Preface: The Invisible Target and the Foundations of Stochology

Learning Objectives. By the end of this opening chapter, you will be able to explain what Stochology studies and where its name originates; trace the three intellectual traditions it unifies; distinguish progressive scientific repairs from degenerative excuses; translate confusing percentages into natural-frequency trees and Bayesian odds; and explain why reproducible pseudo-random seeds (seed = 2026) are the floor—but not the ceiling—of scientific verification.

1. The Decision Before the Answer

On a Tuesday morning, an emergency-room physician examines a 54-year-old man complaining of chest pain. She has an electrocardiogram, his vital signs, his clinical history, and fifteen minutes. She must choose between admitting him to the coronary care unit or discharging him home. If she admits him and the pain is benign reflux, the hospital spends a scarce intensive-care bed that a critical patient may need an hour later. If she sends him home and he is experiencing an atypical myocardial infarction, the catastrophic cost falls on his life.

Pause and notice the structure of this moment: the decision must be taken before the truth is known.

This is not a defect of modern medicine; it is the defining condition of almost every consequential human and institutional action. A civil defense director must order or withhold a coastal evacuation twenty-four hours before a tropical cyclone makes landfall. A central bank adjusts interest rates before next year’s inflation materializes. A call-center operations manager commits shift schedules weeks before customers pick up the phone. An airline dispatcher holds or releases connecting flights before a cold front reaches the runway.

Stochology is the science—and the operational art—of judgment and decision-making under uncertainty.

Where the Name Comes From: Stókhos and Lógos

In classical Greek, stókhos ($\sigma\tau\acute{o}\chi\omicron\varsigma$) names the narrow post or mark at which an archer aims, and by extension a well-aimed conjecture directed at a hidden truth. Combined with lógos ($\lambda\acute{o}\gamma\omicron\varsigma$, reasoned discourse and structured method), Stochology is the disciplined study of aiming well when the target cannot be seen directly.

Tracing the Greek root also separates the discipline cleanly from near-homophones and false friends:

• It is not eschatology (from éskhatos, the theological study of final things);
• It is not stomatology (from stóma, the clinical study of the mouth);
• It is not tocology (from tókos, obstetrics and childbirth);
• And it has nothing to do with commercial “stock” or warehouse inventory accounting.

In 1713, eight years after Jacob Bernoulli’s death, his masterpiece Ars Conjectandi (The Art of Conjecturing) was published. In Book IV, Bernoulli coined the Latinized Greek term ars conjectandi sive stochastice—the art of measuring the probabilities of things as accurately as possible so that in our judgments and actions we may always choose what is healthier, better, and more grounded in reason. Over the next two centuries, however, textbook usage narrowed the word “stochastic” until it meant merely “random” or “noisy.” It kept the dice and forgot the archer.

Stochology restores the full loop: the noisy world that generates the observations, the mathematical model that compresses them, and the responsible agent who must act and answer for the consequences.

2. The Three Traditions Joined Together

Why do traditional courses in statistics, econometrics, and machine learning so often produce fragile systems in production? Because they teach isolated parameter-fitting techniques inside a mathematical vacuum. A student learns how to minimize mean squared error or cross-entropy on a clean table of numbers ($X, Y$), without asking how that table was filtered out of physical reality or how deploying the fitted formula will deform the reality it measures.

To close that gap, Stochology stitches together three intellectual traditions that grew up in separate university departments and rarely audit one another:

1. The Philosophy of Induction and Severe Refutation: David Hume demonstrated that no finite collection of past observations logically proves that tomorrow will resemble yesterday. The sun having risen ten thousand mornings does not deductively entail that it will rise tomorrow; every defense of induction secretly assumes the uniformity of nature it tries to prove. Karl Popper answered that empirical science advances not by accumulating confirming anecdotes, but by exposing bold claims to refutation (falsification). A million white swans do not prove the universal claim “all swans are white,” whereas a single black swan refutes it.
2. Probability Theory and Statistical Inference: Blaise Pascal, Pierre de Fermat, Jacob Bernoulli, Thomas Bayes, Pierre-Simon Laplace, and Andrey Kolmogorov built the mathematical calculus of plausibility and relative frequency. Frank Ramsey, Bruno de Finetti, Jerzy Neyman, Egon Pearson, and Ronald Fisher turned that calculus into rules for updating beliefs, bounding estimation error, and testing hypotheses under finite samples.
3. Stochastic Processes, Non-Equilibrium Dynamics, and Time: Andrey Markov, Paul Langevin, Kiyosi Itô, and Ilya Prigogine studied how randomness unfolds sequentially across time. A single coin toss is memoryless; a sequence of compounded gains and losses is path-dependent. As we will see in Chapter 3, averaging across a million parallel gamblers at a single instant (ensemble average) gives a completely different answer from following a single gambler through a million consecutive bets (time average).

How to Repair a Theory Honestly: Duhem, Quine, and Lakatos

In real life, when a model’s prediction fails in production, nobody immediately throws away the entire discipline. Pierre Duhem and Willard Van Orman Quine pointed out a profound logical truth: an empirical failure never refutes an isolated hypothesis alone. A prediction is derived from a core theory jointly with a bundle of auxiliary assumptions (that the sensors were calibrated, that there was no selection bias, that the environment stayed stationary). When observation contradicts prediction, logic tells us only that something in the bundle is broken.

Because you can always save a pet theory by blaming an auxiliary assumption, Imre Lakatos divided scientific adjustments into two starkly different categories:

• A Progressive Repair adjusts the model in a way that predicts a brand-new, previously unseen fact that can itself be tested and refuted. In the 1840s, the observed orbit of Uranus deviated persistently from Newton’s laws of gravitation. Urbain Le Verrier did not abandon Newton, nor did he invent an untestable excuse. He hypothesized an unseen outer planet perturbing Uranus, calculated its exact coordinates in the night sky, and in 1846 Johann Galle pointed his telescope there and discovered Neptune.
• A Degenerative Repair modifies the model only after the fact to patch the broken prediction, generating zero new testable consequences. When a financial forecasting model crashes in a crisis and its authors add an ad hoc dummy variable for that specific month—or blame “unforeseen market sentiment”—they are performing a degenerative rescue.

History adds a crucial subtlety. In 1859, the same Le Verrier tried the exact same trick to explain the anomalous precession of Mercury’s perihelion, postulating an inner planet named Vulcan. Vulcan was not a dishonest excuse: it made concrete predictions about solar transits that astronomers actively searched for and failed to find. Only in 1915 did Albert Einstein’s General Relativity resolve Mercury’s orbit by replacing the core theory itself.

The lesson for Stochology is operational: every time a model is recalibrated, re-specified, or patched after an error, the protocol must record the attempt counter ($K \ge 1$) and demand an out-of-sample or out-of-time test that the repair could genuinely fail.

3. Foundations: Probability Without Mystery

Before we examine complex models, we must be clear about the elementary building blocks of uncertainty: probability, coherence, natural frequencies, and Bayes’ theorem.

Five Meanings Wearing the Same Number

Suppose a meteorologist says: “There is a 70% probability of rain tomorrow.” What does the number $0.70$ actually mean? Depending on who speaks and how it was computed, that single number can mean five fundamentally different things:

Stochology does not force a philosophical war among these five interpretations. Instead, it types every probability by the layer from which it came. Many catastrophic errors in courtrooms, hospitals, and trading desks happen when a number computed as a symmetry of a Model ($L_2$) or a subjective hunch of an Agent ($L_3$) is treated as a verified physical frequency of the World ($L_1$).

Coherence and the Dutch Book

Why must degrees of belief obey the mathematical axioms of probability—specifically that probabilities lie between $0$ and $1$, that mutually exclusive events add up ($P(A \cup B) = P(A) + P(B)$), and that totality sums to $1$?

Frank Ramsey (1926) and Bruno de Finetti (1937) gave a concrete operational answer: to avoid a Dutch Book—a combination of bets that guarantees a sure loss no matter what happens in the real world.

Imagine a friend who believes there is a $60%$ chance it will rain tomorrow and a $50%$ chance it will not rain. He is willing to buy a ticket that pays USD 1.00 if it rains for USD 0.60, and a second ticket that pays USD 1.00 if it does not rain for USD 0.50. You sell him both tickets and collect $USD 0.60 + USD 0.50 = USD 1.10$ upfront. Tomorrow, either it rains or it does not rain. In either case, exactly one of the two tickets wins, so you pay him back USD 1.00. Your friend has lost USD 0.10 with $100%$ certainty before looking out the window.

Yet Stochology emphasizes an asymmetry that elementary textbooks often miss: internal coherence is cheap; external calibration against the World is expensive. If your friend revises his beliefs to $60%$ rain and $40%$ no rain, no bookmaker can Dutch-book him in a single round because $0.60 + 0.40 = 1.00$. He is now internally coherent. But if he lives in a desert where it actually rains on only $5%$ of days, anyone who knows the World ($L_1$) will bankrupt him over time. Coherence only polices the Agent ($L_3$); calibration polices the bridge between the Agent and the World.

Natural Frequencies vs. Percentages: Why Intuition Fails and How Trees Fix It

Consider a classic clinical screening problem investigated by Gerd Gigerenzer and Ulrich Hoffrage (1995):

• In a routine screening population, the prevalence of a condition is $1%$.
• If a patient has the condition, the diagnostic test is positive $90%$ of the time (sensitivity $= 0.90$).
• If a patient is healthy, the test still triggers a false alarm $9%$ of the time (false-positive rate $= 0.09$, or specificity $= 0.91$).

A patient receives a positive test result. What is the probability that she actually has the condition?

When asked in percentages, a majority of physicians and analysts guess “around $80%$ or $90%$,” confusing the accuracy of the test given the disease, $P(\text{Positive} \mid \text{Disease}) = 0.90$, with the probability of the disease given the test, $P(\text{Disease} \mid \text{Positive})$.

Now watch the mystery evaporate when we replace abstract percentages with Gigerenzer Natural Frequencies—counting whole human beings out of a concrete cohort of $10\text{,}000$ patients:

Look at the two boxes of people who received a positive test result:

• $90$ sick patients tested positive;
• $891$ healthy patients also tested positive ($9%$ of $9\text{,}900$).
• In total, $90 + 891 = 981$ patients hold a positive test slip in their hands.

Out of those $981$ positive alarms, how many actually have the disease?

$$P(\text{Disease} \mid \text{Positive}) = \frac{90}{90 + 891} = \frac{90}{981} \approx 0.0917 \quad (\text{about } 1 \text{ in } 11)$$

The percentage formula and the natural-frequency tree are mathematically identical, yet the natural-frequency tree makes the base rate ($100$ vs. $9\text{,}900$) visually inescapable. That is why Step 8 of the Stochology SIGA Roadmap (crates/stochology-siga/src/roadmap.rs) translates every operational model into an integer natural-frequency tree before presenting it to a human decision-maker.

Bayes’ Rule in Odds and Turing’s Decibans

When we want to update beliefs across multiple pieces of evidence, the cleanest formulation of Bayes’ Theorem is written in odds (the ratio of the probability that a hypothesis $H$ is true to the probability that it is false, $\neg H$):

$$\underbrace{\frac{P(H \mid E)}{P(\neg H \mid E)}}_{\text{Posterior Odds}} = \underbrace{\frac{P(E \mid H)}{P(E \mid \neg H)}}_{\text{Likelihood Ratio } (\mathrm{LR})} \times \underbrace{\frac{P(H)}{P(\neg H)}}_{\text{Prior Odds}}$$

In our screening example:

• The Prior Odds are $\frac{100}{9900} = \frac{1}{99}$.
• The Likelihood Ratio of a positive test is $\mathrm{LR} = \frac{\text{Sensitivity}}{\text{False-Positive Rate}} = \frac{0.90}{0.09} = 10$.
• Multiplying them gives the Posterior Odds: $10 \times \frac{1}{99} = \frac{10}{99}$ (which is $10$ sick patients for every $99$ healthy patients, or $\frac{10}{10 + 99} = \frac{10}{109} \approx 0.0917$).

During World War II at Bletchley Park, Alan Turing and I. J. Good took one step further. By taking ten times the base-$10$ logarithm of the likelihood ratio, they defined the deciban ($\mathrm{dB}$) as the unit of weight of evidence:

$$W(E) \triangleq 10 \log_{10}\left(\frac{P(E \mid H)}{P(E \mid \neg H)}\right) \text{ decibans}$$

Why is the deciban so illuminating for students and auditors? Because logarithms turn multiplication into simple addition:

• A likelihood ratio of $10:1$ adds $+10\text{ dB}$ of evidence.
• A likelihood ratio of $100:1$ adds $+20\text{ dB}$ of evidence.
• Starting from prior odds of $1:99$ ($\approx -19.96\text{ dB}$), a $+10\text{ dB}$ positive test brings us to $-9.96\text{ dB}$ (still roughly $1:10$ against!).

Even more importantly, Turing’s scale exposes the hidden trap of redundant evidence. Two positive tests are worth $+10\text{ dB} + 10\text{ dB} = +20\text{ dB}$ only if the two tests are conditionally independent given the patient’s state. If two diagnostic tests fail for the same physical reason (for instance, dense tissue triggering the same imaging artifact twice), the second test carries far less than $+10\text{ dB}$ of fresh information. Confusing correlated repetitions with independent evidence is the root of pseudoreplication, which we will formalize via the Moulton-Campbell design effect ($\Phi_2$) in Chapter 7.

4. Reproducible Chance: Why a Fixed Seed (seed = 2026) Matters

Every stochastic simulation, bootstrap interval, and Monte Carlo integral in this textbook relies on random draws. Yet if a student in São Paulo, an auditor in Zurich, and a continuous-integration server on GitHub run the same verification script and obtain three slightly different numbers, auditing breaks down. Any bug can hide behind the excuse: “It gave a slightly different number because of random sampling.”

Stochology eliminates this ambiguity through reproducible chance. Computers generate sequences that behave statistically like random noise by applying a deterministic mathematical recurrence to an initial integer called the seed.

To see how a purely deterministic rule produces an irregular-looking sequence without mystery, consider a toy linear congruential generator: “Multiply the current number by $5$, add $3$, and keep the remainder after dividing by $16$” ($x_{t+1} = (5x_t + 3) \bmod 16$), starting from seed $x_0 = 7$:

Anyone in the world who starts from $x_0 = 7$ will obtain the exact sequence $6, 1, 8, 11$. In this repository (crates/stochology-core/src/rng.rs), we use Sebastiano Vigna’s 64-bit SplitMix64 generator anchored at seed = 2026 (Invariant $\Phi_1$).

However, you must keep three concepts strictly separate:

1. Reproducibility: Running the same code on the same dataset with seed = 2026 produces the exact same floating-point output on every machine. The fixed seed guarantees this floor.
2. Replicability: Collecting a new dataset in a new hospital, city, or year and observing that the scientific conclusion still holds. No random seed can buy replicability; only invariant causal structure (Chapter 3) and out-of-time/out-of-domain governance (Chapter 10) can test it.
3. Validity: Whether the mathematical equation in the code actually measures what the claim says it measures. A fixed seed reproduces a wrong formula just as faithfully as a right one! That is why our protocol combines fixed-seed reproducibility with algebraic identity closure and 10 negative defect proofs (Chapter 14).

5. The Three Structural Questions and the Four Prohibitions

Before fitting any parameter, training any neural network, or estimating any probability distribution, every technical claim in the Stochology Protocol must auditably answer three structural questions:

1. In which ontological layer can the system fail — the physical World ($L_1$), the mathematical Model ($L_2$), or the deciding Agent ($L_3$)?
2. Which class of uncertainty threatens inference validity — Aleatory noise ($L_1$), Parametric Epistemic ignorance ($L_2$), Structural Epistemic misspecification ($L_2$), or Knightian deep uncertainty ($L_3$)?
3. Which severe test — endowed with genuine empirical or logical refutation power — supports the confidence placed in the claim?

To enforce these three questions in code, the protocol establishes Four Golden Prohibitions (developed in full in Chapter 6):

• Prohibition 1 (No Free Prose Between Agents): Inter-module and inter-agent claims never travel as ambiguous natural-language paragraphs; they transit exclusively through structured Epistemological Cards (cards/*.yaml) validated by EpistemologicalCard::audit().
• Prohibition 2 (No Lone Mean): Under nonlinear payoffs, multiplicative dynamics, or heavy tails, reporting only the mean $\mathbb{E}[X]$ or $f(\mathbb{E}[X])$ is forbidden.
• Prohibition 3 (No Confusing Fit with Performative Validity): Low predictive error on a passive holdout set never proves that deploying the model will not deform the environment ($L_3 \to L_1$).
• Prohibition 4 (No Dogmatic Extremes and No Omitted Attempts): Probabilities of $0%$ and $100%$ are banned (Cromwell’s Rule), out-of-sample forecasts must be audited via the isotonic CORP-Murphy decomposition, and the counter of attempted specifications $K \ge 1$ must be declared.

6. How to Read and Verify This Book

Every chapter in this textbook follows a Three-Step Pedagogical Ramp:

• Step 1 — Intuition and the Real-World Paradox: We begin with a concrete operational story, everyday reasoning, and geometric or tabular intuition that requires only elementary arithmetic.
• Step 2 — Foundations and Mathematical Formalization: We derive the governing equations from first principles, defining every symbol and showing why naive textbook shortcuts break down.
• Step 3 — Auditable Laboratory in Rust and Exercises: We inspect the exact pure-Rust implementation and run the reproducible laboratory (cargo run --release --bin labs) and epistemological gates (cargo run --release --bin gates), followed by exercises to test your mastery.

At any moment, a single command in your terminal executes the complete verification suite across the entire repository:

scripts/verify.sh

This command checks code formatting (cargo fmt), enforces zero compiler or linter warnings (cargo clippy -- -D warnings), executes all unit and integration tests (cargo test), runs all seven methodological and empirical laboratories (labs --all), verifies that the eight epistemological gates approve the canonical system (gates exiting with 0), and proves that all ten injected methodological defects are caught and blocked (gates -- --defect <name> exiting with 1).

1. The Three Ontological Layers ($L_1 \to L_2 \to L_3 \to L_1$)

Learning Objectives. By the end of this chapter, you will be able to distinguish the World ($L_1$), the Model ($L_2$), and the Agent ($L_3$); locate analytical fallacies on the three bridges connecting them; apply Charles Sanders Peirce’s three modes of inference; derive and compute Xiao-Li Meng’s Fundamental Identity for selection bias and Charles Manski’s non-parametric bounds on Bridge $L_1 \to L_2$; explain convexity, Jensen’s Inequality, and the Continuous Ranked Probability Score ($\mathrm{CRPS}$) on Bridge $L_2 \to L_3$; and formalize Performative Prediction ($\theta_{\mathrm{SL}}, \theta_{\mathrm{PS}}, \theta_{\mathrm{PO}}$) and Repeated Risk Minimization contraction on Bridge $L_3 \to L_1$.

Step 1 — Intuition and the Real-World Paradox

The Territory, the Map, and the Driver

Imagine driving through an unfamiliar city during a heavy rainstorm. Three distinct realities are operating at the same time:

1. The Territory (The World, $L_1$): The physical streets of asphalt and concrete, the flooded underpass, the delivery truck double-parked around a blind corner, and the thousands of other drivers reacting to the storm. You never see the entire city at once.
2. The Map (The Model, $L_2$): A simplified representation on your dashboard screen. By design, the map omits almost everything in the physical city—the texture of the pavement, the color of the buildings, the mood of the pedestrians—so that it can fit on a screen and compute routes quickly. Yet the map is always incomplete and potentially out of date.
3. The Driver (The Agent, $L_3$): You—with limited time, finite attention, a specific destination, and an asymmetric cost function (arriving ten minutes late to dinner is a minor annoyance; driving into a flooded underpass is catastrophic).

Here is the central thesis of Chapter 1, which we call the Bridge Thesis:

Most analytical disasters in science, engineering, finance, and public policy are not errors of arithmetic inside the Map ($L_2$). They are misalignments on the three bridges connecting the Territory ($L_1$), the Map ($L_2$), and the Driver ($L_3$).

Let us watch all three bridge failures happen in a single everyday institution: a municipal health clinic.

• Failure on Bridge $L_1 \to L_2$ (The Invisible Filter): The clinic director wants to know how satisfied patients are with waiting times. She places a tablet survey at the exit of the consultation room. The spreadsheet ($L_2$) reports an average satisfaction of $92%$. The arithmetic is flawless—but the data arrived filtered: the patients who waited three hours in the lobby and walked out in frustration never entered the consultation room and never touched the tablet.
• Failure on Bridge $L_2 \to L_3$ (The Misread Summary): The clinic can serve $\mu = 12$ patients per hour. Looking at the annual ledger, the manager observes that an average of $\bar{\lambda} = 8$ patients arrive per hour. Plugging $\lambda = 8$ and $\mu = 12$ into the standard queueing formula gives a comfortable average wait of $10$ minutes. The manager ($L_3$) concludes there is plenty of slack and refuses to hire a relief nurse. What the average hid is that on half the days the clinic is calm ($\lambda = 5$ per hour, wait $\approx 3.6$ minutes) and on the other half it surges ($\lambda = 11$ per hour, wait $= 55$ minutes!). The average arrival rate is still $\frac{5 + 11}{2} = 8$, but the average wait across days is $\frac{3.6 + 55}{2} = 29.3$ minutes—and because $11$ patients per hour arrive on the bad days versus $5$ on the calm days, $\frac{11}{16} \approx 69%$ of all human beings walk in on the $55$-minute day!
• Failure on Bridge $L_3 \to L_1$ (Performativity): Alarmed by emergency-room crowding, the regional health authority announces that any clinic whose recorded waiting time exceeds $30$ minutes will lose its quarterly budget bonus. Within two months, the recorded waiting time drops to $18$ minutes. Did patient care improve? No: receptionists simply stopped registering patients at the front desk until a doctor was ready to call them, shifting the queue from the waiting room onto the sidewalk outside. The decision ($L_3$) deformed the physical process ($L_1$) it was trying to measure.

Step 2 — Foundations and Mathematical Formalization

1.1 Overview of the Closed Loop ($L_1 \to L_2 \to L_3 \to L_1$)

Every stochastic system in the protocol is mapped across three ontological layers and three directed bridges:

Peirce’s Three Modes of Inference and the Three Senses of “Bias”

Before writing equations for the three bridges, two foundational distinctions clarify how reasoning travels around this loop.

First, the philosopher and logician Charles Sanders Peirce showed that all scientific reasoning consists of three distinct operations linking a Rule, a Case, and a Result:

1. Deduction (Rule + Case $\to$ Result): “All beans in this bag are white; these beans came from this bag; therefore, these beans are white.” Deduction is truth-preserving and lives entirely inside the Model ($L_2$). If the premises hold, the conclusion is guaranteed, but it adds no new empirical knowledge about the World.
2. Induction (Case + Result $\to$ Rule): “These beans came from this bag; these beans are white; therefore, all beans in this bag are white.” Induction crosses Bridge $L_1 \to L_2$, generalizing from a finite sample to a population law. It is ampliative—it claims more than was observed, and can fail whenever the sample was filtered.
3. Abduction (Rule + Result $\to$ Case): “All beans in this bag are white; these beans on the table are white; perhaps these beans came from this bag.” Abduction is the creative leap that proposes a candidate hypothesis or causal mechanism to explain a surprising observation. It is the birthplace of every model, and also the birthplace of the Prosecutor’s Fallacy whenever an agent mistakes a plausible explanation ($P(\text{Evidence} \mid \text{Hypothesis})$) for a proven truth ($P(\text{Hypothesis} \mid \text{Evidence})$).

Second, notice how the word “bias” changes meaning depending on which layer you are standing in:

• In the World ($L_1$), selection bias means the recorded sample $n$ systematically over-represents some parts of the population $N$.
• In the Model ($L_2$), estimator bias means the expected value of a mathematical formula $\mathbb{E}[\hat{\theta}]$ differs from the true parameter $\theta$.
• In the Agent ($L_3$), cognitive or strategic bias means the decision-maker’s mental shortcuts or institutional incentives distort how forecasts are interpreted or acted upon.

When an analyst says “we corrected for bias,” your first question must always be: in which layer?

1.2 Bridge $L_1 \to L_2$: Rubin’s Taxonomy, Meng’s Identity, and Manski’s Bounds

Foundations: What Happens When Data Are Missing or Filtered?

Suppose a target population consists of $N$ units (for instance, all $N$ workers in a labor market or all $N$ patients visiting an emergency department), each carrying an outcome of interest $Y_i$. We want to know the true population average:

$$\bar{Y}_N = \frac{1}{N}\sum_{i=1}^N Y_i$$

However, we only observe a subset of $n < N$ units. To make the filter visible in mathematics, we define a binary recording indicator $R_i$ for every unit $i \in \lbrace 1, \dots, N \rbrace$:

$$R_i = \begin{cases} 1, & \text{if unit } i \text{ is recorded in our dataset,} \\ 0, & \text{if unit } i \text{ is missing or excluded.} \end{cases}$$

The total sample size is $n = \sum_{i=1}^N R_i$, the sampling fraction is $f = \frac{n}{N}$, and the sample mean we actually compute on our computer is:

$$\bar{Y}_n = \frac{\sum_{i=1}^N R_i Y_i}{\sum_{i=1}^N R_i}$$

Donald Rubin (1976) classified the physical mechanism governing $R_i$ into three regimes:

1. MCAR (Missing Completely at Random): Whether a record is observed ($R_i$) is statistically independent of both the observed covariates $X_i$ and the unseen outcome $Y_i$ ($R \perp (X, Y)$). Example: A laboratory technician accidentally drops one out of twenty blood vials on the floor. Under MCAR, the sample mean $\bar{Y}_n$ is an unbiased estimate of $\bar{Y}_N$.
2. MAR (Missing at Random): Conditional on the covariates $X_i$ that we did record, missingness no longer depends on the unseen outcome $Y_i$ ($R \perp Y \mid X$). Example: Younger respondents are less likely to answer a telephone survey, but within each age bracket, respondents and non-respondents have the same income distribution. Under MAR, we can recover $\bar{Y}_N$ by reweighting across the observed strata $X$.
3. MNAR (Missing Not at Random): Even after conditioning on all observed variables $X_i$, the probability of being recorded still depends directly on the unobserved outcome $Y_i$ itself ($R \not\perp Y \mid X$). Example: People with severely depressed earnings self-select into a government training program, or dissatisfied customers leave a platform without filling out the exit survey.

Xiao-Li Meng’s Fundamental Identity (2018) and the “Big Data Paradox”

A widespread myth in data science holds that “if the dataset is massive enough ($n$ in the hundreds of thousands or millions), selection bias no longer matters.” In 2018, Harvard statistician Xiao-Li Meng proved an exact algebraic identity that demolishes this myth.

Because $\bar{Y}_n = \frac{\frac{1}{N}\sum_{i=1}^N R_i Y_i}{\frac{1}{N}\sum_{i=1}^N R_i} = \frac{\mathbb{E}_N[R Y]}{\mathbb{E}_N[R]}$ and $\mathrm{Cov}_N(R, Y) = \mathbb{E}_N[RY] - \mathbb{E}_N[R]\mathbb{E}_N[Y]$, a three-line algebraic rearrangement yields Meng’s Fundamental Identity:

$$\bar{Y}_n - \bar{Y}_N = \underbrace{\rho_{R,Y}}_{\text{Data Quality}} \times \underbrace{\sqrt{\frac{N - n}{n}}}_{\text{Data Quantity}} \times \underbrace{\sigma_Y}_{\text{Problem Difficulty}}$$

Look closely at the three factors multiplying on the right-hand side:

1. $\rho_{R,Y} = \mathrm{Corr}_N(R, Y)$ (Data Quality): The population correlation between being recorded ($R_i$) and the outcome itself ($Y_i$). Under true simple random sampling (MCAR), $\mathbb{E}[\rho_{R,Y}^2] = \frac{1}{N - 1}$, which shrinks rapidly with population size. Under self-selection or unadjusted observational filtering (MNAR), $\rho_{R,Y}$ stays stuck at a non-zero constant (say, $+0.05$ or $+0.13$).
2. $\sqrt{\frac{N - n}{n}} = \sqrt{\frac{1 - f}{f}}$ (Data Quantity): A factor determined by the sampling fraction $f = n/N$.
3. $\sigma_Y$ (Problem Difficulty): The true population standard deviation of the outcome $Y$.

Why is this identity so devastating for naive “Big Data”? Because if a massive unrepresentative sample of size $n$ has selection correlation $\rho_{R,Y}$, its mean squared error is equal to that of a tiny, genuinely random sample of effective sample size:

$$n_{\mathrm{eff}} \approx \frac{n}{1 + n \left(\frac{N - n}{N}\right) \rho_{R,Y}^2 \cdot (\text{design scaling})}$$

In our empirical benchmark on Robert LaLonde’s (1986) labor-market data (nsw_experimental.csv, the randomized National Supported Work experiment, versus cps_observational.csv, the observational Current Population Survey comparison group of $n = 15\text{,}992$ workers), the selection correlation is $\rho_{R,Y} = +0.1334$. That seemingly modest correlation of $0.1334$ shrinks a nominal sample of $n = 15\text{,}992$ workers down to an effective sample size of $n_{\mathrm{eff}} = 2\text{,}842.70$! Over $82%$ of the apparent sample size was an illusion created by the invisible filter on Bridge $L_1 \to L_2$.

Charles Manski’s Non-Parametric Worst-Case Bounds

When missingness or selection is MNAR and we do not know $\rho_{R,Y}$ exactly, what can an honest scientist say without inventing untestable parametric assumptions?

Econometrician Charles Manski (1989, 1990) showed that whenever the outcome $Y$ is bounded by known physical or institutional limits $[Y_{\min}, Y_{\max}]$, the true population expectation $\mathbb{E}[Y]$ is strictly trapped inside a non-parametric identification interval:

$$\mathbb{E}[Y] = P(R = 1) \mathbb{E}[Y \mid R = 1] + P(R = 0) \mathbb{E}[Y \mid R = 0]$$

Since we observe the response rate $p_{\text{obs}} = P(R = 1)$ and the observed mean $\bar{Y}_{\text{obs}} = \mathbb{E}[Y \mid R = 1]$, and since the unobserved mean $\mathbb{E}[Y \mid R = 0]$ cannot be smaller than $Y_{\min}$ or larger than $Y_{\max}$, the truth must lie inside Manski’s Bounds:

$$\bigl[ p_{\text{obs}} \bar{Y}_{\text{obs}} + (1 - p_{\text{obs}}) Y_{\min} ,\quad p_{\text{obs}} \bar{Y}_{\text{obs}} + (1 - p_{\text{obs}}) Y_{\max} \bigr]$$

No matter how adversarial the missingness mechanism is, the population mean cannot escape this interval (crates/stochology-core/src/layers.rs, ManskiBounds). If a decision remains optimal at both endpoints of Manski’s interval, the decision is immune to missing-data bias; if the optimal action flips between the lower and upper bound, the analyst must declare that the conclusion depends on an untestable assumption about the unseen records.

Stratified MAR Bounds and David Lee’s (2009) Sharp Trimming Bounds

Can we tighten Manski’s worst-case interval when additional structure is observed? The protocol provides two non-parametric refinements in ManskiBounds:

1. Covariate-Stratified Bounds (ManskiBounds::compute_stratified): When the population is partitioned into $S$ observed covariate strata with population weights $w_s \ge 0$ ($\sum_{s=1}^S w_s = 1$), stratum response rates $p_{\text{obs}, s}$, and stratum-specific physical bounds $[Y_{\min, s}, Y_{\max, s}]$, aggregating the stratum bounds yields: $$\mathbb{E}[Y] \in \left[\sum_{s=1}^S w_s\bigl(p_{\text{obs}, s}\bar{Y}_{\text{obs}, s} + (1 - p_{\text{obs}, s})Y_{\min, s}\bigr),\quad \sum_{s=1}^S w_s\bigl(p_{\text{obs}, s}\bar{Y}_{\text{obs}, s} + (1 - p_{\text{obs}, s})Y_{\max, s}\bigr)\right]$$ which is guaranteed to be at least as tight as the unstratified Manski interval whenever $Y_{\min, s} \ge Y_{\min}$ and $Y_{\max, s} \le Y_{\max}$.
2. David Lee’s (2009) Sharp Trimming Bounds for Differential Attrition (ManskiBounds::lee_trimming_bounds): In randomized experiments with attrition (where treatment affects who remains observed, $p_1 = P(R(1)=1) > p_0 = P(R(0)=1)$) under monotonic selection ($R_i(1) \ge R_i(0)$), an excess fraction $q = \frac{p_1 - p_0}{p_1}$ of the observed treated group consists of units induced to remain observed by treatment. Without bounded support assumptions $[Y_{\min}, Y_{\max}]$, David Lee (2009) proved that the sharp non-parametric bounds for the average treatment effect among always-responders ($R(1)=1, R(0)=1$) are obtained by trimming the top $q$ or bottom $q$ quantiles of the observed treated distribution: $$\Delta_{\mathrm{Lee}} \in \Bigl[ \mathbb{E}\bigl[Y_1 \mid R_1 = 1,\ Y_1 \le Q_{1-q}(Y_1)\bigr] - \mathbb{E}[Y_0 \mid R_0 = 1],\quad \mathbb{E}\bigl[Y_1 \mid R_1 = 1,\ Y_1 \ge Q_q(Y_1)\bigr] - \mathbb{E}[Y_0 \mid R_0 = 1] \Bigr]$$ Alongside Lee’s bounds, empirical_wasserstein_1 computes the exact 1D Kantorovich-Wasserstein $W_1(P, Q) = \int_0^1 |F_P^{-1}(u) - F_Q^{-1}(u)|,du$ distance between the empirical outcome distributions.

1.3 Bridge $L_2 \to L_3$: Nonlinearity, Jensen’s Gap, and $\mathrm{CRPS}$

Foundations: Convexity and Why the Average Input Does Not Give the Average Output

Once data have crossed into the Model ($L_2$), a second trap awaits on Bridge $L_2 \to L_3$: reading the expected value $\mathbb{E}[X]$ as if it were the only number the decision-maker ($L_3$) needs.

Draw the curve $f(x) = x^2$ on a sheet of paper. It is a bowl opening upward—a convex function. Pick two equally likely outcomes: $x_1 = 0$ and $x_2 = 2$.

• What is the average of the inputs? $\mathbb{E}[X] = \frac{0 + 2}{2} = 1$.
• If you plug that average input into the formula, what do you get? $f(\mathbb{E}[X]) = 1^2 = 1$.
• Now compute the actual average of the outputs: $\mathbb{E}[f(X)] = \frac{0^2 + 2^2}{2} = \frac{0 + 4}{2} = 2$.

Look at the gap between the two numbers: $\mathbb{E}[f(X)] = 2$ is twice as large as $f(\mathbb{E}[X]) = 1$! Geometrically, for any convex function (a curve whose second derivative is positive, $f’’(x) > 0$), the straight chord connecting any two points on the curve lies strictly above the curve itself.

This theorem is Jensen’s Inequality (Johan Jensen, 1906): for any random variable $X$ and any convex function $f$,

$$\mathbb{E}[f(X)] \ge f(\mathbb{E}[X])$$

We define the exact difference as Jensen’s Gap ($\Delta_J$):

$$\Delta_J \triangleq \mathbb{E}[f(X)] - f(\mathbb{E}[X])$$

To see why $\Delta_J$ grows when the world becomes more volatile, expand $f(X)$ around the mean $\mu = \mathbb{E}[X]$ using a second-order Taylor series:

$$f(X) \approx f(\mu) + f’(\mu)(X - \mu) + \frac{1}{2}f’’(\mu)(X - \mu)^2$$

Taking the expectation of both sides (and noting that $\mathbb{E}[X - \mu] = 0$ while $\mathbb{E}[(X - \mu)^2] = \mathrm{Var}(X)$) yields the Second-Order Variance Toll:

$$\Delta_J = \mathbb{E}[f(X)] - f(\mathbb{E}[X]) \approx \frac{1}{2} f’’(\mu) \mathrm{Var}(X)$$

Read that equation in plain English:

Whenever a cost, waiting time, or damage function bends upward ($f’’(\mu) > 0$), variability is not neutral noise that cancels out over time. Variability pays a positive tax equal to half the curvature times the variance.

In bank_calls.csv ($164$ business days of a North American retail bank’s call center), daily call volume fluctuates across days. Under a quadratic staffing congestion penalty, evaluating the cost at the mean daily volume gives $f(\mathbb{E}[X]) = 1.0669 \times 10^9$, whereas the true average daily cost is $\mathbb{E}[f(X)] = 1.0760 \times 10^9$—leaving a Jensen’s Gap of $\Delta_J = +9\text{,}033\text{,}837.19$ that a spreadsheet using only the average day completely erases!

Evaluating Full Predictive Distributions: The Continuous Ranked Probability Score ($\mathrm{CRPS}$)

Because a single mean hides both Jensen’s Gap and tail risk, Prohibition 2 requires every model on Bridge $L_2 \to L_3$ to report not only $f(\mathbb{E}[X])$, $\mathbb{E}[f(X)]$, and $\Delta_J$, but also the median, the 5th and 95th percentiles ($q_{05}, q_{95}$), and the Continuous Ranked Probability Score ($\mathrm{CRPS}$).

What is the $\mathrm{CRPS}$, and why does Stochology mandate it? Suppose a model issues a full predictive cumulative distribution function (CDF) $F(x) = P(X \le x)$, and reality subsequently materializes at the actual number $y$. A single point metric like Root Mean Squared Error ($\mathrm{RMSE}$) ignores whether the model’s uncertainty bands were honest or delusional. The $\mathrm{CRPS}$ scores the entire predictive distribution at once by integrating the squared distance between the forecast CDF $F(x)$ and the empirical step function $\mathbb{I}\lbrace x \ge y \rbrace$ (which is $0$ below $y$ and jumps to $1$ at $y$):

$$\mathrm{CRPS}(F, y) \triangleq \int_{-\infty}^{\infty} \bigl(F(x) - \mathbb{I}\lbrace x \ge y \rbrace\bigr)^2 dx = \mathbb{E}_F|X - y| - \frac{1}{2}\mathbb{E}_F|X - X’|$$

where $X$ and $X’$ are independent draws from the predictive distribution $F$. Notice the two terms in the second expression (NonlinearSummary in crates/stochology-core/src/layers.rs):

• The first term, $\mathbb{E}_F|X - y|$, rewards the distribution for placing its mass close to the realized truth $y$ (accuracy).
• The second term, $-\frac{1}{2}\mathbb{E}_F|X - X’|$, rewards sharp, well-calibrated spread.
• Most importantly, $\mathrm{CRPS}$ is a strictly proper scoring rule: a forecaster minimizes expected $\mathrm{CRPS}$ if and only if they report their true predictive distribution $F$, with zero incentive to hedge or exaggerate confidence.
• Exact $O(n \log n)$ Order-Statistic Computation (exact_loo_empirical_crps): Naively evaluating leave-one-out empirical $\mathrm{CRPS}$ across $n$ observations requires $O(n^2)$ pairwise comparisons. By sorting the sample $x_{(1)} \le x_{(2)} \le \dots \le x_{(n)}$ once in $O(n \log n)$ time and using prefix sums together with the L-moment order-statistic identity $\sum_{1 \le i < j \le n} (x_{(j)} - x_{(i)}) = \sum_{i=1}^n (2i - 1 - n)x_{(i)}$, NonlinearSummary::evaluate computes the exact leave-one-out empirical $\mathrm{CRPS}$ in $O(n \log n)$ time.

1.4 Bridge $L_3 \to L_1$: Performative Prediction and Repeated Risk Minimization

Foundations: When Deploying the Model Deforms the World

Standard supervised learning assumes that the data-generating distribution $\mathcal{D}$ is a passive photograph of nature: whether you deploy parameter vector $\theta_1$ or $\theta_2$, the world keeps drawing pairs $Z = (X, Y) \sim \mathcal{D}$.

In human and institutional systems, this assumption is false. As economist Robert Lucas pointed out in 1976 (the Lucas Critique), and as Charles Goodhart formulated in monetary policy, whenever an agent ($L_3$) deploys a predictive model parameterized by $\theta \in \Theta$ to allocate credit, route traffic, set insurance premiums, or trigger police patrols, the population in the World ($L_1$) reacts to the rule. Deploying $\theta$ changes the distribution of the data from $\mathcal{D}$ to $\mathcal{D}(\theta)$.

In 2020, Juan Perdomo, Tijana Zrnic, Celestine Mendler-Dünner, and Moritz Hardt unified this feedback loop under the mathematical theory of Performative Prediction.

To reason cleanly about Bridge $L_3 \to L_1$, we must distinguish two risk functions:

$$\mathrm{PR}(\theta) \triangleq \mathbb{E}_{Z \sim \mathcal{D}(\theta)}[\ell(Z; \theta)], \qquad \mathrm{DPR}(\theta, \phi) \triangleq \mathbb{E}_{Z \sim \mathcal{D}(\theta)}[\ell(Z; \phi)]$$

Look at the difference between the two formulas:

• In Decoupled Performative Risk $\mathrm{DPR}(\theta, \phi)$, the first argument $\theta$ fixes the World’s distribution $\mathcal{D}(\theta)$ (how the population is currently behaving under the previously deployed policy $\theta$), while the second argument $\phi$ is the new candidate model being evaluated on yesterday’s data.
• In Performative Risk $\mathrm{PR}(\theta) = \mathrm{DPR}(\theta, \theta)$, both arguments move together: it measures the true loss you will experience after you deploy $\theta$ and the world shifts to $\mathcal{D}(\theta)$.

This distinction reveals two fundamentally different equilibria that analysts routinely conflate (Prohibition 3):

1. Performative Stability ($\theta_{\mathrm{PS}}$ — The Myopic Retraining Fixed Point): What happens in almost every modern MLOps pipeline? Data scientists collect data under the current model $\theta_t$, retrain a new model $\theta_{t+1} = \arg\min_\phi \mathrm{DPR}(\theta_t, \phi)$ as if the distribution were static, deploy $\theta_{t+1}$, and repeat. This loop is called Repeated Risk Minimization (RRM). If RRM converges to a fixed point where retraining no longer changes the parameters, that point is Performatively Stable: $$\theta_{\mathrm{PS}} = \arg\min_{\phi \in \Theta} \mathrm{DPR}(\theta_{\mathrm{PS}}, \phi)$$ At $\theta_{\mathrm{PS}}$, the model looks perfectly optimal on its own fresh validation data—yet it is completely blind to how its own deployment shifted $\mathcal{D}(\theta_{\mathrm{PS}})$!

2. Performative Optimality ($\theta_{\mathrm{PO}}$ — The True Stackelberg Equilibrium): An agent who understands Bridge $L_3 \to L_1$ acts as a Stackelberg leader: instead of taking $\mathcal{D}(\theta)$ as frozen, the agent differentiates through the environment’s reaction map $\theta \mapsto \mathcal{D}(\theta)$ and minimizes total Performative Risk directly: $$\theta_{\mathrm{PO}} = \arg\min_{\theta \in \Theta} \mathrm{PR}(\theta)$$

Step-by-Step Derivation of the Canonical Linear Benchmark

Let us derive the exact gap between passive learning ($\theta_{\mathrm{SL}}$), Performative Stability ($\theta_{\mathrm{PS}}$), and Performative Optimality ($\theta_{\mathrm{PO}})$ in the canonical linear-quadratic system implemented in PerformativeSystem (crates/stochology-core/src/layers.rs).

Suppose that when the institution deploys decision parameter $\theta$, the outcome in the world reacts linearly with performative sensitivity $\varepsilon$:

$$Y(\theta) = \mu + \varepsilon\theta + \xi, \qquad \mathbb{E}[\xi] = 0,\quad \mathrm{Var}(\xi) = \sigma^2$$

and the institution evaluates candidate parameter $\phi$ under the strongly convex regularized loss:

$$\ell(Y; \phi) = \frac{\gamma}{2}(Y - \phi)^2 - \alpha\phi \qquad (\gamma > 0)$$

1. Passive Supervised Learning ($\theta_{\mathrm{SL}}$, ignoring feedback $\varepsilon = 0$): Before the model is deployed ($\theta = 0$), $\mathbb{E}[Y(0)] = \mu$. Minimizing $\mathbb{E}[\ell(Y(0); \phi)] = \frac{\gamma}{2}[(\mu - \phi)^2 + \sigma^2] - \alpha\phi$ with respect to $\phi$ sets the derivative to zero: $$-\gamma(\mu - \phi) - \alpha = 0 \implies \theta_{\mathrm{SL}} = \mu + \frac{\alpha}{\gamma}$$

2. Repeated Risk Minimization and Performative Stability ($\theta_{\mathrm{PS}}$): When $\theta_t$ is deployed in round $t$, the environment shifts its mean to $\mathbb{E}[Y(\theta_t)] = \mu + \varepsilon\theta_t$. A myopic retrainer holds $\theta_t$ fixed and minimizes $\mathrm{DPR}(\theta_t, \phi)$ over $\phi$: $$-\gamma(\mu + \varepsilon\theta_t - \phi) - \alpha = 0 \implies \theta_{t+1} = \mu + \frac{\alpha}{\gamma} + \varepsilon\theta_t$$ Setting $\theta_{t+1} = \theta_t = \theta_{\mathrm{PS}}$ gives the Performative Stability fixed point: $$\theta_{\mathrm{PS}} = \frac{\mu + \alpha / \gamma}{1 - \varepsilon}$$

3. True Performative Optimality ($\theta_{\mathrm{PO}}$, Stackelberg Equilibrium): Now substitute $\phi = \theta$ before differentiating! The true Performative Risk is: $$\mathrm{PR}(\theta) = \mathbb{E}\left[\frac{\gamma}{2}(\mu + \varepsilon\theta + \xi - \theta)^2 - \alpha\theta\right] = \frac{\gamma}{2}\bigl[(1 - \varepsilon)\theta - \mu\bigr]^2 + \frac{\gamma}{2}\sigma^2 - \alpha\theta$$ Differentiating $\mathrm{PR}(\theta)$ with respect to $\theta$ (including the $(1 - \varepsilon)$ chain-rule factor from the environment’s reaction!) and setting the derivative to zero yields: $$\gamma(1 - \varepsilon)\bigl[(1 - \varepsilon)\theta_{\mathrm{PO}} - \mu\bigr] - \alpha = 0 \implies \theta_{\mathrm{PO}} = \frac{\mu}{1 - \varepsilon} + \frac{\alpha}{\gamma(1 - \varepsilon)^2}$$

Compare $\theta_{\mathrm{PS}}$ and $\theta_{\mathrm{PO}}$: whenever $\alpha \neq 0$ and $\varepsilon \neq 0$, retraining to stability ($\theta_{\mathrm{PS}}$) converges to a strictly suboptimal policy ($\theta_{\mathrm{PS}} \neq \theta_{\mathrm{PO}}$) because myopic retraining ignores the derivative $\frac{\partial \mathcal{D}(\theta)}{\partial \theta}$!

Even worse, what if the environment is highly reactive? Under Wasserstein-1 distribution sensitivity $W_1(\mathcal{D}(\theta), \mathcal{D}(\theta’)) \le \varepsilon\lVert\theta - \theta’\rVert_2$, $\gamma$-strong convexity, and $\beta$-smoothness of the loss, Perdomo et al. proved that Repeated Risk Minimization contracts via:

$$\lVert\theta_{t+1} - \theta_{\mathrm{PS}}\rVert_2 \le \left(\frac{\varepsilon\beta}{\gamma}\right) \lVert\theta_t - \theta_{\mathrm{PS}}\rVert_2$$

Thus, RRM converges if and only if the contraction ratio satisfies $r_{\mathrm{RRM}} \triangleq \frac{\varepsilon\beta}{\gamma} < 1$. Whenever $\frac{\varepsilon\beta}{\gamma} \ge 1$, retraining the model on its own induced data causes violent self-reinforcing oscillations that destabilize the real world (--defect performativity).

Escaping the Myopic Fixed Point: Performative Gradient Descent (PerfGD)

How can an institution reach the true Stackelberg Performative Optimum $\theta_{\mathrm{PO}}$ instead of getting trapped at the myopic retraining equilibrium $\theta_{\mathrm{PS}}$? In 2021, Zachary Izzo, Lexing Ying, and James Zou introduced Performative Gradient Descent (PerfGD) (PerformativeSystem::perfgd_trajectory). Whereas standard retraining ignores how deploying $\theta$ shifts the distribution $\mathcal{D}(\theta)$, PerfGD updates $\theta_t$ along the total performative gradient:

$$\nabla_\theta \mathrm{PR}(\theta_t) = \underbrace{\nabla_2 \mathrm{DPR}(\theta_t, \theta_t)}_{\text{Standard Gradient (Myopic)}} + \underbrace{\nabla_1 \mathrm{DPR}(\theta_t, \theta_t)}_{\text{Performative Distribution Shift Gradient}}$$

In our linear-quadratic system, $\nabla_\theta \mathrm{PR}(\theta) = \gamma(1 - \varepsilon)\bigl[(1 - \varepsilon)\theta - \mu\bigr] - \alpha$, so stepping via $\theta_{t+1} = \theta_t - \eta\nabla_\theta \mathrm{PR}(\theta_t)$ converges directly to $\theta_{\mathrm{PO}} = 2.03125$, achieving strictly lower Performative Risk than Repeated Risk Minimization ($\mathrm{PR}(\theta_{\mathrm{PO}}) = -0.8203 < \mathrm{PR}(\theta_{\mathrm{PS}}) = -0.8125$).

Step 3 — Auditable Laboratory in Rust and Exercises

In crates/stochology-core/src/layers.rs, the three bridges are implemented in MengAudit, ManskiBounds, NonlinearSummary, and PerformativeSystem. Run Laboratory 1 from your terminal:

cargo run --release --bin labs -- --layers

=== LAB 1: THREE ONTOLOGICAL LAYERS AND BRIDGE MECHANICS (L1 -> L2 -> L3 -> L1) ===
  [Bridge L1->L2] Meng (CPS n=15992 vs NSW n=260): rho_R_Y=+0.1334, selection_err=+164.65, n_eff_Meng=2842.70 | Manski MNAR=[5463.2, 13835.3] | Lee(q=0.031)=[838.7, 2007.2], W1=1722.7
  [Bridge L2->L3] Jensen Gap (bank_calls, 164 days): f(E[X])=1066924927.55, E[f(X)]=1075958764.73, Delta_J=+9033837.19, median=1025216361.00, q05=830290416.50, q95=1481646385.00, OOS_CRPS=90551681.37
  [Bridge L3->L1] Performative Prediction: theta_SL=1.5000, theta_PS=1.8750, theta_PO=2.0312 (PerfGD_30=2.0312), PR(PS)=-0.8125 vs PR(PO)=-0.8203, r_RRM=0.300 (converges=true), oscillation_violated=[1.0, 0.0, 1.0, 0.0, 1.0]

Examine the three lines of output:

1. On Bridge $L_1 \to L_2$, comparing the observational CPS sample ($n = 15\text{,}992$) against the randomized NSW benchmark reveals $\rho_{R,Y} = +0.1334$, collapsing the effective sample size to $n_{\mathrm{eff}} = 2\text{,}842.70$, while the assumption-free Manski MNAR bounds trap the true earnings within $[5\text{,}463.2,\ 13\text{,}835.3]$ and David Lee’s (2009) trimming bounds under $q = 3.1%$ differential attrition bound the always-responder treatment effect within $[838.7,\ 2\text{,}007.2]$ (W1 = 1722.7).
2. On Bridge $L_2 \to L_3$, across the $164$ days of bank_calls.csv, the nonlinear congestion loss exhibits a positive Jensen’s Gap of $\Delta_J = +9\text{,}033\text{,}837.19$ above the naive plug-in mean evaluation $f(\mathbb{E}[X])$, and reports the full quantile profile ($q_{05}$, median, $q_{95}$) alongside the exact $O(n \log n)$ out-of-sample $\mathrm{CRPS} = 9.055 \times 10^7$.
3. On Bridge $L_3 \to L_1$, with $\mu = 1.0, \varepsilon = 0.20, \alpha = 0.50, \gamma = 1.0, \beta = 1.50$, passive learning chooses $\theta_{\mathrm{SL}} = 1.5000$, Repeated Risk Minimization converges ($r_{\mathrm{RRM}} = \frac{0.20 \times 1.50}{1.0} = 0.300 < 1$) to $\theta_{\mathrm{PS}} = 1.8750$ ($\mathrm{PR} = -0.8125$), whereas Performative Gradient Descent (PerfGD_30 = 2.0312) reaches the Stackelberg leader optimum $\theta_{\mathrm{PO}} = 2.0312$ with strictly lower Performative Risk ($\mathrm{PR} = -0.8203$). When the contraction condition is violated, RRM oscillates endlessly ([1.0, 0.0, 1.0, 0.0, 1.0]).

Exercises

1. (Concept — Bridge Diagnosis) Classify each of the following failures by its primary bridge ($L_1 \to L_2$, $L_2 \to L_3$, or $L_3 \to L_1$):
   • (a) A wartime air force armors the fuselage sections where returning bombers have the most bullet holes, forgetting that planes hit in the engines never returned to be counted (Abraham Wald’s survivorship paradox).
   • (b) An agricultural planner computes the crop yield at the average annual rainfall, ignoring that a drought year followed by a flood year destroys the harvest in both years.
   • (c) A navigation app sends ten thousand drivers down a quiet residential side street because its historical travel-time model predicted zero congestion there, creating a two-hour gridlock.
2. (Calculation — Meng’s Identity) Suppose a national health registry covers $n = 2\text{,}000\text{,}000$ self-enrolled citizens out of a population of $N = 10\text{,}000\text{,}000$, with outcome standard deviation $\sigma_Y = 50$ and a tiny selection correlation $\rho_{R,Y} = +0.04$. Using Meng’s Identity, calculate the exact selection bias $\bar{Y}_n - \bar{Y}_N$. Why did a sample of two million people fail to make this error vanish?
3. (Calculation — Jensen’s Gap) A hospital emergency room has capacity $\mu = 20$ patients/hour and waiting time proportional to $W(\lambda) = \frac{\lambda}{\mu - \lambda}$. Compare $W(\mathbb{E}[\lambda])$ against $\mathbb{E}[W(\lambda)]$ when arrival rate $\lambda$ is $10$ patients/hour on half the shifts and $18$ patients/hour on the other half. What is $\Delta_J$?
4. (Laboratory — Performativity Gate) Run cargo run --release --bin gates -- --defect performativity and verify that the gate exits with code 1 when $\frac{\varepsilon\beta}{\gamma} \ge 1$.

Chapter Summary

• Every model operates inside the closed feedback loop World ($L_1$) $\to$ Model ($L_2$) $\to$ Agent ($L_3$) $\to$ World ($L_1$).
• Bridge $L_1 \to L_2$ is governed by Rubin’s missingness taxonomy (MCAR, MAR, MNAR), Meng’s Identity ($\bar{Y}_n - \bar{Y}_N = \rho_{R,Y}\sqrt{\frac{N-n}{n}}\sigma_Y$), and Manski’s non-parametric bounds.
• Bridge $L_2 \to L_3$ is governed by Jensen’s Inequality ($\Delta_J = \mathbb{E}[f(X)] - f(\mathbb{E}[X]) \approx \frac{1}{2}f’’(\mu)\mathrm{Var}(X)$) and strictly proper distributional scoring via $\mathrm{CRPS}$.
• Bridge $L_3 \to L_1$ is governed by Performative Prediction, separating passive fit ($\theta_{\mathrm{SL}}$), myopic retraining stability ($\theta_{\mathrm{PS}}$), and Stackelberg optimality ($\theta_{\mathrm{PO}}$), subject to the strict RRM contraction barrier $\frac{\varepsilon\beta}{\gamma} < 1$.

2. The Typology of Uncertainty

Learning Objectives. By the end of this chapter, you will be able to distinguish Aleatory, Parametric Epistemic, Structural Epistemic, and Knightian uncertainty; use the Law of Total Variance and the Stirling Matrix to diagnose where ignorance lives; apply Pierre-Simon Laplace’s Rule of Succession to prevent dogmatic zero-probability estimates; explain parameter pseudo-convergence and Marc Kennedy and Anthony O’Hagan’s (2001) Gaussian Process structural discrepancy ($\delta(x)$); and combine Yakov Ben-Haim’s Info-Gap Decision Theory ($\hat{\alpha}, \hat{\beta}$) with Moshe Sniedovich’s Global Maximin (Wald) Safeguard to avoid catastrophic failure in “No-Man’s Land.”

Step 1 — Intuition and the Real-World Paradox

The Christmas Turkey and the Three Coins

Bertrand Russell once told the parable of an inductive chicken, later retold by Nassim Nicholas Taleb as the Christmas Turkey. Every morning at 9:00 a.m. sharp, the farmer walks into the barn and fills the trough with corn.

• On Day 1, the turkey is cautious.
• By Day 20, the turkey has formed a statistical hypothesis: “The appearance of the farmer at 9:00 a.m. causes breakfast.”
• By Day 100, the turkey has a hundred consecutive confirmations and zero counterexamples. Using standard textbook confidence intervals, the turkey’s estimated probability of being fed tomorrow morning approaches $100%$, and its standard error has shrunk to almost nothing.

Day 101 is the Wednesday before Thanksgiving (or Christmas Eve). The farmer walks in at 9:00 a.m., not with corn, but with an axe.

Why did one hundred days of real empirical data make the turkey more vulnerable rather than safer? Because the event that killed the turkey was never in the turkey’s list of hypotheses. More data only shrink uncertainty inside a correctly specified model; when the model’s hypothesis space omits the true mechanism of the world, accumulating more data merely builds false confidence around the wrong answer.

To see why treating all “uncertainty” as a single blurry concept is fatal, compare four situations:

1. The Known Fair Coin (Aleatory Uncertainty — $L_1$): You are about to toss a physically verified, symmetric coin once. Will it land Heads or Tails? Nobody on Earth can predict the single toss, and collecting a billion historical coin tosses will not make the next toss any closer to $100%$ Heads. The probability stays $50/50$ forever. This is irreducible physical randomness.
2. The Bent Coin of Unknown Bias (Parametric Epistemic Uncertainty — $L_2$): Someone hands you a bent coin from a workshop. It has a fixed physical bias $\theta \in (0, 1)$, but you do not know the number $\theta$. After $3$ tosses, you are very uncertain about $\theta$; after $10\text{,}000$ tosses, the Law of Large Numbers pins $\theta$ down to within a hundredth of a percent. Here, more data cure ignorance.
3. The Straight Ruler on a Curved Planet (Structural Epistemic Uncertainty — $L_2$): An engineer fits a linear friction formula $y = \theta x$ to predict wind drag on an aircraft wing across high-subsonic speeds, where shockwaves actually bend the physics nonlinearly. As the engineer collects more measurements, the least-squares fit forces the single knob $\theta$ to twist into an unphysical number just to compromise between the low-speed and high-speed points. The confidence interval around $\theta$ shrinks toward zero while the formula itself remains structurally wrong.
4. The Turkey’s Morning (Knightian Uncertainty — $L_3$): A decision-maker faces regimes, strategic reactions, or structural breaks where neither a unique probability distribution nor an exhaustive list of states can be trusted.

Step 2 — Foundations and Mathematical Formalization

2.1 The Law of Total Variance and the Stirling Matrix

Separating Aleatory Noise from Epistemic Ignorance

Mathematics gives us an exact accounting identity to separate the randomness of the World ($L_1$) from the parameter ignorance of the Model ($L_2$). Suppose an outcome $Y$ is governed by an unknown parameter vector $\theta$. By the Law of Total Variance (also known as Eve’s Law):

$$\mathrm{Var}(Y) = \underbrace{\mathbb{E}_\theta\bigl[\mathrm{Var}(Y \mid \theta)\bigr]}_{\text{Aleatory Uncertainty ($L_1$)}} + \underbrace{\mathrm{Var}_\theta\bigl(\mathbb{E}[Y \mid \theta]\bigr)}_{\text{Parametric Epistemic Uncertainty ($L_2$)}}$$

Examine the two additive pieces on the right-hand side:

• The first term, $\mathbb{E}_\theta[\mathrm{Var}(Y \mid \theta)]$, is Aleatory Uncertainty: Even if an oracle whispered the exact true parameter $\theta$ into your ear, the outcome $Y$ would still fluctuate around $\mathbb{E}[Y \mid \theta]$ with variance $\mathrm{Var}(Y \mid \theta)$. Because this variability belongs to the physical generating process in $L_1$, collecting more data never reduces it to zero. You cannot “research away” aleatory risk; you mitigate it by buying insurance, building safety margins, capping exposure (Chapter 3), or redesigning the physical system.
• The second term, $\mathrm{Var}_\theta(\mathbb{E}[Y \mid \theta])$, is Parametric Epistemic Uncertainty: It measures how much the expected outcome $\mathbb{E}[Y \mid \theta]$ shifts across the plausible values of $\theta$ that your finite sample has not yet ruled out. As sample size $n \to \infty$ in an identifiable model, the posterior distribution of $\theta$ concentrates on a single point, and this second term shrinks to zero.

The Stirling Matrix: Crossing Outcomes with Probabilities

What happens when even the list of possible outcomes or the functional form of the model is in doubt? Science-policy theorist Andy Stirling organized uncertainty into a $2 \times 2$ diagnostic grid according to how well we know (1) the possible outcomes and (2) the probabilities attached to them:

In 1921, economist Frank Knight drew the classic boundary between measurable Risk (Column 1) and unmeasurable Uncertainty (Column 2 and Row 2). In the Stochology Protocol (crates/stochology-core/src/uncertainty.rs and card.rs), every Epistemological Card must declare its dominant uncertainty class from four formal types:

2.2 Parametric Epistemic Uncertainty: Laplace’s Rule of Succession

Suppose an insurer examines $n = 36$ consecutive months of fire-reinsurance records (as happened in the 1986–1988 window of danish_fire.csv) and observes $s = 0$ claims exceeding $50\text{ million DKK}$. What is the probability $p$ that a catastrophic claim will strike next month?

A naive frequentist plug-in estimator computes:

$$\hat{p}_{\text{naive}} = \frac{s}{n} = \frac{0}{36} = 0.00$$

Reporting $\hat{p} = 0$ is an epistemological crime (Prohibition 4, Cromwell’s Rule): it confuses “it did not happen in this 36-month window” with “it is physically impossible.” If an underwriter believes $p = 0$, any finite premium looks like free money, encouraging infinite leverage and guaranteeing eventual ruin (which arrived in August 1989 with a $152.4\text{M DKK}$ fire loss).

How do we prevent small samples from collapsing to dogmatic $0%$ or $100%$? In 1774, Pierre-Simon Laplace asked that exact question—famously framing it as the probability that the sun will rise tomorrow given that it has risen $n$ times in a row. Starting from a uniform $\mathrm{Beta}(1, 1)$ prior over the unknown probability $\theta \in [0, 1]$ and observing $s$ successes in $n$ independent Bernoulli trials, the posterior distribution is $\mathrm{Beta}(s + 1, n - s + 1)$, whose expectation is Laplace’s Rule of Succession:

$$\hat{p}_{\text{Laplace}} = \frac{s + 1}{n + 2}$$

Look at what this simple, transparent formula achieves:

• Before any data are collected ($n = 0, s = 0$), $\hat{p} = \frac{1}{2}$ (maximum entropy over a binary outcome).
• After $n = 36$ clean months with $s = 0$ hits, $\hat{p} = \frac{0 + 1}{36 + 2} = \frac{1}{38} \approx 0.0263$ ($2.63%$ per month)—never zero!
• As sample size grows large ($n \to \infty$), the $+1$ and $+2$ pseudocounts wash out and $\frac{s+1}{n+2} \to \frac{s}{n}$ smoothly.

2.3 Structural Epistemic Uncertainty: Kennedy-O’Hagan Discrepancy ($\delta(x)$)

The Trap of Parameter Pseudo-Convergence

Now consider a much deeper danger in $L_2$. Suppose an engineer or economist builds a mechanistic computer simulator $\eta(x, \theta)$ to predict a physical system $y(x)$ across control inputs $x$, where $\theta$ represents a physical constant (for instance, thermal conductivity, aerodynamic drag, or risk aversion).

In reality, no mathematical model $\eta(x, \theta)$ captures $100%$ of the real world’s physics. There is always a missing physical term—a structural discrepancy $\delta(x)$ separating the true generating process of the World ($L_1$) from the idealized simulator ($L_2$).

What happens if we ignore $\delta(x)$ and calibrate the model by minimizing ordinary least squares $\sum_{i=1}^n \bigl(y_i - \eta(x_i, \theta)\bigr)^2$?

1. Biased Physical Parameters (Pseudo-Convergence): The optimizer forces the physical knob $\theta$ away from its true physical value $\theta_{\text{true}}$ toward a distorted value $\hat{\theta}_{\text{naive}}$ that tries to soak up the missing curve $\delta(x)$ inside the training domain.
2. Delusional Confidence: As $n$ grows, the standard error around $\hat{\theta}_{\text{naive}}$ shrinks as $1/\sqrt{n}$. The analyst becomes $99.9%$ confident in a wrong parameter!
3. Extrapolation Collapse: The moment the decision-maker uses $\eta(x, \hat{\theta}_{\text{naive}})$ at a new operational point $x_{\text{extrap}}$ outside the training range, the distorted parameter $\hat{\theta}_{\text{naive}}$ and the unmodeled discrepancy $\delta(x_{\text{extrap}})$ stop canceling each other out, producing a catastrophic prediction error with tiny nominal error bars.

Marc Kennedy and Anthony O’Hagan’s (2001) Solution

In a landmark 2001 paper in the Journal of the Royal Statistical Society, Marc Kennedy and Anthony O’Hagan solved this problem by promoting the model’s structural flaw to a first-class mathematical object:

$$y(x) = \underbrace{\eta(x, \theta)}_{\text{Simulator ($L_2$)}} + \underbrace{\delta(x)}_{\text{Structural Discrepancy}} + \underbrace{\varepsilon}_{\text{Aleatory Noise ($L_1$)}}, \qquad \delta(x) \sim \mathcal{GP}\bigl(m(x), k(x, x’)\bigr)$$

What does $\delta(x) \sim \mathcal{GP}(m(x), k(x, x’))$ mean from first principles? A Gaussian Process ($\mathcal{GP}$) is simply a probability distribution over smooth unknown functions. Instead of assuming that the missing physics $\delta(x)$ is a specific polynomial, a $\mathcal{GP}$ specifies only a prior mean function $m(x)$ (typically $0$) and a covariance kernel $k(x, x’)$, such as the squared-exponential kernel:

$$k(x, x’) = \sigma_\delta^2 \exp\left(-\frac{(x - x’)^2}{2\ell^2}\right)$$

This kernel says something completely intuitive:

• If two inputs $x$ and $x’$ are close together ($|x - x’| \ll \ell$), the simulator’s structural errors $\delta(x)$ and $\delta(x’)$ must be similar (highly correlated).
• If a new query point $x_{\text{extrap}}$ moves far away from all previously observed training data ($|x_{\text{extrap}} - x_i| \gg \ell$), the correlation drops toward zero and the predictive variance automatically inflates back to $\sigma_\delta^2$, honestly warning the decision-maker that the model is extrapolating into the dark!

Why Boundary Anchoring Is Essential

There is one subtle identifiability trap in the raw Kennedy-O’Hagan equation: if $\delta(x)$ can be any curve, how can the data tell the difference between changing $\theta$ inside $\eta(x, \theta)$ and changing $\delta(x)$? Without an identifiability constraint, $\theta$ and $\delta(x)$ are confounded (Brynjarsdóttir & O’Hagan, 2014).

In KennedyOHaganDiscrepancy (crates/stochology-core/src/uncertainty.rs), the protocol enforces anchor constraints (known physical boundary regimes, such as low-excitation anchor points $x_0$ where the idealized law $\eta(x, \theta)$ holds closely and $\delta(x_0) \approx 0$). Anchoring breaks the collinearity between $\eta(x, \theta)$ and $\delta(x)$:

• The anchor regime pins down the true physical parameter $\theta$ without distortion;
• The Gaussian Process $\delta(x)$ absorbs the nonlinear structural departure away from the anchor;
• And out-of-domain predictions carry honest, widened uncertainty bands.

Exact Cholesky Factorization and Empirical Bayes Type-II Maximum Likelihood

How do we select the Gaussian Process hyperparameters—the correlation length-scale $\ell$ and the discrepancy amplitude $\sigma_\delta$—without ad-hoc hand-tuning? In crates/stochology-core/src/uncertainty.rs, the covariance matrix $\Sigma = K_\delta(X, X; \ell, \sigma_\delta) + \sigma_n^2 I$ is factorized via exact lower-triangular Cholesky decomposition $\Sigma = L L^\top$ (cholesky_decompose, cholesky_solve, cholesky_log_det). Given residual vector $r = y - \eta(X, \hat{\theta})$, KennedyOHaganDiscrepancy::log_marginal_likelihood evaluates the exact Gaussian Process Log Marginal Likelihood (Type-II MLE):

$$\ln p(y \mid X, \hat{\theta}, \ell, \sigma_\delta) = \underbrace{-\frac{1}{2} r^\top (K_\delta + \sigma_n^2 I)^{-1} r}_{\text{Data Fit}} \underbrace{- \sum_{i=1}^n \ln L_{ii}}_{\text{Occam’s Razor Complexity Penalty } (-\frac{1}{2}\ln|\Sigma|)} - \frac{n}{2}\ln(2\pi)$$

Notice how the Cholesky log-determinant term $-\frac{1}{2}\ln|\Sigma| = -\sum_{i=1}^n \ln L_{ii}$ acts as an automatic Bayesian Occam’s Razor, penalizing overly wiggly kernels ($\ell \to 0$) while the quadratic form $-\frac{1}{2}r^\top\Sigma^{-1}r$ penalizes underfitting (KennedyOHaganDiscrepancy::calibrate_empirical_bayes).

2.4 Knightian Uncertainty: Info-Gap Decision Theory and Sniedovich’s Safeguard

Foundations: Decision Criteria When Probabilities Cannot Be Trusted

What should an agent ($L_3$) do when operating in the right-hand column of the Stirling Matrix, where probability distributions over future states of the world $u \in \mathcal{U}$ do not exist or cannot be trusted?

Classical decision theory offers four foundational rules, illustrated famously by David van Dantzig (1956) after the catastrophic 1953 North Sea flood prompted the Netherlands to redesign the height of its coastal dikes:

Yakov Ben-Haim’s Info-Gap Decision Theory

In engineering design and operational resilience, Yakov Ben-Haim proposed Info-Gap Decision Theory as a way to navigate severe uncertainty when you have a nominal (best-guess) model $\tilde{u}$ that you know may be wrong, and a critical survival requirement $r_c$ (the minimum reward $R(q, u) \ge r_c$ the system needs to avoid disaster).

Instead of fixing a single uncertainty set, Info-Gap surrounds the nominal model $\tilde{u}$ with a nested family of uncertainty balls $\mathcal{U}(\alpha, \tilde{u})$ indexed by an uncertainty horizon $\alpha \ge 0$:

$$\mathcal{U}(\alpha, \tilde{u}) = \bigl\lbrace u : \lVert u - \tilde{u} \rVert \le \alpha \bigr \rbrace$$

When $\alpha = 0$, the ball contains only the nominal guess $\tilde{u}$. As $\alpha$ grows, the ball expands to allow larger and larger departures from $\tilde{u}$. Info-Gap then defines two horizons for each candidate decision $q$:

1. The Robustness Horizon ($\hat{\alpha}(q, r_c)$ — Immunity to Failure): $$\hat{\alpha}(q, r_c) = \max\left\lbrace \alpha \ge 0 : \min_{u \in \mathcal{U}(\alpha, \tilde{u})} R(q, u) \ge r_c \right\rbrace$$ In plain words: How wrong can our nominal model $\tilde{u}$ be (how large can $\alpha$ get) before decision $q$ risks violating the survival threshold $r_c$? A larger $\hat{\alpha}$ means more robustness.

2. The Opportuneness Horizon ($\hat{\beta}(q, r_w)$ — Propensity for Windfall): $$\hat{\beta}(q, r_w) = \min\left\lbrace \alpha \ge 0 : \max_{u \in \mathcal{U}(\alpha, \tilde{u})} R(q, u) \ge r_w \right\rbrace$$ In plain words: What is the smallest departure $\alpha$ from the nominal model needed to make an ambitious windfall reward $r_w > r_c$ possible? A smaller $\hat{\beta}$ means windfall requires less luck.

A central theorem of Info-Gap is the Zero-ing Property: if you demand a critical reward $r_c$ equal to what the nominal model predicts ($r_c = R(q, \tilde{u})$), your robustness horizon is identically zero ($\hat{\alpha}(q, R(q, \tilde{u})) = 0$). Optimizing for the nominal model buys zero robustness against model error! To gain positive robustness ($\hat{\alpha} > 0$), you must step back from nominal optimality and satisfice.

Moshe Sniedovich’s Critique (“No-Man’s Land”) and the Global Wald Safeguard

Why does the Stochology Protocol refuse to use raw Info-Gap alone?

In a series of incisive mathematical papers (2007–2012), operations researcher Moshe Sniedovich proved a fatal flaw in unguarded Info-Gap analysis. Because $\hat{\alpha}(q, r_c)$ expands outward from a single local point $\tilde{u}$ and stops looking the instant a curve crosses $r_c$, Info-Gap is completely blind to what happens at $\alpha > \hat{\alpha}(q, r_c)$—a region Sniedovich called “No-Man’s Land.”

Look at how easily raw Info-Gap can recommend a Christmas Turkey:

• Suppose Option A (Fragile Turkey) performs brilliantly near the nominal guess $\tilde{u}$ and stays above $r_c = 100$ up to $\hat{\alpha}_A = 1.60$, but at $\alpha = 2.0$ its performance plunges off a cliff to $-450$ (total systemic ruin).
• Suppose Option B (Robust Engineering) has a slightly smaller local crossing or a modest trade-off near $\tilde{u}$, or stays above $r_c$ up to $\hat{\alpha}_B = 3.50$, and even under the worst conceivable state in the entire physical universe $\mathcal{U}_{\text{global}}$, its reward never drops below $+45.0$.

If $\tilde{u}$ is severely misspecified—which is the very definition of Knightian uncertainty!—reality may easily lie outside $\mathcal{U}(\hat{\alpha}, \tilde{u})$. An algorithm that checks only local robustness around a wrong guess $\tilde{u}$ is performing a local maximin around a fiction while ignoring global catastrophe.

To cure this defect permanently, InfoGapOption (crates/stochology-core/src/uncertainty.rs) enforces Sniedovich’s Global Maximin Safeguard:

Every decision under Knightian uncertainty must pass three simultaneous checks:

1. Zero-ing Audit: $\hat{\alpha}(q, R(q, \tilde{u})) = 0$ is verified algebraically;
2. Positive Local Robustness: $\hat{\alpha}(q, r_c) > 0$ at the declared critical threshold $r_c$;
3. Global Wald Maximin Safeguard: Across the entire physically admissible state space $\mathcal{U}_{\text{global}}$ (including all states outside $\mathcal{U}(\hat{\alpha}, \tilde{u})$), the global worst-case payoff must stay above the catastrophic ruin floor: $$\min_{u \in \mathcal{U}_{\text{global}}} R(q, u) \ge r_{\text{Wald, min}}$$

Any option that violates the global Wald floor in No-Man’s Land is automatically rejected (Gate G6 and --defect sniedovich).

Step 3 — Auditable Laboratory in Rust and Exercises

Run Laboratory 2 from your terminal to see both the Kennedy-O’Hagan Gaussian Process calibration and the Info-Gap + Sniedovich safeguard in action:

cargo run --release --bin labs -- --uncertainty

=== LAB 2: KENNEDY-O'HAGAN GP DISCREPANCY AND INFO-GAP + SNIEDOVICH ===
  [Kennedy-O'Hagan GP] theta_true=0.800 | without_GP=0.6454 (bias=0.1546, extrap_err=0.2022) | with_GP=0.7865 (bias=0.0135, extrap_err=0.0324) | EmpBayes(ell*=3.60, sigma*=1.00, LML=+27.27)
  [Info-Gap + Sniedovich] fragile_nominal_turkey: alpha_hat=1.60, zero_ing=0.0, Wald=-450.0, approved=false | robust_satisficing_wald: alpha_hat=3.50, beta_hat=2.13, Wald=45.0, approved=true

Walk through the two laboratory experiments:

1. In [Kennedy-O'Hagan GP], the true physical parameter is $\theta_{\text{true}} = 0.800$, but the physical world includes a nonlinear structural discrepancy $\delta(x)$ absent from the bare model $\eta(x, \theta)$.
   • Without the GP discrepancy, ordinary least squares twists the physical parameter down to $\hat{\theta} = 0.6454$ (a parameter bias of $0.1546$) and suffers an out-of-domain extrapolation error of $0.2022$.
   • With the anchored Kennedy-O’Hagan GP $\delta(x) \sim \mathcal{GP}(0, k)$, the estimator recovers $\hat{\theta} = 0.7865$ (cutting parameter bias more than $11$-fold to $0.0135$), reduces extrapolation error more than $6$-fold to $0.0324$, and selects Empirical Bayes hyperparameters $(\ell^{\ast} = 3.60,\ \sigma_\delta^{\ast} = 1.00)$ maximizing the Cholesky log marginal likelihood ($\mathrm{LML} = +27.27$).
2. In [Info-Gap + Sniedovich], the fragile_nominal_turkey option boasts a positive local robustness horizon $\hat{\alpha} = 1.60$, yet collapses to $\text{Wald} = -450.0$ in No-Man’s Land and is blocked (approved = false). The robust_satisficing_wald option achieves $\hat{\alpha} = 3.50$, opportuneness $\hat{\beta} = 2.13$, and a positive global Wald floor of $+45.0$, earning approval (approved = true).

Exercises

1. (Concept — Uncertainty Typing) For each scenario below, name both the ontological layer ($L_1, L_2, L_3$) and the uncertainty class (aleatory, epistemic_parameter, epistemic_specification, knightian):
   • (a) Thermal agitation (Johnson-Nyquist noise) inside an already-calibrated resistor.
   • (b) Estimating the mean service rate $\mu$ of a newly hired call-center agent after only $15$ calls.
   • (c) Using an M/M/1 queueing formula that assumes constant arrival rates $\lambda$ when real customer arrivals surge every Monday morning.
   • (d) Designing a power-grid reserve policy when an unmodeled cyber-attack or geomagnetic storm could disable transmission lines outside historical weather records.
2. (Calculation — Laplace’s Rule of Succession) A clinical trial tests a surgical procedure on $n = 18$ patients and observes $s = 18$ successful recoveries ($0$ complications).
   • (a) What is the naive plug-in complication probability, and why does Prohibition 4 ban it?
   • (b) What complication probability does Laplace’s Rule of Succession assign?
3. (Concept — Kennedy-O’Hagan) Explain in your own words why collecting $100\text{,}000$ additional observations worsens overconfidence when a mechanistic simulator $\eta(x, \theta)$ is calibrated without a structural discrepancy term $\delta(x)$.
4. (Laboratory — Sniedovich Negative Proof) Run cargo run --release --bin gates -- --defect sniedovich and verify that deploying an option that violates the global Wald floor in No-Man’s Land is blocked with exit code 1.

Chapter Summary

• Aleatory uncertainty ($L_1$) is irreducible noise of the World; Parametric epistemic uncertainty ($L_2$) is finite-sample parameter ignorance; Structural epistemic uncertainty ($L_2$) is model misspecification; Knightian uncertainty ($L_3$) is deep ignorance where probability distributions themselves are untrustworthy.
• The Law of Total Variance ($\mathrm{Var}(Y) = \mathbb{E}[\mathrm{Var}(Y\mid\theta)] + \mathrm{Var}(\mathbb{E}[Y\mid\theta])$) separates $L_1$ aleatory variance from $L_2$ parametric variance.
• Laplace’s Rule of Succession ($\hat{p} = \frac{s+1}{n+2}$) prevents small samples from collapsing to dogmatic $0%$ or $100%$.
• Kennedy-O’Hagan Structural Discrepancy ($y(x) = \eta(x, \theta) + \delta(x) + \varepsilon$ with anchored $\mathcal{GP}$) prevents parameter pseudo-convergence and extrapolation overconfidence.
• Info-Gap Decision Theory coupled with Sniedovich’s Global Maximin Safeguard measures local robustness ($\hat{\alpha}$) and opportuneness ($\hat{\beta}$) while guaranteeing a global Wald worst-case floor across No-Man’s Land.

3. The Five Transversal Lenses

Learning Objectives. By the end of this chapter, you will be able to audit any stochastic model through five universal lenses: (1) Information (Shannon entropy, mutual information, the Data Processing Inequality, the Strong DPI contraction hierarchy $\eta_{\chi^2} \le \eta_{\mathrm{KL}} \le \eta_{\mathrm{TV}}$, and Fano’s error floor); (2) Time (non-ergodicity, Itô’s variance drain $g_{\text{time}} = \mu - \frac{1}{2}\sigma^2$, the asymmetric Kelly criterion, and Log-Sobolev mixing times); (3) Scale and Tail (power-law moment regimes and the Hill tail-index estimator $\hat{\alpha}_{k,n}$); (4) Causal Structure and Invariance (Pearl’s three-rung Causal Ladder, confounders vs. Berkson colliders, Invariant Causal Prediction $\hat{S}^{\ast}$, and nonlinear NILE/IRM over an orthonormal Hermite basis); and (5) Decision and Calibration (the cost-loss threshold $p^{\ast} = \frac{C}{\eta L}$, $\mathrm{EVPI}$, and the exact isotonic CORP-Murphy decomposition via Pool-Adjacent-Violators).

Step 1 — Intuition and the Real-World Paradox

Suppose five domain specialists—a telecom engineer, a quantitative trader, a reinsurance actuary, an epidemiologist, and a hurricane forecaster—sit around a table. On the surface, their fields look completely unrelated. Yet when their models fail in the real world, they fail along the same five universal axes:

1. The Illusion of Creating Information by Reprocessing (Lens 1 — Information): An analyst takes a noisy survey table, runs it through three neural feature layers and two clustering algorithms, and believes the polished dashboard contains “more signal” than the raw sensors. In reality, no mathematical transformation can ever create information about the physical world that was not already captured at the sensor. Every stage of processing can only preserve or leak signal.
2. Confusing the Crowd at One Instant with One Person Across Time (Lens 2 — Time): Imagine a casino game where a fair coin is tossed every minute: on Heads your wealth increases by $+50%$ ($\times 1.50$); on Tails your wealth drops by $-40%$ ($\times 0.60$). If $10\text{,}000$ people play a single round, the average wealth of the room grows by $\frac{1.50 + 0.60}{2} = 1.05$ ($+5%$). It looks like a gold mine! Now play that exact same game yourself for $100$ consecutive rounds: half the time you multiply by $1.50$, half the time by $0.60$, and since $1.50 \times 0.60 = 0.90$, you lose $-10%$ of your wealth every two rounds until you are bankrupt! The average across the crowd ($g_{\text{ensemble}}$) and the growth rate of a single trajectory through time ($g_{\text{time}}$) are not the same number.
3. Treating a Giant Outlier as a “Six-Sigma Fluke” (Lens 3 — Scale and Tail): If you measure the height of $1\text{,}000$ randomly chosen adults, the tallest person might be $2.05\text{ m}$—barely $1.2\times$ the average—and changes the sample mean by a millimeter. If you measure the net worth of $1\text{,}000$ people or the size of $2\text{,}167$ fire insurance claims (danish_fire.csv), a single observation can be hundreds of times larger than the median and can outweigh half the dataset combined. In a heavy-tailed world, the sample variance does not converge: standard textbook $\pm 1.96\sigma/\sqrt{n}$ error bars are fiction.
4. Mistaking a Weathervane for the Wind (Lens 4 — Structure and Invariance): Looking at historical data, every time the barometer needle drops, rain follows. Correlation is high! What happens if we tape the barometer needle to “Sunny” (an intervention, $\mathrm{do}(\text{Barometer} = \text{High})$)? It rains anyway—because the atmospheric pressure caused both the needle and the rain. Worse still, what happens when we train a model inside a hospital and condition on hospitalization (a Berkson collider)? Two completely independent diseases suddenly appear correlated in our dataset simply because either one suffices to put a patient in a hospital bed.
5. Confusing a Bold Forecast with an Useful Decision (Lens 5 — Decision and Calibration): A weather app says “$80%$ chance of hurricane winds” when the true frequency on such days is only $25%$. If a town evacuates whenever the risk exceeds $p^{\ast} = 12%$, both $80%$ and $25%$ lie above $12%$, so the mayor orders the right evacuation today. Does that mean the $80%$ forecast is safe? The moment a neighbouring port uses the same app to decide whether to scuttle a cargo schedule whose break-even threshold is $p^{\ast} = 50%$, the overconfident $80%$ forecast triggers a ruinous false alarm!

These five universal audits are the Five Transversal Lenses (crates/stochology-lenses). Let us build each one from its foundations.

Step 2 — Foundations and Mathematical Formalization

3.1 Lens 1 — Information (stochology_lenses::information)

Foundations: Surprise, Entropy, KL Divergence, and Mutual Information

How do we measure “information” with a number? In 1948, Claude Shannon started from a simple intuition: observing an event that was almost certain ($p \approx 1$) tells you almost nothing, whereas observing a rare event ($p \ll 1$) carries high surprise, measured as $\ln\frac{1}{p(x)} = -\ln p(x)$ (in natural units, nats, or base-$2$ bits).

1. Shannon Entropy $H(W)$: The average uncertainty (expected surprise) of a random variable $W$ before we observe it: $$H(W) \triangleq -\sum_{w \in \mathcal{W}} P(w)\ln P(w) \ge 0$$
2. Kullback-Leibler (KL) Divergence $D_{\mathrm{KL}}(P \parallel Q)$: How distinguishable a distribution $P$ is from a reference distribution $Q$: $$D_{\mathrm{KL}}(P \parallel Q) \triangleq \sum_x P(x)\ln\frac{P(x)}{Q(x)} \ge 0$$
3. Mutual Information $I(W; X)$: How much observing a noisy signal $X$ reduces our uncertainty about the hidden state of the world $W$: $$I(W; X) \triangleq H(W) - H(W \mid X) = \sum_{w, x} P(w, x)\ln\frac{P(w, x)}{P(w)P(x)} \ge 0$$ If $X$ and $W$ are independent, $I(W; X) = 0$ (knowing $X$ tells you nothing about $W$).

The Data Processing Inequality (DPI) and Strong Contraction (SDPI)

Suppose the true state of the world $W$ generates raw physical data $X$, which an ingestion pipeline summarizes into features $Y$, which a model finally compresses into a decision score $Z$. Because each step depends only on the immediately preceding step, they form a 3-step Markov chain:

$$W \longrightarrow X \longrightarrow Y \longrightarrow Z$$

Shannon’s Data Processing Inequality (DPI) (DpiMarkovChain) proves that information can never increase along a Markov chain:

$$I(W; Z) \le I(W; Y) \le I(W; X) \le H(W)$$

Even stronger: when a noisy physical or computational channel $W(y \mid x)$ maps an input distribution $P_X$ to $P_Y$ and $Q_X$ to $Q_Y$, it strictly shrinks the distance between any two distributions! The Strong Data Processing Inequality (SDPI) measures the worst-case contraction factor $\eta_D(W) = \sup_{P \neq Q} \frac{D(P_Y \parallel Q_Y)}{D(P_X \parallel Q_X)} < 1$ across three divergence geometries:

• $\chi^2$-divergence contraction $\eta_{\chi^2}(W) = \rho_m^2(X; Y)$ (the squared Hirschfeld-Gebelein-Rényi maximal correlation);
• KL-divergence contraction $\eta_{\mathrm{KL}}(W)$;
• Total Variation contraction $\eta_{\mathrm{TV}}(W) = \sup_{x, x’} \lVert W(\cdot \mid x) - W(\cdot \mid x’) \rVert_{\mathrm{TV}}$ (Dobrushin’s coefficient of ergodicity).

The protocol audits the exact Ahlswede-Gács-Raginsky SDPI Hierarchy:

$$\eta_{\chi^2}(W) = \rho_m^2(X; Y) \le \eta_{\mathrm{KL}}(W) \le \eta_{\mathrm{TV}}(W) \le 1$$

Fano’s Error Floor

What happens when a pipeline leaks mutual information so that $I(W; Z)$ becomes small compared to the entropy $H(W)$ of the $|\mathcal{W}|$ possible states of the world? Robert Fano’s Inequality (1952) establishes an inescapable lower bound on the probability of classification error $P_e = P(\hat{W}(Z) \neq W)$ of any classifier, no matter how sophisticated:

$$H_2(P_e) + P_e \ln(|\mathcal{W}| - 1) \ge H(W \mid Z) = H(W) - I(W; Z)$$

where $H_2(p) = -p\ln p - (1-p)\ln(1-p)$ is binary entropy. In plain words: if your features $Z$ do not carry enough nats of mutual information $I(W; Z)$ to cover the entropy $H(W)$ of the target, no deep neural network can push error below Fano’s floor $P_e^{\min}$.

Blahut-Arimoto Exact Channel Capacity (blahut_arimoto_capacity)

While $I(W; X)$ measures the mutual information for a fixed input prior $P_W$, what is the absolute maximum information rate that a noisy physical channel $W(x \mid w)$ can transmit under any possible input distribution? In 1972, Richard Blahut and Suguru Arimoto independently derived an alternating convex-optimization algorithm that converges monotonically to Shannon’s Channel Capacity:

$$C(W) \triangleq \max_{P_W \in \Delta_{|\mathcal{W}|}} I(P_W, W)$$

By alternating between the variational posterior $Q^{(t)}(w \mid x) \propto P_W^{(t)}(w) W(x \mid w)$ and the tilted prior update $P_W^{(t+1)}(w) \propto P_W^{(t)}(w) \exp\bigl(\sum_x W(x \mid w)\ln\frac{W(x \mid w)}{\sum_{w’} P_W^{(t)}(w’)W(x \mid w’)}\bigr)$, blahut_arimoto_capacity (together with Laplace-smoothed contingency estimation in estimate_empirical_channel) computes the exact capacity $C(W)$ and capacity-achieving input prior $P_W^{\ast}$ in nats.

3.2 Lens 2 — Time and Survival (stochology_lenses::time)

Foundations: Ergodicity Breaking and Itô’s Variance Drain

In physics and probability, a process is called ergodic if the average across a large population of parallel trajectories at a single time $T$ (the ensemble average, $g_{\text{ensemble}}$) equals the average experienced by a single trajectory followed over a long period of time (the time average, $g_{\text{time}}$).

Additive games with stationary independent increments are ergodic. Multiplicative compounding is non-ergodic (Ole Peters, 2019).

Let us see why using Kiyosi Itô’s stochastic calculus. Suppose an asset, population, or capital reserve $S_t$ evolves via geometric Brownian motion with instantaneous drift $\mu$ and volatility $\sigma$:

$$\frac{dS_t}{S_t} = \mu dt + \sigma dW_t$$

1. The Ensemble Growth Rate ($g_{\text{ensemble}}$): If you average $S_t$ across infinitely many parallel universes, $\mathbb{E}[S_t] = S_0 e^{\mu t}$, so the expected wealth grows at rate: $$g_{\text{ensemble}} = \frac{1}{t}\ln \mathbb{E}\left[\frac{S_t}{S_0}\right] = \mu$$
2. The Time-Average Growth Rate ($g_{\text{time}}$): You do not live across a million parallel universes; you live in one universe over time! By Itô’s Lemma (which is simply the stochastic version of Jensen’s Inequality applied to the concave function $\ln S_t$), $d(\ln S_t) = \left(\mu - \frac{1}{2}\sigma^2\right)dt + \sigma dW_t$. Therefore, along almost every single path over time, the compounded growth rate is: $$g_{\text{time}} = \lim_{T \to \infty} \frac{1}{T}\ln\left(\frac{S_T}{S_0}\right) = \mu - \frac{1}{2}\sigma^2 < g_{\text{ensemble}}$$

The missing piece, $\frac{1}{2}\sigma^2$, is Itô’s Variance Drain (or volatility drag). Even if the average return $\mu$ is positive, if volatility is high enough that $\frac{1}{2}\sigma^2 > \mu$, the ensemble average $\mathbb{E}[S_t] \to \infty$ explodes to infinity while almost every individual player goes bankrupt ($S_t \to 0$)! Across $37\text{,}930$ daily trading sessions of the Dow Jones Industrial Average (djia_1885_2023.csv, 1885–2023), the annualized ensemble growth rate is $g_{\text{ensemble}} = 6.12%$, but Itô’s variance drain steals $1.45%$ per year, leaving a true compounded time-growth rate of $g_{\text{time}} = 4.68%$.

The Optimal Asymmetric Kelly Fraction and Absorbing Ruin

Because over-betting amplifies $\sigma^2$ quadratically while increasing $\mu$ only linearly, betting too large a fraction $f$ of your capital guarantees ruin. In 1956, Bell Labs physicist John L. Kelly Jr. derived the exact fraction $f^{\ast}$ of capital to risk on a repeatable gamble with win probability $p$, fractional loss $a$ on failure, and fractional gain $b$ on success so as to maximize long-run logarithmic time growth $\mathbb{E}[\ln(1 + R_t(f))]$:

$$\max_{f} \bigl[ p\ln(1 + b f) + (1 - p)\ln(1 - a f) \bigr] \implies f^{\ast} = \frac{p}{a} - \frac{1 - p}{b}$$

Notice two crucial boundaries of Kelly’s curve:

• At $f = f^{\ast}$, long-run compounded time-growth reaches its unique peak.
• At $f > 2 f^{\ast}$, time-average growth turns strictly negative even though every single bet has positive expected value!
• At $f \ge 1/a$, a single bad draw wipes out $100%$ of capital ($W_t \le 0$), hitting an absorbing ruin barrier from which no future recovery is possible.

Finally, Lens 2 audits how long a stochastic simulation or Markov chain takes to explore its state space via the Log-Sobolev Inequality (LSI) constant $\alpha_{\mathrm{LSI}} = -\frac{1}{2}\ln \eta_{\mathrm{KL}}$, Penalizing the mixing time whenever heavy-tailed mass $H_R$ traps the sampler in local modes.

Continuous-Return Empirical Kelly vs. the Gaussian Merton Ratio (empirical_kelly_optimal_fraction)

In continuous-time Gaussian finance, Robert Merton (1969) approximated the optimal leverage fraction by maximizing the second-order Taylor expansion $g(f) \approx f\hat{\mu} - \frac{1}{2}f^2\hat{\sigma}^2$, which yields the Merton Ratio $f_{\text{Merton}} = \frac{\hat{\mu}}{\hat{\sigma}^2}$. However, real empirical returns $r_1, \dots, r_n$ exhibit severe skewness and excess kurtosis (on djia_1885_2023.csv, excess kurtosis is $17.8$ and the Jarque-Bera statistic is $\mathrm{JB} = 502\text{,}551$, computed online via OnlineMoments). Because the logarithmic utility $\ln(1 + f r_t)$ diverges to $-\infty$ as $1 + f r_{\min} \to 0^+$, empirical_kelly_optimal_fraction solves the exact concave optimization problem via damped Newton-Raphson:

$$f_{\text{emp}}^{\ast} = \arg\max_{0 \le f < f_{\max}} \frac{1}{n}\sum_{t=1}^n \ln(1 + f r_t)$$

Whenever negative tail jumps exist, $f_{\text{emp}}^{\ast} < f_{\text{Merton}}$ (2.08 < 2.12 on DJIA), protecting the agent against Gaussian over-leverage.

3.3 Lens 3 — Scale and Tail (stochology_lenses::tail)

Foundations: Thin Tails vs. Power Laws and Moment Existence Regimes

In a Gaussian or exponential distribution (thin-tailed / “Mediocristan”), the probability of seeing an event larger than $x$ decays exponentially fast ($e^{-c x^2}$ or $e^{-c x}$). Extreme outliers are practically impossible.

In financial losses, reinsurance claims, city sizes, electrical grid spikes, and casualty counts (heavy-tailed / “Extremistan”), the upper tail decays slowly as a Pareto power law:

$$P(X > x) \sim C x^{-\alpha} \qquad \text{as } x \to \infty$$

The positive exponent $\alpha > 0$ is called the tail index. Why is $\alpha$ the single most important number in risk management? Because the $m$-th moment $\mathbb{E}[X^m] = \int_{x_0}^\infty m x^{m-1} P(X > x) dx \propto \int_{x_0}^\infty x^{m - 1 - \alpha} dx$ is finite if and only if $m < \alpha$! This splits all positive random variables into three sharply different physical worlds:

Bruce Hill’s (1975) Tail-Index Estimator

How do we estimate $\alpha$ from empirical data without parametric wishful thinking? Sort the sample of size $n$ in ascending order: $X_{(1)} \le X_{(2)} \le \dots \le X_{(n)}$. If the top $k$ observations above threshold $X_{(n-k)}$ follow a Pareto tail, then by a logarithmic transformation their log-spacings $\ln(X_{(n-i+1)} / X_{(n-k)})$ behave like exponential random variables with rate $\alpha$. Maximum likelihood estimation yields Hill’s Estimator (HillTailDiagnostic):

$$\hat{\alpha}_{k,n} = \left(\frac{1}{k}\sum_{i=1}^k \ln\frac{X_{(n-i+1)}}{X_{(n-k)}}\right)^{-1}, \qquad \mathrm{SE}(\hat{\alpha}_{k,n}) \approx \frac{\hat{\alpha}_{k,n}}{\sqrt{k}}$$

Applied to the $n = 2\text{,}167$ industrial fire insurance losses of Copenhagen Re (danish_fire.csv), Hill’s estimator yields $\hat{\alpha}_{\mathrm{Hill}} = 1.6009 \pm 0.1601$, placing fire claims squarely inside the FiniteMeanInfiniteVariance ($1 < \alpha \le 2$) regime, with $99\text{th}$ percentile $q_{99} = 26.04\text{M DKK}$ and an effective tail sample size of only tail_n_eff $= 13.9$.

Dekkers-Einmahl-de Haan Moment Estimator, Peaks-Over-Threshold GPD, and Expected Shortfall ($\mathrm{ES}_{0.99}$)

To cross-check Hill’s Pareto estimator across all three Extreme Value Theory (EVT) domains of attraction ($\xi > 0$ Fréchet, $\xi = 0$ Gumbel, and $\xi < 0$ Weibull, where $\xi = 1/\alpha$), crates/stochology-lenses/src/tail.rs implements three complementary EVT diagnostics:

1. Dekkers-Einmahl-de Haan (1989) Moment Estimator (dedh_moment_tail_index): Using the first two log-spacing moments $M_n^{(j)} = \frac{1}{k}\sum_{i=1}^k \bigl(\ln X_{(n-i+1)} - \ln X_{(n-k)}\bigr)^j$ ($j \in \lbrace 1, 2 \rbrace$), the DEdH generalized extreme-value shape estimator is: $$\hat{\xi}_{\mathrm{DEdH}} = M_n^{(1)} + 1 - \frac{1}{2}\left(1 - \frac{(M_n^{(1)})^2}{M_n^{(2)}}\right)^{-1} \in \mathbb{R}$$
2. Pickands-Balkema-de Haan Peaks-Over-Threshold GPD (gpd_pot_fit): By the Pickands-Balkema-de Haan Theorem (1974/1975), excesses $Y = X - u \mid X > u$ above a high threshold $u$ converge to a Generalized Pareto Distribution $G_{\xi, \beta}(y) = 1 - (1 + \xi y / \beta)^{-1/\xi}$, calibrated via Hosking-Wallis probability-weighted moments (L-moments).
3. Coherent Expected Shortfall ($\mathrm{ES}_{0.99}$, expected_shortfall_99): Unlike Value-at-Risk ($q_{99}$), which ignores the severity of losses beyond the $99\text{th}$ percentile and violates Artzner et al.’s (1999) subadditivity axiom, Expected Shortfall $\mathrm{ES}_{0.99} = \mathbb{E}[X \mid X \ge q_{0.99}]$ is a coherent spectral risk measure. On danish_fire.csv, while $q_{99} = 26.04\text{M DKK}$, the tail expectation jumps more than twofold to $\mathrm{ES}_{0.99} = 58.59\text{M DKK}$ (and $\mathrm{ES}_{0.99}^{\mathrm{POT}} = 58.88\text{M DKK}$)!

3.4 Lens 4 — Structure and Invariance (stochology_lenses::invariance)

Foundations: Pearl’s Causal Ladder, Confounders, and Berkson Colliders

Standard regression and machine learning live entirely on the first rung of Judea Pearl’s Three-Rung Causal Ladder:

Why is $P(Y \mid X = x)$ (Rung 1) so often completely different from $P(Y \mid \mathrm{do}(X = x))$ (Rung 2)? Consider the two elementary causal graphs that trap analysts every day:

1. The Confounder ($X \leftarrow C \to Y$): Variable $C$ (say, outdoor summer temperature) causes both ice-cream sales ($X$) and swimming-pool drownings ($Y$). In passive data, $X$ and $Y$ are strongly correlated. If you ban ice cream ($\mathrm{do}(X = 0)$), drownings do not drop at all! To identify the causal effect of $X$ on $Y$, you must condition on the confounder $C$ to block the back-door path.
2. The Berkson Collider ($X \to B \leftarrow Y$): Now flip the arrows! Suppose $X$ (locomotor disease) and $Y$ (respiratory disease) are completely independent in the general population, and either condition can cause a patient to be admitted to a hospital ($B = 1$). If an analyst restricts their dataset only to hospitalized patients (conditioning on $B = 1$), learning that a hospitalized patient does not have respiratory disease ($Y = 0$) immediately raises the probability that they must be in the hospital because of locomotor disease ($X = 1$)! Conditioning on a common effect (collider) creates a mirage of correlation out of thin air (Joseph Berkson, 1946). That is why Filter 2 of the Stochology Funnel strictly bans conditioning on a Berkson collider.

Invariant Causal Prediction (ICP) and Nonlinear NILE/IRM

How can we discover which predictors $X_S$ are true causal parents of $Y$ rather than spurious proxies or descendants when we observe data across multiple environments or regimes $e \in \mathcal{E}$ (for example, different decades, climate regimes, or geographical basins)?

Jonas Peters, Peter Bühlmann, and Nicolai Meinshausen (2016) introduced a profound principle called Invariant Causal Prediction (ICP):

If $S^{\ast}$ is the set of true direct causal parents of $Y$, then the conditional mechanism $P^e(Y \mid X_{S^{\ast}})$ remains invariant across all environments $e \in \mathcal{E}$ that do not directly intervene on $Y$ itself.

By contrast, any subset $S$ that relies on a confounder, a collider, or a regime-specific proxy will exhibit changing regression coefficients or changing residual distributions when the environment $e$ shifts! ICP identifies the identifiable causal core by taking the intersection of all statistically invariant subsets:

$$\hat{S}^{\ast} = \bigcap_{S : H_{0, S} \text{ not rejected across } \mathcal{E}} S$$

In crates/stochology-lenses/src/invariance.rs, the protocol extends linear ICP (env_ols_invariance_penalties) to Nonlinear ICP and NILE/IRM (run_nonlinear_icp_nile) by expanding standardized predictors onto the 3-atom orthonormal probabilists’ Hermite basis:

$$\Phi(z) = \left[ z ,\quad \frac{z^2 - 1}{\sqrt{2}} ,\quad \frac{z^3 - 3z}{\sqrt{6}} \right], \qquad \mathbb{E}_{Z \sim \mathcal{N}(0,1)}[\Phi_j(Z)\Phi_k(Z)] = \delta_{jk}$$

and auditing the Invariant Risk Minimization (IRM / NILE) risk-gradient penalty $\sum_{e \in \mathcal{E}} \lVert \nabla_{w \mid w=1.0} R^e(w \cdot \Phi) \rVert^2$ alongside Paul Rosenbaum’s hidden-confounding sensitivity threshold $\Lambda^{\ast}$ (the minimum odds ratio an unobserved confounder would need to overturn the conclusion).

In addition, crates/stochology-lenses/src/invariance.rs provides two classic econometric invariance and sensitivity audits:

• Gregory Chow’s (1960) Structural Break $F$-Statistic (chow_invariance_f_stat): Tests $H_{0, S}: \beta^{(e)} = \beta^{\text{pooled}}$ across $E$ environments via $F_S = \frac{(\mathrm{RSS}_{\text{pooled}} - \sum_{e=1}^E \mathrm{RSS}_e) / ((E - 1)p)}{\sum_{e=1}^E \mathrm{RSS}_e / (N_{\text{total}} - E p)}$. For the true causal parent $X_0$, $F_{\lbrace 0 \rbrace} = 0.18$ (invariant), whereas for the spurious proxy $X_1$, $F_{\lbrace 1 \rbrace} = 23\text{,}437.0$ (structural breakdown!).
• Cinelli & Hazlett (2020) Omitted-Variable Bias Robustness Value (cinelli_hazlett_robustness_value): Computes the exact partial-$R^2$ strength $RV_q = \frac{1}{2}\bigl(\sqrt{f_q^4 + 4 f_q^2} - f_q^2\bigr)$ (where $f_q = q\cdot |t| / \sqrt{\mathrm{df}}$) that an unobserved confounder $U$ would need with both treatment $X$ and outcome $Y$ to reduce the estimated effect by fraction $q$.

3.5 Lens 5 — Decision and Calibration (stochology_lenses::decision)

Foundations: The Cost-Loss Boundary ($p^{\ast}$) and Value of Perfect Information ($\mathrm{EVPI}$)

A probability forecast $p \in (0, 1)$ is not yet an action. To cross from belief to action on Bridge $L_2 \to L_3$, we must price the errors.

Consider a decision-maker who must choose between two acts—protect (e.g., evacuate a coast, staff extra nurses, hold a flight) or do_not_protect—before a binary adverse event $Y \in \lbrace 0, 1 \rbrace$ occurs with forecast probability $p = P(Y = 1)$:

Comparing the two expected costs shows that protect is strictly better than do_not_protect whenever $C + p(1 - \eta)L < pL$, which simplifies algebraically to the Cost-Loss Boundary:

$$p > p^{\ast} \triangleq \frac{C}{\eta L}$$

Look at the intuition of $p^{\ast} = \frac{C}{\eta L}$:

• If protecting costs $C = USD 12\text{,}000$, a storm surge causes loss $L = USD 125\text{,}000$, and early evacuation mitigates $\eta = 0.80$ ($80%$) of the avoidable damage ($\eta L = USD 100\text{,}000$), then the critical threshold is $p^{\ast} = \frac{12\text{,}000}{100\text{,}000} = 0.1200$ ($12%$).
• You do not wait until a hurricane is “$50%$ likely” to evacuate! Because the damage $\eta L$ is more than $8\times$ the cost of protection $C$, it is rational to protect the moment the calibrated probability passes $12%$.

Furthermore, before spending money on a complex predictive project, we compute the Expected Value of Perfect Information ($\mathrm{EVPI}$)—the maximum economic gain an infallible oracle could ever deliver over acting on the base rate $p_0$ alone:

$$\mathrm{EVPI} = \min\bigl(p_0 \eta L, C\bigr) - \max\bigl(0, p_0 \eta L - C\bigr) = \begin{cases} p_0(\eta L - C) & \text{if } p_0 \le p^{\ast} \text{ (or } p_0 \eta L \text{ net)}, \\ C(1 - p_0) & \text{if } p_0 > p^{\ast}. \end{cases}$$

Specifically, under the cost table above, an oracle saves $C$ whenever $Y=0$ (if you would otherwise protect) or saves $\eta L - C$ whenever $Y=1$ (if you would otherwise not protect). If the total engineering and operational cost of building the model exceeds $\mathrm{EVPI}$, Filter 1 of the Stochology Funnel kills the project immediately.

Calibration vs. Resolution: The Exact Isotonic CORP-Murphy Decomposition

How do we audit whether a forecaster’s probabilities $p_1, \dots, p_n \in (0, 1)$ against realized binary outcomes $y_1, \dots, y_n \in \lbrace 0, 1 \rbrace$ are honest?

We start with Glenn Brier’s (1950) strictly proper Brier Score:

$$\mathrm{BS} = \frac{1}{n}\sum_{i=1}^n (p_i - y_i)^2$$

In 1973, Allan Murphy showed that the Brier Score splits into three meaningful physical components:

1. Miscalibration / Reliability ($\mathrm{REL}$): When the model says $p = 30%$, how far is the true empirical frequency $\hat{\pi}(p)$ from $0.30$? Small $\mathrm{REL}$ is good ($0$ is perfect calibration).
2. Resolution / Discrimination ($\mathrm{RES}$): How strongly do the calibrated frequencies $\hat{\pi}(p)$ separate high-risk days from low-risk days around the overall base rate $\bar{y}$? Large $\mathrm{RES}$ is good ($0$ means a useless constant forecast).
3. Base Uncertainty ($\mathrm{UNC}_0 = \bar{y}(1 - \bar{y})$): The intrinsic variance of the binary outcome in the World ($L_1$).

Historically, analysts estimated $\mathrm{REL}$ and $\mathrm{RES}$ by chopping $[0, 1]$ into $10$ arbitrary histogram bins—a procedure that breaks the exact algebraic identity and changes its answer whenever someone shifts the bin boundaries!

In 2021, Timo Dimitriadis, Tilmann Gneiting, and Alexander Jordan solved this fifty-year problem with the CORP (Consistent, Optimally Binned, Reproducible) Decomposition. Instead of arbitrary bins, CORP computes the unique non-parametric isotonic regression $\hat{\pi}_1 \le \hat{\pi}_2 \le \dots \le \hat{\pi}_n$ of the sorted outcomes $y_{(i)}$ on the sorted forecasts $p_{(i)}$ via the Pool-Adjacent-Violators (PAV) algorithm (CorpPavDecomposition in crates/stochology-lenses/src/decision.rs).

Because PAV partitions the sorted data into optimal monotone blocks where the block average equals the conditional frequency, the CORP-Murphy Identity closes to machine precision ($\sim 10^{-15}$):

$$\mathrm{BS} = \underbrace{\frac{1}{n}\sum_{i=1}^n (p_{(i)} - \hat{\pi}_i)^2}_{\mathrm{REL}_{\mathrm{CORP}} \text{ (Miscalibration)}} - \underbrace{\frac{1}{n}\sum_{i=1}^n (\hat{\pi}_i - \bar{y})^2}_{\mathrm{RES}_{\mathrm{CORP}} \text{ (Resolution)}} + \underbrace{\bar{y}(1 - \bar{y})}_{\mathrm{UNC}_0 \text{ (Uncertainty)}}$$

Remember the fundamental operational asymmetry of this equation:

• $\mathrm{REL}_{\mathrm{CORP}}$ (Miscalibration) can be repaired post-hoc by monotone recalibration (such as PAV isotonic mapping or Platt scaling).
• $\mathrm{RES}_{\mathrm{CORP}}$ (Resolution) cannot be created post-hoc by any monotone rescaling—because any strictly increasing map $p \mapsto g(p)$ produces the exact same PAV isotonic blocks $\hat{\pi}_i$! To increase $\mathrm{RES}_{\mathrm{CORP}}$, you must go back to $L_1$ and collect better causal predictors.
• Richardson’s (2000) Relative Economic Value (CostLossRule::relative_economic_value) and Good’s (1952) Logarithmic Score (logarithmic_score): Alongside the Brier decomposition, Lens 5 evaluates the normalized economic value of a forecast system relative to climatology and a perfect oracle at threshold $p^{\ast} = \frac{C}{\eta L}$: $$V(p^{\ast}) = \frac{\mathbb{E}[\text{Cost}_{\text{climatology}}] - \mathbb{E}[\text{Cost}_{\text{forecast}}]}{\mathbb{E}[\text{Cost}_{\text{climatology}}] - \mathbb{E}[\text{Cost}_{\text{oracle}}]} \in (-\infty, 1]$$ as well as I. J. Good’s local strictly proper Logarithmic (Ignorance) Score $\mathrm{LogS}(p, y) = -\frac{1}{n}\sum_{i=1}^n \bigl[y_i \ln \tilde{p}_i + (1 - y_i)\ln(1 - \tilde{p}_i)\bigr]$ safeguarded by Cromwell’s floor $\tilde{p}_i \in [\varepsilon_{\text{floor}}, 1 - \varepsilon_{\text{floor}}]$.

Step 3 — Auditable Laboratory in Rust and Exercises

Run Laboratory 3 from your terminal to execute all five transversal lenses on both synthetic benchmarks and real empirical data:

cargo run --release --bin labs -- --lenses

=== LAB 3: THE FIVE TRANSVERSAL LENSES (SDPI/DPI, TIME/KELLY, HILL, ICP, CORP-PAV) ===
  [Lens 1: Information] SDPI: eta_chi2=0.4900 <= eta_KL=0.4900 <= eta_TV=0.7000 (valid=true, C_BA=0.2704 nats) | DPI W->X->Y->Z: 0.3681 >= 0.1662 >= 0.0576 (monotonic=true) | I_amp=0.5185 | Fano P_e >= 0.1156
  [Lens 2: Time] DJIA (37930 trading days, kurtosis=17.8, JB=502551): g_ensemble=0.0612 vs g_time_Ito=0.0468 (drain=0.0145) | Kelly f*=0.8600 (emp_DJIA=2.08 vs Merton=2.12) | Mixing steps=13
  [Lens 3: Tail] Danish Fire (n=2167): Hill alpha_k=1.6009 (+/- 0.1601, DEdH_xi=0.538, GPD_xi=0.483), regime=FiniteMeanInfiniteVariance, median=1.778, MAD=0.574, q99=26.04, ES99=58.59 (POT=58.88), tail_n_eff=13.9 | VicElec (n=52608): q99=6981.5 MW
  [Lens 4: Invariance] ICP S*=[0], env_OLS_penalty=["0.0001", "15.8059"] (ChowF=[0.18, 23437.0]), Storms_nonlinear_NILE_IRM=["0.0011", "0.1072"], Lambda*=4.752 (RV=0.511) | AuthenticForm(S*=[0], discarded='atom_1_regime_shifted_lat_proxy', A=true)
  [Lens 5: Decision] CORP-PAV (Atlantic Storms, n=20778): BS=0.26906 = REL(0.21135) - RES(0.13102) + UNC0(0.18873) [id_err=1.53e-14, LogS_PAV=0.1849, REV_PAV=0.719] | FairCoin(p0=0.50): agree@0.30=100%, REL_over=0.1104 vs REL_cal=0.0005, regret@0.70=+18.20
  [Almost-Perfect Machine M=(T,Phi,theta)] sup_err=0.0234 (Barron C_f=5.60), DPI_gap=0.0297 nats, regions=64 (ratio=5.3x), d_eff=8.00/8, P1..P5=true
  [Relational Ontology & Complex Systems] MI_rel=0.3681 vs MI_iso=0.0003 nats | Prigogine dS=-0.55 (turnover=100.0%, closure=100.0%) | Schelling(tau=0.125->50.2% vs tau=0.375->82.4%) | Daisyworld(MAE=1.52C vs dead=9.57C, dT/dL=-11.93) | verified=true

Look at what each lens reveals:

1. Lens 1 (Information): Across the 3-step Markov chain $W \to X \to Y \to Z$, mutual information decays monotonically ($0.3681 \ge 0.1662 \ge 0.0576\text{ nats}$), the SDPI contraction constants obey $\eta_{\chi^2}(0.4900) \le \eta_{\mathrm{KL}}(0.4900) \le \eta_{\mathrm{TV}}(0.7000)$ with Blahut-Arimoto channel capacity $C_{\mathrm{BA}} = 0.2704\text{ nats}$, and Fano’s inequality forces at least $11.56%$ classification error.
2. Lens 2 (Time): Over $37\text{,}930$ trading sessions of the Dow Jones (djia_1885_2023.csv, excess kurtosis $17.8$, Jarque-Bera $\mathrm{JB} = 502\text{,}551$), Itô’s variance drain reduces the ensemble growth rate of $6.12%$ down to a time-average growth rate of $4.68%$, while exact continuous empirical Kelly leverage ($2.08$) is strictly more conservative than the Gaussian Merton ratio ($2.12$).
3. Lens 3 (Tail): On danish_fire.csv ($n = 2\text{,}167$), the Hill estimator finds $\hat{\alpha} = 1.6009 \pm 0.1601$ (FiniteMeanInfiniteVariance), corroborated by Dekkers-Einmahl-de Haan $\hat{\xi}_{\mathrm{DEdH}} = 0.538$ and Peaks-Over-Threshold GPD $\hat{\xi}_{\mathrm{GPD}} = 0.483$, with $99%$ Expected Shortfall $\mathrm{ES}_{0.99} = 58.59\text{M DKK}$ (POT = 58.88M).
4. Lens 4 (Invariance): Across shifting regimes, ICP isolates the true causal parent $\hat{S}^{\ast} = [0]$ with tiny invariance penalty ($0.0001$ linear, Chow $F = 0.18$; $0.0011$ nonlinear NILE/IRM on atlantic_storms.csv) while exposing the spurious proxy ($15.8059$ linear, Chow $F = 23\text{,}437.0$; $0.1072$ nonlinear), with Rosenbaum sensitivity $\Lambda^{\ast} = 4.752$ and Cinelli-Hazlett Robustness Value $RV = 0.511$.
5. Lens 5 (Decision): On $n = 20\text{,}778$ NOAA Atlantic storm records, the PAV isotonic decomposition splits $\mathrm{BS} = 0.26906$ into $\mathrm{REL}_{\mathrm{CORP}} = 0.21135$, $\mathrm{RES}_{\mathrm{CORP}} = 0.13102$, and $\mathrm{UNC}_0 = 0.18873$ with an identity closure error of $1.53 \times 10^{-14}$, PAV-calibrated Logarithmic Score $\mathrm{LogS} = 0.1849$, and Relative Economic Value $\mathrm{REV}_{\mathrm{PAV}} = 0.719$ ($71.9%$ of an infallible oracle’s economic gain). Meanwhile, the FairCoin benchmark proves that an overconfident forecaster (REL = 0.1104) who agrees $100%$ of the time with a calibrated forecaster (REL = 0.0005) at threshold $p^{\ast}_A = 0.30$ inflicts $+18.20$ units of excess regret the moment the decision threshold moves to $p^{\ast}_B = 0.70$!

Exercises

1. (Calculation — Non-Ergodicity and Itô’s Drain) An investment strategy has expected annual arithmetic return $\mu = 0.12$ ($12%$) and annual volatility $\sigma = 0.30$ ($30%$).
   • (a) What is its compounded time-average growth rate $g_{\text{time}} = \mu - \frac{1}{2}\sigma^2$?
   • (b) If a fund applies $3\times$ leverage (tripling both $\mu$ to $0.36$ and $\sigma$ to $0.90$), what happens to $g_{\text{ensemble}}$, and what happens to $g_{\text{time}}$? Why does the $3\times$ leveraged investor lose money over time while the expected value grows?
2. (Concept — Confounder vs. Collider) A tech company notices that among employees it hired, programming test scores ($X$) and interview charisma scores ($Y$) are negatively correlated. Given that a candidate is hired ($B = 1$) only if the sum of $X + Y$ exceeds a high cutoff, draw the causal graph connecting $X$, $Y$, and $B$, and explain why conditioning on hired employees created the negative correlation.
3. (Calculation — Cost-Loss Threshold) Protecting a power substation against a geomagnetic storm costs $C = USD 45\text{,}000$. An unmitigated transformer failure costs $L = USD 1\text{,}000\text{,}000$, and protective switching prevents $\eta = 0.90$ of the damage. Compute $p^{\ast}$. Should the operator protect if the calibrated probability is $p = 0.065$?
4. (Concept — CORP-Murphy Asymmetry) Why is it impossible to increase $\mathrm{RES}_{\mathrm{CORP}}$ by applying a strictly increasing function $p_i \mapsto g(p_i)$ to your model’s predicted probabilities?

Chapter Summary

• Lens 1 (Information): Post-processing cannot create signal ($I(W; Z) \le I(W; Y) \le I(W; X)$), channel noise contracts distributions according to $\eta_{\chi^2} = \rho_m^2 \le \eta_{\mathrm{KL}} \le \eta_{\mathrm{TV}}$, and lost information enforces Fano’s error floor.
• Lens 2 (Time): Multiplicative dynamics are non-ergodic ($g_{\text{time}} = \mu - \frac{1}{2}\sigma^2 < g_{\text{ensemble}}$), and survival requires respecting the asymmetric Kelly fraction $f^{\ast} = \frac{p}{a} - \frac{1-p}{b}$ and absorbing ruin barriers.
• Lens 3 (Tail): Power-law tails $P(X > x) \propto x^{-\alpha}$ estimated via Hill’s $\hat{\alpha}_{k,n}$ lose finite variance when $\alpha \le 2$ and lose finite mean when $\alpha \le 1$.
• Lens 4 (Invariance): Pearl’s Causal Ladder separates seeing, doing, and imagining; conditioning on a Berkson collider is forbidden; and Invariant Causal Prediction ($\hat{S}^{\ast}$) + NILE/IRM isolate mechanisms that survive across environments.
• Lens 5 (Decision): Rational protection occurs at $p > p^{\ast} = \frac{C}{\eta L}$, project viability requires $\mathrm{EVPI} > C_{\text{total}}$, and PAV isotonic regression yields the exact CORP-Murphy decomposition $\mathrm{BS} = \mathrm{REL}_{\mathrm{CORP}} - \mathrm{RES}_{\mathrm{CORP}} + \mathrm{UNC}_0$.

4. The Almost-Perfect Machine and First-Class Authentic Model Form

Learning Objectives. By the end of this chapter, you will be able to explain why high predictive accuracy can hide a “Clever Hans” model; define the $(\varepsilon, \delta)$-Almost-Perfect Machine $M = (T, \Phi, \theta)$ and derive its five mathematical properties (P1 Barron universal density, P2 DPI $\delta$-sufficiency, P3 Fano/minimax rate optimality, P4 Telgarsky depth-$D$ compositional efficiency, and P5 Gram effective dimension $d_{\mathrm{eff}}$); construct the First-Class Authentic Model Form ($\delta(x) + \hat{S}^{\ast}$); and verify simultaneous closure of the six numerical identities (IdentityClosureAudit) and the five-part authenticity criterion $A(\text{model})$.

Step 1 — Intuition and the Real-World Paradox

Clever Hans, the Horse That Could Count

In Berlin at the turn of the twentieth century, a horse named Clever Hans became an international sensation. If his trainer asked, “What is $7 + 5$?”, Hans tapped his hoof twelve times and stopped. Commissions of veterinarians, circus trainers, and zoologists inspected the stable for hidden wires or trick signals and found none; Hans performed even when strangers asked the questions.

Finally, psychologist Oskar Pfungst ran an experiment that changed only one thing: he asked Hans questions whose answers the human questioner did not know. Instantly, Hans’s accuracy collapsed to random guessing.

What had Hans actually learned? He had not learned arithmetic. He had learned to watch the tiny, unconscious forward lean of the questioner’s posture as the hoof taps approached the expected count, and the micro-relaxation of the questioner’s eyebrows on the final tap!

Modern machine learning is filled with Clever Hans horses:

• A deep convolutional network trained to detect pneumonia on chest X-rays achieves an area under the curve ($\mathrm{AUC}$) of $0.96$—by reading the portable metal hospital token in the corner of the image rather than the lungs. When deployed at a second hospital across town, it fails catastrophically.
• A tropical cyclone rapid-intensification model fits historical storm tracks closely by latching onto a basin-specific latitude-season correlation that shifts whenever the multi-decadal ocean oscillation flips regime.
• A massive over-parameterized model uses $100$ colinear dictionary features that merely duplicate one another, hiding structural model error inside tweaked weights.

This raises two foundational questions for the Stochology Protocol:

1. When is a representation and approximation architecture $M = (T, \Phi, \theta)$ mathematically well-conditioned (AlmostPerfectMachine)?
2. When does a fitted model deserve to be called authentic (AuthenticModelForm) rather than a Clever Hans illusion?

Step 2 — Foundations and Mathematical Formalization

4.1 The $(\varepsilon, \delta)$-Almost-Perfect Machine $M = (T, \Phi, \theta)$

Foundations: Anatomy of a Learning Machine

Every parametric or semi-parametric model in statistics and machine learning can be written as a triple:

$$M = (T, \Phi, \theta), \qquad M(x) = \sum_{j=1}^W \theta_j \phi_j\bigl(T(x)\bigr) = \theta^\top \Phi\bigl(T(x)\bigr)$$

where:

• $T: \mathcal{X} \to \mathcal{Z}$ is the Representation Map (Encoder): It extracts a compressed state $z = T(x)$ from the raw high-dimensional observation $x \in \mathbb{R}^d$, stripping away irrelevant sensor noise.
• $\Phi = [\phi_1, \dots, \phi_W]^\top$ is the Atomic Dictionary (Basis): A collection of $W$ nonlinear basis functions or compositional feature atoms evaluated on $T(x)$.
• $\theta \in \mathbb{R}^W$ is the Parameter Vector: The linear readout weights combining the $W$ atoms into a final prediction.

In crates/stochology-lenses/src/machine.rs, AlmostPerfectMachine audits whether $M = (T, \Phi, \theta)$ satisfies five rigorous mathematical laws (P1 through P5) simultaneously:

Property P1 — Universal Barron Density and Escaping the Curse of Dimensionality

If you try to approximate an arbitrary smooth function $f(x)$ in $d$ dimensions using a classic grid of local splines or polynomials, the number of grid cells needed to achieve accuracy $\varepsilon$ grows exponentially as $(1/\varepsilon)^d$. In $d = 50$ dimensions, that curse of dimensionality requires more parameters than there are atoms in the universe.

How is it possible for neural and dictionary expansions of width $W$ to approximate high-dimensional functions at all? In 1993, Yale information theorist Andrew Barron proved a remarkable theorem: if the Fourier transform $\tilde{f}(\omega)$ of the target function $f$ has a finite first spectral moment $C_f \triangleq \int \lVert\omega\rVert_1 |\tilde{f}(\omega)| d\omega < \infty$ (the Barron norm), then a dictionary of $W$ ridge atoms approximates $f$ at a dimension-independent rate:

$$\text{P1 (Barron Rate):} \qquad \sup_{x \in \mathcal{X}} \bigl|M(x) - f(x)\bigr| \le \varepsilon \quad \text{and} \quad \lVert M - f \rVert_{L_2(\mu)}^2 \le \frac{C_f^2}{W}$$

Notice that the ambient dimension $d$ does not appear in the denominator $W$! Property P1 audits both the uniform supremum error ($\le \varepsilon$) and the empirical $L_2^2$ error against the exact Barron ceiling $C_f^2 / W$.

Property P2 — Informational $\delta$-Sufficiency (DPI Compression)

A representation $T(X)$ must compress raw inputs $X$ without throwing away the signal that predicts the target state of the world $W$. By the Data Processing Inequality (Lens 1), $I(W; T(X)) \le I(W; X)$ always holds. If $I(W; T(X)) = I(W; X)$, the statistic $T(X)$ is a sufficient statistic in the classical Fisher-Neyman sense.

In real noisy pipelines, we demand $(\delta)$-Approximate Sufficiency:

$$\text{P2 ($\delta$-Sufficiency):} \qquad \Delta_{\mathrm{DPI}} \triangleq I(W; X) - I(W; T(X)) \le \delta \qquad (\text{with } \Delta_{\mathrm{DPI}} \ge 0)$$

coupled with a valid Strong Data Processing Inequality hierarchy ($\eta_{\chi^2} \le \eta_{\mathrm{KL}} \le \eta_{\mathrm{TV}}$). This guarantees that $T(X)$ sheds nuisance entropy $H(X \mid W)$ while retaining almost every nat of predictive mutual information about $W$.

Property P3 — Fano / Minimax Statistical Rate Optimality

Suppose we fit $W$ parameters from $n$ noisy observations with irreducible noise variance $\sigma^2$. Information-theoretic minimax theory (Fano’s method and Assouad’s lemma) proves that the optimal mean squared estimation error scales as:

$$R_{\text{minimax}} = \frac{\sigma^2 W}{n}$$

Property P3 audits the empirical ratio $\frac{\mathrm{MSE}}{\sigma^2 W / n}$:

• If $\mathrm{MSE} \gg 2.5 \frac{\sigma^2 W}{n}$, the estimator is statistically inefficient or underfitting;
• If $\mathrm{MSE} < 0.25 \frac{\sigma^2 W}{n}$ in a noisy world where Fano’s floor $P_e^{\min} > 0$, the pipeline is memorizing noise or suffering from target leakage!

Thus P3 requires $0.25 \le \frac{\mathrm{MSE}}{\sigma^2 W / n} \le 2.5$ alongside a positive Fano lower bound $P_e^{\min} > 0$.

Property P4 — Telgarsky Depth-$D$ Compositional Efficiency

Why use compositional depth $D$ instead of a single flat layer? In 2016, Matus Telgarsky constructed an explicit family of sawtooth compositions (related to the tent map $g(u) = 1 - |2u - 1|$) proving that composing $D$ affine-nonlinear stages folds the input space in half at every layer, generating $2^D$ distinct affine linear regions:

$$\text{P4 (Telgarsky Efficiency):} \qquad N_{\text{regions}}(D) = 2^D, \qquad \frac{2^D}{2D} \ge 4.0$$

At depth $D = 6$, a composition of only $2D = 12$ elementary parameters creates $2^6 = 64$ linear pieces (efficiency ratio $64 / 12 = 5.33\times \ge 4.0$), whereas a shallow 1-layer network would need $64$ separate units to match the same oscillatory resolution.

Property P5 — Atomic Completeness and Gram Effective Dimension ($d_{\mathrm{eff}}$)

Finally, what if a model declares $W = 8$ basis atoms $\phi_1, \dots, \phi_8$, but $6$ of them are nearly identical copies of one another? Then the dictionary is bloated and ill-conditioned: parameter estimates $\hat{\theta}$ will swing wildly under tiny perturbations of the data.

To audit whether the $W$ atoms are genuinely independent, we compute the empirical Gram Matrix $G \in \mathbb{R}^{W \times W}$ of inner products across the sample:

$$G_{ij} = \frac{1}{n}\sum_{k=1}^n \tilde{\phi}_i(x_k) \tilde{\phi}_j(x_k)$$

and measure its Participation Ratio / Effective Dimension ($d_{\mathrm{eff}}$):

$$\text{P5 (Gram Completeness):} \qquad d_{\mathrm{eff}}(G) \triangleq \frac{(\mathrm{tr} G)^2}{\lVert G \rVert_F^2} = \frac{\left(\sum_{j=1}^W \lambda_j\right)^2}{\sum_{j=1}^W \lambda_j^2} \ge 0.80 W, \qquad \max_{i \neq j} |G_{ij}| < 0.15$$

Notice why $d_{\mathrm{eff}}(G)$ is such a clean geometric diagnostic:

• If all $W$ atoms are mutually orthonormal ($G = I_W$), then $\mathrm{tr} G = W$ and $\lVert G \rVert_F^2 = W$, so $d_{\mathrm{eff}} = \frac{W^2}{W} = W$ (full rank efficiency).
• If all $W$ atoms are collinear clones of a single feature ($\lambda_1 = W, \lambda_2 = \dots = \lambda_W = 0$), then $d_{\mathrm{eff}} = 1$ regardless of how large $W$ is!

4.2 First-Class Authentic Model Form ($\delta(x) + \hat{S}^{\ast}$)

Even when a machine $M = (T, \Phi, \theta)$ is well-conditioned (P1–P5), it can still act like Clever Hans if one of its atoms is a regime-specific spurious correlation rather than an invariant causal mechanism.

Therefore, Gate G8 requires every model promoted to production to take the First-Class Authentic Model Form (AuthenticModelForm):

$$y(x) = \underbrace{f_{\hat{S}^{\ast}}\bigl(x_{\hat{S}^{\ast}}, \theta_{\hat{S}^{\ast}}\bigr)}_{\text{Surviving Invariant Causal Core ($\hat{S}^{\ast}$)}} + \underbrace{\delta(x)}_{\text{Anchored Kennedy-O’Hagan GP}} + \varepsilon$$

Let us unpack the four mandatory pillars of AuthenticModelForm:

1. Invariant Causal Core ($\hat{S}^{\ast}$) Plus Anchored Discrepancy ($\delta(x)$): Only predictors that survive multi-environment nonlinear ICP and NILE/IRM invariance testing enter the parametric core $\hat{S}^{\ast}$. Any remaining smooth discrepancy between the causal core and reality is quarantined inside an anchored Kennedy-O’Hagan Gaussian Process $\delta(x) \sim \mathcal{GP}(0, k_{\text{anchored}})$ so that missing physics never corrupts $\theta_{\hat{S}^{\ast}}$.

2. Explicit Naming of Discarded Spurious Atoms (DiscardedAtomRecord): In standard academic papers, when a researcher tries ten features and drops four, the four dropped features vanish into the wastebasket without a trace. In Stochology, every candidate atom rejected by invariance testing must be recorded explicitly by name in discarded_atoms alongside its cross-environment invariance penalty ratio and the exact reason it was discarded (for example, atom_1_regime_shifted_lat_proxy on atlantic_storms.csv, whose NILE/IRM penalty jumps $97\times$ higher than the physical thermodynamic intensity core!).

3. Simultaneous Closure of the Six Exact Numerical Identities (IdentityClosureAudit): The protocol checks that six mathematical identities close simultaneously to floating-point tolerance (all_six_closed() == true):

   • Identity 1 (Jensen’s Gap Closure): $|\Delta_J - (\mathbb{E}[f(X)] - f(\mathbb{E}[X]))| \le 10^{-6}$;
   • Identity 2 (CORP-Murphy PAV Closure): $|\mathrm{BS} - (\mathrm{REL}_{\mathrm{CORP}} - \mathrm{RES}_{\mathrm{CORP}} + \mathrm{UNC}_0)| \le 10^{-9}$;
   • Identity 3 (Meng’s Selection Bias Closure): $|\Delta_{\text{sel}} - \rho_{R,Y}\sqrt{\frac{N-n}{n}}\sigma_Y| \le 10^{-6}$;
   • Identity 4 (Cryptographic Pre-Registration Seal): The recomputed FIPS 180-4 SHA-256 digest of the design payload matches the 64-character hex seal character-for-character;
   • Identity 5 (Info-Gap Zero-ing & Global Wald Floor): $|\hat{\alpha}(q, R(q, \tilde{u}))| \le 10^{-12}$ and the global Wald floor holds outside $\mathcal{U}(\hat{\alpha}, \tilde{u})$;
   • Identity 6 (Findings Conservation Law): $\text{registered} = \text{used} + \text{unused}$ with $K \ge 1$ and zero undeclared cherry-picking.

4. The Five-Part Operational Authenticity Criterion $A(\text{model})$ (AuthenticityCriterionA): Finally, the boolean certificate authentic == true is granted if and only if all five operational gates hold simultaneously: $$A(\text{model}) = c_1(\text{Invariance of } \hat{S}^{\ast}) \land c_2(\text{Anchored GP } \delta(x)) \land c_3(\text{Named Discarded Atoms}) \land c_4(\text{6 Identities Closed}) \land c_5(\text{OOT/OOD Survival})$$

Step 3 — Auditable Laboratory in Rust and Exercises

Both AlmostPerfectMachine and AuthenticModelForm are audited in labs --lenses and enforced as a blocking check in Gate G8 (crates/stochology-cli/src/bin/gates.rs). Run gates and its negative defect proof --defect machine from your terminal:

cargo run --release --bin gates
cargo run --release --bin gates -- --defect machine

  [Almost-Perfect Machine M=(T,Phi,theta)] sup_err=0.0234 (Barron C_f=5.60), DPI_gap=0.0297 nats, regions=64 (ratio=5.3x), d_eff=8.00/8, P1..P5=true
  [Lens 4: Invariance] ICP S*=[0], env_OLS_penalty=["0.0001", "15.8059"] (ChowF=[0.18, 23437.0]), Storms_nonlinear_NILE_IRM=["0.0011", "0.1072"], Lambda*=4.752 (RV=0.511) | AuthenticForm(S*=[0], discarded='atom_1_regime_shifted_lat_proxy', A=true)

Notice how the numbers tie the theory together:

• The 8-atom orthonormal Hermite-Fourier dictionary achieves uniform supremum error $0.0234$ under Barron norm $C_f = 5.60$ (P1), loses only $\Delta_{\mathrm{DPI}} = 0.0297\text{ nats}$ in representation compression (P2), matches the minimax noise floor (P3), generates $2^6 = 64$ linear regions ($5.3\times$ shallow efficiency, P4), and attains perfect Gram effective dimension $d_{\mathrm{eff}} = 8.00 / 8$ (P5).
• On atlantic_storms.csv, AuthenticModelForm retains only the invariant thermodynamic core $\hat{S}^{\ast} = [0]$ (Storms_nonlinear_NILE_IRM = 0.0011, Chow $F = 0.18$) and explicitly quarantines and logs the non-invariant proxy atom_1_regime_shifted_lat_proxy (0.1072, Chow $F = 23\text{,}437.0$). When --defect machine injects a spurious non-invariant atom into $\hat{S}^{\ast}$ or breaks Gram orthogonality, Gate G8 immediately halts execution with exit code 1.

Exercises

1. (Concept — Clever Hans vs. Authentic Form) A credit-scoring startup adds “phone battery percentage at the moment of loan application” to its gradient-boosted tree and sees validation $\mathrm{AUC}$ rise by $+0.015$.
   • (a) Using Pearl’s Causal Ladder and ICP across environments, explain what happens the moment applicants read on social media that plugging in their phone before applying boosts approval odds.
   • (b) How does AuthenticModelForm handle this feature?
2. (Calculation — Gram Effective Dimension) Suppose a $W = 4$ feature dictionary has Gram matrix eigenvalues $\lambda = (3.7, 0.1, 0.1, 0.1)$. Compute $\mathrm{tr} G$, $\lVert G \rVert_F^2 = \sum \lambda_j^2$, and the effective dimension $d_{\mathrm{eff}} = \frac{(\mathrm{tr} G)^2}{\lVert G \rVert_F^2}$. Does this dictionary pass Property P5 ($d_{\mathrm{eff}} \ge 0.80 W = 3.20$)? Why or why not?
3. (Calculation — Telgarsky Regions) How many affine linear regions $2^D$ does a sawtooth network of depth $D = 8$ generate, and what is its efficiency ratio $2^D / (2D)$ compared to a shallow network?
4. (Laboratory — Defect Proof) Run cargo run --release --bin gates -- --defect machine and inspect why Gate G8 rejects a machine whose discarded atoms are hidden or whose Gram matrix is rank-deficient.

Chapter Summary

• An $(\varepsilon, \delta)$-Almost-Perfect Machine $M = (T, \Phi, \theta)$ requires universal Barron density (P1), DPI $\delta$-sufficiency (P2), Fano/minimax rate optimality (P3), Telgarsky $2^D$ compositional depth efficiency (P4), and Gram effective dimension $d_{\mathrm{eff}} \ge 0.80 W$ (P5).
• The First-Class Authentic Model Form ($\delta(x) + \hat{S}^{\ast}$) pairs the invariant causal core $\hat{S}^{\ast}$ with an anchored Kennedy-O’Hagan discrepancy $\delta(x)$, explicitly names every discarded spurious atom (DiscardedAtomRecord), verifies simultaneous closure of the 6 numerical identities, and enforces the 5-part criterion $A(\text{model})$.

5. Relational Ontology and Complex Systems

Learning Objectives. By the end of this chapter, you will be able to contrast substantialist (atomistic) metaphysics with relational and process ontology across six transdisciplinary axes; explain how Buddhist vacuity (Śūnyatā), Relational Quantum Mechanics (RQM), and Ontic Structural Realism (OSR) map to mutual information collapse ($I_{\text{iso}} \to 0$ vs. $I_{\text{rel}} > 0$); formulate Ilya Prigogine’s open-system entropy balance ($dS = d_i S + d_e S \le 0$) and Maturana and Varela’s autopoietic organizational closure; analyze heteropathic emergence and Thomas Schelling’s (1971) segregation phase transition; connect Norbert Elias’s Homo clausus critique to Moulton-Campbell pseudoreplication ($\Phi_2$) and Stackelberg performativity; and simulate planetary homeostasis in Andrew Watson and James Lovelock’s (1983) Daisyworld.

Step 1 — Intuition and the Real-World Paradox

Peer Gynt’s Onion, Cuvier’s Whirlpool, and Douglas Adams’s Puddle

Why do so many statistical models in economics, sociology, ecology, and psychology break down even when the data are clean and the equations are solved accurately? Because before any mathematician writes down an equation, they implicitly adopt an ontology—a theory of what kinds of things exist in the World ($L_1$).

For three centuries, Western textbook science defaulted to substantialism and methodological individualism: the belief that the world is built out of self-contained, isolated bricks (atoms, selfish genes, isolated Robinson Crusoe consumers, independent rows in a CSV file) that possess intrinsic properties inside themselves prior to any interaction.

Three famous parables expose the illusion of the isolated brick:

1. Peer Gynt’s Onion (The Search for an Isolated Core): In Act V of Henrik Ibsen’s dramatic poem Peer Gynt (1867), the aging protagonist picks up a wild onion and decides to peel away its outer layers—his roles, relationships, habits, and social masks—to find the “true, intrinsic Peer Gynt” hiding at the center. He peels layer after layer until nothing is left in his hand: “Nature is witty! To the innermost center, it’s nothing but layers—smaller and smaller—no kernel at all!” When you strip away all relations from a node in a coupled network, you do not uncover a pure essence; the signal vanishes completely.
2. Cuvier’s Whirlpool and the Knot in a Shoelace (Form That Persists Through Flow): Look at a standing whirlpool in a mountain stream, or a metabolic cell in your body, or a knot tied in a long cord that you slide from left to right. Every drop of water in the whirlpool and almost every molecule in your body is replaced over time. If you freeze the river by building a solid wall around the whirlpool (“isolating the system”), the whirlpool dies immediately into flat, maximum-entropy water! The whirlpool is not a static lump of matter; it is a dissipative, self-maintaining pattern of flow that stays alive only because energy and matter pass continuously through its open boundary.
3. Douglas Adams’s Sentient Puddle (The Illusion of Static Adaptation): Imagine a puddle waking up one morning in a depression in the asphalt and thinking: “What an interesting world I find myself in—an interesting hole I find myself in—fits me rather neatly, doesn’t it? In fact it fits me staggeringly well, must have been made to have me in it!” And the puddle keeps believing that right up until the sun rises, heats the pavement, and evaporates the puddle. Passive supervised learning ($\theta_{\mathrm{SL}}$) and myopic retraining ($\theta_{\mathrm{PS}}$) act exactly like Douglas Adams’s puddle: they assume the environment is a fixed mold to which the agent passively conforms, forgetting that in biological evolution (Richard Lewontin’s niche construction) and institutional economics (Stackelberg co-evolution, $\theta_{\mathrm{PO}}$), organisms and societies actively reshape the very environment that selects them.

In crates/stochology-lenses/src/relational.rs, the Stochology Protocol translates these philosophical, physical, biological, and sociological insights into six executable, quantitatively audited axes (seed = 2026). Let us examine the foundations and mathematics of each axis.

Step 2 — Foundations and Mathematical Formalization

5.1 Axis 1 — Relational Vacuity (Śūnyatā), Indra’s Net, RQM, and OSR

Philosophical and Physical Foundations

In classical metaphysics, Aristotle spoke of substance (ousia) and John Locke spoke of a bare particular—a hidden substrate supposed to carry properties all by itself. In classical Indian philosophy, substantialist schools called this hypothetical self-existent essence svabhāva (“own-being”).

In the second century CE, the Buddhist logician and philosopher Nāgārjuna (Mūlamadhyamakakārikā, Chapter 24, verses 18–19) demonstrated that svabhāva is a logical contradiction: if a thing possessed an immutable intrinsic nature independent of causes, conditions, and relations (pratītyasamutpāda, dependent co-arising), it could never interact, change, or produce an effect. Therefore, all phenomena are empty of intrinsic isolated essence (Śūnyatā)—which does not mean they are nothingness, but rather that to exist is to inter-exist relationally. Seven centuries later, the Huayan philosopher Fazang illustrated this with Indra’s Net: an infinite cosmic web holding a polished jewel at every vertex, where every jewel exists solely by reflecting all other jewels in the net.

In twentieth- and twenty-first-century physics, the exact same conclusion emerged independently from quantum mechanics and the philosophy of science:

• Carlo Rovelli’s Relational Quantum Mechanics (RQM, 1996): Quantum states $\psi$ are not absolute properties carried by an isolated particle; a physical variable takes a definite value only relative to an interaction with another physical system.
• James Ladyman and Don Ross’s Ontic Structural Realism (OSR, Every Thing Must Go, 2007): At the fundamental level of quantum field theory, there are no self-subsisting “little billiard balls”; relational structure is all there is.

Information-Theoretic Formalization (RelationalFigurationAudit)

How do we test Nāgārjuna’s and Rovelli’s thesis mathematically inside our Rust apparatus? Consider two coupled binary subsystems $X_A, X_B \sim \mathrm{Bernoulli}(0.5)$ whose relational interaction—specifically their phase synchrony $R(X_A, X_B) = \mathbb{I}\lbrace X_A = X_B \rbrace$—drives the macroscopic observable state $Y$ across a high-fidelity channel ($90%$ fidelity).

• If an analyst looks at node $X_A$ in isolation (stripping away its relational edge to $X_B$ in search of its intrinsic svabhāva), the marginal distribution of $X_A$ is pure $50/50$ coin noise completely independent of $Y$: $$I(X_{\text{isolated}}; Y) = 0 \qquad (\text{empirically } 0.0003\text{ nats under finite sample } n = 2\text{,}000)$$
• When the analyst measures the relational coupling $R(X_A, X_B)$, mutual information jumps by three orders of magnitude to: $$I\bigl(R(X_A, X_B); Y\bigr) = 0.3681\text{ nats} > 0.30\text{ nats}$$

The predictive power lived $100%$ in the relation (the edge) and $0%$ in the isolated node.

5.2 Axis 2 — Process Ontology, Dissipative Structures, and Autopoiesis

Foundations: From Static Equilibrium to Open-System Thermodynamics

Five hundred years before Christ, Heraclitus of Ephesus observed that reality is a process of becoming (“Everything flows; you cannot step twice into the same river”), and in thirteenth-century Japan Eihei Dōgen formulated Uji (Being-Time): time is not an empty container through which static objects travel; being itself is dynamic temporal activity.

In nineteenth-century physics, the Second Law of Thermodynamics stated that in an isolated system (closed to both matter and energy exchange with the outside world), entropy $S$ can only increase until all gradients flatten into dead thermal equilibrium:

$$d_i S \ge 0 \qquad (\text{irreversible internal entropy production})$$

For decades, this created a famous paradox: If entropy always increases toward disorder, how can living cells, ecosystems, cyclones, and human economies maintain highly ordered structures for decades or millennia?

Nobel laureate Ilya Prigogine resolved the paradox by distinguishing isolated systems from open far-from-equilibrium systems. In an open system, the total change in entropy $dS$ is the sum of two terms:

$$dS = \underbrace{d_i S}_{\text{Internal Production }(\ge 0)} + \underbrace{d_e S}_{\text{Boundary Exchange Flux}}$$

While internal metabolism and friction inevitably produce positive entropy ($d_i S > 0$), an open system imports high-grade free energy and matter from its environment and exports heat and entropy across its boundary ($d_e S < 0$). Whenever the boundary export exceeds internal production:

$$d_e S \le -d_i S < 0 \implies dS = d_i S + d_e S \le 0$$

the system sustains a stationary far-from-equilibrium ordered state that Prigogine named a Dissipative Structure.

Maturana and Varela’s Autopoiesis and Prigogine’s Brusselator with Schnakenberg Entropy Production

Chilean biologists Humberto Maturana and Francisco Varela (1972) added the topological law that distinguishes a living or institutional system from a mere physical eddy: Autopoiesis (“self-production”). An autopoietic network continuously regenerates the very boundary and catalytic processes that produce its components.

In DissipativeAutopoieticAudit::simulate_vortex (crates/stochology-lenses/src/relational.rs), we integrate Ilya Prigogine and René Lefever’s (1968) non-equilibrium Brusselator autocatalytic reaction network ($A \rightleftharpoons X$, $B + X \rightleftharpoons Y + D$, $2X + Y \rightleftharpoons 3X$, $X \rightleftharpoons E$) via 4th-order Runge-Kutta (RK4):

$$\frac{dX}{dt} = A + X^2 Y - (B + 1)X, \qquad \frac{dY}{dt} = B X - X^2 Y$$

In the supercritical regime $B > 1 + A^2$ (specifically $A = 1.0, B = 2.6 > 2.0$), the steady state $(X^{\ast}, Y^{\ast}) = (A, B/A)$ becomes unstable via a Hopf bifurcation, driving a self-sustained limit-cycle chemical oscillation. Along the limit cycle, simulate_vortex evaluates Jürgen Schnakenberg’s (1976) exact microscopic internal entropy production rate across the forward and reverse reaction fluxes $J_\rho^+, J_\rho^-$:

$$\frac{d_i S}{dt} = \sum_{\rho=1}^3 \bigl(J_\rho^+ - J_\rho^-\bigr)\ln\left(\frac{J_\rho^+}{J_\rho^-}\right) > 0$$

coupled with chemostat boundary entropy export $d_e S / dt < -d_i S / dt$, yielding net open-system entropy balance $dS / dt = -0.55 \le 0$. Over the trajectory:

• $100.0%$ of the original constituent matter is replaced (material_turnover_fraction > 0.999), just like Cuvier’s whirlpool or the knot sliding along a cord;
• Yet autopoietic organizational closure preserves the topological limit-cycle pattern at $100.0%$ fidelity (autopoietic_pattern_fidelity > 0.999);
• Conversely, the moment the boundary is sealed ($d_e S = 0$), internal entropy accumulates unchecked ($\Delta S_{\text{iso}} > 10.0$) and the structure collapses into dead thermodynamic equilibrium.

5.3 Axis 3 — Heteropathic Emergence and Schelling’s Segregation Cascade

Foundations: More Is Different and Nonlinear Composition

In Book III of A System of Logic (1843), John Stuart Mill distinguished two ways causes combine in nature:

1. Mechanical (Homopathic) Composition: If you push an object north with $3\text{ N}$ and east with $4\text{ N}$, the resultant is simply the vector sum ($5\text{ N}$ northeast). The whole is the linear sum of the parts.
2. Chemical (Heteropathic) Emergence: Combine sodium (a reactive metal that explodes in water) and chlorine (a lethal greenish-yellow gas), and you obtain table salt ($\mathrm{NaCl}$)—a crystalline solid essential for human life whose macro-properties cannot be deduced by summing the isolated properties of sodium and chlorine.

In 1972, Nobel physicist Philip W. Anderson universalized this principle in his landmark Science essay “More Is Different”: at each new scale of complexity (from quarks to chemistry, from chemistry to cellular biology, from psychology to macro-sociology), broken symmetries generate genuinely new emergent laws.

Thomas Schelling’s (1971) Dynamic Segregation Phase Transition

No model illustrates emergent macro-pathology from benign micro-intentions more starkly than Thomas Schelling’s (1971) spatial neighborhood model (SchellingSegregationModel).

Imagine a city grid populated by two groups of residents ($A$ and $B$, plus empty houses). Every resident looks at their immediate $3 \times 3$ Moore neighborhood (up to $8$ adjacent neighbors) and asks a single question: “Is the fraction of my neighbors who belong to my own group at least $\tau$?”

• If yes, the resident is content and stays put.
• If no, the resident moves to the nearest vacant cell where that threshold $\tau$ is met.

Now look at the paradox of non-hostile tolerance:

• Suppose every single citizen in the city is happy to be in the minority, requiring only $\tau = 0.375$ ($3/8$, i.e., gladly accepting $62.5%$ out-group neighbors!) and having zero desire for a segregated city.
• A linear, reductionist analyst who surveys individual attitudes ($L_3$) concludes: “Nobody in this city wants segregation; therefore, any observed segregation must be small or intentional.”

When we run SchellingPhaseTransitionAudit::evaluate(2026) on the 2D grid, a nonlinear tipping cascade unfolds:

• At subcritical tolerance $\tau = 0.125$, the city remains stably integrated ($50.2%$ same-group similarity, right at the random baseline).
• At mild, non-hostile tolerance $\tau = 0.375$ (where everyone accepts $62.5%$ out-group neighbors), a single local move tips a neighbor below $3/8$, who moves and tips two more neighbors, triggering a self-reinforcing avalanche that locks the city into $82.4%$ macro-segregation (an emergent gap of $\Delta_{\text{emerg}} = 0.449 > 0.38$ above individual intention)!

This mathematical theorem grounds modern structural sociology (Eduardo Bonilla-Silva’s Racism without Racists and Silvio Almeida’s Structural Racism): macroscopic structural inequality and segregation are emergent topological properties of coupled networks and institutional rules ($L_1$), not simple averages of individual hostility.

5.4 Axis 4 — Homo clausus vs. Homines aperti and Figurational Coupling

In The Civilizing Process (1939) and What Is Sociology? (1970), sociologist Norbert Elias diagnosed the central blind spot of modern social and behavioral science as the myth of Homo clausus (“the closed human”)—the image of the individual as a little sealed box standing “inside” while “society” stands outside like an external wall. Against Homo clausus, Elias proposed Homines aperti (“open, interdependent pluralities of humans”) bound together in dynamic figurations (like dancers in a mobile court dance: you cannot understand the steps of one dancer by filming them in an empty room).

In the Stochology Protocol, the Homo clausus fallacy manifests in two exact mathematical errors that our invariants block:

1. On Bridge $L_1 \to L_2$ (Pseudoreplication, Invariant $\Phi_2$): Treating $n = 500$ observations drawn from coupled social clusters as $500$ independent atoms ignores the Moulton-Campbell intraclass correlation. In RelationalFigurationAudit, a tail-exceedance design effect of $\mathrm{DEFF} = 5.81\times$ shrinks $n = 500$ apparent individuals down to $n_{\mathrm{eff}}(0.90) = 86.0$ true independent degrees of freedom.
2. On Bridge $L_3 \to L_1$ (Puddle Stability vs. Co-Creation, Prohibition 3): Treating the agent as passively adapting to a fixed social hole yields Performative Stability $\theta_{\mathrm{PS}} = 2.000$, whereas recognizing the reciprocal co-creation of agent and figuration yields the Stackelberg optimum $\theta_{\mathrm{PO}} = 2.444 > \theta_{\mathrm{PS}}$.

5.5 Axis 5 — Cybernetic Co-Evolution (Triple Helix) and Daisyworld Homeostasis

Foundations: Lewontin’s Triple Helix, Giddens, and Lovelock’s Daisyworld

In evolutionary biology, Richard Lewontin (The Triple Helix: Gene, Organism, and Environment, 2000) replaced the one-way Neo-Darwinian differential equation $\frac{dO}{dt} = f(O, E)$ (where a static environment $E$ filters passive organisms $O$) with a coupled co-evolutionary system:

$$\frac{dO}{dt} = f(O, E), \qquad \frac{dE}{dt} = g(O, E)$$

Beavers build dams that transform dry valleys into wetlands, altering the selection pressures on their own descendants; earthworms chemically rebuild terrestrial soil; in sociology, Anthony Giddens’s Duality of Structure and Roy Bhaskar’s Transformational Model of Social Activity (TMSA) show that social structure is both the medium and the continually reproduced outcome of human agency.

In 1983, Andrew Watson and James Lovelock created Daisyworld (DaisyworldSystem in crates/stochology-lenses/src/relational.rs) to prove mathematically that coupled organism-environment feedback ($f$ and $g$ together) automatically generates planetary cybernetic homeostasis without any foresight, teleology, or central planner.

Mathematical Equations of Daisyworld

Consider a planet seeded with two species of daisies covering fractions $\alpha_b$ (black daisies, low albedo $A_b = 0.25$ that absorb heat) and $\alpha_w$ (white daisies, high albedo $A_w = 0.75$ that reflect heat), with bare ground $\alpha_g = 1 - \alpha_b - \alpha_w$ at intermediate albedo $A_g = 0.50$:

1. Planetary Albedo and Stefan-Boltzmann Radiative Balance: The planet’s effective albedo is the weighted sum $A_p = \alpha_g A_g + \alpha_b A_b + \alpha_w A_w$. Under solar luminosity $L$ (which warms steadily over geological time from $L = 0.65$ to $L = 1.60$) and solar flux constant $S_0$, the effective planetary temperature $T_e$ satisfies the Stefan-Boltzmann Law: $$\sigma_{\mathrm{SB}} T_e^4 = S_0 L (1 - A_p)$$

2. Local Microclimate Heating: Because dark patches absorb more sunlight than average and bright patches reflect more, local temperatures $T_b$ and $T_w$ over black and white daisy beds satisfy: $$T_i^4 = q(A_p - A_i) + T_e^4 \qquad (i \in \lbrace b, w \rbrace)$$ so black daisies warm their local microclimate ($T_b > T_e$) while white daisies cool theirs ($T_w < T_e$).

3. Parabolic Growth Rate and Replicator ODEs: Both species grow best at an optimal biological temperature $T_{\text{opt}} = 22.5 ^\circ\mathrm{C}$ (vanishing below $5 ^\circ\mathrm{C}$ and above $40 ^\circ\mathrm{C}$): $$\beta(T_i) = \max\bigl(0, 1 - 0.003265 (22.5 - T_i)^2\bigr)$$ and compete for bare fertile ground $\alpha_g$ against mortality rate $\gamma = 0.30$: $$\frac{d\alpha_b}{dt} = \alpha_b(\alpha_g \beta(T_b) - \gamma), \qquad \frac{d\alpha_w}{dt} = \alpha_w(\alpha_g \beta(T_w) - \gamma)$$

Watch the cybernetic loop work across solar luminosity $L$:

• When the young sun is dim ($L \approx 0.70$), the planet is cold; black daisies thrive because they warm themselves ($T_b > T_e$), spreading across the globe, lowering planetary albedo $A_p$, and warming the entire planet up to $\approx 22.5 ^\circ\mathrm{C}$!
• As the sun brightens ($L$ climbs from $0.80$ to $1.35$), white daisies gain the advantage because they cool themselves ($T_w < T_e$), gradually replacing black daisies, raising planetary albedo $A_p$, and cooling the planet against the brightening sun!
• In the coexistence regime, the planetary derivative is actually negative ($dT_e / dL = -11.93 < 0$), maintaining a mean absolute thermal deviation from $22.5 ^\circ\mathrm{C}$ of only $\mathrm{MAE} = 1.52 ^\circ\mathrm{C}$ (compared to $9.57 ^\circ\mathrm{C}$ on a dead lifeless planet)!
• Finally, at extreme solar forcing $L = 1.60$, solar radiation overwhelms even a $100%$ white-daisy canopy, crossing an absorbing catastrophe boundary where the biosphere goes extinct and temperature jumps vertically to the dead-planet line.

5.6 Axis 6 — The Six-Layer Ontological Stack and Complexity Economics

Historian of economics Philip Mirowski (More Heat than Light, 1989) documented how late-nineteenth-century neoclassical economists (Walras, Jevons, Edgeworth) copied the equations of 1860s closed-system static potential energy physics line by line—substituting “utility” for potential energy and assuming a frictionless, history-free, atomistic equilibrium. Edgar Morin, W. Brian Arthur, and Eric Beinhocker contrasted this reductionist paradigm against the Six-Layer Relational Ontological Stack audited in Axis 6:

Step 3 — Auditable Laboratory in Rust and Exercises

In crates/stochology-lenses/src/relational.rs, RelationalComplexSystemsSynthesis::evaluate(2026) executes all six axes and is verified in labs --lenses and Gate G8:

cargo run --release --bin labs -- --lenses

  [Relational Ontology & Complex Systems] MI_rel=0.3681 vs MI_iso=0.0003 nats | Prigogine dS=-0.55 (turnover=100.0%, closure=100.0%) | Schelling(tau=0.125->50.2% vs tau=0.375->82.4%) | Daisyworld(MAE=1.52C vs dead=9.57C, dT/dL=-11.93) | verified=true

Exercises

1. (Concept — Relational Vacuity vs. Substantialism) In RelationalFigurationAudit, why does each individual node $X_A \sim \mathrm{Bernoulli}(0.5)$ have zero mutual information with the target $Y$ when inspected alone, yet high mutual information when paired with $X_B$? Give a real-world example from neuroscience, finance, or ecology where measuring a single variable in isolation misses an interaction completely.
2. (Calculation — Prigogine Entropy Balance) An open industrial or biological system generates internal irreversible entropy at rate $d_i S / dt = +0.65\text{ J/(K}\cdot\text{s)}$. What is the minimum magnitude of negative entropy flux $|d_e S / dt|$ that the system must export across its boundary to avoid thermal degradation? What happens if its boundary is sealed ($d_e S / dt = 0$) for $t = 20$ seconds?
3. (Concept — Schelling Phase Transition) In Schelling’s segregation model with $\tau = 0.375$, every resident is happy living in a neighborhood where $62.5%$ of their neighbors belong to the other group. Explain step by step why the city nevertheless tips into $82.4%$ segregation, and why surveying individual attitudes fails to diagnose the macro-outcome.
4. (Concept — Daisyworld Cybernetics) In Daisyworld, neither black nor white daisies have brains, committees, or awareness of planetary temperature—each daisy simply grows faster when its local microclimate is near $22.5 ^\circ\mathrm{C}$. Why does $dT_e / dL$ become negative in the two-species coexistence zone, and what lesson does the collapse at $L = 1.60$ teach about absorbing boundaries ($\Phi_3 / \text{Lens 2}$)?

Chapter Summary

• Axis 1 (Śūnyatā / RQM / OSR): Predictive and physical properties reside in relational couplings ($I_{\text{rel}} = 0.3681\text{ nats}$), vanishing when nodes are stripped of their relations ($I_{\text{iso}} = 0.0003\text{ nats}$).
• Axis 2 (Dissipative Structures & Autopoiesis): Open systems maintain far-from-equilibrium order via boundary entropy export ($dS = d_i S + d_e S \le 0$), surviving $100%$ material turnover while preserving topological closure.
• Axis 3 (Heteropathic Emergence & Schelling): Non-hostile micro-preferences ($\tau = 0.375$) trigger nonlinear tipping cascades into macro-segregation ($82.4%$), proving that More Is Different.
• Axis 4 (Homo clausus vs. Homines aperti): Treating interdependent humans as isolated atoms commits Moulton-Campbell pseudoreplication ($\mathrm{DEFF} = 5.81\times$) and ignores Stackelberg performativity ($\theta_{\mathrm{PO}} > \theta_{\mathrm{PS}}$).
• Axis 5 (Daisyworld Co-Evolution): Coupled replicator-radiative feedback stabilizes planetary temperature near $22.5 ^\circ\mathrm{C}$ ($\mathrm{MAE} = 1.52 ^\circ\mathrm{C}$) without teleology until the absorbing catastrophe boundary ($L = 1.60$).
• Axis 6 (The 6-Layer Ontological Stack): Aligns physical, thermodynamic, biological, psychological, sociological, and economic layers under a single auditable synthesis (verified = true).

6. The Four Prohibitions

Learning Objectives. By the end of this chapter, you will be able to explain the operational and mathematical rationale behind the Four Golden Prohibitions of the Stochology Protocol: (1) Ban on Unstructured Free Prose Between Agents, (2) Ban on the Lone Mean, (3) Ban on Confusing Predictive Fit with Performative Validity, and (4) Ban on Dogmatic Extremes (Cromwell’s Rule) and Omitted Attempts (the Garden of Forking Paths).

Step 1 — Intuition and the Real-World Paradox

The Paragraph That Hid Three Fatal Flaws

Imagine sitting on an operational risk committee at a retail bank. A consultant hands you a polished slide deck containing the following sentence:

“Considering the two-year call-center history, the average arrival rate of $312$ calls per hour, the mean handling time of $6.2$ minutes, and the standard Erlang-C queueing model, the expected service level is $82%$ of calls answered within $20$ seconds; we therefore recommend maintaining the current staffing of $36$ agents.”

On a first reading, the sentence sounds authoritative, technical, and reassuring. Yet when the bank follows this recommendation, customer waiting times explode and the phone queue collapses on Mondays and Fridays. Why? Because natural-language prose is an extraordinary hiding place for unexamined assumptions.

Buried inside that single smooth sentence are three fatal omissions:

1. It applied a nonlinear queueing formula to the average arrival rate ($f(\mathbb{E}[X])$) instead of averaging the queueing delay across the fluctuating days ($\mathbb{E}[f(X)]$), hiding a massive Jensen’s Gap ($82%$ promised versus $57%$ realized!).
2. It treated $27\text{,}716$ five-minute intervals as independent observations instead of clustering by the $164$ calendar days, understating the margin of error by a factor of $\sqrt{28.26} \approx 5.3\times$.
3. It never declared how many alternative staffing formulas the consultant tried before picking the one that looked best on historical data, nor what numeric threshold would force the bank to pull the plug if the model failed in live operation.

In a traditional organization—or in a multi-agent Artificial Intelligence pipeline where Large Language Models converse in free English or Portuguese paragraphs—one agent’s smooth prose becomes the next agent’s unquestioned premise. Rhetorical confidence substitutes for mathematical proof.

To make hiding impossible, the Stochology Protocol establishes Four Golden Prohibitions (AGENTS.md §I, audited in EpistemologicalCard::audit() and Gate G6). No claim, model, or inter-agent message may pass into production if it violates any of the four.

Step 2 — Foundations and Mathematical Formalization

6.1 Prohibition 1 — Ban on Unstructured Free Prose Between Agents (PROHIBITION_1)

Why Prose Fails in Multi-Agent and Institutional Systems

When human teams or autonomous AI agents communicate through free natural language, two well-documented pathologies emerge:

• Adjective Laundering: Uncertain guesses in the first stage (“the data weakly suggest, under strong stationarity assumptions…”) are summarized by the second stage as established facts (“based on the verified trend…”).
• Sycophancy Cascades: In multi-agent LLM architectures, downstream agents defer to the confident tone of upstream agents rather than recomputing the variance budget, SHA-256 data hash, or cost-loss threshold.

The Structural Remedy: Typed Epistemological Cards

Under Prohibition 1, all communication between agents or modules transits exclusively through structured Epistemological Cards (EpistemologicalCard in crates/stochology-core/src/card.rs), serialized in strict YAML (cards/*.yaml) and validated by EpistemologicalCard::audit().

Why does a fixed schema defeat adjective laundering? Because an empty or inconsistent slot cannot hide behind an eloquent verb. If an agent wants to recommend an action in a YAML card, the parser forces the agent to fill in:

• the exact SHA-256 hash of the dataset (dataset_sha256);
• the true independent unit and Moulton-Campbell effective sample size (effective_sample_size_n_eff);
• all seven numbers of the nonlinear summary (f_at_mean, mean_of_f, jensen_gap, median, q05, q95, crps);
• the four variance-budget shares summing to $1.0$;
• the counter of attempted specifications $K \ge 1$;
• and the numeric exit clause (exit_clause).

If any slot is missing, malformed, or algebraically inconsistent with its neighbors, EpistemologicalCard::audit() rejects the card before any downstream agent ever reads it.

6.2 Prohibition 2 — Ban on the Lone Mean (PROHIBITION_2)

Why the Mean Alone Is a Lie Under Curvature, Compounding, or Heavy Tails

In elementary courses, students are taught to summarize a random variable $X$ by its sample mean $\bar{x}$. That habit is harmless only in a linear, thin-tailed, additive Gaussian world. It becomes a dangerous distortion whenever any of three conditions holds:

1. The payoff or loss function $f(X)$ is nonlinear (Bridge $L_2 \to L_3$, Chapter 1): by Jensen’s Inequality, $f(\mathbb{E}[X]) \neq \mathbb{E}[f(X)]$.
2. The dynamics are multiplicative over time (Lens 2, Chapter 3): by Itô’s variance drain, the ensemble mean growth rate $\mu$ overstates the compounded time-average growth rate $\mu - \frac{1}{2}\sigma^2$.
3. The upper tail is heavy (Lens 3, Chapter 3): when the Pareto tail index satisfies $\alpha \le 2$, the population variance is infinite, and the mean is dominated by rare, violent jumps.

The Seven Mandatory Quantities of NonlinearSummary

Under Prohibition 2, reporting only $\mathbb{E}[X]$ or $f(\mathbb{E}[X])$ is strictly forbidden. Every Epistemological Card (epistemological_header.nonlinearity) and every laboratory summary (NonlinearSummary in crates/stochology-core/src/layers.rs) must report all seven numbers together:

$$\bigl( f(\mathbb{E}[X]),\quad \mathbb{E}[f(X)],\quad \Delta_J = \mathbb{E}[f(X)] - f(\mathbb{E}[X]),\quad \text{median},\quad q_{05},\quad q_{95},\quad \mathrm{CRPS} \bigr)$$

Each of these seven numbers answers a distinct operational question:

Furthermore, EpistemologicalCard::audit() checks the exact algebraic closure $|\Delta_J - (\mathbb{E}[f(X)] - f(\mathbb{E}[X]))| \le 10^{-3}$ and requires $\Delta_J \neq 0$ whenever nonlinearity is present.

6.3 Prohibition 3 — Ban on Confusing Learning with Performativity (PROHIBITION_3)

Why Low Validation Error Does Not Prove Causal or Performative Validity

Suppose a credit-scoring model or an airline ground-delay controller achieves a tiny Brier score on last year’s holdout data. Does that prove the model will work when deployed tomorrow?

No—for two distinct reasons across Rung 2 of Pearl’s Ladder and Bridge $L_3 \to L_1$:

1. Confounded Passive Fit vs. Intervention: A model that predicts well passively ($P(Y \mid X)$) may be riding a spurious proxy or confounder that breaks the moment the agent intervenes ($P(Y \mid \mathrm{do}(X))$).
2. Performative Feedback ($\mathcal{D}(\theta)$): When deploying parameter $\theta$ causes customers, borrowers, airlines, or drivers to change their behavior, the data distribution shifts from $\mathcal{D}$ to $\mathcal{D}(\theta)$.

Mandatory Performative Audit on Bridge $L_3 \to L_1$

Under Prohibition 3, every model operating on Bridge $L_3 \to L_1$ must explicitly separate:

• Performative Stability ($\theta_{\mathrm{PS}}$): the fixed point of myopic Repeated Risk Minimization (retraining passively on the distribution induced by the previous round);
• Performative Optimality ($\theta_{\mathrm{PO}}$): the true Stackelberg equilibrium that anticipates the population’s strategic response;
• Wasserstein-1 Distribution Sensitivity ($\varepsilon$) and the Strict RRM Contraction Condition: $$r_{\mathrm{RRM}} = \frac{\varepsilon \beta}{\gamma} < 1$$

If $r_{\mathrm{RRM}} \ge 1$, PerformativeSystem and EpistemologicalCard::audit() reject the card immediately (--defect performativity), preventing an automated retraining loop from destabilizing the real-world environment.

6.4 Prohibition 4 — Ban on Dogmatic Extremes and Omitted Attempts (PROHIBITION_4)

Prohibition 4 guards against two of the most common sins in quantitative research: dogmatic certainty ($0%$ or $100%$) and unreported cherry-picking ($p$-hacking).

Part A: Cromwell’s Rule ($p \in [\varepsilon_{\text{floor}}, 1 - \varepsilon_{\text{floor}}]$)

In August 1650, Oliver Cromwell wrote to the General Assembly of the Church of Scotland:

“I beseech you, in the bowels of Christ, think it possible that you may be mistaken.”

In the 1980s, Bayesian statistician Dennis Lindley named Cromwell’s Rule after this plea. Look back at Bayes’ theorem from the Preface:

$$P(H \mid E) = \frac{P(E \mid H) P(H)}{P(E \mid H) P(H) + P(E \mid \neg H) (1 - P(H))}$$

What happens if an agent sets their prior probability to $P(H) = 0$ (or $P(H) = 1$)? Then no matter how overwhelming the empirical evidence $E$ is—even a billion black swans marching past the window!—multiplying by $P(H) = 0$ forces the posterior probability $P(H \mid E)$ to stay frozen at $0$ forever. Furthermore, under the logarithmic scoring rule $-\ln p$, assigning $p = 0$ to an event that subsequently occurs inflicts an infinite penalty ($\infty$).

Therefore, Prohibition 4 bans probabilities of $0%$ and $100%$ across the entire protocol. Every declared probability $p$ must lie strictly inside the Cromwell Corridor bounded by a declared base-rate floor $\varepsilon_{\text{floor}} \in (0, 0.05]$:

$$\varepsilon_{\text{floor}} \le p \le 1 - \varepsilon_{\text{floor}}$$

If any card or module attempts to declare $p = 0.0$, $p = 1.0$, or $p$ outside $[\varepsilon_{\text{floor}}, 1 - \varepsilon_{\text{floor}}]$, Gate G6 blocks execution with exit code 1 (--defect cromwell).

Part B: The Garden of Forking Paths, the Attempt Counter $K \ge 1$, and Findings Conservation

Why do so many published “statistically significant ($p < 0.05$)” findings fail to replicate when tested by an independent laboratory (John Ioannidis, 2005)?

Suppose a hundred analysts toss a fair coin $20$ times each, or one analyst tests $K = 50$ noisy predictors against a random target on a small validation set (Chapter 7 of the historical studies). Even when nothing is happening in the World ($L_1$), if you try $K = 20$ different feature combinations, outlier exclusions, or functional forms—what Andrew Gelman and Eric Loken called the Garden of Forking Paths—and report only the single best-looking run while hiding the $19$ failed attempts in a file drawer, the probability of finding a false positive climbs from $5%$ to $1 - (1 - 0.05)^{20} \approx 64%$!

Even more striking: in 2022, Nate Breznau and colleagues gave 73 independent research teams the exact same social-science dataset and the exact same hypothesis; the teams came back with confident estimates ranging from strongly negative to strongly positive, and over $95%$ of the variance across teams came from undeclared modeling choices along the bridge!

To make the file drawer visible and auditable, Prohibition 4 enforces three mandatory disclosures in data_and_audit_contract:

1. The Attempt Counter ($K \ge 1$): Every card must declare attempt_counter_K—the total number of model specifications, hyperparameter sweeps, or threshold revisions attempted on the problem.
2. Multiplicity-Adjusted Sequential Evidence (e-process $E_t$): The sequential likelihood ratio (e-process $E_t = \prod_{i=1}^t L_i$) is penalized by $1/K$ under Ville’s inequality (e_process_multiplicity $\ge 1.0$).
3. Exact Findings Conservation (findings): Every card must declare three integers—registered (total hypotheses/atoms tested), used (retained in the final model), and unused (discarded)—satisfying the exact conservation law: $$\text{registered} = \text{used} + \text{unused}, \qquad \text{registered} \ge 1, \qquad \text{used} \ge 1$$
4. Out-of-Sample Isotonic CORP-Murphy Audit: Every probabilistic forecast must report its out-of-sample PAV decomposition ($\mathrm{BS} = \mathrm{REL}_{\mathrm{CORP}} - \mathrm{RES}_{\mathrm{CORP}} + \mathrm{UNC}_0$).

Step 3 — Auditable Laboratory in Rust and Exercises

Test the enforcement of the Four Prohibitions directly through the epistemological gates and negative proofs:

cargo run --release --bin gates
cargo run --release --bin gates -- --defect cromwell
cargo run --release --bin gates -- --defect performativity

When --defect cromwell injects a dogmatic probability ($p = 0.0$ or $p = 1.0$) into a card, or when --defect performativity injects a divergent RRM loop ($r_{\mathrm{RRM}} \ge 1$), gates catches the violation and exits with code 1.

Exercises

1. (Concept — Prohibition 1) Read the following prose statement from an engineering memo: “Our battery degradation neural network achieved an $R^2$ of $0.94$ on historical lab cycles, so we can safely extend the warranty to $10$ years.” List at least four mandatory fields of an EpistemologicalCard that are completely missing from this sentence.
2. (Calculation — Prohibition 2) Suppose daily server latency penalty is $f(X) = X^3$, where daily traffic load $X$ takes values $1$, $2$, and $6$ with equal probability $1/3$. Compute $\mathbb{E}[X]$, $f(\mathbb{E}[X])$, $\mathbb{E}[f(X)]$, and Jensen’s Gap $\Delta_J$. By what factor does $f(\mathbb{E}[X])$ understate the true average penalty $\mathbb{E}[f(X)]$?
3. (Calculation — Prohibition 4 & Multiplicity) If an analyst runs $K = 30$ independent hypothesis tests at significance level $\alpha = 0.05$ on pure noise where the null hypothesis is true in every single test, what is the probability $1 - (1 - 0.05)^{30}$ that at least one test crosses $p < 0.05$ by pure chance? How does declaring $K = 30$ and requiring $E_t / K \ge 1/\alpha$ protect the decision-maker?
4. (Concept — Cromwell’s Rule) Why does assigning $P(H) = 0.9999$ behave completely differently under Bayes’ theorem from assigning $P(H) = 1.0000$ when a catastrophic counterexample arrives?

Chapter Summary

• Prohibition 1 bans unstructured free prose between modules/agents, requiring all claims to travel as validated YAML EpistemologicalCard structs.
• Prohibition 2 bans reporting a lone mean under nonlinearity, multiplicative compounding, or heavy tails, requiring the 7-number NonlinearSummary ($f(\mathbb{E}[X]), \mathbb{E}[f(X)], \Delta_J, \text{median}, q_{05}, q_{95}, \mathrm{CRPS}$).
• Prohibition 3 bans equating passive predictive accuracy with causal or performative validity, requiring explicit separation of $\theta_{\mathrm{PS}}$ vs. $\theta_{\mathrm{PO}}$ and verification of $r_{\mathrm{RRM}} = \frac{\varepsilon\beta}{\gamma} < 1$.
• Prohibition 4 bans dogmatic probabilities ($0%$ or $100%$, enforcing Cromwell’s Rule $p \in [\varepsilon_{\text{floor}}, 1 - \varepsilon_{\text{floor}}]$) and bans hiding failed trials in a file drawer (requiring $K \ge 1$, e-process $E_t$, $\text{registered} = \text{used} + \text{unused}$, and out-of-sample CORP-Murphy decomposition).

7. The Five Boundary Invariants ($\Phi_1$ to $\Phi_5$)

Learning Objectives. By the end of this chapter, you will be able to state and apply the Five Boundary Invariants ($\Phi_1$–$\Phi_5$) that guard every Epistemological Card: ($\Phi_1$) Simulability and the Generative Null Model; ($\Phi_2$) The True Independent Unit, Pseudoreplication, Moulton-Campbell Unequal-Cluster Correction ($\tilde{m}$), and Tail-Exceedance Design Effect ($\mathrm{DEFF}_p$); ($\Phi_3$) Severe Testing, Error Taxonomy (Types I, II, III, S, M), Missingness, and SHA-256 Pre-Registration; ($\Phi_4$) Economic Scope, Alexandra Chouldechova’s Algebraic Fairness Trilemma, and the Automatic Exit Clause; and ($\Phi_5$) Question Resolution Alignment.

Step 1 — Intuition and the Real-World Paradox

Five Hundred Fish in Two Tanks, and One Hundred Coin Tossers

In 1984, ecologist Stuart Hurlbert published a famous review of biological experiments that shocked the scientific community. Suppose a researcher wants to test whether a new water additive makes trout grow faster. She places $250$ trout into Tank A (with the additive) and $250$ trout into Tank B (without the additive). Six months later, she weighs all $500$ fish, runs a two-sample $t$-test with sample size $n = 500$ ($498$ degrees of freedom), and publishes a tiny $p$-value ($p = 0.0001$).

What is wrong with her calculation? If Tank A happened to sit two meters closer to the window, or had a slightly warmer heater, or had a single dominant fish that stressed the others, all $250$ fish in Tank A shared that exact same tank environment! Measuring $250$ fish inside one tank does not give you $250$ independent experiments on the additive; it gives you a very precise measurement of one tank. The true independent unit of the experiment is the tank ($n_{\text{true}} = 2$), not the fish ($n_{\text{nominal}} = 500$). Hurlbert named this ubiquitous error pseudoreplication.

The exact same illusion happens every day in data science:

• In a hospital dataset of $50\text{,}000$ hourly vital-sign readings taken from $400$ patients, the hourly readings of the same patient are not independent—the patient (or the hospital ward) is the cluster!
• In bank_calls.csv, there are $n = 27\text{,}716$ five-minute arrival windows recorded across $164$ working days. If a promotional campaign or a Monday morning surge hits the bank, all $169$ five-minute windows of that day surge together. Treating $n = 27\text{,}716$ as the independent sample size understates the tail variance by $28.26$-fold!

Now consider a second paradox: the Hot Hand and the Forgotten Null Model ($\Phi_1, \Phi_3$). Ask $100$ people in an auditorium to toss a fair coin $20$ times each and write down their longest streak of consecutive Heads. Even though no one has “coin-tossing talent,” in $100%$ of simulated auditoriums someone will toss at least $6$ Heads in a row, and the longest streak in the room will average $9.5$ consecutive Heads! If a journalist interviews only the winner after the fact, tomorrow’s headline announces a miracle. Even more subtly, when Joshua Miller and Adam Sanjurjo (2018) wrote down the exact finite-sample generative null model for basketball shooting streaks, they discovered that in $3$ tosses of a fair coin, the average proportion of Heads immediately following a Head across sequences is not $\frac{1}{2} = 0.50$, but $\frac{5}{12} \approx 0.4167$! For thirty years, psychologists had compared basketball players against $0.50$ instead of simulating the actual null model on a computer.

To prevent these errors from ever entering production, the Stochology Protocol enforces Five Boundary Invariants ($\Phi_1$ to $\Phi_5$) as a strict boolean product $\Phi = \prod_{j=1}^5 \Phi_j$: if even one invariant fails, the gate drops to $0$ and blocks the claim.

Step 2 — Foundations and Mathematical Formalization

Overview of the Five Boundary Invariants

7.1 Invariant $\Phi_1$ — Simulability and the Generative Null Model

Why must every Epistemological Card declare both seed_and_environment (seed = 2026, SplitMix64) and an executable null_model before fitting parameters?

1. Defeating Denominator Illusions: As the Miller-Sanjurjo hot-hand discovery proved, intuitive mental guesses about “what pure chance looks like” under complex stopping rules, sliding windows, or cluster structures are frequently biased. Writing an executable null generator in code and running it with seed = 2026 reveals the true distribution of the test statistic when the claim is false.
2. Synthetic Injection Recovery: Before trusting an estimator on messy real data where the truth is unknown, $\Phi_1$ requires knowing that the estimator can recover a known parameter $\theta_{\text{true}}$ injected into simulated data (formalized via Simulation-Based Calibration in Chapter 9).

7.2 Invariant $\Phi_2$ — The Independent Unit, Moulton-Campbell Correction, and Tail Exceedance

Step-by-Step Derivation: From Intraclass Correlation to Tail Exceedance $n_{\mathrm{eff}}(p)$

Suppose our dataset contains $n = \sum_{j=1}^C m_j$ elementary observations grouped into $C$ clusters (for instance, $C = 164$ days in bank_calls.csv, each containing $m_j$ five-minute intervals, or $C$ hospitals each containing $m_j$ patients).

Inside cluster $j$, any two observations share a common cluster shock, inducing an intraclass correlation coefficient (ICC) $\rho \in [0, 1]$.

1. Equal Cluster Sizes (Leslie Kish’s Classic Formula, 1965): If every cluster has the exact same size $\bar{m} = n / C$, the variance of the sample mean is inflated relative to simple random sampling by the Design Effect ($\mathrm{DEFF}$): $$\mathrm{DEFF}_{\text{Kish}} = 1 + (\bar{m} - 1)\rho$$

2. Unequal Cluster Sizes (Moulton 1986 & Campbell et al. 2001): In the real world, clusters are rarely equal in size: one hospital treats $400$ patients while a rural clinic treats $15$; one turbulent storm system has $80$ track points while a short storm has $12$. When cluster sizes $m_j$ vary with coefficient of variation $\mathrm{CV}(m_j) = \frac{\mathrm{sd}(m_j)}{\bar{m}}$, the larger clusters dominate the sum of squared errors! Brent Moulton and Mike Campbell proved that the average cluster size $\bar{m}$ in the design effect must be replaced by the effective cluster size $\tilde{m}$:

   $$\tilde{m} = \frac{\sum_{j=1}^C m_j^2}{\sum_{j=1}^C m_j} = \bar{m}\Bigl(1 + \mathrm{CV}^2(m_j)\Bigr) \ge \bar{m}$$

   Look at what happens when cluster sizes are skewed: if $\bar{m} = 59.59$ and $\mathrm{CV}(m_j) \approx 1.0$, then $\tilde{m} = 119.05$—doubling the cluster multiplier before we even multiply by $\rho$!

3. Threshold Exceedance ICC ($\rho_I(p)$) in the Tails: Standard textbooks compute $\rho$ on the mean of $Y$. Yet operational decisions (staffing for peak call surges, evacuating for category-2 hurricane winds, holding flights during severe delays) depend on tail quantiles $q_p$ (such as $p = 0.90$ or $p = 0.95$). Even when everyday fluctuations have weak correlation across a day, extreme tail events cluster fiercely inside surge days! Therefore, ExceedanceDesignEffect (crates/stochology-core/src/invariants.rs) defines the binary tail-exceedance indicator $I_{ij}(p) = \mathbb{I}\lbrace Y_{ij} > q_p \rbrace$ (which has variance $p(1-p)$) and computes the ANOVA Threshold Exceedance ICC ($\rho_I(p)$) across the $C$ clusters:

   $$\mathrm{DEFF}_{\text{exceedance}}(p) = 1 + (\tilde{m} - 1) \rho_I(p), \qquad n_{\mathrm{eff}}(p) = \frac{n}{1 + (\tilde{m} - 1) \rho_I(p)}$$

   Let us check the numbers on bank_calls.csv ($n = 27\text{,}716$ five-minute windows across $C = 164$ days, $\tilde{m} = 169.00$):

   • At the $90\text{th}$ percentile ($p = 0.90$), the tail-exceedance ICC is $\rho_I(0.90) = 0.1623$.
   • The resulting design effect is $\mathrm{DEFF}(0.90) = 1 + (169 - 1) \times 0.1623 = 28.26$.
   • Consequently, the true effective sample size for tail staffing decisions is not $27\text{,}716$, but $n_{\mathrm{eff}}(0.90) = \frac{27\text{,}716}{28.26} = 980.7$! Any confidence interval computed on $n = 27\text{,}716$ is more than five times too narrow (--defect moulton).
   • Furthermore, ExceedanceDesignEffect::profile_across_quantiles profiles $n_{\mathrm{eff}}(p)$ across multiple quantiles simultaneously ($p \in \lbrace 0.50, 0.90, 0.99 \rbrace$), revealing on bank_calls.csv how effective sample size collapses from the median ($n_{\mathrm{eff}}(0.50) = 9\text{,}239$) into the surge tail ($n_{\mathrm{eff}}(0.90) = 981$, $n_{\mathrm{eff}}(0.99) = 1\text{,}308$).

The Operational Weighting Gap (The Inspection Paradox)

Invariant $\Phi_2$ also audits a cousin of cluster correlation (OperationalWeightingGap): who are you averaging over—the calendar day or the arriving customer? Remember the health clinic from Chapter 1: on calm days, $5$ patients/hour arrive and wait $3.6\text{ min}$; on surge days, $11$ patients/hour arrive and wait $55\text{ min}$.

• Averaged by day, calm and surge days weigh $50%$ each.
• Averaged by patient, $\frac{11}{5 + 11} = 68.75%$ of all human beings arrive on the surge day! This is the Inspection Paradox (length-biased sampling): sampling by arriving user always weights high-volume clusters by $m_j / \bar{m}$, opening a positive gap whenever cluster outcome $Y_j$ correlates with cluster volume $m_j$.

7.3 Invariant $\Phi_3$ — Severe Testing, Error Taxonomy, Missingness, and Pre-Registration

Deborah Mayo’s Severity Principle and the Five Types of Statistical Error

Philosopher of statistics Deborah Mayo formulated the foundational criterion that distinguishes a genuine empirical test from a hollow confirmation ritual:

The Severity Principle: Data $x_0$ provide genuine evidence for a claim $H$ only if $H$ passes a test $T$ that had a very high probability of refuting $H$ if $H$ were false.

If a bridge inspector tests whether a steel cable can support a $40$-ton truck by placing a $2$-kilogram brick on it and announcing “The cable did not snap! Hypothesis confirmed!”, the cable passed a test of zero severity.

To audit severity comprehensively, Stochology expands the textbook Neyman-Pearson error table (Type I and Type II) to five distinct statistical failure modes:

To seal $\Phi_3$ cryptographically, every Epistemological Card must carry:

1. An explicit Rubin missingness classification (MCAR, MAR, or MNAR) paired with Meng’s Identity and Manski bounds;
2. A declared rung on Pearl’s Causal Ladder (1-See, 2-Act, or 3-Imagine) alongside its identification_strategy and explicit untestable_assumption (remembering Nancy Cartwright’s dictum: “No causes in, no causes out”);
3. A 64-character lowercase hexadecimal SHA-256 pre-registration digest (preregistration_hash, verified in pure Rust by stochology_core::sha256 under FIPS 180-4) sealing the pre-analysis design payload before the test vault is opened.

7.4 Invariant $\Phi_4$ — Scope, Algorithmic Fairness (Chouldechova’s Trilemma), and the Exit Clause

Step-by-Step Derivation of Alexandra Chouldechova’s (2017) Impossibility Identity

Whenever a model triggers consequential actions across demographic, geographic, or institutional groups $g \in \lbrace A, B \rbrace$ (such as pretrial detention, loan approval, medical triage, or storm evacuation), committees naturally ask that the algorithm satisfy three fairness properties simultaneously:

1. Predictive Parity (Equal $\mathrm{PPV}$): When the model raises an alarm ($S = 1$), the probability that the person truly has the outcome ($Y = 1$) is the same in both groups: $\mathrm{PPV}_A = \mathrm{PPV}_B$, where $\mathrm{PPV}_g = P(Y = 1 \mid S = 1, G = g)$.
2. Equal False Negative Rate (Equal $\mathrm{FNR}$): True cases have the same probability of being missed in both groups: $\mathrm{FNR}_A = \mathrm{FNR}_B$, where $\mathrm{FNR}_g = P(S = 0 \mid Y = 1, G = g)$.
3. Equal False Positive Rate (Equal $\mathrm{FPR}$): Innocent or event-free individuals have the same probability of suffering a false alarm in both groups: $\mathrm{FPR}_A = \mathrm{FPR}_B$, where $\mathrm{FPR}_g = P(S = 1 \mid Y = 0, G = g)$.

In 2017, statistician Alexandra Chouldechova (and independently Jon Kleinberg, Sendhil Mullainathan, and Manish Raghavan) proved a stunning mathematical fact: this is not an engineering shortcoming that a cleverer neural network can fix; it is an exact algebraic impossibility whenever the two groups have different base rates ($p_A \neq p_B$)!

Let us derive Chouldechova’s Identity in three lines directly from Bayes’ rule. For any group $g$ with base rate $p_g = P(Y = 1 \mid G = g) \in (0, 1)$, write Bayes’ rule for $\mathrm{PPV}_g$:

$$\mathrm{PPV}_g = \frac{p_g (1 - \mathrm{FNR}_g)}{p_g (1 - \mathrm{FNR}_g) + (1 - p_g) \mathrm{FPR}_g}$$

Multiply both sides by the denominator and solve for $\mathrm{FPR}_g$:

$$\mathrm{FPR}_g = \frac{p_g}{1 - p_g} \frac{1 - \mathrm{PPV}_g}{\mathrm{PPV}_g} (1 - \mathrm{FNR}_g)$$

Look at that exact algebraic equation (ChouldechovaAudit in crates/stochology-core/src/invariants.rs):

• Suppose you force Predictive Parity ($\mathrm{PPV}_A = \mathrm{PPV}_B$) and Equal Opportunity ($\mathrm{FNR}_A = \mathrm{FNR}_B$).
• Then the second and third factors on the right-hand side are identical for Group A and Group B!
• Dividing $\mathrm{FPR}_A$ by $\mathrm{FPR}_B$ immediately yields:

$$\frac{\mathrm{FPR}_A}{\mathrm{FPR}_B} = \frac{p_A / (1 - p_A)}{p_B / (1 - p_B)}$$

The ratio of false positive rates is locked algebraically to the ratio of prior base-rate odds! In toronto_arrests.csv ($n = 5\text{,}226$ police arrest records), two demographic strata exhibit empirical base rates $p_A = 0.3926$ and $p_B = 0.1119$. If a classifier equalizes $\mathrm{PPV} = 0.65$ and $\mathrm{FNR} = 0.25$ across both groups, Chouldechova’s identity forces $\mathrm{FPR}_A = 0.2610$ versus $\mathrm{FPR}_B = 0.0509$—meaning innocent members of Group A suffer false alarms at $5.13\times$ the rate of Group B!

Complementing Chouldechova’s binary threshold identity, Jon Kleinberg, Sendhil Mullainathan, and Manish Raghavan (2017) proved a continuous risk-score impossibility theorem (ChouldechovaAudit::kmr_continuous_impossibility_gap): for any perfectly calibrated continuous risk score $S \in (0, 1)$ ($\mathbb{E}[Y \mid S = s, G = g] = s$), the Law of Iterated Expectations locks the mean score of group $g$ to $\mathbb{E}[S \mid G = g] = p_g$, and if a non-perfect score additionally equalizes average score among negative cases ($\mathbb{E}[S \mid Y = 0, G = g]$) and positive cases ($\mathbb{E}[S \mid Y = 1, G = g]$), the Bernoulli variance ceiling $p_g(1 - p_g)$ forces an irreducible variance gap (KMR_var_gap = 0.0960 on toronto_arrests.csv) whenever $p_A \neq p_B$ and $p_A + p_B \neq 1$.

Because no algorithm can repeal Bayes’ theorem, Invariant $\Phi_4$ requires every Epistemological Card to:

1. Audit Chouldechova’s identity explicitly and declare who_pays_for_error (naming the human or institutional bearer of False Positives and False Negatives);
2. Declare an explicit scope_statement (where the model is forbidden from being applied);
3. Declare a machine-actionable numeric exit_clause (for instance: “Immediately suspend automated shift scheduling if $\mathrm{REL}_{\mathrm{CORP}} > 0.020$ or $\mathrm{RES}_{\mathrm{CORP}} < 0.025$ over a 10-business-day rolling window”).

7.5 Invariant $\Phi_5$ — Question Resolution Alignment

Finally, Invariant $\Phi_5$ (verify_resolution_phi5) guards the temporal and spatial scale of the data against the scale of the action.

Suppose a hospital director needs to staff nurses for 5-minute arrival surges on Tuesday mornings, or an emergency manager needs to issue 6-hour hurricane evacuation advisories, and an analyst hands them a regression fitted on annual or monthly averages ($R_0$). Monthly aggregation averages out the exact intra-day spikes that destroy the queue!

In crates/stochology-core/src/invariants.rs, every resolution level is mapped to an ordered scale: $$\text{Sub-Hourly / 5-Min } (4) > \text{Hourly / 6-Hr Synoptic / Shift } (3) > \text{Daily } (2) > \text{Weekly / Monthly / Annual } (1)$$

Invariant $\Phi_5$ enforces:

$$R_{\text{data}} \ge R_{\text{decision}}$$

Any attempt to answer a shift, hourly, or daily operational question with coarse monthly or annual aggregates is immediately blocked by Gate G5 (--defect phi5).

Step 3 — Auditable Laboratory in Rust and Exercises

Run Laboratory 4 from your terminal to see $\Phi_1$–$\Phi_5$, Moulton-Campbell tail-exceedance design effects, and Chouldechova’s fairness audit on real data:

cargo run --release --bin labs -- --invariants

=== LAB 4: INVARIANTS PHI1-PHI5, MOULTON-CAMPBELL, EXCEEDANCE, AND CHOULDECHOVA ===
  [Benchmarks Phi2] n=25028 -> m_bar=59.59, m_tilde=119.05, rho_I(0.90)=0.155, n_eff=1297.0 (naive Kish=2482.6) | n=500 -> n_eff=86.0 | var_amp=69.0x
  [Real Data: bank_calls.csv] n=27716, clusters=164, m_bar=169.00, m_tilde=169.00, rho_I(0.90)=0.1623, DEFF=28.26, n_eff(0.90)=980.7 (profile q50/q90/q99 n_eff=["9239", "981", "1308"])
  [Phi4: Chouldechova on toronto_arrests.csv] p_A=0.3926 vs p_B=0.1119 -> equalizing PPV=0.65 & FNR=0.25 forces FPR_A=0.2610 vs FPR_B=0.0509 (ratio=5.13x, KMR_var_gap=0.0960)

Notice how the three negative defect proofs verify the teeth of these invariants:

• cargo run --release --bin gates -- --defect phi5 injects a monthly aggregate dataset against a daily/shift decision and verifies that Gate G5 halts with exit code 1.
• cargo run --release --bin gates -- --defect moulton injects a pseudoreplicated card that ignores cluster inflation and verifies that Gate G2 halts with exit code 1.
• cargo run --release --bin gates -- --defect chouldechova injects a card claiming simultaneous equality of $\mathrm{FPR}, \mathrm{PPV}, \mathrm{FNR}$ under unequal base rates and verifies that Gate G4 halts with exit code 1.

Exercises

1. (Calculation — Moulton-Campbell $\Phi_2$) A retail chain collects $n = 10\text{,}000$ customer satisfaction scores across $C = 50$ stores. The mean cluster size is $\bar{m} = 200$, but because flagship stores are much larger than rural stores, the coefficient of variation of store sizes is $\mathrm{CV}(m_j) = 1.0$.
   • (a) Compute the Moulton-Campbell effective cluster size $\tilde{m} = \bar{m}(1 + \mathrm{CV}^2)$.
   • (b) If the threshold exceedance ICC at $p = 0.90$ is $\rho_I(0.90) = 0.10$, compute the Kish design effect (using $\bar{m}$), the Moulton-Campbell design effect (using $\tilde{m}$), and the true effective sample size $n_{\mathrm{eff}}(0.90)$.
2. (Calculation — Chouldechova’s Trilemma $\Phi_4$) In a medical triage algorithm, Group A has disease prevalence $p_A = 0.25$ and Group B has prevalence $p_B = 0.05$. If the triage score is calibrated so that $\mathrm{PPV}_A = \mathrm{PPV}_B = 0.50$ and $\mathrm{FNR}_A = \mathrm{FNR}_B = 0.20$, compute $\mathrm{FPR}_A$, $\mathrm{FPR}_B$, and the ratio $\mathrm{FPR}_A / \mathrm{FPR}_B$.
3. (Concept — Severity and Error Types $\Phi_3$) An analyst runs a noisy pilot study ($n = 20$) and finds that a new teaching method raises test scores by $+35%$ ($p = 0.048$). When the ministry of education rolls the method out to $50\text{,}000$ students, the true effect turns out to be $+2%$. Which of the five error types (Type I, Type II, Type III, Type S, Type M) did the pilot study commit, and why did conditioning on $p < 0.05$ in a small noisy sample guarantee it?
4. (Concept — Question Resolution $\Phi_5$) Why can an electric utility whose annual generation exceeds annual demand by $+25%$ still suffer rolling blackouts on a hot August afternoon? Which invariant blocks using annual totals to plan peaking turbine capacity?

Chapter Summary

• $\Phi_1$ (Simulability): Every claim requires seed = 2026 (SplitMix64) and an executable generative null model.
• $\Phi_2$ (Independent Unit): Discounts nominal sample size $n$ for unequal cluster sizes ($\tilde{m} = \bar{m}(1 + \mathrm{CV}^2)$) and tail clustering ($\rho_I(p)$), yielding $n_{\mathrm{eff}}(p) = \frac{n}{1 + (\tilde{m}-1)\rho_I(p)}$.
• $\Phi_3$ (Severe Testing & Missingness): Enforces Rubin’s missingness taxonomy, Meng’s Identity, Manski bounds, Pearl’s Causal Ladder rung, and a 64-hex SHA-256 pre-registration seal.
• $\Phi_4$ (Scope, Fairness & Exit): Audits Chouldechova’s algebraic identity $\mathrm{FPR}_g = \frac{p_g}{1-p_g}\frac{1-\mathrm{PPV}_g}{\mathrm{PPV}_g}(1-\mathrm{FNR}_g)$, names who pays for false positives and false negatives, bounds scope, and sets a numeric exit clause.
• $\Phi_5$ (Resolution Alignment): Blocks coarse temporal or spatial aggregates from answering fine-grained operational decisions ($R_{\text{data}} \ge R_{\text{decision}}$).

8. The Epistemological Card (EpistemologicalCard)

Learning Objectives. By the end of this chapter, you will be able to read, author, and audit a complete Epistemological Card (cards/*.yaml); explain why each of its five structured sections exists; trace the internal cross-field mathematical consistency checks enforced by EpistemologicalCard::audit(); and understand how the card replaces ambiguous prose reports with a self-verifying contract.

Step 1 — Intuition and the Real-World Paradox

Why Airline Pilots Use Checklists Instead of Essays

Before taking off in a modern commercial airliner, the captain and first officer do not sit in the cockpit and write an expressive literary essay about how confident they feel in the weather and the engines. They execute a structured pre-flight checklist:

• Fuel quantity and cross-feed valves: checked against flight plan.
• Flap setting and stabilizer trim: verified in green band.
• Engine failure abort speed ($V_1$): computed and called out explicitly.

Why did aviation adopt rigid checklists after the 1935 Boeing Model 299 crash? Because under cognitive load, time pressure, and institutional incentives, even brilliant experts skip uncomfortable checks when left to free-form narration.

An Epistemological Card (EpistemologicalCard in crates/stochology-core/src/card.rs) is the pre-flight checklist of quantitative science and decision-making. Every technical claim in the Stochology Protocol lives as a self-contained YAML document (cards/*.yaml) with contract_version: "1.0".

Crucially, an Epistemological Card is not a passive form where an analyst can type arbitrary numbers to make the parser happy. When EpistemologicalCard::audit() reads a card from disk, it acts as an adversarial mathematical auditor: it recomputes Jensen’s Gap, recomputes the Moulton-Campbell design effect, checks that the four variance-budget shares sum to $1.0$, verifies the CORP-Murphy PAV identity $\mathrm{BS} = \mathrm{REL}_{\mathrm{CORP}} - \mathrm{RES}_{\mathrm{CORP}} + \mathrm{UNC}_0$, checks the cost-loss threshold $p^{\ast} = \frac{C}{\eta L}$ against the recommended act (protect vs. do_not_protect), verifies that the modeler and adversarial verifier are distinct agents, and recomputes the SHA-256 cryptographic digest of the underlying CSV dataset on disk!

Step 2 — Anatomy and Mathematical Audit of the Five Sections

Every Epistemological Card begins with top-level routing metadata (contract_version, id, layer, uncertainty) followed by five mandatory sections:

Let us walk through each section and see the exact mathematical invariants it locks in place.

8.1 Section 1: decision_maker_question

decision_maker_question:
  who_decides: "Director of Retail Banking Operations (North American Call Center)"
  altered_action: "Schedule 18 overflow customer-service agents on high-load business days"
  question: "Does the calibrated daily probability of 5-minute call-arrival queue overload exceed the economic protection threshold p* = 0.080?"

• Why it exists (Defeating Type III Error and $\Phi_5$): A model that changes no concrete human or algorithmic action has an Expected Value of Perfect Information ($\mathrm{EVPI}$) of zero.
• What audit() enforces:
  1. who_decides and altered_action must be non-empty concrete declarations;
  2. question must be a genuine interrogative sentence ending with '?';
  3. The temporal/spatial resolution of question and altered_action is cross-checked against the resolution of the dataset under Invariant $\Phi_5$.

8.2 Section 2: epistemological_header

This section captures the physical and causal mechanics across Layers $L_1, L_2,$ and $L_3$:

1. generating_process: Explicit description of the physical data-generating mechanism in $L_1$ (for instance, inhomogeneous Poisson/negative-binomial customer arrivals or thermodynamic tropical cyclone intensification).
2. nonlinearity (Enforcing Prohibition 2): Reports all seven mandatory numbers of NonlinearSummary:
   • payoff_function, f_at_mean ($f(\mathbb{E}[X])$), mean_of_f ($\mathbb{E}[f(X)]$), jensen_gap ($\Delta_J$), median, q05, q95, and crps.
   • Audit Check: Verifies $|\Delta_J - (\mathbb{E}[f(X)] - f(\mathbb{E}[X]))| \le 10^{-3}$, strict quantile ordering $q_{05} < \text{median} < q_{95}$, and $\mathrm{CRPS} > 0$.
3. unit_and_margin (Enforcing Invariant $\Phi_2$): Reports:
   • independent_unit (e.g., "164 calendar business days" or "named Atlantic storm tracks"),
   • nominal_sample_size_n ($n$),
   • weighted_cluster_mean_m_tilde ($\tilde{m} = \bar{m}(1 + \mathrm{CV}^2)$),
   • threshold_exceedance_icc ($\rho_I(p)$),
   • effective_sample_size_n_eff ($n_{\mathrm{eff}}(p)$), and unit_margin_of_error.
   • Audit Check: Recomputes $\frac{n}{1 + (\tilde{m} - 1)\rho_I(p)}$ from the declared fields and blocks the card if effective_sample_size_n_eff deviates from the Moulton-Campbell formula!
4. noise_physics (Enforcing Lens 2 & Prohibition 3): Declares stochastic_regime (e.g., sub-exponential vs. Pareto infinite variance), absorbing_states (ruin or saturation barriers), and bridge_L3_L1_performativity (auditing $\theta_{\mathrm{PS}}, \theta_{\mathrm{PO}},$ and $r_{\mathrm{RRM}} < 1$).
5. causal_ladder (Enforcing Lens 4 & $\Phi_3$): Declares pearl_rung ("1-See", "2-Act", or "3-Imagine"), identification_strategy (e.g., multi-environment NILE/IRM invariance), and untestable_assumption (forcing the author to state openly what could break causal identification).

8.3 Section 3: uncertainty_budget_and_authorship

This section enforces honest accounting of where uncertainty comes from and who authored each part of the card:

1. variance_budget (Decomposition of Total Predictive Uncertainty): Splits predictive variance into four non-negative shares:
   • inputs (measurement and covariate noise in $L_1$),
   • parameters (finite-sample estimation variance in $L_2$),
   • covariance (cross-term dependence across clusters/factors),
   • structural_discrepancy_gp (the share absorbed by the anchored Kennedy-O’Hagan Gaussian Process $\delta(x)$).
   • Audit Check: The four shares must be non-negative, structural_discrepancy_gp must be strictly positive ($> 0$, acknowledging that no parametric model is structurally perfect), and their sum must equal unity: $$\text{inputs} + \text{parameters} + \text{covariance} + \text{structural_discrepancy_gp} = 1.0000$$
2. dominant_event (Cromwell’s Rule on Tail Risk): Names the single tail event carrying the largest share of expected loss, together with probability_p, base_rate_floor_epsilon ($\varepsilon_{\text{floor}}$), and cost_share, verifying $\varepsilon_{\text{floor}} \le p \le 1 - \varepsilon_{\text{floor}}$.
3. info_gap_robustness (Knightian Safeguard — Chapter 2): Declares critical_requirement_rc ($r_c$), robustness_horizon_alpha_hat ($\hat{\alpha} > 0$), opportuneness_horizon_beta_hat ($\hat{\beta} > 0$), and global_maximin_safeguard (requiring explicit verification of the global Wald floor outside $\mathcal{U}(\hat{\alpha}, \tilde{u})$).
4. field_authorship (Adversarial Cross-Authorship — Filter 4): Declares the identifiers of three distinct roles:
   • null_model (who designed the generative null benchmark),
   • decision_rule (who proposed the predictive model and action rule),
   • adversarial_reviewer (who audited the bridges and tried to break the card).
   • Audit Check: Enforces decision_rule != adversarial_reviewer and null_model != decision_rule so that no single agent grades their own homework.

8.4 Section 4: data_and_audit_contract

This section binds the YAML card to the physical bytes of the repository and closes the anti-p-hacking contract:

1. dataset_path and dataset_sha256: Points to the empirical CSV file in data/*.csv and records its 64-character lowercase hexadecimal SHA-256 hash. At runtime, stochology-cli computes the FIPS 180-4 SHA-256 digest of the file on disk and cross-checks it against both dataset_sha256 and data/SHA256SUMS.
2. missingness_mechanism and seed_and_environment: Must declare MCAR, MAR, or MNAR (with Meng/Manski justification) and must include seed = 2026 and SplitMix64.
3. null_model and preregistration_hash: Describes the executable null model and provides the 64-character lowercase hexadecimal SHA-256 pre-registration seal.
4. attempt_counter_K and e_process_multiplicity (Prohibition 4): Requires $K \ge 1$ and $E_t / K \ge 1.0$.
5. murphy_corp_decomposition (Lens 5): Reports total_score_brier_or_crps ($\mathrm{BS}$), miscalibration_REL_MCB ($\mathrm{REL}_{\mathrm{CORP}}$), resolution_RES_DSC ($\mathrm{RES}_{\mathrm{CORP}}$), and base_uncertainty_UNC0 ($\mathrm{UNC}_0$).
   • Audit Check: Verifies the exact PAV identity closure: $$\bigl|\mathrm{BS} - (\mathrm{REL}_{\mathrm{CORP}} - \mathrm{RES}_{\mathrm{CORP}} + \mathrm{UNC}_0)\bigr| \le 10^{-4}$$
6. findings (registered, used, unused):
   • Audit Check: Enforces $\text{registered} = \text{used} + \text{unused}$ with $\text{registered} \ge 1$ and $\text{used} \ge 1$.

8.5 Section 5: decision_rule_and_scope

The final section governs Bridge $L_2 \to L_3$ and Invariant $\Phi_4$:

1. Cost-Loss Parameters and Threshold Verification: Declares event_probability_p ($p$), base_rate_floor_epsilon ($\varepsilon_{\text{floor}}$), protection_cost_C ($C > 0$), event_loss_L ($L > 0$), mitigation_efficacy_eta ($\eta \in (0, 1]$), critical_threshold_p_star ($p^{\ast}$), and declared_act ("protect" or "do_not_protect").
   • Audit Check: Recomputes $\frac{C}{\eta L}$ and verifies: $$\left|p^{\ast} - \frac{C}{\eta L}\right| \le 10^{-4}$$ and verifies that declared_act is "protect" if and only if $p > p^{\ast}$ (and "do_not_protect" if and only if $p \le p^{\ast}$)!
2. scope_statement, who_pays_for_error, and exit_clause: Enforces explicit operational boundaries, Chouldechova error-bearer attribution, and a numeric circuit-breaker exit rule.

Step 3 — Auditable Laboratory in Rust and Exercises

In crates/stochology-core/src/card.rs, EpistemologicalCard::from_yaml_str parses the YAML card using a zero-dependency parser written in pure Rust, and EpistemologicalCard::audit() runs all cross-field algebraic checks. You can see all three canonical cards (card_01, card_02, card_03) audited against their real CSV datasets by running:

cargo run --release --bin labs -- --siga
cargo run --release --bin gates

Exercises

1. (Calculation — Auditing a Card by Hand) Suppose an analyst submits a YAML card with protection_cost_C: 15000.0, event_loss_L: 250000.0, mitigation_efficacy_eta: 0.75, critical_threshold_p_star: 0.08000, event_probability_p: 0.06500, and declared_act: "protect".
   • (a) Verify whether critical_threshold_p_star matches $\frac{C}{\eta L}$.
   • (b) Will EpistemologicalCard::audit() approve or reject declared_act: "protect"? Why?
2. (Calculation — Auditing CORP-Murphy Closure) A card declares total_score_brier_or_crps: 0.03210, miscalibration_REL_MCB: 0.00578, resolution_RES_DSC: 0.06183, and base_uncertainty_UNC0: 0.08815 (the exact numbers from card_01_atlantic_storms_evacuation.yaml). Check whether $\mathrm{REL}_{\mathrm{CORP}} - \mathrm{RES}_{\mathrm{CORP}} + \mathrm{UNC}_0$ equals $\mathrm{BS}$.
3. (Concept — Adversarial Cross-Authorship) Why does field_authorship require null_model, decision_rule, and adversarial_reviewer to be distinct agents? What cognitive and institutional bias on Layer $L_3$ does this rule prevent?

Chapter Summary

• The Epistemological Card (EpistemologicalCard) is the universal unit of communication in the Stochology Protocol (contract_version: "1.0").
• Its five sections (decision_maker_question, epistemological_header, uncertainty_budget_and_authorship, data_and_audit_contract, decision_rule_and_scope) enforce Prohibitions 1–4 and Invariants $\Phi_1$–$\Phi_5$.
• EpistemologicalCard::audit() verifies internal algebraic closure across Jensen’s Gap, Moulton-Campbell $n_{\mathrm{eff}}(p)$, variance-budget unity, CORP-Murphy PAV decomposition, findings conservation, SHA-256 integrity, and the cost-loss decision rule $p \gtrless p^{\ast} = \frac{C}{\eta L}$.

9. Eliminatory Funnel and the 8-Step SIGA Roadmap

Learning Objectives. By the end of this chapter, you will be able to evaluate a proposed study through the 4 Eliminatory Filters (stochology_siga::funnel), understanding why each filter short-circuits doomed projects before a model is ever fitted; explain Simulation-Based Calibration (SBC) and the Sheffield Elicitation Framework (SHELF); execute the 8-Step SIGA Operational Roadmap (stochology_siga::roadmap); derive Anytime-Valid Sequential Evidence Processes (e-processes) and Ville’s Inequality ($P_{H_0}(\sup_t E_t \ge 1/\alpha) \le \alpha$); and translate model outputs into Gigerenzer Natural-Frequency Executive Memoranda.

Step 1 — Intuition and the Real-World Paradox

The Two-Million-Dollar Model That Could Never Change a Decision

A regional hospital system hires a data-science team for USD 500,000 to build a machine-learning model predicting whether patients admitted with severe fever have a bacterial infection.

Suppose treating a patient with broad-spectrum antibiotics costs $C = USD 100$, while failing to treat a true bacterial infection costs $L = USD 50\text{,}000$ in intensive-care complications (with treatment efficacy $\eta = 1.0$). By the Cost-Loss Rule of Chapter 3, a physician should administer antibiotics whenever the probability of bacterial infection exceeds:

$$p^{\ast} = \frac{C}{\eta L} = \frac{100}{50\text{,}000} = 0.002 \quad (0.2%)$$

Now look at the clinical reality: any patient arriving at the hospital with severe fever already has a baseline probability of bacterial infection of at least $15%$—and even if the new USD 500,000 machine-learning test comes back negative, the patient’s posterior probability only drops from $15%$ to $3%$, which is still fifteen times higher than the $0.2%$ threshold $p^{\ast}$!

In other words, whether the expensive new model says “positive” or “negative,” the doctor must administer antibiotics either way. The Expected Value of Sample Information is zero, and the USD 500,000 project was dead on arrival before a single line of code was written.

In most organizations, nobody checks whether a model can alter an action, whether the true cluster sample size $n_{\mathrm{eff}}(p)$ is large enough, or whether the inference software can even recover known synthetic parameters until after months of computing have been spent.

To reverse this waste, crates/stochology-siga enforces two sequential operational instruments:

1. The 4-Filter Eliminatory Funnel (funnel.rs): A strict short-circuiting gate that kills economically, causally, or computationally invalid projects upfront.
2. The 8-Step SIGA Operational Roadmap (roadmap.rs): A disciplined execution cycle (Survey, Interrogate, Generate, Act) backed by anytime-valid e-processes and natural-frequency decision trees.

Step 2 — Foundations and Mathematical Formalization

9.1 The 4 Eliminatory Filters (stochology_siga::funnel)

The four filters are evaluated in strict sequence (Filter 1 -> Filter 2 -> Filter 3 -> Filter 4). If Filter 1 fails, Filters 2–4 are never even run (short_circuited = true):

Filter 1 — Economic Viability and Question Resolution ($\Phi_5$)

Filter 1 asks three elementary questions before touching data:

1. Is the critical cost-loss threshold non-degenerate: $p^{\ast} = \frac{C}{\eta L} \in (0, 1)$?
2. Does the Expected Value of Perfect Information ($\mathrm{EVPI}$) strictly exceed the total engineering, data-acquisition, and operational cost of the study ($\mathrm{EVPI} > C_{\text{total}} \ge 0$)?
3. Does the temporal/spatial resolution of the dataset satisfy Invariant $\Phi_5$ ($R_{\text{data}} \ge R_{\text{decision}}$)?

Filter 2 — Cluster Independence ($\Phi_2$) and Causal Hygiene

Filter 2 audits Bridge $L_1 \to L_2$ and Lens 4:

1. Using the Moulton-Campbell unequal-cluster formula $\tilde{m} = \bar{m}(1 + \mathrm{CV}^2)$ and the tail-exceedance intraclass correlation $\rho_I(p)$, is the effective sample size large enough to support inference ($n_{\mathrm{eff}}(p) = \frac{n}{1 + (\tilde{m}-1)\rho_I(p)} \ge n_{\min}$)?
2. Has the analyst mapped the Markov Blanket of the target variable (its direct causal parents, direct causal children, and co-parents), and verified that zero conditioning occurs on a Berkson collider (conditioned_on_collider == false)?

Filter 3 — Simulation-Based Calibration (SBC) and SHELF Prior Elicitation

Even if the data are clean and the causal graph is sound, how do we know that our Bayesian or probabilistic estimation algorithm does not have a subtle coding bug or biased approximation?

In 2018, Sean Talts, Michael Betancourt, Daniel Simpson, Aki Vehtari, and Andrew Gelman formalized Simulation-Based Calibration (SBC) based on a beautiful self-consistency identity of probability theory:

1. Draw a true parameter $\tilde{\theta} \sim \pi(\theta)$ from the prior distribution.
2. Simulate a synthetic dataset $\tilde{y} \sim p(y \mid \tilde{\theta})$ using the generative model ($\Phi_1$).
3. Run your inference algorithm on $\tilde{y}$ to draw $M$ posterior samples $\theta_1, \dots, \theta_M \sim p(\theta \mid \tilde{y})$.
4. Count the rank statistic $r(\lbrace \theta_m \rbrace, \tilde{\theta}) = \sum_{m=1}^M \mathbb{I}\lbrace \theta_m < \tilde{\theta} \rbrace \in \lbrace 0, 1, \dots, M \rbrace$.

Theorem (Talts et al., 2018): If the posterior inference algorithm is mathematically exact, the rank statistic $r$ is distributed strictly uniformly across $\lbrace 0, 1, \dots, M \rbrace$!

• If your algorithm is overconfident (posterior intervals too narrow), the true $\tilde{\theta}$ falls in the extremes too often, creating a $\cup$-shaped rank histogram.
• If your algorithm is underconfident (intervals too wide), the rank histogram heaps up in the middle ($\cap$-shaped).
• If your algorithm is biased, the rank histogram tilts to the left or right.

Filter 3 bins the SBC ranks across $B$ bins and computes Pearson’s $\chi^2 = \sum_{b=1}^B \frac{(O_b - E_b)^2}{E_b}$, requiring $\chi^2 \le \chi^2_{\text{crit}}$. Simultaneously, Filter 3 validates expert prior elicitation under Anthony O’Hagan’s Sheffield Elicitation Framework (SHELF), requiring strict physical ordering of the elicited quartiles:

$$L_{\text{phys}} < q_{25} < q_{50} < q_{75} < U_{\text{phys}}$$

Once the elicited quartiles $(q_{25}, q_{50}, q_{75})$ are verified, fit_shelf_beta_prior (crates/stochology-siga/src/funnel.rs) fits a continuous conjugate $\mathrm{Beta}(\hat{\alpha}, \hat{\beta})$ prior by minimizing the cumulative distribution RMSE $\sqrt{\frac{1}{3}\bigl[(I_{q_{25}}(\alpha, \beta) - 0.25)^2 + (I_{q_{50}}(\alpha, \beta) - 0.50)^2 + (I_{q_{75}}(\alpha, \beta) - 0.75)^2\bigr]}$, where the regularized incomplete Beta function $I_x(\alpha, \beta)$ is evaluated to machine precision in pure Rust via Lentz’s (1976) continued-fraction algorithm (regularized_incomplete_beta) and Lanczos’s $g=7$ log-Gamma approximation (ln_gamma_lanczos).

Filter 4 — Cryptographic Pre-Registration, Cross-Authorship, and Exit Clause

Finally, Filter 4 verifies:

1. A valid 64-character lowercase hexadecimal SHA-256 pre-registration seal;
2. Independent cross-authorship (modeler_id != verifier_id);
3. A non-empty, machine-actionable numeric exit clause.

9.2 The 8-Step SIGA Operational Roadmap (stochology_siga::roadmap)

Once a project survives all four filters of the Eliminatory Funnel, it executes the 8-Step SIGA Roadmap across four phases (S — Survey, I — Interrogate, G — Generate, A — Act):

9.3 Anytime-Valid Sequential Evidence (e-processes) and Ville’s Inequality

Foundations: Why Classical $p$-Values Break Under Optional Stopping

In a classical fixed-horizon Neyman-Pearson test, you must fix the sample size $n$ in advance and look at the data only once at the end. What happens if a researcher or an automated monitoring dashboard computes a classical $p$-value every day as new data arrive and stops the moment $p_t < 0.05$?

By the Law of the Iterated Logarithm, even under the null hypothesis $H_0$ (where the true effect is zero!), a standardized random walk crosses the fixed $1.96$ threshold infinitely often as $t \to \infty$! Peeking continuously at a classical $p$-value inflates the Type I false-positive rate all the way to $100%$.

How e-values, Test Martingales, and Ville’s Inequality Solve Optional Stopping

Modern sequential statistics (Glenn Shafer, Peter Grünwald, Aaditya Ramdas, and Vladimir Vovk) replaces fragile $p$-values with evidence values (e-values) and sequential e-processes (EProcess in crates/stochology-siga/src/roadmap.rs).

An e-variable is any non-negative random variable $L_i \ge 0$ whose expected value under the null hypothesis $H_0$ is at most $1$:

$$\mathbb{E}_{H_0}[L_i \mid \mathcal{F}_{i-1}] \le 1$$

For example, the likelihood ratio $L_i = \frac{p_1(Y_i)}{p_0(Y_i)}$ between the alternative model $p_1$ and the null model $p_0$ automatically satisfies $\mathbb{E}_{p_0}\left[\frac{p_1(Y_i)}{p_0(Y_i)}\right] = \sum_y p_0(y)\frac{p_1(y)}{p_0(y)} = \sum_y p_1(y) = 1$!

Think of $L_i$ as a fair betting multiplier against the null hypothesis: you start with USD 1.00 of initial capital ($E_0 = 1$), and at each step $i = 1, \dots, t$ your capital multiplies by $L_i$:

$$E_t \triangleq \prod_{i=1}^t L_i$$

Because $E_t$ is a non-negative test martingale (or supermartingale) under $H_0$, Jean Ville’s (1939) Maximal Inequality guarantees that the probability of your capital ever reaching $1/\alpha$ at any stopping time $t$—no matter how often you peek at the dashboard!—is at most $\alpha$:

$$P_{H_0}\left(\sup_{t \ge 1} E_t \ge \frac{1}{\alpha}\right) \le \alpha$$

Even better: if an analyst tried $K \ge 1$ candidate specifications (Prohibition 4), dividing the cumulative evidence by $K$ preserves anytime validity across all $K$ attempts:

$$\frac{E_t}{K} \ge \frac{1}{\alpha}$$

At $\alpha = 0.05$, reaching $E_t / K \ge 20$ means the data have multiplied initial skeptical capital at least twenty-fold after paying the full multiplicity tax $K$.

Non-Parametric GRAPA / Kelly Betting Martingales (EvidenceProcess::from_grapa_betting)

What if we want to construct an anytime-valid e-process from bounded zero-mean under-$H_0$ payoff differences $X_1, \dots, X_t$ without assuming a parametric likelihood ratio $p_1/p_0$? Following Peter Grünwald, Rianne de Heide, and Wouter Koolen (2024, Safe Testing) and Ian Waudby-Smith and Aaditya Ramdas (2024), EvidenceProcess::from_grapa_betting constructs a predictable Growth-Rate Adaptive (GRAPA / Kelly) betting martingale:

$$E_t = \prod_{i=1}^t \bigl(1 + \lambda_i X_i\bigr), \qquad \lambda_i = \mathrm{clamp}\left(\frac{\hat{\mu}_{i-1}}{\hat{\sigma}_{i-1}^2 + \hat{\mu}_{i-1}^2},\ -0.5,\ 0.5\right)$$

Because the predictable stake $\lambda_i$ depends strictly on past observations $\mathcal{F}_{i-1} = \sigma(X_1, \dots, X_{i-1})$, $\mathbb{E}_{H_0}[1 + \lambda_i X_i \mid \mathcal{F}_{i-1}] = 1 + \lambda_i \mathbb{E}_{H_0}[X_i \mid \mathcal{F}_{i-1}] = 1$, guaranteeing exact finite-sample Ville validity under arbitrary optional stopping while maximizing asymptotic log-capital growth under the alternative!

Step 3 — Auditable Laboratory in Rust and Exercises

Run Laboratory 5 from your terminal to watch all three canonical YAML cards pass through the 4-Filter Funnel, execute the 8-Step SIGA Roadmap, compute their cumulative e-processes $E_{30}$, and emit their integer Gigerenzer Natural-Frequency Executive Memoranda:

cargo run --release --bin labs -- --siga

=== LAB 5: 4-FILTER ELIMINATORY FUNNEL AND 8-STEP SIGA ROADMAP ===
  [SIGA cards/card_01_atlantic_storms_evacuation.yaml] dataset=data/atlantic_storms.csv, EVPI=257928.0, p_null=0.0050 (unclamped), chi2_SBC=0.85, E_30=324171.1, steps_1_to_8=[true, true, true, true, true, true, true, true], approved=true
    Out of every 1000 independent units, 98 experience the critical event (of which 98 trigger the alarm at threshold p*=0.12000 and 0 are missed), while 902 do not experience the event (of which 156 trigger a false alarm and 746 remain clear). Positive predictive frequency: 98 out of 254 alarms. Action: do_not_protect. Exit clause: Immediately suspend automated synoptic advisory if REL_CORP > 0.015 or RES_CORP < 0.020 over a 14-day rolling window.
  [SIGA cards/card_02_bank_queue_staffing.yaml] dataset=data/bank_calls.csv, EVPI=216213.6, p_null=0.0050 (unclamped), chi2_SBC=4.65, E_30=2786.4, steps_1_to_8=[true, true, true, true, true, true, true, true], approved=true
    Out of every 1000 independent units, 99 experience the critical event (of which 99 trigger the alarm at threshold p*=0.08000 and 0 are missed), while 901 do not experience the event (of which 426 trigger a false alarm and 475 remain clear). Positive predictive frequency: 99 out of 525 alarms. Action: protect. Exit clause: Immediately suspend automated shift scheduling if REL_CORP > 0.020 or RES_CORP < 0.025 over a 10-business-day rolling window.
  [SIGA cards/card_03_nyc_flights_holding.yaml] dataset=data/nyc_flights_2013.csv, EVPI=135285.0, p_null=0.0050 (unclamped), chi2_SBC=3.00, E_30=32.8, steps_1_to_8=[true, true, true, true, true, true, true, true], approved=true
    Out of every 1000 independent units, 98 experience the critical event (of which 71 trigger the alarm at threshold p*=0.06000 and 27 are missed), while 902 do not experience the event (of which 277 trigger a false alarm and 625 remain clear). Positive predictive frequency: 71 out of 348 alarms. Action: protect. Exit clause: Immediately revert to conservative Wald Maximin ground-delay policy if REL_CORP > 0.012 or RES_CORP < 0.005 or RRM radius >= 0.85 over a 7-day window.
  [SHELF Beta Fit & GRAPA Betting Martingale] SHELF(0.02,0.05,0.09)->Beta(alpha=1.05, beta=15.03, CDF_RMSE=0.0111) | GRAPA E_35=946.42 (rejects_H0=true)

Exercises

1. (Calculation — Filter 1 Short-Circuiting) A logistics company proposes spending $C_{\text{total}} = USD 80\text{,}000$ to build a model predicting late port deliveries. Each late delivery causes loss $L = USD 10\text{,}000$, expedited air-freight protection costs $C = USD 2\text{,}000$ with efficacy $\eta = 1.0$, and across the year $100$ shipments are made with base rate $p_0 = 0.05$ ($5$ late shipments per year). Even if the model were an infallible oracle, what is the maximum annual savings ($\mathrm{EVPI} \times 100$) it could generate? Will Filter 1 approve or kill the USD 80,000 project?
2. (Concept — Simulation-Based Calibration) Suppose you run SBC on a new Bayesian inference algorithm and observe that out of $1\text{,}000$ synthetic runs, the true parameter $\tilde{\theta}$ falls below the $10\text{th}$ percentile of the posterior $250$ times and above the $90\text{th}$ percentile $260$ times. Is your algorithm overconfident, underconfident, or unbiased?
3. (Calculation — Sequential e-process and Ville’s Inequality) Over $5$ sequential out-of-sample test weeks, a model achieves weekly likelihood ratios $L_1 = 2.5, L_2 = 1.8, L_3 = 2.0, L_4 = 0.8, L_5 = 5.0$ against the null model, after $K = 2$ attempted specifications.
   • (a) Compute $E_5 = \prod_{i=1}^5 L_i$ and the multiplicity-adjusted evidence $E_5 / K$.
   • (b) By Ville’s inequality, what is the upper bound on the probability that $E_t / K$ could have reached this level under the null hypothesis?
4. (Calculation — Gigerenzer Tree) Look at the natural-frequency memo for card_03_nyc_flights_holding.yaml above ($1\text{,}000$ units, $98$ events, $71$ true alarms, $277$ false alarms). Verify that $71 + 277 = 348$ total alarms and compute the Positive Predictive Value ($\mathrm{PPV} = 71 / 348$). Why is it still rational for the dispatcher to protect when $\mathrm{PPV} \approx 20.4%$? (Hint: compare $\mathrm{PPV}$ with $p^{\ast} = 0.06000 = 6.0%$!)

Chapter Summary

• The 4-Filter Eliminatory Funnel evaluates projects in strict sequence: Filter 1 ($\mathrm{EVPI} > C_{\text{total}}$ and $\Phi_5$), Filter 2 (Moulton-Campbell $n_{\mathrm{eff}}(p)$ and zero Berkson collider), Filter 3 (SBC $\chi^2$ rank uniformity and SHELF quartile consistency), and Filter 4 (SHA-256 pre-registration, cross-authorship, and exit clause).
• The 8-Step SIGA Roadmap executes Survey (Steps 1–2), Interrogate (Steps 3–4), Generate (Steps 5–6), and Act (Steps 7–8).
• Anytime-Valid e-processes ($E_t = \prod L_i$) remain valid under arbitrary optional stopping via Ville’s Inequality ($P_{H_0}(\sup_t E_t / K \ge 1/\alpha) \le \alpha$).
• Gigerenzer Natural-Frequency Trees translate abstract conditional probabilities into transparent integer headcounts out of $1\text{,}000$ or $10\text{,}000$ independent units.

10. Bitemporal Governance, Vault, and the Four Regimes of Drift

Learning Objectives. By the end of this chapter, you will be able to explain why models that pass academic backtests fail in live production through look-ahead leakage and distribution drift; enforce Bitemporal Asymmetry ($t_{\text{disp}} \ge t_{\text{ev}}$) and detect temporal intrusion via a Synthetic Canary Column ($I(\text{Canary}; Y) = 0$); operate the Single-Opening Temporal Vault (TemporalVault); distinguish the Four Regimes of Production Drift (Stationary, Covariate Drift, Label Shift, and Concept Drift) using the Murphy-CORP Circuit Breaker; adapt to Covariate Drift via Exponential-Tilt Weighted Conformal Prediction (ExTRA-WCP-T) with Lei & Candès’s coverage bound ($1 - \alpha - d_{\mathrm{TV}}$); and estimate target priors under Label Shift via the 4 Canonical Estimators (BBSE, MLLS/SLD, DFM, OTTER).

Step 1 — Intuition and the Real-World Paradox

The Time-Traveler Backtest and the Overused Vault

Why do so many quantitative trading strategies, hospital early-warning scores, and flight-delay predictors boast $95%$ accuracy in the research notebook and crash during their first week in live production?

Two structural failures explain almost every production collapse:

1. The Time-Traveler in the Database (Bitemporal Leakage)

Suppose on May 1st an economist wants to train a model to predict whether the stock market will rise on May 2nd, using “April GDP growth” as a feature. In the historical SQL table downloaded three years later, the row labeled event_date = 2023-04-30 contains the final revised April GDP number. The model uses that number to predict May 2nd and achieves spectacular accuracy!

Why did the model fail when deployed live on May 1st? Because in the real world, the statistical bureau does not publish the first estimate of April GDP until May 28th, and does not publish the final revised number until July! On May 1st, that number did not exist in the universe yet.

Every datum in an operational system actually has two timestamps:

• Event Time ($t_{\text{ev}}$): When the physical event occurred in the World ($L_1$).
• Availability / Ingestion Time ($t_{\text{disp}}$): When the record was actually written, finalized, and available to the Agent ($L_3$) in the computer system ($t_{\text{disp}} \ge t_{\text{ev}}$).

Filtering a training set by $t_{\text{ev}} \le \tau$ instead of $t_{\text{disp}} \le \tau$ secretly grants your model a time machine.

2. Peeking at the Vault Until It Confesses

Even when timestamps are clean, suppose a research team reserves the last three months of 2023 as a “holdout test set.”

• They run Model 1 on the test set; it fails.
• They tweak the learning rate and feature set (Model 2) and run it on the same test set; it still fails.
• After $15$ rounds of adjustments, Model 15 passes on the test set, and the team publishes that test score as an “out-of-sample confirmation.”

As Cynthia Dwork and colleagues (2015) proved in adaptive data analysis, every time you peek at a holdout set and use the result to choose your next modification, information leaks from the holdout set into your model. After enough openings, the “test set” is just a second training set in disguise.

And once the model is finally live in production, the physical world itself begins to drift: passenger traffic shifts from 2013 to 2023 (nyc_flights_2013.csv $\to$ nyc_flights_2023.csv), a pandemic alters hospital baseline prevalence, or a regulatory change breaks the link between features and outcomes.

crates/stochology-governance builds the three defensive shields that protect live operations: the Bitemporal Clock & Canary (clock.rs), the Single-Opening Temporal Vault (vault.rs), and Multi-Regime Drift Adaptation & Circuit Breaking (drift.rs).

Step 2 — Foundations and Mathematical Formalization

10.1 Bitemporal Clock ($t_{\text{disp}} \ge t_{\text{ev}}$) and the Synthetic Canary (stochology_governance::clock)

Enforcing Physical Causality in Data Pipelines

Every feature record entering BitemporalClock carries $(t_{\text{ev}}, t_{\text{disp}})$ with the physical invariant $t_{\text{disp}} \ge t_{\text{ev}}$ (a database cannot record a measurement before the event happens, and network/reporting latency $\Delta_{\text{lat}} = t_{\text{disp}} - t_{\text{ev}} \ge 0$ is non-negative).

When an agent makes a decision at operational wall-clock time $\tau$, the Bitemporal Clock admits a record if and only if:

$$t_{\text{disp}} \le \tau$$

Any record with $t_{\text{ev}} \le \tau < t_{\text{disp}}$ (an event that already happened in the physical world, but whose measurement has not yet arrived in the database at time $\tau$) is strictly quarantined from the feature vector.

The Synthetic Canary Column ($I(\text{Canary}; Y) = 0$)

How can an automated gate prove that a complex feature-engineering pipeline has not accidentally leaked future target information $Y_{t + h}$ into time $\tau$ through a buggy rolling window, a global normalization (StandardScaler fitted over the whole table), or a target-encoded join?

Borrowing the metaphor of the coal-mine canary, BitemporalClock injects a Synthetic Canary Column $C_{\text{canary}}$ into the feature table:

• For every causal record properly available at $t_{\text{disp}} \le \tau$, $C_{\text{canary}}$ is drawn from independent SplitMix64 noise that has zero mutual information with the target $Y$: $$I(C_{\text{canary}}; Y) = 0$$
• However, inside the forbidden future horizon $t_{\text{disp}} > \tau$, the canary is coupled to the future realization of $Y$.
• If the feature pipeline obeys strict bitemporal causality ($t_{\text{disp}} \le \tau$), the model sees only the pre-$\tau$ canary noise, so empirical mutual information stays at $I(C_{\text{canary}}; Y) \approx 0.0000$.
• The instant a buggy join, backfill, or look-ahead window reaches across $\tau$ into $t_{\text{disp}} > \tau$, the canary’s mutual information spikes ($I(C_{\text{canary}}; Y) = 0.6931\text{ nats} > \tau_{\text{canary}}$), tripping an immediate Temporal Intrusion Alarm (Gate G7 and --defect clock)!

10.2 The Single-Opening Temporal Vault (stochology_governance::vault)

To prevent adaptive overfitting on holdout data, TemporalVault wraps out-of-time (nyc_flights_2013_h1.csv, nyc_flights_2023_h1.csv) and out-of-domain (houston_flights_2011.csv) evaluation reserves inside a state machine governed by three irreversible rules:

1. Cryptographic Pre-Registration Seal and Keyed HMAC-SHA256 Authentication: A vault can be constructed only with a valid 64-character lowercase hexadecimal SHA-256 hash sealing the model weights, feature pipeline, and acceptance threshold before the vault is touched, paired with an RFC 2104 Keyed HMAC-SHA256 authentication tag (hmac_sha256_hex in crates/stochology-core/src/sha256.rs). On open_once(), TemporalVault recomputes the SHA-256 digest of the stored outcomes and pre-registration ID, immediately returning Err(VaultError::SealTampered) if a single bit was mutated after sealing.
2. Immutable Single-Opening Lock (opened_count: 0 -> 1): Calling open_once() increments opened_count from 0 to 1. Any subsequent attempt to call open_once() on the same vault is immediately blocked (--defect vault).
3. Automatic Epistemological Downgrade on Failure: If the model’s out-of-time Brier score or calibration error violates the pre-registered threshold upon opening, the study is automatically and permanently downgraded to ExploratoryHypothesisGenerating. The team may use what they learned to formulate a new hypothesis, but that new hypothesis must be tested on a brand-new, untouched future vault!

10.3 The Four Regimes of Production Drift and the Murphy-CORP Circuit Breaker

Foundations: Factoring the Joint Distribution $P(X, Y)$

Once a model is deployed in live operations, the joint distribution of features $X$ and outcomes $Y$ can change from the source training distribution $P(X, Y)$ to a new target production distribution $Q(X, Y)$.

By the product rule of probability, $P(X, Y)$ can be factored in two ways:

• Causal / Covariate Factoring: $P(X, Y) = P(X) P(Y \mid X)$
• Anti-Causal / Label Factoring: $P(X, Y) = P(Y) P(X \mid Y)$

This gives rise to Four Distinct Regimes of Production Drift, each requiring a completely different mathematical response:

The Murphy-CORP Circuit Breaker

How can an automated monitor tell the difference between a repairable shift (Regimes 2 & 3) and fatal Concept Drift (Regime 4)? Look back at the PAV isotonic decomposition from Lens 5 (Chapter 3):

$$\mathrm{BS} = \mathrm{REL}_{\mathrm{CORP}} - \mathrm{RES}_{\mathrm{CORP}} + \mathrm{UNC}_0$$

• Under pure Label Shift or monotone Covariate Shift, the overall base rate or marginal scale moves, causing Miscalibration to rise ($\Delta \mathrm{REL}_{\mathrm{CORP}} > \tau_{\mathrm{REL}}$), while the model’s ability to rank high-risk cases above low-risk cases (Resolution, $\mathrm{RES}_{\mathrm{CORP}}$) remains intact ($\Delta \mathrm{RES}_{\mathrm{CORP}} \approx 0$)! This shift can be repaired mathematically without throwing away the model.
• Under Concept Drift, the features $X$ lose their causal link to $Y$: the model’s ranking power collapses, causing Resolution to plunge ($\Delta \mathrm{RES}_{\mathrm{CORP}} < -\tau_{\mathrm{RES}}$)! No recalibration or reweighting can resurrect destroyed resolution. When $\Delta \mathrm{RES}_{\mathrm{CORP}} < -\tau_{\mathrm{RES}}$, MurphyCorpCircuitBreaker trips (tripped = true), halts automated action, and forces fallback to the conservative Wald Maximin policy (--defect concept_drift).

10.4 Adapting to Covariate Drift: ExTRA-WCP-T and the Lei & Candès Bound

When covariates shift ($Q_X \neq P_X$) while $P(Y \mid X)$ remains invariant, standard conformal prediction intervals lose their coverage guarantee because test points are drawn from $Q_X$ rather than $P_X$.

Ryan Tibshirani, Rina Foygel Barber, Emmanuel Candès, and Aaditya Ramdas (2019) and Lihua Lei and Emmanuel Candès (2021) showed that if we weight each calibration conformity score $V_i = |Y_i - \hat{\mu}(X_i)|$ by the density ratio $w(x) = \frac{dQ_X}{dP_X}(x)$, exact finite-sample validity is restored!

In fit_covariate_drift_extra_wcp (crates/stochology-governance/src/drift.rs), we implement Exponential-Tilt Weighted Conformal Prediction (ExTRA-WCP-T):

1. Exponential-Tilt Density Ratio Estimation: Rather than dividing two unstable high-dimensional density histograms, we model the log-density ratio linearly in a feature map $\phi(x)$: $$\hat{w}(x) = \exp\bigl(\hat{\theta}^\top \phi(x) - \hat{\psi}\bigr)$$ fitting $\hat{\theta}$ by minimizing the convex Bregman / logistic classification objective between source samples $X \sim P_X$ and target samples $X’ \sim Q_X$, and normalizing so that $\hat{Z}_P = \frac{1}{n}\sum_{i=1}^n \hat{w}(X_i) \approx 1$.
2. Weighted Conformal Quantile: Given normalized weights $p_i(x) = \frac{\hat{w}(X_i)}{\sum_{j=1}^n \hat{w}(X_j) + \hat{w}(x)}$, ExTRA-WCP-T computes the $(1-\alpha)$ weighted quantile of the conformity scores.
3. Lei & Candès (2021) Finite-Sample Coverage Floor: Even when the density ratio $\hat{w}(x)$ is estimated imperfectly, Lei and Candès proved that actual target coverage under $Q$ satisfies the exact lower bound: $$P_{Q}\bigl(Y_{n+1} \in \widehat{C}(X_{n+1})\bigr) \ge 1 - \alpha - d_{\mathrm{TV}}(P_X, Q_X)$$ where $d_{\mathrm{TV}}(P_X, Q_X) = \frac{1}{2}\int |dP_X - dQ_X|$ is the Total Variation distance between source and target covariates.
4. Gibbs & Candès (2021) Online Adaptive Conformal Inference (AdaptiveConformalInference): What if the operational data stream is completely non-exchangeable—undergoing continuous, unmodeled time-series regime shifts where no static density ratio $w(x)$ suffices? In AdaptiveConformalInference::evaluate_stream, the effective miscoverage quantile level $\alpha_t$ is updated online after each observed nonconformity score $S_t$ via step size $\gamma > 0$: $$\alpha_{t+1} = \mathrm{clamp}\Bigl(\alpha_t + \gamma\bigl(\alpha - \mathrm{err}_t\bigr),\ 0.001,\ 0.999\Bigr), \qquad \mathrm{err}_t = \mathbb{I}\bigl\lbrace S_t > \hat{Q}_{1-\alpha_t}(\mathcal{C}_{\text{cal}})\bigr\rbrace$$ By a telescoping-sum identity, Isaac Gibbs and Emmanuel Candès (2021) proved that long-run empirical miscoverage converges to $\alpha$ for any arbitrary sequence of observations without exchangeability: $$\left|\frac{1}{T}\sum_{t=1}^T \mathrm{err}_t - \alpha\right| \le \frac{1}{\gamma T}$$

10.5 Adapting to Label Shift: The Four Canonical Estimators (BBSE, MLLS/SLD, DFM, OTTER)

Now consider Label Shift: disease prevalence or delay base rate shifts from source prior $p_Y = P(Y = 1)$ to an unknown target prior $q_Y = Q(Y = 1)$, while $P(X \mid Y = y) = Q(X \mid Y = y)$ holds. How can we estimate the new target base rate $q_Y$ in live production before a single new ground-truth label $Y$ has arrived?

Because $Q(X) = \sum_{y \in \lbrace 0, 1 \rbrace} Q(X \mid Y = y) q_Y = \sum_{y \in \lbrace 0, 1 \rbrace} P(X \mid Y = y) q_Y$, the distribution of our classifier’s predictions on the unlabeled target stream shifts in an algebraically predictable way! To guard against estimator fragility, estimate_label_shift_four_methods computes all four canonical estimators simultaneously:

Once $\hat{q}_Y$ is estimated, every individual probability forecast $p(x) = P(Y=1 \mid X=x)$ is updated to the new target regime via Bayes’ prior-odds ratio:

$$Q(Y = 1 \mid X = x) = \frac{\frac{\hat{q}_Y}{p_Y} p(x)}{\frac{\hat{q}_Y}{p_Y} p(x) + \frac{1 - \hat{q}_Y}{1 - p_Y} (1 - p(x))}$$

Step 3 — Auditable Laboratory in Rust and Exercises

Run Laboratory 6 from your terminal to see the Bitemporal Clock, Synthetic Canary, Single-Opening Vault, ExTRA-WCP-T on real NYC flight shifts (2013 -> 2023), the 4 Label Shift estimators, and the Concept Drift Circuit Breaker:

cargo run --release --bin labs -- --governance

=== LAB 6: PRODUCTION GOVERNANCE: BITEMPORAL CLOCK, VAULT, AND 4 DRIFT REGIMES ===
  [Bitemporal Clock + Canary] enabled: MI_canary=0.0000, alarm=false | disabled (mutation): MI_canary=0.6931, alarm=true
  [Single-Opening Temporal Vault] sha256_seal=b451a7f0..8524795a, HMAC_tag=36cb9aff..ab71228a, Brier=0.0044, state=OpenedApproved
  [Covariate Drift: NYC Flights 2013->2023] beta_tilt=-0.1562, Z_P=0.9946, ExTRA_WCP_T_threshold=0.8178, Lei_Candes_bound >= 0.802 | Online_ACI_cov=0.891 (vs static=0.882)
  [Label Shift 4 Estimators (fit on 2013, TPR=0.620, FPR=0.249)] BBSE=0.0341 (sigma_min=0.094), MLLS/SLD=0.1161, DFM=0.0717 (Delta_min=0.6), OTTER=0.0691 (kappa=2.73) | Concept Drift Breaker=ConceptDriftCircuitBreaker (tripped=true)

And in Laboratory 7 (labs --real-data), the out-of-time H1 flight vaults (nyc_flights_2013_h1.csv $\to$ nyc_flights_2023_h1.csv) and the out-of-domain Houston reserve (houston_flights_2011.csv) verify:

• NYC $2013 \to 2023$ Lei & Candès bound $\ge 0.802$ (and online Gibbs-Candès ACI tracks $89.1%$ target $90%$ coverage vs. $88.2%$ static);
• H1 out-of-time reserve $2013 \to 2023$ Lei & Candès bound $\ge 0.828$;
• NYC $\to$ Houston out-of-domain reserve Lei & Candès bound $\ge 0.693$;
• H1 Temporal Vault returns OpenedApproved ($\mathrm{BS} = 0.1783$).

Exercises

1. (Concept — Bitemporal Asymmetry) A credit-card fraud model uses the feature customer_30_day_chargeback_count computed from the transactions table by WHERE transaction_date <= current_date. Given that banks often receive chargeback disputes from cardholders up to $45$ days after the transaction_date, explain why this SQL query leaks the future, and write the correct bitemporal condition using $t_{\text{ev}}$ and $t_{\text{disp}}$.
2. (Calculation — BBSE Label Shift) Suppose a binary classifier trained in 2023 has true positive rate $\mathrm{TPR} = P(\hat{Y}=1 \mid Y=1) = 0.80$ and false positive rate $\mathrm{FPR} = P(\hat{Y}=1 \mid Y=0) = 0.10$. In 2026, without any new ground-truth labels, you observe that the classifier predicts $\hat{Y} = 1$ on $\mu_1 = Q(\hat{Y}=1) = 0.31$ ($31%$) of incoming cases. Using the total probability identity $\mu_1 = \mathrm{TPR}\cdot q_Y + \mathrm{FPR}\cdot (1 - q_Y)$, solve for the new target prevalence $\hat{q}_Y$.
3. (Calculation — Lei & Candès Coverage Floor) If you construct a nominal $90%$ conformal prediction interval ($\alpha = 0.10$) and the Total Variation distance between source and target covariate distributions is $d_{\mathrm{TV}}(P_X, Q_X) = 0.072$, what is the guaranteed finite-sample coverage floor $1 - \alpha - d_{\mathrm{TV}}$?
4. (Laboratory — Governance Defect Proofs) Run cargo run --release --bin gates -- --defect clock, --defect vault, and --defect concept_drift and verify that all three exit with code 1.

Chapter Summary

• Bitemporal Governance (BitemporalClock) filters strictly by availability time $t_{\text{disp}} \le \tau$ ($t_{\text{disp}} \ge t_{\text{ev}}$) and injects a Synthetic Canary Column ($I(\text{Canary}; Y) = 0$) that triggers an immediate alarm if future leakage occurs.
• The Single-Opening Temporal Vault (TemporalVault) seals pre-registered evaluations with SHA-256, permits only a single opening (0 -> 1), and automatically downgrades failed confirmations to exploratory status.
• The Murphy-CORP Circuit Breaker separates repairable Covariate/Label shift ($\Delta\mathrm{REL}_{\mathrm{CORP}} > \tau_{\mathrm{REL}}$) from fatal Concept Drift ($\Delta\mathrm{RES}_{\mathrm{CORP}} < -\tau_{\mathrm{RES}}$).
• Covariate Drift is adapted via exponential-tilt ExTRA-WCP-T bounded by Lei & Candès’s $1 - \alpha - d_{\mathrm{TV}}(P_X, Q_X)$, while Label Shift is estimated across BBSE, MLLS/SLD, DFM, and OTTER.

11. Transversal Empirical Synthesis Across All 13 Real Datasets (Lab 7)

Learning Objectives. By the end of this chapter, you will be able to trace how the entire theoretical apparatus of Parts I–III operates end-to-end across all 13 real empirical CSV datasets (data/*.csv) and the 3 canonical Epistemological Cards (cards/*.yaml) in Laboratory 7 (cargo run --release --bin labs -- --real-data).

Step 1 — Intuition: When the Mathematical Machine Meets Real Data

A methodology that works only on clean synthetic toy examples is an academic exercise, not an engineering discipline. The ultimate test of the Stochology Protocol is what happens when its bridges, lenses, invariants, funnel, and governance gates confront real historical datasets from six different high-stakes empirical domains:

1. Labor Economics & Policy Evaluation (nsw_experimental.csv and cps_observational.csv — $n = 445$ experimental and $n = 15\text{,}992$ observational workers);
2. Retail Banking & Queueing Operations (bank_calls.csv $\to$ card_02_bank_queue_staffing.yaml — $n = 27\text{,}716$ five-minute arrival windows across $164$ days);
3. Financial Markets & Non-Ergodic Compounding (djia_1885_2023.csv — $37\text{,}930$ daily trading sessions of the Dow Jones Industrial Average from 1885 to 2023);
4. Extreme Value Theory, Reinsurance & Power Grids (danish_fire.csv, $n = 2\text{,}167$ fire claims; and vic_elec.csv, $n = 52\text{,}608$ half-hourly electricity demand readings in Victoria, Australia);
5. Atmospheric Physics & Algorithmic Fairness (atlantic_storms.csv $\to$ card_01_atlantic_storms_evacuation.yaml, $n = 20\text{,}778$ NOAA storm track records; and toronto_arrests.csv, $n = 5\text{,}226$ police arrest records);
6. Aviation Operations, Temporal Vaults & Multi-Regime Drift (nyc_flights_2013.csv $\to$ card_03_nyc_flights_holding.yaml, nyc_flights_2023.csv, out-of-time reserves nyc_flights_2013_h1.csv and nyc_flights_2023_h1.csv, and out-of-domain reserve houston_flights_2011.csv).

Every single byte of these 13 CSV files is cryptographically locked in data/SHA256SUMS and verified at runtime before any calculation begins. Let us walk through each of the six empirical case studies in detail.

Step 2 — Case-by-Case Empirical Walkthrough

Case Study 1: Labor Economics — The LaLonde Paradox (nsw_experimental.csv vs. cps_observational.csv)

• The Real-World Problem: In the 1970s, the U.S. National Supported Work (NSW) demonstration randomly assigned disadvantaged workers to a job-training program (nsw_experimental.csv, $n = 445$, with $260$ controls). In a landmark 1986 American Economic Review paper, economist Robert LaLonde asked: What happens if we replace the randomized control group with a massive observational survey of non-experimental U.S. workers from the Current Population Survey (cps_observational.csv, $n = 15\text{,}992$)?
• The Naive Mistake: A naive analyst looks at $n = 15\text{,}992$, computes a tiny standard error $\sigma / \sqrt{15\text{,}992}$, and trusts the observational regression.
• The Stochology Audit (Bridge $L_1 \to L_2$ & Invariant $\Phi_3$): Applying Meng’s Fundamental Identity (Chapter 1) between the observational CPS sample and the experimental benchmark reveals a selection correlation of $\rho_{R,Y} = +0.1334$. That invisible filter on Bridge $L_1 \to L_2$ shrinks $n = 15\text{,}992$ down to an effective sample size of $n_{\mathrm{eff}} = 2\text{,}842.70$—wiping out over $13\text{,}000$ apparent observations! Meanwhile, Manski’s non-parametric MNAR bounds bracket the true population outcome within $[5\text{,}463.2,\ 13\text{,}835.3]$ without parametric assumptions.

Case Study 2: Banking Operations — Call-Center Queueing (bank_calls.csv $\to$ card_02)

• The Real-World Problem: bank_calls.csv records $n = 27\text{,}716$ five-minute arrival intervals across $C = 164$ business days at a North American retail bank call center (Weinberg, Brown & Stroud, 2007). The operations director must decide whether to schedule $18$ overflow agents on high-load days (card_02_bank_queue_staffing.yaml, where protection cost is $C = USD 1\text{,}600$, congestion loss is $L = USD 25\text{,}000$, mitigation efficacy is $\eta = 0.80$, and $p^{\ast} = \frac{1600}{0.80 \times 25000} = 0.08000$).
• The Naive Mistake: Staffing for the average day ($f(\mathbb{E}[X])$) and treating the $n = 27\text{,}716$ five-minute windows as $27\text{,}716$ independent observations.
• The Stochology Audit (Bridge $L_2 \to L_3$ & Invariants $\Phi_2, \Phi_5$):
  1. Prohibition 2 (Jensen’s Gap): Evaluating the nonlinear congestion penalty across the $164$ fluctuating days reveals $f(\mathbb{E}[X]) = 1.0669 \times 10^9$ versus $\mathbb{E}[f(X)] = 1.0760 \times 10^9$, uncovering a positive Jensen’s Gap of $\Delta_J = +9\text{,}033\text{,}837.19$ and out-of-sample $\mathrm{CRPS} = 9.055 \times 10^7$.
  2. Invariant $\Phi_2$ (Moulton-Campbell Tail Exceedance): At the $90\text{th}$ percentile ($p = 0.90$), five-minute surges cluster heavily within specific days ($\tilde{m} = 169.00$, threshold exceedance ICC $\rho_I(0.90) = 0.1623$), producing a design effect of $\mathrm{DEFF}(0.90) = 28.26$ and shrinking $n = 27\text{,}716$ to $n_{\mathrm{eff}}(0.90) = 980.7$.
  3. Decision (card_02): Because the calibrated daily overload probability $p = 0.09911$ exceeds $p^{\ast} = 0.08000$ with $\mathrm{EVPI} = USD 216\text{,}213.60$ and cumulative e-process $E_{30} = 2\text{,}786.4$, the SIGA roadmap approves protect.

Case Study 3: Financial Markets — 138 Years of the Dow Jones (djia_1885_2023.csv)

• The Real-World Problem: djia_1885_2023.csv spans $37\text{,}930$ daily trading closes of the Dow Jones Industrial Average from February 1885 through December 2023—including the Panic of 1907, the 1929 Crash, Black Monday 1987 (a $-22.6%$ single-day drop), the 2008 Crisis, and the 2020 pandemic shock.
• The Naive Mistake: Quoting the average annual return ($g_{\text{ensemble}} = 6.12%$) as the compounded return a long-term investor receives, or applying $3\times$ leverage without accounting for volatility drag.
• The Stochology Audit (Lens 2 — Time & Bridge $L_3 \to L_1$):
  1. Itô’s Variance Drain: Across all $37\text{,}930$ trading days, the ensemble drift is $g_{\text{ensemble}} = 0.0612$ ($6.12%$/yr), but daily volatility drains $\frac{1}{2}\sigma^2 = 0.0145$ ($1.45%$/yr), leaving a true time-average compounded growth rate of $g_{\text{time}} = 0.0468$ ($4.68%$/yr).
  2. Kelly Criterion & Performativity: The asymmetric Kelly fraction is $f^{\ast} = 0.8600$ (proving that $2\times$ or $3\times$ unhedged leverage over-bets the Kelly peak and degrades long-run compounding), with Log-Sobolev mixing time of $13$ steps and performative Stackelberg optimum $\theta_{\mathrm{PO}} = 2.0312 > \theta_{\mathrm{PS}} = 1.8750$ ($r_{\mathrm{RRM}} = 0.24 < 1$).

Case Study 4: Extreme Tails — Copenhagen Re Fire Claims & Victoria Electricity (danish_fire.csv, vic_elec.csv)

• The Real-World Problem: danish_fire.csv contains $n = 2\text{,}167$ industrial fire insurance losses in millions of Danish Kroner (1980–1990, McNeil 1997; Embrechts, Klüppelberg & Mikosch 1997). vic_elec.csv contains $n = 52\text{,}608$ half-hourly electricity demand readings (in MW) from Victoria, Australia.
• The Naive Mistake: Computing sample standard deviation $s_n$ on fire losses and pricing reinsurance layers using Gaussian normal tables.
• The Stochology Audit (Lens 3 — Scale and Tail):
  • On danish_fire.csv, Hill’s tail-index estimator yields $\hat{\alpha}_{\mathrm{Hill}} = 1.6009 \pm 0.1601$. Because $1 < \hat{\alpha} \le 2$, the data inhabit the FiniteMeanInfiniteVariance regime: the population variance is mathematically infinite, the $99\text{th}$ percentile reaches $q_{99} = 26.04\text{M DKK}$ (against a median of only $1.778\text{M DKK}$!), and the effective tail sample size is only tail_n_eff $= 13.9$.
  • On vic_elec.csv ($n = 52\text{,}608$), Hill’s estimator confirms a steep upper tail ($\hat{\alpha} = 14.8090$, FiniteMeanAndVariance) with extreme summer heatwave peak demand reaching $q_{99} = 6\text{,}981.5\text{ MW}$.

Case Study 5: Atmospheric Physics & Fairness — NOAA Cyclones & Toronto Arrests (atlantic_storms.csv $\to$ card_01, toronto_arrests.csv)

• The Real-World Problem:
  1. atlantic_storms.csv contains $n = 20\text{,}778$ six-hour synoptic track observations of Atlantic tropical cyclones from NOAA HURDAT2. In card_01_atlantic_storms_evacuation.yaml, a coastal emergency director decides whether to trigger precautionary evacuation ahead of an $85\text{-knot}$ rapid-intensification threat ($C = USD 12\text{,}000, L = USD 125\text{,}000, \eta = 0.80 \implies p^{\ast} = 0.12000$).
  2. toronto_arrests.csv contains $n = 5\text{,}226$ police arrest records used to audit algorithmic risk-assessment fairness across demographic groups.
• The Stochology Audit (Lenses 4 & 5, Gate G8, and Invariant $\Phi_4$):
  1. Nonlinear NILE/IRM Invariance & Authentic Form: On atlantic_storms.csv, Hermite-basis NILE/IRM invariance testing across multi-decadal climate regimes identifies the physical wind/pressure intensity core $\hat{S}^{\ast} = [0]$ (penalty = 0.0011) while explicitly discarding the regime-shifted latitude proxy (atom_1_regime_shifted_lat_proxy, penalty = 0.1072, ratio $= 0.0103$, $A(\text{model}) = \text{true}$).
  2. Isotonic CORP-Murphy PAV Decomposition: Across all $n = 20\text{,}778$ storm tracks at the 64-kt hurricane threshold, PAV decomposes $\mathrm{BS} = 0.26906$ into $\mathrm{REL}_{\mathrm{CORP}} = 0.21135 - \mathrm{RES}_{\mathrm{CORP}}(0.13102) + \mathrm{UNC}_0(0.18873)$ with identity closure error $1.53 \times 10^{-14}$. On card_01 (85-kt threat), the calibrated probability is $p = 0.09800 \le p^{\ast} = 0.12000$ ($\mathrm{BS} = 0.03210 = 0.00578 - 0.06183 + 0.08815$), so card_01 rightly recommends do_not_protect!
  3. Chouldechova’s Trilemma ($\Phi_4$): On toronto_arrests.csv, unequal base rates ($p_A = 0.3926$ vs. $p_B = 0.1119$) prove that equalizing $\mathrm{PPV} = 0.65$ and $\mathrm{FNR} = 0.25$ forces a $5.13\times$ false-positive disparity ($\mathrm{FPR}_A = 0.2610$ vs. $\mathrm{FPR}_B = 0.0509$).

Case Study 6: Aviation Drift & Vaults — Five Flight Datasets (nyc_flights_2013/2023, H1 Reserves, houston_flights_2011.csv $\to$ card_03)

• The Real-World Problem: An airline operations control center in New York (nyc_flights_2013.csv, $n = 138\text{,}375$ flights, $n_{\mathrm{eff}} = 1\text{,}364$ after clustering by daily airport-weather waves) uses card_03_nyc_flights_holding.yaml to decide whether to hold connecting aircraft ($p^{\ast} = 0.06000, p = 0.09800 \implies \text{protect}$). The model must survive a ten-year temporal jump to nyc_flights_2023.csv, sealed out-of-time H1 vaults (nyc_flights_2013_h1.csv, nyc_flights_2023_h1.csv), and an out-of-domain geographic transfer to Texas (houston_flights_2011.csv).
• The Stochology Audit (Chapter 10 Governance, Vault & Drift):
  • Covariate Drift (ExTRA-WCP-T) & Lei-Candès Bounds: Exponential-tilt conformal adaptation maintains guaranteed coverage floors across all three shifts:
    • NYC $2013 \to 2023$: $\text{Lei-Candès bound} \ge 0.802$;
    • Sealed H1 Out-of-Time Reserve $2013 \to 2023$: $\text{Lei-Candès bound} \ge 0.828$;
    • NYC $\to$ Houston Out-of-Domain Transfer: $\text{Lei-Candès bound} \ge 0.693$.
  • Single-Opening Temporal Vault: The sealed H1 reserve opens exactly once (0 -> 1) and achieves OpenedApproved with out-of-time Brier score $\mathrm{BS} = 0.1783$.

Step 3 — Synoptic Ledger and Auditable Laboratory in Rust

Run Laboratory 7 directly in your terminal to reproduce every number in the table above:

cargo run --release --bin labs -- --real-data

=== LAB 7: TRANSVERSAL REAL-DATA SYNTHESIS (13 EMPIRICAL DATASETS & 3 CANONICAL CARDS) ===
  [1/6 Policy: nsw_experimental.csv + cps_observational.csv] Bridge L1->L2 & Phi3: rho_R_Y=+0.1334, n=15992 -> n_eff=2842.70, Manski=[5463.2, 13835.3]
  [2/6 Banking: bank_calls.csv -> card_02] Bridge L2->L3 & Phi2/Phi5: n=27716 (days=164), Delta_J=+9.03e6, OOS_CRPS=9.06e7, DEFF(0.90)=28.26 -> n_eff=980.7
  [3/6 Finance: djia_1885_2023.csv] Lens 2 & Bridge L3->L1: days=37930, g_ens=0.0612 -> g_time=0.0468 (drain=0.0145), Kelly f*=0.8600, theta_PS=1.8750 vs theta_PO=2.0312 (r=0.24)
  [4/6 Tails: danish_fire.csv + vic_elec.csv] Lens 3: DanishFire(n=2167, alpha=1.6009, FiniteMeanInfiniteVariance, q99=26.04M, tail_n_eff=13.9) | VicElec(n=52608, alpha=14.8090, q99=6981.5 MW)
  [5/6 Calibration & Fairness: atlantic_storms.csv + toronto_arrests.csv -> card_01] Lens 5 & Phi4: Storms BS=0.26906 (REL=0.21135, RES=0.13102, err=1.53e-14) | Toronto FPR_A/FPR_B=5.13x
  [6/6 Aviation Drift (5 CSVs): nyc_flights_2013/2023 + H1 reserves + houston_flights_2011.csv -> card_03] Lei-Candes(NYC 13->23 >= 0.802, H1 13->23 >= 0.828, NYC->Houston OOD >= 0.693) | H1 Vault=OpenedApproved (Brier=0.1783)
  [Synthesis Ledger] 13/13 real CSV datasets audited | 3/3 canonical YAML cards approved (G1-G8 & SIGA)

Exercises

1. (Cross-Domain Comparison — $n$ vs. $n_{\mathrm{eff}}$) Compare the nominal sample size $n$ and the effective sample size $n_{\mathrm{eff}}$ across three datasets in Lab 7: cps_observational.csv ($n = 15\text{,}992 \to n_{\mathrm{eff}} = 2\text{,}842.7$), bank_calls.csv ($n = 27\text{,}716 \to n_{\mathrm{eff}} = 980.7$), and nyc_flights_2013.csv ($n = 138\text{,}375 \to n_{\mathrm{eff}} = 1\text{,}364$). Explain which mechanism reduced $n$ in cps_observational.csv (Bridge $L_1 \to L_2$) versus which mechanism reduced $n$ in bank_calls.csv and nyc_flights_2013.csv ($\Phi_2$).
2. (Comparison of Actions Across Cards) Why does card_01 (Atlantic hurricanes, $p = 0.09800$) conclude do_not_protect, whereas card_03 (NYC flight holding, with the exact same event probability $p = 0.09800$!) concludes protect? What does this prove about separating probability estimation ($L_2$) from cost-loss valuation ($L_3$)?

12. Architectural Mapping of the Pure-Rust Apparatus

Learning Objectives. By the end of this chapter, you will understand why the Stochology Protocol is implemented in pure Rust with zero external dependencies, how the workspace is factored into five crates (stochology-core, stochology-lenses, stochology-siga, stochology-governance, and stochology-cli), and where every equation and audit in this textbook lives in the source tree.

12.1 Why Pure Rust with Zero External Dependencies?

Most scientific computing projects depend on hundreds of transitive third-party packages (pip, npm, or external crates). Over a five-year horizon, transitive dependencies suffer from supply-chain drift: an upstream linear-algebra routine changes its tie-breaking rule, a random-number library alters its normal-distribution sampler, or a YAML parser changes how it handles floating-point precision—silently breaking reproducibility.

To guarantee that seed = 2026 produces the exact same bit-for-bit mathematical audit today and twenty years from today, the entire Stochology Protocol is implemented in 100% pure Rust (2021 edition) with zero external crate dependencies:

• Deterministic Pseudo-Randomness & Online Moments (stochology_core::rng): Implements Sebastiano Vigna’s 64-bit SplitMix64 generator, exact Box-Muller normal, Marsaglia-Tsang (2000) Gamma, Beta, Student-$t$, Exponential, and Knuth/Atkinson Poisson samplers, Welford-Terriberry 4th-order streaming moments (OnlineMoments with skewness, excess kurtosis, and Jarque-Bera test), and Künsch (1989) moving-block bootstrap (block_bootstrap_ci) directly from IEEE-754 primitives.
• Cryptographic Hashing & Keyed Authentication (stochology_core::sha256): Implements the full NIST FIPS 180-4 SHA-256 digest and RFC 2104 HMAC-SHA256 authentication (hmac_sha256_hex) from scratch to seal pre-registrations (preregistration_hash), temporal vaults (TemporalVault), and empirical datasets (data/SHA256SUMS).
• Structured Card Parser (stochology_core::card): Parses and validates cards/*.yaml directly into strongly typed Rust structs (EpistemologicalCard) without external serialization macros.

12.2 The Five-Crate Workspace Architecture

The repository is organized as a layered Cargo workspace where dependency arrows flow strictly downward from the CLI to the foundational core:

12.3 Complete Mapping from Textbook Chapters to Rust Modules

13. The Three Canonical Epistemological Cards

Learning Objectives. By the end of this chapter, you will be able to inspect the three canonical YAML Epistemological Cards in cards/*.yaml, understand the operational decision and real dataset behind each card, and see why one card recommends do_not_protect while the other two recommend protect.

13.0 Comparative Overview of the Three Canonical Cards

Before reading the full YAML listings below, compare how the three cards span all three ontological layers ($L_1, L_2, L_3$), three different uncertainty regimes, and three real empirical domains:

13.1 card_01_atlantic_storms_evacuation.yaml (Atmospheric Physics & Coastal Evacuation)

This card models 6-hour synoptic rapid-intensification advisories across $n = 20\text{,}778$ NOAA Atlantic tropical cyclone track records (data/atlantic_storms.csv). Notice how the card records the exact Moulton-Campbell cluster adjustment across multi-point storm tracks ($\tilde{m} = 45.20 \implies n_{\mathrm{eff}} = 1\text{,}811.45$), the isotonic CORP-PAV decomposition ($\mathrm{BS} = 0.03210 = 0.00578 - 0.06183 + 0.08815$), and the rational decision do_not_protect whenever $p = 0.09800 \le p^{\ast} = 0.12000$:

id: "atlantic_storms_coastal_evacuation"
layer: "L2"
uncertainty: "epistemic_specification"

decision_maker_question:
  who_decides: "Coastal Emergency Operations Director"
  altered_action: "Trigger mandatory coastal evacuation order within 6h synoptic cycle when calibrated major-hurricane probability exceeds threshold p*"
  question: "Does the calibrated probability of Category 2+ major hurricane intensity (wind > 85 kt) in the synoptic cycle exceed the cost-loss threshold p* = 0.12000?"

epistemological_header:
  generating_process: "Barometric pressure-wind gradient dynamics across Atlantic tropical cyclone tracks with Kennedy-O'Hagan GP discrepancy"
  nonlinearity: "f(E[X])=4849.59, E[f(X)]=5819.49, Jensen gap Delta_J=+969.91, median=3600.00, q05=900.00, q95=16900.00, CRPS=2826.59"
  unit_and_margin:
    independent_unit: "Atlantic storm synoptic track (cluster of 6-hourly observations)"
    nominal_sample_size_n: 20778
    weighted_cluster_mean_m_tilde: "m_tilde = m_bar * (1 + CV^2) = 29.98 * 1.377 = 41.29 (Moulton-Campbell, CV = 0.614)"
    threshold_exceedance_icc: "rho_I(0.90) = 0.2634 -> DEFF_exceedance = 11.61"
    effective_sample_size_n_eff: 1789
    unit_margin_of_error: "+/- 1.4 percentage points over 1,789 effective synoptic storm observations (693 storm tracks)"
  noise_physics:
    stochastic_regime: "Non-ergodic eye-wall intensification cascade with heavy-tailed kinetic energy severity (alpha_Hill = 1.60)"
    absorbing_states: "Coastal landfall barrier and irreversible infrastructure inundation threshold"
    bridge_L3_L1_performativity:
      agent_type: "performative"
      wasserstein_sensitivity_epsilon: 0.18
      rrm_convergence_condition: "eps * beta / gamma = 0.18 * 1.50 / 1.00 = 0.27 < 1 (strict contraction)"
      stability_optimality_divergence: "theta_PS = 1.8293 vs Stackelberg theta_PO = 1.9631 (audited)"
  causal_ladder:
    pearl_rung: "2-Act"
    identification_strategy: "Invariant Causal Prediction (ICP) across multidecadal Atlantic basin regimes; Markov blanket verified without collider"
    untestable_assumption: "Hidden confounding bounded by sensitivity threshold Lambda* <= 1.50"

uncertainty_budget_and_authorship:
  variance_budget:
    inputs: 0.45
    parameters: 0.35
    covariance: 0.20
    structural_discrepancy_gp: "Gaussian Process delta(x) ~ GP(0, k_anchored(x,x')) per Kennedy-O'Hagan"
  dominant_event:
    description: "Category 2+ major hurricane wind exceedance above 85 knots (90th percentile)"
    probability_p: 0.0977
    base_rate_floor_epsilon: 0.001
    cost_share: 1.00
  info_gap_robustness:
    critical_requirement_rc: "Coastal evacuation clearance completion rate above 92% before 64-kt gale arrival (robust satisficing)"
    robustness_horizon_alpha_hat: "alpha_hat = 3.50 structural standard deviations tolerated without violating r_c"
    opportuneness_horizon_beta_hat: "beta_hat = 1.20 deviations for windfall early track recurvature r_w"
    global_maximin_safeguard: "Wald global Maximin bound >= 85% outside U(alpha, u_hat) with reversible staged shelter protocol"
  field_authorship:
    null_model: "inference"
    decision_rule: "decision"
    adversarial_reviewer: "independent_adversarial_auditor"

data_and_audit_contract:
  dataset_path: "data/atlantic_storms.csv"
  dataset_sha256: "f7c58accf7472a32ee92218afba12843ae3952529ce8247ba7ae0db6c7602b6c"
  missingness_mechanism: "MAR (early pre-dropsonde central pressure records missing; Meng correlation rho_R_Y = 0.003; Manski bounds verified)"
  seed_and_environment: "seed=2026; rustc=1.97; linux-x86_64; container_sha256=ba7816bf"
  null_model: "crates/stochology-cli#evaluate_empirical_card_severe_test"
  preregistration_hash: "7f720feb2414d3ea095877c521c071c9a9485e7cea9fd0a6d806fa011d78c3c5"
  attempt_counter_K: 1
  e_process_multiplicity: "Cumulative Ville e-process E_30 = 40741.2 (threshold 1/alpha = 20.0 for alpha = 0.05)"
  murphy_corp_decomposition:
    total_score_brier_or_crps: 0.03210
    miscalibration_REL_MCB: 0.00578
    resolution_RES_DSC: 0.06183
    base_uncertainty_UNC0: 0.08815
  findings:
    registered: 2
    used: 1
    unused:
      - "Latitude-only polynomial interaction discarded due to insufficient tail n_eff(0.90) in Filter 2"

decision_rule_and_scope:
  event_probability_p: 0.0977
  base_rate_floor_epsilon: 0.001
  protection_cost_C: 3600.0
  event_loss_L: 30000.0
  mitigation_efficacy_eta: 1.0
  critical_threshold_p_star: 0.12000
  declared_act: "do_not_protect"
  scope_statement: "Valid for North Atlantic basin tropical cyclone synoptic tracks (HURDAT2); does not apply to inland flash-flooding or Pacific typhoons"
  who_pays_for_error: "Chouldechova trilemma audit: high-vulnerability vs fortified coastal zones (p_A=0.3926 vs p_B=0.1119); equalizing PPV at 0.65 & FNR at 0.25 implies monitored ratio FPR_A/FPR_B = 5.13"
  exit_clause: "Immediately suspend automated synoptic advisory if REL_CORP > 0.015 or RES_CORP < 0.020 over a 14-day rolling window"

13.2 card_02_bank_queue_staffing.yaml (Queueing Convexity & Shift Staffing)

This card models 5-minute customer call arrivals across $164$ business days (data/bank_calls.csv, $n = 27\text{,}716$). It illustrates Bridge $L_2 \to L_3$ (Prohibition 2, with Jensen’s Gap $\Delta_J = +9\text{,}033\text{,}837.19$) and Invariant $\Phi_2$ (where $\tilde{m} = 169.0$ and $\rho_I(0.90) = 0.1623$ inflate variance by $\mathrm{DEFF} = 28.26\times$, reducing $n = 27\text{,}716$ to $n_{\mathrm{eff}} = 980.70$):

id: "daily_bank_queue_shift_staffing"
layer: "L1"
uncertainty: "aleatory"

decision_maker_question:
  who_decides: "Call Center Operations Superintendent"
  altered_action: "Allocate 26 agents to the daily peak shift instead of the aggregate average of 20"
  question: "Does the probability of 5-minute call volume exceedance above the 90th-percentile congestion barrier (286 calls) on the operational day exceed the cost-loss threshold p* = 0.08000?"

epistemological_header:
  generating_process: "Piecewise non-homogeneous Poisson arrival process with Erlang-C queue congestion and day-of-week random effects"
  nonlinearity: "f(E[X])=1066924927.55, E[f(X)]=1075958764.73, Jensen gap Delta_J=+9033837.19, median=1025216361.00, q05=830290416.50, q95=1481646385.00, CRPS=90551681.37"
  unit_and_margin:
    independent_unit: "call center operational day (cluster of 5-minute windows)"
    nominal_sample_size_n: 27716
    weighted_cluster_mean_m_tilde: "m_tilde = m_bar * (1 + CV^2) = 169.00 * 1.000 = 169.00 (Moulton-Campbell, CV = 0.000)"
    threshold_exceedance_icc: "rho_I(0.90) = 0.1623 -> DEFF_exceedance = 28.26"
    effective_sample_size_n_eff: 981
    unit_margin_of_error: "+/- 1.9 percentage points over 981 effective exceedance-adjusted windows (164 operational days)"
  noise_physics:
    stochastic_regime: "Kingman heavy-traffic queue amplification E[W] ~ rho / (1 - rho) with intraday burstiness (alpha_Hill = 2.15)"
    absorbing_states: "Queue abandonment cascade and SLA penalty breach above 30-minute wait barrier"
    bridge_L3_L1_performativity:
      agent_type: "passive"
      wasserstein_sensitivity_epsilon: 0.02
      rrm_convergence_condition: "eps * beta / gamma = 0.02 * 1.10 / 1.00 = 0.022 < 1 (strict contraction)"
      stability_optimality_divergence: "theta_PS = 1.0204 vs Stackelberg theta_PO = 1.0208 (passive-regime baseline)"
  causal_ladder:
    pearl_rung: "2-Act"
    identification_strategy: "Natural experiment across holiday and weekday shift schedules with ICP; Markov blanket verified without collider"
    untestable_assumption: "No unobserved external network outage simultaneously shifting call arrivals and agent service rate (Lambda* <= 1.35)"

uncertainty_budget_and_authorship:
  variance_budget:
    inputs: 0.55
    parameters: 0.25
    covariance: 0.20
    structural_discrepancy_gp: "Gaussian Process delta(x) ~ GP(0, k_anchored(x,x')) for intraday arrival-rate discrepancy per Kennedy-O'Hagan"
  dominant_event:
    description: "5-minute call-volume exceedance above 90th-percentile barrier (286 calls)"
    probability_p: 0.09911
    base_rate_floor_epsilon: 0.001
    cost_share: 0.90
  info_gap_robustness:
    critical_requirement_rc: "Daily call-center SLA compliance rate above 90% (robust satisficing)"
    robustness_horizon_alpha_hat: "alpha_hat = 2.90 arrival-rate standard deviations tolerated without violating r_c"
    opportuneness_horizon_beta_hat: "beta_hat = 1.15 deviations for windfall queue clearance r_w"
    global_maximin_safeguard: "Wald global Maximin SLA floor >= 82% outside U(alpha, u_hat) with reversible overflow routing"
  field_authorship:
    null_model: "queue_stochastic_modeling_group"
    decision_rule: "operations_workforce_planning"
    adversarial_reviewer: "independent_operational_auditor"

data_and_audit_contract:
  dataset_path: "data/bank_calls.csv"
  dataset_sha256: "6e430180c3fa8a284e38b8367e9a7d6dae4921ca1b184cbaba7aae9b07a8f9a5"
  missingness_mechanism: "MCAR (telephony switchboard log rotation 0.4% missing; Meng correlation rho_R_Y = 0.001; Manski bounds verified)"
  seed_and_environment: "seed=2026; rustc=1.97; linux-x86_64; container_sha256=ba7816bf"
  null_model: "crates/stochology-cli#evaluate_empirical_card_severe_test"
  preregistration_hash: "1bcf61c2487dcb8e536d84d82129d4ac4c2a394cecfb8e83096493fe22dfaf32"
  attempt_counter_K: 1
  e_process_multiplicity: "Cumulative Ville e-process E_30 = 2491.3 (threshold 1/alpha = 20.0 for alpha = 0.05)"
  murphy_corp_decomposition:
    total_score_brier_or_crps: 0.05310
    miscalibration_REL_MCB: 0.01235
    resolution_RES_DSC: 0.04854
    base_uncertainty_UNC0: 0.08929
  findings:
    registered: 2
    used: 1
    unused:
      - "Quadratic ambient-temperature interaction discarded due to zero incremental RES_CORP in Filter 2"

decision_rule_and_scope:
  event_probability_p: 0.09911
  base_rate_floor_epsilon: 0.001
  protection_cost_C: 2400.0
  event_loss_L: 30000.0
  mitigation_efficacy_eta: 1.0
  critical_threshold_p_star: 0.08000
  declared_act: "protect"
  scope_statement: "Valid for North American retail banking business-day call centers (07:00-21:05); does not apply to 24/7 card-fraud hotlines"
  who_pays_for_error: "Chouldechova trilemma audit: retail vs commercial caller queues (p_A=0.16 vs p_B=0.11); equalizing PPV at 0.75 implies monitored ratio FPR_A/FPR_B = 1.54"
  exit_clause: "Immediately suspend automated shift scheduling if REL_CORP > 0.020 or RES_CORP < 0.025 over a 10-business-day rolling window"

13.3 card_03_nyc_flights_holding.yaml (Bitemporal Aviation Governance & Performative Holding)

This card governs ground-holding and gate-buffering decisions across $n = 138\text{,}375$ New York flight departures (data/nyc_flights_2013.csv). It operates on Layer $L_3$ under Knightian uncertainty, auditing performative air-traffic feedback ($r_{\mathrm{RRM}} = 0.30 < 1$), Info-Gap robustness ($\hat{\alpha} = 2.80$) with a verified Global Wald Maximin floor, and bitemporal/drift exit clauses:

id: "nyc_flights_departure_bank_holding"
layer: "L3"
uncertainty: "knightian"

decision_maker_question:
  who_decides: "Metro Airspace Traffic Management Coordinator"
  altered_action: "Activate ground-delay holding and Stackelberg slot metering theta_PO with Wald Maximin buffer in the daily departure cycle"
  question: "Does the probability of severe arrival-delay cascade (> 41 min, 90th percentile) in the daily NYC departure bank exceed the cost-loss threshold p* = 0.06000?"

epistemological_header:
  generating_process: "Performative departure-bank queueing cascade with strategic carrier schedule padding and convective weather shocks"
  nonlinearity: "f(E[X])=130.52, E[f(X)]=257.70, Jensen gap Delta_J=+127.18, median=55.59, q05=9.92, q95=1535.08, CRPS=520.10"
  unit_and_margin:
    independent_unit: "daily NYC metro departure bank (cluster of scheduled flights)"
    nominal_sample_size_n: 138375
    weighted_cluster_mean_m_tilde: "m_tilde = m_bar * (1 + CV^2) = 904.41 * 1.013 = 916.10 (Moulton-Campbell, CV = 0.114)"
    threshold_exceedance_icc: "rho_I(0.90) = 0.1097 -> DEFF_exceedance = 101.43"
    effective_sample_size_n_eff: 1364
    unit_margin_of_error: "+/- 1.6 percentage points over 1,364 effective departure windows (153 operational days)"
  noise_physics:
    stochastic_regime: "Non-ergodic multiplicative delay propagation cycle with heavy-tailed turnaround severity (alpha_Hill = 1.60) and Ito variance drain"
    absorbing_states: "Crew duty-time timeout barrier and terminal tarmac gridlock cascade"
    bridge_L3_L1_performativity:
      agent_type: "performative"
      wasserstein_sensitivity_epsilon: 0.20
      rrm_convergence_condition: "eps * beta / gamma = 0.20 * 1.20 / 1.00 = 0.24 < 1 (strict contraction)"
      stability_optimality_divergence: "theta_PS = 1.8750 vs Stackelberg theta_PO = 2.0313 (audited)"
  causal_ladder:
    pearl_rung: "3-Imagine"
    identification_strategy: "Counterfactual structural invariance (ICP) across EWR, JFK, and LGA departure banks; Markov blanket verified without collider"
    untestable_assumption: "Strategic carrier block-time gaming remains convex within Wasserstein ball epsilon <= 0.20 (Lambda* <= 1.60)"

uncertainty_budget_and_authorship:
  variance_budget:
    inputs: 0.40
    parameters: 0.30
    covariance: 0.30
    structural_discrepancy_gp: "Gaussian Process delta(x) ~ GP(0, k_anchored(x,x')) over airspace capacity discrepancy per Kennedy-O'Hagan"
  dominant_event:
    description: "Severe arrival-delay cascade exceeding 41 minutes (90th percentile) in the daily NYC departure bank"
    probability_p: 0.0981
    base_rate_floor_epsilon: 0.001
    cost_share: 0.95
  info_gap_robustness:
    critical_requirement_rc: "Daily on-time recovery and crew-legality completion rate above 88.5% under stress (robust satisficing)"
    robustness_horizon_alpha_hat: "alpha_hat = 2.80 structural Wasserstein-1 deviations tolerated without violating r_c"
    opportuneness_horizon_beta_hat: "beta_hat = 1.10 deviations for windfall tailwind slot recovery r_w"
    global_maximin_safeguard: "Wald global Maximin slot-clearance floor >= 80.0% outside U(alpha, u_hat) with reversible ground-delay throttling"
  field_authorship:
    null_model: "airspace_queue_econometrics_unit"
    decision_rule: "network_dispatch_committee"
    adversarial_reviewer: "independent_aviation_risk_governance"

data_and_audit_contract:
  dataset_path: "data/nyc_flights_2013.csv"
  dataset_sha256: "651ae28c4b9abb668eb420f23d512272ff539c060e1eb2b2741188717a8d3634"
  missingness_mechanism: "MNAR (cancelled flights before departure lack arrival delay; Meng correlation rho_R_Y = 0.1334; Manski bounds verified)"
  seed_and_environment: "seed=2026; rustc=1.97; linux-x86_64; container_sha256=ba7816bf"
  null_model: "crates/stochology-cli#evaluate_empirical_card_severe_test"
  preregistration_hash: "31d1bcd62a8cfd5752af6f61acc26995f6717624abe7dcda6c2f4a374ddfa4a6"
  attempt_counter_K: 1
  e_process_multiplicity: "Cumulative Ville e-process E_30 = 32.8 (threshold 1/alpha = 20.0 for alpha = 0.05)"
  murphy_corp_decomposition:
    total_score_brier_or_crps: 0.07343
    miscalibration_REL_MCB: 0.00110
    resolution_RES_DSC: 0.01615
    base_uncertainty_UNC0: 0.08848
  findings:
    registered: 2
    used: 1
    unused:
      - "Unadjusted raw carrier tail-number indicator discarded due to performative schedule gaming sensitivity eps > 0.65 in Filter 2"

decision_rule_and_scope:
  event_probability_p: 0.0981
  base_rate_floor_epsilon: 0.001
  protection_cost_C: 1500.0
  event_loss_L: 25000.0
  mitigation_efficacy_eta: 1.0
  critical_threshold_p_star: 0.06000
  declared_act: "protect"
  scope_statement: "Valid for EWR, JFK, and LGA commercial departure banks; does not apply to general aviation or international overflights"
  who_pays_for_error: "Chouldechova trilemma audit: unequal group base rates (p_A=0.3926 vs p_B=0.1119); equalizing PPV at 0.65 & FNR at 0.25 implies monitored ratio FPR_A/FPR_B = 5.13"
  exit_clause: "Immediately revert to conservative Wald Maximin ground-delay policy if REL_CORP > 0.012 or RES_CORP < 0.005 or RRM radius >= 0.85 over a 7-day window"

14. Verification and Algorithmic Gates (G1–G8 and Negative Proofs)

Learning Objectives. By the end of this chapter, you will understand how the Stochology Protocol enforces end-to-end verification via scripts/verify.sh, what each of the Eight Epistemological Gates (G1–G8) checks, and why Ten Negative Defect Proofs (--defect) are required to prove that the gates actually catch and block methodological errors.

14.1 The Philosophy of Positive and Negative Verification

In ordinary software engineering, a test suite checks that valid inputs produce the expected output (positive testing). In an auditable epistemological machine, positive testing alone is never enough.

Suppose a gate is supposed to reject dogmatic $0%$ probabilities or Moulton-Campbell pseudoreplication, but a programmer accidentally wrote if true { return Ok(()); } inside the validator. Every positive test will pass with flying colors! The only way to prove that a gate has genuine refutation power (Deborah Mayo’s Severity Principle, Chapter 7) is to deliberately inject each forbidden methodological pathology into the system and verify that the binary halts and exits with non-zero status code 1.

A single command at the root of the repository runs the complete positive and negative verification suite:

scripts/verify.sh

14.2 The Six Verification Stages of scripts/verify.sh

1. Formatting Check (cargo fmt --all --check): Enforces canonical Rust formatting across all 5 crates.
2. Zero-Warning Static Analysis (cargo clippy --workspace --all-targets -- -D warnings): Rejects any compiler or Clippy lint warning anywhere in library, binary, or test targets.
3. Unit and Integration Tests (cargo test --workspace): Executes all unit tests across stochology-core, stochology-lenses, stochology-siga, stochology-governance, and the end-to-end integration suite in crates/stochology-cli/tests/protocol_integration.rs.
4. The Seven Methodological and Empirical Laboratories (labs):
   • cargo run --release --bin labs -- --all
   • cargo run --release --bin labs -- --layers (Lab 1: Meng, Manski, Jensen, Performativity)
   • cargo run --release --bin labs -- --uncertainty (Lab 2: Kennedy-O’Hagan GP, Info-Gap + Sniedovich)
   • cargo run --release --bin labs -- --lenses (Lab 3: The 5 Lenses, Machine $M=(T,\Phi,\theta)$, and 6-Axis Relational Ontology)
   • cargo run --release --bin labs -- --invariants (Lab 4: $\Phi_1$–$\Phi_5$, Moulton-Campbell, Exceedance, Chouldechova)
   • cargo run --release --bin labs -- --siga (Lab 5: 4-Filter Funnel and 8-Step SIGA on the 3 YAML Cards)
   • cargo run --release --bin labs -- --governance (Lab 6: Bitemporal Clock, Canary, Vault, and 4 Drift Regimes)
   • cargo run --release --bin labs -- --real-data (Lab 7: Transversal Synthesis across all 13 CSVs & 3 YAML Cards)
5. The Eight Epistemological Gates (gates, exit code 0) and Ten Negative Proofs (--defect, exit code 1).
6. Repository Tag Hygiene (git tag --list): Verifies that no git tags pollute the tree.

14.3 The Eight Epistemological Gates (G1 to G8)

When you run cargo run --release --bin gates, the binary executes eight sequential gates:

14.4 The Ten Negative Defect Proofs (--defect)

Each command below injects a targeted methodological defect and must exit with code 1:

15. Empirical Data Sources and Annotated Bibliography

Learning Objectives. By the end of this chapter, you will know the provenance, cryptographic SHA-256 verification, and domain structure of all 13 empirical CSV datasets (data/*.csv), and have a structured guide to the primary scientific literature across philosophy of science, probability, causal inference, extreme value theory, decision theory, and complex systems.

15.1 Provenance and Cryptographic Integrity of the 13 Empirical Datasets

All 13 CSV files in data/*.csv were retrieved from public scientific repositories—the Rdatasets archive (github.com/vincentarelbundock/Rdatasets, commit 1dcc2bf5f955cc1224a3e1307256e1fe86b68dae), CRAN packages (fitdistrplus, nycflights13, nycflights23), NOAA HURDAT2, AEMO Victoria, and Open Data Toronto.

Their exact 64-character SHA-256 digests are recorded in data/SHA256SUMS and verified at runtime by stochology-cli before any laboratory or gate executes:

15.2 Annotated Bibliography by Thematic Pillar

I. Epistemology, Induction, and Severe Testing

• Bernoulli, Jacob (1713). Ars Conjectandi. Basel: Thurnisiorum. — Introduces ars conjectandi sive stochastice, the art of aiming conjectures under uncertainty.
• Peirce, Charles Sanders (1878). “Deduction, Induction, and Hypothesis.” Popular Science Monthly, 13, 470–482. — Separates truth-preserving deduction from ampliative induction and abduction.
• Popper, Karl (1959). The Logic of Scientific Discovery. London: Hutchinson. — Formulates falsificationism and propensity probability.
• Lakatos, Imre (1970). “Falsification and the Methodology of Scientific Research Programmes.” In Criticism and the Growth of Knowledge, Cambridge University Press. — Distinguishes progressive problemshifts (predicting novel testable facts) from degenerative patches.
• Mayo, Deborah G. (2018). Statistical Inference as Severe Testing: How to Get Beyond the Statistics Wars. Cambridge University Press. — Establishes the Severity Principle ($\Phi_3$).
• Simmons, Joseph P., Leif D. Nelson & Uri Simonsohn (2011). “False-Positive Psychology: Undisclosed Flexibility in Data Collection and Analysis Allows Presenting Anything as Significant.” Psychological Science, 22(11), 1359–1366.
• Breznau, Nate et al. (2022). “Observing Many Researchers Using the Same Data and Hypothesis Reveals a Hidden Universe of Uncertainty.” Proceedings of the National Academy of Sciences (PNAS), 119(44), e2203150119.

II. Bridge Mechanics, Missingness, Performativity, and Severe Uncertainty

• Rubin, Donald B. (1976). “Inference and Missing Data.” Biometrika, 63(3), 581–592. — Formalizes MCAR, MAR, and MNAR.
• Meng, Xiao-Li (2018). “Statistical Paradises and Paradoxes in Big Data (I): Law of Large Populations, Big Data Paradox, and the 2016 US Presidential Election.” Annals of Applied Statistics, 12(2), 685–726. — Derives Meng’s Fundamental Identity ($\bar{Y}_n - \bar{Y}_N = \rho_{R,Y}\sqrt{\frac{N-n}{n}}\sigma_Y$).
• Manski, Charles F. (1990). “Nonparametric Bounds on Treatment Effects.” American Economic Review, 80(2), 319–323. — Establishes worst-case identification bounds under MNAR.
• Lee, David S. (2009). “Training, Wages, and Sample Selection: Estimating Sharp Bounds on Treatment Effects.” Review of Economic Studies, 76(3), 1071–1102. — Derives sharp quantile-trimming bounds under monotonic differential attrition (ManskiBounds::lee_trimming_bounds).
• Perdomo, Juan C., Tijana Zrnic, Celestine Mendler-Dünner & Moritz Hardt (2020). “Performative Prediction.” Proceedings of the 37th International Conference on Machine Learning (ICML), PMLR 119:7599–7609. — Formalizes Performative Risk, Performative Stability ($\theta_{\mathrm{PS}}$), Performative Optimality ($\theta_{\mathrm{PO}}$), and RRM contraction.
• Izzo, Zachary, Lexing Ying & James Zou (2021). “How to Learn when Data Reacts to Your Model: Performative Gradient Descent.” Proceedings of the 38th International Conference on Machine Learning (ICML), PMLR 139:4631–4640. — Introduces PerfGD converging to the Stackelberg optimum $\theta_{\mathrm{PO}}$.
• Kennedy, Marc C. & Anthony O’Hagan (2001). “Bayesian Calibration of Computer Models.” Journal of the Royal Statistical Society: Series B, 63(3), 425–464. — Introduces Gaussian Process structural discrepancy $\delta(x) \sim \mathcal{GP}(m(x), k(x, x’))$.
• Brynjarsdóttir, Jenný & Anthony O’Hagan (2014). “Learning About Physical Parameters: The Importance of Model Discrepancy.” Inverse Problems, 30(11), 114007. — Demonstrates boundary-anchored GP kernels for physical parameter identifiability.
• Ben-Haim, Yakov (2006). Info-Gap Decision Theory: Decisions Under Severe Uncertainty (2nd ed.). Academic Press.
• Sniedovich, Moshe (2012). “Black Swans, New Nostradamuses, Voodoo Decision Theories, and the Science of Decision Making in the Face of Severe Uncertainty.” International Transactions in Operational Research, 19(1–2), 253–281. — Proves the local nature of Info-Gap and the necessity of Wald’s global Maximin safeguard across “No-Man’s Land.”

III. The Five Transversal Lenses and the Almost-Perfect Machine

• Blahut, Richard E. (1972). “Computation of Channel Capacity and Rate-Distortion Functions.” IEEE Transactions on Information Theory, 18(4), 460–473; & Arimoto, Suguru (1972). “An Algorithm for Computing the Capacity of Arbitrary Discrete Memoryless Channels.” IEEE Transactions on Information Theory, 18(1), 14–20.
• Raginsky, Maxim (2016). “Strong Data Processing Inequalities and $\Phi$-Sobolev Inequalities for Discrete Channels.” IEEE Transactions on Information Theory, 62(6), 3355–3389.
• Peters, Ole (2019). “The Ergodicity Problem in Economics.” Nature Physics, 15(12), 1216–1221.
• Kelly, John L. Jr. (1956). “A New Interpretation of Information Rate.” Bell System Technical Journal, 35(4), 917–926.
• Hill, Bruce M. (1975). “A Simple General Approach to Inference About the Tail of a Distribution.” Annals of Statistics, 3(5), 1163–1174.
• Dekkers, Arnold L. M., John H. J. Einmahl & Laurens de Haan (1989). “A Moment Estimator for the Index of an Extreme-Value Distribution.” Annals of Statistics, 17(4), 1833–1855.
• Pickands, James (1975). “Statistical Inference Using Extreme Order Statistics.” Annals of Statistics, 3(1), 119–131; & Balkema, A. A. & Laurens de Haan (1974). “Residual Life Time at Great Age.” Annals of Probability, 2(5), 792–804.
• Embrechts, Paul, Claudia Klüppelberg & Thomas Mikosch (1997). Modelling Extremal Events for Insurance and Finance. Berlin: Springer.
• Pearl, Judea (2009). Causality: Models, Reasoning, and Inference (2nd ed.). Cambridge University Press.
• Peters, Jonas, Peter Bühlmann & Nicolai Meinshausen (2016). “Causal Inference by Using Invariant Prediction: Identification and Confidence Intervals.” Journal of the Royal Statistical Society: Series B, 78(5), 947–1012.
• Chow, Gregory C. (1960). “Tests of Equality Between Sets of Coefficients in Two Linear Regressions.” Econometrica, 28(3), 591–605.
• Cinelli, Carlos & Chad Hazlett (2020). “Making Sense of Sensitivity: Extending Omitted Variable Bias.” Journal of the Royal Statistical Society: Series B, 82(1), 39–67.
• Richardson, David S. (2000). “Skill and Relative Economic Value of the ECMWF Ensemble Prediction System.” Quarterly Journal of the Royal Meteorological Society, 126(563), 649–667.
• Dimitriadis, Timo, Tilmann Gneiting & Alexander I. Jordan (2021). “Stable Reliability Diagrams for Probabilistic Classifiers.” Proceedings of the National Academy of Sciences (PNAS), 118(8), e2016191118. — Establishes the isotonic CORP-Murphy decomposition via Pool-Adjacent-Violators (PAV).
• Barron, Andrew R. (1993). “Universal Approximation Bounds for Superpositions of a Sigmoidal Function.” IEEE Transactions on Information Theory, 39(3), 930–945.
• Telgarsky, Matus (2016). “Benefits of Depth in Neural Networks.” Proceedings of the 29th Conference on Learning Theory (COLT), PMLR 49:1517–1539.

IV. Cluster Invariants, Fairness, Funnel, and Drift Governance

• Hurlbert, Stuart H. (1984). “Pseudoreplication and the Design of Ecological Field Experiments.” Ecological Monographs, 54(2), 187–211.
• Moulton, Brent R. (1986). “Random Group Effects and the Precision of Regression Estimates.” Journal of Econometrics, 32(3), 385–397.
• Chouldechova, Alexandra (2017). “Fair Prediction with Disparate Impact: A Study of Bias in Recidivism Prediction Instruments.” Big Data, 5(2), 153–163.
• Kleinberg, Jon, Sendhil Mullainathan & Manish Raghavan (2017). “Inherent Trade-Offs in the Fair Determination of Risk Scores.” Proceedings of the 8th Innovations in Theoretical Computer Science Conference (ITCS), LIPIcs 67:43:1–43:23.
• Gigerenzer, Gerd & Ulrich Hoffrage (1995). “How to Improve Bayesian Reasoning Without Instruction: Frequency Formats.” Psychological Review, 102(4), 684–704.
• Talts, Sean, Michael Betancourt, Daniel Simpson, Aki Vehtari & Andrew Gelman (2018). “Validating Bayesian Inference Algorithms with Simulation-Based Calibration.” arXiv:1804.06788.
• Grünwald, Peter, Rianne de Heide & Wouter M. Koolen (2024). “Safe Testing.” Journal of the Royal Statistical Society: Series B, 86(5), 1091–1128; & Waudby-Smith, Ian & Aaditya Ramdas (2024). “Estimating Means of Bounded Random Variables by Betting.” JRSS: Series B, 86(1), 1–27.
• Lei, Lihua & Emmanuel J. Candès (2021). “Conformal Inference of Counterfactuals and Individual Treatment Effects.” Journal of the Royal Statistical Society: Series B, 83(5), 911–938.
• Gibbs, Isaac & Emmanuel Candès (2021). “Adaptive Conformal Inference Under Distribution Shift.” Advances in Neural Information Processing Systems (NeurIPS), 34, 1660–1672.
• Lipton, Zachary C., Yu-Xiang Wang & Alexander Smola (2018). “Detecting and Correcting for Label Shift with Black Box Predictors.” Proceedings of ICML, PMLR 80:3122–3130.

V. Relational Ontology, Emergence, and Complex Systems

• Nāgārjuna (c. 150 CE / trans. Jay L. Garfield, 1995). The Fundamental Wisdom of the Middle Way: Nāgārjuna’s Mūlamadhyamakakārikā. Oxford University Press.
• Rovelli, Carlo (1996). “Relational Quantum Mechanics.” International Journal of Theoretical Physics, 35(8), 1637–1678.
• Ladyman, James & Don Ross (2007). Every Thing Must Go: Metaphysics Naturalized. Oxford University Press.
• Prigogine, Ilya & René Lefever (1968). “Symmetry Breaking Instabilities in Dissipative Systems. II.” Journal of Chemical Physics, 48(4), 1695–1700.
• Schnakenberg, Jürgen (1976). “Network Theory of Microscopic and Macroscopic Behavior of Master Equation Systems.” Reviews of Modern Physics, 48(4), 571–585.
• Prigogine, Ilya & Isabelle Stengers (1984). Order Out of Chaos: Man’s New Dialogue with Nature. Bantam Books.
• Maturana, Humberto R. & Francisco J. Varela (1980). Autopoiesis and Cognition: The Realization of the Living. D. Reidel.
• Anderson, Philip W. (1972). “More Is Different.” Science, 177(4047), 393–396.
• Schelling, Thomas C. (1971). “Dynamic Models of Segregation.” Journal of Mathematical Sociology, 1(2), 143–186.
• Elias, Norbert (1939 / 2000). The Civilizing Process: Sociogenetic and Psychogenetic Investigations. Blackwell.
• Lewontin, Richard C. (2000). The Triple Helix: Gene, Organism, and Environment. Harvard University Press.
• Watson, Andrew J. & James E. Lovelock (1983). “Biological Homeostasis of the Global Environment: The Parable of Daisyworld.” Tellus B, 35(4), 284–289.
• Mirowski, Philip (1989). More Heat than Light: Economics as Social Physics, Physics as Nature’s Economics. Cambridge University Press.

VI. Empirical Dataset Primary Sources

• LaLonde, Robert J. (1986). “Evaluating the Econometric Evaluations of Training Programs with Experimental Data.” American Economic Review, 76(4), 604–620.
• Dehejia, Rajeev H. & Sadek Wahba (1999). “Causal Effects in Nonexperimental Studies: Reevaluating the Evaluation of Training Programs.” Journal of the American Statistical Association, 94(448), 1053–1062.
• Weinberg, Jonathan, Lawrence D. Brown & Jonathan R. Stroud (2007). “Bayesian Forecasting of an Inhomogeneous Poisson Process With Applications to Call Center Data.” Journal of the American Statistical Association, 102(480), 1185–1198.
• McNeil, Alexander J. (1997). “Estimating the Tails of Loss Severity Distributions Using Extreme Value Theory.” ASTIN Bulletin, 27(1), 117–137.

Appendix — Full Specification

Stochology Protocol: Enriched Methodological Architecture for Judgment and Decision-Making under Uncertainty

This document establishes the consolidated, mathematically formalized specification of the Stochology Protocol for data architecture, stochastic modeling, causal inference, and structured inter-agent communication. It unifies operational decision-making with explicit algorithmic gates for performative prediction, decision theory under severe uncertainty, strong information contraction, tail design effects in unequal clusters, and formal production drift adaptation.

1. Deep Structural Diagnosis: Bridge Mechanics, Severe Uncertainty, and the Five Transversal Lenses

Before fitting any parameter, selecting predictive architectures, or estimating probability distributions, every technical claim, scientific hypothesis, or operational model must auditably answer three structural questions:

1. In which ontological layer can the system fail (World $L_1$, Model $L_2$, or Agent $L_3$)?
2. Which class of uncertainty threatens inference validity (Aleatory, Parametric/Structural Epistemic, or Knightian)?
3. Which severe test — endowed with genuine empirical or logical refutation power — supports the confidence placed in the claim?

1.1. Dynamics of the Three Ontological Layers ($L_1 \to L_2 \to L_3 \to L_1$)

On Bridge $L_3 \to L_1$, when a model parameterized by $\theta \in \Theta$ supports consequential decisions, deploying $\theta$ causally alters the environment and induces $Z = (X, Y) \sim \mathcal{D}(\theta)$. Performance is governed by Performative Risk $\mathrm{PR}(\theta)$ and Decoupled Performative Risk $\mathrm{DPR}(\theta, \phi)$ (Perdomo, Zrnic, Mendler-Dünner & Hardt):

$$\mathrm{PR}(\theta) \triangleq \mathbb{E}_{Z \sim \mathcal{D}(\theta)}[\ell(Z; \theta)], \qquad \mathrm{DPR}(\theta, \phi) \triangleq \mathbb{E}_{Z \sim \mathcal{D}(\theta)}[\ell(Z; \phi)]$$

• Performative Stability ($\theta_{\mathrm{PS}}$): $\theta_{\mathrm{PS}} = \arg\min_{\phi \in \Theta} \mathrm{DPR}(\theta_{\mathrm{PS}}, \phi)$ — fixed point of Repeated Risk Minimization ($\mathrm{RRM}$).
• Performative Optimality ($\theta_{\mathrm{PO}}$): $\theta_{\mathrm{PO}} = \arg\min_{\theta \in \Theta} \mathrm{PR}(\theta)$ — Stackelberg equilibrium anticipating the strategic reaction of the population, attained via Performative Gradient Descent (PerfGD, Izzo, Ying & Zou 2021) along the total performative gradient $\nabla_\theta \mathrm{PR}(\theta) = \nabla_1 \mathrm{DPR}(\theta,\theta) + \nabla_2 \mathrm{DPR}(\theta,\theta)$ (PerformativeSystem::perfgd_trajectory).
• Canonical Linear Benchmark: Under $Y(\theta) = \mu + \varepsilon \theta + \xi$ and loss $\ell(z; \phi) = \frac{\gamma}{2}(y - \phi)^2 - \alpha \phi$, passive learning yields $\theta_{\mathrm{SL}} = \mu + \frac{\alpha}{\gamma}$, retraining converges to $\theta_{\mathrm{PS}} = \frac{\mu + \alpha / \gamma}{1 - \varepsilon}$ (reducing to $\frac{\mu}{1 - \varepsilon}$ when $\alpha = 0$), whereas the true Stackelberg optimum minimizing $\mathrm{PR}(\theta) = \frac{\gamma}{2}[(1 - \varepsilon)\theta - \mu]^2 + \frac{\gamma}{2}\sigma^2 - \alpha\theta$ is $\theta_{\mathrm{PO}} = \frac{\mu}{1 - \varepsilon} + \frac{\alpha}{\gamma(1 - \varepsilon)^2}$. Under Wasserstein-1 sensitivity $W_1(\mathcal{D}(\theta), \mathcal{D}(\theta’)) \le \varepsilon \lVert\theta - \theta’\rVert_2$, $\gamma$-strong convexity, and $\beta$-smoothness, $\mathrm{RRM}$ contracts linearly if and only if $\frac{\varepsilon \beta}{\gamma} < 1$.

1.2. Uncertainty Typing: Kennedy-O’Hagan Discrepancy and Info-Gap + Sniedovich Safeguard

1. Aleatory Uncertainty (aleatory, $L_1$): Irreducible variability; demands safety margins and exposure control.
2. Parametric Epistemic Uncertainty (epistemic_parameter, $L_2$): Reducible ignorance about finite parameters $\theta$; uses Laplace’s rule of succession $\hat{p} = \frac{s+1}{n+2}$ in small samples.
3. Structural Epistemic Uncertainty (epistemic_specification, $L_2$): Formulated via Kennedy-O’Hagan Structural Discrepancy: $$y(x) = \eta(x, \theta) + \delta(x) + \varepsilon, \qquad \delta(x) \sim \mathcal{GP}(m(x), k(x, x’))$$ with anchoring constraints to prevent parameter pseudo-convergence and extrapolation overconfidence, solved via exact Cholesky decomposition $K_y = LL^\top$ and calibrated via Empirical Bayes Type-II maximum marginal likelihood $\log p(y \mid X, \ell, \sigma_\delta)$ (KennedyOHaganDiscrepancy::calibrate_empirical_bayes).
4. Knightian Uncertainty (knightian, $L_3$): Formulated via Info-Gap Decision Theory (Ben-Haim) coupled with Sniedovich’s Global Maximin Safeguard (Wald): $$\hat{\alpha}(q, r_c) = \max\left\lbrace\alpha \ge 0 : \min_{u \in \mathcal{U}(\alpha, \tilde{u})} R(q, u) \ge r_c\right\rbrace, \qquad \hat{\beta}(q, r_w) = \min\left\lbrace\alpha \ge 0 : \max_{u \in \mathcal{U}(\alpha, \tilde{u})} R(q, u) \ge r_w\right\rbrace$$ Enforces the zero-ing property ($\hat{\alpha}(q, R(q, \tilde{u})) = 0$) and requires a global Wald Maximin floor outside $\mathcal{U}(\hat{\alpha}, \tilde{u})$ to prevent catastrophic collapse in “No-Man’s Land”.

1.3. Mathematical Formalism of the Five Transversal Lenses, Almost-Perfect Machine, and Authentic Model Form

1. Lens 1 — Information (stochology_lenses::information):
   • Data Processing Inequality ($I(W; Z) \le I(W; Y) \le I(W; X)$ across a 3-step Markov chain $W \to X \to Y \to Z$ via DpiMarkovChain), exact Blahut-Arimoto channel capacity $C(W) = \max_{p(x)} I(X; Y)$ (blahut_arimoto_capacity), empirical transition matrix estimation with Laplace smoothing (estimate_empirical_channel), and Strong Data Processing Inequality (SDPI) contraction hierarchy: $$\eta_{\chi^2}(W) = \rho_m^2(X; Y) \le \eta_{\mathrm{KL}}(W) \le \eta_{\mathrm{TV}}(W)$$
   • Fano’s Error Floor: $H(P_e) + P_e \ln(|\mathcal{W}| - 1) \ge H(W) - I(W; Z)$.
   • Meng’s Fundamental Identity: $\bar{Y}_n - \bar{Y}_N = \rho_{R,Y} \times \sqrt{\frac{N-n}{n}} \times \sigma_Y$.
2. Lens 2 — Time (stochology_lenses::time):
   • Itô Variance Drain: $g_{\text{time}} = \mu - \frac{1}{2}\sigma^2 < \mu = g_{\text{ensemble}}$.
   • Optimal Asymmetric Kelly Fraction $f^{\ast} = \frac{p}{a} - \frac{1 - p}{b}$ and continuous-return Empirical Kelly Optimal Leverage $f^{\ast}_{\mathrm{emp}} = \arg\max_f \frac{1}{T}\sum_{t=1}^T \ln(1 + f R_t)$ via damped Newton-Raphson (empirical_kelly_optimal_fraction), quantifying skewness/kurtosis over-betting penalty relative to the Gaussian Merton ratio $f_{\mathrm{Merton}} = \hat{\mu}/\hat{\sigma}^2$.
   • Heavy-Tailed Mixing Time under Log-Sobolev Inequality ($\alpha_{\mathrm{LSI}} = -\frac{1}{2}\ln \eta_{\mathrm{KL}}$) and tail mass $H_R$.
3. Lens 3 — Scale and Tail (stochology_lenses::tail):
   • Hill Estimator $\hat{\alpha}_{k,n} = \left(\frac{1}{k}\sum_{i=1}^k \ln \frac{X_{(n-i+1)}}{X_{(n-k)}}\right)^{-1}$, moment regimes ($\alpha \le 1$, $1 < \alpha \le 2$, $\alpha > 2$), Dekkers-Einmahl-de Haan (1989) Moment Tail Index $\hat{\xi}_{\mathrm{DEdH}} = M_{k,n}^{(1)} + 1 - \frac{1}{2}\bigl(1 - (M_{k,n}^{(1)})^2 / M_{k,n}^{(2)}\bigr)^{-1} \in \mathbb{R}$ (dedh_moment_tail_index), Pickands-Balkema-de Haan Peaks-Over-Threshold GPD via Hosking-Wallis probability-weighted moments (gpd_pot_fit), and Expected Shortfall ($\mathrm{ES}_{0.99} / \mathrm{CVaR}_{0.99}$) (expected_shortfall_99).
4. Lens 4 — Structure and Invariance (stochology_lenses::invariance):
   • Pearl’s Causal Ladder (1-See, 2-Act, 3-Imagine), Invariant Causal Prediction ($\hat{S}^{\ast} = \bigcap_{S:\text{invariant}} S$), environment OLS invariance penalty (env_ols_invariance_penalties), Chow (1960) Structural Break $F$-Statistic across environments (chow_invariance_f_stat), nonlinear ICP and NILE/IRM risk-gradient penalty over the 3-atom orthonormal Hermite basis $\Phi(z) = \bigl[z, \frac{z^2-1}{\sqrt{2}}, \frac{z^3-3z}{\sqrt{6}}\bigr]$ (run_nonlinear_icp_nile), 2nd-order worst-case loss, Rosenbaum’s $\Lambda^{\ast}$, and Cinelli & Hazlett (2020) Omitted-Variable Bias Robustness Value ($RV_q$) (cinelli_hazlett_robustness_value).
5. Lens 5 — Decision and Calibration (stochology_lenses::decision):
   • Cost-Loss Boundary $p > p^{\ast} \triangleq \frac{C}{\eta L}$, Expected Value of Perfect Information ($\mathrm{EVPI}$), Richardson (2000) Relative Economic Value $V(p^{\ast}) = \frac{E_{\text{climate}} - E_{\text{forecast}}}{E_{\text{climate}} - E_{\text{perfect}}}$ (CostLossRule::relative_economic_value), and Logarithmic (Ignorance) Score with Cromwell floor (logarithmic_score).
   • Exact Isotonic CORP-Murphy Decomposition via Pool-Adjacent-Violators (PAV): $$\mathrm{BS} = \mathrm{REL}_{\mathrm{CORP}} - \mathrm{RES}_{\mathrm{CORP}} + \mathrm{UNC}_0$$
   • Exact Fair-Coin Calibration vs. Decision Benchmark (ExactCoinCalibrationBenchmark, $p_0 = 0.50$), proving that decision agreement at a fixed threshold $p^{\ast}_A$ does not imply calibrated probabilities when the threshold shifts to $p^{\ast}_B$.
6. Almost-Perfect Machine and First-Class Authentic Model Form (stochology_lenses::machine):
   • $(\varepsilon, \delta)$-Almost-Perfect Machine $M = (T, \Phi, \theta)$ (AlmostPerfectMachine): Audits (P1) universal Barron density ($\sup_x |M(x) - f(x)| \le \varepsilon$ and $L_2^2 \le C_f^2 / W$), (P2) informational $\delta$-sufficiency ($\Delta_{\mathrm{DPI}} = I(W; X) - I(W; T(X)) \le \delta$ and valid SDPI hierarchy), (P3) Fano/minimax rate optimality ($0.25 \le \mathrm{MSE} / (\sigma^2 W / n) \le 2.5$ and $P_e^{\min} > 0$), (P4) Telgarsky depth-$D$ compositional efficiency ($2^D$ affine linear regions with $2^D / (2D) \ge 4.0$), and (P5) atomic completeness (Gram effective dimension $d_{\mathrm{eff}} = \frac{(\mathrm{tr} G)^2}{\lVert G\rVert_F^2} \ge 0.80 W$ and off-diagonal coherence $< 0.15$).
   • First-Class Authentic Model Form (AuthenticModelForm, $\delta(x) + \hat{S}^{\ast}$): Pairs the surviving invariant causal core $\hat{S}^{\ast}$ with an anchored Kennedy-O’Hagan GP discrepancy $\delta(x) \sim \mathcal{GP}(0, k_{\text{anchored}})$, explicitly named discarded spurious atoms (DiscardedAtomRecord), simultaneous closure of the 6 exact numerical identities (IdentityClosureAudit: Jensen, CORP-Murphy, Meng, SHA-256 pre-registration, Wald Maximin, and Findings accounting), and the 5-part operational authenticity criterion $A(\text{model})$ (AuthenticityCriterionA), enforced by Gate G8 and --defect machine.
7. Relational Ontology and Complex Systems (stochology_lenses::relational):
   • Formalizes the 6-axis transdisciplinary synthesis (RelationalComplexSystemsSynthesis): (Axis 1 & 4) relational vacuity (Śūnyatā / RQM / OSR, $I_{\text{isolated}} \to 0$ vs. $I_{\text{relational}} > 0$) and Homo clausus vs. Homines aperti figuration audit (RelationalFigurationAudit); (Axis 2) Prigogine Brusselator RK4 open-system dissipative entropy balance $dS = d_i S + d_e S \le 0$ with Schnakenberg (1976) microscopic entropy production $\frac{d_i S}{dt} = \sum_\rho (J_\rho^+ - J_\rho^-)\ln(J_\rho^+/J_\rho^-) > 0$ and Maturana-Varela autopoietic organizational closure (DissipativeAutopoieticAudit); (Axis 3) heteropathic emergence (More Is Different) and Thomas Schelling’s (1971) 2D dynamic segregation phase transition (SchellingSegregationModel, SchellingPhaseTransitionAudit); (Axis 5) Andrew Watson & James Lovelock’s (1983) Daisyworld planetary cybernetic homeostasis integrated via 4th-order Runge-Kutta (DaisyworldSystem, DaisyworldHomeostasisAudit); and (Axis 6) the 6-layer Ontological Stack (Morin, Mirowski, Arthur, Beinhocker), audited in Lab 3 (labs --lenses) and Gate G8.
   • Audited numeric thresholds (seed = 2026): Axis 1&4 — $I_{\text{rel}} > 0.30$ nats vs. $I_{\text{iso}} < 0.005$ nats, Moulton-Campbell $\mathrm{DEFF} = 5.81\times$, Stackelberg $\theta_{\mathrm{PO}} > \theta_{\mathrm{PS}}$; Axis 2 — Brusselator RK4 + Schnakenberg dissipative entropy balance $d_i S = +4.47,\ d_e S = -5.02 \Rightarrow dS = -0.55 \le 0$, material turnover $>99.9%$, autopoietic fidelity $>99.9%$; Axis 3 — Schelling phase transition $\tau = 0.125 \to$ integrated ($<60%$) vs. $\tau = 0.375 \to$ segregation cascade ($\ge 78%$), emergent gap $\Delta_{\text{emerg}} > 0.38$; Axis 5 — Daisyworld RK4 homeostasis $\approx 22.5 ^\circ\mathrm{C}$ ($\mathrm{MAE} = 1.52 ^\circ\mathrm{C} < 3.0 ^\circ\mathrm{C}$ with biosphere vs. $9.57 ^\circ\mathrm{C}$ dead planet), $dT_e/dL = -11.93 \le 0$ in coexistence, extinction at $L = 1.60$; Axis 6 — all_six_axes_verified == true.
   • 6-layer Ontological Stack (substancialist vs. relational): (1) physics/metaphysics — atomism + svabhāva vs. Śūnyatā/RQM/OSR; (2) thermodynamics/time — closed static equilibrium vs. block-universe/Uji + dissipative-autopoietic; (3) biology/ecology — unilateral adaptation vs. Lewontin co-evolution + Daisyworld homeostasis; (4) psychology — Homo clausus vs. bundle-theory/Anattā/Homines aperti; (5) sociology/emergence — methodological individualism vs. More is Different + duality of structure; (6) political economy/epistemology — neoclassical equilibrium vs. complexity economics + complex thought.

2. Structured Communication Contract, Prohibitions, and Boundary Invariants

2.1. The Four Prohibitions

• Prohibition 1: Ban on unstructured free prose between modules/agents; all claims transit via EpistemologicalCard (cards/*.yaml).
• Prohibition 2: Ban on the lone mean under nonlinearity or heavy tails; mandatory reporting of $f(\mathbb{E}[X]), \mathbb{E}[f(X)], \Delta_J, \text{median}, q_{05}, q_{95}, \mathrm{CRPS}$.
• Prohibition 3: Ban on confusing predictive fit with causal/performative validity; mandatory audit of $\theta_{\mathrm{PS}}$ vs. $\theta_{\mathrm{PO}}$ and $\frac{\varepsilon\beta}{\gamma} < 1$.
• Prohibition 4: Ban on dogmatic extremes ($0%$ or $100%$, Cromwell’s Rule $p \in [\varepsilon_{\text{floor}}, 1 - \varepsilon_{\text{floor}}]$) and omitted attempts ($K \ge 1$, e-process $E_t$, and CORP-Murphy decomposition).

2.2. The Five Boundary Invariants ($\Phi_1$ to $\Phi_5$)

• $\Phi_1$ (Simulability): Fixed seed (seed = 2026, SplitMix64 with uniform, normal, exponential, Marsaglia-Tsang Gamma, Beta, Student-$t$, and Poisson samplers, Welford-Terriberry 4th-order OnlineMoments, and block bootstrap block_bootstrap_ci) and executable generative null model.
• $\Phi_2$ (Independent Unit & Exceedance Design Effect): Moulton-Campbell unequal-cluster correction $\tilde{m} = \bar{m}(1 + \mathrm{CV}^2(m_j))$, threshold exceedance ICC $\rho_I(p)$, $n_{\mathrm{eff}}(p) = \frac{n}{1 + (\tilde{m} - 1)\rho_I(p)}$, and multi-quantile exceedance profiles (ExceedanceDesignEffect::profile_across_quantiles).
• $\Phi_3$ (Severe Test & Missingness): Rubin classification (MCAR, MAR, MNAR), SHA-256 and RFC 2104 HMAC-SHA256 pre-registration seal, and Pearl’s Ladder rung.
• $\Phi_4$ (Scope, Fairness & Exit): Chouldechova’s binary algebraic impossibility identity $\mathrm{FPR}_g = \frac{p_g}{1-p_g}\frac{1-\mathrm{PPV}_g}{\mathrm{PPV}_g}(1-\mathrm{FNR}_g)$, Kleinberg-Mullainathan-Raghavan (KMR 2017) continuous score impossibility gap $\mathrm{Var}_g(S) = p_g(1 - p_g)(m_{g,+} - m_{g,-})$ (ChouldechovaAudit::kmr_continuous_impossibility_gap), scope statement, and numeric exit clause.
• $\Phi_5$ (Question Resolution): Ban on answering daily/shift operational decisions with coarse annual/monthly aggregates.

2.3. Epistemological Card Schema (EpistemologicalCard)

Every claim is serialized in YAML (cards/*.yaml) and validated by EpistemologicalCard::audit(), carrying top-level scalars (id, layer, uncertainty) and five structured sections:

• decision_maker_question: who_decides, altered_action, and question (ending in '?').
• epistemological_header: generating_process, nonlinearity ($f(\mathbb{E}[X]), \mathbb{E}[f(X)], \Delta_J, \text{median}, q_{05}, q_{95}, \mathrm{CRPS}$), unit_and_margin (independent_unit, nominal_sample_size_n, weighted_cluster_mean_m_tilde, threshold_exceedance_icc, effective_sample_size_n_eff, unit_margin_of_error), noise_physics (stochastic_regime, absorbing_states, bridge_L3_L1_performativity), and causal_ladder (pearl_rung, identification_strategy, untestable_assumption).
• uncertainty_budget_and_authorship: variance_budget (inputs, parameters, covariance, structural_discrepancy_gp), dominant_event (description, probability_p, base_rate_floor_epsilon, cost_share), info_gap_robustness (critical_requirement_rc, robustness_horizon_alpha_hat, opportuneness_horizon_beta_hat, global_maximin_safeguard), and field_authorship (null_model, decision_rule, adversarial_reviewer).
• data_and_audit_contract: dataset_path, dataset_sha256 (64-char SHA-256 verified against data/SHA256SUMS), missingness_mechanism, seed_and_environment, null_model, preregistration_hash (64-char SHA-256 over pre-analysis design payload), attempt_counter_K, e_process_multiplicity, murphy_corp_decomposition (total_score_brier_or_crps, miscalibration_REL_MCB, resolution_RES_DSC, base_uncertainty_UNC0), and findings (registered, used, unused).
• decision_rule_and_scope: event_probability_p, base_rate_floor_epsilon, protection_cost_C, event_loss_L, mitigation_efficacy_eta, critical_threshold_p_star, declared_act, scope_statement, who_pays_for_error (Chouldechova audit), and exit_clause.

3. Eliminatory Funnel and 8-Step SIGA Operational Roadmap

3.1. The 4 Eliminatory Filters (stochology_siga::funnel)

Evaluated in strict sequence with immediate short-circuiting on failure:

1. Filter 1 (Economic & Resolution): Requires $\mathrm{EVPI} > C_{\text{total}} \ge 0$, non-degenerate $p^\ast = \frac{C}{\eta L} \in (0, 1)$, and $\Phi_5$ temporal resolution alignment ($R_{\text{data}} \ge R_{\text{decision}}$).
2. Filter 2 (Cluster Independence & Causal Structure): Requires Moulton-Campbell tail-exceedance effective sample size $n_{\mathrm{eff}}(p) \ge n_{\min}$, mapped Markov Blanket, and zero conditioning on a Berkson collider.
3. Filter 3 (Simulation-Based Calibration & Elicitation): Requires Simulation-Based Calibration (SBC) rank uniformity ($\chi^2 \le \chi^2_{\text{crit}}$), SHELF quartile consistency ($L_{\text{phys}} < q_{25} < q_{50} < q_{75} < U_{\text{phys}}$), and parametric $\mathrm{Beta}(\hat{\alpha}, \hat{\beta})$ prior calibration via Lanczos log-Gamma and Lentz continued-fraction regularized incomplete Beta (fit_shelf_beta_prior).
4. Filter 4 (Pre-Registration, Cross-Authorship & Exit): Requires valid 64-character lowercase SHA-256 pre-registration hash, distinct modeler and verifier IDs, and an explicit numeric exit clause.

3.2. The 8-Step SIGA Roadmap, Evidence Processes, and Natural Frequencies (stochology_siga::roadmap)

• 8-Step SIGA Execution: Executes Survey the Layer & Bridge (Steps 1–2), Interrogate the Decision-Maker (Steps 3–4), Generate the Null & Noise Physics (Steps 5–6), and Act with Threshold, Memory & Exit (Steps 7–8).
• Anytime-Valid Evidence Process (e-process): Computes $E_t = \prod_{i=1}^t L_i$ as well as non-parametric predictable GRAPA Kelly betting martingales $E_t = \prod_{i=1}^t \bigl(1 + \lambda_i(X_i - \mu_0)\bigr)$ (EvidenceProcess::from_grapa_betting, Grünwald, de Heide & Koolen 2024; Waudby-Smith & Ramdas 2024) with optional Ville’s inequality threshold $E_t / K \ge 1 / \alpha$.
• Gigerenzer Natural Frequencies: Translates prevalence, sensitivity, and false-positive rate into integer natural trees ($N = 1000$ or $10000$) to eliminate base-rate neglect.

4. Bitemporal Production Governance, Vault, and Drift Adaptation

4.1. Bitemporal Clock, Synthetic Canary, and Single-Opening Vault (stochology_governance::{clock, vault})

• Bitemporal Asymmetry ($t_{\text{disp}} \ge t_{\text{ev}}$): Filters feature records strictly by system availability timestamp $t_{\text{disp}} \le \tau$ rather than event timestamp $t_{\text{ev}}$, and injects a high-cardinality synthetic canary column ($I(\text{Canary}; Y) = 0$) whose non-zero importance triggers an immediate look-ahead intrusion alarm.
• Single-Opening Temporal Vault (TemporalVault): Enforces a cryptographic SHA-256 pre-registration seal (re-verified at opening time with VaultError::SealTampered on payload mutation) and an immutable single-opening lock (opened_count: 0 -> 1). Any non-positive confirmation outcome automatically downgrades the study to ExploratoryHypothesisGenerating, and any second opening attempt is blocked.

4.2. Murphy-CORP Circuit Breaker, Covariate Drift (ExTRA-WCP-T), Online ACI, and Label Shift (stochology_governance::drift)

• Murphy-CORP Circuit Breaker: Separates pure Covariate/Target Shift ($\Delta\mathrm{REL}_{\mathrm{CORP}} > \tau_{\mathrm{REL}}, \Delta\mathrm{RES}_{\mathrm{CORP}} \approx 0$) from Concept Drift ($\Delta\mathrm{RES}_{\mathrm{CORP}} < -\tau_{\mathrm{RES}}$), halting automated predictions under concept breakdown.
• Covariate Drift Adaptation (ExTRA-WCP-T) & Online Adaptive Conformal Inference (AdaptiveConformalInference): Fits exponential tilt density ratios $\hat{w}(x) = \exp(\hat{\theta}^\top \phi(x) - \hat{\psi})$ for weighted conformal intervals with Lei & Candès coverage lower bound $1 - \alpha - d_{\mathrm{TV}}(P_X, Q_X)$, and adapts threshold quantiles online under non-exchangeable time series via Gibbs & Candès (2021) $\alpha_{t+1} = \alpha_t + \gamma(\alpha - \mathrm{err}_t)$.
• Label Shift Adaptation (4 Canonical Estimators): Simultaneously estimates target class priors $q_Y$ via BBSE ($q = C^{-1}\mu$), MLLS/SLD (EM fixed point), DFM (characteristic-function kernel matching with condition number $\kappa(M)$), and OTTER (Sinkhorn-Knopp optimal transport scaling with golden-section sub-grid refinement).

5. Module 7 & Lab 7 (labs --real-data): Transversal Real-Data Synthesis Across All 13 Empirical Datasets and 3 Canonical Cards

Module 7 (cargo run --release --bin labs -- --real-data) consolidates end-to-end empirical verification across all 13 real datasets (data/*.csv) and 3 canonical Epistemological Cards (cards/*.yaml):

6. Architectural Mapping to Rust Crates