W08: Defending an independent engineering result

Specify exact output before optimizing candidates

One contract: for finite unique-ID points and finite ordered bounds $(\ell,b,r,t)$, return each ID exactly once precisely when $\ell\le x\le r$ and $b\le y\le t$, in sorted ID order. A cell spanning $[0,1)\times[0,1)$ touched by box $[0,.1]\times[0,.1]$ may contain point $(.9,.9)$; returning that candidate is a false positive. The final exact predicate is necessary.

For $x=-.2$ and cell size 1, floor yields $-1$ while truncation yields 0. A scheme whose enumeration bounds assume floor but whose insertion truncates can miss points or search the wrong geometric cells. Consistent truncation can define a different bucket partition, but the floor-based coverage proof would no longer apply without revision. Do not claim every use of truncation necessarily fails every possible index; identify the mismatched contract.

Tests should include negative coordinates, exact cell/box boundaries, empty inputs, duplicate-ID rejection, clustered points, huge sparse boxes, tiny boxes, and randomized comparison against a simple exact scan. Prove every true hit is visited and every emitted ID passes containment, with unique IDs and no double emission. Prove safe range arithmetic separately. For performance, fix identical output sorting and validation, record index-build inclusion, query distribution, candidate/hit counts, raw repeated timing, and input sizes. Coverage is a mathematical claim; the speed advantage is empirical and workload-specific.

Back to W08.01

Lifetime and synchronization both need a contract

The referenced vector dies when its owning local scope ends, so a later task dereferences an object outside its lifetime. Independently, concurrent increments of a shared ordinary counter can be a data race; a familiar lost-update trace is not a complete description of undefined C++ behavior. A passing stress test establishes neither property.

A safe bounded design may move the vector into task-owned storage, preallocate result slots, assign each task a disjoint slot, join or otherwise await completion before consuming results, and aggregate counts afterward in one thread. Read-only sharing can use an immutable object with an ownership mechanism ensuring its lifetime extends beyond all tasks. A counter needing concurrent updates can use a correct atomic read-modify-write or a mutex, with the memory-order requirement determined by whether it publishes other data. An alternative is copying input per task; it simplifies lifetime but increases memory and copying cost. An alternative is synchronous completion before returning; it simplifies ownership but changes latency and scheduling. Specify error propagation and cancellation so a failed task does not leave an apparently complete result.

Back to W08.02

An invariant does not locate the correct point on an orbit

A method can stay near an energy surface while traversing it at a slightly wrong frequency. Bounded amplitude and accumulated phase error are compatible. The Verlet analysis in W05 demonstrates a numerical frequency different from the continuous one even in a stable regime. Compare trajectories to analytic position and velocity at common times, measure zero-crossing or period error with a documented interpolation method, and study energy and maximum state error separately. Use several halved steps over both short and longer fixed intervals, preserving initial conditions and parameters. Check whether errors scale as expected before roundoff dominates.

Physical-model validation additionally requires evidence that the equations, forces, parameters, and measurements describe the real system. Converging accurately to a damping-free oscillator cannot validate a damped physical device. Explain model discrepancy, measurement uncertainty, discretization, and finite precision as different uncertainties; a small energy error alone quantifies none of the others.

Back to W08.03

A decision policy is not just a probability model

For calibrated $p=P(Y=1\mid\text{available information})$, predicting positive has expected cost $2(1-p)$ and predicting negative has expected cost $8p$. Choose positive when $2(1-p)\le8p$, equivalently $p\ge.2$. A tie policy at $.2$ should be specified. The derivation assumes the stated costs, calibration for the deployment population, and zero cost for correct decisions. Capacity constraints, asymmetric downstream consequences, or changed prevalence/calibration can change the policy.

Split by independent entity and relevant time before fitting preprocessing. Fit transforms on training data only, choose model and threshold with validation evidence, freeze the artifact and policy, then evaluate the untouched test set with confusion counts, calibration, group/sample limitations, and expected cost under the declared policy. Do not tune on the test result and keep calling it untouched.

For recording, include immutable input and model/policy digests in a canonical job payload. Atomically record a producer job with its outbox item; have the consumer commit receipt and effect together, reject an ID reused with a different payload, and acknowledge only after consumer success. A crash after consumer commit can cause delivery repetition but must not duplicate the matching result. Tests should terminate a worker at that boundary and reopen both stores. These are local process-crash claims, not proof against power loss or arbitrary distributed failure. Human-impact use additionally needs consent/data governance, domain validation, review and appeal, and monitoring; calibrated scores and a cost equation do not decide whose harms are acceptable.

Back to W08.04

A changed requirement revises the theorem

An adequate GP1 defense states the accepted pure language, lexical binding semantics, type rules, compiler/VM relation, verifier invariants, resource bounds, test strategy, and limitations. With mutable external calls, rewriting $0\cdot e$ to zero can remove an effect: if $e$ increments a counter, the optimized and original programs differ observably. Repeated evaluation or reordering can also change outputs. Add an effectful semantics and effect-aware transformations, define ordering and exceptions, change bytecode/type or effect checks, and test observable traces rather than return values alone. The original pure-language induction is not enough.

An adequate GP2 defense states training/validation/test separation, immutable model schema, data and policy identity, producer/consumer transactions, replay behavior, crash boundary, and local durability limits. Concurrent versions require a versioned artifact registry and a rule binding each job to one exact digest, not “whatever model is newest.” A naive patch that loads the latest artifact on retry can record a different prediction after a crash, violating the original job identity. Tests should submit jobs with two versions, retry them across deployment changes, reject unavailable or mismatched digests, and compare each recorded result against its bound version. Define retention of old artifacts, authorization, schema migration, and throughput/storage costs. Passing all old single-version tests would not establish these new conditions.

Both outlines should include a reproducible build, original unaided work, a failing example and repair, independent test oracles, raw measurements where performance is claimed, and a precise account of personal contribution. Multiple designs can be valid; the required common feature is that the changed assumption is reflected in the reasoning, implementation, and evidence.

Back to W08.05