1 Introduction↩︎

A deliberately narrow system guarded by a tripwire and an escalation path is one of engineering’s most common patterns, and the literatures that study its parts are mature. Chow’s reject option prices the tripwire’s threshold; selective prediction and learning-to-defer train it; out-of-distribution detection asks how well it fires where the data runs out; AI control demands a monitor outside the untrusted system [1]. All of them ask how good the detector is. None asks where the detector sits relative to the restriction that created the blind spot it guards — whether the narrowing that makes the specialist cheap also reaches the tripwire. This paper shows that placement is the whole game.

The central fact is a two-line lemma with a long shadow. Model the specialist’s deficiency as a coarsening of perception, and force the detector to work through that same coarsened view. Then for any pair of task ensembles the coarsening cannot tell apart — one safe and profitable, one fatal — the detector’s gain-capture rate equals its fatal-miss rate: one number prices both. Every unit of specialization gain let through carries an equal unit of fatal exposure, so benefit and harm cannot be decoupled by anything downstream of the coarsening; a switch that disables the harm disables the benefit in the same motion, however perfect the switch. From this coupling the paper’s two-sided characterization follows: a defect is profitably removable iff the detector-relevant distinction survives the restriction — iff the detector can be placed outside the defect — and an explicit advantage condition holds.

The general object behind the story is a feature whose value depends on context: harmful in situation \(A\), beneficial in situation \(B\). Always-on pays \(A\)’s harm; always-off — the generalist who never commits — forfeits \(B\)’s benefit; controlled (enable in \(B\), disable in \(A\)) dominates both, if achievable. Control needs a switch, which is usually cheap, and a detector that tells you which situation you are in, which is the binding constraint: a flawless switch you cannot time is worthless. The economically sharp case is asymmetric — \(B\) common and mildly good, \(A\) rare but fatal — and there the feature is kept enabled by default and switched off only on detection, by routing the rare fatal case to a compensation channel (buy the missing work, defer to a principal, rent judgment). We call such a deliberately-kept, on-demand-correctable deficiency a removable defect.

Two questions organize the paper. When is keeping the defect worth it? — an economic question, answered by the advantage condition (§3). When can it actually be removed? — a structural question, answered by the coupling lemma and its consequences (§5–§6): removal can be impossible even with a perfect switch, and the obstruction is precisely where the detector sits.

Contributions↩︎

1. The coupling lemma, and the converse it forces (§5; appendix Lemma 1 and Theorem 1, Appendices 13–14). Inside an observation defect, gain-capture rate \(=\) fatal-miss rate — benefit and harm are one scalar. Consequently a confounded detector earns zero specialization premium against an adversarial task distribution — even with transductive access to the deployment distribution — and under multiplicative (Kelly) dynamics any positive premium forces log-growth to \(-\infty\). To our knowledge the first worst-case, decision-theoretic formalization of detector placement — the principle AI control and safety engineering hold as an axiom, given formal backing.

2. The two-sided iff, priced (§3, §5; appendix Theorem A, Appendix 21). A detector outside the defect earns an explicit positive premium under an advantage condition that is the Ehrlich–Becker insurance margin restated for a competence gap, with the detector a Townsend verification cost. Placement supplies the possibility; the advantage condition supplies the profit. The condition is frequency-free: the ruin condition is written on the detector’s per-event miss rate, never on the fatal-event frequency that history cannot estimate.

3. A taxonomy with an exact price (§6; Appendices 15–19). Observation defects (the information is destroyed) and capacity defects (the information survives; the class cannot use it) differ exactly on whether deployment knowledge rescues them — yet one value formula prices both: premium \(=\) support function of the detector class’s ROC set at an economic price vector, with removability a coefficient, not a yes/no. The gap between menu and machine decomposes into two named obstructions with exact formulas, a router bound that makes the theory recurse on itself, and a least-favorable-mixture duality: a coin buys back the gluing failure, never the cross-leak.

4. End-to-end learnability (§4; Appendix 22). The detector can be selected and certified from stratified samples of declared fatal categories: a one-time training bill linear in the loss severity plus \(O(\log L)\) per-period rent, both growing slower than the loss they insure — the advantage condition survives learning, and default-deny gating makes the certificate fail-safe against cover incompleteness.

2 The model↩︎

Tasks arrive one per period from a distribution \(P\) on a space \(X\). The specialist has a competence set \(C \subseteq X\) it handles well; the complement is the defect. A fatal set \(F\) marks tasks where acting without competence is catastrophic; the danger zone is the fatal exposure \(E := F \setminus C\), with mass \(\varepsilon := P(E)\), assumed small. Per task the agent either acts or escalates to the compensation channel:

with \(g\) the specialization gain, \(L \gg g\) the fatal loss, \(p\) the price of compensation. A detector \(d : X \to \{\text{act}, \text{escalate}\}\) gates the choice, at running cost \(c_d\), with two error rates: the miss rate \(\mu = P(d{=}\text{act} \mid E)\) (acting on a fatal task — the dangerous error) and the false-alarm rate \(\alpha = P(d{=}\text{escalate} \mid C)\) (escalating work the specialist could have done — the self-inflicted tax). The detector never solves the escalated task; it answers one binary question, “is this mine?”, and routes.

Expected per-period growth is \[G = (1-\alpha)\,g\,P(C) - c_d - p\,\big[\alpha P(C) + (\text{escalations outside } C)\big] - \varepsilon\mu L - (\text{benign terms}).\]

Two structural facts. The fatal term \(\varepsilon\mu L\) is a product of three factors; the architecture attacks \(\mu\) (the detector) and caps \(L\) (bounded blast radius — a spend ceiling), and deliberately does not lean on estimating \(\varepsilon\) well, because tail frequencies are exactly what history gets wrong. And the generalist alternative is not free: it pays a carrying cost \(c_{\text{gen}}\) per period for rarely-used breadth and earns \(g_{\text{gen}}\) (typically \(< g\)) on \(C\), since breadth dilutes depth.

3 The advantage condition↩︎

Informally: specialization gain per period \(>\) fatal-event frequency \(\times\) price of compensation, once the detector’s rent and false alarms are charged. When fatal events are rare, the deliberate deficiency wins, and every term is measurable in an instrumented environment — which is what makes “should I be deficient?” a computable question rather than a matter of temperament.

This is not new economics, and we do not claim it is. Structurally it is the Ehrlich–Becker [2] substitution margin between market insurance (the per-event compensation channel) and self-insurance (the generalist’s carried breadth), with the detector playing the role of Townsend’s [3] costly state verification — pay to verify, and only in the bad state. The carrying-cost- versus-per-event framing is the standard make-or-buy / capacity-versus-spot tradeoff [4], [5]. Our contribution here is narrow and we state it as such: the insured object is a deliberately maintained competence gap rather than a portfolio position, and — see §5 — the binding constraint turns out to be the detector’s reliability, not the frequency the insurance is priced against.

4 The detector: what it costs and where it must sit↩︎

The optimal rule is Chow’s. Because \(G\) is linear in \((\mu, \alpha)\), the loss-minimizing escalate-versus-act rule is a likelihood-ratio test whose threshold is the ratio of what a false alarm wastes to what a miss costs. This is exactly Chow’s reject option [6], [7]; we cite it and keep only one design consequence: the threshold is an economic quantity, not an engineering constant. As stakes \(L\) rise, the same detector must slide along its ROC curve toward paranoia; a system whose escalation threshold cannot be re-priced is mis-built. One caveat we will need [8]: with a restricted actor, the optimal rejection region is provably not a threshold on the actor’s own confidence — the detector must be a separate function. This foreshadows §5.

Detection is cheap — and that is load-bearing. Detecting whether a task is out of scope is a binary hypothesis test; by the Chernoff–Stein bound [9] its cost scales as \(\log(1/\mu)\) in the miss rate. Producing the solution to an out-of-scope task is far more expensive. We will see in §5 that survival against fatal events of severity \(L\) forces the miss rate down to \(O(1/L)\), which by the hypothesis-testing bound costs only \(O(\log L)\) in detector rent. The architecture insures against loss \(L\) at logarithmic price — this is why it is affordable at all. (Putting detection and production in a single cost model — rather than the mismatched units of samples and compute — is possible via doubly-efficient interactive proofs and property testing; we regard this as a strengthening, not a load-bearing step, and do not pursue it here.)

The shape survives when the detector must be learned rather than assumed: certifying a near-zero miss rate from data is a one-sided rare-event problem, costing a one-time training bill linear in \(L\) in labeled fatal examples (Appendix 22) — amortized over deployment, both bills grow slower than the per-event loss they insure against, so the advantage condition survives learning. A side consequence worth naming: the scarce input is labeled catastrophes, which a well-run system stops producing — it escalates them — so detector training data must come from history, simulation, or other agents’ failures.

5 Removability: the central result↩︎

5.1 Profitable removability↩︎

We first correct a definition. It is tempting to call a defect removable if some policy keeps growth bounded below. This is vacuous: the constant always-escalate detector lies in every detector class and bounds \(G \geq -p\) regardless of the defect. Survival is trivially available; it is not the question. The question is paid-for survival:

5.2 The coupling lemma↩︎

Formalize the defect as a restriction on what the agent can perceive: an observation defect forces the detector to be a function of a coarsened view \(\varphi(x)\) rather than of \(x\) itself. (This covers pruned, quantized, or attention-limited perception.)

The proof is two lines (Doob–Dynkin factorization plus equality of pushforwards; Appendix 13, Lemma 1). The content is in what it says: inside an observation defect the miss rate is the capture rate. Every unit of specialization gain the detector lets through carries an equal unit of fatal exposure — the two rates are literally the same number. This is the common-cause-failure principle of reliability engineering [10], [11] upgraded from a correlation model to an identity. A switch that disables the harm disables the benefit in the same motion.

5.3 The converse↩︎

The mechanism is the coupling lemma: positive premium requires acting on the confounded family at some positive rate \(q > 0\), which by the lemma is also the fatal-miss rate, and the missed-fatal term \(-\varepsilon q L\) overwhelms the gain as \(L\) grows. An exact value formula (Appendix 15, Theorem 1\('\)) refines “zero” to a coefficient: the surviving premium fraction is the residual separability \(\sigma_0\) — the share of safe mass the coarsening still places at zero fatal risk. So removability is not a yes/no but a number: a defect is profitably removable exactly to the extent that the detector’s distinction survives the restriction.

That transductive access does not help is worth pausing on. Seeing the deployment distribution tells you that fatal mass is present; it never tells you which task is fatal, because \(\varphi\) destroyed that distinction per-task, before any distributional knowledge can act. Optimal play here is a Chow rule on the coarsened posterior — and at the confounded points that posterior is uninformative, forcing all-or-nothing behavior. Chow’s rule executes the collapse; it cannot prevent it. The failure is not in the decision rule but in what reaches it.

5.4 Achievability, and the iff↩︎

The premium reduces to three per-unit prices — captured competence at \(g+p\), leaked fatal at \(L-p\), flat rent — and Theorem A is just Proposition 1 re-derived with the detector’s real operating characteristics in place of the abstract “price of compensation.” Existence of such an out-of-defect detector is exactly a class-uniform coverage guarantee; it is achievable for structured uncertainty classes (finite-VC families, divergence balls) and, by the coupling lemma, impossible inside an observation defect. Achievability inherits that structural restriction — no more, no less — and the existence assumption is ultimately discharged constructively: Appendix 22 selects the detector from data within that structure, with certified rates.

The two theorems meet at the large-loss boundary. With \(\delta\) fixed, \(\Pi^* \to -\infty\) as \(L \to \infty\) — a detector of any fixed miss rate is eventually ruined, matching the converse. Survival against arbitrary \(L\) requires either sharpening the detector to \(\delta = O(1/L)\) (rent only \(O(\log L)\), per §4) or capping the blast radius. At the ideal operating point the bound recovers the converse’s separation witness exactly, so the two results are two ends of one continuum.

Necessity is the converse (inside the defect the distinction is gone); sufficiency is achievability (outside it, an explicit positive premium). Placement supplies the possibility; the advantage condition supplies the profit.

6 Two kinds of defect↩︎

The restriction in §5 coarsened perception. A different restriction confines the detector to a limited function class \(H\) while perception stays full — a capacity defect. The two behave differently, and the difference is the paper’s cleanest structural claim.

For a capacity defect the premium collapses in the inductive regime — when the detector is committed before the deployment distribution is known (\(\sup_d \inf_P\)) — but is fully recovered in the transductive regime, when the detector may be chosen knowing the distribution (\(\inf_P \sup_d\)) (Appendix 16, Theorem 2). The inductive-versus-transductive gap is exactly the mechanism by which [12] escape impossibility using unlabeled deployment data. For an observation defect, by contrast, the converse holds even transductively (§5.3): the gap is zero.

So the two defect types are provably distinct along the transduction axis — an observation defect destroys the distinction per task, and no amount of distributional knowledge rebuilds it, while a capacity defect still contains the right detector; it merely cannot be identified until deployment is seen. This is the switch/detector distinction of §1 made precise: a capacity defect is “the switch is confined but the context is in principle visible”; an observation defect is “the context itself is unresolvable to you, and switch quality is irrelevant.” The average-case selective-prediction literature, which fixes a distribution, does not see this split; the worst-case framing makes it unavoidable.

The split is sharper than it first appears, because it is not a split in how removability is priced. A single value formula covers both defect types (Appendix 17, Theorem 2\('\)): for any detector class, the worst-case premium is the support function of the class’s ROC set — its achievable (capture, leak) pairs against the confusable ensembles — evaluated at the economic price vector (captured competence at \(g+p\), leaked fatal at \(L-p\)), and the removability coefficient is the class’s zero-leak capture capacity, of which §5.3’s \(\sigma_0\) is the \(\sigma\)-algebra special case. What genuinely separates the two types is joint realizability: on any single confusable direction the inductive and transductive values coincide for every class, so the transduction gap exists only when the adversary has several directions, each resolvable by some member of the class but no member resolving all. An observation defect fails per direction; a capacity defect fails only jointly. One formula for the price; two escape routes.

The joint-realizability deficit is itself characterizable (Appendix 18). It decomposes into exactly two obstructions — cross-leak (one direction’s solution acts on another’s fatal mass) and non-closure (the class cannot glue its local solutions) — with exact formulas where each acts alone: for confidence-threshold detectors the deficit is a “global paranoia” tax (the safe mass trapped between each direction’s fatal ceiling and the worst direction’s), and for halfspaces it is precisely non-separability of the safe and fatal point clouds. In general the deficit is bounded by the confusion mass of a direction router, priced at the same two prices — and since a router is itself a detector (of directions rather than of fatality), the question recurses. The recursion is the observation/capacity split in its sharpest form: for a capacity defect it terminates in a cheap router, obeying the same \(O(\log L)\) detector economics; for an observation defect the router would need exactly the information the coarsening destroyed, and the recursion halts at the coupling lemma with nothing to buy. When the two obstructions mix, a duality resolves them (Appendix 19): allowing the agent per-task randomization convexifies its options, and the many-direction game collapses to a single-direction problem at a least-favorable mixture of directions — whereupon the transduction gap splits additively into irreducible cross-leak plus the price of determinism. A coin buys back the gluing failure, never the cross-leak.

7 A worked example: Agent World↩︎

The theory grew out of an engineering problem, and the engineering carries an instantiation of it. Agent World is a protocol for autonomous agents that act on a principal’s behalf: each agent is a keypair, a signed manifest, and an inbox. The instantiation is at the design and protocol level — a manifest field, its schema, and a conformance rule, merged to the project’s mainline with its chain test passing — not a deployment with measured data. We describe it as a demonstration that the paper’s objects have a natural protocol footprint, not as empirical confirmation.

The defect is a closed list. A manifest declares the agent’s capabilities as a positive, closed list of typed task classes. Everything not listed is a deliberate deficiency, and silence is the honest way to express it — the competence set \(C\) of §2, written down. A narrow agent with a high capability score on one class is the specialist the advantage condition rewards; a diluted generalist is what it warns against.

The compensation route is declared, the detector is not. A manifest may carry one optional field:

"onOutOfScope": "escalate:market"    // or "escalate:owner" | "decline"

This names the route the agent takes when it meets work outside its competence: post the missing task to the market, defer to its principal, or refuse. Crucially, the field declares that a route exists — never the detector that fires it. What recognizes “this task is out of my competence and high-stakes” is internals, out of the protocol’s scope by construction. This is exactly the paper’s division of labor: the switch and its route are public and cheap to state; the detector is the agent’s own always-on burden.

Placement is enforced, weakly but measurably. No hub can verify that a detector actually sits outside the defect. The protocol does two enforceable things instead. It rejects an internally inconsistent declaration — a manifest claiming escalate:market while its mandate lacks the right to post tasks is read as decline, since it has declared a route it cannot take (a conformance requirement, checked by a chain test that also rejects unknown routes). And it makes the rest a measurable divergence: declaring a route, like declaring a goal frame, turns silent failure into an observable gap between declared route and behavior. The advantage condition’s terms are, by design, quantities the hub can read — capability score against market prices on one side, observed escalation spend on the other — so “should this agent be deficient?” is meant to be computed, not judged.

The two-sided theorem, from both sides at once. Agent World names the paper’s central rule as its one load-bearing constraint: “the deficiency must never include the detector — an agent may be deficient in what it can do, never in noticing what it cannot.” We do not claim independent discovery — the design and this paper share an origin. What we can honestly claim is the order: the constraint was articulated as an engineering necessity before any theorem existed, and the theorem then showed the necessity was mathematical, not stylistic. And the two failure accounts line up as one fact seen twice. The paper’s converse is ex ante: a confounded detector cannot earn premium, full stop. Agent World’s ledger supplies the ex post image: an agent that declares a route but whose detector is in fact blind will act out of competence, overclaim, burn its stake, and go broke — dissipation is the punishment the market administers to the unremovable defect. Theorem 1 says it was never removable; the ledger says why that costs.

Removal in the strongest sense. One of the declared routes is to buy a capability module — after which the missing competence is no longer missing. This is the permanent end of the removability spectrum: the defect does not merely get compensated for one event, it becomes a capability, and the word “removable” is then literal. The sealed-frame agent is the opposite extreme — a permanent deficiency that is never lifted, where removal means the guardian machinery compensating the seal’s one fatal case. That a single manifest field spans permanent, per-event, and interpretive removal is the concrete form of an open question we flag in §9: whether “removable” is one concept or three.

8 Related work↩︎

Each ingredient has a home in an existing literature; we claim the coupling, the converse, the taxonomy, and the synthesis. Per-claim verdicts with sources are maintained in the project repository; here we position only.

• Reject option / selective prediction. The optimal escalate-versus-act rule (§4) is Chow’s [6], [7]; [8] show a restricted actor forces a separate rejector, an architecture the taxonomy already names [13]. None of it provides a growth statement, and none asks where the rejector sits relative to the actor’s restriction. The empirical finding that a rejector sharing the actor’s representation can beat an independent one [14] is not a counterexample: that is average-case selective risk on the deployment distribution, while our placement claim is a worst-case guarantee against declared fatal events — exactly the regime where Lemma 1 prices the shared representation at zero.

• Impossibility. Adversarial-distribution impossibility for restricted detector classes is standard technology ([15]; [16] for same-representation failures). Unstated anywhere we could find: the coupling — one restriction defining both competence and blindness — with an unbounded-loss consequence and a positive converse. The AI-control literature [1] holds “monitor outside the untrusted system” as an axiom with no formal backing; this is the backing.

• Growth and insurance. [17] and [18] own ruin exclusion; [19] and [20] the licensing half; [2] plus [3] the advantage condition’s structure. Our residual: the ruin condition written on the detector’s miss rate, not the event frequency.

• Common-cause failure. [10] and [11] give “a monitor sharing the system’s failure mode gives no protection” as an average-case correlation model; the coupling lemma is its worst-case, identity-strength form.

• Minimax testing. The duality behind the obstruction split (§6) is classical — [21], [22]; [23] for the collapse to a least favorable pair — and randomization realizing the ROC convex hull is the Neyman–Pearson lemma [24] plus [25]. We claim the application only, and distinguish [26], who pair robust testing with abstention at asymptotic exponents over unrestricted detectors.

• Learning the detector. Theorem E is [27] plus the BEHW [28] version-space bound. Theorem E\('\)’s problem is Kalai–Kanade–Mansour’s positive-reliable learning [29] and its setup is Neyman–Pearson classification at \(\alpha = 0\) [30]; neither contains the zero-empirical-miss fast-rate certificate nor the linear-versus-quadratic- in-severity bill — itself an elementary corollary of the realizable/ agnostic rate dichotomy. Closest neighbor: [31], group-wise reliable abstention at agnostic rates.

9 Limitations and open questions↩︎

We are honest about the boundary of what is proved.

• The learned detector’s certificate is only as good as its cover. The end-to-end result (Appendix 22) trains and certifies the detector from stratified samples of declared fatal categories, and default-deny gating makes it fail-safe against categories left out of the cover — an unknown fatal category is escalated, not missed. What remains exposed is mis-declaration: fatal mass inside a declared-safe cell, where the gate admits and the samples mislead. That is model misspecification, mitigated structurally by the blast-radius cap, not statistically.

• The advantage condition is frequency-free but budget-dependent. It uses only an upper bound \(\bar\varepsilon\) on fatal mass, never a point estimate — the minimax robustness we wanted. But it still trusts that budget, and it assumes i.i.d.periods; clustered fatal events (regimes, cascades), where frequency estimates fail worst, are unmodeled.

• The adversary moves once. The converse is a one-shot game. The iterated game against a learning detector — and whether detector diversity helps the way portfolio diversity does — is open.

• The price of determinism is exact but not computable-by-us. The deterministic many-direction value is a max-min over a non-convex joint ROC set; we resolve it for randomized play (the duality of §6) but have neither a simplification nor a hardness proof for the deterministic case — the nearby classifier-rejector hardness results suggest NP-hardness, and we have not shown it.

• “Removable” may be one concept or three. Permanent removal (buy the capability — the defect becomes a capability), per-event removal (escalate this once), and interpretive removal (the sealed-frame case, where the seal is never lifted and removal means compensating its one fatal reading) share a single manifest field in §7 but may deserve separate treatment. The observation/capacity split (§6) is first evidence that the taxonomy is real; the removability spectrum is a second, orthogonal axis, and we have unified neither.

• The human case is deliberately excluded. The model prices artifacts. Applying “a person’s deficiency is an advantage” to people imports ethical questions — who owns the compensation channel, autonomy versus dependency — that no theorem here resolves, and we do not pretend otherwise.

10 Conclusion↩︎

A deliberately narrow system with a tripwire and an escalation path is a common engineering pattern, usually justified by intuition. This paper gives it an economics and a limit. The economics: keeping a deficiency is a priced position, advantageous when specialization gain outruns the insured tail. The limit: removal is possible exactly when the detector sits outside the defect, and impossible — regardless of switch quality — when the defect and its harm share a substrate, because then the rate the feature helps and the rate it harms are the same number. Between the two sits an exact accounting: one value formula prices every detector class, the shortfall against the ideal decomposes into two named obstructions with a coin buying back one and never the other, and the whole architecture can be certified from data at a training bill linear in the severity it insures. The single design rule that follows is sharper than “add a monitor”: narrow the action all you like, but never let the narrowing reach the detector. Perception must stay open even where action is closed.

Overview of the appendix↩︎

This appendix proves both directions of the detector-placement iff (Conjectures B and A of the project’s formalization notes), after an honest repair that the proof itself forced. The proofs are elementary once the model is right; per the project’s convention, we say so — the content is in the definitions and in the quantifier structure, not in analytic difficulty.

What is proved here:

• Lemma 1 (coupling): inside an observation defect, the detector’s gain-capture rate and its fatal-miss rate are the same number.

• Theorem 1 (observation defects): the specialization premium collapses to zero, unconditionally — transductive access does not help.

• Theorem 1\('\) (value formula): the exact within-defect value, with the removability coefficient \(\sigma_0\) (residual separability) governing the collapse.

• Theorem 2 (capacity defects): the premium collapses in the inductive regime, and the inductive condition is exactly a minimax gap — transduction closes it, matching [12].

• Theorem 2\('\) (capacity value formula, Appendix 17): for any detector class, the premium is the support function of the class’s ROC set at an economic price vector, with removability coefficient the zero-leak capture capacity \(\bar\sigma_0(H)\). This subsumes Theorem 1\('\) — observation and capacity defects obey one value formula — and relocates the split entirely to joint realizability across confusable directions (the transduction gap).

• The deficit characterized (Appendix 18): the joint-realizability deficit is the limiting transduction gap in premium units; it decomposes into exactly two obstructions (cross-leak, non-closure); exact formulas for monotone classes (“global paranoia”) and halfspaces (convex non-separability); and Theorem R bounds it by a direction router’s confusion mass at the same two prices — the router is itself a detector, the question recurses, and the recursion is the observation/capacity split in its third formulation.

• Theorem M (mixed obstructions, Appendix 19): the \(k\)-direction game, with per-task randomization, collapses by LP duality to a single Theorem 2\('\) instance at a least-favorable mixture of directions; the transduction gap splits additively into irreducible cross-leak plus the closure deficit — a coin buys back the gluing failure, never the cross-leak. XOR witnesses both halves at exactly \(A/2\) each.

• Corollary 3 (growth form): under multiplicative dynamics, survival and specialization gain cannot coexist inside the defect.

• Theorem A (achievability, Appendix 21): a detector outside the defect earns a worst-case premium bounded below by an explicit \(\Pi^* > 0\) under the advantage condition; the premium identity has three per-unit-priced terms. A meets B exactly at the \(L \to \infty\) boundary, and the two give the full iff (Corollary A+B).

• Theorem E/E\('\) (end-to-end, Appendix 22): the detector learned from stratified samples of a declared cell cover, with certified rates. The rare-event form certifies the fatal side at a one-time training bill linear in severity \(L\) (the agnostic route costs \(L^2\)); amortized, learning preserves the advantage condition. Default-deny gating makes the certificate fail-safe against cover incompleteness; the residual risk is mis-declaration.

What the proof forced us to admit: the drafted definition of “removable” was vacuous, and the drafted Conjecture B was false under it (Appendix 12). The repaired notion is profitable removability.

Still open (Appendix 24): the iterated adversary, the deterministic max-min’s complexity, iterated routing, and beyond-mixture uncertainty classes.

11 Model↩︎

Task space \((X, \Sigma)\), one task per period. Competence set \(C \in \Sigma\); fatal exposure \(E := F \setminus C \in \Sigma\), disjoint from \(C\). Per-task payoffs for the two actions:

with \(g, p > 0\) and \(L\) the fatal loss; standing assumption: \(L > p\) (a missed fatal costs more than an escalation — otherwise always-act dominates and there is nothing to insure). Tasks outside \(C \cup E\) form the benign region \(N := X \setminus (C \cup E)\): acting there pays \(-\ell\) with \(0 \leq \ell \leq p\), escalating pays \(-p\); benign mass enters no result below except through Theorem A’s accounting. A detector is a measurable \(d : X \to \{a, e\}\); the agent’s per-period expected payoff under task distribution \(P\) is \(G_P(d) = \mathbb{E}_P[\text{payoff}]\). The detector rent \(c_d\) is a constant shift within any fixed detector class and is dropped. A third action decline (payoff \(0\), task not done) changes nothing below except replacing the forfeit value \(-p\) by \(0\); we note where.

Throughout, fix \(\bar\varepsilon \in (0,\, g/(g+p))\) — the fatal-mass budget — and define the critical loss \[L^* \;:=\; \frac{(1-\bar\varepsilon)\,g + p}{\bar\varepsilon}.\]

Two formalizations of the defect.

• Observation defect. The agent perceives tasks only through a measurable map \(\varphi : X \to Z\); its detector must be \(\sigma(\varphi)\)-measurable. Write \(\mathcal{D}_R\) for this class. (Coarsened observation channel; covers pruned/quantized perception.)

• Capacity defect. The agent perceives \(x\) fully but its detector must come from a restricted class \(H \subseteq \{a,e\}^X\) containing the two constant maps. (Restricted function class.)

Adversarial families. For probability measures \(\nu_0\) (supported in \(C\)) and \(\nu_1\) (supported in \(E\)), define the mixture family \[\mathcal{F}(\nu_0, \nu_1) \;:=\; \{\, P_\lambda = (1-\lambda)\nu_0 + \lambda \nu_1 \;:\; \lambda \in [0, \bar\varepsilon] \,\}.\]

All results are stated for uncertainty classes \(\mathcal{P}\) containing such a family; protection claims are always relative to the declared class, never to nature (the formalization notes’ honesty rule).

12 The definition was vacuous — profitable removability↩︎

The project’s formalization notes defined a defect removable if some policy keeps \(G\) bounded below uniformly over \(\mathcal{P}\). Writing the proof exposed the flaw: the constant detector \(d \equiv e\) (always escalate) lies in every detector class — constants are measurable for any \(\sigma(\varphi)\) and were assumed in \(H\) — and bounds \(G \geq -p\) regardless of the defect. Under the drafted definition every defect is removable and Conjecture B was vacuously false, independently of the Goldwasser escape already recorded in the project’s literature notes. Survival was never the question; paid-for survival is.

The theorems below say: with a confounded detector the premium is zero (or \(\to 0\)), while an out-of-defect detector on the same family earns premium \((1-\bar\varepsilon)(g+p)\). That is the honest, non-vacuous form of “the defect must not include the detector.”

13 Lemma 1 — the coupling lemma↩︎

Reading. Inside the defect, the miss rate is the capture rate: one scalar \(q := q_0 = q_1\) prices both. Every unit of specialization gain the detector lets through carries a proportional unit of fatal exposure — the two cannot be decoupled by any cleverness downstream of \(\varphi\), because they are literally the same number. Outside the defect they decouple completely (\(q_0 = 1\), \(q_1 = 0\) is available). This is the formal content of “shared difficulty function \(\Rightarrow\) correlated failure” [10], [11], upgraded from a correlation model to an identity.

Quantitative version. Without equal pushforwards, let \(\tau := \mathrm{TV}(\varphi_*\nu_0, \varphi_*\nu_1)\). Then for every \(d \in \mathcal{D}_R\): \(\;q_0 - q_1 \leq \tau\) (immediate from the definition of total variation). The retained distinguishability \(\tau\) is the only wedge the restricted detector can drive between capture and miss.

14 Theorem 1 — observation defects: unconditional collapse↩︎

Remarks.

• Point (2) is stronger than the repaired Conjecture B asked for: for observation defects the inductive-regime condition is unnecessary. Transduction tells you that fatal mass is present (\(\lambda\)), never which task is fatal — the information was destroyed per-task by \(\varphi\), before any distributional knowledge can act. Knowing \(\lambda\), the optimal within-defect play is precisely a Chow rule on the coarsened posterior — and at the confounded points that posterior equals \(\lambda\) itself, forcing all-or-nothing behavior: acting everywhere or escalating everywhere. Chow’s rule executes the collapse; it cannot prevent it.

• The gap between inside and outside is \((1-\bar\varepsilon)(g+p)\) — the entire specialization premium, independent of \(L\) beyond the threshold \(L^*\).

15 Theorem 1\('\) — exact value and the removability coefficient↩︎

Drop the equal-pushforward assumption. Write \(m_i := \varphi_* \nu_i\) and define the residual separability \[\sigma_0 \;:=\; \sup\{\, m_0(S) \;:\; S \subseteq Z \text{ measurable},\; m_1(S) = 0 \,\}\] — the share of the safe ensemble recoverable at zero coarsened fatal risk.

Reading. \(\sigma_0\) is the fraction of the specialization premium that survives the coarsening: \(\sigma_0 = 1\) recovers the full premium, \(\sigma_0 = 0\) is Theorem 1’s collapse. For observation defects on mixture families this settles the “iff” direction of the slogan: the defect is profitably removable in the large-\(L\) limit iff the restriction retains a region where safe mass lives at zero fatal mass — iff the detector-relevant distinction survives outside the defect. Removability is not a yes/no after all (research backlog #6): it is the coefficient \(\sigma_0\).

16 Theorem 2 — capacity defects: collapse in the inductive regime, and the minimax gap↩︎

Now the detector sees \(x\) fully but is confined to \(H \subseteq \{a,e\}^X\) (constants included). Fix distinct pairs \((x_0^i, x_1^i)_{i=1}^k\) with \(x_0^i \in C\), \(x_1^i \in E\), and let \(\mathcal{P} = \bigcup_i \mathcal{F}(\delta_{x_0^i}, \delta_{x_1^i})\).

• Confounding condition: every \(h \in H\) pools some pair: \(\forall h\, \exists i : h(x_0^i) = h(x_1^i)\).

• Resolution condition: every pair is resolved by some member: \(\forall i\, \exists h_i \in H : h_i(x_0^i) = a,\; h_i(x_1^i) = e\).

Remarks.

• The inductive condition of the repaired Conjecture B is now identified formally: it is the order of quantifiers. Inductive = detector committed before the deployment distribution (\(\sup_h \inf_P\)); transductive = detector chosen with knowledge of it (\(\inf_P \sup_h\)). For capacity defects the gap between the two is the whole premium — this is the toy form of exactly the mechanism by which [12] escape: unlabeled deployment data moves the system from the first value to (toward) the second. For observation defects, Theorem 1(2) says the gap is zero. Backlog #6’s “one concept or three” receives its first hard evidence: observation and capacity defects are provably different along the transduction axis.

• Realizability of the conditions is generic, not exotic. Example: \(H\) = threshold detectors on a one-dimensional confidence score \(s\), with safe/fatal points interleaved in \(s\) (scores \(1, 2, 3, 4\) for \(x_0^1, x_1^1, x_0^2, x_1^2\)): every threshold pools one of the two pairs, yet each pair is resolved by some threshold. Interleaved confidence is the norm for restricted scores — this is Ulmer–Cinà’s ReLU-confidence failure [16] as a two-pair combinatorial fact.

17 Theorem 2\('\) — the capacity value formula, and the unification↩︎

Theorem 2 gave the capacity-defect collapse as an inequality under a combinatorial condition. Here is the exact value, for an arbitrary class — and it turns out to be the same formula as Theorem 1\('\), which relocates the observation/capacity split.

Setup. Detector class \(H \subseteq \{a,e\}^X\) (constants included), ensemble pair \(\nu_0\) (supported in \(C\)), \(\nu_1\) (supported in \(E\)), family \(\mathcal{F}(\nu_0,\nu_1)\). Each \(h \in H\) has an operating point \(\big(q_0(h), q_1(h)\big) := \big(\nu_0(h{=}a),\, \nu_1(h{=}a)\big)\) — capture rate and leak rate; note \(q_1\) is the miss rate \(\mu\) on the fatal ensemble and \(1 - q_0\) the false-alarm rate on the safe one. Call \(\mathrm{ROC}(H) := \{(q_0(h), q_1(h)) : h \in H\} \subseteq [0,1]^2\) the class’s ROC set against the pair. Write the price vector \[A := (1-\bar\varepsilon)(g+p) \quad (\text{per unit captured}), \qquad B := \bar\varepsilon\,(L-p) \quad (\text{per unit leaked}).\]

Remark (closure). \(\bar\sigma_0(H) \geq \sigma_0(H) := \sup\{q_0 : q_1 = 0\}\), with equality when the ROC set is closed — finite classes, compact operating sets — and possibly strict otherwise (a class whose every non-constant member leaks a little, with no zero-leak limit point, has \(\sigma_0 = 0 < \bar\sigma_0\)). For \(\sigma\)-algebra classes the two coincide: from \(S_n\) with \(m_1(S_n) \to 0\) summably and \(m_0(S_n) \geq c\), the set \(S = \limsup S_n\) has \(m_1(S) = 0\) and \(m_0(S) \geq c\) by reverse Fatou. So Theorem 1\('\)’s \(\sigma_0\) needed no correction.

Where the split actually lives. On a single mixture family the transduction gap vanishes for every class: each \(h\)’s infimum over \(\lambda\) sits at \(\bar\varepsilon\), so \(\inf_\lambda \sup_h G \leq \sup_h G_{P_{\bar\varepsilon}} = \sup_h \inf_\lambda G\), and the minimax inequality closes the other side. The gap of Theorem 2 is therefore a multi-direction phenomenon: with a union of confusable families the inductive value is the joint max-min \(\sup_h \min_j [A\,q_0^j(h) - B\,q_1^j(h)]\), the transductive value is the per-direction \(\min_j \sup_h\), and the gap measures joint-realizability deficit — whether one member of the class can serve all confusable directions at once. Theorem 2’s confounding/resolution conditions are the extreme case (each direction resolvable, no member resolves all). This sharpens the taxonomy result: the observation/capacity split is not about how a detector is priced — the formula above is common — but about whether deployment knowledge lets the class pick its member per direction. The limiting coefficient for a union family is accordingly \(\bar\sigma_0(H; \{\nu^j\}) = \lim_{t \downarrow 0} \sup\{\min_j q_0^j(h) : h \in H,\; \max_j q_1^j(h) \leq t\}\), which recovers Theorem 2(1)’s collapse as \(\bar\sigma_0 = 0\) under confounding.

18 The joint-realizability deficit, characterized↩︎

Theorem 2\('\) located the transduction gap in joint realizability. This section makes that quantitative: what the deficit is, which two obstructions produce it, exact formulas for the natural classes, and a general bound that turns out to be the theory applied to itself.

Setup. Directions \(j = 1, \dots, k\): ensemble pairs \((\nu_0^j, \nu_1^j)\), union family \(\mathcal{P} = \bigcup_j \mathcal{F}(\nu_0^j, \nu_1^j)\). Write \(\bar\sigma^j(H)\) for the per-direction zero-leak capture capacity and \(\bar\sigma^{\mathrm{jt}}(H) := \lim_{t \downarrow 0} \sup\{\min_j q_0^j(h) : h \in H,\;\max_j q_1^j(h) \leq t\}\) for the joint one (Appendix 17). Write \(\Pi^{\mathrm{ind}}_L(H) := \sup_{h \in H} \min_j \big[A\,q_0^j(h) - B\,q_1^j(h)\big]\) for the inductive premium (one detector must serve every direction) and \(\Pi^{\mathrm{tr}}_L(H) := \min_j \sup_{h \in H} \big[A\,q_0^j(h) - B\,q_1^j(h)\big]\) for the transductive one (the detector may be chosen after the direction is revealed), as in Appendix 17. Define the joint-realizability deficit \[\Delta(H) \;:=\; \min_j \bar\sigma^j(H) \;-\; \bar\sigma^{\mathrm{jt}}(H) \;\in\; [0, 1],\] (nonnegative since any jointly feasible \(h\) is feasible per direction). By Theorem 2\('\)’s limits applied per-direction and jointly, the transduction gap satisfies \(\Gamma_L := \Pi^{\mathrm{tr}}_L - \Pi^{\mathrm{ind}}_L \to A \cdot \Delta(H)\) as \(L \to \infty\): the deficit is the limiting gap in premium units.

So every positive deficit is attributable to cross-leak (direction \(i\)’s solution acts on direction \(j\)’s fatal mass) or non-closure (the class cannot glue its local solutions), and the two are separated by the examples below: thresholds fail only by cross-leak, halfspaces only by non-closure.

Remark (no single capacity number). If \(H\) shatters the \(2k\) direction points, \(\Delta = 0\) trivially — so a positive deficit certifies that the directions witness a non-shattered set. But the converse fails badly: thresholds (VC 1), intervals (VC 2), and halfspaces (VC \(n{+}1\)) all admit \(\Delta = 1\) at \(k = 2\) under adversarial placement. The deficit is a function of the geometry of the directions relative to the class, not of class capacity alone; shattering gives sufficiency, never a characterization.

Three consequences:

1. The deficit is priced by the same two prices — router confusion on safe mass costs \(A\) per unit, on fatal mass \(B\) per unit. Since \(B = \bar\varepsilon(L - p)\) grows with \(L\), a useful bound at large \(L\) needs router confusion \(O(1/L)\) on the fatal ensembles — exactly Theorem A’s law for the primary detector, at the same \(O(\log L)\) hypothesis-testing rent. The router is a detector — of directions instead of fatality — and obeys detector economics.

2. The escape-route question recurses. “Can the class serve all directions at once?” reduces to “can the direction be detected per task?” — a second-order instance of the original problem. The recursion terminates in one of two ways, and this is the observation/capacity split in its third and sharpest formulation: for a capacity defect the recursion bottoms out in a cheap router (directions distinguishable from the task; deficit \(\leq \rho(A{+}B)\), bought at log-rent); for an observation defect the router would need exactly the information the coarsening destroyed — its confusion is bounded below by the coupling lemma — and the recursion halts at level one with nothing to buy.

3. Fleet corollary (research backlog #5): a menu of \(k\) specialists plus a router is one generalist detector, and \(\rho(A + B)\) is precisely what the fleet loses to the ideal; the composition question inherits the whole pricing apparatus.

The bound is stated for the augmented class: it characterizes what composition closure buys, while Propositions 5–6 give the exact deficit of the raw classes. The mixed case — cross-leak and non-closure together, on ensemble directions — is Appendix 19.

19 Theorem M — the mixed-obstruction deficit: duality and the price of determinism↩︎

Where Appendix 18 characterized the deficit with one obstruction acting alone, this section gives the general case. The conjectured shape (a Neyman–Pearson problem over the joint ROC set) is correct, and its dual is the theorem: the \(k\)-direction game collapses to a single-direction Theorem 2\('\) instance at a least-favorable mixture of directions — and the duality separates the two obstructions exactly: randomization eliminates non-closure and can never touch cross-leak.

Randomized play. Let the agent draw its detector per task from a finite lottery \(\pi\) over \(H\). The operating point of a lottery is the mixture of its atoms’ points, so lotteries realize exactly \(\mathrm{conv}\,\mathrm{ROC}_k(H)\) (Carathéodory: at most \(2k+1\) atoms suffice — the optimal randomized detector is a small menu with a coin). Write \(\Pi^{\mathrm{rand}}_L(H)\) for the inductive premium over lotteries.

The first bracket is the cross-leak against the least-favorable mixture — it survives any amount of randomization, because Theorem M already plays the convex hull. The second is the convexity gap of \(\mathrm{ROC}_k(H)\) at the optimal price functional — the price of determinism, and it is all of Prop 4’s non-closure obstruction: a coin buys back the gluing failure, never the cross-leak. Union-closed classes (Prop 5) have zero closure deficit already; for them randomization is worthless, as the exact formula showed.

Worked example (XOR, the numbers). Halfspaces on the XOR directions (Appendix 18, Prop 6), \(L \to \infty\), in units of \(A\): deterministic \(0\), randomized \(1/2\) (the coin over the two corner halfspaces \(\{x{+}y < \tfrac12\}\), \(\{x{+}y > \tfrac32\}\); dual check: at \(w^* = (\tfrac12, \tfrac12)\) no halfspace excludes both fatal points while capturing more than half the mixed safe mass), transductive \(1\). Both obstructions are worth exactly \(1/2\) here: the three values separate, and the decomposition of M1 is witnessed with all brackets positive.

Remarks.

• The lineage is now verified (the project repository’s literature notes, second round). The duality technology is fully classical: [21], [22] for minimax-equals-Bayes against a least favorable prior with randomized rules; [23] for the exact collapse move — composite minimax testing reduces to one NP test against a least favorable pair; [32] for the finite-LP/dual-LP computation. Even the coin mechanism is in print: randomized rules realize the ROC convex hull (NP lemma, [33], Thm 3.2.1; [25]; [34, Secs. V–D] on point-mass LRs forcing randomization). We cite all of it and claim only the application — and must distinguish [26], who already pair robust testing with abstention (asymptotic exponents, unrestricted detectors): M’s claim sits at the restricted-class premium game, the closure-deficit identification, and the obstruction split.

• Theorem R is now the constructive counterpart of M: blind randomization (route without looking) is the \(\rho = 1 - 1/k\) corner of the router bound, and M says the best blind play is not gating but the NP solution against \(w^*\); a router with per-task information interpolates between M’s value and the transductive one.

• What M does not deliver: the deterministic value itself. The max-min over a non-convex \(\mathrm{ROC}_k(H)\) (Lemma 3) is exact but not, in general, simplifiable — computing it is plausibly hard (the nearby classifier-rejector hardness of [35] suggests so, but we have not proved it), and the closure deficit is exactly what it costs. That is now the honest residual.

20 Corollary 3 — the growth form↩︎

Survival and specialization gain cannot coexist inside the defect. This is Proposition 3 of the project’s formalization notes with its missing half: there, ruin forces \(\mu = 0\); here, inside the defect, \(\mu = 0\) forces \(q_0 = 0\) (Lemma 1) — no gain. The two halves together are the theorem the founding statement needed.

21 Theorem A — the achievability half (the converse’s partner)↩︎

The converse (Appendices 14–17) says a confounded detector earns zero premium. The partner statement: a detector placed outside the defect earns a premium bounded below by an explicit constant, so removal is not merely possible but profitable — closing the “if” direction of the iff. Where Appendices 14–17 fixed the detector class and varied \(P\) adversarially, here we fix a good detector and lower-bound its worst-case premium over the class.

Hypotheses.

• Structured class with a competence floor. \(\mathcal{P} \subseteq \{P : P(E) \leq \bar\varepsilon,\; P(C) \geq \underline{c}\}\) with \(\underline{c} + \bar\varepsilon \leq 1\). The floor \(\underline c > 0\) is necessary: if the world may contain no in-competence mass, no policy can guarantee positive premium (there is nothing to specialize on).

• Out-of-defect detector. There is a detector \(d\) achieving, uniformly over \(\mathcal{P}\), miss rate \(\sup_P P(d{=}a \mid E) \leq \delta\) and false-alarm rate \(\sup_P P(d{=}e \mid C) \leq \alpha_0\), at rent \(c_d\), and escalating the benign region (\(P(d{=}a \mid N) = 0\) — the conservative choice; acting on benign only helps, by \((p-\ell) \geq 0\) per unit). “Out of the defect” is exactly what makes both bounds simultaneously attainable: Lemma 1 forbids it inside an observation defect (there capture rate \(=\) miss rate), and Appendix 22 constructs such a \(d\) for structured \(\mathcal{P}\) (declared covers with finite-VC detector classes, Theorem E\('\); Mondrian/group-conditional conformal constructions [36] cover the same ground distribution-free). A inherits that structural restriction — no more, no less.

The premium identity. Against the always-escalate baseline \(B_0 = -p\), for any detector and any \(P\) (writing \(\alpha_P, \mu_P\) for the realized rates, benign escalated): \[\Pi_P(d) \;=\; P(C)\,(1-\alpha_P)\,(g+p) \;-\; P(E)\,\mu_P\,(L-p) \;-\; c_d.\]

Three terms, each a per-unit price: captured competence earns \((g+p)\) per unit (gain \(g\) where the baseline paid \(p\)); leaked fatal costs \((L-p)\) per unit (loss \(L\) where the baseline paid \(p\)); rent is flat.

This is Proposition 1 / the advantage condition (§3 of the main text), re-derived as the achievability threshold with the detector’s real operating characteristics substituted for the abstract “price of compensation”: the escalation cost enters as the \((1-\alpha_0)\) haircut on captured competence, and the missed-fatal cost as \(\bar\varepsilon\delta(L-p)\).

Remarks — where A meets B↩︎

1. The \(L\)-dependence, and the exact meeting with the converse. \(\Pi^*\) carries \(L\) only through the leakage \(\bar\varepsilon\delta(L-p)\). With \(\delta > 0\) fixed, \(\Pi^* \to -\infty\) as \(L \to \infty\): a detector of any fixed positive miss rate is eventually ruined by a severe enough fatal event. This is not a weakness of the proof — it is A shaking hands with Conjecture B, which drove \(G \to -\infty\) precisely when \(\mu\) stayed bounded away from \(0\). The two theorems partition the \((\delta, L)\) plane along the same curve. Profitable removal survives arbitrary \(L\) only if the miss rate shrinks with severity, \[\delta(L) \;<\; \frac{\underline c(1-\alpha_0)(g+p) - c_d}{\bar\varepsilon(L-p)} \;=\; O\!\big(1/L\big).\]

2. Two independent routes to a bound uniform in \(L\). Either (i) sharpen the detector, \(\delta = O(1/L)\), so leakage stays \(\leq \bar\varepsilon\kappa\) for a constant \(\kappa\); or (ii) cap the blast radius — a spend ceiling / bounded compensation making realized loss \(\leq \bar L\) regardless of the true \(L\) (formalization notes §2, point 2), after which any fixed \(\delta\) satisfying the advantage condition at \(\bar L\) works. The architecture uses both; either alone suffices for a constant lower bound.

3. Route (i) is cheap — the tie to detector economics. By the Chernoff–Stein hypothesis-testing bound [9], miss rate \(\delta\) costs rent \(c_d \sim \log(1/\delta)\), so \(\delta = O(1/L)\) costs only \(c_d \sim \log L\). Leakage is held constant at the price of logarithmic rent — the detector’s cost grows exponentially slower than the severity it insures against. Profitability then holds up to a finite but exponentially large ceiling \(L \leq \exp\big(O(\text{margin})\big)\), where the margin is the specialization premium net of constant leakage. Cheap detection is what makes the whole architecture affordable, quantified.

4. Graceful degradation recovers the converse’s witness. At the ideal operating point \(\alpha_0 = \delta = 0\) and zero rent \(c_d = 0\) (perfect free detector) with the fullest class \(\underline c = 1-\bar\varepsilon\), \(\Pi^* = (1-\bar\varepsilon)(g+p)\) — exactly the separation witness of Theorem 1(3) and the outside-defect value against which the converse measured the collapse. A’s bound degrades continuously from that ideal as \((\alpha_0, \delta, c_d)\) rise, so Theorems 1\('\) and A are two ends of one continuum: \(\sigma_0\) measures how much of the premium a confined detector keeps; \((\alpha_0, \delta)\) measure how much a free but imperfect detector keeps.

Corollary A+B — the full iff↩︎

Combining Theorem A with the converse (Appendices 14–17), over structured classes and with either \(L\) capped or \(\delta = O(1/L)\):

A defect is profitably removable iff a detector achieving small miss and false-alarm rates exists outside it — equivalently, iff the detector-relevant distinction survives the restriction (zero-leak capture capacity \(\bar\sigma_0 > 0\), one coefficient for both defect types by Theorem 2\('\)) and the advantage condition holds.

Necessity is B (inside the defect the distinction is gone, premium \(= 0\)); sufficiency is A (outside it, the explicit \(\Pi^* > 0\)). Placement supplies the possibility; the advantage condition supplies the profit. This is the theorem the founding statement asked for, in both directions.

22 Theorem E — end-to-end achievability: the detector learned, not assumed↩︎

Theorem A takes the uniform rate caps \((\alpha_0, \delta)\) as given. Here the detector is selected from data, and the caps are replaced by certificates. The concentration is standard and we use it as such (textbook constants, not optimized); the content is where the union bound lands and what the certificate costs as severity grows.

Setup (declared cover; the repaired-C structure made concrete). The agent declares a finite cover: safe-cell conditionals \(\nu_0^1, \dots, \nu_0^r\) (supported in \(C\)) and fatal-cell conditionals \(\nu_1^1, \dots, \nu_1^m\) (supported in \(E\)) — fixed measures, a Mondrian/group-conditional structure (cf.Mondrian conformal prediction, [36]) in its simplest form. The uncertainty class \(\mathcal{P}\) reweights cells arbitrarily subject to the budgets \(P(E) \leq \bar\varepsilon\), \(P(C) \geq \underline c\); within cells, conditionals are fixed. Worst-case rates then reduce to cell maxima: \(\mu(d) := \max_i \nu_1^i(d{=}a)\), \(\alpha(d) := \max_l \nu_0^l(d{=}e)\), and Theorem A’s bound holds with these: \(\inf_P \Pi_P(d) \geq \Pi^{\mathrm{lb}}(d) := \underline c\,(1-\alpha(d))(g+p) - \bar\varepsilon\,\mu(d)(L-p) - c_d\).

The detector class \(D\) (VC dimension \(v\), outside the defect — that is what \(D\)’s freedom means) is gated by the cover: every \(d \in D\) escalates off the covered cells. Data: \(n\) i.i.d.samples from each cell conditional (stratified — test the candidate detector against known-fatal history per category).

The penalty is priced by the same \(\kappa \approx B\) for large \(L\): under the square-root rate, holding the estimation penalty constant costs \(n \sim L^2\) samples. The agnostic training bill is quadratic in severity — too expensive. The rare-event form fixes this:

Lifecycle economics. Sustaining severity \(L\) end-to-end now has two bills: a one-time training bill of \(O(L \cdot v \log L)\) labeled fatal examples per declared category (amortized over deployment), and the per-period rent \(c_d = O(\log L)\) from Appendix 21‘s Remark 3. Amortized, both grow slower than the per-event loss they insure against, so the advantage condition survives learning whenever it held with known rates, up to the explicit slack above. One economic observation rides along: the scarce input is labeled catastrophes — precisely what a well-run system stops producing (it escalates them). The detector’s training data must come from history, simulation, or other agents’ failures; in market terms, labeled fatal examples are a tradable good, and Theorem E\('\) prices demand for them at \(O(L)\) per category.

Coverage: fail-safe against incompleteness, exposed to mis-declaration. Because \(D\) is gated by the cover, a fatal category outside the declared cells is escalated by default — incompleteness costs foregone premium (an uncovered safe cell earns nothing), never uncertified fatal exposure. The certificate’s true residual risk is mis-declaration: fatal mass inside a declared-safe conditional’s support, where the gate admits and the samples mislead. That is model misspecification, not sample complexity, and it is mitigated structurally (the blast-radius cap on \(L\)), not statistically — the formalization notes’ honesty rule, surviving to the end of the pipeline. This also discharges Theorem A’s delegation: existence of the out-of-defect detector is no longer assumed but reduced to realizability of \(D\) on the declared cells, with everything else certified from data.

23 Positioning↩︎

• vs.[15]: their impossibility is statistical (non-learnability of OOD detection in restricted spaces); ours is decision-theoretic (value collapse for an actor–detector pair sharing one restriction), with the adversarial-distribution move imported as technology, as planned.

• vs.[12]: not a contradiction but a corner of the theory — their escape is Theorem 2’s minimax gap, and Theorem 1(2) marks its boundary: transduction rescues capacity defects, never observation defects.

• vs.Littlewood–Rushby / common-cause failure: Lemma 1 is the common-cause principle upgraded from a correlation model to an identity (\(q_0 = q_1\)), with the quantitative wedge \(\tau\) recovering the graded version [11].

• vs.Chow: within the defect, optimal play is Chow’s rule on the coarsened posterior (Theorem 1\('\) is a Neyman–Pearson problem) — and that is precisely why optimal within-defect play cannot help. The failure is not in the decision rule but in what reaches it.

• vs.least-favorable priors (verified): Theorem M’s structure is the classical minimax-testing duality — [21], [22], [37], [23] for the collapse-to-one-NP-test move, [32] for the finite-LP form; randomization-realizes-the-ROC-hull is NP-lemma classical ([33], Thm 3.2.1; [25]; [34, Secs. V–D]). We claim the application only, and distinguish [26] — robust testing with abstention exists as of 2025, at asymptotic exponents over unrestricted detectors; the restricted-class premium game and the obstruction split are ours. Affirmative evidence the classical robust-detection canon skipped the reject option: the Fauß–Zoubir–Poor survey contains no abstention action.

• vs.NP classification and reliable learning (verified): Theorem E is standard technology ([27]; [28], Thm 2.1 for the version-space bound; textbooks [38], [39]). Theorem E\('\)’s problem is Kalai–Kanade–Mansour’s positive-reliable learning [29] and its setup is Neyman–Pearson classification at \(\alpha = 0\) ([40]; [30]; [41]) — cite both frames. Neither contains the zero-empirical-miss selection with the one-sided fast rate (KKM’s reduction pays agnostic \(\varepsilon^2\) rates; all NP papers run two-sided \(\sqrt{\,}\) at \(\alpha > 0\)), nor the linear-vs-quadratic-in-\(L\) training bill — which we present as an elementary corollary of the tight realizable/agnostic \(1/\varepsilon\) vs \(1/\varepsilon^2\) dichotomy (EHKV lower bound: [42]), not a new phenomenon. Must engage: [31], group-wise reliable abstention at agnostic rates — owns the group-wise frame; lacks zero-miss certification, reweighting robustness, and the severity asymmetry.

• The slogan, final form: a defect is profitably removable exactly to the extent that the detector’s distinction survives outside it — coefficient \(\sigma_0\), not a yes/no.

24 Open↩︎

1. Iterated adversary (research backlog #3, second half): the adversary here chooses \(P\) once; the repeated game with a learning detector is untouched.

2. Beyond mixture families: the theorems quantify over \(\mathcal{F}(\nu_0,\nu_1)\) and unions thereof; characterizing collapse for arbitrary \(\mathcal{P}\) (not built from confusable ensemble pairs) is open, though any \(\mathcal{P}\) containing such a family inherits the collapse.

3. The deterministic max-min. Theorem M resolves the mixed-obstruction deficit for randomized play; the deterministic value (Lemma 3’s max-min over the non-convex joint ROC set) is exact but unsimplified, and its computational complexity is unproved — the nearby classifier-rejector hardness [35] suggests NP-hardness for halfspace-type classes, but we have not shown it. Equivalently open: bounding the closure deficit by a structural property of \(H\) (something Shapley–Folkman-shaped as \(k\) grows).

4. The iterated router. Theorem R’s recursion is one level deep. A hierarchy of directions (directions about directions) would iterate it; whether the total rent telescopes (each level \(O(\log L)\)) or compounds is open, and bears directly on the research backlog’s #5 fleet economics.

References↩︎

---

1. Extended notes, the research backlog, and per-claim literature verdicts are maintained at https://github.com/macrokit/removable-defects.↩︎