Variation / Morris Sensitivity Suite: consolidate 34 draft PRs (#4142, #4433, #4120, #4206)

[dieterolson]

Consolidates the variation / Morris-sensitivity draft family (34 open draft PRs) into one branch against main.

Known non-required-lane state, disclosed rather than left to be discovered: tests (3.12) reports 6 failed / 4893 passed. Three are main's own pre-existing failures, fixed in #4480 (main fails them today at edfeae684; see #4481). The other three are this family's, fail only on 3.12, and pass on 3.11 — filed as #4482 (an over-tight cross-client parity fixture, the Morris authority child never reporting readiness, and a JSON error taxonomy that shifts with the interpreter). tests (3.12) is not a required check; none of the six is fixed here, per the rule that a consolidation is the wrong vehicle for pre-existing defects.

Correctness findings are now filed as issues — they outlive this consolidation and are not fixed here, because a consolidation is the wrong vehicle for pre-existing defects:
#4455 (Morris validation is scale-blind — highest value) · #4456 (variation_parity.json vacuous) · #4457 (three flight-model policies) · #4458 (parity-only tests) · #4459 (tautological router verification) · #4460 (tests (3.11) never created on any of the 34 drafts) · #4461 (unpinned Python/TS duplicates) · #4462 (suite cannot detect a planted-design substitution)

Supersedes

Every PR below has been verified by ancestry check to be a true ancestor of this branch, so closing it drops nothing. Verified with verify_coverage.sh: covered=34 NOT-covered=0 SAFE, and independently against each PR's current headRefOid from the API (not from a cached branch table).

Supersedes #4393, Supersedes #4394, Supersedes #4395, Supersedes #4396, Supersedes #4397, Supersedes #4398, Supersedes #4399, Supersedes #4400, Supersedes #4401, Supersedes #4403, Supersedes #4404, Supersedes #4405, Supersedes #4407, Supersedes #4412, Supersedes #4413, Supersedes #4414, Supersedes #4415, Supersedes #4416, Supersedes #4417, Supersedes #4422, Supersedes #4423, Supersedes #4424, Supersedes #4425, Supersedes #4426, Supersedes #4427, Supersedes #4428, Supersedes #4431, Supersedes #4432, Supersedes #4435, Supersedes #4440, Supersedes #4441, Supersedes #4442, Supersedes #4443, Supersedes #4444

Epics

This family closes no leaf issues. It advances epics only:

Part of #4142
Part of #4433
Part of #4120
Part of #4206

(#4206 arrives via #4417, which had absorbed the already-merged #4436.)

Why merging the 7 chain tips was not sufficient

The brief assumed a chain tip contains everything below it. That is false here. #4417's branch head advanced after its six children branched off it: it now carries 89563be74 + 87719a266 (Sasho rotational AoA) via a merge of #4436, which is itself already MERGED into that feature branch and exists on no other branch and not on main. Those two commits are absent from all seven tips. They are merged here explicitly, so #4417 can be closed without stranding #4436's work.

#4424 and #4423 reported Already up to date — they were genuinely contained by the other tips. Confirmed by ancestry, not by assumption.

Blocking defects fixed

1. Unreachable gitlinks (the repo-wide blocker). Removed the six mode-160000 entries under .codex-worktrees/. They are not declared submodules (no .gitmodules anywhere) and the commits they point at exist only in one local clone, on no remote. main has zero of them. Verified: git ls-tree -r HEAD --name-only | grep '^\.codex-worktrees' is empty, and no 160000 mode remains anywhere in the tree. The .gitignore line that prevents recurrence is owned by the CI/infra consolidation, not this branch.

2. quality-gate Format Check would have failed on 91 files. Slices in this stack reformatted files with an older ruff, reverting them to the pre-0.9 wrapping style (assert hasattr(\n a, b\n), "msg" instead of assert hasattr(a, b), (\n "msg"\n)). I confirmed origin/main is format-clean under the CI-pinned ruff 0.14.10 while this branch was not, so the regression is the family's. Only 1 of the 91 files is rate_of_closure/variation code — the other 90 are collateral churn in unrelated trees. Reformatted with 0.14.10. The CI-excluded prefixes were deliberately left untouched.

3. ruff check would have failed with 9 × F841. A slice wrapped nine app = QtWidgets.QApplication… statements across three lines in tests/unit/sidekick/test_sidekick_ux_hardening.py, moving # noqa: F841 off the line ruff reports the diagnostic on. Restored main's single-line form.

4. tests (3.10) would have failed at collection. tests/unit/sidekick/agent/test_action_audit.py had been rewritten to from datetime import UTC, which does not exist on Python 3.10 — a regression of the fix SPEC 1.1.352 recorded for this exact file. Restored main's timezone.utc form. Root cause worth a follow-up: the repo's AST guard tests/rate_of_closure/test_python_310_datetime_boundaries.py only walks src/rate_of_closure, so it structurally cannot catch this class of regression in tests/ or in any other src tree.

5. No raw conflict markers: git grep "<<<<<<< HEAD" is empty.

6. quality-gate Type Check (Mypy) failed with 70 errors in 27 files — and every one of those 27 files is a file that does not exist on main at all. 428 of the 537 changed source files here are new. Because each source PR was based on its parent's branch, its changed-file delta only ever contained its own slice; once a file was introduced in slice N, no later slice re-checked it, and no PR in the family ever type-checked it against main. That is why all 34 sources show a green Mypy step while the consolidation did not. Fixed all 70 — 16 numpy no-any-return/var-annotated (annotated locals), 16 arg-type in _kinetics_dynamics.py (explicit float() at scalar-indexing boundaries), 16 arg-type from dict[str, object] inference being **-unpacked into typed constructors, 5 attr-defined/index in launcher.py (root cause: the unannotated GUI_INFO literal), 4 redundant-cast, plus one each of has-type, Literal narrowing, FrozenJsonValue, and an untyped Qt currentData(). All behaviour-preserving; the one public signature I briefly tightened was reverted in favour of a call-site fix.

7. quality-gate Changed Test Assertion Check failed on six src/shared/python/swing_sim/**/tests/__init__.py package markers (five docstring-only, one empty). Added them to scripts/test_assertion_allowlist.txt, following the check's own guidance and the existing src/movement_optimizer/tests/** precedent.

8. pyproject.toml and tool_manifest.yaml had been converted from LF to CRLF by this family, so both rendered as near-total rewrites. Restored LF: their real change is 35 added lines, not 802 changed ones. These were the only two files in the 1249-file diff with a newly introduced CRLF conversion.

9. The web build was broken, and a real behavioural regression was hiding behind it. npm run build (i.e. tsc) failed, which is why "Rate web production Worker E2E" could not even start its preview server — that check passes on all four source PRs that carry it, so the breakage is the integration, not any one slice. Two distinct cross-slice defects:

   (a) Type error. feat(variation): bind runtime replay identity #4431 made executionMetadata required on VariationExecutionRequest/VariationExecutionResult, but four test fixtures introduced by the feat(rate): add bounded club explorer camera #4444 chain construct those objects without it. Supplied it the way the already-updated fixtures in the same file do — from the request under test, which also satisfies validateResult's request/result metadata equality check.

   (b) A user-visible regression, and the most consequential thing I found. importPlan reports provenance after loading a plan — either "resolves against the current variable registry … not evidence of historical reproducibility" for a raw plan, or "Execution sidecar verified against the current registry" for a signed document. The feat(rate): add bounded club explorer camera #4444 chain added an effect that calls invalidateResults on every configuration-identity change; loading a plan changes that identity, so the effect ran after commit and overwrote the provenance message with the generic "Ready: configuration changed; run again." The user was silently denied the one message that tells them a loaded plan was re-resolved against today's registry rather than its recorded one — an honesty regression in a suite whose whole theme is honest provenance. invalidateResults now announces only a discard that actually happened, decided from refs so the callback identity stays stable and the effect cannot re-trigger itself. Nothing else references that string, and the invalidation tests assert visual state and heading removal rather than status text.

   Two React tests (from feat(variation): bind runtime replay identity #4431's side) correctly detected (b) and were failing; they now pass. Web workspace: tsc clean, eslint --max-warnings 0 clean, vite build succeeds, vitest 1084/1084 across 126 files (was 1082/1084).

10. The family's Python test suite had never run in CI at all, and once run it revealed five more cross-slice contract contradictions. pick-runner never granted any of the 34 drafts a fleet slot, so tests (3.11) was never even created on a single one of them — every "green" source PR was green on quality-gate alone. I built a Python 3.11 environment with CI's pinned numpy/scipy/pandas/PyQt6 and ran the suite. Five real failures, none caused by the merge; each is one slice's contract rejecting another slice's code, where no branch contained both halves:

    (a) The RNG-replay contract vs the explicit-design seam — the most serious. feat(rate-of-closure): produce paired localized attribution #4426 added build_simulation_ensemble_request_from_samples for "deterministic experimental designs whose rows are the scientific authority … rather than pseudorandom Monte Carlo draws". feat(variation): bind resolved execution metadata #4428/feat(variation): bind runtime replay identity #4431 then made SimulationEnsembleRequest require unconditionally that sampled_inputs equal sample_inputs(plan). Together the request contract rejects exactly the designs the seam exists to carry: 7 tests failed and the entire paired-attribution producer was non-functional. Reconciled by making the provenance explicit — sample_provenance defaults to plan_rng so every existing caller keeps the reproducibility guarantee bit-for-bit, and the explicit seam declares explicit_design, which skips only the RNG-equality check. Shape, finiteness, and _require_config_sample_binding — the check that actually proves each row was executed as written — all still apply. The same contradiction also broke a benchmark script and two archive tests.

    (b) A run may no longer be attributed to a config it did not come from. capture_simulation gained a config-identity guard; a Morris test injected pre-computed runs built from other configs. The guard is correct, so the test changed: the hit-availability case now asserts against project_simulation_outcome, which owns that rule, and the miss goes through the real evaluator end to end.

    (c) NaN where a null belongs. launch_monitor_import returned NaN for an empty CSV cell, because from pandas 3 a bare DataFrame construction coerces None in an object column. The test's own name says this import mirrors browser policy, which yields null. Built with dtype=object so an absent value stays absent instead of silently becoming a floating-point quantity.

    (d) Eight paired-study controls had no tooltips, failing the repo-wide tooltip-completeness contract that a different slice owns.

    (e) A request-identity test asserted identity by mutating sampled inputs in place, which is now unconstructable twice over. The sample-bytes case rebinds each config to its row; the config-order case now asserts the stronger property the binding provides — a misordered request is rejected outright rather than merely hashing differently.

    Result: tests/rate_of_closure/ is 1451 passed, 0 failed on Python 3.11. One further failure reproduced only on 3.13 (a JSON nesting-depth error-taxonomy difference) and passes on 3.11, so it is untouched.

Local reproduction note

Reproducing quality-gate on Windows requires MYPYPATH=src;src/python/src with a semicolon. CI is Linux and uses :; on Windows that colon string parses as one nonexistent directory, every first-party import silently degrades to Any under --ignore-missing-imports, and mypy reports a fabricated result. I measured both on this branch's exact 418-file list: semicolon gives Success, colon gives 109 errors in 13 files — a different, bogus set. Cross-module resolution also requires passing all 418 files to a single invocation via mypy's @listfile form (not xargs, which splits on Windows), numpy <2.4, and mypy pinned to 1.13.0. My initial semicolon run reproduced CI exactly: the same 27 files and 70 errors.

Substantive conflict resolutions

Two conflicts were more than textual, and both were resolved against the incoming side.

request_builder.py — a mis-merge that would have silently destroyed the paired-attribution design. Git aligned #4431's Monte Carlo function body against the #4444 chain's new explicit-sample seam, so the incoming side inserted

samples = sample_inputs(plan)

inside build_simulation_ensemble_request_from_samples — the function whose whole contract is that its caller-supplied rows are the scientific authority (planted baseline/perturbed pairs). Taking that side would have replaced an explicit design matrix with pseudorandom draws while every test still passed. Rejected. Execution metadata is now supplied by the sampling caller and stays None on the explicit seam: the metadata carries an RNG replay identity, and rows never drawn from that stream cannot be replayed from it, so claiming it would be a false provenance assertion.

simulation_adapter.py — assert execution_metadata is not None became a None-tolerant identity override for the same reason. An injected executor still can never be reported as the pinned production implementation.

Remaining resolutions, all union-of-both-sides: attribution wiring re-homed from the eager _on_ensemble_succeeded into _apply_prepared_result so it publishes only for an accepted result (guarded by authority() is None per #4427, and not cleared by _clear_result_widgets, so explicit paired authority keeps its own lifecycle); EnsembleStreamHeader fields and validations; the TS execution-metadata contract (the prepared request now feeds both validateExecutionRequest and validateResult); #4425's flight-model check kept alongside the stricter isSafeInteger nRuns check; #4427's value-based scenario comparison (strictly narrower than the identity check it replaced); and the dated sections in SPEC/handoff docs.

Correctness findings — read before merging

These are defects in the consolidated work, not in the consolidation. None is a merge error. I am reporting them rather than fixing them because each is a design decision for the epic owner.

1. There is no TypeScript Morris implementation, despite a branch named codex/4142-morris-typescript-parity. The Morris numerics exist in exactly one place: src/shared/python/swing_sim/variation/global_sensitivity.py. The TypeScript side is a wire parser plus an algebraic invariant checker. src/rate_of_closure/variation/morris_rate_adapter.py and morris_execution.py contain zero effect arithmetic. So the recurring Python/TS algorithm divergence cannot occur here — but the "parity" framing overstates what exists, and there is no second implementation to cross-check against.

The TS check that does exist is genuine, not decorative: morrisMetricValidation.ts:39-63 enforces sigma² − n·SE² − c·muStar² + c·mu² ≈ 0 with c = n/(n−1), which is an exact identity given Python's ddof=1 estimators, and would fire if Python switched to ddof=0. Zero-clamp thresholds match exactly (64 * eps * max(1, muStar) on both sides). Its limitation is structural: it validates a relation among metrics, so a uniformly wrong scale factor passes.

2. The Morris estimator has exactly one genuine numeric validation, and it is scale-blind. test_global_sensitivity.py:89-114 uses response 2·x₀ + 3·x₁ over bounds [0,1], so closed-form elementary effects are exactly 2 and 3. That is real ground truth. But every numeric mu_star assertion in the repo runs on factors with lower=0.0, upper=1.0, where normalized and physical coordinates coincide. Elementary effects are computed per normalized factor range (global_sensitivity.py:173 divides by signed_steps, which are in [0,1] units), and no test can currently distinguish "per normalized range" from "per physical unit." test_morris_rate_adapter.py does use non-unit bounds but contains zero mu_star assertions. This is the highest-value gap I found.

3. Parity-only tests (agreement asserted, correctness not). morrisUiParity.test.ts (both tests), test_morris_ui_contract.py::test_python_generated_ui_fixture_is_exact_and_shared, test_web_parity_fixture.py (both tests), variation.test.ts::"matches the fixture dispersion within the loose band", morrisGlobalSensitivityContract.test.ts::"parses the Python golden fixture…", morrisPresentation.test.ts::"ranks finite effects…" (its muStar 3 and 2 are read from the fixture), and the morris_workspace_v1.json consumers. One test is mislabeled as parity and checks nothing cross-runtime: morrisAuthorityRequest.test.ts::"matches Python R13.6 base-centered suggestions…" reads no Python artifact — its ten expected bound pairs are hardcoded TS literals, so Python drift cannot fail it.

To be fair to the fixtures: morris_ui_parity_v1.json and morris_global_sensitivity_golden_v1.json are genuinely two-sided (each is pinned by a Python test and a TS test, so a one-sided change fails exactly one), and no regeneration script exists for any fixture, so none is auto-derived from one side. The golden fixture's mu_star values coincide with the analytically-asserted 2.0/3.0, making it the one fixture transitively anchored to closed-form truth.

4. variation_parity.json is effectively vacuous as a correctness gate. The TS side accepts mean_abs_tolerance of 8.0 m on a 216.73 m mean (3.7%) and std_rel_tolerance of 0.4 (40%). A browser engine with a 39% dispersion error passes. The Python test's own docstring concedes exact RNG parity is not attempted.

5. #4425's flight-model pin contradicts the Morris slices in this same stack. Three policies now coexist:

Surface	Allowed flight models
Python VariationPlan (spec.py:283)	all 7 FlightModelType members
variationSchema.ts validatePlan	1 (waterloo_penner)
morrisAuthorityRequest.ts AUTHORITY_FLIGHT_MODELS	all 7

A plan with flight_model in {macdonald_hanzely, nathan, ballantyne, jcole, rospie_dl, charry_l3} is valid in Python, round-trips through to_json_dict, and is rejected by the browser — and accepted by the Morris path in that same browser. The reverse cannot happen. #4425's error message ("unsupported for browser variation") makes this honest rather than silent, and #4425's Python-side change is sound (it requires plan and config to agree, without restricting the set). But the browser is now internally inconsistent, and SUPPORTED_VARIATION_FLIGHT_MODEL has no test asserting the rejection or documenting the asymmetry.

6. normalized_step can be reported inaccurately and neither runtime can detect it. _validate_design_paths never requires |signed_steps| == delta, nor that points lie on the k/(levels−1) lattice. TS parseDesign re-derives levels/(2·(levels−1)) from levels — validating the field against itself, not against the divisor actually used. MorrisResults.tsx then displays that number to the user.

7. Smaller divergences, all currently latent but not guarded: the Morris workspace CSV export has 39 Python columns vs 35 TS, with different order and different names for the same data (source_time_window_start_s vs source_time_start_s, design_levels vs levels, …) and four Python-only columns — each side asserts only its own header, and nothing compares the two. OUTPUT_LABELS is duplicated (23 Python entries vs 17 TS) and already out of sync. variationRegistry.ts is a hand-mirror of registry.py, including the typicalScale values that drive every Morris suggested bound, with no test pinning the two together (I compared the 10 Morris entries by hand — they agree today; nothing keeps them agreeing). Presentation tie-breaks differ (Python codepoint spec_id vs TS localeCompare), as do fallback labels (str.title() vs first-char capitalization: "carry_2m" → "Carry 2M" vs "Carry 2m"). Finally, application/morris/router.py:238 "verifies" a result by calling analyze_morris on the same inputs and comparing — tautological; it can catch transport corruption but never an algorithm error.

What I could not verify

• I ran the JavaScript suite but not the Python suite. The web workspace is fully exercised locally (vitest 1084/1084, tsc, eslint, vite build).
• The Python suite now runs locally on 3.11 and is green (1451 passed), including the PyQt paths I re-homed. PyQt6 6.11 does import on this machine, so those tests executed rather than being reasoned about. What I did not run locally is the rest of the repo's suite outside tests/rate_of_closure/, the Rust wheel build, or the Playwright PyQt-DPI lane.
• My decision to leave execution_metadata=None on the explicit-sample seam is a judgement call, not something a test forced. It is the honest reading (no RNG was used, so no RNG replay identity should be claimed) and it is consistent with the stack's own "model identity honesty" theme, but if the epic owner intends explicit designs to carry metadata, it needs a non-RNG provenance variant rather than reusing make_execution_metadata.
• Four files under src/data_processing/ are changed by this family and are not ruff-format-clean under 0.14.10. They sit under a CI-excluded prefix, so the gate does not see them, and I left them untouched per the exclusion rule. Flagging so it is not mistaken for clean.
• I reviewed the Morris and attribution numerics and the flight-model policy. I did not audit the club-explorer camera, Putting sample inspector, linked-scatter, or visualization-manifest slices from the Epic: Visual-first tab visibility and visualization-led React/PyQt UX #4433 series beyond conflict resolution.

Gates run locally

Reproduced with CI's own pinned tools, commands, and file lists:

• ruff check (pinned 0.14.10), 596 in-scope changed files and full-repo: clean.
• ruff format --check (pinned 0.14.10): clean.
• mypy (pinned 1.13.0, CI's exact 418-file list and flags): Success, no issues.
• scripts/check_test_assertions.py --changed-files: passed.
• scripts/check_minimum_test_contract.py: passed.
• scripts/check_module_size_budget.py --max-lines 1200 --include src: passed.
• bandit -ll -ii over the 372 changed src files: 0 medium, 0 high.
• git grep "<<<<<<< HEAD": empty. git ls-tree -r HEAD | grep '^160000': empty.
• verify_coverage.sh: safe=34, NOT-covered=0, SAFE.

requirements.txt is untouched, so pip-audit is unchanged from main. file-size-budget is not a required check here, and I have not refactored any module to satisfy it.

Merge note

main requires linear history, so this must land via squash, not a merge commit. Squashing collapses 34 PRs' worth of slice history, so the provenance above is the only surviving record — please keep it in the squash message.

🤖 Generated with Claude Code