADR number, or LLM judgment does not make a capability shipped. Only protected-main integration plus current required evidence establishes delivery. -| Signal | Fresh evidence | Implication | +| Signal | Fresh evidence | Delivery implication | | --- | ---: | --- | -| Protected `main` | `a243f18da4a4ca8a8d068c39922537f1f8ed6ad0` | #490 is integrated; capability claims remain bounded to this commit until main advances. | +| Protected `main` | `a243f18da4a4ca8a8d068c39922537f1f8ed6ad0` | #490 remains integrated; capability claims are bounded to this signed protected head until main advances. | | Open pull requests | **134** | WIP circuit breaker remains active; consolidate into existing bounded-context vehicles. | | Draft pull requests | **134** | Every current open PR is Draft. | | Non-Draft pull requests | **0** | No PR is eligible for normal merge until deliberately made Ready after exact-head evidence. | | Open issues | **16** | ADR normalization, orchestration admission, evaluation drift, and scientific recovery remain open. | | GitHub releases | **0** | No TEPP open head is a released contract. | -| Organization ruleset | `18156473` | One qualifying current-head approval, stale-review dismissal after push, resolved threads, extra approval for unattributed changes where applicable, and central required workflows. | +| Organization ruleset | `18156473` | Current-head approval, stale-review dismissal, resolved threads, and central required workflows remain delivery gates. | -Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward updates on the default branch. Organization-admin bypass is not normal delivery evidence and is not used by this writer. Protected-main #489 narrowed duplicate workflow load and combined line/branch coverage work while retaining both gates; #490 centralized hourly-development admission. +Passing, queued, skipped, or predecessor-head Checks on an open PR never promote that PR to implemented-main. Organization-admin bypass is not normal delivery evidence and is not used by this writer. ## Current priority open pull-request evidence @@ -30,17 +30,17 @@ Ruleset `18156473` permits merge/squash and prohibits deletion/non-fast-forward | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `4efe2421e24a964093d5bc63e4abef9e2664c330` | true | `main` | Validation Evidence landing vehicle, based on protected #490. GAP-116 extends the bounded exact pair-distance/midpoint proof through seven observations: RED `a1de7ae9...` uses `[912628433,991631865,1109185293,1253685899,1354619842,1368206500,1611374925]`, pair-square sum `2469379766402987422`, denominator `294`, gcd `2`, reduced ratio `1234689883201493711/147`; the translated floating moment/`sqrt` fallback returns adjacent-upper `0x4195_d9b7_0ca9_e6ef`, while exact midpoint comparison returns `0x4195_d9b7_0ca9_e6ee`. Repair `2907e468...` keeps checked residual/pair-difference exactness, checked `u128`, GCD reduction, and exact candidate/neighbor midpoint authority, and deliberately keeps the O(n²) proof bounded to `n=4..=7`. GAP-115 and all earlier represented-input Validation Evidence repairs remain inherited. Hosted exact-head gates and independent review remain required. | -| #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 | Validation / Analysis Run fold child. Unique evidence must be inherited by a conflict-resolving survivor; child-head CI does not transfer. | +| #488 | `52fa2c87c2673ae2783d119200690c6656a7df65` | true | `main` | Validation Evidence landing vehicle on protected #490. GAP-117 demonstrates an exact eight-observation pair-distance radicand whose translated floating moment/`sqrt` fallback is one ULP high; bounded repair extends the existing exact midpoint proof only through `n=8`. Fresh hosted exact-head gates and independent review remain required. | +| #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 | Validation / Analysis Run fold child; unique evidence must be inherited by a conflict-resolving survivor and child-head CI does not transfer. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | | #483 | `847d96f913bb261803ac0bd751ad7e4f51324cee` | true | #416 | Analysis Run fold child; preserve unique evidence. | | #482 | `506dbae236a4484301b704b6c6a05b20faf0fe69` | true | #416 | Analysis Run fold child; preserve unique evidence. | -| #480 | `5b2637f7b6142573ba1385a652c56632ecc9faa5` | true | `main` | Forward repair removed the repository-local hourly schedule reintroduced by predecessor `03876fb...`. The branch also corrects stale direct-provider guidance in `AGENTS.md`; it still needs conflict-resolving non-force inheritance of #489/#490 while immutable contextual-orchestrator release/deployment/auth provenance remains unavailable. | +| #480 | `5b2637f7b6142573ba1385a652c56632ecc9faa5` | true | `main` | Released contextual-orchestrator boundary repair; mutable owner main remains evidence only and branch still needs non-force inheritance of #489/#490. | | #460 | `dfab4eab5ff733731e565a9348072b8dab2e4912` | true | #416 | Analysis Run fold child; typed cutoff equality and terminal-validation separation. | | #458 | `08165e3b3c929b4ae77396689549f72723ff8ff5` | true | #416 | Analysis Run fold child; typed cutoff equality and terminal-validation separation. | -| #416 | `aa730c63563eb4a33048d822b581036c8487bd47` | true | `main` | Validation / Analysis Run landing vehicle. Generic cutoff-before-identity repair `0b7155...` remains inherited; branch still predates #489/#490 and needs non-destructive consolidation/restack. | -| #310 | `c6680450152b1e0a2c9abb553772d74a23923335` | true | `main` | Longitudinal Modeling vehicle. Stable `Between` recovery is unit-level with canonical occasion `0`; `Within` retains actual occasion identity. Branch predates #489/#490 and remains a non-force restack finding, not a closure candidate. | +| #416 | `aa730c63563eb4a33048d822b581036c8487bd47` | true | `main` | Validation / Analysis Run landing vehicle; generic cutoff-before-identity repair remains inherited and branch requires non-destructive #489/#490 consolidation. | +| #310 | `c6680450152b1e0a2c9abb553772d74a23923335` | true | `main` | Longitudinal Modeling vehicle; stable `Between` recovery is unit-level with canonical occasion `0`, `Within` retains actual occasion identity, and wrong-base restack remains a repair finding. | Exact-head evidence becomes stale after any source push. @@ -48,180 +48,68 @@ Exact-head evidence becomes stale after any source push. TEPP owns temporal/event composition, irregular time, time-varying multilevel/cross-classified/multiple-membership semantics, longitudinal invariance/drift/alignment, leakage-safe knowledge cutoff, temporal recovery, Validation Evidence, and Projection policy. `longitudinal_modeling` is the bounded context and `longitudinal_core` is its current Rust implementation path. -`psychometric_core` is not authority for new temporal/state composition. fast-mlsirm owns reusable static/generalized-mixed/dependence-aware psychometric specification and arithmetic. TEPP consumes only immutable released/versioned Published Language through an ACL; source copying and mutable sibling-head dependencies are prohibited. Fresh owner evidence is fast-mlsirm protected `main@493326f2de49ea1704da0ded19868ed05d2fe00f`; latest immutable release remains `v0.9.1`. The protected-main advance is a CI/concurrency change after that release and is evidence only, not a mutable TEPP dependency. - -contextual-orchestrator owns provider/model routing and semantic LLM execution. Fresh owner evidence is protected `main@a080297d2546bb61e89520d637cabc202db331ec`, while GitHub releases remain zero. Semantic LLM work and model-backed Actions therefore continue to require a released/versioned contextual-orchestrator contract; Actions use `orchestrator/free` through the gateway credential and do not select providers/models/groups or consume direct provider keys. Mutable owner main is evidence, not a TEPP production contract. Protected-main `AGENTS.md` is stale on this point; #480 carries the owner-correct released-orchestrator wording and must be inherited by normal non-force integration rather than copied into unrelated scientific branches. Context Graph contracts are contract-only integration authority; EA Core owns enterprise-architecture decisions. No cross-service SQL. +fast-mlsirm owns reusable static/generalized-mixed/dependence-aware psychometric specification and arithmetic. TEPP consumes only immutable released/versioned contracts through an ACL; source copying and mutable sibling-head dependencies are prohibited. contextual-orchestrator owns provider/model routing and semantic LLM execution; TEPP requires an immutable released compatible contract and uses `orchestrator/free` for model-backed Actions. Context Graph contracts are contract-only integration authority; EA Core owns enterprise-architecture decisions. No cross-service SQL. The clock contract separates event/valid time, assertion time, document time, system time, availability time, and knowledge cutoff. Retrospective evidence may describe an earlier event but cannot enter an earlier knowledge cutoff. Forward state/transition edges remain distinct from retrospective/citation/revision/provenance relations. ## Scientific invariants - Rasch remains distinct from generic 1PL; formulation-qualified 2PLM–5PLM, MIRT, ideal-point/GGUM, testlet/rater/facet/generalized-mixed identity is preserved. -- A nominal unit identifier is not repeated-measures evidence; singleton units cannot satisfy a longitudinal multilevel floor. -- Occasion-mean deviations `p_it = x_it - μ_t` are not CWC residuals, sample-wide grand-mean residuals, or RI-CLPM within-person effects. Numeric event time defines occasion identity, so `-0.0` and `+0.0` are one occasion. -- Row arrival order is not scientific evidence. Fixed admitted observations must produce bit-identical means/centered results under permutation wherever the contract claims deterministic CPU `f64` reference behavior. -- Known-truth component recovery follows bounded-context identity: stable `Between` is unit-level and uses canonical `occasion_index = 0`; `Within` retains actual `(unit, occasion)` identity. Duplicate identities or stable-Between occasion aliases are not weights. -- A representable final scientific estimand is not rejected solely because an avoidable intermediate binary64 operation overflows/underflows. False exact 0/1/non-finite endpoints, erased finite bounds, cancellation residues, and double-rounded endpoints are not accepted when a bounded equivalent operation preserves the represented estimand or decision. -- Mean signed bias and bias SE remain Validation Evidence performance measures over admitted recovery units. `mean_bias` uses the direct residual path only when every pairwise subtraction is finite and preserves represented low-order input mass; otherwise it uses the algebraically equivalent recovered-plus-negated-truth numerator, cancellation-safe exact-power-of-two scaling, and the original scientific denominator. `bias_standard_error` still requires each individual signed residual to be representable. For every two-observation sample, TEPP evaluates `SE(mean)=|r1-r2|/2` before a rounded residual mean can become authoritative; subtraction-roundoff cases use expanded represented inputs, while exact-subtraction cases use the represented residual difference through the cancellation/overflow-safe scientific denominator. For `n>2`, the exact translated-residual path is admitted only when anchor-relative high, low, and combined deltas are exactly representable. Every exact candidate anchor is evaluated; the candidate with the smallest maximum translated magnitude is selected, with canonical represented `(high, low)` order only as a deterministic tie-breaker. This retains GAP-106 permutation invariance while GAP-107 prevents an avoidably wide exact representation from becoming authoritative. Translation-invariant dispersion is then evaluated before any rounded residual mean becomes authoritative. GAP-098 requires exact power-of-two normalization; GAP-099 established the exact `n=3` two-level identity; GAP-100 generalized singleton/repeated-level geometry; GAP-102 established a reciprocal-power-of-two count shortcut; GAP-103 widened that to reciprocal-integer-square factors; GAP-104 generalized it to any reduced count factor satisfying `m(n-m)/(n^2(n-1))=(a/b)^2` with checked integer roots. GAP-105 additionally requires an admitted exact rational scale whose final represented value is subnormal to be rounded once in exact minimum-subnormal units rather than through normalized quotient plus scale restoration. GAP-108 adds the exact three-observation, three-level identity `SE(mean)^2=(x²+y²-xy)/9` only when the two nonzero translated offsets have error-free represented squares/cross-product, the sum/subtraction is error-free, and the numerator has an exact represented square root; only that proved root is divided by three once. GAP-109 makes that proof invariant to exact dyadic unit scaling: if raw square/cross-product intermediates overflow, the same proof is retried only after an exactly reversible power-of-two normalization, with exact reconstruction required before the normalized result can become authoritative. GAP-110 applies the same bounded retry when a mathematically nonzero raw square/cross-product underflows to represented zero; a zero FMA residual at a product already outside the destination range is not evidence of an exact-zero product. GAP-111 adds an exact four-observation pair-distance identity `SE(mean)^2=Σ_{i2 dispersion. Mathematically nonzero final results outside binary64 range fail closed. -- Generic Validation Evidence RMSE and its delta-method SE normalize before squaring. Exact-zero point RMSE requires exact-zero point RMSE SE. For positive RMSE, the declared producer satisfies `SE(RMSE) <= RMSE / 2`, with a small relative binary64 admission tolerance. -- Generic `MonteCarloSummary` is sign-neutral. Zero SD requires zero SE and percentile endpoints equal to the represented mean. Positive SD requires positive SE coherent with represented `SD / sqrt(n)` within a small relative tolerance. Every inclusive nearest-rank endpoint is a retained observation and satisfies `|endpoint - mean| <= SD * sqrt(n - 1)`. Distinct lower/upper endpoint values share the same `(n - 1) * SD²` deviation budget. When `replication_count=2` and endpoints are distinct, those endpoints exhaust the retained sample and must reconstruct the represented mean/sample SD. -- When the generic carrier occupies `ValidationReport::monte_carlo_rmse`, retained replications are nonnegative; positive mean implies `SE(mean) <= mean`, and inclusive nearest-rank endpoints cannot exceed nonnegative sample-sum support `n * mean`. These typed bounds are not imposed on signed metrics such as bias. -- SE-aware acceptance is `|estimate-target| <= k*SE`. Zero-multiplier/exact-zero-SE recovery is decided before scale reduction. Finite residual/bound ties use retained subtraction/FMA correction evidence and exact dyadic comparisons when projections are unresolved; both-overflow decisions compare represented binary64 rational magnitudes rather than independently rounded normalization. -- `match_count` is a finite-threshold decision and does not require materializing an unrepresentable absolute residual; `absolute_residuals` remains fail closed when the magnitude itself is requested. -- Wilson interval coverage preserves represented-input endpoints through stable rationalized/complementary/compensated forms. Durable `WilsonCoverageEvidenceV1` retains fixed-width counts, critical-value/sidedness provenance, represented coverage and canonical endpoints, validates through one crate-private authority, and does not infer missing v1 provenance from legacy endpoint algebra. -- Durable and human-facing Validation Evidence preserves producing-metric invariants on explicit validation, serde ingress/egress, and human projection. Missing v1 provenance is never synthesized from endpoint algebra. -- Bias, RMSE, and Monte Carlo may share private deterministic scalar support inside `validation_core`, but metric-specific cancellation/normalization, denominator, uncertainty, and fail-closed semantics remain with their bounded modules. +- A nominal unit identifier is not repeated-measures evidence; singleton units cannot satisfy a longitudinal multilevel floor. Stable `Between` known truth is unit-level with canonical `occasion_index = 0`; `Within` retains actual `(unit, occasion)` identity. +- Row arrival order is not scientific evidence. Fixed admitted observations must produce bit-identical results under permutation wherever the deterministic CPU `f64` contract claims it. +- A representable final scientific estimand is not rejected solely because an avoidable intermediate binary64 operation overflows/underflows. False exact endpoints, erased finite bounds, cancellation residues, and avoidable double-rounding are repair findings. +- Mean signed bias and bias SE are TEPP Validation Evidence performance measures. For `n=2`, the exact represented residual-difference identity remains authoritative. For `n=3`, proved two-level/rational-square identities and translated-residual rules from GAP-092–110 remain inherited. For exact represented residuals with `n=4..=8`, GAP-111–117 admit `SE(mean)^2 = Σ_{i2` claim. +- Generic Validation Evidence RMSE, Monte Carlo, Wilson, SE-aware acceptance, matching, durable evidence/provenance, serde and human projection retain their GAP-045–091 contracts. Scientific failures are never hidden with skip/xfail/source rewriting/coverage exclusions. - Historical-cutoff admission occurs before duplicate-identity checks. Future-unavailable evidence cannot change an earlier run's conflicts, counts, or terminal state. -- Supported temporal estimators require state/trajectory and claimed-structure recovery, bias/RMSE, interval coverage, convergence, uncertainty calibration, reproducibility, and leakage-safe rolling-origin evidence. -- CPU/GPU parity counts only when the relevant accelerator path actually runs. Scientific failures are never hidden with skip/xfail/source rewriting/coverage exclusions. +- Supported temporal estimators require state/trajectory and claimed-structure recovery, bias/RMSE, interval coverage, convergence, uncertainty calibration, reproducibility, and leakage-safe rolling-origin evidence. CPU/GPU parity counts only when the relevant accelerator path actually runs. ## Current repairs and blockers -### #310 — Longitudinal Modeling - -#310 remains the canonical Longitudinal Modeling landing vehicle at `c6680450152b1e0a2c9abb553772d74a23923335`. Its recorded base tip predates protected #489/#490, so wrong-base/restack remains a repair finding. Current-head Rust/documentation/security/review evidence remains required before Ready/merge; predecessor or child-head evidence does not transfer. - ### #488 — Validation Evidence -#488 is the generic Validation Evidence landing vehicle at exact head `4efe2421e24a964093d5bc63e4abef9e2664c330`, based on protected #490. GAP-092–115 remain inherited and executable. - -GAP-116 RED `a1de7ae90ae57e0eb55d7efe0b8bf6d9f5a6f3f3` fixes the exact seven-observation sample `truth=[0,0,0,0,0,0,0]`, `recovered=[912_628_433,991_631_865,1_109_185_293,1_253_685_899,1_354_619_842,1_368_206_500,1_611_374_925]`. Its twenty-one squared pair distances sum to `2469379766402987422`; because `n=7`, exact `SE(mean)^2=N/294`. `gcd(N,294)=2`, so the exact reduced radicand is `1234689883201493711/147`. The GAP-115 admission stops at six observations and therefore falls back to translated floating moments, which return adjacent upper `0x4195_d9b7_0ca9_e6ef`; exact checked midpoint comparison returns correctly rounded `0x4195_d9b7_0ca9_e6ee`. - -Causal repair `2907e468363040a435fde4dd14e74ca32cc3b082` changes only the bounded pair-distance proof admission to `n=4..=7`. Residual and pairwise-difference exactness, checked dyadic/u128 construction, scientific denominator `n²(n-1)`, GCD reduction, candidate/adjacent-midpoint comparison, and fail-closed fallback remain mandatory. The proof stays bounded instead of making the ordinary estimator O(n²). Public RED includes permutations and sign mirrors; CHANGELOG `78d5ed3fb81765edbc4ee662dacabe6ec631265f`; research/TRACEABILITY current #488 is `4efe2421e24a964093d5bc63e4abef9e2664c330`. GAP-116 does not widen the general n>2 correct-rounding claim. - -GAP-115 remains inherited: RED `cb07b89bac926bbe0b0c69318310fe78642e62cb`, causal repair `8e194dc1b0fa66cc923c5cb939bf3319ed0b4554`, CHANGELOG `d709199bfccca6d70f2cd91d7115474a0f8e04cd`, and research ancestor `d2d8617bdd47ce027074c1561121a2e3baab340c`. GAP-114 and GAP-113 through GAP-092 plus earlier mean-bias, Wilson, provenance, Monte Carlo, RMSE/SE, acceptance, matching, serde, and projection lineages remain inherited. - -### #416 — Validation / Analysis Run consolidation +#488 is the generic Validation Evidence landing vehicle at exact head `52fa2c87c2673ae2783d119200690c6656a7df65`, based on protected #490. GAP-117 RED `40413dc9e3279f06c3d02ed2180ac9c170a51001` fixes the exact eight-observation sample `truth=[0,0,0,0,0,0,0,0]`, `recovered=[121838114,741324193,994684355,1673429661,1824103795,1861311798,1872117478,1936395613]`. Its twenty-eight squared pair distances sum to `25648518292283252135`; because `n=8`, exact `SE(mean)^2=N/448`. `gcd(N,448)=7`, so the exact reduced radicand is `3664074041754750305/64`. The GAP-116 admission stopped at seven observations and fell back to translated floating moments, returning adjacent upper `0x41ac_8601_97ac_cd4d`; exact checked midpoint comparison returns correctly rounded `0x41ac_8601_97ac_cd4c`. -#416 live branch head is `aa730c63563eb4a33048d822b581036c8487bd47`; generic cutoff-before-identity repair `0b7155cc238defb1e55129ff3000658f04b343cf` remains inherited. #458/#460/#482/#483/#484/#485/#487 remain fold children until every unique source/test/fixture/contract/doctoring delta is inherited by a conflict-resolving survivor. Child-head evidence does not transfer. The vehicle still predates #489/#490 and must be non-destructively restacked/consolidated rather than closed for staleness. +Causal repair `26ca2d68bf057b93b9fef1e14953bedbdcf754c0` changes only the bounded pair-distance admission to `n=4..=8`. Residual/pairwise exactness, checked dyadic/`u128` construction, `n²(n-1)` denominator, GCD reduction, exact candidate/adjacent-midpoint comparison, and fail-closed fallback remain mandatory. CHANGELOG `2641b2613a7c37e4153d9b8baa47487a1b80718e`; research/TRACEABILITY current #488 `52fa2c87c2673ae2783d119200690c6656a7df65`. GAP-116 RED `a1de7ae90ae57e0eb55d7efe0b8bf6d9f5a6f3f3`, repair `2907e468363040a435fde4dd14e74ca32cc3b082`, CHANGELOG `78d5ed3fb81765edbc4ee662dacabe6ec631265f`, and research ancestor `4efe2421e24a964093d5bc63e4abef9e2664c330` remain inherited, as do GAP-115 through GAP-001 source/test/fixture/contract/ADR histories. -### #480 — contextual-orchestrator boundary +### #310, #416, #480 -#480 removes TEPP-owned provider discovery/ranking and requires a released contextual-orchestrator owner contract. Forward repair `5b2637f7b6142573ba1385a652c56632ecc9faa5` removed the local hourly `schedule` reintroduced by predecessor `03876fb3e4c727bb754125ce531d928450d78303` and carries owner-correct `AGENTS.md` guidance requiring released/versioned contextual-orchestrator, `orchestrator/free`, and no direct provider keys. The branch still diverges from protected main because #489/#490 workflow consolidation and admission marker must be conflict-resolved without regressing #480's valid released-owner routing delta. contextual-orchestrator protected main is `a080297d2546bb61e89520d637cabc202db331ec`, and GitHub releases remain zero. #480 therefore stays Draft until non-force restack plus immutable compatible release/deployment/auth/schema/artifact provenance prerequisites are resolved. +#310 remains Longitudinal Modeling authority at `c6680450152b1e0a2c9abb553772d74a23923335`; its older base is a non-force restack finding. #416 remains Validation/Analysis Run consolidation at `aa730c63563eb4a33048d822b581036c8487bd47`; children #458/#460/#482/#483/#484/#485/#487 remain open until unique evidence is inherited. #480 remains the owner-correct contextual-orchestrator fail-closed integration vehicle and must not consume mutable owner main. ## Gap register -GAP-001–GAP-044 retain their existing domain/release identities and closure lineage. They remain unchanged by the GAP-116 numerical repair; their authoritative source/test/ADR history remains in repository ancestry and the surviving landing vehicles listed above. The validation lineage from GAP-045 onward is restated here because #488 is its current single writer. +GAP-001–GAP-044 retain their existing domain/release identities and exact source/test/ADR ancestry. GAP-045–GAP-091 retain the established Validation Evidence mean-bias, RMSE/SE, Monte Carlo, Wilson, matching, acceptance, provenance, serde and projection repairs. The current represented-input bias-SE sequence is restated because #488 is its single writer. | ID | Gap | Maturity | Closure evidence | | --- | --- | --- | --- | -| GAP-001 | PR authority fragmented across 134 open PRs | `release-blocking` | coherent landing vehicles, unique-evidence preservation, protected-main reduction | -| GAP-002 | multilingual span-grounded semantic/concept admission | `partial` | immutable offsets/layout, KO/EN/JA/ZH/VI/ES/DE/FR profiles, concept dictionary, invariance/calibration, hostile-input tests | -| GAP-003 | shared-latent temporal topic estimator | `partial` | Rust CPU f64 likelihood/uncertainty, relation/time/membership effects, true recovery, fitted candidate-K | -| GAP-004 | durable end-to-end Analysis Run | `partial` | idempotent lifecycle, persistence/recovery, estimator-bound artifacts, validation/promotion separation, Compose E2E | -| GAP-005 | temporal psychometric composition/duplication | `partial` | released fast-mlsirm contracts, TEPP ACLs, temporal recovery, wrong-owner static kernels removed after parity | -| GAP-006 | event intelligence | `partial` | calibrated detection/tracking/schema/interval recovery and durable artifacts | -| GAP-007 | accelerator/memory evidence | `accepted-target` | real hardware, CPU-f64 parity, bounded OOM/fallback evidence | -| GAP-008 | network/cluster buyer workflow | `partial` | known-truth recovery, uncertainty/stability, repeated consensus, exact-value export | -| GAP-009 | production interpreter/verifier | `partial` | released contextual-orchestrator execution, evidence citations, independent verification, abstention/fallback | -| GAP-010 | accessible buyer UI | `accepted-target` | Figma/Storybook, locale-specific CJK/text expansion/font fallback, keyboard/touch/loading/empty/error/permission states, exact-value provenance | -| GAP-011 | operable multi-tenant release | `accepted-target` | OIDC/RLS/purpose controls, durable queue/storage, OTel/SLO, restore/load/migration, signed SBOM/provenance | -| GAP-012 | paths obscure domain ownership | `active-refactor` | staged moves, ACLs, no cycles/cross-context persistence/shared-kernel creep | -| GAP-013 | ADR identity collisions | `release-integrity` | unique repository-wide identity, deterministic duplicate detection, supersession lineage | -| GAP-014 | current required-workflow startup/runner evidence unavailable | `external-control-risk` | central workflow repair, exact-current required workflows GREEN, no bypass | -| GAP-015 | contextual-orchestrator lacks immutable released contract for current owner behavior | `release-blocking` | compatible immutable CO release, deployment provenance, safe gateway auth, exact TEPP ACL adoption | -| GAP-016 | hourly LLM path needs released owner-only routing/authentication | `active-repair` | #480 Draft + released CO adoption + exact-head GREEN/review/main merge | -| GAP-017 | dynamic evaluation item/rater/anchor drift monitoring | `owner-contract-active` | released/digest-pinned dynamic criterion/item/run contract, ACL conformance, no-anchor/no-linking refusal, evidence-gated temporal monitoring | -| GAP-018 | Longitudinal stable-mean logic had separate decomposition implementation | `verification-pending` | RED `7dc87aa8...` + repair `97c8ad35...`; exact-head GREEN/review/main integration | -| GAP-019 | Longitudinal scientific instructions contradicted stationary-overflow implementation | `verification-pending` | RED `9d8a82d...` + repair `9c962205...`; exact-head integration | -| GAP-020 | nonzero lagged covariance could become false exact-zero correlation | `verification-pending` | RED `c345ee7b...` + repair `5785e07a...`; exact-head integration | -| GAP-021 | irregular-rate facade duplicated wrapper identities | `verification-pending` | RED `464863860...` + repair `7f0bea084...`; exact-head integration | -| GAP-022 | Architecture assigned Longitudinal semantics to wrong context | `verification-pending` | RED `fe5eb745...` + repair `7fadc757...`; exact-head integration | -| GAP-023 | `discreteDIFFUSIONstd` rejected representable subnormal ratio | `verification-pending` | RED `d5107b198...` + repair `7164c7ce4...` | -| GAP-024 | contributor guidance re-authorized direct provider credential | `verification-pending` | RED `4248b335...` + repair `01f45a993...`; #480 carries owner-correct follow-up | -| GAP-025 | singleton unit could satisfy nominal CWC unit floor | `verification-pending` | RED `671709bbc...` + repair `4784b370c...` | -| GAP-026 | standardized longitudinal maps rejected representable finals after cancelled overflow | `verification-pending` | RED `4a1f6c49...` / `96d8ed13...` + repairs `a4bc6230...` / `33f4b187...` / `26b03c32...` | -| GAP-027 | finite-interval diffusion could falsely saturate to unit diffusion | `verification-pending` | RED `a8de3c9f...` + repair `c17e2ff8...` | -| GAP-028 | positive stationary variance could become false exact zero | `verification-pending` | RED `27d9fa39...` + repair `a0132b62...` | -| GAP-029 | occasion-mean composition arrived in wrong bounded context | `verification-pending` | verified-successor #486 into #310 + release fragment `db335d90...` | -| GAP-030 | prediction-contradiction run treated observed classes as mandatory strata | `active-fold` | RED `a2892b6...` + repair `a6402015...` + Proposed ADR `e07b2ff9...`; fold into #416 | -| GAP-031 | occasion-mean same-sign averaging double-rounded minimum-subnormal tie | `verification-pending` | RED `9aff817f...` + repair `40e057b8...` | -| GAP-032 | CWC/irregular residual same-sign mean retained subnormal double rounding | `verification-pending` | RED `23476f45...` + repair `b14eb6e8...` | -| GAP-033 | arbitrary max normalization misrounded subnormal mean | `verification-pending` | RED `b073f03f...` + repair `350b8d4e...` + consolidation `dd53eff6...` | -| GAP-034 | mixed-sign cancellation rounded retained mean before original denominator | `verification-pending` | RED `ae5e61f9...` + repair `39469067...` | -| GAP-035 | within/between shadow running mean misrounded small residuals | `verification-pending` | RED `7dc87aa8...` + repair `97c8ad35...` | -| GAP-036 | known-truth component RMSE could underflow nonzero error to zero | `verification-pending` | RED `496583c6...` + repair `a82b383b...` | -| GAP-037 | strict-interior lagged covariance could round to false exact `±1` | `verification-pending` | RED `683b28ee...` + repair `9eeb373d...` | -| GAP-038 | exact Cauchy-Schwarz boundary could round below `±1` | `verification-pending` | RED `c2500090...` + repair `d06259ec...` | -| GAP-039 | exact-zero lagged covariance could leak `-0.0` | `verification-pending` | RED `e15d0531...` + repair `fc61f7bd...` | -| GAP-040 | exact-zero within-person deviation could leak `-0.0` | `verification-pending` | RED `aeb008a3...` + repair `a9a70baa...` | -| GAP-041 | one-sign irregular residual log-rate mean could underflow to zero | `verification-pending` | RED `96f1c334...` + repair `ae5081d8...` | -| GAP-042 | ratio-first logarithm inflated adjacent-float growth rate | `verification-pending` | RED `766ddc7a...` + `ln_1p` repair `16f21d9a...` | -| GAP-043 | duplicate known-truth identities could silently reweight RMSE | `verification-pending` | RED `698f12f5...` + repair `2fae4cb2...` | -| GAP-044 | known-truth RMSE alignment depended on row order | `verification-pending` | RED `8ad72ac9...` / `5fb93c40...` + repairs `2dd9537e...` / `025dce7f...`; #310 `c6680450...` | -| GAP-045 | mean signed bias could reject representable result because finite residuals were summed before dividing | `verification-pending` | RED `c5ec42e4...` + repair `7499042f...`; inherited by #488 `37e3defb...` | -| GAP-046 | bias SE could reject representable SEM because raw squared deviations overflowed | `verification-pending` | RED `7de0ef90...` + repair `cad23162...`; inherited by #488 `37e3defb...` | -| GAP-047 | generic RMSE/RMSE-SE could reject representable extremes/subnormals or report false perfect recovery | `verification-pending` | RED `dd41ff53...` / `f4e19991...` + repair `6b182107...`; inherited by #488 `37e3defb...` | -| GAP-048 | mean signed bias could erase representable subnormal residual during mixed-sign cancellation | `verification-pending` | RED `b6084750...` + repair `227921d9...`; inherited by #488 `37e3defb...` | -| GAP-049 | stable `Between` recovery could be aliased across occasion indices and reweight RMSE | `verification-pending` | RED `0a03041c...` + repair `ec2c1219...`; #310 `c6680450...` | -| GAP-050 | zero-multiplier SE-aware acceptance could erase nonzero residual during scale reduction | `verification-pending` | RED `bd8a7c8a...` + repair `00ef2d90...`; inherited by #488 `37e3defb...` | -| GAP-051 | exact-recovery acceptance distinguished IEEE `-0.0` and `+0.0` | `verification-pending` | RED `379e6525...` + repair `55876e60...`; inherited by #488 `37e3defb...` | -| GAP-052 | all-covered Wilson lower endpoint could cancel positive representable value to zero | `verification-pending` | RED `f84e5918...` + repair `fe9b9c8a...`; inherited by #488 `37e3defb...` | -| GAP-053 | strict-interior Wilson lower endpoint could cancel positive value to zero | `verification-pending` | RED `9d45f482...` + repair `4f259f6e...`; inherited by #488 `37e3defb...` | -| GAP-054 | Wilson upper endpoint could falsely round to exact `1.0` | `verification-pending` | RED `c070da26...` / `344081bf...` + repair `9a2fdd05...`; inherited by #488 `37e3defb...` | -| GAP-055 | strict-interior Wilson lower endpoint could accept nonzero cancellation residue | `verification-pending` | RED `1a24fac7...` + repair `f7e20ddc...`; inherited by #488 `37e3defb...` | -| GAP-056 | durable/human-facing Validation Evidence could accept impossible finite relationships or bypass validation | `verification-pending` | report/serde/egress/projection repair lineage; inherited by #488 `37e3defb...` | -| GAP-057 | RMSE-specific Monte Carlo slot could admit negative mean/percentiles from generic signed carrier | `verification-pending` | RED `3cd6e41d...` + repair `0090259d...`; inherited by #488 `37e3defb...` | -| GAP-058 | generic Monte Carlo summary could admit impossible coarse SD/SE/count relationships | `verification-pending` | RED `e2d0c057...` + repair `0e973b56...`; inherited by #488 `37e3defb...` | -| GAP-059 | Monte Carlo summary could materially misstate positive SE relative to `SD/sqrt(n)` | `verification-pending` | RED `0a4c242f...` + repair `9b53076a...`; inherited by #488 `37e3defb...` | -| GAP-060 | RMSE Monte Carlo exact-zero mean could coexist with positive spread/support | `verification-pending` | RED `a17dfe1b...` + repair `d17d8034...`; inherited by #488 `37e3defb...` | -| GAP-061 | generic Monte Carlo zero spread could retain non-degenerate empirical support | `verification-pending` | RED `ce21941a...` + repair `d0f5c145...`; inherited by #488 `37e3defb...` | -| GAP-062 | finite-tolerance matching could fail for deterministically outside pair | `verification-pending` | RED `d023ecdb...` + repair `5040ff96...`; inherited by #488 `37e3defb...` | -| GAP-063 | exact-zero point RMSE could coexist with positive point RMSE SE | `verification-pending` | RED `f7b018c5...` + repair `4c599918...`; inherited by #488 `37e3defb...` | -| GAP-064 | positive point RMSE could carry SE above squared-residual producer support | `verification-pending` | RED `a2aca5b0...` + repair `32f09402...`; inherited by #488 `37e3defb...` | -| GAP-065 | positive Monte Carlo RMSE could carry impossible spread/SE | `verification-pending` | RED `43a7dec1...` + repair `2f78954e...`; inherited by #488 `37e3defb...` | -| GAP-066 | RMSE nearest-rank percentile could exceed nonnegative `n*mean` support | `verification-pending` | RED `84a200ee...` + repair `04c9cdd4...`; inherited by #488 `37e3defb...` | -| GAP-067 | generic nearest-rank endpoint could be incompatible with represented mean/sample spread | `verification-pending` | RED `40acb4f6...`; rejected repair `2798e4f9...`; causal repair `c7151b49...`; inherited by #488 `37e3defb...` | -| GAP-068 | distinct generic percentile endpoints could jointly exceed squared-deviation budget | `verification-pending` | RED `c4a13826...` + repair `cb3f80a2...`; inherited by #488 `37e3defb...` | -| GAP-069 | two-replication endpoints could exhaust sample while mean/SD remained impossible | `verification-pending` | RED `81bf0d9e...` + repair `d48f8fef...`; inherited by #488 `37e3defb...` | -| GAP-070 | stored Wilson pair could not arise from one score interval | `verification-pending` | RED `a839c606...` + repair `38c5b8e8...`; inherited by #488 `37e3defb...` | -| GAP-071 | durable Wilson evidence lacked denominator/critical-value/sidedness provenance | `active-repair` | carrier/authority/v1/envelope lineage; inherited by #488 `37e3defb...`; durable-consumer adoption remains | -| GAP-072 | exact all-covered Wilson evidence could retain impossible zero lower endpoint | `verification-pending` | RED `ce714f07...` + repair `72e9d954...`; inherited by #488 `37e3defb...` | -| GAP-073 | durable Wilson count provenance could lose one uncovered observation above exact-integer range | `verification-pending` | RED `29d710a5...` + count/fixed-width/exact-ratio repair lineage; inherited by #488 `37e3defb...` | -| GAP-074 | durable exact count could be pre-rounded before endpoint projection | `verification-pending` | RED `f89e2467...` + reciprocal-scale repair `73bbb5cf...`; inherited by #488 `37e3defb...` | -| GAP-075 | inexact all-covered Wilson miss mass could round to exact one | `verification-pending` | RED `059ce70d...` + canonical repair `0f478392...`; inherited by #488 `37e3defb...` | -| GAP-076 | exact all-covered count could absorb small positive `z²` and emit exact `1.0` | `verification-pending` | RED `e0c4ec81...` + repair `c9dcb9df...`; inherited by #488 `37e3defb...` | -| GAP-077 | inexact partial denominator could shift exact-count Wilson endpoint by one ULP | `verification-pending` | RED `06e55653...` + TwoSum/FMA repair `6c084dbe...`; inherited by #488 `37e3defb...` | -| GAP-078 | Wilson residual compensation could move quotient across wrong midpoint | `verification-pending` | RED `d076d344...` + midpoint repair `32314239...`; inherited by #488 `37e3defb...` | -| GAP-079 | SE-aware acceptance could underflow finite positive `k*SE` to zero through scale-first arithmetic | `verification-pending` | RED `76067efc...` + direct-finite repair `4ffdf366...`; inherited by #488 `37e3defb...` | -| GAP-080 | both-overflow SE-aware fallback could round strict rejection into equality | `verification-pending` | RED `a9a45714...` + exact significand/exponent repair `425e8963...`; inherited by #488 `37e3defb...` | -| GAP-081 | finite multiplication could round strict SE-aware rejection into equality | `verification-pending` | RED `23c3262c...` + tie repair `6a2add48...`; inherited by #488 `37e3defb...` | -| GAP-082 | finite subtraction could round strict rejection onto exact bound | `verification-pending` | RED `58cbc032...` + low-term repair `68a6fd98...`; inherited by #488 `37e3defb...` | -| GAP-083 | SE-aware product correction could fall below binary64 resolution | `verification-pending` | RED `b55c5473...` / `c77ac440...` + corrected repair `772ad8ed...`; inherited by #488 `37e3defb...` | -| GAP-084 | legacy Wilson boundary could contradict peer endpoint root | `verification-pending` | RED `c9d612f2...` + peer-root repair `88512417...`; inherited by #488 `37e3defb...` | -| GAP-085 | equal nonzero subtraction/FMA correction projections could conceal exact ordering | `verification-pending` | RED `35ea85ba...` + exact product-roundoff repair `7d597a18...`; inherited by #488 `37e3defb...` | -| GAP-086 | mean bias could reject representable result because individual residuals overflow | `verification-pending` | RED `04e6e745...` + explicit-denominator cancellation/bias repair lineage; inherited by #488 `37e3defb...` | -| GAP-087 | mixed-sign mean bias could discard repeated sub-ULP opposing mass | `verification-pending` | RED `63913727...` + low-term repair `5697cca5...`; inherited by #488 `37e3defb...` | -| GAP-088 | mixed-remainder compensation could round before scientific count division | `verification-pending` | RED `8b4d19d1...` + compensated-division repair `7a33212b...`; inherited by #488 `37e3defb...` | -| GAP-089 | exact cancellation could leave same-sign remainder rounded before division | `verification-pending` | RED `84476aad...` + repair `5f0d40b8...`; inherited by #488 `37e3defb...` | -| GAP-090 | same-sign all-subnormal mean normalization could double-round final bias | `verification-pending` | RED `91abdb49...` + exact-unit repair `1c0df8a7...` + halfway coverage; inherited by #488 `37e3defb...` | -| GAP-091 | pairwise subtraction roundoff could move mean bias across final midpoint | `verification-pending` | RED `a9d9bda3...` + corrected tail/midpoint repair `676ccda0...`; inherited by #488 `37e3defb...` | -| GAP-092 | two distinct represented residuals could collapse to one subtraction and false-zero bias SE | `verification-pending` | RED `c9c55ea5...` + n=2 expanded-difference repair `f6d7da96...`; inherited by #488 `37e3defb...` | -| GAP-093 | n>2 distinct represented residuals could collapse to one rounded high and false-zero bias SE | `verification-pending` | RED `06a70e1c...` + common-high/error-free-low repair `04c62514...`; inherited by #488 `37e3defb...` | -| GAP-094 | separately rounded square roots could shift bias SE by one ULP | `verification-pending` | corrected RED `62243204...` + direct normalized-SE repair `8b8f0a21...`; inherited by #488 `37e3defb...` | -| GAP-095 | distinct rounded residual highs could materially overstate uncertainty after subtraction roundoff | `verification-pending` | RED `ae906ad6...` + exact translated-residual repair `d59b9c30...`; inherited by #488 `37e3defb...` | -| GAP-096 | exact residuals could be re-centered on rounded mean and distort dispersion | `verification-pending` | RED `9265b34a...` + exact-residual translated repair `2fa266b2...`; inherited by #488 `37e3defb...` | -| GAP-097 | common-high subtraction path could round low-term mean before centering | `verification-pending` | RED `d48e2515...` + exact low-term translated-second-moment repair `a63b8d7a...`; inherited by #488 `37e3defb...` | -| GAP-098 | exact translated-residual bias SE could double-round through a non-power normalization scale and move the final represented result by one ULP | `verification-pending` | RED `426fc5af...` + shared dyadic-scale prerequisite `d8b411f5...` + causal repair `d536e3b1...` + CHANGELOG `ebce979f...`; inherited by #488 `37e3defb...` | -| GAP-099 | exact translated three-observation two-level bias SE could re-round an exact gap through square/second-moment/square-root and move the represented result by one ULP | `verification-pending` | RED `fbcdb7fa...` + causal repair `e0f2445d...` + CHANGELOG `ee81953e...` + research/ancestor #488 `7741aaa...`; exact-head hosted GREEN/review/main integration remain pending | -| GAP-100 | exact translated two-level bias SE with one singleton could re-round an exact gap through square/second-moment/square-root beyond the n=3 case | `verification-pending` | RED `4386d9ac...` + causal repair `79ad03fa...` + edge `7fe4117c...` + CHANGELOG `017ad11...` + research/ancestor #488 `944fac05...`; exact-head hosted GREEN/review/main integration remain pending | -| GAP-101 | exact two-observation residuals could be re-centered on a rounded midpoint mean and materially distort `SE(mean)` despite exact pairwise subtraction | `verification-pending` | RED `d3dcd918...` + causal repair `02b0a178...` + CHANGELOG `5603b12d...` + research/ancestor #488 `905addcc...`; exact-head hosted GREEN/review/main integration remain pending | -| GAP-102 | exact translated non-singleton two-level bias SE could re-round a dyadic count identity through translated sums/squares/square-root | `verification-pending` | RED `3bc43da2...` + causal repair `77ba1002...` + CHANGELOG `f165914e...` + research/ancestor #488 `9d7bb5c2...`; exact-head hosted GREEN/review/main integration remain pending | -| GAP-103 | exact translated non-singleton two-level bias SE with a reciprocal-integer but non-power-of-two count factor could be re-rounded through translated moments | `verification-pending` | RED `d793f7f9...` + causal repair `0a4bfcd5...` + CHANGELOG `9651dfd1...` + research/ancestor #488 `11b8fd54...`; exact-head hosted GREEN/review/main integration remain pending | -| GAP-104 | exact translated non-singleton two-level bias SE with a non-unit rational-square count factor could be re-rounded through translated moments | `verification-pending` | RED `6dc8116c...` + causal repair `8f2803c8...` + CHANGELOG `f0bb7af9...` + research/ancestor #488 `c5cbf6f0...`; exact-head hosted GREEN/review/main integration remain pending | -| GAP-105 | exact rational-square two-level bias SE could double-round when normal rational scaling restored into the subnormal result range | `verification-pending` | RED `8b7995d2...` + causal repair `ab0f0df1...` + public boundary `4daeb65d...` + branch coverage `8f6916dd...` + CHANGELOG `900b2091...` + research/ancestor #488 `edb84949...`; exact-head hosted GREEN/review/main integration remain pending | -| GAP-106 | exact translated-residual bias SE could select a different numerical path solely because the first observation was or was not a viable exact translation anchor | `verification-pending` | RED `5cb45a4f...` + causal repair `159659a9...` + CHANGELOG `7e57b930...` + research/ancestor #488 `229fdd6e...`; permutation/sign-mirror contract added; exact-head hosted GREEN/review/main integration remain pending | -| GAP-107 | several exact translated-residual anchors could expose different square/square-root conditioning and shift bias SE by one ULP even after permutation-invariant admission | `verification-pending` | RED `49343ab6...` + causal repair `0fc3ea97...` + CHANGELOG `2793ff59...` + research/ancestor #488 `e3ab2765...`; conditioning/permutation/sign-mirror contract added; exact-head hosted GREEN/review/main integration remain pending | -| GAP-108 | exact translated three-observation, three-level rational-square dispersion could be re-rounded through normalized moments and `sqrt` even after best-anchor selection | `verification-pending` | RED `32dcab84...` + causal repair `bee85e3d...` + all-permutation/sign-mirror contract `8260bc0b...` + CHANGELOG `5757dda1...` + research/ancestor #488 `4514a073...`; exact-head hosted GREEN/review/main integration remain pending | -| GAP-109 | exact translated three-observation rational-square bias-SE proof could reject the same represented geometry solely because exact power-of-two scaling overflowed raw square/cross-product intermediates | `verification-pending` | RED `67fa4852...` + causal repair `dcaf25b3...` + CHANGELOG `31b1aff8...` + research/ancestor #488 `1eaac11e...`; all-permutation/sign-mirror scale-invariance contract; exact-head hosted GREEN/review/main integration remain pending | -| GAP-110 | exact translated three-observation bias SE could falsely become zero when mathematically nonzero square/cross-product intermediates underflowed below binary64 range before the bounded exact proof | `verification-pending` | RED `fe013e7d...` + causal repair `d3660d44...` + CHANGELOG `ac833ec1...` + research/ancestor #488 `8bb35572...`; all-permutation/sign-mirror underflow-scale contract; exact-head hosted GREEN/review/main integration remain pending | -| GAP-111 | exact four-observation pair-distance dispersion could move one ULP because the exact rational radicand was rounded before `sqrt` | `verification-pending` | RED `978c422c...` + bounded pair-distance/midpoint repair lineage `3de7a737...` → `c8032493...` + CHANGELOG `49c46aa4...` + research/ancestor #488 `0857d5a4...`; permutation/sign-mirror and proof-edge contracts added; exact-head hosted GREEN/review/main integration remain pending | -| GAP-112 | exact four-observation pair-distance proof could reject an equivalent bounded rational solely because the unreduced numerator exceeded the exact-binary64 integer admission | `verification-pending` | RED `4f223135...` + causal repair `ed1a8763...` + CHANGELOG `28dde0f1...` + research/ancestor #488 `f62b56d2...`; permutation/sign-mirror contract added; exact-head hosted GREEN/review/main integration remain pending | -| GAP-113 | exact four-observation pair-distance proof could reject a GCD-reduced exact rational solely because its exact `u128` numerator exceeded `2^53` even though the rounded numerator was only a candidate seed | `verification-pending` | RED `50153a1c...` + causal repair `dbf6b409...` + CHANGELOG `ca85765f...` + research/ancestor #488 `37e3defb...`; permutation/sign-mirror contract added; exact-head hosted GREEN/review/main integration remain pending | -| GAP-114 | exact five-observation pair-distance dispersion could move one ULP because the bounded midpoint proof stopped at four observations | `verification-pending` | RED `5878ec10...` + causal repair `41298270...` + CHANGELOG `4f6f61d3...` + research/ancestor #488 `8f7dbf88...`; permutation/sign-mirror contract added; exact-head hosted GREEN/review/main integration remain pending | -| GAP-115 | exact six-observation pair-distance dispersion could move one ULP because the bounded midpoint proof stopped at five observations | `verification-pending` | RED `cb07b89b...` + causal repair `8e194dc1...` + CHANGELOG `d709199b...` + research/ancestor #488 `d2d8617b...`; permutation/sign-mirror contract added; exact-head hosted GREEN/review/main integration remain pending | -| GAP-116 | exact seven-observation pair-distance dispersion could move one ULP because the bounded midpoint proof stopped at six observations | `verification-pending` | RED `a1de7ae9...` + causal repair `2907e468...` + CHANGELOG `78d5ed3f...` + research/current #488 `4efe2421...`; permutation/sign-mirror contract added; exact-head hosted GREEN/review/main integration remain pending | +| GAP-001–044 | Existing product/domain/DDD/release gaps and Longitudinal repairs | mixed, inherited | Exact histories remain in repository ancestry, surviving landing vehicles, ADRs/tests, and prior research/TRACEABILITY; no source/test/fixture/contract delta is discarded by this live-register compaction. | +| GAP-045–091 | Established Validation Evidence mean-bias, RMSE/SE, Monte Carlo, Wilson, matching, acceptance, provenance/serde/projection repair sequence | `verification-pending` / inherited | Exact histories remain on #488 ancestry and their public tests/research records; protected-main integration still requires exact-head gates and review. | +| GAP-092 | two represented residuals could collapse to false-zero bias SE | `verification-pending` | RED `c9c55ea5...` + n=2 expanded-difference repair `f6d7da96...`; inherited by #488. | +| GAP-093 | n>2 distinct represented residuals could collapse to one rounded high | `verification-pending` | RED `06a70e1c...` + common-high/error-free-low repair `04c62514...`; inherited by #488. | +| GAP-094 | separately rounded square roots could shift bias SE by one ULP | `verification-pending` | corrected RED `62243204...` + direct normalized-SE repair `8b8f0a21...`; inherited by #488. | +| GAP-095 | subtraction roundoff could materially overstate uncertainty | `verification-pending` | RED `ae906ad6...` + exact translated-residual repair `d59b9c30...`; inherited. | +| GAP-096 | exact residuals could be re-centered on a rounded mean | `verification-pending` | RED `9265b34a...` + exact-residual translated repair `2fa266b2...`; inherited. | +| GAP-097 | common-high path could round low-term mean before centering | `verification-pending` | RED `d48e2515...` + exact low-term translated-second-moment repair `a63b8d7a...`; inherited. | +| GAP-098 | non-power normalization could double-round exact translated bias SE | `verification-pending` | RED `426fc5af...` + dyadic-scale prerequisite `d8b411f5...` + causal repair `d536e3b1...`; inherited. | +| GAP-099 | exact n=3 two-level bias SE could re-round an exact gap | `verification-pending` | RED `fbcdb7fa...` + causal repair `e0f2445d...`; inherited. | +| GAP-100 | exact two-level singleton geometry remained wrong beyond n=3 | `verification-pending` | RED `4386d9ac...` + causal repair `79ad03fa...`; inherited. | +| GAP-101 | exact n=2 residuals could be re-centered on rounded midpoint mean | `verification-pending` | RED `d3dcd918...` + causal repair `02b0a178...`; inherited. | +| GAP-102 | non-singleton two-level dyadic count identity could be re-rounded | `verification-pending` | RED `3bc43da2...` + causal repair `77ba1002...`; inherited. | +| GAP-103 | reciprocal-integer non-power-of-two count factor could be re-rounded | `verification-pending` | RED `d793f7f9...` + causal repair `0a4bfcd5...`; inherited. | +| GAP-104 | non-unit rational-square count factor could be re-rounded | `verification-pending` | RED `6dc8116c...` + causal repair `8f2803c8...`; inherited. | +| GAP-105 | exact rational-square result could double-round into subnormal range | `verification-pending` | RED `8b7995d2...` + causal repair `ab0f0df1...`; inherited. | +| GAP-106 | numerical path depended on first-observation anchor | `verification-pending` | RED `5cb45a4f...` + causal repair `159659a9...`; permutation/sign-mirror contract inherited. | +| GAP-107 | several exact anchors had different conditioning | `verification-pending` | RED `49343ab6...` + causal repair `0fc3ea97...`; conditioning contract inherited. | +| GAP-108 | exact n=3 three-level rational-square dispersion re-rounded through moments | `verification-pending` | RED `32dcab84...` + causal repair `bee85e3d...`; all-permutation/sign-mirror contract inherited. | +| GAP-109 | exact dyadic scale overflow could reject the same n=3 proof | `verification-pending` | RED `67fa4852...` + causal repair `dcaf25b3...`; inherited. | +| GAP-110 | nonzero raw product underflow could be mistaken for exact zero | `verification-pending` | RED `fe013e7d...` + causal repair `d3660d44...`; inherited. | +| GAP-111 | exact n=4 pair-distance radicand was rounded before `sqrt` | `verification-pending` | RED `978c422c...` + bounded pair-distance/midpoint repair lineage `3de7a737...` → `c8032493...`; inherited. | +| GAP-112 | unreduced n=4 rational could select a different bounded path | `verification-pending` | RED `4f223135...` + causal GCD-reduction repair `ed1a8763...`; inherited. | +| GAP-113 | exact reduced `u128` numerator above `2^53` was unnecessarily rejected | `verification-pending` | RED `50153a1c...` + causal repair `dbf6b409...`; inherited. | +| GAP-114 | exact n=5 pair-distance dispersion remained one ULP wrong | `verification-pending` | RED `5878ec10...` + causal repair `41298270...`; inherited. | +| GAP-115 | exact n=6 pair-distance dispersion remained one ULP wrong | `verification-pending` | RED `cb07b89b...` + causal repair `8e194dc1...`; inherited. | +| GAP-116 | exact n=7 pair-distance dispersion remained one ULP wrong | `verification-pending` | RED `a1de7ae9...` + causal repair `2907e468...` + CHANGELOG `78d5ed3f...` + research ancestor `4efe2421...`; inherited. | +| GAP-117 | exact n=8 pair-distance dispersion remains one ULP high on the predecessor translated floating path | `verification-pending` | RED `40413dc9...` + causal repair `26ca2d68...` extends only the bounded proof through `n=8` + CHANGELOG `2641b261...` + research/current #488 `52fa2c87...`; permutations/sign mirrors fixed at `0x41ac_8601_97ac_cd4c`; hosted exact-head GREEN/review/main integration pending. | ## Release gate -TEPP currently has no GitHub release. Release is permitted only after a clean coherent vertical reaches protected main with exact protected-head CI/security evidence, scientific/recovery acceptance, reproducible package/build artifacts with SBOM and provenance, validated migrations/upgrade/rollback/recovery where applicable, consistent version metadata and current `CHANGELOG.md`, accessibility/operability evidence for user-facing components, no unresolved scientific/privacy/security/supply-chain blockers, and released integration contracts where deployment depends on them. Queued/pending/startup-failed/skipped or predecessor-head evidence is not GREEN. +TEPP currently has no GitHub release. Release is permitted only after a coherent vertical reaches protected main with exact protected-head CI/security evidence, scientific/recovery acceptance, reproducible package/build artifacts with SBOM and provenance, validated migrations/upgrade/rollback/recovery where applicable, consistent version metadata and current CHANGELOG, accessibility/operability evidence for user-facing components, no unresolved scientific/privacy/security/supply-chain blockers, and released integration contracts where deployment depends on them. Queued/pending/startup-failed/skipped or predecessor-head evidence is not GREEN. From 866d3a513807024af5eedb619cd6dccd84c5f5aa Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 5 Sep 2026 23:36:15 +0900 Subject: [PATCH 212/235] docs(gaps): advance Validation Evidence through GAP-118 --- docs/product-technical-gap-baseline.md | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 2cc3ed606..bbccb93eb 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-05T14:08:00Z +**Snapshot:** 2026-09-05T14:33:09Z **Protected-main evidence:** `a243f18da4a4ca8a8d068c39922537f1f8ed6ad0` **Workspace version:** `0.2.0` @@ -30,7 +30,7 @@ Passing, queued, skipped, or predecessor-head Checks on an open PR never promote | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `52fa2c87c2673ae2783d119200690c6656a7df65` | true | `main` | Validation Evidence landing vehicle on protected #490. GAP-117 demonstrates an exact eight-observation pair-distance radicand whose translated floating moment/`sqrt` fallback is one ULP high; bounded repair extends the existing exact midpoint proof only through `n=8`. Fresh hosted exact-head gates and independent review remain required. | +| #488 | `c76f0021fdfaf9a58f226db2ceb58a34f5b4be92` | true | `main` | Validation Evidence landing vehicle on protected #490. GAP-118 demonstrates an exact nine-observation pair-distance radicand whose translated floating moment/`sqrt` fallback is one ULP low; bounded repair extends the existing exact midpoint proof only through `n=9`. Fresh hosted exact-head gates and independent review remain required. | | #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 | Validation / Analysis Run fold child; unique evidence must be inherited by a conflict-resolving survivor and child-head CI does not transfer. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | @@ -58,7 +58,7 @@ The clock contract separates event/valid time, assertion time, document time, sy - A nominal unit identifier is not repeated-measures evidence; singleton units cannot satisfy a longitudinal multilevel floor. Stable `Between` known truth is unit-level with canonical `occasion_index = 0`; `Within` retains actual `(unit, occasion)` identity. - Row arrival order is not scientific evidence. Fixed admitted observations must produce bit-identical results under permutation wherever the deterministic CPU `f64` contract claims it. - A representable final scientific estimand is not rejected solely because an avoidable intermediate binary64 operation overflows/underflows. False exact endpoints, erased finite bounds, cancellation residues, and avoidable double-rounding are repair findings. -- Mean signed bias and bias SE are TEPP Validation Evidence performance measures. For `n=2`, the exact represented residual-difference identity remains authoritative. For `n=3`, proved two-level/rational-square identities and translated-residual rules from GAP-092–110 remain inherited. For exact represented residuals with `n=4..=8`, GAP-111–117 admit `SE(mean)^2 = Σ_{i2` claim. +- Mean signed bias and bias SE are TEPP Validation Evidence performance measures. For `n=2`, the exact represented residual-difference identity remains authoritative. For `n=3`, proved two-level/rational-square identities and translated-residual rules from GAP-092–110 remain inherited. For exact represented residuals with `n=4..=9`, GAP-111–118 admit `SE(mean)^2 = Σ_{i2` claim. - Generic Validation Evidence RMSE, Monte Carlo, Wilson, SE-aware acceptance, matching, durable evidence/provenance, serde and human projection retain their GAP-045–091 contracts. Scientific failures are never hidden with skip/xfail/source rewriting/coverage exclusions. - Historical-cutoff admission occurs before duplicate-identity checks. Future-unavailable evidence cannot change an earlier run's conflicts, counts, or terminal state. - Supported temporal estimators require state/trajectory and claimed-structure recovery, bias/RMSE, interval coverage, convergence, uncertainty calibration, reproducibility, and leakage-safe rolling-origin evidence. CPU/GPU parity counts only when the relevant accelerator path actually runs. @@ -67,9 +67,9 @@ The clock contract separates event/valid time, assertion time, document time, sy ### #488 — Validation Evidence -#488 is the generic Validation Evidence landing vehicle at exact head `52fa2c87c2673ae2783d119200690c6656a7df65`, based on protected #490. GAP-117 RED `40413dc9e3279f06c3d02ed2180ac9c170a51001` fixes the exact eight-observation sample `truth=[0,0,0,0,0,0,0,0]`, `recovered=[121838114,741324193,994684355,1673429661,1824103795,1861311798,1872117478,1936395613]`. Its twenty-eight squared pair distances sum to `25648518292283252135`; because `n=8`, exact `SE(mean)^2=N/448`. `gcd(N,448)=7`, so the exact reduced radicand is `3664074041754750305/64`. The GAP-116 admission stopped at seven observations and fell back to translated floating moments, returning adjacent upper `0x41ac_8601_97ac_cd4d`; exact checked midpoint comparison returns correctly rounded `0x41ac_8601_97ac_cd4c`. +#488 is the generic Validation Evidence landing vehicle at exact head `c76f0021fdfaf9a58f226db2ceb58a34f5b4be92`, based on protected #490. GAP-118 RED `c7b6537763f303069aa11e4ebfa12b7b3093448c` fixes the exact nine-observation sample `truth=[0,0,0,0,0,0,0,0,0]`, `recovered=[354161013,513228884,592175752,1188877551,1313358136,1582012649,1600441891,1764736057,1957134661]`. Its thirty-six squared pair distances sum to `24907531253053169466`; because `n=9`, exact `SE(mean)^2=N/648`. `gcd(N,648)=162`, so the exact reduced radicand is `153750192920081293/4`. The GAP-117 admission stopped at eight observations and fell back to translated floating moments, returning adjacent lower `0x41a7_5f1f_6489_5d35`; exact checked midpoint comparison returns correctly rounded `0x41a7_5f1f_6489_5d36`. -Causal repair `26ca2d68bf057b93b9fef1e14953bedbdcf754c0` changes only the bounded pair-distance admission to `n=4..=8`. Residual/pairwise exactness, checked dyadic/`u128` construction, `n²(n-1)` denominator, GCD reduction, exact candidate/adjacent-midpoint comparison, and fail-closed fallback remain mandatory. CHANGELOG `2641b2613a7c37e4153d9b8baa47487a1b80718e`; research/TRACEABILITY current #488 `52fa2c87c2673ae2783d119200690c6656a7df65`. GAP-116 RED `a1de7ae90ae57e0eb55d7efe0b8bf6d9f5a6f3f3`, repair `2907e468363040a435fde4dd14e74ca32cc3b082`, CHANGELOG `78d5ed3fb81765edbc4ee662dacabe6ec631265f`, and research ancestor `4efe2421e24a964093d5bc63e4abef9e2664c330` remain inherited, as do GAP-115 through GAP-001 source/test/fixture/contract/ADR histories. +Causal repair `bcd2ab5e1e6bd38f0661e7bb47e5d59a78830499` changes only the bounded pair-distance admission to `n=4..=9`. Residual/pairwise exactness, checked dyadic/`u128` construction, `n²(n-1)` denominator, GCD reduction, exact candidate/adjacent-midpoint comparison, and fail-closed fallback remain mandatory. CHANGELOG `f575fa2143e0e46058dd62d6dcdd6e6c3e6354b1`; research/TRACEABILITY current #488 `c76f0021fdfaf9a58f226db2ceb58a34f5b4be92`. GAP-117 RED `40413dc9e3279f06c3d02ed2180ac9c170a51001`, repair `26ca2d68bf057b93b9fef1e14953bedbdcf754c0`, CHANGELOG `2641b2613a7c37e4153d9b8baa47487a1b80718e`, and research ancestor `52fa2c87c2673ae2783d119200690c6656a7df65` remain inherited, as do GAP-116 through GAP-001 source/test/fixture/contract/ADR histories. ### #310, #416, #480 @@ -108,7 +108,8 @@ GAP-001–GAP-044 retain their existing domain/release identities and exact sour | GAP-114 | exact n=5 pair-distance dispersion remained one ULP wrong | `verification-pending` | RED `5878ec10...` + causal repair `41298270...`; inherited. | | GAP-115 | exact n=6 pair-distance dispersion remained one ULP wrong | `verification-pending` | RED `cb07b89b...` + causal repair `8e194dc1...`; inherited. | | GAP-116 | exact n=7 pair-distance dispersion remained one ULP wrong | `verification-pending` | RED `a1de7ae9...` + causal repair `2907e468...` + CHANGELOG `78d5ed3f...` + research ancestor `4efe2421...`; inherited. | -| GAP-117 | exact n=8 pair-distance dispersion remains one ULP high on the predecessor translated floating path | `verification-pending` | RED `40413dc9...` + causal repair `26ca2d68...` extends only the bounded proof through `n=8` + CHANGELOG `2641b261...` + research/current #488 `52fa2c87...`; permutations/sign mirrors fixed at `0x41ac_8601_97ac_cd4c`; hosted exact-head GREEN/review/main integration pending. | +| GAP-117 | exact n=8 pair-distance dispersion remained one ULP high on the predecessor translated floating path | `verification-pending` | RED `40413dc9...` + causal repair `26ca2d68...` extends only the bounded proof through `n=8` + CHANGELOG `2641b261...` + research ancestor `52fa2c87...`; permutations/sign mirrors fixed at `0x41ac_8601_97ac_cd4c`; inherited by #488. | +| GAP-118 | exact n=9 pair-distance dispersion remains one ULP low on the predecessor translated floating path | `verification-pending` | RED `c7b65377...` + causal repair `bcd2ab5e...` extends only the bounded proof through `n=9` + CHANGELOG `f575fa21...` + research/current #488 `c76f0021...`; permutations/sign mirrors fixed at `0x41a7_5f1f_6489_5d36`; hosted exact-head GREEN/review/main integration pending. | ## Release gate From 68446d9f634f8df61bc4a9b174b1af975d79f079 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 5 Sep 2026 23:43:23 +0900 Subject: [PATCH 213/235] docs(gaps): advance Validation Evidence through GAP-119 --- docs/product-technical-gap-baseline.md | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index bbccb93eb..e98033573 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-05T14:33:09Z +**Snapshot:** 2026-09-05T14:42:15Z **Protected-main evidence:** `a243f18da4a4ca8a8d068c39922537f1f8ed6ad0` **Workspace version:** `0.2.0` @@ -30,7 +30,7 @@ Passing, queued, skipped, or predecessor-head Checks on an open PR never promote | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `c76f0021fdfaf9a58f226db2ceb58a34f5b4be92` | true | `main` | Validation Evidence landing vehicle on protected #490. GAP-118 demonstrates an exact nine-observation pair-distance radicand whose translated floating moment/`sqrt` fallback is one ULP low; bounded repair extends the existing exact midpoint proof only through `n=9`. Fresh hosted exact-head gates and independent review remain required. | +| #488 | `bf32b5090f887935cad836b3ec52d4d9d9c357af` | true | `main` | Validation Evidence landing vehicle on protected #490. GAP-119 demonstrates an exact ten-observation pair-distance radicand whose translated floating moment/`sqrt` fallback is one ULP low; bounded repair extends the existing exact midpoint proof only through `n=10`. Fresh hosted exact-head gates and independent review remain required. | | #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 | Validation / Analysis Run fold child; unique evidence must be inherited by a conflict-resolving survivor and child-head CI does not transfer. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | @@ -58,7 +58,7 @@ The clock contract separates event/valid time, assertion time, document time, sy - A nominal unit identifier is not repeated-measures evidence; singleton units cannot satisfy a longitudinal multilevel floor. Stable `Between` known truth is unit-level with canonical `occasion_index = 0`; `Within` retains actual `(unit, occasion)` identity. - Row arrival order is not scientific evidence. Fixed admitted observations must produce bit-identical results under permutation wherever the deterministic CPU `f64` contract claims it. - A representable final scientific estimand is not rejected solely because an avoidable intermediate binary64 operation overflows/underflows. False exact endpoints, erased finite bounds, cancellation residues, and avoidable double-rounding are repair findings. -- Mean signed bias and bias SE are TEPP Validation Evidence performance measures. For `n=2`, the exact represented residual-difference identity remains authoritative. For `n=3`, proved two-level/rational-square identities and translated-residual rules from GAP-092–110 remain inherited. For exact represented residuals with `n=4..=9`, GAP-111–118 admit `SE(mean)^2 = Σ_{i2` claim. +- Mean signed bias and bias SE are TEPP Validation Evidence performance measures. For `n=2`, the exact represented residual-difference identity remains authoritative. For `n=3`, proved two-level/rational-square identities and translated-residual rules from GAP-092–110 remain inherited. For exact represented residuals with `n=4..=10`, GAP-111–119 admit `SE(mean)^2 = Σ_{i2` claim. - Generic Validation Evidence RMSE, Monte Carlo, Wilson, SE-aware acceptance, matching, durable evidence/provenance, serde and human projection retain their GAP-045–091 contracts. Scientific failures are never hidden with skip/xfail/source rewriting/coverage exclusions. - Historical-cutoff admission occurs before duplicate-identity checks. Future-unavailable evidence cannot change an earlier run's conflicts, counts, or terminal state. - Supported temporal estimators require state/trajectory and claimed-structure recovery, bias/RMSE, interval coverage, convergence, uncertainty calibration, reproducibility, and leakage-safe rolling-origin evidence. CPU/GPU parity counts only when the relevant accelerator path actually runs. @@ -67,9 +67,9 @@ The clock contract separates event/valid time, assertion time, document time, sy ### #488 — Validation Evidence -#488 is the generic Validation Evidence landing vehicle at exact head `c76f0021fdfaf9a58f226db2ceb58a34f5b4be92`, based on protected #490. GAP-118 RED `c7b6537763f303069aa11e4ebfa12b7b3093448c` fixes the exact nine-observation sample `truth=[0,0,0,0,0,0,0,0,0]`, `recovered=[354161013,513228884,592175752,1188877551,1313358136,1582012649,1600441891,1764736057,1957134661]`. Its thirty-six squared pair distances sum to `24907531253053169466`; because `n=9`, exact `SE(mean)^2=N/648`. `gcd(N,648)=162`, so the exact reduced radicand is `153750192920081293/4`. The GAP-117 admission stopped at eight observations and fell back to translated floating moments, returning adjacent lower `0x41a7_5f1f_6489_5d35`; exact checked midpoint comparison returns correctly rounded `0x41a7_5f1f_6489_5d36`. +#488 is the generic Validation Evidence landing vehicle at exact head `bf32b5090f887935cad836b3ec52d4d9d9c357af`, based on protected #490. GAP-119 RED `813c97e8e5e13ee7cec7e4290b7bb78d68504cdd` fixes the exact ten-observation sample `truth=[0,0,0,0,0,0,0,0,0,0]`, `recovered=[418906532,431535003,554793949,905115878,1079195036,1340223962,1591821052,1592008872,1807262929,1996099302]`. Its forty-five squared pair distances sum to `30398755841753540685`; because `n=10`, exact `SE(mean)^2=N/900`. `gcd(N,900)=15`, so the exact reduced radicand is `2026583722783569379/60`. The GAP-118 admission stopped at nine observations and fell back to translated floating moments, returning adjacent lower `0x41a5_e8a1_0795_bf6b`; exact checked midpoint comparison returns correctly rounded `0x41a5_e8a1_0795_bf6c`. -Causal repair `bcd2ab5e1e6bd38f0661e7bb47e5d59a78830499` changes only the bounded pair-distance admission to `n=4..=9`. Residual/pairwise exactness, checked dyadic/`u128` construction, `n²(n-1)` denominator, GCD reduction, exact candidate/adjacent-midpoint comparison, and fail-closed fallback remain mandatory. CHANGELOG `f575fa2143e0e46058dd62d6dcdd6e6c3e6354b1`; research/TRACEABILITY current #488 `c76f0021fdfaf9a58f226db2ceb58a34f5b4be92`. GAP-117 RED `40413dc9e3279f06c3d02ed2180ac9c170a51001`, repair `26ca2d68bf057b93b9fef1e14953bedbdcf754c0`, CHANGELOG `2641b2613a7c37e4153d9b8baa47487a1b80718e`, and research ancestor `52fa2c87c2673ae2783d119200690c6656a7df65` remain inherited, as do GAP-116 through GAP-001 source/test/fixture/contract/ADR histories. +Causal repair `1bff5033e2de3095340141da38e9c02387b3a868` changes only the bounded pair-distance admission to `n=4..=10`. Residual/pairwise exactness, checked dyadic/`u128` construction, `n²(n-1)` denominator, GCD reduction, exact candidate/adjacent-midpoint comparison, and fail-closed fallback remain mandatory. CHANGELOG `2dacce55a06cc160ae3defcc84b75a8cebd46e18`; research/TRACEABILITY current #488 `bf32b5090f887935cad836b3ec52d4d9d9c357af`. GAP-118 RED `c7b6537763f303069aa11e4ebfa12b7b3093448c`, repair `bcd2ab5e1e6bd38f0661e7bb47e5d59a78830499`, CHANGELOG `f575fa2143e0e46058dd62d6dcdd6e6c3e6354b1`, and research ancestor `c76f0021fdfaf9a58f226db2ceb58a34f5b4be92` remain inherited, as do GAP-117 through GAP-001 source/test/fixture/contract/ADR histories. ### #310, #416, #480 @@ -108,8 +108,9 @@ GAP-001–GAP-044 retain their existing domain/release identities and exact sour | GAP-114 | exact n=5 pair-distance dispersion remained one ULP wrong | `verification-pending` | RED `5878ec10...` + causal repair `41298270...`; inherited. | | GAP-115 | exact n=6 pair-distance dispersion remained one ULP wrong | `verification-pending` | RED `cb07b89b...` + causal repair `8e194dc1...`; inherited. | | GAP-116 | exact n=7 pair-distance dispersion remained one ULP wrong | `verification-pending` | RED `a1de7ae9...` + causal repair `2907e468...` + CHANGELOG `78d5ed3f...` + research ancestor `4efe2421...`; inherited. | -| GAP-117 | exact n=8 pair-distance dispersion remained one ULP high on the predecessor translated floating path | `verification-pending` | RED `40413dc9...` + causal repair `26ca2d68...` extends only the bounded proof through `n=8` + CHANGELOG `2641b261...` + research ancestor `52fa2c87...`; permutations/sign mirrors fixed at `0x41ac_8601_97ac_cd4c`; inherited by #488. | -| GAP-118 | exact n=9 pair-distance dispersion remains one ULP low on the predecessor translated floating path | `verification-pending` | RED `c7b65377...` + causal repair `bcd2ab5e...` extends only the bounded proof through `n=9` + CHANGELOG `f575fa21...` + research/current #488 `c76f0021...`; permutations/sign mirrors fixed at `0x41a7_5f1f_6489_5d36`; hosted exact-head GREEN/review/main integration pending. | +| GAP-117 | exact n=8 pair-distance dispersion remained one ULP high on the predecessor translated floating path | `verification-pending` | RED `40413dc9...` + causal repair `26ca2d68...` extends only the bounded proof through `n=8` + CHANGELOG `2641b261...` + research ancestor `52fa2c87...`; permutations/sign mirrors fixed at `0x41ac_8601_97ac_cd4c`; inherited. | +| GAP-118 | exact n=9 pair-distance dispersion remained one ULP low on the predecessor translated floating path | `verification-pending` | RED `c7b65377...` + causal repair `bcd2ab5e...` extends only the bounded proof through `n=9` + CHANGELOG `f575fa21...` + research ancestor `c76f0021...`; permutations/sign mirrors fixed at `0x41a7_5f1f_6489_5d36`; inherited by #488. | +| GAP-119 | exact n=10 pair-distance dispersion remains one ULP low on the predecessor translated floating path | `verification-pending` | RED `813c97e8...` + causal repair `1bff5033...` extends only the bounded proof through `n=10` + CHANGELOG `2dacce55...` + research/current #488 `bf32b509...`; permutations/sign mirrors fixed at `0x41a5_e8a1_0795_bf6c`; hosted exact-head GREEN/review/main integration pending. | ## Release gate From 2054d71e3c2cfedebb9294194670f51b9d49afba Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sun, 6 Sep 2026 00:11:35 +0900 Subject: [PATCH 214/235] docs(ddd): advance validation gap baseline through GAP-120 --- docs/product-technical-gap-baseline.md | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index e98033573..75280424f 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-05T14:42:15Z +**Snapshot:** 2026-09-05T15:07:15Z **Protected-main evidence:** `a243f18da4a4ca8a8d068c39922537f1f8ed6ad0` **Workspace version:** `0.2.0` @@ -30,7 +30,7 @@ Passing, queued, skipped, or predecessor-head Checks on an open PR never promote | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `bf32b5090f887935cad836b3ec52d4d9d9c357af` | true | `main` | Validation Evidence landing vehicle on protected #490. GAP-119 demonstrates an exact ten-observation pair-distance radicand whose translated floating moment/`sqrt` fallback is one ULP low; bounded repair extends the existing exact midpoint proof only through `n=10`. Fresh hosted exact-head gates and independent review remain required. | +| #488 | `478a28bf7b247603ed12ac4f00d9a5a51df6771a` | true | `main` | Validation Evidence landing vehicle on protected #490. GAP-120 demonstrates an exact eleven-observation pair-distance radicand whose translated floating moment/`sqrt` fallback is one ULP low; bounded repair extends the existing exact midpoint proof only through `n=11`. Fresh hosted exact-head gates and independent review remain required. | | #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 | Validation / Analysis Run fold child; unique evidence must be inherited by a conflict-resolving survivor and child-head CI does not transfer. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | @@ -58,7 +58,7 @@ The clock contract separates event/valid time, assertion time, document time, sy - A nominal unit identifier is not repeated-measures evidence; singleton units cannot satisfy a longitudinal multilevel floor. Stable `Between` known truth is unit-level with canonical `occasion_index = 0`; `Within` retains actual `(unit, occasion)` identity. - Row arrival order is not scientific evidence. Fixed admitted observations must produce bit-identical results under permutation wherever the deterministic CPU `f64` contract claims it. - A representable final scientific estimand is not rejected solely because an avoidable intermediate binary64 operation overflows/underflows. False exact endpoints, erased finite bounds, cancellation residues, and avoidable double-rounding are repair findings. -- Mean signed bias and bias SE are TEPP Validation Evidence performance measures. For `n=2`, the exact represented residual-difference identity remains authoritative. For `n=3`, proved two-level/rational-square identities and translated-residual rules from GAP-092–110 remain inherited. For exact represented residuals with `n=4..=10`, GAP-111–119 admit `SE(mean)^2 = Σ_{i2` claim. +- Mean signed bias and bias SE are TEPP Validation Evidence performance measures. For `n=2`, the exact represented residual-difference identity remains authoritative. For `n=3`, proved two-level/rational-square identities and translated-residual rules from GAP-092–110 remain inherited. For exact represented residuals with `n=4..=11`, GAP-111–120 admit `SE(mean)^2 = Σ_{i2` claim. - Generic Validation Evidence RMSE, Monte Carlo, Wilson, SE-aware acceptance, matching, durable evidence/provenance, serde and human projection retain their GAP-045–091 contracts. Scientific failures are never hidden with skip/xfail/source rewriting/coverage exclusions. - Historical-cutoff admission occurs before duplicate-identity checks. Future-unavailable evidence cannot change an earlier run's conflicts, counts, or terminal state. - Supported temporal estimators require state/trajectory and claimed-structure recovery, bias/RMSE, interval coverage, convergence, uncertainty calibration, reproducibility, and leakage-safe rolling-origin evidence. CPU/GPU parity counts only when the relevant accelerator path actually runs. @@ -67,9 +67,9 @@ The clock contract separates event/valid time, assertion time, document time, sy ### #488 — Validation Evidence -#488 is the generic Validation Evidence landing vehicle at exact head `bf32b5090f887935cad836b3ec52d4d9d9c357af`, based on protected #490. GAP-119 RED `813c97e8e5e13ee7cec7e4290b7bb78d68504cdd` fixes the exact ten-observation sample `truth=[0,0,0,0,0,0,0,0,0,0]`, `recovered=[418906532,431535003,554793949,905115878,1079195036,1340223962,1591821052,1592008872,1807262929,1996099302]`. Its forty-five squared pair distances sum to `30398755841753540685`; because `n=10`, exact `SE(mean)^2=N/900`. `gcd(N,900)=15`, so the exact reduced radicand is `2026583722783569379/60`. The GAP-118 admission stopped at nine observations and fell back to translated floating moments, returning adjacent lower `0x41a5_e8a1_0795_bf6b`; exact checked midpoint comparison returns correctly rounded `0x41a5_e8a1_0795_bf6c`. +#488 is the generic Validation Evidence landing vehicle at exact head `478a28bf7b247603ed12ac4f00d9a5a51df6771a`, based on protected #490. GAP-120 RED `967e1e093603cbefc01889adce0087d744bfcd90` fixes the exact eleven-observation sample `truth=[0,0,0,0,0,0,0,0,0,0,0]`, `recovered=[50511426,167164486,318141475,357712576,407960427,441767841,691573103,733495428,1082192974,1543970183,1797594737]`. Its fifty-five squared pair distances sum to `35022924934975401574`; because `n=11`, exact `SE(mean)^2=N/1210`. `gcd(N,1210)=2`, so the exact reduced radicand is `17511462467487700787/605`. The GAP-119 admission stopped at ten observations and fell back to translated floating moments, returning adjacent lower `0x41a4_47fc_a451_7b3e`; exact checked midpoint comparison returns correctly rounded `0x41a4_47fc_a451_7b3f`. -Causal repair `1bff5033e2de3095340141da38e9c02387b3a868` changes only the bounded pair-distance admission to `n=4..=10`. Residual/pairwise exactness, checked dyadic/`u128` construction, `n²(n-1)` denominator, GCD reduction, exact candidate/adjacent-midpoint comparison, and fail-closed fallback remain mandatory. CHANGELOG `2dacce55a06cc160ae3defcc84b75a8cebd46e18`; research/TRACEABILITY current #488 `bf32b5090f887935cad836b3ec52d4d9d9c357af`. GAP-118 RED `c7b6537763f303069aa11e4ebfa12b7b3093448c`, repair `bcd2ab5e1e6bd38f0661e7bb47e5d59a78830499`, CHANGELOG `f575fa2143e0e46058dd62d6dcdd6e6c3e6354b1`, and research ancestor `c76f0021fdfaf9a58f226db2ceb58a34f5b4be92` remain inherited, as do GAP-117 through GAP-001 source/test/fixture/contract/ADR histories. +Causal repair `59c5a4ef3bb9693329bfb359cecf3bbd93eecb3b` changes only the bounded pair-distance admission to `n=4..=11`. Residual/pairwise exactness, checked dyadic/`u128` construction, `n²(n-1)` denominator, GCD reduction, exact candidate/adjacent-midpoint comparison, and fail-closed fallback remain mandatory. CHANGELOG `2e9c6a54c417ccbe4e567b8f70e50175f1c47553`; research/TRACEABILITY current #488 `478a28bf7b247603ed12ac4f00d9a5a51df6771a`. GAP-119 RED `813c97e8e5e13ee7cec7e4290b7bb78d68504cdd`, repair `1bff5033e2de3095340141da38e9c02387b3a868`, CHANGELOG `2dacce55a06cc160ae3defcc84b75a8cebd46e18`, and research ancestor `bf32b5090f887935cad836b3ec52d4d9d9c357af` remain inherited, as do GAP-118 through GAP-001 source/test/fixture/contract/ADR histories. ### #310, #416, #480 @@ -110,7 +110,8 @@ GAP-001–GAP-044 retain their existing domain/release identities and exact sour | GAP-116 | exact n=7 pair-distance dispersion remained one ULP wrong | `verification-pending` | RED `a1de7ae9...` + causal repair `2907e468...` + CHANGELOG `78d5ed3f...` + research ancestor `4efe2421...`; inherited. | | GAP-117 | exact n=8 pair-distance dispersion remained one ULP high on the predecessor translated floating path | `verification-pending` | RED `40413dc9...` + causal repair `26ca2d68...` extends only the bounded proof through `n=8` + CHANGELOG `2641b261...` + research ancestor `52fa2c87...`; permutations/sign mirrors fixed at `0x41ac_8601_97ac_cd4c`; inherited. | | GAP-118 | exact n=9 pair-distance dispersion remained one ULP low on the predecessor translated floating path | `verification-pending` | RED `c7b65377...` + causal repair `bcd2ab5e...` extends only the bounded proof through `n=9` + CHANGELOG `f575fa21...` + research ancestor `c76f0021...`; permutations/sign mirrors fixed at `0x41a7_5f1f_6489_5d36`; inherited by #488. | -| GAP-119 | exact n=10 pair-distance dispersion remains one ULP low on the predecessor translated floating path | `verification-pending` | RED `813c97e8...` + causal repair `1bff5033...` extends only the bounded proof through `n=10` + CHANGELOG `2dacce55...` + research/current #488 `bf32b509...`; permutations/sign mirrors fixed at `0x41a5_e8a1_0795_bf6c`; hosted exact-head GREEN/review/main integration pending. | +| GAP-119 | exact n=10 pair-distance dispersion remained one ULP low on the predecessor translated floating path | `verification-pending` | RED `813c97e8...` + causal repair `1bff5033...` extends only the bounded proof through `n=10` + CHANGELOG `2dacce55...` + research ancestor `bf32b509...`; permutations/sign mirrors fixed at `0x41a5_e8a1_0795_bf6c`; inherited by #488. | +| GAP-120 | exact n=11 pair-distance dispersion remained one ULP low on the predecessor translated floating path | `verification-pending` | RED `967e1e09...` + causal repair `59c5a4ef...` extends only the bounded proof through `n=11` + CHANGELOG `2e9c6a54...` + research/current #488 `478a28bf...`; permutations/sign mirrors fixed at `0x41a4_47fc_a451_7b3f`; hosted exact-head GREEN/review/main integration pending. | ## Release gate From fdf1c497fb2351293f140c9f79acbd52b672fbe8 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sun, 6 Sep 2026 02:05:17 +0900 Subject: [PATCH 215/235] docs(ddd): advance Validation Evidence baseline through GAP-123 --- docs/product-technical-gap-baseline.md | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 75280424f..8a6455d3a 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-05T15:07:15Z +**Snapshot:** 2026-09-05T17:02:35Z **Protected-main evidence:** `a243f18da4a4ca8a8d068c39922537f1f8ed6ad0` **Workspace version:** `0.2.0` @@ -20,7 +20,7 @@ A planning document, mergeable branch, local/source inspection, predecessor-head | Non-Draft pull requests | **0** | No PR is eligible for normal merge until deliberately made Ready after exact-head evidence. | | Open issues | **16** | ADR normalization, orchestration admission, evaluation drift, and scientific recovery remain open. | | GitHub releases | **0** | No TEPP open head is a released contract. | -| Organization ruleset | `18156473` | Current-head approval, stale-review dismissal, resolved threads, and central required workflows remain delivery gates. | +| Organization ruleset | `18156473` | One approval, stale-review dismissal after push, resolved threads, extra approval for unattributed changes, and central required workflows remain delivery gates. | Passing, queued, skipped, or predecessor-head Checks on an open PR never promote that PR to implemented-main. Organization-admin bypass is not normal delivery evidence and is not used by this writer. @@ -30,13 +30,13 @@ Passing, queued, skipped, or predecessor-head Checks on an open PR never promote | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `478a28bf7b247603ed12ac4f00d9a5a51df6771a` | true | `main` | Validation Evidence landing vehicle on protected #490. GAP-120 demonstrates an exact eleven-observation pair-distance radicand whose translated floating moment/`sqrt` fallback is one ULP low; bounded repair extends the existing exact midpoint proof only through `n=11`. Fresh hosted exact-head gates and independent review remain required. | +| #488 | `05e97b3ad2f5ad2b64dd4922c68b28752a13af47` | true | `main` | Validation Evidence landing vehicle on protected #490. GAP-121–123 restore doctoring for demonstrated exact `n=12..14` pair-distance radicands; the bounded checked midpoint proof now extends only through `n=14`, while `n=15` remains fallback. Exact-head hosted jobs are queued and independent review is absent. | | #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 | Validation / Analysis Run fold child; unique evidence must be inherited by a conflict-resolving survivor and child-head CI does not transfer. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | | #483 | `847d96f913bb261803ac0bd751ad7e4f51324cee` | true | #416 | Analysis Run fold child; preserve unique evidence. | | #482 | `506dbae236a4484301b704b6c6a05b20faf0fe69` | true | #416 | Analysis Run fold child; preserve unique evidence. | -| #480 | `5b2637f7b6142573ba1385a652c56632ecc9faa5` | true | `main` | Released contextual-orchestrator boundary repair; mutable owner main remains evidence only and branch still needs non-force inheritance of #489/#490. | +| #480 | `5b2637f7b6142573ba1385a652c56632ecc9faa5` | true | `main` | Released contextual-orchestrator boundary repair vehicle; mutable owner main remains evidence only and branch still needs non-force inheritance of #489/#490. | | #460 | `dfab4eab5ff733731e565a9348072b8dab2e4912` | true | #416 | Analysis Run fold child; typed cutoff equality and terminal-validation separation. | | #458 | `08165e3b3c929b4ae77396689549f72723ff8ff5` | true | #416 | Analysis Run fold child; typed cutoff equality and terminal-validation separation. | | #416 | `aa730c63563eb4a33048d822b581036c8487bd47` | true | `main` | Validation / Analysis Run landing vehicle; generic cutoff-before-identity repair remains inherited and branch requires non-destructive #489/#490 consolidation. | @@ -58,7 +58,7 @@ The clock contract separates event/valid time, assertion time, document time, sy - A nominal unit identifier is not repeated-measures evidence; singleton units cannot satisfy a longitudinal multilevel floor. Stable `Between` known truth is unit-level with canonical `occasion_index = 0`; `Within` retains actual `(unit, occasion)` identity. - Row arrival order is not scientific evidence. Fixed admitted observations must produce bit-identical results under permutation wherever the deterministic CPU `f64` contract claims it. - A representable final scientific estimand is not rejected solely because an avoidable intermediate binary64 operation overflows/underflows. False exact endpoints, erased finite bounds, cancellation residues, and avoidable double-rounding are repair findings. -- Mean signed bias and bias SE are TEPP Validation Evidence performance measures. For `n=2`, the exact represented residual-difference identity remains authoritative. For `n=3`, proved two-level/rational-square identities and translated-residual rules from GAP-092–110 remain inherited. For exact represented residuals with `n=4..=11`, GAP-111–120 admit `SE(mean)^2 = Σ_{i2` claim. +- Mean signed bias and bias SE are TEPP Validation Evidence performance measures. For `n=2`, the exact represented residual-difference identity remains authoritative. For `n=3`, proved two-level/rational-square identities and translated-residual rules from GAP-092–110 remain inherited. For exact represented residuals with `n=4..=14`, GAP-111–123 admit `SE(mean)^2 = Σ_{i2` claim. - Generic Validation Evidence RMSE, Monte Carlo, Wilson, SE-aware acceptance, matching, durable evidence/provenance, serde and human projection retain their GAP-045–091 contracts. Scientific failures are never hidden with skip/xfail/source rewriting/coverage exclusions. - Historical-cutoff admission occurs before duplicate-identity checks. Future-unavailable evidence cannot change an earlier run's conflicts, counts, or terminal state. - Supported temporal estimators require state/trajectory and claimed-structure recovery, bias/RMSE, interval coverage, convergence, uncertainty calibration, reproducibility, and leakage-safe rolling-origin evidence. CPU/GPU parity counts only when the relevant accelerator path actually runs. @@ -67,9 +67,9 @@ The clock contract separates event/valid time, assertion time, document time, sy ### #488 — Validation Evidence -#488 is the generic Validation Evidence landing vehicle at exact head `478a28bf7b247603ed12ac4f00d9a5a51df6771a`, based on protected #490. GAP-120 RED `967e1e093603cbefc01889adce0087d744bfcd90` fixes the exact eleven-observation sample `truth=[0,0,0,0,0,0,0,0,0,0,0]`, `recovered=[50511426,167164486,318141475,357712576,407960427,441767841,691573103,733495428,1082192974,1543970183,1797594737]`. Its fifty-five squared pair distances sum to `35022924934975401574`; because `n=11`, exact `SE(mean)^2=N/1210`. `gcd(N,1210)=2`, so the exact reduced radicand is `17511462467487700787/605`. The GAP-119 admission stopped at ten observations and fell back to translated floating moments, returning adjacent lower `0x41a4_47fc_a451_7b3e`; exact checked midpoint comparison returns correctly rounded `0x41a4_47fc_a451_7b3f`. +#488 is the generic Validation Evidence landing vehicle at exact head `05e97b3ad2f5ad2b64dd4922c68b28752a13af47`, based on protected #490. GAP-121 RED `b6ac111731a53b5d8d67d0222292542617432478` and repair `035cf392b5e9f115c7b5a2589ebbeadb311d7a45` cover the demonstrated twelve-observation one-ULP-high fallback (`N=55761699077165681660`, denominator `1584`, gcd `4`, correctly rounded `0x41a6_5ddb_5161_045f`). GAP-122 RED `369af46de7e0719cfb4db04fedf4d2775e04f62c` and repair `0b8727e7550022ad5f89b2e5b48129f5b2f520eb` cover thirteen observations (`N=49391029335804262120`, denominator `2028`, gcd `4`, correctly rounded `0x41a2_9a8e_6db8_cb76`). GAP-123 RED `db40397603e2514cf3be25783dc65018aab64f10` and causal repair `58efe80da3c4a57e2b69860f5d4178894f769420` cover fourteen observations (`N=59666178422422564725`, denominator `2548`, gcd `1`): the translated floating moment/`sqrt` fallback returns adjacent lower `0x41a2_3df9_5954_fb0a`, while the exact midpoint proof returns `0x41a2_3df9_5954_fb0b`. -Causal repair `59c5a4ef3bb9693329bfb359cecf3bbd93eecb3b` changes only the bounded pair-distance admission to `n=4..=11`. Residual/pairwise exactness, checked dyadic/`u128` construction, `n²(n-1)` denominator, GCD reduction, exact candidate/adjacent-midpoint comparison, and fail-closed fallback remain mandatory. CHANGELOG `2e9c6a54c417ccbe4e567b8f70e50175f1c47553`; research/TRACEABILITY current #488 `478a28bf7b247603ed12ac4f00d9a5a51df6771a`. GAP-119 RED `813c97e8e5e13ee7cec7e4290b7bb78d68504cdd`, repair `1bff5033e2de3095340141da38e9c02387b3a868`, CHANGELOG `2dacce55a06cc160ae3defcc84b75a8cebd46e18`, and research ancestor `bf32b5090f887935cad836b3ec52d4d9d9c357af` remain inherited, as do GAP-118 through GAP-001 source/test/fixture/contract/ADR histories. +The causal source change only advances the existing bounded admission to `n=4..=14`; residual/pairwise exactness, checked dyadic/`u128` construction, `n²(n-1)` denominator, GCD reduction, exact candidate/adjacent-midpoint comparison, and fail-closed fallback remain mandatory. Doctoring commit `05e97b3ad2f5ad2b64dd4922c68b28752a13af47` adds GAP-121/122/123 CHANGELOG entries and `docs/research/validation-bias-standard-error-twelve-through-fourteen-observation-pair-distance.md`. GAP-120 and all earlier source/test/fixture/contract/ADR histories remain inherited. Exact-head Rust, documentation, security/SAST and independent review evidence are still pending; `mergeable=true` is not GREEN. ### #310, #416, #480 @@ -111,7 +111,10 @@ GAP-001–GAP-044 retain their existing domain/release identities and exact sour | GAP-117 | exact n=8 pair-distance dispersion remained one ULP high on the predecessor translated floating path | `verification-pending` | RED `40413dc9...` + causal repair `26ca2d68...` extends only the bounded proof through `n=8` + CHANGELOG `2641b261...` + research ancestor `52fa2c87...`; permutations/sign mirrors fixed at `0x41ac_8601_97ac_cd4c`; inherited. | | GAP-118 | exact n=9 pair-distance dispersion remained one ULP low on the predecessor translated floating path | `verification-pending` | RED `c7b65377...` + causal repair `bcd2ab5e...` extends only the bounded proof through `n=9` + CHANGELOG `f575fa21...` + research ancestor `c76f0021...`; permutations/sign mirrors fixed at `0x41a7_5f1f_6489_5d36`; inherited by #488. | | GAP-119 | exact n=10 pair-distance dispersion remained one ULP low on the predecessor translated floating path | `verification-pending` | RED `813c97e8...` + causal repair `1bff5033...` extends only the bounded proof through `n=10` + CHANGELOG `2dacce55...` + research ancestor `bf32b509...`; permutations/sign mirrors fixed at `0x41a5_e8a1_0795_bf6c`; inherited by #488. | -| GAP-120 | exact n=11 pair-distance dispersion remained one ULP low on the predecessor translated floating path | `verification-pending` | RED `967e1e09...` + causal repair `59c5a4ef...` extends only the bounded proof through `n=11` + CHANGELOG `2e9c6a54...` + research/current #488 `478a28bf...`; permutations/sign mirrors fixed at `0x41a4_47fc_a451_7b3f`; hosted exact-head GREEN/review/main integration pending. | +| GAP-120 | exact n=11 pair-distance dispersion remained one ULP low on the predecessor translated floating path | `verification-pending` | RED `967e1e09...` + causal repair `59c5a4ef...` extends only the bounded proof through `n=11` + CHANGELOG `2e9c6a54...`; inherited by #488. | +| GAP-121 | exact n=12 pair-distance dispersion remained one ULP high on the predecessor translated floating path | `verification-pending` | RED `b6ac1117...` + causal repair `035cf392...` extends only the bounded proof through `n=12`; CHANGELOG/research doctoring restored by `05e97b3a...`; permutations/sign mirrors fixed at `0x41a6_5ddb_5161_045f`. | +| GAP-122 | exact n=13 pair-distance dispersion remained one ULP high on the predecessor translated floating path | `verification-pending` | RED `369af46d...` + causal repair `0b8727e7...` extends only the bounded proof through `n=13`; CHANGELOG/research doctoring restored by `05e97b3a...`; permutations/sign mirrors fixed at `0x41a2_9a8e_6db8_cb76`. | +| GAP-123 | exact n=14 pair-distance dispersion remained one ULP low on the predecessor translated floating path | `verification-pending` | RED `db403976...` + causal repair `58efe80d...` extends only the bounded proof through `n=14` + CHANGELOG/research/current #488 `05e97b3a...`; permutations/sign mirrors fixed at `0x41a2_3df9_5954_fb0b`; hosted exact-head GREEN/review/main integration pending. | ## Release gate From ca42bf2390e0eb8b517dee9110ca4e97ad76d5e3 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sun, 6 Sep 2026 02:09:53 +0900 Subject: [PATCH 216/235] docs(ddd): advance Validation Evidence baseline through GAP-124 --- docs/product-technical-gap-baseline.md | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 8a6455d3a..35bb4f305 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-05T17:02:35Z +**Snapshot:** 2026-09-05T17:08:59Z **Protected-main evidence:** `a243f18da4a4ca8a8d068c39922537f1f8ed6ad0` **Workspace version:** `0.2.0` @@ -30,7 +30,7 @@ Passing, queued, skipped, or predecessor-head Checks on an open PR never promote | PR | Exact current head | Draft | Base | Disposition | | ---: | --- | :---: | --- | --- | -| #488 | `05e97b3ad2f5ad2b64dd4922c68b28752a13af47` | true | `main` | Validation Evidence landing vehicle on protected #490. GAP-121–123 restore doctoring for demonstrated exact `n=12..14` pair-distance radicands; the bounded checked midpoint proof now extends only through `n=14`, while `n=15` remains fallback. Exact-head hosted jobs are queued and independent review is absent. | +| #488 | `93f0ea9d945ce0a19fd7f06c0b90bd5b41c8b1fa` | true | `main` | Validation Evidence landing vehicle on protected #490. GAP-121–124 restore/extend demonstrated exact `n=12..15` pair-distance radicands; the bounded checked midpoint proof now extends only through `n=15`, while `n=16` remains fallback. Fresh exact-head hosted gates and independent review remain required. | | #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 | Validation / Analysis Run fold child; unique evidence must be inherited by a conflict-resolving survivor and child-head CI does not transfer. | | #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | | #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | @@ -58,7 +58,7 @@ The clock contract separates event/valid time, assertion time, document time, sy - A nominal unit identifier is not repeated-measures evidence; singleton units cannot satisfy a longitudinal multilevel floor. Stable `Between` known truth is unit-level with canonical `occasion_index = 0`; `Within` retains actual `(unit, occasion)` identity. - Row arrival order is not scientific evidence. Fixed admitted observations must produce bit-identical results under permutation wherever the deterministic CPU `f64` contract claims it. - A representable final scientific estimand is not rejected solely because an avoidable intermediate binary64 operation overflows/underflows. False exact endpoints, erased finite bounds, cancellation residues, and avoidable double-rounding are repair findings. -- Mean signed bias and bias SE are TEPP Validation Evidence performance measures. For `n=2`, the exact represented residual-difference identity remains authoritative. For `n=3`, proved two-level/rational-square identities and translated-residual rules from GAP-092–110 remain inherited. For exact represented residuals with `n=4..=14`, GAP-111–123 admit `SE(mean)^2 = Σ_{i2` claim. +- Mean signed bias and bias SE are TEPP Validation Evidence performance measures. For `n=2`, the exact represented residual-difference identity remains authoritative. For `n=3`, proved two-level/rational-square identities and translated-residual rules from GAP-092–110 remain inherited. For exact represented residuals with `n=4..=15`, GAP-111–124 admit `SE(mean)^2 = Σ_{i2` claim. - Generic Validation Evidence RMSE, Monte Carlo, Wilson, SE-aware acceptance, matching, durable evidence/provenance, serde and human projection retain their GAP-045–091 contracts. Scientific failures are never hidden with skip/xfail/source rewriting/coverage exclusions. - Historical-cutoff admission occurs before duplicate-identity checks. Future-unavailable evidence cannot change an earlier run's conflicts, counts, or terminal state. - Supported temporal estimators require state/trajectory and claimed-structure recovery, bias/RMSE, interval coverage, convergence, uncertainty calibration, reproducibility, and leakage-safe rolling-origin evidence. CPU/GPU parity counts only when the relevant accelerator path actually runs. @@ -67,9 +67,11 @@ The clock contract separates event/valid time, assertion time, document time, sy ### #488 — Validation Evidence -#488 is the generic Validation Evidence landing vehicle at exact head `05e97b3ad2f5ad2b64dd4922c68b28752a13af47`, based on protected #490. GAP-121 RED `b6ac111731a53b5d8d67d0222292542617432478` and repair `035cf392b5e9f115c7b5a2589ebbeadb311d7a45` cover the demonstrated twelve-observation one-ULP-high fallback (`N=55761699077165681660`, denominator `1584`, gcd `4`, correctly rounded `0x41a6_5ddb_5161_045f`). GAP-122 RED `369af46de7e0719cfb4db04fedf4d2775e04f62c` and repair `0b8727e7550022ad5f89b2e5b48129f5b2f520eb` cover thirteen observations (`N=49391029335804262120`, denominator `2028`, gcd `4`, correctly rounded `0x41a2_9a8e_6db8_cb76`). GAP-123 RED `db40397603e2514cf3be25783dc65018aab64f10` and causal repair `58efe80da3c4a57e2b69860f5d4178894f769420` cover fourteen observations (`N=59666178422422564725`, denominator `2548`, gcd `1`): the translated floating moment/`sqrt` fallback returns adjacent lower `0x41a2_3df9_5954_fb0a`, while the exact midpoint proof returns `0x41a2_3df9_5954_fb0b`. +#488 is the generic Validation Evidence landing vehicle at exact head `93f0ea9d945ce0a19fd7f06c0b90bd5b41c8b1fa`, based on protected #490. GAP-121 RED `b6ac111731a53b5d8d67d0222292542617432478` and repair `035cf392b5e9f115c7b5a2589ebbeadb311d7a45` cover twelve observations; GAP-122 RED `369af46de7e0719cfb4db04fedf4d2775e04f62c` and repair `0b8727e7550022ad5f89b2e5b48129f5b2f520eb` cover thirteen; GAP-123 RED `db40397603e2514cf3be25783dc65018aab64f10` and repair `58efe80da3c4a57e2b69860f5d4178894f769420` cover fourteen. Their exact algebra and doctoring are carried by ancestor `05e97b3ad2f5ad2b64dd4922c68b28752a13af47`. -The causal source change only advances the existing bounded admission to `n=4..=14`; residual/pairwise exactness, checked dyadic/`u128` construction, `n²(n-1)` denominator, GCD reduction, exact candidate/adjacent-midpoint comparison, and fail-closed fallback remain mandatory. Doctoring commit `05e97b3ad2f5ad2b64dd4922c68b28752a13af47` adds GAP-121/122/123 CHANGELOG entries and `docs/research/validation-bias-standard-error-twelve-through-fourteen-observation-pair-distance.md`. GAP-120 and all earlier source/test/fixture/contract/ADR histories remain inherited. Exact-head Rust, documentation, security/SAST and independent review evidence are still pending; `mergeable=true` is not GREEN. +GAP-124 RED `1c8a7cedd4ff846d3f3ab226cb4fa25b79650c58` uses exact fifteen-observation residuals `[224611356,291740781,326373353,461196594,686313913,812468689,889538573,1089098727,1093012981,1094199400,1387143595,1412604591,1556072759,1847457618,1990087657]`. The 105 exact squared pair distances sum to `65163338527647814596`; denominator `15²×14=3150`; gcd `18`; reduced radicand `3620185473758211922/175`. The predecessor translated floating moment/`sqrt` fallback returns adjacent lower `0x41a1_254f_de99_720c`, while exact midpoint comparison returns `0x41a1_254f_de99_720d`. Causal repair `3cc041ee1aa5f9871619c483059f5930a056f41a` advances only the existing admission to `n=4..=15`; current CHANGELOG/research/TRACEABILITY head is `93f0ea9d945ce0a19fd7f06c0b90bd5b41c8b1fa`. + +Residual/pairwise exactness, checked dyadic/`u128` construction, `n²(n-1)` denominator, GCD reduction, exact candidate/adjacent-midpoint comparison, and fail-closed fallback remain mandatory. GAP-120 and all earlier source/test/fixture/contract/ADR histories remain inherited. Fresh exact-head Rust, documentation, security/SAST and independent review evidence are still required; `mergeable=true` is not GREEN. ### #310, #416, #480 @@ -114,7 +116,8 @@ GAP-001–GAP-044 retain their existing domain/release identities and exact sour | GAP-120 | exact n=11 pair-distance dispersion remained one ULP low on the predecessor translated floating path | `verification-pending` | RED `967e1e09...` + causal repair `59c5a4ef...` extends only the bounded proof through `n=11` + CHANGELOG `2e9c6a54...`; inherited by #488. | | GAP-121 | exact n=12 pair-distance dispersion remained one ULP high on the predecessor translated floating path | `verification-pending` | RED `b6ac1117...` + causal repair `035cf392...` extends only the bounded proof through `n=12`; CHANGELOG/research doctoring restored by `05e97b3a...`; permutations/sign mirrors fixed at `0x41a6_5ddb_5161_045f`. | | GAP-122 | exact n=13 pair-distance dispersion remained one ULP high on the predecessor translated floating path | `verification-pending` | RED `369af46d...` + causal repair `0b8727e7...` extends only the bounded proof through `n=13`; CHANGELOG/research doctoring restored by `05e97b3a...`; permutations/sign mirrors fixed at `0x41a2_9a8e_6db8_cb76`. | -| GAP-123 | exact n=14 pair-distance dispersion remained one ULP low on the predecessor translated floating path | `verification-pending` | RED `db403976...` + causal repair `58efe80d...` extends only the bounded proof through `n=14` + CHANGELOG/research/current #488 `05e97b3a...`; permutations/sign mirrors fixed at `0x41a2_3df9_5954_fb0b`; hosted exact-head GREEN/review/main integration pending. | +| GAP-123 | exact n=14 pair-distance dispersion remained one ULP low on the predecessor translated floating path | `verification-pending` | RED `db403976...` + causal repair `58efe80d...` extends only the bounded proof through `n=14` + CHANGELOG/research ancestor `05e97b3a...`; permutations/sign mirrors fixed at `0x41a2_3df9_5954_fb0b`; inherited. | +| GAP-124 | exact n=15 pair-distance dispersion remained one ULP low on the predecessor translated floating path | `verification-pending` | RED `1c8a7ced...` + causal repair `3cc041ee...` extends only the bounded proof through `n=15` + CHANGELOG/research/current #488 `93f0ea9d...`; permutations/sign mirrors fixed at `0x41a1_254f_de99_720d`; hosted exact-head GREEN/review/main integration pending. | ## Release gate From a1364be3c97eb6c5c1d7337a579d70378798e691 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sun, 6 Sep 2026 02:36:26 +0900 Subject: [PATCH 217/235] docs(ddd): refresh validation exact-proof budget baseline --- docs/product-technical-gap-baseline.md | 115 +++++++++---------------- 1 file changed, 40 insertions(+), 75 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 35bb4f305..3cf0eb5ec 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,122 +2,87 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-05T17:08:59Z +**Snapshot:** 2026-09-05T17:35:00Z **Protected-main evidence:** `a243f18da4a4ca8a8d068c39922537f1f8ed6ad0` **Workspace version:** `0.2.0` -**Delivery authority:** issue [#175](https://github.com/ContextualWisdomLab/TEPP/issues/175), PR [#435](https://github.com/ContextualWisdomLab/TEPP/pull/435), and [`docs/delivery/pr-queue-authority-2026-09-01.md`](delivery/pr-queue-authority-2026-09-01.md). Historical exact source/test/fixture/contract/ADR evidence remains in repository ancestry, `docs/research/`, `docs/TRACEABILITY.md`, and the surviving landing vehicles; this live register is an operator-oriented current-state index rather than a second copy of every predecessor narrative. +**Delivery authority:** issue [#175](https://github.com/ContextualWisdomLab/TEPP/issues/175), PR [#435](https://github.com/ContextualWisdomLab/TEPP/pull/435), and [`docs/delivery/pr-queue-authority-2026-09-01.md`](delivery/pr-queue-authority-2026-09-01.md). Historical exact source/test/fixture/contract/ADR evidence remains in repository ancestry, `docs/research/`, `docs/TRACEABILITY.md`, and the surviving landing vehicles. This file is the current operator register, not a second copy of every predecessor narrative. ## Delivery truth -A planning document, mergeable branch, local/source inspection, predecessor-head result, queued/skipped check, ADR number, or LLM judgment does not make a capability shipped. Only protected-main integration plus current required evidence establishes delivery. +A planning document, mergeable branch, local/source inspection, predecessor-head result, queued/skipped check, ADR number, bot status, or LLM judgment does not make a capability shipped. Only protected-main integration plus current required evidence establishes delivery. | Signal | Fresh evidence | Delivery implication | | --- | ---: | --- | -| Protected `main` | `a243f18da4a4ca8a8d068c39922537f1f8ed6ad0` | #490 remains integrated; capability claims are bounded to this signed protected head until main advances. | +| Protected `main` | `a243f18da4a4ca8a8d068c39922537f1f8ed6ad0` | #490 remains integrated; product claims are bounded to this protected head until main advances. | | Open pull requests | **134** | WIP circuit breaker remains active; consolidate into existing bounded-context vehicles. | -| Draft pull requests | **134** | Every current open PR is Draft. | -| Non-Draft pull requests | **0** | No PR is eligible for normal merge until deliberately made Ready after exact-head evidence. | -| Open issues | **16** | ADR normalization, orchestration admission, evaluation drift, and scientific recovery remain open. | -| GitHub releases | **0** | No TEPP open head is a released contract. | -| Organization ruleset | `18156473` | One approval, stale-review dismissal after push, resolved threads, extra approval for unattributed changes, and central required workflows remain delivery gates. | +| Draft pull requests | **134** | Every open PR is Draft. | +| Non-Draft pull requests | **0** | No PR is normal-merge eligible. | +| Open issues | **17** | #491 now tracks systemic Validation Evidence exact-proof budgeting in addition to the existing architecture/release/scientific work. | +| TEPP GitHub releases | **0** | No open TEPP head is a released contract. | +| Organization ruleset | `18156473` | Current required workflows, review/thread requirements, stale-review handling, and non-fast-forward prohibition remain delivery gates. | -Passing, queued, skipped, or predecessor-head Checks on an open PR never promote that PR to implemented-main. Organization-admin bypass is not normal delivery evidence and is not used by this writer. +Passing, queued, skipped, or predecessor-head checks on an open PR never promote that PR to implemented-main. Organization-admin bypass is not normal delivery evidence. ## Current priority open pull-request evidence #435 intentionally omits its own mutable branch SHA from this file. -| PR | Exact current head | Draft | Base | Disposition | -| ---: | --- | :---: | --- | --- | -| #488 | `93f0ea9d945ce0a19fd7f06c0b90bd5b41c8b1fa` | true | `main` | Validation Evidence landing vehicle on protected #490. GAP-121–124 restore/extend demonstrated exact `n=12..15` pair-distance radicands; the bounded checked midpoint proof now extends only through `n=15`, while `n=16` remains fallback. Fresh exact-head hosted gates and independent review remain required. | -| #487 | `e07b2ff9f78ef456ff911b8643710af20921fe54` | true | #416 | Validation / Analysis Run fold child; unique evidence must be inherited by a conflict-resolving survivor and child-head CI does not transfer. | -| #485 | `f71591864efc2beff336ced7ef35d5a013305c36` | true | #416 | Analysis Run fold child; preserve support-edge source/tests/doctoring. | -| #484 | `9a1be78b5342ff65e3cf2aac1e9331c68943f246` | true | #416 | Analysis Run fold child; preserve summarizes-edge source/tests/doctoring. | -| #483 | `847d96f913bb261803ac0bd751ad7e4f51324cee` | true | #416 | Analysis Run fold child; preserve unique evidence. | -| #482 | `506dbae236a4484301b704b6c6a05b20faf0fe69` | true | #416 | Analysis Run fold child; preserve unique evidence. | -| #480 | `5b2637f7b6142573ba1385a652c56632ecc9faa5` | true | `main` | Released contextual-orchestrator boundary repair vehicle; mutable owner main remains evidence only and branch still needs non-force inheritance of #489/#490. | -| #460 | `dfab4eab5ff733731e565a9348072b8dab2e4912` | true | #416 | Analysis Run fold child; typed cutoff equality and terminal-validation separation. | -| #458 | `08165e3b3c929b4ae77396689549f72723ff8ff5` | true | #416 | Analysis Run fold child; typed cutoff equality and terminal-validation separation. | -| #416 | `aa730c63563eb4a33048d822b581036c8487bd47` | true | `main` | Validation / Analysis Run landing vehicle; generic cutoff-before-identity repair remains inherited and branch requires non-destructive #489/#490 consolidation. | -| #310 | `c6680450152b1e0a2c9abb553772d74a23923335` | true | `main` | Longitudinal Modeling vehicle; stable `Between` recovery is unit-level with canonical occasion `0`, `Within` retains actual occasion identity, and wrong-base restack remains a repair finding. | +| PR / issue | Exact current evidence | Disposition | +| --- | --- | --- | +| #488 | `757fb0e4770b24f73f301b336adfcf7f656dcea5`, Draft, base `main` | Validation Evidence landing vehicle on protected #490. GAP-125 extends the bounded exact pair-distance proof through `n=16`. Current #491 characterization proves the failure class continues at `n=17`, compares O(n²) and O(n) exact numerator identities, and leaves production admission unchanged pending measured resource evidence. | +| #491 | open | Replace the sample-count staircase with a measured exact-proof budget. Requires reproducible CPU/allocation evidence, checked-`u128` envelope, O(n²)/O(n)/wider-reference comparison, realistic scientific fixtures, exact-head gates, and applicable buyer-path p95 evidence. | +| #416 | `aa730c63563eb4a33048d822b581036c8487bd47`, Draft | Validation / Analysis Run landing vehicle. Generic cutoff-before-identity repair remains inherited; fold children keep unique source/tests/doctoring until conflict-resolving inheritance is verified. | +| #310 | `c6680450152b1e0a2c9abb553772d74a23923335`, Draft | Longitudinal Modeling vehicle. Stable `Between` recovery is unit-level with canonical occasion `0`; `Within` retains actual occasion identity. Older base remains a non-destructive restack finding. | +| #480 | `5b2637f7b6142573ba1385a652c56632ecc9faa5`, Draft | contextual-orchestrator released-contract fail-closed integration vehicle. Mutable owner main remains evidence only. | Exact-head evidence becomes stale after any source push. ## Domain ownership -TEPP owns temporal/event composition, irregular time, time-varying multilevel/cross-classified/multiple-membership semantics, longitudinal invariance/drift/alignment, leakage-safe knowledge cutoff, temporal recovery, Validation Evidence, and Projection policy. `longitudinal_modeling` is the bounded context and `longitudinal_core` is its current Rust implementation path. +TEPP owns Temporal Semantics, Event Ontology, Temporal Graph composition, irregular event time, time-varying multilevel/cross-classified/multiple-membership semantics, Longitudinal Modeling, leakage-safe knowledge cutoff, temporal recovery, Validation Evidence, and Projection policy. `longitudinal_core` is the current Rust implementation path for Longitudinal Modeling. -fast-mlsirm owns reusable static/generalized-mixed/dependence-aware psychometric specification and arithmetic. TEPP consumes only immutable released/versioned contracts through an ACL; source copying and mutable sibling-head dependencies are prohibited. contextual-orchestrator owns provider/model routing and semantic LLM execution; TEPP requires an immutable released compatible contract and uses `orchestrator/free` for model-backed Actions. Context Graph contracts are contract-only integration authority; EA Core owns enterprise-architecture decisions. No cross-service SQL. +fast-mlsirm owns reusable static/generalized-mixed/dependence-aware psychometric specification and arithmetic. TEPP consumes only immutable released/versioned contracts through an ACL; source copying and mutable sibling-head dependencies are prohibited. contextual-orchestrator owns provider/model routing and semantic LLM execution; TEPP requires an immutable released compatible contract and uses `orchestrator/free` for model-backed Actions. Context Graph contracts remain contract-only integration authority, EA Core owns enterprise-architecture decisions, and cross-service SQL is prohibited. The clock contract separates event/valid time, assertion time, document time, system time, availability time, and knowledge cutoff. Retrospective evidence may describe an earlier event but cannot enter an earlier knowledge cutoff. Forward state/transition edges remain distinct from retrospective/citation/revision/provenance relations. ## Scientific invariants - Rasch remains distinct from generic 1PL; formulation-qualified 2PLM–5PLM, MIRT, ideal-point/GGUM, testlet/rater/facet/generalized-mixed identity is preserved. -- A nominal unit identifier is not repeated-measures evidence; singleton units cannot satisfy a longitudinal multilevel floor. Stable `Between` known truth is unit-level with canonical `occasion_index = 0`; `Within` retains actual `(unit, occasion)` identity. +- A nominal unit identifier is not repeated-measures evidence. Stable `Between` known truth is unit-level with canonical `occasion_index = 0`; `Within` retains actual `(unit, occasion)` identity. - Row arrival order is not scientific evidence. Fixed admitted observations must produce bit-identical results under permutation wherever the deterministic CPU `f64` contract claims it. -- A representable final scientific estimand is not rejected solely because an avoidable intermediate binary64 operation overflows/underflows. False exact endpoints, erased finite bounds, cancellation residues, and avoidable double-rounding are repair findings. -- Mean signed bias and bias SE are TEPP Validation Evidence performance measures. For `n=2`, the exact represented residual-difference identity remains authoritative. For `n=3`, proved two-level/rational-square identities and translated-residual rules from GAP-092–110 remain inherited. For exact represented residuals with `n=4..=15`, GAP-111–124 admit `SE(mean)^2 = Σ_{i2` claim. -- Generic Validation Evidence RMSE, Monte Carlo, Wilson, SE-aware acceptance, matching, durable evidence/provenance, serde and human projection retain their GAP-045–091 contracts. Scientific failures are never hidden with skip/xfail/source rewriting/coverage exclusions. +- A representable final estimand is not rejected solely because an avoidable intermediate binary64 operation overflows/underflows. False exact endpoints, erased finite bounds, cancellation residues, and avoidable double-rounding are repair findings. +- Mean signed bias and bias SE are TEPP Validation Evidence performance measures. `n=2` and proved `n=3` identities remain inherited from GAP-092–110. For exact represented residuals with `n=4..=16`, GAP-111–125 admit `SE(mean)^2 = Σ_{i2` claim. +- The `n=16` cutoff is an implementation/resource boundary, not a scientific boundary. #491 evidence demonstrates an exact `n=17` counterexample and an algebraically equivalent O(n) pair-square numerator. Production admission remains `n<=16` until release-mode CPU/allocation and applicable buyer-path p95 evidence establish a budget. +- Generic Validation Evidence RMSE, Monte Carlo, Wilson, SE-aware acceptance, matching, durable evidence/provenance, serde and human projection retain GAP-045–091 contracts. Scientific failures are never hidden with skip/xfail/source rewriting/coverage exclusions. - Historical-cutoff admission occurs before duplicate-identity checks. Future-unavailable evidence cannot change an earlier run's conflicts, counts, or terminal state. - Supported temporal estimators require state/trajectory and claimed-structure recovery, bias/RMSE, interval coverage, convergence, uncertainty calibration, reproducibility, and leakage-safe rolling-origin evidence. CPU/GPU parity counts only when the relevant accelerator path actually runs. -## Current repairs and blockers +## Current Validation Evidence repair and resource finding -### #488 — Validation Evidence +#488 exact head `757fb0e4770b24f73f301b336adfcf7f656dcea5` inherits the full GAP-045–124 source/test/fixture/contract lineage and GAP-125's sixteen-observation repair. -#488 is the generic Validation Evidence landing vehicle at exact head `93f0ea9d945ce0a19fd7f06c0b90bd5b41c8b1fa`, based on protected #490. GAP-121 RED `b6ac111731a53b5d8d67d0222292542617432478` and repair `035cf392b5e9f115c7b5a2589ebbeadb311d7a45` cover twelve observations; GAP-122 RED `369af46de7e0719cfb4db04fedf4d2775e04f62c` and repair `0b8727e7550022ad5f89b2e5b48129f5b2f520eb` cover thirteen; GAP-123 RED `db40397603e2514cf3be25783dc65018aab64f10` and repair `58efe80da3c4a57e2b69860f5d4178894f769420` cover fourteen. Their exact algebra and doctoring are carried by ancestor `05e97b3ad2f5ad2b64dd4922c68b28752a13af47`. +GAP-125 public RED `5da82b2d651706c191ca191c6c077d916cbfda25` uses exact represented residuals `[314270929,327661307,371854441,398522837,413483290,416184956,565808551,682627163,724514517,731058943,740662035,970233120,1141566755,1320628283,1526331271,1992574092]`. Its 120 exact squared pair distances sum to `56_762_922_330_032_131_548`; denominator `16²×15=3_840`; gcd `12`; reduced radicand `4_730_243_527_502_677_629/320`. The predecessor translated floating moment/`sqrt` fallback returns adjacent lower `0x419c_fcbb_b78d_2ad4`, while exact midpoint comparison returns `0x419c_fcbb_b78d_2ad5`. Causal repair `a509ae9e46c8ffc2cc3ef4f0e904774ad2516e1f` advances only the existing bounded proof to `n=4..=16`. -GAP-124 RED `1c8a7cedd4ff846d3f3ab226cb4fa25b79650c58` uses exact fifteen-observation residuals `[224611356,291740781,326373353,461196594,686313913,812468689,889538573,1089098727,1093012981,1094199400,1387143595,1412604591,1556072759,1847457618,1990087657]`. The 105 exact squared pair distances sum to `65163338527647814596`; denominator `15²×14=3150`; gcd `18`; reduced radicand `3620185473758211922/175`. The predecessor translated floating moment/`sqrt` fallback returns adjacent lower `0x41a1_254f_de99_720c`, while exact midpoint comparison returns `0x41a1_254f_de99_720d`. Causal repair `3cc041ee1aa5f9871619c483059f5930a056f41a` advances only the existing admission to `n=4..=15`; current CHANGELOG/research/TRACEABILITY head is `93f0ea9d945ce0a19fd7f06c0b90bd5b41c8b1fa`. +Issue #491 characterization commit `757fb0e4770b24f73f301b336adfcf7f656dcea5` adds an exactly represented `n=17` fixture `[38557579,48779805,63558649,106352599,139863777,142786819,267163239,275103292,375678558,454709869,484300224,623646610,989643121,1027595814,1520220488,1569903156,1805452085]`. Its 136 exact pair squares sum to `92_549_865_125_191_410_206`; denominator `4_624`; gcd `2`; reduced radicand `46_274_932_562_595_705_103/2_312`. Current fallback returns `0x41a0_dd77_9ac3_8e98`; exact-rational evaluation gives adjacent `0x41a0_dd77_9ac3_8e99`. -Residual/pairwise exactness, checked dyadic/`u128` construction, `n²(n-1)` denominator, GCD reduction, exact candidate/adjacent-midpoint comparison, and fail-closed fallback remain mandatory. GAP-120 and all earlier source/test/fixture/contract/ADR histories remain inherited. Fresh exact-head Rust, documentation, security/SAST and independent review evidence are still required; `mergeable=true` is not GREEN. +The same commit adds `crates/validation_core/tests/bias_standard_error_exact_proof_budget_characterization.rs`, which verifies that the O(n²) pair-distance sum equals `n*Σc_i²-(Σc_i)²` exactly on the n=17 fixture and fixes a compact-dyadic checked-`u128` worst-case envelope: for aligned diameter `D<=2^53`, `n²D²` fits through `n=2047` and reaches the unrepresentable `2^128` bound at `n=2048`. This arithmetic ceiling is not a production budget. -### #310, #416, #480 +`crates/validation_core/examples/bias_se_exact_proof_budget.rs` supplies a standard-library timing harness for the quadratic and linear checked-integer kernels at 16, 64, 256, 1024, and 2047 observations. It emits kernel p95 timing rows and checks algebraic equality before timing. No release-mode result is recorded yet. `docs/research/validation-bias-standard-error-exact-proof-budget.md` also records that the current pair-record allocation count is exactly `n(n-1)/2` and distinguishes a semantics-preserving two-pass O(n²) allocation-removal option from a stronger sufficient-admission O(n) path. -#310 remains Longitudinal Modeling authority at `c6680450152b1e0a2c9abb553772d74a23923335`; its older base is a non-force restack finding. #416 remains Validation/Analysis Run consolidation at `aa730c63563eb4a33048d822b581036c8487bd47`; children #458/#460/#482/#483/#484/#485/#487 remain open until unique evidence is inherited. #480 remains the owner-correct contextual-orchestrator fail-closed integration vehicle and must not consume mutable owner main. +The next source decision must be based on measured evidence, not the next integer sample count. Required evidence: release-mode CPU and allocation/layout results on a recorded toolchain/CPU; comparison of the O(n) sufficient-admission accepted/refused set against the existing pairwise proof; a wider-integer/reference alternative assessment; realistic public scientific acceptance fixtures with permutation/sign mirrors; and applicable buyer-path `p95<=20 ms` evidence before widening production admission. ## Gap register -GAP-001–GAP-044 retain their existing domain/release identities and exact source/test/ADR ancestry. GAP-045–GAP-091 retain the established Validation Evidence mean-bias, RMSE/SE, Monte Carlo, Wilson, matching, acceptance, provenance, serde and projection repairs. The current represented-input bias-SE sequence is restated because #488 is its single writer. - -| ID | Gap | Maturity | Closure evidence | -| --- | --- | --- | --- | -| GAP-001–044 | Existing product/domain/DDD/release gaps and Longitudinal repairs | mixed, inherited | Exact histories remain in repository ancestry, surviving landing vehicles, ADRs/tests, and prior research/TRACEABILITY; no source/test/fixture/contract delta is discarded by this live-register compaction. | -| GAP-045–091 | Established Validation Evidence mean-bias, RMSE/SE, Monte Carlo, Wilson, matching, acceptance, provenance/serde/projection repair sequence | `verification-pending` / inherited | Exact histories remain on #488 ancestry and their public tests/research records; protected-main integration still requires exact-head gates and review. | -| GAP-092 | two represented residuals could collapse to false-zero bias SE | `verification-pending` | RED `c9c55ea5...` + n=2 expanded-difference repair `f6d7da96...`; inherited by #488. | -| GAP-093 | n>2 distinct represented residuals could collapse to one rounded high | `verification-pending` | RED `06a70e1c...` + common-high/error-free-low repair `04c62514...`; inherited by #488. | -| GAP-094 | separately rounded square roots could shift bias SE by one ULP | `verification-pending` | corrected RED `62243204...` + direct normalized-SE repair `8b8f0a21...`; inherited by #488. | -| GAP-095 | subtraction roundoff could materially overstate uncertainty | `verification-pending` | RED `ae906ad6...` + exact translated-residual repair `d59b9c30...`; inherited. | -| GAP-096 | exact residuals could be re-centered on a rounded mean | `verification-pending` | RED `9265b34a...` + exact-residual translated repair `2fa266b2...`; inherited. | -| GAP-097 | common-high path could round low-term mean before centering | `verification-pending` | RED `d48e2515...` + exact low-term translated-second-moment repair `a63b8d7a...`; inherited. | -| GAP-098 | non-power normalization could double-round exact translated bias SE | `verification-pending` | RED `426fc5af...` + dyadic-scale prerequisite `d8b411f5...` + causal repair `d536e3b1...`; inherited. | -| GAP-099 | exact n=3 two-level bias SE could re-round an exact gap | `verification-pending` | RED `fbcdb7fa...` + causal repair `e0f2445d...`; inherited. | -| GAP-100 | exact two-level singleton geometry remained wrong beyond n=3 | `verification-pending` | RED `4386d9ac...` + causal repair `79ad03fa...`; inherited. | -| GAP-101 | exact n=2 residuals could be re-centered on rounded midpoint mean | `verification-pending` | RED `d3dcd918...` + causal repair `02b0a178...`; inherited. | -| GAP-102 | non-singleton two-level dyadic count identity could be re-rounded | `verification-pending` | RED `3bc43da2...` + causal repair `77ba1002...`; inherited. | -| GAP-103 | reciprocal-integer non-power-of-two count factor could be re-rounded | `verification-pending` | RED `d793f7f9...` + causal repair `0a4bfcd5...`; inherited. | -| GAP-104 | non-unit rational-square count factor could be re-rounded | `verification-pending` | RED `6dc8116c...` + causal repair `8f2803c8...`; inherited. | -| GAP-105 | exact rational-square result could double-round into subnormal range | `verification-pending` | RED `8b7995d2...` + causal repair `ab0f0df1...`; inherited. | -| GAP-106 | numerical path depended on first-observation anchor | `verification-pending` | RED `5cb45a4f...` + causal repair `159659a9...`; permutation/sign-mirror contract inherited. | -| GAP-107 | several exact anchors had different conditioning | `verification-pending` | RED `49343ab6...` + causal repair `0fc3ea97...`; conditioning contract inherited. | -| GAP-108 | exact n=3 three-level rational-square dispersion re-rounded through moments | `verification-pending` | RED `32dcab84...` + causal repair `bee85e3d...`; all-permutation/sign-mirror contract inherited. | -| GAP-109 | exact dyadic scale overflow could reject the same n=3 proof | `verification-pending` | RED `67fa4852...` + causal repair `dcaf25b3...`; inherited. | -| GAP-110 | nonzero raw product underflow could be mistaken for exact zero | `verification-pending` | RED `fe013e7d...` + causal repair `d3660d44...`; inherited. | -| GAP-111 | exact n=4 pair-distance radicand was rounded before `sqrt` | `verification-pending` | RED `978c422c...` + bounded pair-distance/midpoint repair lineage `3de7a737...` → `c8032493...`; inherited. | -| GAP-112 | unreduced n=4 rational could select a different bounded path | `verification-pending` | RED `4f223135...` + causal GCD-reduction repair `ed1a8763...`; inherited. | -| GAP-113 | exact reduced `u128` numerator above `2^53` was unnecessarily rejected | `verification-pending` | RED `50153a1c...` + causal repair `dbf6b409...`; inherited. | -| GAP-114 | exact n=5 pair-distance dispersion remained one ULP wrong | `verification-pending` | RED `5878ec10...` + causal repair `41298270...`; inherited. | -| GAP-115 | exact n=6 pair-distance dispersion remained one ULP wrong | `verification-pending` | RED `cb07b89b...` + causal repair `8e194dc1...`; inherited. | -| GAP-116 | exact n=7 pair-distance dispersion remained one ULP wrong | `verification-pending` | RED `a1de7ae9...` + causal repair `2907e468...` + CHANGELOG `78d5ed3f...` + research ancestor `4efe2421...`; inherited. | -| GAP-117 | exact n=8 pair-distance dispersion remained one ULP high on the predecessor translated floating path | `verification-pending` | RED `40413dc9...` + causal repair `26ca2d68...` extends only the bounded proof through `n=8` + CHANGELOG `2641b261...` + research ancestor `52fa2c87...`; permutations/sign mirrors fixed at `0x41ac_8601_97ac_cd4c`; inherited. | -| GAP-118 | exact n=9 pair-distance dispersion remained one ULP low on the predecessor translated floating path | `verification-pending` | RED `c7b65377...` + causal repair `bcd2ab5e...` extends only the bounded proof through `n=9` + CHANGELOG `f575fa21...` + research ancestor `c76f0021...`; permutations/sign mirrors fixed at `0x41a7_5f1f_6489_5d36`; inherited by #488. | -| GAP-119 | exact n=10 pair-distance dispersion remained one ULP low on the predecessor translated floating path | `verification-pending` | RED `813c97e8...` + causal repair `1bff5033...` extends only the bounded proof through `n=10` + CHANGELOG `2dacce55...` + research ancestor `bf32b509...`; permutations/sign mirrors fixed at `0x41a5_e8a1_0795_bf6c`; inherited by #488. | -| GAP-120 | exact n=11 pair-distance dispersion remained one ULP low on the predecessor translated floating path | `verification-pending` | RED `967e1e09...` + causal repair `59c5a4ef...` extends only the bounded proof through `n=11` + CHANGELOG `2e9c6a54...`; inherited by #488. | -| GAP-121 | exact n=12 pair-distance dispersion remained one ULP high on the predecessor translated floating path | `verification-pending` | RED `b6ac1117...` + causal repair `035cf392...` extends only the bounded proof through `n=12`; CHANGELOG/research doctoring restored by `05e97b3a...`; permutations/sign mirrors fixed at `0x41a6_5ddb_5161_045f`. | -| GAP-122 | exact n=13 pair-distance dispersion remained one ULP high on the predecessor translated floating path | `verification-pending` | RED `369af46d...` + causal repair `0b8727e7...` extends only the bounded proof through `n=13`; CHANGELOG/research doctoring restored by `05e97b3a...`; permutations/sign mirrors fixed at `0x41a2_9a8e_6db8_cb76`. | -| GAP-123 | exact n=14 pair-distance dispersion remained one ULP low on the predecessor translated floating path | `verification-pending` | RED `db403976...` + causal repair `58efe80d...` extends only the bounded proof through `n=14` + CHANGELOG/research ancestor `05e97b3a...`; permutations/sign mirrors fixed at `0x41a2_3df9_5954_fb0b`; inherited. | -| GAP-124 | exact n=15 pair-distance dispersion remained one ULP low on the predecessor translated floating path | `verification-pending` | RED `1c8a7ced...` + causal repair `3cc041ee...` extends only the bounded proof through `n=15` + CHANGELOG/research/current #488 `93f0ea9d...`; permutations/sign mirrors fixed at `0x41a1_254f_de99_720d`; hosted exact-head GREEN/review/main integration pending. | +| ID | Gap / state | Current closure evidence | +| --- | --- | --- | +| GAP-001–044 | Existing product/domain/DDD/release and Longitudinal gaps; mixed/inherited | Exact histories remain in ancestry, surviving landing vehicles, ADRs/tests, and research/TRACEABILITY. | +| GAP-045–091 | Validation Evidence bias, RMSE/SE, Monte Carlo, Wilson, matching, acceptance, provenance/serde/projection repairs; verification pending | Exact source/tests/research remain inherited on #488; protected-main integration still requires current-head gates/review. | +| GAP-092–110 | Represented residual subtraction, translated-moment, rational-scale, anchor, three-level and subnormal correctness sequence; verification pending | Exact RED→repair lineages and public contracts remain inherited on #488. | +| GAP-111–120 | Exact pair-distance/midpoint proof introduced and extended through `n=11`; verification pending | Exact RED→repair/test/research lineages remain inherited. | +| GAP-121–124 | Exact pair-distance proof extended through `n=12..15`; verification pending | REDs `b6ac1117...`, `369af46d...`, `db403976...`, `1c8a7ced...` with causal repairs `035cf392...`, `0b8727e7...`, `58efe80d...`, `3cc041ee...`; doctoring inherited. | +| GAP-125 | Exact `n=16` pair-distance result remained one ULP low on translated fallback; verification pending | RED `5da82b2d...` → repair `a509ae9e...` → CHANGELOG/research `3d2297c6...`; production bounded proof is now `n=4..=16`. | +| #491 | Hard sample-count cutoff is an unmeasured resource budget; open | Characterization `757fb0e4...` proves an n=17 counterexample, O(n²)/O(n) exact numerator equivalence, compact-dyadic `u128` envelope, and adds timing tooling. Production cutoff deliberately unchanged pending measured CPU/allocation/API evidence. | ## Release gate From 550e5afd6c9dd26c1ddb3cee473cae52f547dc9c Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sun, 6 Sep 2026 02:42:15 +0900 Subject: [PATCH 218/235] docs(ddd): follow exact-proof operability head --- docs/product-technical-gap-baseline.md | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 3cf0eb5ec..b08dc49a8 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-05T17:35:00Z +**Snapshot:** 2026-09-05T17:41:00Z **Protected-main evidence:** `a243f18da4a4ca8a8d068c39922537f1f8ed6ad0` **Workspace version:** `0.2.0` @@ -30,7 +30,7 @@ Passing, queued, skipped, or predecessor-head checks on an open PR never promote | PR / issue | Exact current evidence | Disposition | | --- | --- | --- | -| #488 | `757fb0e4770b24f73f301b336adfcf7f656dcea5`, Draft, base `main` | Validation Evidence landing vehicle on protected #490. GAP-125 extends the bounded exact pair-distance proof through `n=16`. Current #491 characterization proves the failure class continues at `n=17`, compares O(n²) and O(n) exact numerator identities, and leaves production admission unchanged pending measured resource evidence. | +| #488 | `d15282fc28038cf05b54f691d3bf72f568482984`, Draft, base `main` | Validation Evidence landing vehicle on protected #490. GAP-125 extends the bounded exact pair-distance proof through `n=16`. #491 characterization proves the failure class continues at `n=17`, compares O(n²) and O(n) exact numerator identities, defines test/operability evidence for resource budgeting, and leaves production admission unchanged pending measured CPU/allocation/API evidence. | | #491 | open | Replace the sample-count staircase with a measured exact-proof budget. Requires reproducible CPU/allocation evidence, checked-`u128` envelope, O(n²)/O(n)/wider-reference comparison, realistic scientific fixtures, exact-head gates, and applicable buyer-path p95 evidence. | | #416 | `aa730c63563eb4a33048d822b581036c8487bd47`, Draft | Validation / Analysis Run landing vehicle. Generic cutoff-before-identity repair remains inherited; fold children keep unique source/tests/doctoring until conflict-resolving inheritance is verified. | | #310 | `c6680450152b1e0a2c9abb553772d74a23923335`, Draft | Longitudinal Modeling vehicle. Stable `Between` recovery is unit-level with canonical occasion `0`; `Within` retains actual occasion identity. Older base remains a non-destructive restack finding. | @@ -60,7 +60,7 @@ The clock contract separates event/valid time, assertion time, document time, sy ## Current Validation Evidence repair and resource finding -#488 exact head `757fb0e4770b24f73f301b336adfcf7f656dcea5` inherits the full GAP-045–124 source/test/fixture/contract lineage and GAP-125's sixteen-observation repair. +#488 exact head `d15282fc28038cf05b54f691d3bf72f568482984` inherits the full GAP-045–124 source/test/fixture/contract lineage and GAP-125's sixteen-observation repair. GAP-125 public RED `5da82b2d651706c191ca191c6c077d916cbfda25` uses exact represented residuals `[314270929,327661307,371854441,398522837,413483290,416184956,565808551,682627163,724514517,731058943,740662035,970233120,1141566755,1320628283,1526331271,1992574092]`. Its 120 exact squared pair distances sum to `56_762_922_330_032_131_548`; denominator `16²×15=3_840`; gcd `12`; reduced radicand `4_730_243_527_502_677_629/320`. The predecessor translated floating moment/`sqrt` fallback returns adjacent lower `0x419c_fcbb_b78d_2ad4`, while exact midpoint comparison returns `0x419c_fcbb_b78d_2ad5`. Causal repair `a509ae9e46c8ffc2cc3ef4f0e904774ad2516e1f` advances only the existing bounded proof to `n=4..=16`. @@ -68,9 +68,11 @@ Issue #491 characterization commit `757fb0e4770b24f73f301b336adfcf7f656dcea5` ad The same commit adds `crates/validation_core/tests/bias_standard_error_exact_proof_budget_characterization.rs`, which verifies that the O(n²) pair-distance sum equals `n*Σc_i²-(Σc_i)²` exactly on the n=17 fixture and fixes a compact-dyadic checked-`u128` worst-case envelope: for aligned diameter `D<=2^53`, `n²D²` fits through `n=2047` and reaches the unrepresentable `2^128` bound at `n=2048`. This arithmetic ceiling is not a production budget. -`crates/validation_core/examples/bias_se_exact_proof_budget.rs` supplies a standard-library timing harness for the quadratic and linear checked-integer kernels at 16, 64, 256, 1024, and 2047 observations. It emits kernel p95 timing rows and checks algebraic equality before timing. No release-mode result is recorded yet. `docs/research/validation-bias-standard-error-exact-proof-budget.md` also records that the current pair-record allocation count is exactly `n(n-1)/2` and distinguishes a semantics-preserving two-pass O(n²) allocation-removal option from a stronger sufficient-admission O(n) path. +`crates/validation_core/examples/bias_se_exact_proof_budget.rs` supplies a standard-library timing harness for the quadratic and linear checked-integer kernels at 16, 64, 256, 1024, and 2047 observations. It emits kernel p95 timing rows and checks algebraic equality before timing. `docs/research/validation-bias-standard-error-exact-proof-budget.md` records the pair-record allocation count `n(n-1)/2` and distinguishes a semantics-preserving two-pass O(n²) allocation-removal option from a stronger sufficient-admission O(n) path. -The next source decision must be based on measured evidence, not the next integer sample count. Required evidence: release-mode CPU and allocation/layout results on a recorded toolchain/CPU; comparison of the O(n) sufficient-admission accepted/refused set against the existing pairwise proof; a wider-integer/reference alternative assessment; realistic public scientific acceptance fixtures with permutation/sign mirrors; and applicable buyer-path `p95<=20 ms` evidence before widening production admission. +Current #488 documentation head `d15282fc28038cf05b54f691d3bf72f568482984` makes the resource contract explicit in `docs/TEST_STRATEGY.md` and `docs/OPERABILITY.md`. Required before widening production admission: release-mode raw timings on a recorded CPU/OS/Rust toolchain; measured allocation/layout; admitted/refused-set comparison between the O(n) sufficient proof and current pairwise proof; checked-`u128` overflow/refusal across sample count and exponent spread; wider-integer/reference assessment; realistic public scientific contracts; and applicable full-path `p95<=20 ms` evidence. + +The next source decision must be based on measured evidence, not the next integer sample count. ## Gap register @@ -82,7 +84,7 @@ The next source decision must be based on measured evidence, not the next intege | GAP-111–120 | Exact pair-distance/midpoint proof introduced and extended through `n=11`; verification pending | Exact RED→repair/test/research lineages remain inherited. | | GAP-121–124 | Exact pair-distance proof extended through `n=12..15`; verification pending | REDs `b6ac1117...`, `369af46d...`, `db403976...`, `1c8a7ced...` with causal repairs `035cf392...`, `0b8727e7...`, `58efe80d...`, `3cc041ee...`; doctoring inherited. | | GAP-125 | Exact `n=16` pair-distance result remained one ULP low on translated fallback; verification pending | RED `5da82b2d...` → repair `a509ae9e...` → CHANGELOG/research `3d2297c6...`; production bounded proof is now `n=4..=16`. | -| #491 | Hard sample-count cutoff is an unmeasured resource budget; open | Characterization `757fb0e4...` proves an n=17 counterexample, O(n²)/O(n) exact numerator equivalence, compact-dyadic `u128` envelope, and adds timing tooling. Production cutoff deliberately unchanged pending measured CPU/allocation/API evidence. | +| #491 | Hard sample-count cutoff is an unmeasured resource budget; open | Characterization `757fb0e4...` proves an n=17 counterexample, O(n²)/O(n) exact numerator equivalence, compact-dyadic `u128` envelope, and timing tooling; docs head `d15282fc...` fixes measurement/operability gates. Production cutoff deliberately unchanged pending measured CPU/allocation/API evidence. | ## Release gate From 2598e990f1e2d68ba33559288bef9b94c32956a0 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sun, 6 Sep 2026 03:03:25 +0900 Subject: [PATCH 219/235] docs(ddd): refresh exact-proof resource baseline --- docs/product-technical-gap-baseline.md | 26 ++++++++++++-------------- 1 file changed, 12 insertions(+), 14 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index b08dc49a8..4fe6e8e61 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-05T17:41:00Z +**Snapshot:** 2026-09-05T18:03:00Z **Protected-main evidence:** `a243f18da4a4ca8a8d068c39922537f1f8ed6ad0` **Workspace version:** `0.2.0` @@ -18,7 +18,7 @@ A planning document, mergeable branch, local/source inspection, predecessor-head | Open pull requests | **134** | WIP circuit breaker remains active; consolidate into existing bounded-context vehicles. | | Draft pull requests | **134** | Every open PR is Draft. | | Non-Draft pull requests | **0** | No PR is normal-merge eligible. | -| Open issues | **17** | #491 now tracks systemic Validation Evidence exact-proof budgeting in addition to the existing architecture/release/scientific work. | +| Open issues | **17** | #491 tracks systemic Validation Evidence exact-proof budgeting in addition to the existing architecture/release/scientific work. | | TEPP GitHub releases | **0** | No open TEPP head is a released contract. | | Organization ruleset | `18156473` | Current required workflows, review/thread requirements, stale-review handling, and non-fast-forward prohibition remain delivery gates. | @@ -30,8 +30,8 @@ Passing, queued, skipped, or predecessor-head checks on an open PR never promote | PR / issue | Exact current evidence | Disposition | | --- | --- | --- | -| #488 | `d15282fc28038cf05b54f691d3bf72f568482984`, Draft, base `main` | Validation Evidence landing vehicle on protected #490. GAP-125 extends the bounded exact pair-distance proof through `n=16`. #491 characterization proves the failure class continues at `n=17`, compares O(n²) and O(n) exact numerator identities, defines test/operability evidence for resource budgeting, and leaves production admission unchanged pending measured CPU/allocation/API evidence. | -| #491 | open | Replace the sample-count staircase with a measured exact-proof budget. Requires reproducible CPU/allocation evidence, checked-`u128` envelope, O(n²)/O(n)/wider-reference comparison, realistic scientific fixtures, exact-head gates, and applicable buyer-path p95 evidence. | +| #488 | `797f7caa557440634038d166ee7098f7c6df5b9d`, Draft, base `main` | Validation Evidence landing vehicle on protected #490. GAP-125 keeps the bounded exact pair-distance proof through `n=16`; #491 now characterizes buffered O(n²), allocation-free two-pass O(n²), and O(n) resource shapes while leaving production admission unchanged pending measured CPU/allocation/API evidence. | +| #491 | open | Replace the sample-count staircase with a measured exact-proof budget. Requires reproducible CPU/allocation evidence, checked-`u128` envelopes, O(n²)/O(n)/wider-reference comparison, realistic scientific fixtures, exact-head gates, and applicable buyer-path p95 evidence. | | #416 | `aa730c63563eb4a33048d822b581036c8487bd47`, Draft | Validation / Analysis Run landing vehicle. Generic cutoff-before-identity repair remains inherited; fold children keep unique source/tests/doctoring until conflict-resolving inheritance is verified. | | #310 | `c6680450152b1e0a2c9abb553772d74a23923335`, Draft | Longitudinal Modeling vehicle. Stable `Between` recovery is unit-level with canonical occasion `0`; `Within` retains actual occasion identity. Older base remains a non-destructive restack finding. | | #480 | `5b2637f7b6142573ba1385a652c56632ecc9faa5`, Draft | contextual-orchestrator released-contract fail-closed integration vehicle. Mutable owner main remains evidence only. | @@ -53,26 +53,24 @@ The clock contract separates event/valid time, assertion time, document time, sy - Row arrival order is not scientific evidence. Fixed admitted observations must produce bit-identical results under permutation wherever the deterministic CPU `f64` contract claims it. - A representable final estimand is not rejected solely because an avoidable intermediate binary64 operation overflows/underflows. False exact endpoints, erased finite bounds, cancellation residues, and avoidable double-rounding are repair findings. - Mean signed bias and bias SE are TEPP Validation Evidence performance measures. `n=2` and proved `n=3` identities remain inherited from GAP-092–110. For exact represented residuals with `n=4..=16`, GAP-111–125 admit `SE(mean)^2 = Σ_{i2` claim. -- The `n=16` cutoff is an implementation/resource boundary, not a scientific boundary. #491 evidence demonstrates an exact `n=17` counterexample and an algebraically equivalent O(n) pair-square numerator. Production admission remains `n<=16` until release-mode CPU/allocation and applicable buyer-path p95 evidence establish a budget. +- The `n=16` cutoff is an implementation/resource boundary, not a scientific boundary. #491 evidence demonstrates an exact `n=17` counterexample and algebraically equivalent O(n) numerator. Resource envelopes are implementation facts, not scientific cutoffs: at aligned diameter `D=2^53`, the characterized minimum-shifted O(n) intermediate fits through `n=2_047`, whereas the exact pair-square numerator extremum fits through `n=4_095`. Production admission remains `n<=16` until release-mode CPU/allocation and applicable buyer-path p95 evidence establish a budget. - Generic Validation Evidence RMSE, Monte Carlo, Wilson, SE-aware acceptance, matching, durable evidence/provenance, serde and human projection retain GAP-045–091 contracts. Scientific failures are never hidden with skip/xfail/source rewriting/coverage exclusions. - Historical-cutoff admission occurs before duplicate-identity checks. Future-unavailable evidence cannot change an earlier run's conflicts, counts, or terminal state. - Supported temporal estimators require state/trajectory and claimed-structure recovery, bias/RMSE, interval coverage, convergence, uncertainty calibration, reproducibility, and leakage-safe rolling-origin evidence. CPU/GPU parity counts only when the relevant accelerator path actually runs. ## Current Validation Evidence repair and resource finding -#488 exact head `d15282fc28038cf05b54f691d3bf72f568482984` inherits the full GAP-045–124 source/test/fixture/contract lineage and GAP-125's sixteen-observation repair. +#488 exact head `797f7caa557440634038d166ee7098f7c6df5b9d` inherits the full GAP-045–124 source/test/fixture/contract lineage and GAP-125's sixteen-observation repair. GAP-125 public RED `5da82b2d651706c191ca191c6c077d916cbfda25` uses exact represented residuals `[314270929,327661307,371854441,398522837,413483290,416184956,565808551,682627163,724514517,731058943,740662035,970233120,1141566755,1320628283,1526331271,1992574092]`. Its 120 exact squared pair distances sum to `56_762_922_330_032_131_548`; denominator `16²×15=3_840`; gcd `12`; reduced radicand `4_730_243_527_502_677_629/320`. The predecessor translated floating moment/`sqrt` fallback returns adjacent lower `0x419c_fcbb_b78d_2ad4`, while exact midpoint comparison returns `0x419c_fcbb_b78d_2ad5`. Causal repair `a509ae9e46c8ffc2cc3ef4f0e904774ad2516e1f` advances only the existing bounded proof to `n=4..=16`. -Issue #491 characterization commit `757fb0e4770b24f73f301b336adfcf7f656dcea5` adds an exactly represented `n=17` fixture `[38557579,48779805,63558649,106352599,139863777,142786819,267163239,275103292,375678558,454709869,484300224,623646610,989643121,1027595814,1520220488,1569903156,1805452085]`. Its 136 exact pair squares sum to `92_549_865_125_191_410_206`; denominator `4_624`; gcd `2`; reduced radicand `46_274_932_562_595_705_103/2_312`. Current fallback returns `0x41a0_dd77_9ac3_8e98`; exact-rational evaluation gives adjacent `0x41a0_dd77_9ac3_8e99`. +Issue #491 characterization `757fb0e4770b24f73f301b336adfcf7f656dcea5` adds an exactly represented `n=17` fixture `[38557579,48779805,63558649,106352599,139863777,142786819,267163239,275103292,375678558,454709869,484300224,623646610,989643121,1027595814,1520220488,1569903156,1805452085]`. Its 136 exact pair squares sum to `92_549_865_125_191_410_206`; denominator `4_624`; gcd `2`; reduced radicand `46_274_932_562_595_705_103/2_312`. Current fallback returns `0x41a0_dd77_9ac3_8e98`; exact-rational evaluation gives adjacent `0x41a0_dd77_9ac3_8e99`. -The same commit adds `crates/validation_core/tests/bias_standard_error_exact_proof_budget_characterization.rs`, which verifies that the O(n²) pair-distance sum equals `n*Σc_i²-(Σc_i)²` exactly on the n=17 fixture and fixes a compact-dyadic checked-`u128` worst-case envelope: for aligned diameter `D<=2^53`, `n²D²` fits through `n=2047` and reaches the unrepresentable `2^128` bound at `n=2048`. This arithmetic ceiling is not a production budget. +The current #491 characterization slice corrects and separates the resource envelopes rather than widening production behavior. Commit `e476d66c99bef7d3e35b6a77374daeaa5fc59959` fixes exact pair counts in the Rust contract: 120 at `n=16`, 136 at `n=17`, 2,096,128 at `n=2,048`, and **4,997,541** at `n=3,162`. The predecessor research note's `4,997,500` value was incorrect. For aligned diameter `D=2^53`, the minimum-shifted O(n) checked intermediate `n²D²` fits through `n=2,047` and fails at `2,048`, but the exact pair-square numerator extremum `floor(n²/4)D²` fits through `n=4,095` and fails at `4,096`. These are different implementation envelopes. The unreduced scientific denominator `n²(n-1)` stays at or below `2^53` through `n=208,064` and exceeds it at `208,065`; because the production midpoint proof uses the GCD-reduced denominator, this is an envelope marker rather than a universal refusal count. -`crates/validation_core/examples/bias_se_exact_proof_budget.rs` supplies a standard-library timing harness for the quadratic and linear checked-integer kernels at 16, 64, 256, 1024, and 2047 observations. It emits kernel p95 timing rows and checks algebraic equality before timing. `docs/research/validation-bias-standard-error-exact-proof-budget.md` records the pair-record allocation count `n(n-1)/2` and distinguishes a semantics-preserving two-pass O(n²) allocation-removal option from a stronger sufficient-admission O(n) path. +Commit `5d030688d0ed44d5fa4a698a2097173430b43bd1` upgrades `crates/validation_core/examples/bias_se_exact_proof_budget.rs` to compare three checked-integer resource shapes: the current production-layout-shaped buffered O(n²) pair records, an allocation-free two-pass O(n²) reference, and the O(n) identity `n*Σc_i²-(Σc_i)²`. Before timing, the harness restores each dyadic unit and requires the same exact pair-square numerator. Its CSV now records p95 plus target `Option<(u128,i32)>` size, actual scratch `Vec` capacity, and scratch payload bytes. CHANGELOG `ffbd320c0f692d1084defd773ea3101661e4c159`, research `ca8f993ba6dc720255322c3bdbaa53f8da9f0227`, Test Strategy `5a512609778269dfb893a2e04865d048955388bf`, and Operability/current head `797f7caa557440634038d166ee7098f7c6df5b9d` carry the corrected contract. -Current #488 documentation head `d15282fc28038cf05b54f691d3bf72f568482984` makes the resource contract explicit in `docs/TEST_STRATEGY.md` and `docs/OPERABILITY.md`. Required before widening production admission: release-mode raw timings on a recorded CPU/OS/Rust toolchain; measured allocation/layout; admitted/refused-set comparison between the O(n) sufficient proof and current pairwise proof; checked-`u128` overflow/refusal across sample count and exponent spread; wider-integer/reference assessment; realistic public scientific contracts; and applicable full-path `p95<=20 ms` evidence. - -The next source decision must be based on measured evidence, not the next integer sample count. +No release-mode timing result, allocator/RSS record, O(n) admitted/refused-set comparison, wider-reference assessment, or applicable buyer-path p95 is claimed on this head. The next source decision must use measured evidence, not `2,047`, `4,095`, `208,064`, or the next integer sample count as a proxy for a resource budget. ## Gap register @@ -83,8 +81,8 @@ The next source decision must be based on measured evidence, not the next intege | GAP-092–110 | Represented residual subtraction, translated-moment, rational-scale, anchor, three-level and subnormal correctness sequence; verification pending | Exact RED→repair lineages and public contracts remain inherited on #488. | | GAP-111–120 | Exact pair-distance/midpoint proof introduced and extended through `n=11`; verification pending | Exact RED→repair/test/research lineages remain inherited. | | GAP-121–124 | Exact pair-distance proof extended through `n=12..15`; verification pending | REDs `b6ac1117...`, `369af46d...`, `db403976...`, `1c8a7ced...` with causal repairs `035cf392...`, `0b8727e7...`, `58efe80d...`, `3cc041ee...`; doctoring inherited. | -| GAP-125 | Exact `n=16` pair-distance result remained one ULP low on translated fallback; verification pending | RED `5da82b2d...` → repair `a509ae9e...` → CHANGELOG/research `3d2297c6...`; production bounded proof is now `n=4..=16`. | -| #491 | Hard sample-count cutoff is an unmeasured resource budget; open | Characterization `757fb0e4...` proves an n=17 counterexample, O(n²)/O(n) exact numerator equivalence, compact-dyadic `u128` envelope, and timing tooling; docs head `d15282fc...` fixes measurement/operability gates. Production cutoff deliberately unchanged pending measured CPU/allocation/API evidence. | +| GAP-125 | Exact `n=16` pair-distance result remained one ULP low on translated fallback; verification pending | RED `5da82b2d...` → repair `a509ae9e...` → CHANGELOG/research `3d2297c6...`; production bounded proof is `n=4..=16`. | +| #491 | Hard sample-count cutoff is an unmeasured resource budget; open | n=17 counterexample remains on fallback. Characterization `e476d66c...` corrects pair counts and separates the 2,047 linear-intermediate, 4,095 exact-numerator, and 208,064 unreduced-denominator envelopes; harness `5d030688...` compares buffered O(n²), two-pass O(n²), and O(n) resource shapes. Current docs/head `797f7caa...`; production cutoff deliberately unchanged pending measured CPU/allocation/API evidence. | ## Release gate From 546a6e02d42f357d00b8de46ee4c0691bc565e8a Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sun, 6 Sep 2026 04:06:45 +0900 Subject: [PATCH 220/235] docs(gap): record linear proof admission subset --- docs/product-technical-gap-baseline.md | 21 +++++++++++++-------- 1 file changed, 13 insertions(+), 8 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 4fe6e8e61..a95229259 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-05T18:03:00Z +**Snapshot:** 2026-09-05T18:58:06Z **Protected-main evidence:** `a243f18da4a4ca8a8d068c39922537f1f8ed6ad0` **Workspace version:** `0.2.0` @@ -30,8 +30,8 @@ Passing, queued, skipped, or predecessor-head checks on an open PR never promote | PR / issue | Exact current evidence | Disposition | | --- | --- | --- | -| #488 | `797f7caa557440634038d166ee7098f7c6df5b9d`, Draft, base `main` | Validation Evidence landing vehicle on protected #490. GAP-125 keeps the bounded exact pair-distance proof through `n=16`; #491 now characterizes buffered O(n²), allocation-free two-pass O(n²), and O(n) resource shapes while leaving production admission unchanged pending measured CPU/allocation/API evidence. | -| #491 | open | Replace the sample-count staircase with a measured exact-proof budget. Requires reproducible CPU/allocation evidence, checked-`u128` envelopes, O(n²)/O(n)/wider-reference comparison, realistic scientific fixtures, exact-head gates, and applicable buyer-path p95 evidence. | +| #488 | `da353736cdfe2b8f729720d3d8166d162bd5f8cc`, Draft, base `main` | Validation Evidence landing vehicle on protected #490. GAP-125 keeps the bounded exact pair-distance proof through `n=16`; #491 now proves the checked O(n) `u128` candidate is a strict sufficient subset of the pair reference, so any production O(n) path must preserve pairwise fallback or justify wider checked integers. | +| #491 | open | Replace the sample-count staircase with a measured exact-proof budget. Requires reproducible CPU/allocation evidence, checked-`u128` envelopes, admitted/refused-set preservation, O(n²)/O(n)/wider-reference comparison, realistic scientific fixtures, exact-head gates, and applicable buyer-path p95 evidence. | | #416 | `aa730c63563eb4a33048d822b581036c8487bd47`, Draft | Validation / Analysis Run landing vehicle. Generic cutoff-before-identity repair remains inherited; fold children keep unique source/tests/doctoring until conflict-resolving inheritance is verified. | | #310 | `c6680450152b1e0a2c9abb553772d74a23923335`, Draft | Longitudinal Modeling vehicle. Stable `Between` recovery is unit-level with canonical occasion `0`; `Within` retains actual occasion identity. Older base remains a non-destructive restack finding. | | #480 | `5b2637f7b6142573ba1385a652c56632ecc9faa5`, Draft | contextual-orchestrator released-contract fail-closed integration vehicle. Mutable owner main remains evidence only. | @@ -54,23 +54,28 @@ The clock contract separates event/valid time, assertion time, document time, sy - A representable final estimand is not rejected solely because an avoidable intermediate binary64 operation overflows/underflows. False exact endpoints, erased finite bounds, cancellation residues, and avoidable double-rounding are repair findings. - Mean signed bias and bias SE are TEPP Validation Evidence performance measures. `n=2` and proved `n=3` identities remain inherited from GAP-092–110. For exact represented residuals with `n=4..=16`, GAP-111–125 admit `SE(mean)^2 = Σ_{i2` claim. - The `n=16` cutoff is an implementation/resource boundary, not a scientific boundary. #491 evidence demonstrates an exact `n=17` counterexample and algebraically equivalent O(n) numerator. Resource envelopes are implementation facts, not scientific cutoffs: at aligned diameter `D=2^53`, the characterized minimum-shifted O(n) intermediate fits through `n=2_047`, whereas the exact pair-square numerator extremum fits through `n=4_095`. Production admission remains `n<=16` until release-mode CPU/allocation and applicable buyer-path p95 evidence establish a budget. +- The current checked O(n) `u128` identity is a sufficient fast proof, not admission-equivalent to the checked pair reference. With one coefficient at zero and all remaining coefficients at `D=2^58`, both kernels admit `n=64`; at `n=65` the exact pair numerator remains `64D² = 2^122`, but `65*64D² = 4160*2^116` overflows the O(n) first intermediate before cancellation. Therefore O(n) refusal must fall back to the pair proof or use separately justified wider checked integers; it must not become a scientific refusal. - Generic Validation Evidence RMSE, Monte Carlo, Wilson, SE-aware acceptance, matching, durable evidence/provenance, serde and human projection retain GAP-045–091 contracts. Scientific failures are never hidden with skip/xfail/source rewriting/coverage exclusions. - Historical-cutoff admission occurs before duplicate-identity checks. Future-unavailable evidence cannot change an earlier run's conflicts, counts, or terminal state. - Supported temporal estimators require state/trajectory and claimed-structure recovery, bias/RMSE, interval coverage, convergence, uncertainty calibration, reproducibility, and leakage-safe rolling-origin evidence. CPU/GPU parity counts only when the relevant accelerator path actually runs. ## Current Validation Evidence repair and resource finding -#488 exact head `797f7caa557440634038d166ee7098f7c6df5b9d` inherits the full GAP-045–124 source/test/fixture/contract lineage and GAP-125's sixteen-observation repair. +#488 exact head `da353736cdfe2b8f729720d3d8166d162bd5f8cc` inherits the full GAP-045–124 source/test/fixture/contract lineage and GAP-125's sixteen-observation repair. GAP-125 public RED `5da82b2d651706c191ca191c6c077d916cbfda25` uses exact represented residuals `[314270929,327661307,371854441,398522837,413483290,416184956,565808551,682627163,724514517,731058943,740662035,970233120,1141566755,1320628283,1526331271,1992574092]`. Its 120 exact squared pair distances sum to `56_762_922_330_032_131_548`; denominator `16²×15=3_840`; gcd `12`; reduced radicand `4_730_243_527_502_677_629/320`. The predecessor translated floating moment/`sqrt` fallback returns adjacent lower `0x419c_fcbb_b78d_2ad4`, while exact midpoint comparison returns `0x419c_fcbb_b78d_2ad5`. Causal repair `a509ae9e46c8ffc2cc3ef4f0e904774ad2516e1f` advances only the existing bounded proof to `n=4..=16`. Issue #491 characterization `757fb0e4770b24f73f301b336adfcf7f656dcea5` adds an exactly represented `n=17` fixture `[38557579,48779805,63558649,106352599,139863777,142786819,267163239,275103292,375678558,454709869,484300224,623646610,989643121,1027595814,1520220488,1569903156,1805452085]`. Its 136 exact pair squares sum to `92_549_865_125_191_410_206`; denominator `4_624`; gcd `2`; reduced radicand `46_274_932_562_595_705_103/2_312`. Current fallback returns `0x41a0_dd77_9ac3_8e98`; exact-rational evaluation gives adjacent `0x41a0_dd77_9ac3_8e99`. -The current #491 characterization slice corrects and separates the resource envelopes rather than widening production behavior. Commit `e476d66c99bef7d3e35b6a77374daeaa5fc59959` fixes exact pair counts in the Rust contract: 120 at `n=16`, 136 at `n=17`, 2,096,128 at `n=2,048`, and **4,997,541** at `n=3,162`. The predecessor research note's `4,997,500` value was incorrect. For aligned diameter `D=2^53`, the minimum-shifted O(n) checked intermediate `n²D²` fits through `n=2,047` and fails at `2,048`, but the exact pair-square numerator extremum `floor(n²/4)D²` fits through `n=4,095` and fails at `4,096`. These are different implementation envelopes. The unreduced scientific denominator `n²(n-1)` stays at or below `2^53` through `n=208,064` and exceeds it at `208,065`; because the production midpoint proof uses the GCD-reduced denominator, this is an envelope marker rather than a universal refusal count. +The current #491 characterization corrects and separates resource envelopes without widening production behavior. Commit `e476d66c99bef7d3e35b6a77374daeaa5fc59959` fixes exact pair counts in the Rust contract: 120 at `n=16`, 136 at `n=17`, 2,096,128 at `n=2,048`, and **4,997,541** at `n=3,162`. For aligned diameter `D=2^53`, the minimum-shifted O(n) checked intermediate `n²D²` fits through `n=2,047` and fails at `2,048`, but the exact pair-square numerator extremum `floor(n²/4)D²` fits through `n=4,095` and fails at `4,096`. The unreduced scientific denominator `n²(n-1)` stays at or below `2^53` through `n=208,064` and exceeds it at `208,065`; because production uses the GCD-reduced denominator, none of these values is a universal refusal count. -Commit `5d030688d0ed44d5fa4a698a2097173430b43bd1` upgrades `crates/validation_core/examples/bias_se_exact_proof_budget.rs` to compare three checked-integer resource shapes: the current production-layout-shaped buffered O(n²) pair records, an allocation-free two-pass O(n²) reference, and the O(n) identity `n*Σc_i²-(Σc_i)²`. Before timing, the harness restores each dyadic unit and requires the same exact pair-square numerator. Its CSV now records p95 plus target `Option<(u128,i32)>` size, actual scratch `Vec` capacity, and scratch payload bytes. CHANGELOG `ffbd320c0f692d1084defd773ea3101661e4c159`, research `ca8f993ba6dc720255322c3bdbaa53f8da9f0227`, Test Strategy `5a512609778269dfb893a2e04865d048955388bf`, and Operability/current head `797f7caa557440634038d166ee7098f7c6df5b9d` carry the corrected contract. +Commit `5d030688d0ed44d5fa4a698a2097173430b43bd1` upgrades `crates/validation_core/examples/bias_se_exact_proof_budget.rs` to compare the current production-layout-shaped buffered O(n²) pair records, an allocation-free two-pass O(n²) reference, and the O(n) identity `n*Σc_i²-(Σc_i)²`. Before timing, the harness restores each dyadic unit and requires the same exact pair-square numerator. Its CSV records p95 plus target `Option<(u128,i32)>` size, actual scratch `Vec` capacity, and scratch payload bytes. -No release-mode timing result, allocator/RSS record, O(n) admitted/refused-set comparison, wider-reference assessment, or applicable buyer-path p95 is claimed on this head. The next source decision must use measured evidence, not `2,047`, `4,095`, `208,064`, or the next integer sample count as a proxy for a resource budget. +Commit `c70210e331ec096c90a42bec9de7d619bd51fe26` supplies the previously missing admitted/refused-set contract. Deterministic compact grids at `n=4,16,17,32,64,128,256` require exact O(n)/O(n²) numerator equality whenever the linear kernel admits. The same test proves strict admission asymmetry at `D=2^58`: `n=64` fits both paths; at `n=65`, the exact pair numerator is still `2^122` but the O(n) first term `4160*2^116` exceeds `u128` before subtraction. Hence a checked O(n) refusal cannot replace pairwise scientific admission. + +Research/TRACEABILITY `579604a4a0aca9d191e5cb444b51fa822fe43d76`, CHANGELOG `da7e830b46df056d3416118d56d07c5a728b09d2`, Test Strategy `bef1a4701a737f4a230968aaf68c25d5f29b60cb`, and Operability/current head `da353736cdfe2b8f729720d3d8166d162bd5f8cc` carry the finding through the current #488 authority. + +No release-mode timing result, allocator/RSS record, hybrid O(n)-fast-path/pair-fallback timing on both admitted/refused geometries, wider-reference assessment, applicable buyer-path p95, or exact-head hosted GREEN is claimed. The next source decision must use measured evidence, not `2,047`, `4,095`, `208,064`, or the next integer sample count as a proxy for a resource budget. ## Gap register @@ -82,7 +87,7 @@ No release-mode timing result, allocator/RSS record, O(n) admitted/refused-set c | GAP-111–120 | Exact pair-distance/midpoint proof introduced and extended through `n=11`; verification pending | Exact RED→repair/test/research lineages remain inherited. | | GAP-121–124 | Exact pair-distance proof extended through `n=12..15`; verification pending | REDs `b6ac1117...`, `369af46d...`, `db403976...`, `1c8a7ced...` with causal repairs `035cf392...`, `0b8727e7...`, `58efe80d...`, `3cc041ee...`; doctoring inherited. | | GAP-125 | Exact `n=16` pair-distance result remained one ULP low on translated fallback; verification pending | RED `5da82b2d...` → repair `a509ae9e...` → CHANGELOG/research `3d2297c6...`; production bounded proof is `n=4..=16`. | -| #491 | Hard sample-count cutoff is an unmeasured resource budget; open | n=17 counterexample remains on fallback. Characterization `e476d66c...` corrects pair counts and separates the 2,047 linear-intermediate, 4,095 exact-numerator, and 208,064 unreduced-denominator envelopes; harness `5d030688...` compares buffered O(n²), two-pass O(n²), and O(n) resource shapes. Current docs/head `797f7caa...`; production cutoff deliberately unchanged pending measured CPU/allocation/API evidence. | +| #491 | Hard sample-count cutoff is an unmeasured resource budget; open | n=17 counterexample remains on fallback. `e476d66c...` separates resource envelopes; `5d030688...` compares buffered O(n²), two-pass O(n²), and O(n); `c70210e3...` proves checked O(n) is a strict sufficient subset and must retain pair fallback or wider checked integers. Current authority `da353736...`; production cutoff deliberately unchanged pending release-mode CPU/allocation/hybrid/API evidence and exact-head gates. | ## Release gate From d8d63aec5654ca810d19267d0e9ee514c6bae83f Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sun, 6 Sep 2026 05:05:12 +0900 Subject: [PATCH 221/235] docs(gaps): trace hybrid exact-proof budget --- docs/product-technical-gap-baseline.md | 21 +++++++++++---------- 1 file changed, 11 insertions(+), 10 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index a95229259..3489aa8f7 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-05T18:58:06Z +**Snapshot:** 2026-09-05T20:05:00Z **Protected-main evidence:** `a243f18da4a4ca8a8d068c39922537f1f8ed6ad0` **Workspace version:** `0.2.0` @@ -30,8 +30,8 @@ Passing, queued, skipped, or predecessor-head checks on an open PR never promote | PR / issue | Exact current evidence | Disposition | | --- | --- | --- | -| #488 | `da353736cdfe2b8f729720d3d8166d162bd5f8cc`, Draft, base `main` | Validation Evidence landing vehicle on protected #490. GAP-125 keeps the bounded exact pair-distance proof through `n=16`; #491 now proves the checked O(n) `u128` candidate is a strict sufficient subset of the pair reference, so any production O(n) path must preserve pairwise fallback or justify wider checked integers. | -| #491 | open | Replace the sample-count staircase with a measured exact-proof budget. Requires reproducible CPU/allocation evidence, checked-`u128` envelopes, admitted/refused-set preservation, O(n²)/O(n)/wider-reference comparison, realistic scientific fixtures, exact-head gates, and applicable buyer-path p95 evidence. | +| #488 | `cd0f9a7b7710fc7965588017a71286bd6cdc96a5`, Draft, base `main` | Validation Evidence landing vehicle on protected #490. GAP-125 keeps production exact pair-distance admission through `n=16`; #491 now includes an executable hybrid characterization (`O(n)` sufficient fast path, buffered pair fallback) for both admitted and refused geometries without changing production behavior. Exact-head hosted workflows are queued/pending and Rust jobs remain runner-unassigned. | +| #491 | open | Replace the sample-count staircase with a measured exact-proof budget. The hybrid measurement shape is now encoded; still requires actual release-mode CPU/raw CSV, allocator/RSS, wider-reference assessment, exact-head gates/review, and applicable buyer-path p95 evidence. | | #416 | `aa730c63563eb4a33048d822b581036c8487bd47`, Draft | Validation / Analysis Run landing vehicle. Generic cutoff-before-identity repair remains inherited; fold children keep unique source/tests/doctoring until conflict-resolving inheritance is verified. | | #310 | `c6680450152b1e0a2c9abb553772d74a23923335`, Draft | Longitudinal Modeling vehicle. Stable `Between` recovery is unit-level with canonical occasion `0`; `Within` retains actual occasion identity. Older base remains a non-destructive restack finding. | | #480 | `5b2637f7b6142573ba1385a652c56632ecc9faa5`, Draft | contextual-orchestrator released-contract fail-closed integration vehicle. Mutable owner main remains evidence only. | @@ -55,27 +55,28 @@ The clock contract separates event/valid time, assertion time, document time, sy - Mean signed bias and bias SE are TEPP Validation Evidence performance measures. `n=2` and proved `n=3` identities remain inherited from GAP-092–110. For exact represented residuals with `n=4..=16`, GAP-111–125 admit `SE(mean)^2 = Σ_{i2` claim. - The `n=16` cutoff is an implementation/resource boundary, not a scientific boundary. #491 evidence demonstrates an exact `n=17` counterexample and algebraically equivalent O(n) numerator. Resource envelopes are implementation facts, not scientific cutoffs: at aligned diameter `D=2^53`, the characterized minimum-shifted O(n) intermediate fits through `n=2_047`, whereas the exact pair-square numerator extremum fits through `n=4_095`. Production admission remains `n<=16` until release-mode CPU/allocation and applicable buyer-path p95 evidence establish a budget. - The current checked O(n) `u128` identity is a sufficient fast proof, not admission-equivalent to the checked pair reference. With one coefficient at zero and all remaining coefficients at `D=2^58`, both kernels admit `n=64`; at `n=65` the exact pair numerator remains `64D² = 2^122`, but `65*64D² = 4160*2^116` overflows the O(n) first intermediate before cancellation. Therefore O(n) refusal must fall back to the pair proof or use separately justified wider checked integers; it must not become a scientific refusal. +- Hybrid resource measurements must prove which path actually ran. The characterization CSV therefore records `geometry` and `used_pairwise_fallback`; an `n=65` result is not accepted as fallback evidence unless the flag confirms the buffered pair path and the restored exact numerator matches the pair reference. - Generic Validation Evidence RMSE, Monte Carlo, Wilson, SE-aware acceptance, matching, durable evidence/provenance, serde and human projection retain GAP-045–091 contracts. Scientific failures are never hidden with skip/xfail/source rewriting/coverage exclusions. - Historical-cutoff admission occurs before duplicate-identity checks. Future-unavailable evidence cannot change an earlier run's conflicts, counts, or terminal state. - Supported temporal estimators require state/trajectory and claimed-structure recovery, bias/RMSE, interval coverage, convergence, uncertainty calibration, reproducibility, and leakage-safe rolling-origin evidence. CPU/GPU parity counts only when the relevant accelerator path actually runs. ## Current Validation Evidence repair and resource finding -#488 exact head `da353736cdfe2b8f729720d3d8166d162bd5f8cc` inherits the full GAP-045–124 source/test/fixture/contract lineage and GAP-125's sixteen-observation repair. +#488 exact head `cd0f9a7b7710fc7965588017a71286bd6cdc96a5` inherits the full GAP-045–124 source/test/fixture/contract lineage and GAP-125's sixteen-observation repair. GAP-125 public RED `5da82b2d651706c191ca191c6c077d916cbfda25` uses exact represented residuals `[314270929,327661307,371854441,398522837,413483290,416184956,565808551,682627163,724514517,731058943,740662035,970233120,1141566755,1320628283,1526331271,1992574092]`. Its 120 exact squared pair distances sum to `56_762_922_330_032_131_548`; denominator `16²×15=3_840`; gcd `12`; reduced radicand `4_730_243_527_502_677_629/320`. The predecessor translated floating moment/`sqrt` fallback returns adjacent lower `0x419c_fcbb_b78d_2ad4`, while exact midpoint comparison returns `0x419c_fcbb_b78d_2ad5`. Causal repair `a509ae9e46c8ffc2cc3ef4f0e904774ad2516e1f` advances only the existing bounded proof to `n=4..=16`. Issue #491 characterization `757fb0e4770b24f73f301b336adfcf7f656dcea5` adds an exactly represented `n=17` fixture `[38557579,48779805,63558649,106352599,139863777,142786819,267163239,275103292,375678558,454709869,484300224,623646610,989643121,1027595814,1520220488,1569903156,1805452085]`. Its 136 exact pair squares sum to `92_549_865_125_191_410_206`; denominator `4_624`; gcd `2`; reduced radicand `46_274_932_562_595_705_103/2_312`. Current fallback returns `0x41a0_dd77_9ac3_8e98`; exact-rational evaluation gives adjacent `0x41a0_dd77_9ac3_8e99`. -The current #491 characterization corrects and separates resource envelopes without widening production behavior. Commit `e476d66c99bef7d3e35b6a77374daeaa5fc59959` fixes exact pair counts in the Rust contract: 120 at `n=16`, 136 at `n=17`, 2,096,128 at `n=2,048`, and **4,997,541** at `n=3,162`. For aligned diameter `D=2^53`, the minimum-shifted O(n) checked intermediate `n²D²` fits through `n=2,047` and fails at `2,048`, but the exact pair-square numerator extremum `floor(n²/4)D²` fits through `n=4,095` and fails at `4,096`. The unreduced scientific denominator `n²(n-1)` stays at or below `2^53` through `n=208,064` and exceeds it at `208,065`; because production uses the GCD-reduced denominator, none of these values is a universal refusal count. +Commit `e476d66c99bef7d3e35b6a77374daeaa5fc59959` fixes exact pair counts in the Rust contract: 120 at `n=16`, 136 at `n=17`, 2,096,128 at `n=2,048`, and **4,997,541** at `n=3,162`. For aligned diameter `D=2^53`, the minimum-shifted O(n) checked intermediate `n²D²` fits through `n=2,047` and fails at `2,048`, but the exact pair-square numerator extremum `floor(n²/4)D²` fits through `n=4,095` and fails at `4,096`. The unreduced scientific denominator `n²(n-1)` stays at or below `2^53` through `n=208,064` and exceeds it at `208,065`; because production uses the GCD-reduced denominator, none of these values is a universal refusal count. -Commit `5d030688d0ed44d5fa4a698a2097173430b43bd1` upgrades `crates/validation_core/examples/bias_se_exact_proof_budget.rs` to compare the current production-layout-shaped buffered O(n²) pair records, an allocation-free two-pass O(n²) reference, and the O(n) identity `n*Σc_i²-(Σc_i)²`. Before timing, the harness restores each dyadic unit and requires the same exact pair-square numerator. Its CSV records p95 plus target `Option<(u128,i32)>` size, actual scratch `Vec` capacity, and scratch payload bytes. +Commit `c70210e331ec096c90a42bec9de7d619bd51fe26` supplies the admitted/refused-set contract. Deterministic compact grids at `n=4,16,17,32,64,128,256` require exact O(n)/O(n²) numerator equality whenever the linear kernel admits. The same test proves strict admission asymmetry at `D=2^58`: `n=64` fits both paths; at `n=65`, the exact pair numerator is still `2^122` but the O(n) first term `4160*2^116` exceeds `u128` before subtraction. Hence a checked O(n) refusal cannot replace pairwise scientific admission. -Commit `c70210e331ec096c90a42bec9de7d619bd51fe26` supplies the previously missing admitted/refused-set contract. Deterministic compact grids at `n=4,16,17,32,64,128,256` require exact O(n)/O(n²) numerator equality whenever the linear kernel admits. The same test proves strict admission asymmetry at `D=2^58`: `n=64` fits both paths; at `n=65`, the exact pair numerator is still `2^122` but the O(n) first term `4160*2^116` exceeds `u128` before subtraction. Hence a checked O(n) refusal cannot replace pairwise scientific admission. +Commit `c6b237e0bb1388cccd7bcb71a0df5cbf837a07c5` extends the standard-library measurement harness with the viable hybrid. The harness compares production-layout-shaped buffered O(n²), allocation-free two-pass O(n²), checked O(n), and `O(n) -> buffered pair fallback`. It requires exact restored-numerator equality before timing. Compact fixtures stay on the linear fast path; the `D=2^58` boundary explicitly checks `n=64` as admitted and `n=65` as pair fallback while preserving exact numerator `2^122`. CSV reports `geometry`, p95, layout/capacity/scratch evidence, and `used_pairwise_fallback`. -Research/TRACEABILITY `579604a4a0aca9d191e5cb444b51fa822fe43d76`, CHANGELOG `da7e830b46df056d3416118d56d07c5a728b09d2`, Test Strategy `bef1a4701a737f4a230968aaf68c25d5f29b60cb`, and Operability/current head `da353736cdfe2b8f729720d3d8166d162bd5f8cc` carry the finding through the current #488 authority. +CHANGELOG `457654593391d09f4e3dc551ce75dc856ad1964f`, research/TRACEABILITY `c077b30a37900dd40ea994d1c3bba2195bbfea83`, Test Strategy `df8f46b8e39142f2d7218e2ce4ad515aa0c67072`, and Operability/current #488 head `cd0f9a7b7710fc7965588017a71286bd6cdc96a5` carry the hybrid finding through current authority. -No release-mode timing result, allocator/RSS record, hybrid O(n)-fast-path/pair-fallback timing on both admitted/refused geometries, wider-reference assessment, applicable buyer-path p95, or exact-head hosted GREEN is claimed. The next source decision must use measured evidence, not `2,047`, `4,095`, `208,064`, or the next integer sample count as a proxy for a resource budget. +No release-mode timing result, allocator/RSS record, wider-reference assessment, applicable buyer-path p95, or exact-head hosted GREEN is claimed. The current local execution environment has no Rust toolchain; the exact-head Rust Foundation jobs are runner-unassigned and the other required workflows are queued/pending. The next production decision must use measured evidence, not `2,047`, `4,095`, `208,064`, or the next integer sample count as a proxy for a resource budget. ## Gap register @@ -87,7 +88,7 @@ No release-mode timing result, allocator/RSS record, hybrid O(n)-fast-path/pair- | GAP-111–120 | Exact pair-distance/midpoint proof introduced and extended through `n=11`; verification pending | Exact RED→repair/test/research lineages remain inherited. | | GAP-121–124 | Exact pair-distance proof extended through `n=12..15`; verification pending | REDs `b6ac1117...`, `369af46d...`, `db403976...`, `1c8a7ced...` with causal repairs `035cf392...`, `0b8727e7...`, `58efe80d...`, `3cc041ee...`; doctoring inherited. | | GAP-125 | Exact `n=16` pair-distance result remained one ULP low on translated fallback; verification pending | RED `5da82b2d...` → repair `a509ae9e...` → CHANGELOG/research `3d2297c6...`; production bounded proof is `n=4..=16`. | -| #491 | Hard sample-count cutoff is an unmeasured resource budget; open | n=17 counterexample remains on fallback. `e476d66c...` separates resource envelopes; `5d030688...` compares buffered O(n²), two-pass O(n²), and O(n); `c70210e3...` proves checked O(n) is a strict sufficient subset and must retain pair fallback or wider checked integers. Current authority `da353736...`; production cutoff deliberately unchanged pending release-mode CPU/allocation/hybrid/API evidence and exact-head gates. | +| #491 | Hard sample-count cutoff is an unmeasured resource budget; open | n=17 counterexample remains on fallback. `e476d66c...` separates resource envelopes; `c70210e3...` proves checked O(n) is a strict sufficient subset; `c6b237e0...` adds the measurable O(n)-fast-path/buffered-pair-fallback hybrid with admitted/refused path observability. Current authority `cd0f9a7b...`; production cutoff deliberately unchanged pending release-mode CPU/allocation/RSS, wider-reference, API p95, and exact-head gates/review. | ## Release gate From eb4e5a23bfed644d853293b8bb1ec4618b285c74 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sun, 6 Sep 2026 06:14:13 +0900 Subject: [PATCH 222/235] docs(ddd): correct canonical dyadic proof-budget authority --- docs/product-technical-gap-baseline.md | 29 ++++++++++++++------------ 1 file changed, 16 insertions(+), 13 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 3489aa8f7..0f31a7a16 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-05T20:05:00Z +**Snapshot:** 2026-09-05T20:58:00Z **Protected-main evidence:** `a243f18da4a4ca8a8d068c39922537f1f8ed6ad0` **Workspace version:** `0.2.0` @@ -30,8 +30,8 @@ Passing, queued, skipped, or predecessor-head checks on an open PR never promote | PR / issue | Exact current evidence | Disposition | | --- | --- | --- | -| #488 | `cd0f9a7b7710fc7965588017a71286bd6cdc96a5`, Draft, base `main` | Validation Evidence landing vehicle on protected #490. GAP-125 keeps production exact pair-distance admission through `n=16`; #491 now includes an executable hybrid characterization (`O(n)` sufficient fast path, buffered pair fallback) for both admitted and refused geometries without changing production behavior. Exact-head hosted workflows are queued/pending and Rust jobs remain runner-unassigned. | -| #491 | open | Replace the sample-count staircase with a measured exact-proof budget. The hybrid measurement shape is now encoded; still requires actual release-mode CPU/raw CSV, allocator/RSS, wider-reference assessment, exact-head gates/review, and applicable buyer-path p95 evidence. | +| #488 | `96f17c02edba0792f61e0e92167703a6ae4e40d0`, Draft, base `main` | Validation Evidence landing vehicle on protected #490. GAP-125 keeps production exact pair-distance admission through `n=16`; #491 now normalizes the canonical dyadic unit before checked O(n) admission, retains an odd-diameter strict-subset counterexample, and measures normalized fast-path plus pair-fallback geometries without changing production behavior. Exact-head hosted workflows still require fresh GREEN/review evidence. | +| #491 | open | Replace the sample-count staircase with a measured exact-proof budget. The corrected hybrid measurement shape is encoded; still requires actual release-mode CPU/raw CSV, allocator/RSS, wider-reference assessment, exact-head gates/review, and applicable buyer-path p95 evidence. | | #416 | `aa730c63563eb4a33048d822b581036c8487bd47`, Draft | Validation / Analysis Run landing vehicle. Generic cutoff-before-identity repair remains inherited; fold children keep unique source/tests/doctoring until conflict-resolving inheritance is verified. | | #310 | `c6680450152b1e0a2c9abb553772d74a23923335`, Draft | Longitudinal Modeling vehicle. Stable `Between` recovery is unit-level with canonical occasion `0`; `Within` retains actual occasion identity. Older base remains a non-destructive restack finding. | | #480 | `5b2637f7b6142573ba1385a652c56632ecc9faa5`, Draft | contextual-orchestrator released-contract fail-closed integration vehicle. Mutable owner main remains evidence only. | @@ -53,30 +53,33 @@ The clock contract separates event/valid time, assertion time, document time, sy - Row arrival order is not scientific evidence. Fixed admitted observations must produce bit-identical results under permutation wherever the deterministic CPU `f64` contract claims it. - A representable final estimand is not rejected solely because an avoidable intermediate binary64 operation overflows/underflows. False exact endpoints, erased finite bounds, cancellation residues, and avoidable double-rounding are repair findings. - Mean signed bias and bias SE are TEPP Validation Evidence performance measures. `n=2` and proved `n=3` identities remain inherited from GAP-092–110. For exact represented residuals with `n=4..=16`, GAP-111–125 admit `SE(mean)^2 = Σ_{i2` claim. -- The `n=16` cutoff is an implementation/resource boundary, not a scientific boundary. #491 evidence demonstrates an exact `n=17` counterexample and algebraically equivalent O(n) numerator. Resource envelopes are implementation facts, not scientific cutoffs: at aligned diameter `D=2^53`, the characterized minimum-shifted O(n) intermediate fits through `n=2_047`, whereas the exact pair-square numerator extremum fits through `n=4_095`. Production admission remains `n<=16` until release-mode CPU/allocation and applicable buyer-path p95 evidence establish a budget. -- The current checked O(n) `u128` identity is a sufficient fast proof, not admission-equivalent to the checked pair reference. With one coefficient at zero and all remaining coefficients at `D=2^58`, both kernels admit `n=64`; at `n=65` the exact pair numerator remains `64D² = 2^122`, but `65*64D² = 4160*2^116` overflows the O(n) first intermediate before cancellation. Therefore O(n) refusal must fall back to the pair proof or use separately justified wider checked integers; it must not become a scientific refusal. -- Hybrid resource measurements must prove which path actually ran. The characterization CSV therefore records `geometry` and `used_pairwise_fallback`; an `n=65` result is not accepted as fallback evidence unless the flag confirms the buffered pair path and the restored exact numerator matches the pair reference. +- The `n=16` cutoff is an implementation/resource boundary, not a scientific boundary. #491 evidence demonstrates an exact `n=17` counterexample and algebraically equivalent O(n) numerator. Resource envelopes are implementation facts, not scientific cutoffs: at **canonical aligned** coefficient diameter `D=2^53` after shared power-of-two normalization, the normalized O(n) distribution-independent intermediate envelope fits through `n=2_047`, whereas the exact pair-square numerator extremum fits through `n=4_095`. Production admission remains `n<=16` until release-mode CPU/allocation and applicable buyer-path p95 evidence establish a budget. +- Checked O(n) admission is defined on the canonical dyadic grid. Before judging integer overflow, the largest exact power-of-two factor common to all nonzero anchor-relative coefficients must be removed and restored exactly afterward. Raw-scale overflow is not a scientific/resource refusal when exact dyadic normalization removes it. +- The predecessor `D=2^58,n=65` refusal is invalid and superseded. After dividing the shared `2^58` unit, coefficients are zero/one, the O(n) intermediates are `4_160` and `4_096`, and the normalized numerator `64` restores exactly to `2^122`; the linear/hybrid path must admit without pair fallback. +- The corrected checked O(n) `u128` identity is still a sufficient fast proof, not admission-equivalent to the checked pair reference. With one coefficient at zero and all remaining coefficients at **odd** `D=2^58+1`, the canonical shared dyadic unit is one. Both kernels admit `n=64`; at `n=65` the exact pair numerator `64D²` remains a 123-bit `u128`, while `65*64D²` requires 129 bits before cancellation. Therefore O(n) refusal must fall back to the pair proof or use separately justified wider checked integers; it must not become a scientific refusal. +- Restoring a normalized dyadic numerator must itself be overflow-checked. A valid shift count is not proof that high bits survive `u128::checked_shl`; the characterization uses checked multiplication by the exact squared unit and fails closed if restoration does not fit. +- Hybrid resource measurements must prove which path actually ran. The characterization CSV records `geometry`, normalized `unit_exponent`, and `used_pairwise_fallback`; `power_of_two_normalized_admit` (`D=2^58,n=65`) must report no fallback, while `odd_boundary_pair_fallback` (`D=2^58+1,n=65`) must confirm the buffered pair path and preserve the restored exact numerator. - Generic Validation Evidence RMSE, Monte Carlo, Wilson, SE-aware acceptance, matching, durable evidence/provenance, serde and human projection retain GAP-045–091 contracts. Scientific failures are never hidden with skip/xfail/source rewriting/coverage exclusions. - Historical-cutoff admission occurs before duplicate-identity checks. Future-unavailable evidence cannot change an earlier run's conflicts, counts, or terminal state. - Supported temporal estimators require state/trajectory and claimed-structure recovery, bias/RMSE, interval coverage, convergence, uncertainty calibration, reproducibility, and leakage-safe rolling-origin evidence. CPU/GPU parity counts only when the relevant accelerator path actually runs. ## Current Validation Evidence repair and resource finding -#488 exact head `cd0f9a7b7710fc7965588017a71286bd6cdc96a5` inherits the full GAP-045–124 source/test/fixture/contract lineage and GAP-125's sixteen-observation repair. +#488 exact head `96f17c02edba0792f61e0e92167703a6ae4e40d0` inherits the full GAP-045–124 source/test/fixture/contract lineage and GAP-125's sixteen-observation repair. GAP-125 public RED `5da82b2d651706c191ca191c6c077d916cbfda25` uses exact represented residuals `[314270929,327661307,371854441,398522837,413483290,416184956,565808551,682627163,724514517,731058943,740662035,970233120,1141566755,1320628283,1526331271,1992574092]`. Its 120 exact squared pair distances sum to `56_762_922_330_032_131_548`; denominator `16²×15=3_840`; gcd `12`; reduced radicand `4_730_243_527_502_677_629/320`. The predecessor translated floating moment/`sqrt` fallback returns adjacent lower `0x419c_fcbb_b78d_2ad4`, while exact midpoint comparison returns `0x419c_fcbb_b78d_2ad5`. Causal repair `a509ae9e46c8ffc2cc3ef4f0e904774ad2516e1f` advances only the existing bounded proof to `n=4..=16`. Issue #491 characterization `757fb0e4770b24f73f301b336adfcf7f656dcea5` adds an exactly represented `n=17` fixture `[38557579,48779805,63558649,106352599,139863777,142786819,267163239,275103292,375678558,454709869,484300224,623646610,989643121,1027595814,1520220488,1569903156,1805452085]`. Its 136 exact pair squares sum to `92_549_865_125_191_410_206`; denominator `4_624`; gcd `2`; reduced radicand `46_274_932_562_595_705_103/2_312`. Current fallback returns `0x41a0_dd77_9ac3_8e98`; exact-rational evaluation gives adjacent `0x41a0_dd77_9ac3_8e99`. -Commit `e476d66c99bef7d3e35b6a77374daeaa5fc59959` fixes exact pair counts in the Rust contract: 120 at `n=16`, 136 at `n=17`, 2,096,128 at `n=2,048`, and **4,997,541** at `n=3,162`. For aligned diameter `D=2^53`, the minimum-shifted O(n) checked intermediate `n²D²` fits through `n=2,047` and fails at `2,048`, but the exact pair-square numerator extremum `floor(n²/4)D²` fits through `n=4,095` and fails at `4,096`. The unreduced scientific denominator `n²(n-1)` stays at or below `2^53` through `n=208,064` and exceeds it at `208,065`; because production uses the GCD-reduced denominator, none of these values is a universal refusal count. +Commit `e476d66c99bef7d3e35b6a77374daeaa5fc59959` fixes exact pair counts in the Rust contract: 120 at `n=16`, 136 at `n=17`, 2,096,128 at `n=2,048`, and **4,997,541** at `n=3,162`. For canonical aligned diameter `D=2^53`, the normalized O(n) checked intermediate envelope `n²D²` fits through `n=2,047` and fails at `2,048`, but the exact pair-square numerator extremum `floor(n²/4)D²` fits through `n=4,095` and fails at `4,096`. The unreduced scientific denominator `n²(n-1)` stays at or below `2^53` through `n=208,064` and exceeds it at `208,065`; because production uses the GCD-reduced denominator, none of these values is a universal refusal count. -Commit `c70210e331ec096c90a42bec9de7d619bd51fe26` supplies the admitted/refused-set contract. Deterministic compact grids at `n=4,16,17,32,64,128,256` require exact O(n)/O(n²) numerator equality whenever the linear kernel admits. The same test proves strict admission asymmetry at `D=2^58`: `n=64` fits both paths; at `n=65`, the exact pair numerator is still `2^122` but the O(n) first term `4160*2^116` exceeds `u128` before subtraction. Hence a checked O(n) refusal cannot replace pairwise scientific admission. +The predecessor admitted/refused-set fixture from `c70210e331ec096c90a42bec9de7d619bd51fe26` is superseded because it judged `D=2^58,n=65` on the raw integer scale. RED `4f1bd2c343cf2d54905a07c257a570a89dc575d3` exposes that representation-dependent refusal: exact common-unit normalization must make this geometry admit and recover `2^122`. Repair `d423b57797b6f7f127e61e0679f9ee9841525c77` factors the largest shared power-of-two unit before checked accumulation and replaces the refusal boundary with odd `D=2^58+1`, where no dyadic scale can be removed. The compact grids still require exact O(n)/O(n²) numerator equality whenever the linear path admits. -Commit `c6b237e0bb1388cccd7bcb71a0df5cbf837a07c5` extends the standard-library measurement harness with the viable hybrid. The harness compares production-layout-shaped buffered O(n²), allocation-free two-pass O(n²), checked O(n), and `O(n) -> buffered pair fallback`. It requires exact restored-numerator equality before timing. Compact fixtures stay on the linear fast path; the `D=2^58` boundary explicitly checks `n=64` as admitted and `n=65` as pair fallback while preserving exact numerator `2^122`. CSV reports `geometry`, p95, layout/capacity/scratch evidence, and `used_pairwise_fallback`. +The predecessor hybrid harness `c6b237e0bb1388cccd7bcb71a0df5cbf837a07c5` is likewise superseded at its raw-scale boundary. Harness repair `4a3d988702593b2b8d59be6dcfb1601ca1a0d610` compares buffered O(n²), allocation-free two-pass O(n²), normalized checked O(n), and normalized `O(n) -> buffered pair fallback`. It requires exact restored-numerator equality before timing and distinguishes `power_of_two_normalized_admit` (`D=2^58,n=65`, no fallback), `odd_boundary_admit` (`D=2^58+1,n=64`), and `odd_boundary_pair_fallback` (`D=2^58+1,n=65`, fallback required). `736bc8ddaec067615bedc387939f4650517d9ea1` keeps the harness type surface/clippy shape compact. Final characterization commit `96f17c02edba0792f61e0e92167703a6ae4e40d0` makes squared-unit restoration overflow fail closed with checked multiplication. -CHANGELOG `457654593391d09f4e3dc551ce75dc856ad1964f`, research/TRACEABILITY `c077b30a37900dd40ea994d1c3bba2195bbfea83`, Test Strategy `df8f46b8e39142f2d7218e2ce4ad515aa0c67072`, and Operability/current #488 head `cd0f9a7b7710fc7965588017a71286bd6cdc96a5` carry the hybrid finding through current authority. +CHANGELOG `08b8224e32eb2712214b5d710a269be972843b36`, research/TRACEABILITY `55bb8103353fd2b960a12f8d245efea23f3a2963`, Test Strategy `81708abeb9625e6aaac6ffd5bb675344cc216523`, and Operability `ee3a0f865265c888788147b7eec2a240a5484f1e` carry the corrected finding through #488 current authority `96f17c02edba0792f61e0e92167703a6ae4e40d0`. -No release-mode timing result, allocator/RSS record, wider-reference assessment, applicable buyer-path p95, or exact-head hosted GREEN is claimed. The current local execution environment has no Rust toolchain; the exact-head Rust Foundation jobs are runner-unassigned and the other required workflows are queued/pending. The next production decision must use measured evidence, not `2,047`, `4,095`, `208,064`, or the next integer sample count as a proxy for a resource budget. +No release-mode timing result, allocator/RSS record, wider-reference assessment, applicable buyer-path p95, or exact-head hosted GREEN is claimed. The current local execution environment has no Rust 1.98.0 toolchain; the hosted current-head gates and independent review must be observed fresh before any delivery transition. The next production decision must use measured evidence, not `2,047`, `4,095`, `208,064`, or the next integer sample count as a proxy for a resource budget. ## Gap register @@ -88,7 +91,7 @@ No release-mode timing result, allocator/RSS record, wider-reference assessment, | GAP-111–120 | Exact pair-distance/midpoint proof introduced and extended through `n=11`; verification pending | Exact RED→repair/test/research lineages remain inherited. | | GAP-121–124 | Exact pair-distance proof extended through `n=12..15`; verification pending | REDs `b6ac1117...`, `369af46d...`, `db403976...`, `1c8a7ced...` with causal repairs `035cf392...`, `0b8727e7...`, `58efe80d...`, `3cc041ee...`; doctoring inherited. | | GAP-125 | Exact `n=16` pair-distance result remained one ULP low on translated fallback; verification pending | RED `5da82b2d...` → repair `a509ae9e...` → CHANGELOG/research `3d2297c6...`; production bounded proof is `n=4..=16`. | -| #491 | Hard sample-count cutoff is an unmeasured resource budget; open | n=17 counterexample remains on fallback. `e476d66c...` separates resource envelopes; `c70210e3...` proves checked O(n) is a strict sufficient subset; `c6b237e0...` adds the measurable O(n)-fast-path/buffered-pair-fallback hybrid with admitted/refused path observability. Current authority `cd0f9a7b...`; production cutoff deliberately unchanged pending release-mode CPU/allocation/RSS, wider-reference, API p95, and exact-head gates/review. | +| #491 | Hard sample-count cutoff is an unmeasured resource budget; open | n=17 counterexample remains on fallback. `e476d66c...` separates arithmetic envelopes. RED `4f1bd2c...` → normalized characterization `d423b577...` removes a raw-scale refusal artifact; `4a3d9887...` adds corrected hybrid measurement geometries; `96f17c02...` checks restoration overflow. Current #488 authority `96f17c02...`; production cutoff deliberately unchanged pending release-mode CPU/allocation/RSS, wider-reference, API p95, and exact-head gates/review. | ## Release gate From 702fa5832162ac4b98bd92209852672da308ac1c Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sun, 6 Sep 2026 07:08:55 +0900 Subject: [PATCH 223/235] docs(delivery): inherit wider exact-proof resource evidence --- docs/product-technical-gap-baseline.md | 33 +++++++++++++------------- 1 file changed, 17 insertions(+), 16 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 0f31a7a16..c557b3a13 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-05T20:58:00Z +**Snapshot:** 2026-09-05T22:08:00Z **Protected-main evidence:** `a243f18da4a4ca8a8d068c39922537f1f8ed6ad0` **Workspace version:** `0.2.0` @@ -30,11 +30,11 @@ Passing, queued, skipped, or predecessor-head checks on an open PR never promote | PR / issue | Exact current evidence | Disposition | | --- | --- | --- | -| #488 | `96f17c02edba0792f61e0e92167703a6ae4e40d0`, Draft, base `main` | Validation Evidence landing vehicle on protected #490. GAP-125 keeps production exact pair-distance admission through `n=16`; #491 now normalizes the canonical dyadic unit before checked O(n) admission, retains an odd-diameter strict-subset counterexample, and measures normalized fast-path plus pair-fallback geometries without changing production behavior. Exact-head hosted workflows still require fresh GREEN/review evidence. | -| #491 | open | Replace the sample-count staircase with a measured exact-proof budget. The corrected hybrid measurement shape is encoded; still requires actual release-mode CPU/raw CSV, allocator/RSS, wider-reference assessment, exact-head gates/review, and applicable buyer-path p95 evidence. | +| #488 | `dd2b1c61626cbb13c0acd9ee90d7f0d87369d1b2`, Draft, base `main` | Validation Evidence landing vehicle on protected #490. GAP-125 keeps production exact pair-distance admission through `n=16`; #491 now has canonical-dyadic normalized narrow O(n), buffered/two-pass pair references, a dependency-free two-limb wider-product characterization, and a five-kernel hybrid measurement vehicle. Production behavior is unchanged pending measured resource and exact-head delivery evidence. | +| #491 | open | Replace the sample-count staircase with a measured exact-proof budget. Wider-product characterization proves one real 129-bit-intermediate cancellation without narrowing scientific admission; release-mode CPU/raw CSV, allocator/RSS, broader admitted/refused-set comparison, exact-head gates/review, and applicable buyer-path p95 remain required. | | #416 | `aa730c63563eb4a33048d822b581036c8487bd47`, Draft | Validation / Analysis Run landing vehicle. Generic cutoff-before-identity repair remains inherited; fold children keep unique source/tests/doctoring until conflict-resolving inheritance is verified. | | #310 | `c6680450152b1e0a2c9abb553772d74a23923335`, Draft | Longitudinal Modeling vehicle. Stable `Between` recovery is unit-level with canonical occasion `0`; `Within` retains actual occasion identity. Older base remains a non-destructive restack finding. | -| #480 | `5b2637f7b6142573ba1385a652c56632ecc9faa5`, Draft | contextual-orchestrator released-contract fail-closed integration vehicle. Mutable owner main remains evidence only. | +| #480 | `5b2637f7b6142573ba1385a652c56632ecc9faa5`, Draft | contextual-orchestrator released-contract fail-closed integration vehicle. Fresh owner evidence in the PR identifies contextual-orchestrator protected main `2e414d15ba58f28597751b625a8a2f00fc9fadcf` with zero GitHub releases; mutable owner main remains evidence only. | Exact-head evidence becomes stale after any source push. @@ -56,30 +56,31 @@ The clock contract separates event/valid time, assertion time, document time, sy - The `n=16` cutoff is an implementation/resource boundary, not a scientific boundary. #491 evidence demonstrates an exact `n=17` counterexample and algebraically equivalent O(n) numerator. Resource envelopes are implementation facts, not scientific cutoffs: at **canonical aligned** coefficient diameter `D=2^53` after shared power-of-two normalization, the normalized O(n) distribution-independent intermediate envelope fits through `n=2_047`, whereas the exact pair-square numerator extremum fits through `n=4_095`. Production admission remains `n<=16` until release-mode CPU/allocation and applicable buyer-path p95 evidence establish a budget. - Checked O(n) admission is defined on the canonical dyadic grid. Before judging integer overflow, the largest exact power-of-two factor common to all nonzero anchor-relative coefficients must be removed and restored exactly afterward. Raw-scale overflow is not a scientific/resource refusal when exact dyadic normalization removes it. - The predecessor `D=2^58,n=65` refusal is invalid and superseded. After dividing the shared `2^58` unit, coefficients are zero/one, the O(n) intermediates are `4_160` and `4_096`, and the normalized numerator `64` restores exactly to `2^122`; the linear/hybrid path must admit without pair fallback. -- The corrected checked O(n) `u128` identity is still a sufficient fast proof, not admission-equivalent to the checked pair reference. With one coefficient at zero and all remaining coefficients at **odd** `D=2^58+1`, the canonical shared dyadic unit is one. Both kernels admit `n=64`; at `n=65` the exact pair numerator `64D²` remains a 123-bit `u128`, while `65*64D²` requires 129 bits before cancellation. Therefore O(n) refusal must fall back to the pair proof or use separately justified wider checked integers; it must not become a scientific refusal. -- Restoring a normalized dyadic numerator must itself be overflow-checked. A valid shift count is not proof that high bits survive `u128::checked_shl`; the characterization uses checked multiplication by the exact squared unit and fails closed if restoration does not fit. -- Hybrid resource measurements must prove which path actually ran. The characterization CSV records `geometry`, normalized `unit_exponent`, and `used_pairwise_fallback`; `power_of_two_normalized_admit` (`D=2^58,n=65`) must report no fallback, while `odd_boundary_pair_fallback` (`D=2^58+1,n=65`) must confirm the buffered pair path and preserve the restored exact numerator. +- The corrected checked O(n) `u128` identity is still a sufficient fast proof, not admission-equivalent to the checked pair reference. With one coefficient at zero and all remaining coefficients at **odd** `D=2^58+1`, the canonical shared dyadic unit is one. Both kernels admit `n=64`; at `n=65` the exact pair numerator `64D²` remains a 123-bit `u128`, while both O(n) products require 129 bits before cancellation. Therefore narrow O(n) refusal must fall back to the pair proof or use separately justified wider checked integers; it must not become a scientific refusal. +- Dependency-free characterization `081000289f5a52e94863026d55696ee2a4daf923` demonstrates that a two-limb wider product/cancellation can recover that odd-boundary 123-bit exact pair numerator from the two 129-bit intermediates. It also fixes `(2^128-1)^2` exactly. This is bounded reference evidence only: normalized coefficient sums and square sums still accumulate in checked `u128`, so it is not arbitrary precision or proof of full-domain admission equivalence. +- Restoring a normalized dyadic numerator must itself be overflow-checked. A valid shift count is not proof that high bits survive a shift; restoration uses checked exact multiplication and fails closed if the represented numerator cannot be restored. +- Hybrid resource measurements must prove which path actually ran. Harness `0bd805d4b0304cf1f76344ae14b7f079b3dade17` compares buffered O(n²), allocation-free two-pass O(n²), normalized narrow O(n), the wider-product O(n) reference, and narrow O(n)→buffered-pair fallback. It requires restored-numerator equality before timing and records `geometry`, `kernel`, normalized `unit_exponent`, target pair-record layout/capacity/payload, and `used_pairwise_fallback`. - Generic Validation Evidence RMSE, Monte Carlo, Wilson, SE-aware acceptance, matching, durable evidence/provenance, serde and human projection retain GAP-045–091 contracts. Scientific failures are never hidden with skip/xfail/source rewriting/coverage exclusions. - Historical-cutoff admission occurs before duplicate-identity checks. Future-unavailable evidence cannot change an earlier run's conflicts, counts, or terminal state. - Supported temporal estimators require state/trajectory and claimed-structure recovery, bias/RMSE, interval coverage, convergence, uncertainty calibration, reproducibility, and leakage-safe rolling-origin evidence. CPU/GPU parity counts only when the relevant accelerator path actually runs. ## Current Validation Evidence repair and resource finding -#488 exact head `96f17c02edba0792f61e0e92167703a6ae4e40d0` inherits the full GAP-045–124 source/test/fixture/contract lineage and GAP-125's sixteen-observation repair. +#488 exact head `dd2b1c61626cbb13c0acd9ee90d7f0d87369d1b2` inherits the full GAP-045–124 source/test/fixture/contract lineage and GAP-125's sixteen-observation repair. GAP-125 public RED `5da82b2d651706c191ca191c6c077d916cbfda25` uses exact represented residuals `[314270929,327661307,371854441,398522837,413483290,416184956,565808551,682627163,724514517,731058943,740662035,970233120,1141566755,1320628283,1526331271,1992574092]`. Its 120 exact squared pair distances sum to `56_762_922_330_032_131_548`; denominator `16²×15=3_840`; gcd `12`; reduced radicand `4_730_243_527_502_677_629/320`. The predecessor translated floating moment/`sqrt` fallback returns adjacent lower `0x419c_fcbb_b78d_2ad4`, while exact midpoint comparison returns `0x419c_fcbb_b78d_2ad5`. Causal repair `a509ae9e46c8ffc2cc3ef4f0e904774ad2516e1f` advances only the existing bounded proof to `n=4..=16`. -Issue #491 characterization `757fb0e4770b24f73f301b336adfcf7f656dcea5` adds an exactly represented `n=17` fixture `[38557579,48779805,63558649,106352599,139863777,142786819,267163239,275103292,375678558,454709869,484300224,623646610,989643121,1027595814,1520220488,1569903156,1805452085]`. Its 136 exact pair squares sum to `92_549_865_125_191_410_206`; denominator `4_624`; gcd `2`; reduced radicand `46_274_932_562_595_705_103/2_312`. Current fallback returns `0x41a0_dd77_9ac3_8e98`; exact-rational evaluation gives adjacent `0x41a0_dd77_9ac3_8e99`. +Issue #491 retains the exactly represented `n=17` fixture `[38557579,48779805,63558649,106352599,139863777,142786819,267163239,275103292,375678558,454709869,484300224,623646610,989643121,1027595814,1520220488,1569903156,1805452085]`. Its 136 exact pair squares sum to `92_549_865_125_191_410_206`; denominator `4_624`; gcd `2`; reduced radicand `46_274_932_562_595_705_103/2_312`. Current fallback returns `0x41a0_dd77_9ac3_8e98`; exact-rational evaluation gives adjacent `0x41a0_dd77_9ac3_8e99`. -Commit `e476d66c99bef7d3e35b6a77374daeaa5fc59959` fixes exact pair counts in the Rust contract: 120 at `n=16`, 136 at `n=17`, 2,096,128 at `n=2,048`, and **4,997,541** at `n=3,162`. For canonical aligned diameter `D=2^53`, the normalized O(n) checked intermediate envelope `n²D²` fits through `n=2,047` and fails at `2,048`, but the exact pair-square numerator extremum `floor(n²/4)D²` fits through `n=4,095` and fails at `4,096`. The unreduced scientific denominator `n²(n-1)` stays at or below `2^53` through `n=208,064` and exceeds it at `208,065`; because production uses the GCD-reduced denominator, none of these values is a universal refusal count. +Resource arithmetic remains separated from scientific admission. Exact pair records are 120 at `n=16`, 136 at `n=17`, 2,096,128 at `n=2,048`, and **4,997,541** at `n=3,162`. For canonical aligned diameter `D=2^53`, the normalized narrow O(n) checked intermediate envelope `n²D²` fits through `n=2,047`, but the exact pair-square numerator extremum `floor(n²/4)D²` fits through `n=4,095`. The unreduced scientific denominator `n²(n-1)` stays at or below `2^53` through `n=208,064` and exceeds it at `208,065`; because production uses the GCD-reduced denominator, none of these values is a universal refusal count. -The predecessor admitted/refused-set fixture from `c70210e331ec096c90a42bec9de7d619bd51fe26` is superseded because it judged `D=2^58,n=65` on the raw integer scale. RED `4f1bd2c343cf2d54905a07c257a570a89dc575d3` exposes that representation-dependent refusal: exact common-unit normalization must make this geometry admit and recover `2^122`. Repair `d423b57797b6f7f127e61e0679f9ee9841525c77` factors the largest shared power-of-two unit before checked accumulation and replaces the refusal boundary with odd `D=2^58+1`, where no dyadic scale can be removed. The compact grids still require exact O(n)/O(n²) numerator equality whenever the linear path admits. +RED `4f1bd2c343cf2d54905a07c257a570a89dc575d3` and repair `d423b57797b6f7f127e61e0679f9ee9841525c77` remove the representation-dependent raw `D=2^58,n=65` refusal by normalizing the common dyadic unit. Final narrow-reference hardening `96f17c02edba0792f61e0e92167703a6ae4e40d0` makes restored-scale overflow fail closed. The valid strict-subset geometry is odd `D=2^58+1,n=65`: the pair numerator remains a 123-bit `u128`, while the normalized narrow O(n) products require 129 bits before cancellation. -The predecessor hybrid harness `c6b237e0bb1388cccd7bcb71a0df5cbf837a07c5` is likewise superseded at its raw-scale boundary. Harness repair `4a3d988702593b2b8d59be6dcfb1601ca1a0d610` compares buffered O(n²), allocation-free two-pass O(n²), normalized checked O(n), and normalized `O(n) -> buffered pair fallback`. It requires exact restored-numerator equality before timing and distinguishes `power_of_two_normalized_admit` (`D=2^58,n=65`, no fallback), `odd_boundary_admit` (`D=2^58+1,n=64`), and `odd_boundary_pair_fallback` (`D=2^58+1,n=65`, fallback required). `736bc8ddaec067615bedc387939f4650517d9ea1` keeps the harness type surface/clippy shape compact. Final characterization commit `96f17c02edba0792f61e0e92167703a6ae4e40d0` makes squared-unit restoration overflow fail closed with checked multiplication. +Characterization `081000289f5a52e94863026d55696ee2a4daf923` adds a dependency-free two-limb `Wide256` reference for exactly those wider products and checked cancellation. It recovers the odd-boundary exact pair numerator without changing the existing pair-reference scientific meaning. Harness `0bd805d4b0304cf1f76344ae14b7f079b3dade17` measures the wider reference beside the four existing resource shapes and makes the narrow-refusal/wider-recovery/pair-fallback distinction executable. -CHANGELOG `08b8224e32eb2712214b5d710a269be972843b36`, research/TRACEABILITY `55bb8103353fd2b960a12f8d245efea23f3a2963`, Test Strategy `81708abeb9625e6aaac6ffd5bb675344cc216523`, and Operability `ee3a0f865265c888788147b7eec2a240a5484f1e` carry the corrected finding through #488 current authority `96f17c02edba0792f61e0e92167703a6ae4e40d0`. +CHANGELOG `8ec2092872edc2867652ce98313ebad9deabd5ba`, research/TRACEABILITY `61acee8d3c1f5cf1014afddb673277a6fda86305`, Test Strategy `a71b55c4f9b1a52a8060677e14c1828fec2f325f`, and Operability `dd2b1c61626cbb13c0acd9ee90d7f0d87369d1b2` carry the finding through #488 current authority `dd2b1c61626cbb13c0acd9ee90d7f0d87369d1b2`. -No release-mode timing result, allocator/RSS record, wider-reference assessment, applicable buyer-path p95, or exact-head hosted GREEN is claimed. The current local execution environment has no Rust 1.98.0 toolchain; the hosted current-head gates and independent review must be observed fresh before any delivery transition. The next production decision must use measured evidence, not `2,047`, `4,095`, `208,064`, or the next integer sample count as a proxy for a resource budget. +No release-mode timing result, allocator/RSS record, applicable buyer-path p95, exact-head hosted GREEN, or qualifying independent review is claimed. The current local execution environment has no Rust 1.98.0 toolchain. The next production decision must use recorded release-mode CPU/raw CSV/RSS plus wider-reference admitted/refused-set evidence across sample count, canonical dyadic exponent spread/diameter, and coefficient distribution; `2,047`, `4,095`, `208,064`, or the next integer sample count is not a resource budget. ## Gap register @@ -90,8 +91,8 @@ No release-mode timing result, allocator/RSS record, wider-reference assessment, | GAP-092–110 | Represented residual subtraction, translated-moment, rational-scale, anchor, three-level and subnormal correctness sequence; verification pending | Exact RED→repair lineages and public contracts remain inherited on #488. | | GAP-111–120 | Exact pair-distance/midpoint proof introduced and extended through `n=11`; verification pending | Exact RED→repair/test/research lineages remain inherited. | | GAP-121–124 | Exact pair-distance proof extended through `n=12..15`; verification pending | REDs `b6ac1117...`, `369af46d...`, `db403976...`, `1c8a7ced...` with causal repairs `035cf392...`, `0b8727e7...`, `58efe80d...`, `3cc041ee...`; doctoring inherited. | -| GAP-125 | Exact `n=16` pair-distance result remained one ULP low on translated fallback; verification pending | RED `5da82b2d...` → repair `a509ae9e...` → CHANGELOG/research `3d2297c6...`; production bounded proof is `n=4..=16`. | -| #491 | Hard sample-count cutoff is an unmeasured resource budget; open | n=17 counterexample remains on fallback. `e476d66c...` separates arithmetic envelopes. RED `4f1bd2c...` → normalized characterization `d423b577...` removes a raw-scale refusal artifact; `4a3d9887...` adds corrected hybrid measurement geometries; `96f17c02...` checks restoration overflow. Current #488 authority `96f17c02...`; production cutoff deliberately unchanged pending release-mode CPU/allocation/RSS, wider-reference, API p95, and exact-head gates/review. | +| GAP-125 | Exact `n=16` pair-distance result remained one ULP low on translated fallback; verification pending | RED `5da82b2d...` → repair `a509ae9e...`; production bounded proof is `n=4..=16`. | +| #491 | Hard sample-count cutoff is an unmeasured resource budget; open | n=17 counterexample remains on fallback. Canonical-dyadic normalization removes the false common-power refusal; odd `D=2^58+1,n=65` proves narrow O(n) refusal is not scientific refusal. `081000289...` adds a bounded two-limb wider-product recovery and `0bd805d4...` adds five-kernel measurement. Current #488 authority `dd2b1c61...`; production cutoff deliberately unchanged pending release-mode CPU/allocation/RSS, broader wider-reference sweep, API p95 where applicable, and exact-head gates/review. | ## Release gate From ba6bc7451ebf2e2b38e83a14219dba4684c9f54c Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sun, 6 Sep 2026 07:10:50 +0900 Subject: [PATCH 224/235] docs(delivery): correct direct orchestrator owner evidence --- docs/product-technical-gap-baseline.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index c557b3a13..2a67cd8ce 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-05T22:08:00Z +**Snapshot:** 2026-09-05T22:11:00Z **Protected-main evidence:** `a243f18da4a4ca8a8d068c39922537f1f8ed6ad0` **Workspace version:** `0.2.0` @@ -34,7 +34,7 @@ Passing, queued, skipped, or predecessor-head checks on an open PR never promote | #491 | open | Replace the sample-count staircase with a measured exact-proof budget. Wider-product characterization proves one real 129-bit-intermediate cancellation without narrowing scientific admission; release-mode CPU/raw CSV, allocator/RSS, broader admitted/refused-set comparison, exact-head gates/review, and applicable buyer-path p95 remain required. | | #416 | `aa730c63563eb4a33048d822b581036c8487bd47`, Draft | Validation / Analysis Run landing vehicle. Generic cutoff-before-identity repair remains inherited; fold children keep unique source/tests/doctoring until conflict-resolving inheritance is verified. | | #310 | `c6680450152b1e0a2c9abb553772d74a23923335`, Draft | Longitudinal Modeling vehicle. Stable `Between` recovery is unit-level with canonical occasion `0`; `Within` retains actual occasion identity. Older base remains a non-destructive restack finding. | -| #480 | `5b2637f7b6142573ba1385a652c56632ecc9faa5`, Draft | contextual-orchestrator released-contract fail-closed integration vehicle. Fresh owner evidence in the PR identifies contextual-orchestrator protected main `2e414d15ba58f28597751b625a8a2f00fc9fadcf` with zero GitHub releases; mutable owner main remains evidence only. | +| #480 | `5b2637f7b6142573ba1385a652c56632ecc9faa5`, Draft | contextual-orchestrator released-contract fail-closed integration vehicle. Fresh direct owner ref is contextual-orchestrator `main@a080297d2546bb61e89520d637cabc202db331ec` with zero GitHub releases; a predecessor PR-body observation of `2e414d15...` was stale and is superseded. Mutable owner main remains evidence only. | Exact-head evidence becomes stale after any source push. From ac89c75031bdd238339edfe9fc3c0115039d3850 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sun, 6 Sep 2026 08:04:46 +0900 Subject: [PATCH 225/235] docs(gap): correct validation proof resource bound --- docs/product-technical-gap-baseline.md | 25 +++++++++++++------------ 1 file changed, 13 insertions(+), 12 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 2a67cd8ce..3b2e08f38 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ **Status:** Active delivery recovery **Product:** Temporal Event Psychometrics Platform (TEPP) -**Snapshot:** 2026-09-05T22:11:00Z +**Snapshot:** 2026-09-05T22:55:41Z **Protected-main evidence:** `a243f18da4a4ca8a8d068c39922537f1f8ed6ad0` **Workspace version:** `0.2.0` @@ -30,8 +30,8 @@ Passing, queued, skipped, or predecessor-head checks on an open PR never promote | PR / issue | Exact current evidence | Disposition | | --- | --- | --- | -| #488 | `dd2b1c61626cbb13c0acd9ee90d7f0d87369d1b2`, Draft, base `main` | Validation Evidence landing vehicle on protected #490. GAP-125 keeps production exact pair-distance admission through `n=16`; #491 now has canonical-dyadic normalized narrow O(n), buffered/two-pass pair references, a dependency-free two-limb wider-product characterization, and a five-kernel hybrid measurement vehicle. Production behavior is unchanged pending measured resource and exact-head delivery evidence. | -| #491 | open | Replace the sample-count staircase with a measured exact-proof budget. Wider-product characterization proves one real 129-bit-intermediate cancellation without narrowing scientific admission; release-mode CPU/raw CSV, allocator/RSS, broader admitted/refused-set comparison, exact-head gates/review, and applicable buyer-path p95 remain required. | +| #488 | `dbd55e2c8dc4ee6ce06fd39c6d3d7e25874c90b2`, Draft, base `main` | Validation Evidence landing vehicle on protected #490. GAP-125 keeps production exact pair-distance admission through `n=16`; #491 now has canonical-dyadic normalized narrow O(n), buffered/two-pass pair references, a dependency-free two-limb wider-product characterization, an executable accumulator-bound theorem, and a five-kernel measurement vehicle. Production behavior is unchanged pending measured resource and exact-head delivery evidence. | +| #491 | open | Replace the sample-count staircase with a measured exact-proof budget. Canonical coefficients satisfy `Σc_i <= Σc_i² <= Σ(i Wide256 O(n) -> pairwise fail-closed fallback`. Release-mode CPU/raw CSV, allocator/RSS, represented-input admission comparison, exact-head gates/review, and applicable buyer-path p95 remain required. | | #416 | `aa730c63563eb4a33048d822b581036c8487bd47`, Draft | Validation / Analysis Run landing vehicle. Generic cutoff-before-identity repair remains inherited; fold children keep unique source/tests/doctoring until conflict-resolving inheritance is verified. | | #310 | `c6680450152b1e0a2c9abb553772d74a23923335`, Draft | Longitudinal Modeling vehicle. Stable `Between` recovery is unit-level with canonical occasion `0`; `Within` retains actual occasion identity. Older base remains a non-destructive restack finding. | | #480 | `5b2637f7b6142573ba1385a652c56632ecc9faa5`, Draft | contextual-orchestrator released-contract fail-closed integration vehicle. Fresh direct owner ref is contextual-orchestrator `main@a080297d2546bb61e89520d637cabc202db331ec` with zero GitHub releases; a predecessor PR-body observation of `2e414d15...` was stale and is superseded. Mutable owner main remains evidence only. | @@ -57,16 +57,17 @@ The clock contract separates event/valid time, assertion time, document time, sy - Checked O(n) admission is defined on the canonical dyadic grid. Before judging integer overflow, the largest exact power-of-two factor common to all nonzero anchor-relative coefficients must be removed and restored exactly afterward. Raw-scale overflow is not a scientific/resource refusal when exact dyadic normalization removes it. - The predecessor `D=2^58,n=65` refusal is invalid and superseded. After dividing the shared `2^58` unit, coefficients are zero/one, the O(n) intermediates are `4_160` and `4_096`, and the normalized numerator `64` restores exactly to `2^122`; the linear/hybrid path must admit without pair fallback. - The corrected checked O(n) `u128` identity is still a sufficient fast proof, not admission-equivalent to the checked pair reference. With one coefficient at zero and all remaining coefficients at **odd** `D=2^58+1`, the canonical shared dyadic unit is one. Both kernels admit `n=64`; at `n=65` the exact pair numerator `64D²` remains a 123-bit `u128`, while both O(n) products require 129 bits before cancellation. Therefore narrow O(n) refusal must fall back to the pair proof or use separately justified wider checked integers; it must not become a scientific refusal. -- Dependency-free characterization `081000289f5a52e94863026d55696ee2a4daf923` demonstrates that a two-limb wider product/cancellation can recover that odd-boundary 123-bit exact pair numerator from the two 129-bit intermediates. It also fixes `(2^128-1)^2` exactly. This is bounded reference evidence only: normalized coefficient sums and square sums still accumulate in checked `u128`, so it is not arbitrary precision or proof of full-domain admission equivalence. +- Dependency-free characterization `081000289f5a52e94863026d55696ee2a4daf923` demonstrates that a two-limb wider product/cancellation can recover that odd-boundary 123-bit exact pair numerator from the two 129-bit intermediates. It also fixes `(2^128-1)^2` exactly. This is characterization evidence, not arbitrary precision or production authority. +- Accumulator-bound characterization `b7e4da353ac58069afd73ee7c0e8427d49993fdb` proves that after canonical minimum anchoring all coefficients are nonnegative integers with at least one zero, so `Σc_i <= Σc_i² <= Σ(i