Stratified Relational Workspace Theory

Download original file

This is the original TeX manuscript source. Use the paper’s PDF for typeset equations.

Read the typeset paper

1 % This file is part of the modular source for Stratified Relational Workspace Theory.
2 % !TeX root = ../Stratified_Relational_Workspace_Theory.tex
3 \theorypart{XVIII}{Specification Robustness, Identifiability, and Statistical Certification}
4 
5 A workspace certificate is never evaluated in a vacuum. It is evaluated for a
6 particular future variable, loss, time horizon, intervention family, null
7 panel, threshold vector, and system decomposition. These choices determine
8 which distinctions matter and which capacities count as successful. They are
9 therefore part of the scientific claim rather than clerical details surrounding
10 it.
11 
12 This dependence has two consequences. First, a result that passes under one
13 reasonable analysis can fail under another. Robustness must be assessed across
14 a declared family of scientifically defensible alternatives. Second, even a
15 fully specified claim may not be identifiable from the observations and
16 interventions that are actually available. Distinct realizations can induce the
17 same experimental law while disagreeing about whether a relational workspace
18 exists. The theory must say when such disagreement can be resolved, when only
19 bounds are justified, and how sampling uncertainty compounds these structural
20 ambiguities.
21 
22 \topic{61}{The Complete Scientific Specification}
23 
24 \begin{definition}[Workspace specification]\label{def:workspace-specification}
25 A workspace specification is a tuple
26 \[
27 \boxed{
28 \varsigma
29 =
30 \bigl(
31 \mathcal D,
32 Y^+,
33 \ell,
34 \tau,
35 \mathcal I,
36 \mathcal N,
37 \Theta
38 \bigr),
39 }
40 \]
41 where:
42 \begin{itemize}
43 \item \(\mathcal D\) is the decomposition and local-access model;
44 \item \(Y^+\) is the declared future variable or trajectory;
45 \item \(\ell\) is the normalized loss or utility convention;
46 \item \(\tau\) is the temporal horizon or horizon family;
47 \item \(\mathcal I\) is the feasible intervention family;
48 \item \(\mathcal N\) is the required matched-null family; and
49 \item \(\Theta\) is the gate schema, direction, threshold, and indifference
50  region used for certification.
51 \end{itemize}
52 The complete certificate is written
53 \[
54 \operatorname{Cert}(W;\varsigma)
55 =
56 \bigwedge_{q\in\mathcal J(\varsigma)}
57 \mathbf 1\{m_q(W;\varsigma)>0\},
58 \]
59 where \(m_q\) is the signed margin of gate \(q\). Positive margin means that
60 that gate passes in the direction declared by \(\Theta\).
61 \end{definition}
62 
63 The notation absorbs lower-bounded and upper-bounded gates into one sign
64 convention. If a causal effect must exceed \(c_0\), then
65 \[
66 m_q=\widehat\eta-c_0.
67 \]
68 If a defect must remain below \(\varepsilon_0\), then
69 \[
70 m_q=\varepsilon_0-\widehat\delta.
71 \]
72 The complete certificate therefore passes exactly when every required signed
73 margin is positive.
74 
75 The specification does not include arbitrary features of the analysis. It
76 contains choices that alter the meaning or evidential force of the claim. An
77 optimization algorithm, numerical tolerance, or estimator belongs in the
78 estimation protocol unless changing it changes the target estimand or the
79 admissible interventions. Conversely, the target, horizon, and null family
80 cannot be treated as implementation details because changing them can reverse
81 the conclusion without changing the underlying realization.
82 
83 \subtopic{61.1 Specification relativity is not unrestricted relativism}
84 
85 A theorem-development workspace may be operationally real for a month-long
86 research trajectory and irrelevant for a ten-second motor-control target. A
87 repair channel may preserve theorem identity while failing to preserve social
88 coordination. These are different scientific claims. The theory does not
89 require one workspace state to be sufficient for every possible future or loss.
90 It requires the intended scope to be declared before certification.
91 
92 This yields the more precise notation
93 \[
94 \boxed{
95 \SRW(W;\varsigma)=1.
96 }
97 \]
98 The earlier expression \(\SRW_\Theta(W;\mathcal D)\) is the special case in
99 which the remaining coordinates of \(\varsigma\) are held fixed.
100 
101 \subtopic{61.2 Inert reparameterization and substantive change}
102 
103 Some changes of specification merely recode the same claim. Others change its
104 content. The distinction is analogous to gauge freedom in the structural
105 theory.
106 
107 \begin{definition}[Specification equivalence]\label{def:spec-equivalence}
108 Two specifications \(\varsigma\) and \(\varsigma'\) are equivalent, written
109 \(\varsigma\simeq_{\mathrm{spec}}\varsigma'\), when there are bijective
110 transport maps that:
111 \begin{enumerate}
112 \item preserve the sigma-field generated by the future target;
113 \item preserve the ordering and normalization of decisions under the loss;
114 \item map feasible interventions to physically equivalent interventions;
115 \item map every required null to a null preserving the same quantities; and
116 \item carry every gate threshold and margin into its counterpart.
117 \end{enumerate}
118 \end{definition}
119 
120 \begin{proposition}[Certificate invariance under specification equivalence]
121 \label{prop:spec-equivalence-invariance}
122 If \(\varsigma\simeq_{\mathrm{spec}}\varsigma'\) and \(\Phi\) is the induced
123 workspace correspondence, then
124 \[
125 \operatorname{Cert}(W;\varsigma)
126 =
127 \operatorname{Cert}(\Phi W;\varsigma').
128 \]
129 \end{proposition}
130 
131 \begin{proof}
132 Every required gate is carried to a gate with the same signed margin. The
133 conjunction of positive margins is therefore unchanged.
134 \end{proof}
135 
136 A bijective relabeling of target classes with the correspondingly transported
137 loss is inert. Replacing exact theorem validity with stylistic similarity is
138 not. Changing a one-step horizon to a year-long persistence horizon is not.
139 Removing the null that tests hidden centralization is not. Robustness concerns
140 substantive alternatives after equivalent recodings have been quotiented out.
141 
142 \subtopic{61.3 Admissible specification families}
143 
144 \begin{definition}[Admissible specification family]
145 \label{def:admissible-spec-family}
146 An admissible specification family \(\mathfrak S\) is a predeclared set of
147 specifications that:
148 \begin{enumerate}
149 \item refer to the same scientific claim type and carrier presentation;
150 \item use targets that are equivalent operationalizations or explicitly
151  declared nearby stress targets;
152 \item normalize losses so that margins are comparable;
153 \item use horizons justified by the process being studied;
154 \item include every feasible intervention and null needed to distinguish the
155  principal alternative explanations;
156 \item use thresholds fixed without access to certification outcomes; and
157 \item exclude only alternatives for reasons stated before evaluation.
158 \end{enumerate}
159 \end{definition}
160 
161 The family should not contain every imaginable analysis. Such a requirement
162 would erase meaningful domain specificity. It should contain the alternatives
163 that a technically informed critic could reasonably regard as equally valid or
164 as necessary stress tests for the declared claim. Multiverse and specification-
165 curve methods formalize related concerns in empirical analysis
166 \cite{SteegenEtAl2016,SimonsohnEtAl2020}, while sensitivity analysis and
167 partial identification emphasize that conclusions should expose their
168 assumption dependence rather than conceal it \cite{Leamer1983,Manski2003}.
169 
170 Three classes should be reported separately:
171 \begin{description}
172 \item[Equivalent alternatives.] Different encodings or estimators of the same
173  estimand after appropriate transport.
174 \item[Robustness alternatives.] Scientifically defensible choices intended to
175  support the same claim.
176 \item[Scope alternatives.] Genuinely different targets or domains that define
177  different claims and should not be averaged into one robustness number.
178 \end{description}
179 
180 \subtopic{61.4 Common gate schema}
181 
182 A robustness family must use a common semantic gate index
183 \(\mathcal J_*\). A specification may mark a gate as not required only when the
184 claim level itself does not include that property. It may not remove a failed
185 gate after observing the result. Let
186 \[
187 \mathcal J(\varsigma)\subseteq\mathcal J_*
188 \]
189 be fixed before certification. For a family intended to support one fixed
190 claim level, the cleanest design uses
191 \[
192 \mathcal J(\varsigma)=\mathcal J_*
193 \qquad
194 (\varsigma\in\mathfrak S).
195 \]
196 This prevents apparent robustness from being created by silently changing the
197 meaning of passage across the family.
198 
199 \topic{62}{Robustness Across Admissible Specifications}
200 
201 For each gate \(q\in\mathcal J_*\), define the specification envelope
202 \[
203 \boxed{
204 \underline m_q^{\mathfrak S}(W)
205 =
206 \inf_{\varsigma\in\mathfrak S}m_q(W;\varsigma),
207 \qquad
208 \overline m_q^{\mathfrak S}(W)
209 =
210 \sup_{\varsigma\in\mathfrak S}m_q(W;\varsigma).
211 }
212 \]
213 Its sensitivity width is
214 \[
215 \Delta_q^{\mathrm{spec}}(W)
216 =
217 \overline m_q^{\mathfrak S}(W)
218 -
219 \underline m_q^{\mathfrak S}(W).
220 \]
221 The robust certificate margin is
222 \[
223 \boxed{
224 r_{\mathfrak S}(W)
225 =
226 \inf_{\varsigma\in\mathfrak S}
227 \min_{q\in\mathcal J_*}m_q(W;\varsigma).
228 }
229 \]
230 Then
231 \[
232 \operatorname{Cert}_{\mathfrak S}(W)=1
233 \quad\Longleftrightarrow\quad
234 r_{\mathfrak S}(W)>0.
235 \]
236 
237 \begin{definition}[Specification-specific, robust, and fragile claims]
238 A claim is:
239 \begin{description}
240 \item[Specification-specific] when it is asserted only for one declared
241  \(\varsigma_0\).
242 \item[Specification-robust] when every required gate has positive lower
243  envelope across \(\mathfrak S\).
244 \item[Specification-fragile] when it passes for at least one admissible
245  specification and fails for at least one other.
246 \end{description}
247 \end{definition}
248 
249 A high fraction of passing specifications is informative but does not replace
250 the lower envelope when the claim is universal over \(\mathfrak S\). A family
251 in which ninety-nine analyses pass and one scientifically decisive hidden-
252 controller null fails does not support the complete relational certificate.
253 The noncompensatory logic remains in force at the specification level.
254 
255 \subtopic{62.1 Geometry of a specification family}
256 
257 Let \(d_{\mathfrak S}\) be a declared extended pseudometric on the quotient of
258 \(\mathfrak S\) by specification equivalence. A convenient decomposition is
259 \[
260 \begin{aligned}
261 d_{\mathfrak S}(\varsigma,\varsigma')
262 ={}&
263  w_Dd_D(\mathcal D,\mathcal D')
264 +w_Yd_Y(Y^+,Y^{+'})
265 +w_\ell d_\ell(\ell,\ell')\\
266 &+w_\tau d_\tau(\tau,\tau')
267 +w_Id_I(\mathcal I,\mathcal I')
268 +w_Nd_N(\mathcal N,\mathcal N')
269 +w_\Theta d_\Theta(\Theta,\Theta').
270 \end{aligned}
271 \]
272 No universal metric is imposed. The target term may use a divergence between
273 conditional laws under a declared coupling. The intervention and null terms
274 may use Hausdorff distances between implemented kernels. Threshold terms must
275 be expressed on normalized signed-margin scales. The metric is part of the
276 audit and should be varied in sensitivity analysis when more than one
277 scientifically defensible choice exists.
278 
279 For a reference specification \(\varsigma_0\), define the distance to
280 certificate failure by
281 \[
282 \boxed{
283 r_{\mathrm{spec}}(W;\varsigma_0)
284 =
285 \inf\left\{
286  d_{\mathfrak S}(\varsigma,\varsigma_0):
287  \min_q m_q(W;\varsigma)\leq0
288 \right\}.
289 }
290 \]
291 If no failing specification exists in the declared universe, the radius is
292 infinite relative to that universe. A radius near zero means that a small
293 scientifically defensible change can reverse the conclusion.
294 
295 \subtopic{62.2 Specification transport}
296 
297 Changing the decomposition can alter the coordinate realization of the
298 workspace, while changing the target or horizon can alter the relevant
299 predictive state. Let
300 \[
301 \Phi_{\varsigma}:W_{\varsigma_0}\longrightarrow W_{\varsigma}
302 \]
303 be the declared correspondence when such transport is needed. For each gate,
304 assume a bound
305 \[
306 \left|
307  m_q(\Phi_{\varsigma}W;\varsigma)
308  -m_q(W;\varsigma_0)
309 \right|
310 \leq
311 L_qd_{\mathfrak S}(\varsigma,\varsigma_0)
312 +b_q(\varsigma),
313 \]
314 where \(b_q\) records mismatch not represented by the metric. The mismatch may
315 include a change of model class, imperfect target coupling, or an intervention
316 whose implementation cannot be transported exactly.
317 
318 \subtopic{62.3 \(T_{28}\): Specification-transport robustness theorem}
319 
320 \begin{theorem}[Specification-transport robustness]
321 \label{thm:specification-transport}
322 Let \(\mathfrak S\) be an admissible specification family with reference
323 \(\varsigma_0\). Suppose every required gate satisfies the transport bound
324 above. If
325 \[
326 \boxed{
327  m_q(W;\varsigma_0)
328 >
329 \sup_{\varsigma\in\mathfrak S}
330 \left[
331 L_qd_{\mathfrak S}(\varsigma,\varsigma_0)
332 +b_q(\varsigma)
333 \right]
334 }
335 \]
336 for every \(q\in\mathcal J_*\), then
337 \[
338 \operatorname{Cert}(\Phi_{\varsigma}W;\varsigma)=1
339 \qquad
340 \text{for every }\varsigma\in\mathfrak S.
341 \]
342 If \(b_q\equiv0\), then
343 \[
344 \boxed{
345 r_{\mathrm{spec}}(W;\varsigma_0)
346 \geq
347 \min_{q:L_q>0}
348 \frac{m_q(W;\varsigma_0)}{L_q}.
349 }
350 \]
351 \end{theorem}
352 
353 \begin{proof}
354 For each \(\varsigma\in\mathfrak S\),
355 \[
356 m_q(\Phi_{\varsigma}W;\varsigma)
357 \geq
358 m_q(W;\varsigma_0)
359 -L_qd_{\mathfrak S}(\varsigma,\varsigma_0)
360 -b_q(\varsigma).
361 \]
362 The hypothesis makes the right-hand side positive uniformly over the family.
363 Every required gate therefore passes under every admissible specification.
364 When \(b_q=0\), no gate can cross zero at a distance smaller than its reference
365 margin divided by its Lipschitz constant. Taking the minimum over gates gives
366 the radius bound.
367 \end{proof}
368 
369 The theorem is deliberately gatewise. A large structural margin cannot absorb
370 a fragile causal margin. It also clarifies the relation to Part~XVII. The
371 decomposition-transport theorem is recovered by varying only the
372 \(\mathcal D\) coordinate while holding the remaining coordinates fixed.
373 
374 \subtopic{62.4 A three-budget sufficient condition}
375 
376 In practice, the reference margin is reduced by three distinct uncertainty
377 budgets:
378 \[
379 \boxed{
380 B_q^{\mathrm{total}}
381 =
382 B_q^{\mathrm{model}}
383 +B_q^{\mathrm{spec}}
384 +B_q^{\mathrm{sample}}.
385 }
386 \]
387 The first covers variation across observationally compatible realizations. The
388 second covers variation across admissible specifications. The third covers
389 finite-sample estimation. The sufficient condition
390 \[
391 \widehat m_q(W;\varsigma_0)
392 >
393 B_q^{\mathrm{total}}
394 \qquad(q\in\mathcal J_*)
395 \]
396 will reappear below in identified-set and confidence-envelope form. Keeping the
397 budgets separate prevents an apparently narrow confidence interval from being
398 mistaken for strong identification or specification robustness.
399 
400 \topic{63}{Experimental Equivalence and Identifiability}
401 
402 A complete mathematical definition does not guarantee that its truth can be
403 recovered from available data. The experimental design may fail to distinguish
404 two realizations that have different internal organization.
405 
406 \begin{definition}[Experimental design and induced law]
407 \label{def:workspace-experiment-design}
408 An experimental design is a tuple
409 \[
410 \mathcal E
411 =
412 (\mathcal O,\mathcal I,\mathcal T),
413 \]
414 where \(\mathcal O\) is the observation map, \(\mathcal I\) is the family of
415 implemented interventions, and \(\mathcal T\) is the set of measured temporal
416 windows. A realization \(\mathfrak R\) induces the family of laws
417 \[
418 P_{\mathfrak R}^{\mathcal E}
419 =
420 \left
421 \{
422 \mathcal L_{\mathfrak R}
423 \bigl(\mathcal O(\mathbf H)\mid\operatorname{do}(\iota)\bigr):
424 \iota\in\mathcal I,
425 \ t\in\mathcal T
426 \right\}.
427 \]
428 \end{definition}
429 
430 \begin{definition}[Experimental equivalence]
431 Two realizations are experimentally equivalent under \(\mathcal E\), written
432 \[
433 \mathfrak R\equiv_{\mathcal E}\mathfrak R',
434 \]
435 when
436 \[
437 P_{\mathfrak R}^{\mathcal E}
438 =
439 P_{\mathfrak R'}^{\mathcal E}.
440 \]
441 A property \(\psi(\mathfrak R)\) is identifiable on a model class
442 \(\mathfrak M\) under \(\mathcal E\) when it is constant on every
443 \(\equiv_{\mathcal E}\)-equivalence class contained in \(\mathfrak M\).
444 \end{definition}
445 
446 Identifiability is therefore relative to both a model class and an experiment
447 family. Enlarging the intervention family refines the equivalence classes and
448 can make previously hidden distinctions identifiable. Enlarging the model
449 class can have the opposite effect.
450 
451 \subtopic{63.1 \(T_{29}\): Non-identifiability impossibility theorem}
452 
453 \begin{theorem}[No uniformly correct decision under experimental equivalence]
454 \label{thm:workspace-nonidentifiability}
455 Let \(\mathfrak R,\mathfrak R'\in\mathfrak M\) satisfy
456 \[
457 \mathfrak R\equiv_{\mathcal E}\mathfrak R'
458 \]
459 but
460 \[
461 \operatorname{Cert}(W_{\mathfrak R};\varsigma)
462 \neq
463 \operatorname{Cert}(W_{\mathfrak R'};\varsigma).
464 \]
465 Then the workspace certificate is not identifiable on \(\mathfrak M\) under
466 \(\mathcal E\). More strongly, for every possibly randomized decision rule
467 \(\widehat C\) based only on data generated by \(\mathcal E\),
468 \[
469 \boxed{
470 \mathbb P_{\mathfrak R}
471 \left(
472 \widehat C\neq C_{\mathfrak R}
473 \right)
474 +
475 \mathbb P_{\mathfrak R'}
476 \left(
477 \widehat C\neq C_{\mathfrak R'}
478 \right)
479 =1,
480 }
481 \]
482 where \(C_{\mathfrak R}=\operatorname{Cert}(W_{\mathfrak R};\varsigma)\).
483 Consequently,
484 \[
485 \inf_{\widehat C}
486 \max\left\{
487 \mathbb P_{\mathfrak R}(\widehat C\neq C_{\mathfrak R}),
488 \mathbb P_{\mathfrak R'}(\widehat C\neq C_{\mathfrak R'})
489 \right\}
490 \geq\frac12.
491 \]
492 \end{theorem}
493 
494 \begin{proof}
495 The data law is identical under the two realizations, so
496 \(p=\mathbb P(\widehat C=1)\) is the same in both. If
497 \(C_{\mathfrak R}=0\) and \(C_{\mathfrak R'}=1\), the two error probabilities
498 are \(p\) and \(1-p\). Their sum is one, and at least one is at least one half.
499 The opposite labeling is identical.
500 \end{proof}
501 
502 The theorem is not a limitation of a particular estimator. It is an
503 information-theoretic obstruction. No amount of optimization or sample size
504 can resolve a difference that the declared observations and interventions do
505 not expose.
506 
507 \subtopic{63.2 Hidden-controller witness}
508 
509 Consider two realizations that emit the same local streams \(X_1,X_2\) and the
510 same outcome
511 \[
512 Y=X_1\oplus X_2.
513 \]
514 In the distributed realization, the two streams are generated and retained by
515 separately intervenable carriers, and no carrier contains the pair. In the
516 centralized realization, a hidden controller contains \((X_1,X_2)\) and emits
517 the two displayed streams. Under passive observation of
518 \((X_1,X_2,Y)\), the induced laws are identical. Even interventions that alter
519 only the displayed messages may fail to distinguish them if the hidden
520 controller simply re-emits the manipulated values.
521 
522 Carrier-relative relationality becomes identifiable only when the experiment
523 can test the claimed causal separation. Examples include independently
524 interrupting the candidate carriers, exposing the hidden memory, randomizing a
525 shared controller, or measuring whether one physical mechanism reconstructs
526 the complete state before the displayed split. The decomposition controls
527 \(N_{25}\)--\(N_{27}\) are therefore identifiability interventions, not merely
528 optional robustness checks.
529 
530 \subtopic{63.3 Identifiability of individual gates}
531 
532 The full certificate may be unidentified even when some coordinates are
533 identified. Structural dimension might be recoverable from observed transfer
534 constraints while causal specificity remains ambiguous. Conversely, a causal
535 contrast may be identifiable even when the latent workspace coordinates are
536 known only up to gauge. Each margin should therefore be assigned one of four
537 statuses:
538 \[
539 \text{point identified},
540 \quad
541 \text{sign identified},
542 \quad
543 \text{partially identified},
544 \quad
545 \text{unidentified}.
546 \]
547 A complete pass requires the sign of every required gate to be identified as
548 positive, not merely that one compatible model produces a positive estimate.
549 
550 \topic{64}{Partial Identification of Workspace Claims}
551 
552 When point identification fails, the correct response is not to choose one
553 convenient realization. It is to report the set of values compatible with the
554 data and assumptions \cite{Manski2003,ImbensManski2004}.
555 
556 \begin{definition}[Identified realization set]
557 \label{def:identified-realization-set}
558 Given an experimental law \(P^{\mathcal E}\) and model class \(\mathfrak M\),
559 define
560 \[
561 \boxed{
562 \mathfrak R_{\mathrm{ID}}
563 (P^{\mathcal E};\mathfrak M)
564 =
565 \left\{
566 \mathfrak R\in\mathfrak M:
567 P_{\mathfrak R}^{\mathcal E}=P^{\mathcal E}
568 \right\}.
569 }
570 \]
571 For a gate \(q\) and specification \(\varsigma\), its identified margin set is
572 \[
573 \mathcal M_q^{\mathrm{ID}}
574 (P^{\mathcal E};\varsigma)
575 =
576 \left\{
577  m_q(W_{\mathfrak R};\varsigma):
578 \mathfrak R\in\mathfrak R_{\mathrm{ID}}
579 \right\}.
580 \]
581 \end{definition}
582 
583 The sharp lower and upper identified margins are
584 \[
585 \underline m_q^{\mathrm{ID}}(\varsigma)
586 =
587 \inf\mathcal M_q^{\mathrm{ID}}(\varsigma),
588 \qquad
589 \overline m_q^{\mathrm{ID}}(\varsigma)
590 =
591 \sup\mathcal M_q^{\mathrm{ID}}(\varsigma).
592 \]
593 A gate is sign-identified as passing if its lower bound is positive. It is
594 sign-identified as failing if its upper bound is nonpositive. If the interval
595 crosses zero, the available design does not determine that gate's outcome.
596 
597 \subtopic{64.1 Identified certificate set}
598 
599 Define
600 \[
601 \boxed{
602 \mathcal C_{\mathrm{ID}}
603 (P^{\mathcal E};\varsigma)
604 =
605 \left\{
606 \operatorname{Cert}(W_{\mathfrak R};\varsigma):
607 \mathfrak R\in\mathfrak R_{\mathrm{ID}}
608 \right\}
609 \subseteq\{0,1\}.
610 }
611 \]
612 The certificate is point identified exactly when this set is a singleton. The
613 marginal gate intervals provide simple sufficient conditions, but they need
614 not be logically necessary because gate margins can be dependent across the
615 identified set.
616 
617 For robustness across specifications, define the realization-level robust
618 margin
619 \[
620 r_{\mathfrak S}(\mathfrak R)
621 =
622 \inf_{\varsigma\in\mathfrak S}
623 \min_{q\in\mathcal J_*}
624  m_q(W_{\mathfrak R};\varsigma)
625 \]
626 and its identified range
627 \[
628 \underline r_{\mathrm{ID},\mathfrak S}
629 =
630 \inf_{\mathfrak R\in\mathfrak R_{\mathrm{ID}}}
631  r_{\mathfrak S}(\mathfrak R),
632 \qquad
633 \overline r_{\mathrm{ID},\mathfrak S}
634 =
635 \sup_{\mathfrak R\in\mathfrak R_{\mathrm{ID}}}
636  r_{\mathfrak S}(\mathfrak R).
637 \]
638 
639 \subtopic{64.2 \(T_{30}\): Joint specification-identification theorem}
640 
641 \begin{theorem}[Identification of a specification-robust certificate]
642 \label{thm:joint-spec-identification}
643 Let \(\mathfrak R_{\mathrm{ID}}\) be the identified realization set and
644 \(\mathfrak S\) an admissible specification family.
645 \begin{enumerate}
646 \item If
647 \[
648 \boxed{
649 \underline r_{\mathrm{ID},\mathfrak S}>0,
650 }
651 \]
652 then every realization compatible with the experimental law passes every
653 required gate under every admissible specification. The robust certificate is
654 identified as passing.
655 \item If
656 \[
657 \boxed{
658 \overline r_{\mathrm{ID},\mathfrak S}\leq0,
659 }
660 \]
661 then no compatible realization passes the complete certificate throughout the
662 family. The robust certificate is identified as failing.
663 \item If there exist compatible realizations
664 \(\mathfrak R_+,\mathfrak R_-\) with
665 \[
666 r_{\mathfrak S}(\mathfrak R_+)>0,
667 \qquad
668 r_{\mathfrak S}(\mathfrak R_-)\leq0,
669 \]
670 then the robust certificate is not identified under the declared experiment.
671 \end{enumerate}
672 \end{theorem}
673 
674 \begin{proof}
675 The first two conclusions follow directly from the definitions of the infimum
676 and supremum over the identified set. The third gives two experimentally
677 compatible realizations with different robust-certificate values, so
678 Theorem~\ref{thm:workspace-nonidentifiability} applies.
679 \end{proof}
680 
681 This theorem joins two forms of robustness that are often conflated. A result
682 can be stable across specifications within one fitted model yet fail to be
683 identified across models compatible with the data. It can also be identified
684 under one specification while changing sign across a reasonable specification
685 family. The strongest claim controls both axes.
686 
687 \subtopic{64.3 Confidence regions for identified sets}
688 
689 In finite samples, the identified set is itself uncertain. Let
690 \[
691 \widehat{\mathfrak R}_{1-\delta}
692 \]
693 be a confidence region satisfying
694 \[
695 \inf_{\mathfrak R_0\in\mathfrak M}
696 \mathbb P_{\mathfrak R_0}
697 \left(
698 \mathfrak R_0\in
699 \widehat{\mathfrak R}_{1-\delta}
700 \right)
701 \geq1-\delta.
702 \]
703 A conservative robust lower margin is
704 \[
705 \widehat r_{1-\delta}
706 =
707 \inf_{\mathfrak R\in\widehat{\mathfrak R}_{1-\delta}}
708 \inf_{\varsigma\in\mathfrak S}
709 \min_q m_q(W_{\mathfrak R};\varsigma).
710 \]
711 If \(\widehat r_{1-\delta}>0\), a false specification-robust certificate has
712 probability at most \(\delta\), provided that the model class and
713 specification family were fixed before the confidence region was computed.
714 This confidence-set approach is useful when gate estimators are strongly
715 coupled or when the latent realization is the primary inferential object.
716 
717 \topic{65}{Uniform Finite-Sample Certification}
718 
719 Population margins are not observed directly. A certification rule must
720 control the estimation error uniformly across every specification and gate on
721 which its conclusion depends.
722 
723 Let \(\widehat m_q(\varsigma)\) estimate
724 \(m_q(W;\varsigma)\). Suppose there are nonnegative error radii
725 \(\varepsilon_q(n,\delta)\) such that
726 \[
727 \mathbb P\left(
728 \sup_{\varsigma\in\mathfrak S}
729 \left|
730 \widehat m_q(\varsigma)-m_q(\varsigma)
731 \right|
732 \leq
733 \varepsilon_q(n,\delta)
734 \quad\text{for all }q\in\mathcal J_*
735 \right)
736 \geq1-\delta.
737 \]
738 Define the empirical lower confidence envelope
739 \[
740 \boxed{
741 \widehat{\underline m}_{q,1-\delta}^{\mathfrak S}
742 =
743 \inf_{\varsigma\in\mathfrak S}
744 \widehat m_q(\varsigma)
745 -
746 \varepsilon_q(n,\delta).
747 }
748 \]
749 
750 \subtopic{65.1 \(T_{31}\): Uniform specification-certificate theorem}
751 
752 \begin{theorem}[Uniform finite-sample certification across specifications]
753 \label{thm:uniform-spec-certification}
754 Under the uniform error event above, declare a specification-robust certificate
755 only when
756 \[
757 \widehat{\underline m}_{q,1-\delta}^{\mathfrak S}>0
758 \qquad
759 \text{for every }q\in\mathcal J_*.
760 \]
761 Then
762 \[
763 \boxed{
764 \sup_{P:\,\operatorname{Cert}_{\mathfrak S}(W)=0}
765 \mathbb P_P
766 \left(
767 \text{the robust certificate is declared}
768 \right)
769 \leq\delta.
770 }
771 \]
772 \end{theorem}
773 
774 \begin{proof}
775 On the uniform error event,
776 \[
777 m_q(\varsigma)
778 \geq
779 \widehat m_q(\varsigma)-\varepsilon_q
780 \]
781 for every gate and every specification. If all empirical lower envelopes are
782 positive, every population margin is positive throughout the family. A false
783 declaration can therefore occur only when the uniform error event fails, which
784 has probability at most \(\delta\).
785 \end{proof}
786 
787 The theorem controls the complete specification family, not merely the
788 analysis that happened to produce the strongest estimate. It is an extension
789 of the gatewise intersection rule in Theorem~\ref{thm:gatewise-validity}.
790 Gatewise validity controls the conjunction at one frozen specification.
791 Uniform validity controls the conjunction over a family.
792 
793 \subtopic{65.2 Finite specification grids}
794 
795 Suppose \(\mathfrak S\) and \(\mathcal J_*\) are finite, and each margin is
796 estimated as
797 \[
798 \widehat m_q(\varsigma)
799 =
800 \frac1n\sum_{i=1}^nZ_{i,q,\varsigma}-\theta_{q,\varsigma},
801 \qquad
802 0\leq Z_{i,q,\varsigma}\leq1,
803 \]
804 from independent certification units. Hoeffding's inequality and a union bound
805 give
806 \[
807 \mathbb P\left(
808 \sup_{q,\varsigma}
809 \left|
810 \widehat m_q(\varsigma)-m_q(\varsigma)
811 \right|
812 >
813 \sqrt{
814 \frac{
815 \log\bigl(2|\mathcal J_*||\mathfrak S|/\delta\bigr)
816 }{2n}}
817 \right)
818 \leq\delta.
819 \]
820 Thus the choice
821 \[
822 \boxed{
823 \varepsilon_n(\delta)
824 =
825 \sqrt{
826 \frac{
827 \log\bigl(2|\mathcal J_*||\mathfrak S|/\delta\bigr)
828 }{2n}
829 }
830 }
831 \]
832 yields an explicit conservative certificate. Dependent episodes require a
833 bound appropriate to the true independent unit rather than token-level or
834 edge-level pseudo-replication.
835 
836 \subtopic{65.3 Continuous specification families}
837 
838 Let \(\mathfrak S_\eta\) be an \(\eta\)-net of
839 \((\mathfrak S,d_{\mathfrak S})\) with covering number
840 \(N(\eta,\mathfrak S,d_{\mathfrak S})\). If both the population and empirical
841 margin functions are \(L_q\)-Lipschitz, then
842 \[
843 \sup_{\varsigma\in\mathfrak S}
844 |\widehat m_q(\varsigma)-m_q(\varsigma)|
845 \leq
846 \max_{\varsigma_j\in\mathfrak S_\eta}
847 |\widehat m_q(\varsigma_j)-m_q(\varsigma_j)|
848 +2L_q\eta.
849 \]
850 For bounded empirical means, a valid radius is therefore
851 \[
852 \boxed{
853 \varepsilon_{q,n,\eta}(\delta)
854 =
855 \sqrt{
856 \frac{
857 \log\bigl(2|\mathcal J_*|
858 N(\eta,\mathfrak S,d_{\mathfrak S})/\delta\bigr)
859 }{2n}
860 }
861 +2L_q\eta.
862 }
863 \]
864 The tuning parameter \(\eta\) balances net cardinality against interpolation
865 error. More refined empirical-process bounds may replace this elementary
866 covering argument without changing the certificate logic.
867 
868 \subtopic{65.4 Power and indifference regions}
869 
870 A robust procedure can be valid yet uninformative when the family is too large
871 or the data are insufficient. Each gate should therefore report an
872 indifference region \([-\kappa_q,\kappa_q]\). A conclusion is:
873 \begin{description}
874 \item[Robust pass] when the lower confidence envelope exceeds
875  \(\kappa_q\) for every gate.
876 \item[Robust fail] when a required gate's upper confidence envelope is below
877  \(-\kappa_q\) throughout the relevant family.
878 \item[Specification conflict] when well-estimated admissible specifications
879  lie on opposite sides of the indifference region.
880 \item[Statistically unresolved] when sampling uncertainty intersects the
881  indifference region.
882 \end{description}
883 This vocabulary separates genuine sensitivity from low power.
884 
885 \topic{66}{Adaptive Specification Choice and Selective Validity}
886 
887 A pointwise valid test does not remain valid after the analyst searches for the
888 most favorable target, horizon, null panel, or threshold. Consider
889 \(K\) independent null \(p\)-values and select the smallest. Then
890 \[
891 \mathbb P\left(\min_{1\leq k\leq K}p_k\leq\alpha\right)
892 =
893 1-(1-\alpha)^K,
894 \]
895 which exceeds \(\alpha\) whenever \(K>1\). The same logic applies when a
896 workspace certificate is reported only for the specification that produced the
897 largest gate margins.
898 
899 The issue is not exploration itself. Exploration is often necessary to learn
900 which target and intervention are scientifically meaningful. The issue is
901 using the same random outcomes both to choose the claim and to certify it.
902 Post-selection inference addresses the general problem by using simultaneous
903 or selection-adjusted procedures \cite{BerkEtAl2013}.
904 
905 \subtopic{66.1 Specification leakage}
906 
907 \begin{definition}[Specification leakage]
908 Specification leakage occurs when certification outcomes influence any of the
909 following without a fresh inferential correction:
910 \[
911 Y^+,
912 \ell,
913 \tau,
914 \mathcal I,
915 \mathcal N,
916 \Theta,
917 \mathfrak S,
918 \mathcal J_*.
919 \]
920 The leakage status is separate from formation leakage. A workspace extractor
921 may be frozen while the analyst still searches over targets or thresholds on
922 the certification split.
923 \end{definition}
924 
925 A valid report must retain the complete search history, including failed and
926 abandoned specifications. Reporting only the selected analysis prevents the
927 reader from determining the effective multiplicity.
928 
929 \subtopic{66.2 \(T_{32}\): Sample-split selection theorem}
930 
931 \begin{theorem}[Validity after independent specification selection]
932 \label{thm:sample-split-spec-selection}
933 Let \(\widehat\varsigma\) be selected using
934 \(\mathcal D_{\mathrm{sel}}\), and let
935 \(\mathcal D_{\mathrm{cert}}\) be independent of
936 \(\mathcal D_{\mathrm{sel}}\). For every fixed
937 \(\varsigma\in\mathfrak S\), let
938 \(\phi_\varsigma(\mathcal D_{\mathrm{cert}})\in\{0,1\}\) be a certificate
939 rule satisfying
940 \[
941 \sup_{P:\operatorname{Cert}(W;\varsigma)=0}
942 \mathbb P_P\bigl(\phi_\varsigma=1\bigr)
943 \leq\alpha.
944 \]
945 Then the selected-specification procedure satisfies
946 \[
947 \boxed{
948 \sup_P
949 \mathbb P_P\left(
950 \phi_{\widehat\varsigma}=1,
951 \operatorname{Cert}(W;\widehat\varsigma)=0
952 \right)
953 \leq\alpha.
954 }
955 \]
956 \end{theorem}
957 
958 \begin{proof}
959 Condition on \(\mathcal D_{\mathrm{sel}}\). The selected specification is then
960 fixed. Independence leaves the certification data distributed exactly as in
961 the fixed-specification test, whose false-pass probability is at most
962 \(\alpha\). Averaging the conditional bound over the selection data preserves
963 the same bound.
964 \end{proof}
965 
966 The theorem justifies discovery on formation or calibration data followed by a
967 single frozen evaluation on fresh certification data. Reusing the
968 certification split to revise the specification requires either another fresh
969 split or a simultaneous post-selection procedure whose validity covers the
970 entire search.
971 
972 \subtopic{66.3 Nested selection and stress testing}
973 
974 A practical design may use:
975 \[
976 \mathcal D_{\mathrm{form}}
977 \sqcup
978 \mathcal D_{\mathrm{spec}}
979 \sqcup
980 \mathcal D_{\mathrm{cert}}
981 \sqcup
982 \mathcal D_{\mathrm{stress}}.
983 \]
984 Formation learns the workspace. The specification split chooses targets,
985 horizons, nulls, and thresholds from a predeclared menu. Certification makes
986 the pass decision once. Stress testing explores broader shifts without
987 retroactively changing the certified claim. Cross-fitting can recover sample
988 efficiency, but the fold-level selection and evaluation paths must remain
989 separated and the final uncertainty calculation must account for recombination.
990 
991 \subtopic{66.4 Thresholds and null families are part of selection}
992 
993 Threshold tuning can be as consequential as target selection. If the observed
994 causal effect is \(0.12\), choosing a minimum effect threshold of \(0.10\)
995 after seeing the estimate is not certification. Likewise, retaining only the
996 nulls that the intact system defeats converts a falsification panel into a
997 success filter. Thresholds and null families must be frozen or evaluated under
998 a uniform rule that includes every considered alternative.
999 
1000 \topic{67}{Specification Audit and Reporting}
1001 
1002 A complete specification audit should accompany every strong relational
1003 workspace claim.
1004 
1005 \subtopic{67.1 Audit procedure}
1006 
1007 \begin{enumerate}
1008 \item State the reference specification \(\varsigma_0\) in full.
1009 \item Distinguish equivalent recodings, robustness alternatives, and genuinely
1010  different scope claims.
1011 \item Declare the admissible family \(\mathfrak S\) and justify every major
1012  exclusion before certification.
1013 \item Record the specification pseudometric or other transport bounds used to
1014  compare family members.
1015 \item Compute every gate's lower envelope, upper envelope, sensitivity width,
1016  and reference margin.
1017 \item State the experiment family \(\mathcal E\) and the model class
1018  \(\mathfrak M\) relative to which identifiability is claimed.
1019 \item Report identified sets or bounds whenever point identification fails.
1020 \item Apply a uniform finite-sample rule over every gate and specification used
1021  in the conclusion.
1022 \item Preserve the complete specification-selection history and the data split
1023  on which each choice was made.
1024 \item Report the strongest pointwise, family-robust, sign-identified, and
1025  statistically resolved conclusions separately.
1026 \end{enumerate}
1027 
1028 \subtopic{67.2 Additional adversarial controls}
1029 
1030 The empirical null and audit panel is extended by:
1031 \[
1032 \begin{aligned}
1033 N_{29}&=\text{post hoc target-selection audit},\\
1034 N_{30}&=\text{horizon cherry-picking audit},\\
1035 N_{31}&=\text{loss and utility substitution audit},\\
1036 N_{32}&=\text{restricted intervention-family audit},\\
1037 N_{33}&=\text{threshold and gate-set tuning audit},\\
1038 N_{34}&=\text{frozen specification sweep across }\mathfrak S.
1039 \end{aligned}
1040 \]
1041 The first five reconstruct or bound the analysis search that preceded the
1042 reported claim. The final control reruns the complete frozen certificate across
1043 the admissible family. A claim that survives \(N_{34}\) but fails the search
1044 audit remains vulnerable to selection bias. A claim that passes the search
1045 audit but changes sign across \(\mathfrak S\) is validly estimated yet
1046 specification-fragile.
1047 
1048 \subtopic{67.3 Required specification record}
1049 
1050 The machine-readable record should include:
1051 \[
1052 \boxed{
1053 \begin{aligned}
1054 \mathsf{SpecificationRecord}
1055 =\{&
1056 \mathsf{reference},
1057 \mathsf{family},
1058 \mathsf{equivalence\_classes},
1059 \mathsf{metric},\\
1060 &\mathsf{targets},
1061 \mathsf{losses},
1062 \mathsf{horizons},
1063 \mathsf{interventions},\\
1064 &\mathsf{null\_panels},
1065 \mathsf{thresholds},
1066 \mathsf{selection\_history},\\
1067 &\mathsf{identified\_sets},
1068 \mathsf{uniform\_bounds},
1069 \mathsf{gate\_envelopes}
1070 \}.
1071 \end{aligned}
1072 }
1073 \]
1074 Every omitted family member requires a reason. Every changed specification
1075 requires a data-split label and time stamp. Every gate requires pointwise and
1076 family-wide status.
1077 
1078 \subtopic{67.4 Claim-strength vocabulary}
1079 
1080 The following vocabulary is recommended:
1081 \begin{description}
1082 \item[Pointwise demonstrated.] The certificate passes at one frozen
1083  specification with valid uncertainty.
1084 \item[Specification-robust.] It passes uniformly across a declared admissible
1085  family.
1086 \item[Sign identified.] Every realization compatible with the experimental
1087  law gives the same gate sign.
1088 \item[Robustly identified.] The complete family-robust certificate is
1089  identified as passing.
1090 \item[Partially identified.] The data restrict the certificate margins but do
1091  not determine every required sign.
1092 \item[Specification-fragile.] Validly estimated admissible specifications give
1093  different certificate outcomes.
1094 \item[Selection-contaminated.] The reported specification was chosen using
1095  certification outcomes without valid adjustment.
1096 \end{description}
1097 
1098 \subtopic{67.5 Consequence for the motivating collaboration}
1099 
1100 The motivating human--AI research process remains a plausible candidate
1101 persistent workspace, but its strongest current description is narrower than
1102 a certified robust claim. The relevant target trajectory, horizon family,
1103 intervention set, null panel, thresholds, and admissible specification family
1104 have not been frozen and tested prospectively. Nor has the carrier-relative
1105 workspace predicate been shown to be identifiable against hidden-controller
1106 and matched-storage alternatives. The theory therefore supports a disciplined
1107 research program rather than a retrospective declaration.
1108 
1109 The terminal architecture is now explicit. A strong claim must survive three
1110 separate questions:
1111 \[
1112 \boxed{
1113 \begin{aligned}
1114 &\text{Would it survive another defensible specification?}\\
1115 &\text{Could a contrary realization generate the same experiments?}\\
1116 &\text{Does the finite sample support every required margin uniformly?}
1117 \end{aligned}
1118 }
1119 \]
1120 Once these questions are answered, further extensions concern new mathematical
1121 settings or new empirical domains rather than a missing foundational layer.

Back to source controls

Back to Stratified Relational Workspace Theory