feat(psychometric): land the Driver/Oud/Voelkle recovery stack as one reviewed vehicle

CHANGELOG.md

@@ -4,6 +4,16 @@ All notable changes to TEPP are documented here. The format follows Keep a Chang
 
 ## [Unreleased]
 
+- Restored protected-main gate integrity after the consolidation merges: hourly-scheduler prompt-contract tests now assert the gap-baseline-derived task contract (Gap ID naming, no invented weights) instead of stale increment-specific tokens, the operator-gap register inventory matches the live 33-PR queue, `evidence_core::image_unit` non-image/empty-subtype refusals and `load_union_branch_totals` valid-record accumulation have exact coverage, and the README crate fence plus duplicate registry entries stay deduped.
+- Branch-coverage diagnostics on the post-consolidation head exposed two uncovered outcomes in `evidence_core::image_unit` (`is_image_media_type_token` non-image prefix and empty-subtype refusals), one uncovered authored line (the strip-prefix refusal), and lost valid-record coverage for `load_union_branch_totals`; exact red-to-green cases now cover the non-image/empty-subtype data URIs and per-coordinate True/False accumulation.
+- Repaired post-consolidation merge fallout that left protected `main` red: restored the lost `return True` in the `check_coverage.py` match-guard branch, removed the shadowed duplicate `load_union_branch_totals` and `_is_multiline_match_guard` definitions plus duplicate workspace-crate entries (`episode_membership`, `analysis_engine`) from the contract tuple and Cargo member arrays, split two union-fused four-tuples back into `(variant, message)` pairs in the `event_core` error table, repaired the fused `identity_recovery_rate` body in `episode_membership::window`, deduplicated the checked-arithmetic eligible-count block in `analysis_engine`, fixed four-argument `unit()` test call sites, rebalanced the README crate-list fence around all 54 unique crates, and deduplicated the `location_membership`/`validation_core`/`tepp_api` architecture-table rows. Also documents private `PLAUSIBLE_IMAGE_MEDIA_TYPES` so `cargo doc -D warnings` passes.
+- Branch coverage JSON now unique-folds `files[].branches` True/False counts across instantiations. Nightly totals on #49 head `1e3e2eb` reported `event_time.rs` 505/506 while every unique site had both arms taken (253 sites × 2 instantiations). Summary-only reports without branch arrays still fail closed on totals. The 100% contract is unique production arms, matching the LCOV authored-line gate. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation.
+- `psychometric_core` maps overflowing `expm1(a Δt)` / `expm1(2 a Δt)` in `recover_discrete_constant_predictor_effect` and `recover_discrete_process_noise` through the log-space rewrite without a redundant `if !argument.is_finite()` after overflow. Local crate llvm-cov on #49 head `559e7b399473ee90ba3234677dd9ef7f05f7fd2e` was 509/510: the same LLVM `exp`/`expm1` finite-argument proof as L768/L5040. Existing rewrite (`a = 800` / `a = 400`) and overflow (`a = 1e308`) tests remain the contract. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation.
+- `psychometric_core` maps overflowing `e^{a Δt}` / `e^{a(t−u)}` through the log-space rewrite without redundant `if !argument.is_finite()` after `exp` overflow on lagged covariance, T0 TI/TD carry, and impulse carry. Nightly branch coverage on #49 head `7e669babcc54408dd8407bbac56be0f304fa99e5` was 1713/1714: LLVM counted `event_time.rs` L5040 True and treated the finite-argument overflow False as uncovered after proving `exp` of a finite argument is finite, which binary64 overflow falsifies. `fit_scalar_log_rate` now also skips a zero earlier residual and a negative lag while still recovering from a valid pair. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation.
+- `psychometric_core` maps overflowing `e^{2 a Δt}` in `recover_discrete_latent_variance` through the log-space rewrite `(ln p + 2 a Δt).exp()` without a redundant `if !2 a Δt.is_finite()` after `exp` overflow. Nightly branch coverage on #49 head `e301e9706c0bd671ccad533063fb624cc568d0b3` was 1715/1716: LLVM counted `event_time.rs` L768 True and treated the finite-argument overflow False as uncovered after proving `exp` of a finite argument is finite, which binary64 overflow falsifies. Existing rewrite (`p = 1e-308`, `a = 400`, `Δt = 1`) and overflow (`a = 1e308`) tests remain the contract. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation.
+- `psychometric_core` executes the later `|| !log_rate.is_finite()` operand on `recover_discrete_time_independent_predictor_effect` from both the lib tests and the multilevel integration crate. Nightly branch coverage on #49 head `90b08bbe82cbe7776365a6c04df38857dfe5e53c` was 1714/1716: both True arms at `event_time.rs` L2480 were unhit because fail-closed tests supplied a non-finite `TIPREDEFFECT` or predictor before `a`. Direct `a = NaN` now takes those arms. `LagClock::as_str` is called through `black_box` so the outlined instantiation is not const-folded away. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation.
+- `psychometric_core` evaluates the Driver, Oud, and Voelkle (2017, §7.2) extra-process lag as `e^{ε Δt}` even when `ε Δt` underflows to `0` (`exp(0) = 1`). Nightly branch coverage on #49 head `22b8e68813ad59a9a91689bacfa4cf033dfad158` was 1718/1720: LLVM deleted `if extra_argument == 0.0` / `original_argument == 0.0` True after proving `ε < 0` and `Δt > 0` imply a nonzero product, which binary64 underflow falsifies. The public map now uses `exp` directly; `original_log_rate == 0` remains the Brownian `e^{0} = 1` path. Recovery tests assert the §7.2 identity `a_{ηξ} x e^{a Δt}(e^{(ε−a)Δt} − 1)/(ε − a)` on `(-min_subnormal) * 1e-320`. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation.
+- `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, p. 16 `MANIFESTMEANSstd`; Table 2, p. 12; footnote 4; Eq. 5, p. 5; 2017-era ctsem `summary.ctsemFit.R`; JSS PDF re-opened 2026-08-25T05:04Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar standardised manifest mean. Page 16 prints standardised matrices with the suffix `std` when appropriate. Footnote 4 standardises using only the relevant variance, not the total. Table 2 names `MANIFESTMEANS` `τ` the `n.manifest × 1` matrix of manifest means. Table 2 names `MANIFESTVAR` `Θ` the residual covariance of the indicators. The relevant variance for that named measurement intercept is residual `MANIFESTVAR` `θ`, not total observed `Var(y) = λ² Var(η) + θ`, matching `MANIFESTVARstd`. The 2017-era `summary.ctsemFit.R` forms unstandardised `MANIFESTMEANS` as `mxEval(MANIFESTMEANS, mxobj, compute=TRUE)`. That source does not form a `MANIFESTMEANSstd` matrix; the scalar map here is the footnote 4 standardisation of that named intercept: `τ / √θ`. Form strictly positive `θ` first, then divide `τ` by `√θ`. A zero mean is exactly zero. Unstandardised `MANIFESTMEANS` is defined for a zero residual; standardised `MANIFESTMEANS` is not. Zero `θ` has no positive SD and fails closed. Manifest means are an event-time measurement quantity, so a non-event clock fails closed. `MANIFESTMEANS` does not require stable `a < 0`. `MANIFESTVARstd` `θ / θ = 1` recovers the same number when `τ = √θ` and remains a distinct named quantity. `τ / √(λ² Var(η) + θ)` uses total observed variance and is not this residual map. The 2017-era source assigns `dimnames(MANIFESTMEANS)` to `list(manifestNames, manifestNames)` on an `n.manifest × 1` matrix; that assignment is a source bug and is not this map. `T0MEANSstd` `μ_0 / √p_0` recovers the same number when `τ = μ_0` and `θ = p_0` and remains a distinct named quantity. Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation. Meredith (1993) remains unread (Unpaywall 2026-08-25T05:04Z: `is_oa: false`, 0 locations; title *Measurement Invariance, Factor Analysis and Factorial Invariance*). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread (Unpaywall 2026-08-25T05:04Z: `is_oa: false`, 0 locations; title *Randomization-Based Inference about Latent Variables from Complex Samples*).
 - `network_analysis` posterior edge estimation now carries exact two-sided Fisher z-transform p-values against `rho = 0` (erfc evaluated by an all-positive confluent series plus the Laplace continued fraction, locked to libm reference values at 1e-13 relative tolerance), percentile-bootstrap credible intervals and selection fractions over posterior draws, Benjamini–Hochberg step-up admission on those exact p-values instead of the complement of a thresholded fraction, an explicit fail-closed `edge_drop_probability` parameter for consensus co-assignment resampling (replacing a hardcoded 0.1), and honest per-replicate stability admission; the greedy partition helper is renamed to state that it makes no modularity-optimization claim. APA 7 entries added: Benjamini & Hochberg (1995), Efron (1979), Fisher (1921), Hennig (2007), Monti (2003).
 - Restored protected-main gate integrity after the consolidation merges: hourly-scheduler prompt-contract tests now assert the gap-baseline-derived task contract (Gap ID naming, no invented weights) instead of stale increment-specific tokens, the operator-gap register inventory matches the live 33-PR queue, `evidence_core::image_unit` non-image/empty-subtype refusals and `load_union_branch_totals` valid-record accumulation have exact coverage, and the README crate fence plus duplicate registry entries stay deduped.
 - Branch-coverage diagnostics on the post-consolidation head exposed two uncovered outcomes in `evidence_core::image_unit` (`is_image_media_type_token` non-image prefix and empty-subtype refusals), one uncovered authored line (the strip-prefix refusal), and lost valid-record coverage for `load_union_branch_totals`; exact red-to-green cases now cover the non-image/empty-subtype data URIs and per-coordinate True/False accumulation.
@@ -103,6 +113,7 @@ All notable changes to TEPP are documented here. The format follows Keep a Chang
 - `psychometric_core` posterior-aware structural input gates: construct classification, refusal of raw-proportion Pearson/OLS, explicit ALR-versus-ILR geometry boundaries, CPU `f64` OLS recovery, posterior-draw loading point-estimate averaging without Rubin uncertainty claims, invariance-gated latent-mean comparison, and causal-heuristic refusal (ADR 0005 first production slice; no new migration).
 ### Added
 
+- `model_selection` fitted candidate-`K` scoring: each candidate is fitted with the CPU `f64` TRSL-TM reference, scored from the actual in-sample mixture log-likelihood and Schwarz's (1978) `ℓ − (p ln N)/2` penalty, then passed through the existing Pareto gate. A typed non-convergence, non-finite, or invalid-input failure is a failed candidate, not a fabricated diagnostic. LLM-vote-only `K` remains non-authoritative. TF-IDF, BM25, stopword-deletion, and LLM labels are refused as inferential coordinates. Known two-topic counts select `K=2` over `K=3` with selected-`K` RMSE `0` across seed replications. This is not GPU execution, full Bayesian sampling, or topic birth/split/merge (ADR 0012; issue #167 remaining slice).
 - `relation_absence` identity gate: unobserved relation pairs cannot become evidence of no relationship; recovered observed/inferred/unobserved statuses match known truth at a higher computed rate than collapsing every status to observed (ADR 0003).
 - `orchestrator_live` loopback HTTP/1.1 listener: `POST /v1/interpretation-runs` binds loopback only, replays matching idempotency keys, and refuses non-loopback binds, table-access hosts, review/Copilot/GitHub credentials, and scientific-authority promotion. Accepted output is always hypothetical. Not TLS termination or model execution (ADR 0010; ADR 0011).
 - `role_contradiction` identity gate: customer and competitor cannot occupy the same group; recovered commercial-role labels match known truth at a higher computed rate than collapsing every role to customer (ADR 0003).

crates/model_selection/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "model_selection"
-description = "Statistical and Pareto candidate-K gates that refuse LLM numerical authority."
+description = "Fitted candidate-K scoring and Pareto gates that refuse LLM numerical authority."
 version.workspace = true
 edition.workspace = true
 rust-version.workspace = true
@@ -13,5 +13,15 @@ keywords.workspace = true
 categories.workspace = true
 publish = false
 
+[dependencies]
+topic_measurement = { path = "../topic_measurement", version = "0.1.0" }
+
+[dev-dependencies]
+corpus_split = { path = "../corpus_split", version = "0.1.0" }
+membership_core = { path = "../membership_core", version = "0.1.0" }
+relation_graph = { path = "../relation_graph", version = "0.1.0" }
+temporal_core = { path = "../temporal_core", version = "0.1.0" }
+uuid.workspace = true
+
 [lints]
 workspace = true

crates/model_selection/src/error.rs

@@ -14,6 +14,10 @@ pub enum ModelSelectionError {
     EmptyCandidateSet,
     /// An LLM vote was asked to define the numerical optimum.
     LlmVoteIsNotStatisticalAuthority,
+    /// TF-IDF, BM25, stopword deletion, or LLM labels were offered as coordinates.
+    LexicalWeightForbidden,
+    /// Every fitted candidate failed to converge or produced a typed numeric failure.
+    NoSuccessfulFit,
 }
 
 impl fmt::Display for ModelSelectionError {
@@ -23,6 +27,8 @@ impl fmt::Display for ModelSelectionError {
             Self::InvalidDiagnostic => "invalid model-selection diagnostic",
             Self::EmptyCandidateSet => "empty model-selection candidate set",
             Self::LlmVoteIsNotStatisticalAuthority => "llm vote is not statistical authority",
+            Self::LexicalWeightForbidden => "lexical inferential weights are forbidden",
+            Self::NoSuccessfulFit => "no fitted candidate produced a finite diagnostic",
         };
         formatter.write_str(message)
     }
@@ -53,6 +59,14 @@ mod tests {
                 ModelSelectionError::LlmVoteIsNotStatisticalAuthority,
                 "llm vote is not statistical authority",
             ),
+            (
+                ModelSelectionError::LexicalWeightForbidden,
+                "lexical inferential weights are forbidden",
+            ),
+            (
+                ModelSelectionError::NoSuccessfulFit,
+                "no fitted candidate produced a finite diagnostic",
+            ),
         ] {
             assert_eq!(error.to_string(), message);
         }