diag: online/target encoder frame mismatch, and a ledger-citation integrity proposal

[aurascoper]

Draft. Two related pieces: a measurement, and a proposal that exists because the measurement's first commit shipped a bad citation.

Nothing here changes an objective, a planner, or any control claim. No experimental result is asserted.

---

1. Frame diagnostic — WorldModel/frame_diagnostic.py (+ 12 lines in forward_eval.py)

_mpc_success plans across two different maps:

goals = [{**starts[i], "pos": goal_pos[i]} ...]   # :316  pos differs ALONE
z0 = _encode_states(..., use_target=False)        # :317  ONLINE encoder
zg = _encode_states(..., use_target=True)         # :319  TARGET encoder
costs = ((z - zg_lat) ** 2).sum(dim=1)            # :292  cost reads across both

The goal state is the start state with pos changed alone, by at most goal_offset (0.4). So z0 and zg encode near-identical inputs through two encoders tied together only by an EMA at tau=0.99. If those encoders disagree by more than a 0.4 position shift moves the latent, the planner's cost is dominated by a frame offset it cannot reduce by acting — and control cannot improve however good the predictor gets.

That is a candidate mechanism for a null where prediction improves sharply and control does not move at all.

The isotropy connection

For orthogonal R, z ~ N(0,I) implies Rz ~ N(0,I). An isotropic objective (SIGReg, VISReg) places no penalty on the encoder rotating — the rotational gauge is left maximally free. Under EMA the target is a lagged copy, so the frames differ by however much the encoder rotated during the EMA window. Pinning the distribution can make the gauge freer, not tighter.

This also sharpens the Theorem 5.4 question. An L2 cost is O(n)-invariant, so a shared rotation is harmless and the theorem is untroubled. The issue is two encoders in two frames: the guarantee covers one representation, and nothing in it makes an online/target pair converge to the same rotation.

What it reports

field	meaning
frame_mismatch_median (A)	same input, two encoders — primary
goal_displacement_median (B)	true goal displacement, one frame — primary
planner_reads_median	what the cost actually sees at step 0
centroid_gap	the translational part, which centering discards
mismatch_to_displacement_ratio	A/B — derived, see below
procrustes_residual_ratio	fraction a rotation cannot absorb
rotation_from_identity	‖R−I‖_F / (2√d) — 0 at a shared gauge, sin(θ/2) for angle θ

Read the last two together: absorbed-by-rotation plus far-from-identity is gauge; not-absorbed plus near-identity is genuine disagreement. Either alone is ambiguous.

The ratio is derived, not primary: holding encoder disagreement fixed and varying only the goal displacement moves it across 1.0 in both directions, so it partly reports the goal-sampling distribution.

Registered read — fixed before any real number exists

mismatch_to_displacement_ratio   > 1.0  frame offset exceeds the entire goal signal
                                 < 0.3  frame hypothesis rejected

procrustes_residual_ratio        < 0.2  mostly rotational — the free gauge
                                 > 0.5  not rotational; gauge is not the mechanism

The 0.2/0.5 band is deliberately narrower than a naive 0.3/0.7. Simulating EMA lag as a generic perturbation parks the residual at ~0.67–0.70 across two orders of magnitude, i.e. the likeliest realistic outcome would have landed inside a 0.3–0.7 "inconclusive" gap and decided nothing.

Cross-arm prediction, registered: if the gauge story holds, SIGReg arms show a ratio at or above VICReg arms, because better isotropy means a freer rotation. A lower SIGReg ratio falsifies the mechanism.

It cannot run from a checkpoint

torch.save (eeg_jepa.py:593) persists encoder_state_dict and predictor_state_dict only — target_encoder_state_dict is written nowhere in this repo — and __init__ rebuilds the target as copy.deepcopy(self.encoder) (:327). A checkpoint-loaded model has target_encoder == encoder exactly and would report zero mismatch: a false negative that reads like a clean result. Hence instrumentation inside _mpc_success rather than a standalone loader.

Verification status — read this before trusting numbers

The self-test executes and asserts four polarities plus a 50-case invariant sweep:

identical encoders   ratio=0.00e+00  procrustes=nan                    OK
rotated target       ratio=27.7      procrustes=2.9e-15  rot=0.70      OK
scaled target        ratio=10.0      procrustes=0.93     rot=0.09      OK
translated target    centroid_gap=17.14  procrustes=nan                OK
invariant sweep      50 mixed perturbations, all ratio <= 1            OK

But it ran under a pure-Python shim for torch, not torch. The authoring host has neither torch nor numpy. The shim (modified Gram-Schmidt QR, one-sided Jacobi SVD, torch's lower-middle median convention) verifies the algorithm, not torch-specific API behaviour — SVD sign conventions and float32-vs-float64 could still shift things.

Run python3 WorldModel/frame_diagnostic.py against real torch before trusting any production number. One second, CPU, no ROCm.

Review history

The first commit shipped this unrun, and review found six real defects — all fixed in 5925bfa. The most interesting: principal_angle_cosine_min was not a cosine, and orthonormalizing it revealed the field was vacuous here (rotation and per-dim scaling both preserve the column span, so two full-rank frames always have all principal angles zero — measured at exactly 1.0000 for identical, rotated, and scaled alike). Replaced with rotation_from_identity, which measures the map rather than the span. Also: Procrustes centered out the very translation the module is about, and procrustes_residual_ratio <= 1 is a free invariant (R=I is always feasible) that now has an assertion and previously had 50 violations.

---

2. Citation-integrity proposal — Scripts/check_ledger_references.py + doc

Advisory-only. Not wired into CI.

docs/architecture/reflective-evidence-citation.md already states the rule: "an unpinned attribution is not a source." Nothing checks it for experiment-ledger citations. Commit 8533ea8 in this PR proved the gap by attributing a null to "ledger node 7 at commit 208cbcd" — node 7 is a different experiment, and 208cbcd is on no branch.

The obvious fix would not have worked

"Extend check_adr_references.py to scan EXPERIMENT_LEDGER.md" would not have caught this. That checker scans files under HARD_ROOTS/ADVISORY_ROOTS; a git commit message is in neither, and that is where the bad citation lived. Two distinct gaps — hence --commit-message, for a commit-msg hook or a CI pass over a PR's commits.

Separately: WorldModel/ is in neither root list, so the entire experiment lane is currently unscanned even for ADR references. I did not fix that here — it changes what an existing CI gate covers, which is your call.

Measured on this tree, not asserted

target	result
tree scan	12 findings, all bare node 33
8533ea8	PASS (0 warnings)
5925bfa	FAIL — COMMIT_SHA_UNRESOLVABLE: 208cbcd

Node 33 is a dialectic-session node from another numbering space, referenced 13 times and qualified as dialectic node 33 exactly once (line 149) — which the checker correctly does not flag. Twelve one-word fixes.

It catches half the defect, and says so

half	mechanically detectable?
pinned 208cbcd, which does not exist	yes
cited "node 7", which exists but lacks the claimed numbers	no

8533ea8 passes clean and always will — that half is a semantic claim about content, and only human review catches it. What the check buys is converting unverifiable into wrong or right, which is the precondition for review to work at all. Overstating it would repeat the original error.

A design decision recorded because it was measured

The first draft treated any non-connective word before node as a namespace qualifier. On the real ledger that produced 9 false positives out of 18 findings (if node 33, refutes node 12, across node 7). A denylist of English words cannot be completed, so it uses an allowlist and treats everything else as prose. A checker that cries wolf gets disabled, and then catches nothing.

---

Status

• Self-test executes and passes — under a shim, not real torch
• Existing ADR checker unaffected (--mode all, 1 pre-existing ADR-009+ warning)
• Provenance error corrected forward, not retro-edited — parent commit left intact per the decision-log rule
• Self-test run against real torch
• Frame diagnostic run on real data — no number has been produced yet
• Twelve node 33 references qualified
• Decision on the proposal's open questions

Open questions (in the doc, deliberately undecided)

• Where does the commit-message check run? A local hook is unenforceable on a shared repo; CI can only fail after the commit exists.
• Should an unresolvable SHA be an error or a warning? A legitimate workflow writes the ledger entry before pushing — warning-on-branch, error-on-main may be the honest split.
• Namespace syntax: dialectic node 33 is prose; [dialectic#33] is unambiguous but a bigger edit.
• Merge the two checkers behind one entry point with --check {adr,ledger,all}?

Non-claims

No claim that the node 7 figures are wrong — only that as committed they were unverifiable. No claim that mechanical checking replaces review. No control claim, no objective change, and no support for or against the frame hypothesis, which remains unmeasured on real data.