fix: correct DS-np candidate evaluation in dsnp_limits

[flaviobarros]

The bug

In dsnp_limits(), the inner function eval_candidate() hardcoded the second-stage upper control limit:

ucl2 <- a + 1.5    # always wl_accept + 1.5, ignoring the loop variable c

Meanwhile the outer enumeration loop iterates over c (the integer ucl2_accept threshold) and stores ucl2 = c + 0.5 in the results table. The actual calls to dsnp_prob_accept(), dsnp_arl(), and dsnp_ass() inside eval_candidate() always evaluated with the fixed value a + 1.5, never with the candidate's own ucl2.

Consequence: all candidates sharing the same (wl_accept, ucl1_reject) pair but differing only in ucl2_accept received identical performance metrics. The limit search did not truly explore the second-stage threshold dimension.

Why existing tests didn't catch it

The consistency test re-evaluates the best candidate using its table values (c + 0.5). The ranking algorithm places c = a + 1 (the smallest valid second-stage threshold) at the top for typical parameters, and a + 1.5 == (a + 1) + 0.5, so the re-evaluation accidentally matched.

The fix

Add c as a parameter to eval_candidate() and compute ucl2 <- c + 0.5 instead of ucl2 <- a + 1.5.

Statistical reasoning

The DS-np chart has three integer thresholds:

• wl_accept = a: accept at first stage if x1 <= a
• ucl1_reject = b: signal at first stage if x1 >= b
• ucl2_accept = c: accept at second stage if x1 + x2 <= c

The fractional limits are wl = a + 0.5, ucl1 = b - 0.5, ucl2 = c + 0.5. The value c controls how permissive the second stage is: a larger c means more combined counts are accepted, reducing p_signal. The search must evaluate each c independently to find the optimal tradeoff between false alarm rate (p_signal0) and out-of-control detection (arl1).

New tests

Four regression tests that would have caught the original bug:

1. Candidates with same (wl, ucl1) but different ucl2 must produce different p_signal0
2. Every candidate's stored metrics match a direct dsnp_prob_accept/dsnp_arl call
3. ucl2 == ucl2_accept + 0.5 for every candidate
4. p_signal0 is non-increasing in ucl2 (larger limit = more accepting)

Verification

• All 362 tests pass
• Published example (Joekes et al. 2015): ARL0 = 803.41, ARL1 = 193.22, ASS0 = 35.94 — all match
• API unchanged