Scalar Corollary
Original conditional derivation from the September 10 study. Assumptions and proof notation are retained.
# Scalar corollary v1: clipped local mixing after accurate reference arrival
Prepared by B/formal critic, 2026-09-10, on R4-A-B-1. Analytic source specialization only; no numerical run, tuning, scorer edit, holdout-result inspection or change to frozen THEOREM_DRAFT_v1.md.
## Source and scope
Inspected current [recovery_lab.py], Controller.update (especially lines 42-85), reference construction/arrival and modeled dispatch accounting (lines 135-165), and the base environment definition. SHA-256 observed: `033dd38c3b2be999aa3f97b3febd14536e385b5618f6bd7d1f9e1d4f5e4f75f3`. This binds the source inspected here, not every historical run.
Canonical unchanged theorem digest, as returned by the file-integrity read: `5693e57902cf5e1ec45acfd164a60e9484d74b58937983b28976d3e526ff1f8f`.
The source clips each accepted mixing value to the current local state plus/minus d=.22 and then computes a symmetrically trimmed mean. For finite values and a nonempty retained set this implies |m_i-x_i|<=d, regardless of whether the incoming values are correct. The guarded methods relay separate reference columns, admit finite references with age<=24, discard ordinary anchor columns in guarded aggregation, and use their median when at least two columns remain. Only those `usable` rows receive the reference override considered here. Other rows follow the source's fallback dynamics and are outside this corollary.
The specialization does NOT assume that this nonlinear trimmed/clipped controller has the earlier linear lifted Q certificate. Its proof uses the local displacement cap and an explicit accurate-reference assumption instead. It is an elementary conditional scalar bound, not the native RETA theorem, a novelty claim or a proof of ethical alignment.
## 1. One-step inequality and fixed-gain band
At an eligible update, let x_i be the actual pre-update scalar state, m_i the clipped/trimmed local mixture, r the fixed current reference in [0,1], and rhat_i the actual usable aggregate. Assume
|m_i-x_i|<=d,
|rhat_i-r|<=eta,
x_i^+ = Proj_[0,1]((1-a)m_i+a*rhat_i), 0<a<=1. (S1)
The truth bound eta is an assumption about the aggregate's actual accuracy. It is not inferred from hashes, protected labels, origin count, a median or agreement. The actual update must execute this override with finite values and the specified gain.
Since projection fixes r and is nonexpansive,
|x_i^+-r| <= (1-a)|m_i-r|+a*eta
<= (1-a)|x_i-r|+(1-a)d+a*eta. (S2)
If every required row is eligible under these assumptions, E=max_i|x_i-r| therefore obeys
E_next <= q E+b, q=1-a, b=q d+a eta.
For consecutive eligible updates with fixed r, define
F=b/a=eta+(1-a)d/a.
Then after k completed updates,
E_k <= q^k E_0+(1-q^k)F. (S3)
This follows by induction from the scalar affine recurrence. In particular, the closed tolerance band E<=tau is invariant if F<=tau. A strict asymptotic margin F<tau, with tau>eta, is equivalent to
a > d/(d+tau-eta). (S4)
Equality in the corresponding non-strict condition can give band invariance but does not ensure finite entry from every larger E_0. For 0<a<1, tau>F and E_0>tau, a sufficient number of completed eligible updates is
k_star=ceil[log((E_0-F)/(tau-F))/log(1/(1-a))]. (S5)
If E_0<=tau, k_star=0 suffices for invariance. At a=1, the separate bound is E_next<=eta in one eligible update, with no logarithmic formula needed. Pre-arrival time, missing-reference intervals and execution latency are not included in k_star.
For guarded_fixed, a=.9, d=.22, eta=.002 and tau=.05:
b=.1*.22+.9*.002=.0238,
F=119/4500=.026444444...,
d/(d+tau-eta)=55/67=.820895522... < .9.
At E<=.05, the next error is at most .1*.05+.0238=.0288, strictly inside the band. Because x_i,r belong to [0,1], E_0<=1 is an available conservative initial bound. The first two affine bounds are E_1<=.1238 and E_2<=.03618. Thus two consecutive eligible accurate-reference updates suffice for numeric entry from that worst-case initial bound. These values are analytic substitutions, not executed trial results.
For verified_copy, a=1, so E_next<=eta=.002 after one eligible update. This says nothing about whether an accurate usable reference has arrived, whether copying it is authorized, or whether the system can deliver service.
## 2. Adaptive low-innovation branch: use its actual condition
In the usable-reference override, guarded_adaptive uses a_hi=.9 if |rhat_i-m_i|>h=.045 and a_lo=.35 otherwise. This condition is the direct reference/mixed difference in line 77; it is not the earlier exponentially smoothed innovation variable used by fallback logic.
On the high branch, (S2) gives
|x_i^+-r|<=.1|x_i-r|+.0238. (S6)
On the low branch, the defining condition itself gives the stronger bound
|x_i^+-r|
<= |Proj_[0,1](rhat_i+(1-a_lo)(m_i-rhat_i))-r|
<= eta+(1-a_lo)|m_i-rhat_i|
<= .002+.65*.045=.03125. (S7)
Thus the low branch DOES keep the .05 band, provided the reference error assumption holds. Applying a=.35 to a worst-case mixture displacement d without using the low-innovation condition gives a valid but very loose floor; it misses the information that makes (S7) useful. The sufficient low-branch band condition generally is eta+(1-a_lo)h<=tau.
Across arbitrary switches between these two ELIGIBLE branches,
E_next <= max(.1E+.0238, .03125). (S8)
For E<=.05 this maximum is .03125, so the whole .05 band is invariant. From E_0<=1, E_1<=.1238 and E_2<=.03618 again; two consecutive eligible updates suffice for numeric entry. A useful all-k envelope is
E_k <= max(.03125, F+.1^k(E_0-F)), F=119/4500. (S9)
To see this, note that the affine high-branch map sends .03125 to .026925<=.03125. Therefore applying max(high-map, .03125) to the envelope preserves its form inductively. Its limiting upper bound is .03125. This is a common certificate for the two stated override branches, not for arbitrary adaptive changes, fallback ticks, altered clipping thresholds or reference corruption.
## 3. Arrival, trust, age and epoch qualifications
1. **Eligibility is local and explicit.** The source overrides only when at least two finite reference columns aged<=24 are available. A source may be called a verifier without satisfying the corollary's accuracy bound. Before `usable`, or after losing it, the fallback mixture/anchor update may have different gains and no eta guarantee. Count k only through consecutive updates satisfying (S1); do not splice disjoint eligible periods into a continuous-recovery claim.
2. **Local clipping does not require honest peers.** The displacement bound can remain true under arbitrarily wrong but finite values after clipping. It does not make the independent rhat accuracy assumption true. Nonfinite inputs, empty retained sets or update defection require separate handling; they are not covered by the source-level finite-value argument.
3. **Two reports do not establish truth.** Two verifier-origin columns can be wrong together; with two values the source median is their arithmetic midpoint. Origin separation and a digest do not prove causal independence or accuracy. If every admitted value is within eta of r, their scalar median is also within eta, but the code's validity/count tests do not prove that premise. More specialized majority-good assumptions require their own stated proof and cardinality conditions.
4. **Timestamp freshness is not epoch correctness.** Verifier inputs in the inspected simulator normally observe the preceding environment tick; relayed reference ages can remain admissible through age24. The reference acceptance rule does not itself carry a semantic target-epoch check. At a target jump, a finite accepted previous-epoch observation may be far outside eta=.002 even though its origin and age are valid. Source attacks can also compromise verifier values. Neither case is covered by the numeric band claim.
5. **A possible age-to-error bridge remains conditional.** If reference observations are accurate to eta_0 at their own honest timestamps and the target drifts by at most v per tick, age<=A implies aggregate error at most eta_0+A v when all admitted constituents have that bound. Use that larger effective eta in (S2)-(S9); an arbitrary target jump supplies no such small bound. This statement does not certify the simulator's references globally.
6. **Global arrival time is additional.** A per-node bound can hold while other nodes lack references because local displacement is capped independently. A global max-error claim requires every required node to have the relevant consecutive eligible accurate updates. Report the time until that condition is reached separately; it cannot be omitted by starting the recovery clock only after convenient evidence arrival.
7. **New target or controller epoch.** For a changed r, reassess reference accuracy and initialize a new pre-update error bound for the current target, while retaining the original episode's elapsed time, losses and prior judgments. This scalar corollary does not inherit a pre-change .05 invariant automatically. A modified gain/clipping/filter policy needs its own conditions or a common certificate.
## 4. Implemented action checks and capacity remain separate
The inspected source dispatches route B when x>=.5 and A otherwise. Non-consensus readiness requires |x-.5|>=.15; guarded/verified-copy readiness additionally requires a finite verification_ref and |x-verification_ref|<=.1.
For the inspected BASE environment's fixed target values r=.2 or r=.8, E<=.05 implies correct route and |x-.5|>=.25, clearing the readiness margin. If the same usable rhat has error<=.002, |x-rhat|<=.052<.1 also clears the reference-proximity guard. This is an explicit conditional action bridge for those route targets. Custom targets near .5, changed guards or mismatched reference epochs require new margins; state error .05 alone is not universally safe/useful.
Actual service still depends on capacity, audit costs and overrides. The source uses `available=max(0,capacity-audit_cost)` and caps attempted per-node service at 1, with denied nodes forced to zero. If route/readiness conditions hold, there are no denial overrides, and every node's net capacity is at least .8, then per-tick useful service can meet an .8 per-beneficiary floor in this modeled accounting. For the source's stated audit charges, a sufficient raw-capacity condition is:
| Method | Per-tick audit charge | Raw capacity sufficient for .8 net service |
|---|---:|---:|
| guarded_fixed | .015+.01+.03=.055 | >=.855 |
| guarded_adaptive | .03+.01+.03=.070 | >=.870 |
| verified_copy | .015+.01+.03=.055 | >=.855 |
These are sufficient conditions for the inspected accounting, not realized service results or universal cost models. Extra paid work, execution failure, changed repair rules and denied beneficiaries must remain visible. Spare compute or a small state error cannot replace missing service capacity. A conditional current-service improvement does not erase missed prior jobs or irreversible loss.
The scorer uses rolling service/coverage windows while error and hard violations are current-row quantities. A numeric entry bound is therefore not the complete service-qualified recovery bound. A full warmup/consecutive qualification window, original beneficiaries/demand, execution outcomes and consequence maturity must be retained; no suffix through a finite cutoff proves future perpetual stability.
## 5. Observation clock and received peer corrections
C's direct R4-C-B-1 and [R4_CLOCK_REVIEW.md] establish by source inspection that row t follows perturbation, Controller.update and modeled action accounting. Here k=0 is the pre-update state at the start of the eligible epoch; its first affected completed row is k=1. A raw scorer latency0 is one completed affected update, not the theorem's unupdated initial state. If the first eligible completed row is j, the conservative two-update entry above occurs no later than row j+1, conditional on continued eligibility, not at a raw zero-time repair.
Keep the initial perturbation onset, time to accurate reference arrival, completed-update count, measured first dwell onset/recognition and retrospective final suffix distinct. C's rolling5/warmup and cutoff warnings remain accepted. R3's separately declared .8 beneficiary floor is not silently substituted for any other historical scorer configuration.
Direct R4-B-A-1, R4-B-C-1 and R4-B-D-1 messages communicate the strongest caveat: source count/age checks do not establish current-epoch eta, and this post-arrival scalar comparison does not imply the old Q certificate or full recovery. Peer response evidence is recorded in R4_MESSAGES.md; no peer agreement is treated as a numerical validation.
## Conclusion at proved scope
The proposed fixed inequality and gain threshold are valid under (S1). At eta=.002, guarded_fixed and BOTH eligible guarded_adaptive branches preserve the .05 band; verified_copy enters the eta band in one eligible update. Accurate-reference arrival, continued freshness/trust, actual override execution, action margins and capacity are essential additional conditions. The corollary neither proves that the nonlinear experiments satisfy them globally nor establishes superiority of adaptive control or RETA.