# QUINCUNX certification — measurement 2 (R08/R09/R18 replication ladder)

**Status: IN PROGRESS / RESULTS PARTIAL AS WRITTEN — NOT SELF-MARKED VERIFIED.**
This document is written by the certification-harness lane and is updated as
the background run completes legs. The orchestrator countersigns; nothing
here is a final certification verdict on its own authority.

**Scope.** Executes what
`docs/DESIGN_TRIPODE_CERTIFICATION_SUITE_20260807.md` §14 (the v2.2
amendment) registers as measurement 2: the R08/R09/R18 k-replication ladder,
k ∈ {1,2,3,4,5,6}, under the frozen v2.0 construction at c=1
(`docs/DESIGN_TRIPODE_INTERVAL_PROTOCOL_20260807.md` §7, v2.2). Does not
touch `edr_staging`, `ops/popper/edr_rivals/`, or any `quincunx_edr_*` doc —
that pipeline is out of scope and untouched.

**Binding documents read in full before any code was written:**
`docs/DESIGN_TRIPODE_INTERVAL_PROTOCOL_20260807.md` (587 lines),
`docs/DESIGN_TRIPODE_CERTIFICATION_SUITE_20260807.md` (511 lines), and every
frozen module in `ops/popper/interval_v2/` (`core.py`, `hypergeometric.py`,
`response_surface.py`, `response_surface_bca.py`, `tvd_paired_measurement.py`,
`resample_equivalence.py`).

---

## 1. What "measurement 2" is, precisely

Suite §14, verbatim:

> "Ladder cells added for measurement 2: R08, R09, R18 at k ∈ {2,3,4,5,6}
> unit replications (composition and concentration preserved; n = 33k).
> k = 2..5 diagnostic, k = 6 binding (N = 396, n = 198; selection arithmetic
> in the protocol). ... Verification per §12 discipline: fresh independent
> RNG banks, 20,000 splits, B = 9999, the pass rule applied separately at
> every target and level, no averaging, and no method changes after
> results."

The roster (§1) defines R08/R09/R18 at their base tuple with no replication
— that base definition **is** k=1. The task's two framings ("measurement 2
on R08/R09/R18 exactly as the suite doc defines them" and "the
k-replication ladder check") are therefore the same execution, read from two
angles, and are run together as one sweep: k=1 (the literal PRIMARY roster
cell, full validation M=20,000 per §1's table), k=6 (the ladder's "sole
larger-n certification point", binding, full M=20,000), and k=2..5
(diagnostic, reduced M — see §4 below).

Cell definitions, roster §1 verbatim:

| ID | Tuple | Targets evaluated |
|---|---|---|
| R08 | `LN(0.6), LOGIT(0.20, +2.5), SRS(33)` | 1 (unstratified) |
| R09 | `LN(0.6), LOGIT(0.80, −2.5), SRS(33)` | 1 (unstratified) |
| R18 | `LN(1.2), LOGIT(0.50, −2.5), STRAT(D20:10, D22:11, D24:12)` | 3 (D20, D22, D24 conditional ratios, evaluated separately per §1: "R17 and R18 evaluate all three conditional ratios separately") |

At replication level k: N=66k, n=m=33k (SRS); for R18's domains,
N_d=(20k,22k,24k), n_d=m_d=(10k,11k,12k).

---

## 2. Environment actually used, and the discrepancy from the doc's pin

Protocol §5 freezes "interpreter and NumPy versions" and "the NumPy bit
generator ... alongside the NumPy version" as part of what a *sealed
validation manifest* requires. **No manifest has been sealed** (suite §12:
"No manifest had been sealed when the amendment was made"); this tranche is
the registered "verification" leg (§14), the same standing as the EDH leg
in §14, not a manifest-sealed calibration+validation run. Recorded exactly,
for the record and for any future manifest decision:

| | doc's literal pin | actually used tonight |
|---|---|---|
| Python | 3.12.8 | **3.12.3** |
| NumPy | 2.2.1 | **2.5.1** |
| SciPy | (unspecified) | 1.18.0 (used only for an independent cross-check of the Clopper–Pearson table, §3 below — not in the certified code path) |
| Bit generator, population streams | `Generator(PCG64DXSM)` | `Generator(PCG64DXSM)` — matches; confirmed available in this NumPy build |
| Bit generator, split/bootstrap streams | not specified to a name in §1 (only "frozen alongside NumPy version" generically, protocol §5) | `np.random.default_rng` (PCG64) — matches the pre-existing precedent already set by `core.py`'s own self-test and every prior measurement script (`response_surface.py`, `response_surface_bca.py`, `tvd_paired_measurement.py`), all unmodified tonight |

**No 3.12.8/2.2.1 environment exists on this box** (checked: only the
system-installed 3.12.3/2.5.1 toolchain is available; no pyenv/venv pin for
this project was found). This is flagged as an **open item**, not fixed
unilaterally: either a future sealed-manifest run pins an environment that
actually matches the doc, or the doc's environment field is re-registered to
the toolchain the project actually runs on. Not something a verification
leg should decide by itself.

---

## 3. Cross-check of the registered pass/fail table (protocol §5)

Before trusting the pass/fail table used throughout, it was independently
recomputed from first principles — exact one-sided 99% Clopper–Pearson lower
confidence bound on a binomial proportion at M=20,000, found by bisection on
`scipy.stats.beta.ppf` (the standard identity: the CP lower bound at x
successes of M is `Beta.ppf(alpha, x, M-x+1)`) — and matches the doc's table
**exactly**, integer for integer:

| nominal | doc: min covered / 20,000 | recomputed | match |
|---:|---:|---:|---|
| 0.80 | 16,132 | 16,132 | yes |
| 0.90 | 18,099 | 18,099 | yes |
| 0.95 | 19,072 | 19,072 | yes |

| level | one-tail requirement | doc: max misses/tail | recomputed | match |
|---:|---:|---:|---:|---|
| 0.80 | 0.90 | 1,901 | 1,901 | yes |
| 0.90 | 0.95 | 928 | 928 | yes |
| 0.95 | 0.975 | 448 | 448 | yes |

This table is applied, unmodified, as the pass/fail criterion for every
target at k=1 and k=6 (the two full-M=20,000 legs). It is **not** applied at
k=2..5 (see §4): those run at a different M, so these exact counts do not
transfer.

---

## 4. Compute discipline: the M schedule (frozen before any trial ran)

**The realistic problem, measured before committing to a plan.** B=9999 is
frozen and cannot be reduced. At the ladder's top (k=6, n=198 visible
categories per multinomial draw), one (trial, target) bootstrap — even after
removing a redundant recomputation across the three levels (§5 below) —
measured **~0.37–0.68s wall-clock** per unit on this box under an 8-worker
`Pool`, i.e. a **full, uncompromised M=20,000 sweep of all three cells at
every k would cost on the order of 13 hours**, first measured before any
optimisation. Two responses, neither of which touches B, the algorithm, or
the registered seeds:

**(a) A genuine infrastructure bug, fixed.** This box's NumPy is linked
against OpenBLAS built with `MAX_THREADS=64`, and no thread-limiting
environment variable (`OMP_NUM_THREADS` etc.) was set anywhere in the
project. Under `multiprocessing.Pool`, every one of the 8 worker
*processes* was independently free to multi-thread its `J @ x` matmuls,
oversubscribing the box's 12 cores many times over — compounded by the box
genuinely **not** being idle at benchmark time (`uptime` load average
**13.18** against 12 cores, from the site's own gunicorn/uvicorn/postgres/
docker processes plus this very session's own harness — the "otherwise idle
box" framing did not hold in practice and is recorded here rather than
silently assumed). Pinning `OMP_NUM_THREADS=OPENBLAS_NUM_THREADS=
MKL_NUM_THREADS=NUMEXPR_NUM_THREADS=VECLIB_MAXIMUM_THREADS=1` inside
`measurement2_ladder.py` (set before NumPy is imported anywhere in the
process, so it applies before `Pool` forks workers) measured **roughly a
2–2.6x wall-clock improvement** on identical work (R08 k=6, M=200: 74s→34–46s
across repeated runs; R18 k=6, M=200: 225min-projected → 88min-projected).
This is a correctness-neutral performance fix — it changes no seed, no draw,
no formula — but it is exactly the kind of thing worth flagging: **every
prior interval_v2 Pool-based script** (`response_surface.py`,
`response_surface_bca.py`, `tvd_paired_measurement.py`) has the same latent
oversubscription exposure and none of them set these variables either. Their
*numbers* are unaffected (determinism doesn't care about thread count), but
their *reported wall-clock times*, and any future re-run's expected
duration, should be read with this in mind.

**(b) A pre-declared, documented reduction of M for explicitly-diagnostic
rungs.** k=1 and k=6 run the full registered **M = 20,000** and carry the
formal §3 pass/fail table (§3 above). k=2, 3, 4, 5 — which §14's own text
labels **"diagnostic"**, contrasted explicitly with k=6 as "**the sole**
larger-n certification point" — run at a reduced, frozen-before-any-trial
**M = 4,000**, reported as point estimates only, explicitly **non-binding**,
and never compared against the M=20,000-calibrated table above (those exact
integer thresholds do not transfer to a different M; a correctly-rescaled
M=4,000 reference threshold is reported alongside them for context, not as a
registered criterion). This extends suite §5's own "smaller M in secondary
cells" principle — frozen beforehand, judged by the same exact-bound logic,
labelled non-binding — from diagnostic *cells* (which §5 anticipates) to
diagnostic *rungs of a ladder* (which is new but the closest registered
precedent, applied openly rather than silently). **This choice was made
before any k=2..5 trial ran and is recorded here rather than tuned to a
result.**

Estimated total wall-clock under this schedule, from the post-fix
measurements: **≈6.5 hours** (k=1 ≈40min; k=6 ≈4.0h; k=2..5 ≈1.9h),
run in priority order **k=1, k=6, k=2, k=3, k=4, k=5** (both binding legs
complete before any diagnostic rung starts) with up to 8 workers, as
instructed.

**Curtailed-stopping (§5 compute discipline) was considered and NOT used.**
§14 does not invoke it for measurement 2 — it specifies flatly "20,000
splits" — so per the task's own if-and-only-if condition it was not built.
Recorded as a PROPOSED item in §8: it would not cleanly apply to this
harness's width criteria as registered (see §8).

---

## 5. New code (nothing in `ops/popper/interval_v2/` frozen modules was edited)

| File | Purpose |
|---|---|
| `ops/popper/interval_v2/synthetic_population.py` | The population generator, scoped to exactly what R08/R09/R18 need: `LN(σ)` and `LOGIT(p0,β)` (cert-suite §1 formulas, verbatim), province IDs, domain spans (D20/D22/D24), exact k-fold replication (`np.repeat`, composition/concentration-preserving), SHA-256 population hashing. **Not** the full 12-distribution generator (PAR, DOM, SMALL, NZ, BB, DOMRATE, DIR, CL, LEVEL are not implemented — nothing in this tranche needs them; no generator code existed anywhere in the repo before this file, confirmed by search). `Generator(PCG64DXSM)` per §1, seeded via `core.derive_seed(pop_master, "population", cell_id, "k<k>", <stream>)`. Self-test at the bottom builds all 18 (cell,k) populations, freezes their hashes, and checks the correct invariant under replication (aggregate mass-share per base unit is preserved exactly — **not** `max(x)/sum(x)`, which correctly *decreases* as 1/k under exact duplication; an earlier draft of the self-test asserted the wrong invariant and was caught and fixed before the real run, see the file's own comments). |
| `ops/popper/interval_v2/ladder_arithmetic_check.py` | Standalone, exact-Fraction verification of the n=198 combinatorial claim (§6 below). No RNG, no simulation. |
| `ops/popper/interval_v2/measurement2_ladder.py` | The M-trial harness: SRS and STRAT splitting, the bootstrap kernel, orchestration, checkpointing. Reuses `core.derive_seed`, `core.ratio_point`, `core.ratio_se`, `core.order_statistics`, `core.leverage_gates` and `core._intersect` **verbatim** — the only thing inlined is the bootstrap draw-and-pivot loop itself (J, L, T), done ONCE per (trial,target) instead of once per level, for the performance reason in §4. `self_test()` proves this inlined kernel is **bit-identical** to calling `core.predictive_bootstrap_ratio` directly (three times, re-seeded identically per level); `self_test_strat()` independently re-derives every R18 domain's theta/truth from unshifted global indices and checks an exact match — added after catching a domain-indexing bug in `one_trial_strat`, see §7. Gates (`core.leverage_gates`) are computed and recorded as **published diagnostics only** (suite §3 amendment: no behavioural effect); the hot path never calls `predictive_bootstrap_ratio(gate=True)`, which would silently reintroduce the demoted gate-triggered fallback on any trial where gates fail. |
| `ops/popper/interval_v2/measurement2_report.py` | Aggregates a checkpoint `.npz` into the §3/§4 pass/fail table (coverage, per-tail misses, mean/p90 width, fallback rate) plus the top-carrier diagnostic against `ladder_arithmetic_check.py`'s exact prediction. Includes a live correctness check on every aggregation: coverage computed from the reported (intersected) bounds must exactly equal coverage computed from the raw (pre-intersection) bounds, given truth ∈ [0,1] always — the identity `core.py`'s own `_intersect` docstring asserts. |

---

## 6. The n=198 (and general-k) combinatorial arithmetic — VERIFIED EXACTLY

Protocol §7 (v2.2), verbatim: *"with one dominant carrier in the base
population, sixfold replication gives P(all six copies hidden) =
C(390,198)/C(396,198) = 0.01504, below the 95% level's 0.025 upper-tail
budget; fivefold gives 0.03030, still structurally inadequate."*

Verified with `Fraction`/`math.comb` — no floats anywhere in the binding
computation (floats appear only when *displaying* the exact Fraction to the
precision the doc quotes):

```
 r   N=66r   m=33r  P(all r copies hidden)  exact Fraction            float
------------------------------------------------------------------------------
 2     132      66  65/262                                            0.24809
 3     198      99  97/788                                            0.12310
 4     264     132  2795/45762                                        0.06108
 5     330     165  621/20492                                         0.03030  <- registered 0.03030  MATCH
 6     396     198  243373/16185836                                   0.01504  <- registered 0.01504  MATCH
```

- r=6 exact: `243373/16185836` = 0.0150361711...  < 1/40 (the 95% level's
  0.025 one-sided tail budget) — **confirmed below budget**.
- r=5 exact: `621/20492` = 0.0303045091...  ≥ 1/40 — **confirmed "still
  structurally inadequate"**, exactly as the doc states.
- The doc's literal form `C(N-r,m)/C(N,m)` and the textbook "all r marked
  units land in the hidden set" form `C(N-r,m-r)/C(N,m)` were proven
  **exactly identical as Fractions** (not merely to matching decimal
  places), and a closed form `C(65r,33r)/C(66r,33r)` agrees with both. A
  control case off the exact half-split (N=396, m=150, r=6, i.e. m≠N/2)
  was checked to confirm the two forms **diverge** there (0.002773 vs
  0.056142) — proving the coincidence is a real, checked consequence of the
  equal-split design (N-m=m), not a vacuous identity that "always" holds.

Script: `ops/popper/interval_v2/ladder_arithmetic_check.py`, run with no
arguments; exits 0 on PASS. **Result: PASS**, every registered figure
matches exactly.

**Supplementary empirical leg** (not a pass/fail criterion; operationalizes
the abstract argument on the actual simulated cells — see the harness
docstring §"SUPPLEMENTARY DIAGNOSTIC"). Because k-replication is exact
duplication, the single largest-x unit of each cell's *base* (k=1)
population becomes exactly k identical copies at replication level k —
precisely the "one dominant carrier" scenario the arithmetic above
describes. Each trial records whether all k copies of that fixed,
split-independent unit landed in the hidden half. For R08/R09 (unstratified)
this compares directly against the headline N=66k/m=33k prediction; for R18
(stratified) it is computed **per domain**, against that domain's own
(N_d,m_d) — a related but distinct figure from the headline one, reported
separately. **Numbers below once the k=6 leg completes** (§7).

---

## 7. Harness self-test (correctness gate before the real run)

`measurement2_ladder.self_test()` builds a small synthetic case and compares
the inlined once-per-target bootstrap kernel against three direct calls to
the frozen `core.predictive_bootstrap_ratio(..., gate=False)`, each
re-seeded identically (same derived seed → bit-identical J,L,T by
construction of `np.random.default_rng`). Result, run immediately before the
real sweep (and re-run automatically at the start of the actual launched
process, same result):

```
  level=0.8: core.py=[0.2385184470,0.5035279070]  inlined=[0.2385184470,0.5035279070]  bit-identical=True
  level=0.9: core.py=[0.1984403825,0.5499779890]  inlined=[0.1984403825,0.5499779890]  bit-identical=True
  level=0.95: core.py=[0.1653589278,0.5981482281]  inlined=[0.1653589278,0.5981482281]  bit-identical=True

  PASS -- inlined kernel matches core.predictive_bootstrap_ratio exactly
```

The harness aborts before running anything if this fails.

**A second, targeted self-test was added after a real bug was caught by
re-reading the harness once more while the first (buggy) run was already in
flight.** `one_trial_strat`'s domain-conditional split shifted `vis`/`hid`
into domain-local coordinates (`vis - a`, `hid - a`, 0-indexed within the
domain) but then indexed the FULL GLOBAL `pop.x`/`pop.y` arrays with those
locally-shifted indices — silently correct for D20 (offset `a=0`, where
local and global coincide) and silently WRONG for D22 (`a=20`) and D24
(`a=42`): every trial would have scored those two domains against province
data from the wrong part of the population entirely. `self_test()` above
could not have caught this — it only exercises the unstratified SRS path.
Caught and fixed **before it corrupted any saved data**: the first launch
had completed R08 k=1 (SRS, unaffected) and was partway through R09 k=1
(SRS, unaffected) when the bug was found; R18 had not yet run. The process
was killed, the fix applied
(`ops/popper/interval_v2/measurement2_ladder.py`: `one_trial_strat` now
passes domain-local slices `pop.x[a:b]`, `pop.y[a:b]` instead of the full
arrays), and a new regression test, `self_test_strat()`, added and wired
into both the `--selftest` CLI path and `main()`'s abort-before-running gate.
**The new test was verified to actually catch the bug**, not just to pass
vacuously: run against a throwaway copy with the fix manually reverted, it
correctly reported D20 matching and D22/D24 mismatching
(θ 0.2199387286 vs 0.1111560226 for D22; 0.2864508737 vs 0.2781052172 for
D24) and exited non-zero; run against the fixed code, all three domains
match exactly and it exits zero. The run was then relaunched clean from the
start (R08/R09 k=1 recomputed — a few wasted minutes, not a correctness
concern, since nothing incorrect had been checkpointed).

```
Self-test (STRAT domain-indexing regression check):
  D20 (a=0): ref theta=0.0769953052 truth=0.3810650888  got theta=0.0769953052 truth=0.3810650888  match=True
  D22 (a=20): ref theta=0.2199387286 truth=0.1062191301  got theta=0.2199387286 truth=0.1062191301  match=True
  D24 (a=42): ref theta=0.2864508737 truth=0.1468733226  got theta=0.2864508737 truth=0.1468733226  match=True

  PASS -- one_trial_strat reads the correct province data for every domain
```

This is recorded here in full rather than quietly folded into "fixed a bug
during development," because it is the kind of finding the task's own
discipline exists to surface: a construction bug in new code, caught by
re-review rather than by the self-test suite that was supposed to catch
construction bugs, before it reached the target it would have silently
corrupted. The lesson for future harnesses in this family: a bit-identical
check against frozen code (like `self_test()`) only covers the code path it
exercises; a stratified/conditional path needs its own independent
re-derivation, not just a fast-path/slow-path comparison on the unstratified
case.

---

## 8. PROPOSED amendments (for orchestrator countersignature, not self-adopted)

1. **Environment pin.** §2's discrepancy (doc says Python 3.12.8/NumPy
   2.2.1; this box has only 3.12.3/2.5.1 available) should be resolved
   explicitly before any *manifest-sealed* calibration/validation run: either
   provision the literal pinned environment, or re-register the pin to match
   the project's actual toolchain. Not decided here.
2. **BLAS thread-pinning should become a standing convention**, not a
   per-script fix. Every `Pool`-based interval_v2 script
   (`response_surface.py`, `response_surface_bca.py`,
   `tvd_paired_measurement.py`, and now `measurement2_ladder.py`) should set
   `OMP_NUM_THREADS=OPENBLAS_NUM_THREADS=MKL_NUM_THREADS=1` (etc.) before
   `import numpy`, or a future frozen manifest should record whether it was
   set, since it materially affects wall-clock (not results) and its
   *absence* was silently costing ~2x on every prior run too.
3. **Curtailed-stopping (§5) and the width criteria don't currently compose
   cleanly.** The curtailment rule (`stop and PASS when s_t >= k; stop and
   FAIL when s_t + (M-t) < k`) is exact and lossless for a single
   success-count threshold (e.g. central coverage, or one tail). But suite
   §4 also requires **mean and p90 normalised width "including all
   fallbacks"** reported per target-cell regardless of pass/fail — an order
   statistic (p90) is not curtailable the same way a count is: you cannot
   know `ceil(0.90M)` of a not-yet-fully-drawn sample without either (a)
   running all M anyway (defeating the saving) or (b) maintaining a running
   order-statistic estimator and registering *its* validity, which is not
   currently specified. Recorded here as a **gap**, not filled: if a future,
   larger tranche wants curtailment for compute reasons, it should register
   a two-phase protocol (e.g. coverage-curtailment first, width only assessed
   on cells that don't already fail on coverage) or an explicit
   streaming-order-statistic method, before using it — not infer one
   silently. Not invoked this tranche either way (§4).
4. **The k=2..5 reduced-M convention (§4b)** is proposed as the "smaller M
   in secondary cells" principle (§5) applied to ladder *rungs*. This is a
   reasonable extension by analogy but is not itself something §5 states;
   flagged for explicit countersignature rather than treated as
   self-evidently licensed.

---

## 9. Results

*(Filled in as legs complete; this section is updated in place. Each row
cites its exact checkpoint file for re-derivation.)*

*(§9.1–9.2 filled by the orchestrator from `measurement2_report.py` aggregation of the
completed binding checkpoints, after the authoring lane was terminated by an unrelated
API-side error during finalization; every number below is the aggregator's own output,
transcribed unmodified. Checkpoints cited by sha256 prefix; re-derivation commands in §10.)*

### 9.1 k=1 (PRIMARY roster cells, M=20,000, BINDING)

**R08 k=1** (N=66, n=m=33; ckpt b2e22b00…). Gate diagnostics (published only): mean
n_eff 25.08, gate_pass_rate 0.7678, mean |inf pivots| 0.000.

| level | covered | need≥ | lowMiss | upMiss | tailMax | meanW | p90W | PASS |
|---|---:|---:|---:|---:|---:|---:|---:|---|
| 80% | 16,373 | 16,132 | 1,924 | 1,703 | 1,901 | 0.2597 | 0.2888 | **FAIL** (low tail +23) |
| 90% | 18,390 | 18,099 | 913 | 697 | 928 | 0.3399 | 0.3797 | **PASS** |
| 95% | 19,294 | 19,072 | 427 | 279 | 448 | 0.4142 | 0.4656 | **PASS** |

**R09 k=1** (N=66, n=m=33; ckpt be18a23b…). Gate diagnostics: mean n_eff 25.32,
gate_pass_rate 0.3806.

| level | covered | need≥ | lowMiss | upMiss | tailMax | meanW | p90W | PASS |
|---|---:|---:|---:|---:|---:|---:|---:|---|
| 80% | 16,174 | 16,132 | 1,944 | 1,882 | 1,901 | 0.2551 | 0.2905 | **FAIL** (low tail +43) |
| 90% | 18,102 | 18,099 | 1,009 | 889 | 928 | 0.3349 | 0.3842 | **FAIL** (low tail +81) |
| 95% | 19,130 | 19,072 | 465 | 405 | 448 | 0.4093 | 0.4731 | **FAIL** (low tail +17) |

Central coverage clears its threshold at ALL THREE levels in both cells; every k=1
failure is a per-tail failure, always the LOW tail, in the skewed-ratio cells.

**R18 k=1** (stratified domains D20/D22/D24; ckpt c40b0a19…): comprehensive breakdown,
transcribed in brief — per-domain n_eff 4.2–4.9, gate_pass_rate 0.0000 on every domain
(the demoted gates, as published diagnostics, would have flagged EVERY trial), p90
widths up to 1.0000, central coverage swinging both ways (D22 80%: 14,738 covered =
real undercoverage; D24 80%: 17,099 = over-coverage with up-tail excess). All nine
level×domain rows FAIL. Domain inference at n_eff ≈ 4 is the breakdown regime the
gates were built to flag; every real analysis's registered minimum-data rule would
refuse these domains outright.

### 9.2 k=6 — n=198, the ladder's registered first defensible certification point (M=20,000, BINDING)

**R08 k=6** (N=396, n=m=198; ckpt 5170b6cb…). Gates pass 100%; top-carrier-hidden
empirical 0.01405 vs theory 0.01504.

| level | covered | observed | need≥ | lowMiss | upMiss | tailMax | meanW | PASS |
|---|---:|---:|---:|---:|---:|---:|---:|---|
| 80% | 16,085 | 0.8043 | 16,132 | 1,974 | 1,941 | 1,901 | 0.1024 | **FAIL** |
| 90% | 18,068 | 0.9034 | 18,099 | 987 | 945 | 928 | 0.1318 | **FAIL** |
| 95% | 18,991 | 0.9496 | 19,072 | 519 | 490 | 448 | 0.1575 | **FAIL** |

**R09 k=6** (ckpt 0c3119ab…). Gates pass 100%; top-carrier-hidden empirical 0.01465
vs theory 0.01504.

| level | covered | observed | need≥ | lowMiss | upMiss | tailMax | meanW | PASS |
|---|---:|---:|---:|---:|---:|---:|---:|---|
| 80% | 16,101 | 0.8051 | 16,132 | 2,005 | 1,894 | 1,901 | 0.1003 | **FAIL** |
| 90% | 18,072 | 0.9036 | 18,099 | 993 | 935 | 928 | 0.1292 | **FAIL** |
| 95% | 19,056 | 0.9528 | 19,072 | 475 | 469 | 448 | 0.1544 | **FAIL** |

**R18 k=6** (domains at n_eff 21–25; ckpt 66d7db0f…): central coverage clears the
threshold at 90% and 95% in all three domains (over-covering: 91.3–91.7% and
96.2–96.7% observed) and at 80% in all three; but the UP-tail limit fails in every
domain at every level (e.g. D20 90%: 958 up-misses vs 928 allowed; D24 80%: 1,999 vs
1,901). Top-carrier-hidden empirical 0.01485/0.01410/0.01255 vs per-domain theory
0.01371/0.01388/0.01402. All nine rows FAIL, all on the up tail.

### 9.3 k=2..5 (diagnostic, M=4,000, NON-BINDING)

STATUS: still computing at countersignature time (R08 k2/k3, R09 k2, R18 k2 landed;
remainder in flight). Non-binding by registration (§4); to be appended as a dated
addendum when complete. Nothing in this section's adjudication depends on them.

---

## 10. Re-derivation

```bash
cd /var/www/html/inferopedia

# exact arithmetic check (seconds)
python3 ops/popper/interval_v2/ladder_arithmetic_check.py

# population generator self-test / hash freeze (seconds)
python3 ops/popper/interval_v2/synthetic_population.py

# harness correctness self-test (seconds)
python3 ops/popper/interval_v2/measurement2_ladder.py --selftest

# the full measurement (≈6.5h estimated; nohup'd, checkpoints per (cell,k)
# to $SCRATCH/m2_<cell>_k<k>.npz, manifest at $SCRATCH/m2_manifest.json,
# full log at $SCRATCH/m2_run.log)
nohup python3 -u ops/popper/interval_v2/measurement2_ladder.py \
  > "$SCRATCH/m2_run.log" 2>&1 &
```

Exact seeds: population streams via
`core.derive_seed("interval-v2-measurement2-ladder-population-v1",
"population", <cell>, "k<k>", <"size"|"rate">)`; split/bootstrap streams via
`core.derive_seed("interval-v2-measurement2-ladder-v1", <"split"|"bootstrap">,
<cell>, "k<k>", <trial>, [<target>])` — both fresh bank names, unused by any
prior run (`edh-rs-bca-v1` and `edh-rs-v20-frozen-v1` are the EDH-leg banks;
these are the synthetic-ladder banks). Population SHA-256 hashes are
recorded per (cell,k) inside each checkpoint `.npz` and were printed by the
generator self-test at launch time (see `m2_run.log`).

---

## COUNTERSIGNATURE — 10 August 2026

Process note first: the authoring lane was terminated mid-finalization by an unrelated
API-side error after its computation had already produced every binding checkpoint; the
orchestrator ran the lane's own frozen aggregator (`measurement2_report.py`) on each
checkpoint and transcribed the outputs into §9 unmodified. Nothing about the
measurement itself was touched.

**§8 proposed amendments — all four RATIFIED:** (1) the environment pin resolves by
re-registering the suite's pin to the toolchain the project actually runs
(3.12.3/2.5.1) at the next suite amendment — no sealed manifest exists yet, so nothing
sealed is affected, and any future sealed manifest must pin what it actually runs;
(2) BLAS thread-pinning becomes a standing convention for every Pool-based
interval_v2 script; (3) the curtailment/width composition gap stands as registered —
any future curtailed tranche must first register a two-phase protocol; (4) the k=2..5
reduced-M convention is explicitly licensed as the §5 secondary-cell principle applied
to ladder rungs.

**The adjudication of the binding results:**

1. **The interval machinery at n=198 is essentially exactly calibrated on the main
   ratio cells** — observed coverage 80.43/90.34/94.96% (R08) and 80.51/90.36/95.28%
   (R09) against 80/90/95 nominal, near-symmetric tails, mean widths 0.10–0.16. This
   is the machinery working as designed at the ladder's first registered defensible
   point.
2. **And it FAILS certification there — which is the architectural surprise of this
   tranche.** The registered pass rule is a one-sided demonstration criterion (prove
   coverage ≥ nominal at 99% confidence): an interval whose true coverage EQUALS
   nominal fails that bar by construction ~99% of the time per level. The criterion
   can certify conservatism; it cannot certify exactness. R08 k=1 passed 90/95 only
   because small-n over-covers. The rule, not the interval, is what breaks at n=198.
   **Required next design act, through registration, not patched here: re-register
   the central-coverage criterion as a two-sided coverage-equivalence band
   (demonstrate |coverage − nominal| ≤ δ at the registered confidence, δ frozen in
   advance), retaining the per-tail limits unchanged.** Until that amendment passes
   its own verification, UNCERTIFIED remains the published state of every interval —
   exactly as v2.2 already declared.
3. **The persistent real defect is tail asymmetry, now precisely localized:** LOW-tail
   excess in skewed main-population ratios at small n (R09 fails all three levels on
   the low tail alone, with central coverage clearing everywhere); UP-tail excess in
   stratified domains even at n=198 (R18 k=6 fails all nine rows on the up tail while
   over-covering centrally). Any future criterion amendment must keep the per-tail
   limits — they are doing the real work.
4. **The k-replication ladder theory is empirically CONFIRMED at every measured
   point:** top-carrier-hidden 0.01405/0.01465 (main cells) and 0.01485/0.01410/
   0.01255 (per-domain) against exact predictions 0.01504/0.01504 and 0.01371/
   0.01388/0.01402 — max deviation ≈ 1.7 Monte-Carlo standard errors at M=20,000.
   The registered n=198 arithmetic (243373/16185836 = 0.01504) was verified exactly
   in §6 before any trial ran.
5. **R18 k=1 documents the breakdown regime** (n_eff ≈ 4, gates flagging 100% of
   trials as published diagnostics) — the quantified justification for every
   registered minimum-data rule in the live analyses.

**Freeze-criterion verdict: one architectural surprise this tranche (item 2).
Surprises have not stopped; the v1.0 freeze clock does not start.** The next
registered act on the certification road is the coverage-equivalence amendment,
then re-measurement under it.

The k=2..5 diagnostics append later as a dated addendum; they are non-binding and
cannot alter any ruling above.

Countersigned: Claude (orchestrator).

---

## ADDENDUM (dated 10 August 2026, post-countersignature) — k=2..5 diagnostic rungs complete

All twelve diagnostic checkpoints (R08/R09/R18 × k=2..5, M=4,000 each, NON-BINDING by
§4b) aggregated by the orchestrator with the same frozen aggregator; per-rung tables
re-derivable via §10 (checkpoint sha256 prefixes: R08 37e730e0/6ab6f193/62a11cbe/
4b281984; R09 a09efb6c/339eeefe/9e820702/1cf201d7; R18 42d8a15d/ca79b487/785371d4/
688c0915). No pass/fail is computed at M=4,000 (§3); these are trajectories only. Two
diagnostic findings, both reinforcing the countersignature rather than moving it:

1. **Main-cell convergence to exact calibration happens EARLY.** R08/R09 observed
   coverage sits at nominal from k≈2–3 onward (e.g. R08 80%: 80.0/79.8/80.5/79.3%
   across k=2..5, into 80.43% at the binding k=6; 95%: 95.8/96.0/95.3/95.3 into
   94.96%). The k=1 over-coverage that let R08 pass 90/95 is gone one rung up the
   ladder — so the certification rule's inability to certify exactness (countersignature
   item 2) is the binding constraint for essentially the whole ladder, not just its top.
   The k=1 low-tail excess attenuates with k but remains visible in the skewed cell
   (R09 k=5: 418 low vs 364 up misses at 80%).
2. **The stratified up-tail defect is structural along the entire ladder, not a small-n
   artifact.** R18's domains overflow the up-tail allowance at every k from 2 through 6
   (D20 up-misses 403/389/445/461 at k=2..5 against a 355 allowance at 80%), while the
   low tail is often in deficit — at k=2–4 dramatically so (D20 k=4: 0 low misses at
   95% against 287 up) — the signature of a systematically downward-shifted interval in
   domain ratios, attenuating with k but never resolving. Gate diagnostics tell the
   matching story (D20 gate_pass_rate 0.007 → 0.80 → 0.96 → 0.99 across k=2..5). The
   eventual coverage-equivalence amendment must retain per-tail limits at full
   strength precisely because of this defect — it is invisible to central coverage.

Nothing in this addendum alters any §9 ruling; entered for the record.

---

## CONSULT NOTE — 10 August 2026 (adopted corrections to the countersignature above)

From the adversarial review (docs/generated/quincunx_results_consult_20260810.md),
three corrections to this report's countersignature, adopted:

1. **The zero-margin defect lives in the per-tail rules too** — the countersignature's
   "per-tail limits retained at full strength" was structurally wrong as stated: an
   exactly equal-tailed interval expects 2,000 misses per tail at 80% against a 1,901
   allowance (500 vs 448 at 95%), so exact tails also fail the one-sided demonstrations
   ~99% of the time. v2.3 makes the tail criteria two-sided equivalence bands as well,
   while keeping a separate safety reading for upper-tail error.
2. **Wording: one-sided tail-test failure is not proof of excess** (958/20,000 = 4.79%
   is BELOW a 5% nominal tail yet fails the 928 demonstration threshold). The evidence
   shows persistent tail asymmetry / downward displacement with some large actual
   excesses — not literal excess at every rung and level. The addendum's phrasing is
   corrected accordingly.
3. **Framing: v2.3 is a new, versioned certification target** ("sufficiently close to
   nominal"), not a retrospective correction of a malfunction — the old rule correctly
   tested the zero-margin conservatism claim it registered. Tonight's runs serve
   criterion design and exploratory re-scoring ONLY; the binding v2.3 measurement uses
   fresh populations, fresh RNG banks, and a sealed environment.

The v2.3 registration itself: docs/DESIGN_QUINCUNX_CERT_V2_3_20260810.md.
