fix(validation): preserve representable recovery metrics

.github/workflows/validation-rustfmt-evidence.yml

@@ -0,0 +1,49 @@
+name: Validation Rustfmt Evidence
+
+on:
+  push:
+    branches:
+      - fix/validation-bias-overflow-safe-mean
+    paths:
+      - "crates/**"
+      - ".github/workflows/validation-rustfmt-evidence.yml"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: validation-rustfmt-evidence-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  format:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Checkout exact branch head
+        uses: actions/checkout@631c942040754b6e095e929c1677c07e10ed4f87
+        with:
+          persist-credentials: false
+      - name: Install pinned Rust formatter
+        run: rustup toolchain install 1.98.0 --profile minimal --component rustfmt
+      - name: Materialize canonical rustfmt output
+        run: |
+          set -euo pipefail
+          cargo +1.98.0 fmt --all
+          git diff --check
+          git diff --binary > "${RUNNER_TEMP}/rustfmt.patch"
+          git diff --name-only --diff-filter=ACM -z | tar --null -T - -cf "${RUNNER_TEMP}/rustfmt-tree.tar"
+          git diff --name-only --diff-filter=ACM > "${RUNNER_TEMP}/rustfmt-files.txt"
+          test -s "${RUNNER_TEMP}/rustfmt.patch"
+          test -s "${RUNNER_TEMP}/rustfmt-files.txt"
+      - name: Upload immutable formatting evidence
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: validation-rustfmt-${{ github.sha }}
+          path: |
+            ${{ runner.temp }}/rustfmt.patch
+            ${{ runner.temp }}/rustfmt-tree.tar
+            ${{ runner.temp }}/rustfmt-files.txt
+          retention-days: 1
+          if-no-files-found: error
+          compression-level: 0

CHANGELOG.d/validation-bias-cancellation-roundoff.md

@@ -0,0 +1,3 @@
+### Fixed
+
+- Validation Evidence mean-bias accumulation now retains error-free low terms from opposite-sign cancellation before scale reduction. Repeated sub-ULP residuals can therefore contribute when their combined represented mass changes the final bias, while exact cancellation and fail-closed unrepresentable results keep their existing semantics.

CHANGELOG.d/validation-bias-compensated-division.md

@@ -0,0 +1,3 @@
+- Preserve mixed-sign Validation Evidence mean-bias compensation through the original scientific denominator so a correctly retained low term is not rounded into the numerator and lost again before division.
+- Add a public mirrored contract for the represented residual boundary `[2^-53, -2^-52, -(1 + 2^-52)]`, whose exact mean rounds to `±0x1.5555555555557p-2`.
+- Keep same-sign arithmetic, reusable psychometric estimation ownership, and `bias_standard_error` unchanged.

CHANGELOG.d/validation-bias-exact-proof-budget-characterization.md

@@ -0,0 +1,17 @@
+# Validation bias-SE exact-proof budget characterization
+
+- Correct the pair-record resource evidence for 3,162 observations to 4,997,541 records and lock exact pair counts in a Rust characterization contract.
+- Distinguish the current minimum-shifted O(n) `u128` intermediate envelope (`n=2,047` at aligned diameter `2^53`) from the wider exact pair-square numerator envelope (`n=4,095` for the same diameter); neither is a production sample-count budget.
+- Normalize the shared power-of-two dyadic unit before judging checked O(n) intermediates. The former `D=2^58, n=65` refusal was a characterization artifact: factoring the common `2^58` unit reduces the aligned coefficients to zero/one and preserves the exact restored numerator `2^122` without pair fallback.
+- Preserve the non-equivalence finding with a normalized counterexample rather than the raw-scale artifact. With one zero and the remaining coefficients at odd diameter `D=2^58+1`, the common dyadic unit is one; both pair and narrow O(n) kernels fit at `n=64`, while at `n=65` the exact pair numerator still fits `u128` but the narrow O(n) products require 129-bit intermediates before cancellation.
+- Record the canonical accumulator bound `Σc_i <= Σc_i² <= Σ(i<j)(c_i-c_j)²` for the earlier nonnegative minimum-anchor characterization; pair-admitted coefficient-sum or square-sum overflow is not a valid wider-path refusal hypothesis. Remaining wider-path refusal analysis belongs to full-width product/subtraction, scale restoration, denominator/midpoint proof, or upstream represented-input admission.
+- Add a dependency-free two-limb `Wide256` O(n) reference and a measured candidate route `narrow O(n) -> Wide256 O(n) -> buffered pair fail-closed fallback`. RED `3136739460ef0c8e13c044a7e5b04891e4f4e23d` requires the missing route; repair `ce4ed2722e160eb0ca0ee2d636a5eca55e3ff2d5` implements it and records both wide-product selection and pairwise fallback separately in CSV.
+- The corrected harness keeps the existing narrow-to-pair hybrid for comparison. On odd `D=2^58+1, n=65`, that predecessor hybrid still allocates the pair buffer, while the new narrow-to-wide-to-pair candidate must recover the same exact numerator through `Wide256` with `used_wide_product=true` and `used_pairwise_fallback=false`. Power-of-two-normalized `n=65` and odd `n=64` remain narrow-path admissions.
+- Represented-input equivalence distinguishes proof admission from public numerical correctness. Characterization `2bc1d2284d75154e020640adb573c1cfadf005fb` uses residuals `[0,1,2^-54,2]`: every neutral-zero coordinate is exact, but `1 - 2^-54` rounds in binary64, so the O(n²) pairwise-f64 proof refuses. On common unit `2^-54`, integer coordinates `[0,2^54,1,2^55]` give exact pair numerator `3569704090242693886528325169446915`; the generic fallback happens to return the correct public value.
+- Add source-level RED `fd9f9ff2c5c395e4cc13042232f4deef018adb48` for residuals `[0,1,2,-2^53]`. The minimum residual cannot exactly translate `1`, while neutral zero preserves every coordinate. Signed unit-one coordinates give `P=243388915243820099130562543878155`, so `SE(mean)^2=P/48`; the predecessor translated floating-moment path returns `0x4320000000000000` while exact rounding requires adjacent `0x4320000000000001`. Its Actions runs were cancelled by the immediate repair push and are not hosted RED evidence.
+- Initial production repair `81ba770cc4812c8fbeb4b3529f0a73b41abbed0f` kept pairwise exact accumulation first and searched represented residual anchors. Follow-up RED `9f403194a2ec1636531c2dfe9229cfb34b73d747` showed that observed anchors alone are incomplete: residuals `[1,2^-54,2,3]` have no observed universal exact anchor, while neutral dyadic anchor `0` preserves all coordinates. On unit `2^-54`, `P=6490371073168534319490338297741315`; exact rounding requires `0x3fe4a7e9cb8a3491`, while the predecessor translated floating-moment fallback returns adjacent `0x3fe4a7e9cb8a3492`.
+- Repair `6cf30eeb549c0df0377bda1111cf46396e8282a3` temporarily included neutral zero plus represented residuals in a deterministic exact-anchor set and reused signed dyadic/Wide256 cancellation plus the exact midpoint rounder. That closed the demonstrated correctness defects but retained O(n²) anchor scanning.
+- Source-level route-order RED `e0b324864e48a503e2aba0d2a487a0b95f5276ed` required production to attempt `neutral_zero_linear` before quadratic proofs. Repair `2b62bd46eb0c391327d2285c2244a76f5a1e0449` added a two-pass neutral-zero signed-dyadic/Wide256 kernel, O(n) in time with O(1) proof storage after the residual vector. The superseded RED did not finish a hosted failing run and is not claimed as hosted RED evidence.
+- A later retention criterion required the conditioned observed-anchor fallback to prove unique bounded admission after neutral-zero refusal. The checked-in corpus supplied no such represented fixture. RED `d40bfbf98b36562164d15d505f8f8825fd1c1349` and repair `14e7862f4ddccce54f3b93d4dac89adbf047ba77` therefore remove that unsupported O(n²) route. Production order is now `neutral_zero_linear -> pairwise_reference -> generic_fallback`; this is evidence-based consolidation, not a theorem that pairwise is globally redundant.
+- Intermediate commit `da703fc50e136ed79e12262909c9f400a3945621` replaced the stale minimum-anchor helper but copied production `Wide256`, dyadic parsing, scaling, and neutral-zero arithmetic into the integration characterization and described `n=17..2050` as production-aligned despite the production `n=4..=16` admission. Repair `43d208383b765a3424019de45530af77ca484d78` removes that source copy: admitted `n=4` and `n=16` families now use an independent `i128/u128` direct pair-distance oracle plus audited output bits, forward/reversed/rotated order invariance is checked through the public API, and `[-2^53,0,1,2^53]` remains the neutral-zero-only admission witness with `P=2^109+3` and bits `0x432a20bd700c2c3e`. Wider `n>16` evidence remains characterization-only rather than a production-route test.
+- Keep production `bias_standard_error` sample admission unchanged at `n=4..=16`. A budget change beyond 16 still requires broad pair/neutral-zero same-domain equivalence, truthful production route evidence, recorded Rust 1.98.0 release-mode CPU/raw CSV and allocator/RSS evidence, applicable buyer-path p95 evidence, exact-head Rust/rustdoc/100% line+branch/security/documentation GREEN, current TRACEABILITY/research/operator doctoring, and qualifying independent current-head review.

CHANGELOG.d/validation-bias-overflow-safe-mean.md

@@ -0,0 +1,5 @@
+### Fixed
+
+- `validation_core::mean_bias` now computes finite signed residual means without allowing either raw-sum overflow or largest-scale normalization to erase a representable low-order bias after extreme mixed-sign cancellation. Opposite signs cancel at represented magnitude first; the remaining one-sign mass is power-of-two normalized and divided by the original recovery denominator before scale restoration.
+- `validation_core::bias_standard_error` reuses the same stable bias mean and scales deviations before squaring, forming the SEM directly rather than materializing an avoidably overflowing raw square sum or sample variance. Constant extreme finite bias retains its exact zero standard error, and representable non-constant extreme cases remain measurable.
+- Exact cancellation remains zero; a mathematically non-zero mean or standard error that would become false zero only because it falls below binary64 range fails closed rather than being reported as perfect recovery.

CHANGELOG.d/validation-bias-overflowing-residual-cancellation.md

@@ -0,0 +1,3 @@
+### Fixed
+
+- Preserve a representable mean signed bias when individual `recovered - truth` residuals overflow but opposing represented input terms cancel. The fallback keeps the original paired-observation denominator, preserves minimum-subnormal results after extreme cancellation, and still fails closed when the final mean bias itself is unrepresentable.

CHANGELOG.d/validation-bias-pairwise-subtraction-roundoff.md

@@ -0,0 +1,3 @@
+### Fixed
+
+- Preserve represented low-order mass when a finite `recovered - truth` subtraction rounds before mean-bias aggregation. `mean_bias` now detects nonzero error-free subtraction roundoff and switches that case to the existing recovered-plus-negated-truth numerator, while mixed-sign mean restoration retains a second-order compensation tail through the scientific denominator and final binary64 midpoint decision. This prevents pairwise subtraction and compensation rounding from moving a representable bias by one ULP without changing the exact-subtraction fast path, overflow refusal policy, or `bias_standard_error` contract.

CHANGELOG.d/validation-bias-same-sign-remainder-division.md

@@ -0,0 +1,3 @@
+### Validation
+
+- Preserve Neumaier compensation through the scientific count division when exact mixed-sign cancellation leaves a same-sign remainder. This prevents a represented-input mean bias from moving by one ULP because `sum + correction` was rounded before division. The public regression contract covers the sign-mirrored boundary as well.

CHANGELOG.d/validation-bias-same-sign-subnormal-double-rounding.md

@@ -0,0 +1,5 @@
+# Validation bias same-sign subnormal single rounding
+
+- `validation_core::mean_bias` now rounds same-sign all-subnormal represented residuals once at the final binary64 subnormal grid when the scientific divisor is at least the surviving term count.
+- The public contract fixes the three-residual case `(3 * 2^52 - 64) / 3`, which must round to subnormal units `2^52 - 21` rather than the adjacent `2^52 - 22` produced by normalize-then-rescale double rounding.
+- Halfway cases use IEEE 754 round-to-nearest, ties-to-even on exact represented subnormal units; a companion fixture prevents the discarded direct-float repair from reintroducing a one-ULP halfway error.

CHANGELOG.d/validation-bias-standard-error-anchor-conditioning.md

@@ -0,0 +1,3 @@
+### Fixed
+
+- Preserve exact translated-residual `bias_standard_error` conditioning when several exact anchors exist. The Validation Evidence path now chooses the exact anchor with the smallest maximum translated magnitude and uses canonical represented `(high, low)` ordering only as a tie-breaker, preventing an avoidable one-ULP square/square-root drift while retaining permutation invariance and the existing exactness admission boundary.

CHANGELOG.d/validation-bias-standard-error-anchor-permutation.md

@@ -0,0 +1,4 @@
+### Fixed
+
+- `validation_core::bias_standard_error` now searches exact translated-residual anchors in canonical represented `(high, low)` order instead of making the first observation authoritative. This preserves permutation invariance when one represented anchor admits exact deltas but another anchor would force the rounded-residual fallback.
+- The public regression contract fixes a three-residual boundary whose low- and high-anchor permutations previously returned the adjacent lower binary64 standard error while the middle anchor returned the correctly rounded represented-input result. Sign-mirrored orderings are covered as well.

CHANGELOG.d/validation-bias-standard-error-common-high-mean-roundoff.md

@@ -0,0 +1,5 @@
+# Validation bias standard error preserves common-high low-term dispersion
+
+- When every rounded signed residual collapses to the same binary64 high part, evaluate the subtraction low-term dispersion with the exact translated-residual second moment whenever its anchor-relative deltas are exactly representable.
+- Prevent low terms such as `[-2^-54, 0, 0]` from being re-centered on a rounded low-term mean and moving the final standard error one ULP upward.
+- Retain the predecessor scaled low-term path only when exact translation cannot be established; this is a bounded represented-input repair, not a global correct-rounding claim.

CHANGELOG.d/validation-bias-standard-error-distinct-high-roundoff.md

@@ -0,0 +1,5 @@
+# Validation bias standard error retains distinct residual roundoff
+
+- Preserve error-free subtraction low terms when represented bias residual high parts differ but their anchor-relative exact deltas are representable.
+- Evaluate the translation-invariant second moment of those exact deltas in O(n), avoiding a rounded-residual standard error that can materially overstate uncertainty.
+- Keep the predecessor rounded-residual path when exact translated deltas cannot be established without another rounding step; this change does not claim globally correctly rounded standard errors.

CHANGELOG.d/validation-bias-standard-error-dyadic-two-level-count.md

@@ -0,0 +1,4 @@
+### Fixed
+
+- `validation_core::bias_standard_error` now preserves an exactly translated two-level sample's count geometry when its standard-error factor reduces to a reciprocal power of two. For the 6/10 split of 16 observations, `SE(mean)` is exactly `|level_gap| / 8`; the represented `next_down(1.0)` gap therefore remains `0x3fbf_ffff_ffff_ffff` instead of being rounded up to `0.125` by the generic sum/square/square-root path.
+- The dyadic shortcut is admitted only after exact residual translation and exact integer count verification. Other non-singleton two-level samples retain the existing translated second-moment path, and a mathematically nonzero dyadic result that falls below binary64 range still fails closed.

CHANGELOG.d/validation-bias-standard-error-eight-observation-pair-distance.md

@@ -0,0 +1,2 @@
+- Validation Evidence now admits the exact pair-distance identity for bounded eight-observation mean-bias standard errors when represented residuals and pairwise differences are proven exact and the reduced dyadic ratio fits the existing checked `u128` midpoint proof.
+- This prevents the translated floating moment/`sqrt` fallback from moving a demonstrated exact represented-input eight-observation standard error one ULP high, while retaining the established fallback outside the bounded proof.

CHANGELOG.d/validation-bias-standard-error-eleven-observation-pair-distance.md

@@ -0,0 +1,2 @@
+- Validation Evidence now admits the exact pair-distance identity for bounded eleven-observation mean-bias standard errors when represented residuals and pairwise differences are proven exact and the reduced dyadic ratio fits the existing checked `u128` midpoint proof.
+- This prevents the translated floating moment/`sqrt` fallback from moving a demonstrated exact represented-input eleven-observation standard error one ULP low, while retaining the established fallback outside the bounded proof.

CHANGELOG.d/validation-bias-standard-error-exact-proof-budget.md

@@ -0,0 +1,4 @@
+- Add exact-proof budget characterization for mean-bias standard error: a seventeen-observation represented-input fixture, O(n²) versus algebraically equivalent O(n) checked-`u128` numerator evidence, and the compact-dyadic `n<=2_047` worst-case arithmetic envelope.
+- Add a reproducible standard-library timing harness for the buffered O(n²), allocation-free two-pass O(n²), canonical-dyadic checked O(n), and O(n)→pair-fallback kernels while keeping production exact pair-distance admission bounded at `n<=16` until release-mode CPU/allocation and applicable buyer-path p95 evidence establish a resource budget.
+- Add a dependency-free two-limb wider-product O(n) reference for characterization. On the canonical odd boundary `D=2^58+1,n=65`, the narrow checked-`u128` O(n) intermediates require 129 bits and refuse, while the exact pair numerator remains 123 bits; the wider-product reference performs the cancellation without overflow and recovers the same exact pair numerator. This is evidence about intermediate width, not production admission or a new arithmetic owner.
+- Extend the timing harness to emit the wider-product reference beside the existing kernels so a recorded Rust 1.98.0 release-mode run can compare CPU cost without adding a production dependency or weakening pairwise fallback.

CHANGELOG.d/validation-bias-standard-error-exact-residual-mean.md

@@ -0,0 +1,5 @@
+# Validation bias standard error avoids rounded-mean dispersion drift
+
+- Evaluate larger-sample bias standard errors from exact anchor-relative residual deltas when those deltas are provably representable, even when the original pairwise residual subtractions were exact.
+- Prevent an exactly represented residual vector such as `[1, 1-2^-52, 1]` from being turned into a different dispersion geometry by rounding its mean before centering.
+- Keep the predecessor rounded-mean path when exact translated deltas cannot be established; this remains a bounded binary64 repair rather than a global correct-rounding claim.

CHANGELOG.d/validation-bias-standard-error-fifteen-observation-pair-distance.md

@@ -0,0 +1,2 @@
+- Validation Evidence now admits the exact pair-distance identity for bounded fifteen-observation mean-bias standard errors when represented residuals and pairwise differences are proven exact and the reduced dyadic ratio fits the existing checked `u128` midpoint proof.
+- This prevents the translated floating moment/`sqrt` fallback from moving a demonstrated exact represented-input fifteen-observation standard error one ULP low, while retaining the established fallback outside the bounded proof.

CHANGELOG.d/validation-bias-standard-error-five-observation-pair-distance.md

@@ -0,0 +1,2 @@
+- Validation Evidence now admits the exact pair-distance identity for bounded five-observation mean-bias standard errors when every represented residual and pairwise difference is proven exact and the reduced dyadic ratio fits the existing `u128` midpoint proof.
+- This prevents the translated floating moment/`sqrt` fallback from moving an exact represented-input five-observation standard error by one ULP while preserving fail-closed fallback outside the bounded proof.

CHANGELOG.d/validation-bias-standard-error-four-observation-large-reduced-ratio.md

@@ -0,0 +1,3 @@
+### Fixed
+
+- Preserve the exact four-observation pair-distance standard-error proof when the GCD-reduced `u128` numerator exceeds `2^53`. The binary64 numerator conversion is now only a candidate seed; exact dyadic-square and midpoint comparisons remain authoritative for the returned rounding, so representable exact ratios do not fall back solely because the seed integer is not exactly representable as binary64.