fix(validation): preserve representable recovery metrics

[seonghobae]

Validation Evidence authority

Protected base is main@a243f18da4a4ca8a8d068c39922537f1f8ed6ad0. This Draft remains the owner-correct Validation Evidence landing vehicle. Production validation_core::bias_standard_error exact pair-distance admission remains deliberately bounded to n=4..=16; issue #491 owns the resource-budget decision rather than another sample-count staircase patch.

GAP-125 remains the latest production behavior repair: RED 5da82b2d651706c191ca191c6c077d916cbfda25 → causal repair a509ae9e46c8ffc2cc3ef4f0e904774ad2516e1f. The exact pair-distance proof keeps exact residual/pairwise subtraction, checked dyadic/u128 construction, n²(n-1) denominator, GCD reduction, exact candidate/adjacent-midpoint comparison, and fail-closed fallback.

#491 exact-proof resource characterization

Common dyadic normalization remains mandatory. The superseded raw D=2^58,n=65 refusal is representation-dependent; after removing the shared unit the narrow O(n) path admits and restores exact numerator 2^122. The valid narrow strict-subset boundary is odd D=2^58+1,n=65, where the pair numerator is 123 bits but the two narrow O(n) products require 129 bits before cancellation.

Characterization 081000289f5a52e94863026d55696ee2a4daf923 provides the dependency-free two-limb Wide256 reference. Characterization b7e4da353ac58069afd73ee7c0e8427d49993fdb proves Σc_i <= Σc_i² <= Σ(i<j)(c_i-c_j)² for canonical anchor-relative coefficients, so pair-admitted accumulator overflow is not a valid wider-path refusal hypothesis.

RED 3136739460ef0c8e13c044a7e5b04891e4f4e23d required the missing narrow O(n) -> Wide256 O(n) -> pairwise fail-closed fallback; repair ce4ed2722e160eb0ca0ee2d636a5eca55e3ff2d5 adds that route to crates/validation_core/examples/bias_se_exact_proof_budget.rs. The predecessor narrow→pair hybrid remains a comparison baseline. The harness independently records used_wide_product and used_pairwise_fallback and requires exact restored-numerator equality before timing.

RED f74d9ac11cb0acf3eb8fdd9ad79ac3d2e9180993 required a proof that canonical pair admission implies sufficient Wide256 product width; repair e9a7dee29afb97542bfe2965f850c8ab5a34368e adds it to bias_standard_error_wide_linear_admission_bound_characterization.rs. If P <= u128::MAX, then S1 <= S2 <= P, while supported sample count converts from usize to u128; both cancellation products are exact u128 × u128 products and fit two u128 limbs. Product width alone therefore cannot make Wide256 refuse a coefficient set admitted by the u128 pair proof.

This still does not authorize deleting pair fallback or widening production admission. Represented-residual conversion, canonical normalization, full-width subtraction, dyadic restoration, reduced denominator/midpoint rounding, release-mode resource evidence, and exact-head execution must demonstrate end-to-end equivalence first.

Hosted RED and causal repair state

Rust Foundation run 34004656803 on prior source head 26d727ae10a70f9798f8c9f4a30a0e745dea56bc produced three current causal findings rather than a numerical-acceptance failure:

• Repository contracts/Python branch coverage still failed exactly the obsolete local-cron assertion inherited from protected-main fix(actions): centralize hourly development admission #490. Direct foundation repair is fix(actions): align central hourly admission contracts #492; fix(validation): preserve representable recovery metrics #488 does not restore the cron.
• Production coverage reached stable/nightly compilation and found three integration-test crates missing crate-level rustdoc: bias_standard_error_pairwise_subtraction_roundoff_contract.rs, wilson_all_covered_extreme_z_contract.rs, and bias_standard_error_two_level_integer_divisor_rounding_contract.rs. Commit 1f765a7430b3263afb7e436efdf6d3f14dd433c9 adds substantive //! contract documentation to all three atomically, without allow(missing_docs), skip, xfail, or denominator exclusion.
• Format/lint/test/rustdoc/dependency policy still stops at Rust 1.98.0 cargo fmt --all -- --check. The pinned read-only formatter run 34004539628 at source-relevant head e9a7dee29afb97542bfe2965f850c8ab5a34368e has now produced artifact 9981126289, digest sha256:94dc827376d0ab411af1be1eb309d29f3fe305bb3ac52fcda777d51bee756d9e, containing rustfmt.patch, a formatted 38-file tree, and the exact file list. Subsequent commits through the previous head changed only the Wide256 CHANGELOG/research docs; the current head additionally changes crate-level documentation in three tests, one of which overlaps that formatter tree and must preserve the new crate doc when the canonical tree is applied. The formatter delta is therefore actionable evidence, but it has not yet been applied and the format gate is not GREEN.

On the same prior head, Live PostgreSQL, Documentation Quality, SAST Semgrep, and Security Scan were GREEN. CodeQL entered the central exact-head dispatch handshake: language detection and dispatch succeeded, then compatibility shards failed intentionally with VERDICT_STATE=pending pending authenticated central verdict/rerun. That state is neither a SARIF finding nor GREEN.

Current exact source head is 1f765a7430b3263afb7e436efdf6d3f14dd433c9. Fresh Rust Foundation 34009380827, Documentation Quality 34009380841, SAST 34009380811, Security Scan 34009380833, and CodeQL 34009380807 are queued/current-head work and are not counted GREEN until terminal conclusions are available. The repository-contract lane remains prerequisite-bound on #492; the rustfmt lane remains local to #488.

The canonical docs/TRACEABILITY.md still lacks a direct #491 resource-route row. Research traceability and CHANGELOG are current through the Wide256 product-capacity proof, but the canonical matrix gap is retained rather than misreported as complete. docs/product-technical-gap-baseline.md on #435 also requires another code-current sync after these exact-head repairs.

Merge policy

Draft status is retained. No force push, destructive rebase, self-approval, required-gate weakening, mutable sibling dependency, routine admin bypass, or fabricated benchmark/CI evidence is authorized. #492 must land through normal protected-main review/Checks before its central-admission correction is considered inherited by this PR. Production admission remains n=4..=16.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}