Innovation-Residual Auditing of Autonomous Analysis Agents: Localization, Detection Limits, Error Control, and Identifiability

# Innovation-Residual Auditing of Autonomous Analysis Agents: Localization, Detection Limits, Error Control, and Identifiability
Source: [https://arxiv.org/html/2608.05490](https://arxiv.org/html/2608.05490)
Mark Dredze Johns Hopkins University mdredze1@jh\.edu

###### Abstract

Autonomous agents now carry out entire data analyses, selecting cohorts, joining tables, and fitting models with little step\-by\-step supervision\. When such an analysis turns out to be wrong, someone must determine which operation caused it\. A recent approach does this without any labelled mistakes, learning instead from analyses known to be sound and flagging operations that depart from what that model predicts; how reliable such audits are has not been studied\. This paper supplies that analysis\. The choice of score determines whether an error can be localized at all\. If each operation is scored by how surprising it is given the operation immediately preceding it, then operations that merely inherit an earlier error are indistinguishable from correct ones, so one mistake produces one flag; scores computed against a longer reconstruction of the intended analysis instead spread a single mistake across many operations\. We quantify how far they spread, and how to choose the comparison length when an error accumulates gradually rather than at once\. We then give procedures that control the proportion of falsely flagged operations within a single audited analysis, requiring only that sound analyses be exchangeable rather than that the fitted model be correct, and we quantify how much the guarantees weaken when the model is imperfect or when the analysis was selected for review in a way that depends on its content\. Finally we establish a limit on what any such audit can report: errors below a certain magnitude cannot be attributed at all, being indistinguishable from ordinary variation among sound analyses\. This limit falls so slowly as more sound analyses are collected that at the representation sizes now in use a hundredfold increase reduces it by under two percent, so the dimension of the representation rather than the volume of training data is the binding constraint\.

## 1Introduction

Language\-model agents are increasingly used to conduct data analysis end to end\. Given a research question, such an agent formulates hypotheses, defines cohorts, joins tables across federated repositories, fits models, and reports conclusions, executing dozens of operations without human review of the intermediate steps\. In biomedical settings the resulting analyses inform substantive claims, and the volume at which they can be produced exceeds what expert reviewers can check line by line\.

These analyses are not always sound\. An agent may narrow a cohort with a filter that silently excludes a class of patients, join on a key that drops records, or fit a model omitting an adjustment the design requires\. The result is a trajectory that terminates in a plausible\-looking conclusion reached by invalid means\. Detecting that a trajectory is unsound is one problem; the operative question for anyone who must act on the finding is a second one, namely which of its operations introduced the error\. That determines what to re\-run, what to correct, and whether the conclusion can be salvaged\.

Attributing a failure to specific operations is difficult for a reason intrinsic to sequential execution\. An error early in a trajectory corrupts the state that every subsequent operation consumes, so later operations that are themselves executed correctly nonetheless appear anomalous relative to what the analysis should have been doing\. Symptoms mask the source\. The difficulty compounds when a trajectory contains more than one genuine error, when the trajectory reaching the auditor has already been selected by an upstream judgment that is itself a function of the whole trajectory, and when no examples of failure are available to learn from\.

Existing approaches divide on that last constraint\. Supervised attribution methods learn from failure trajectories with annotated error steps, obtained by hand, by counterfactual replay, or by programmatic fault injection \(Zhang et al\., 2025; Feng et al\., 2026\)\. The cost of producing such annotation is substantial, and the common assumption of a single decisive error per trajectory reflects it\. Yeh et al\. \(2026\) showed that the annotation requirement can be removed altogether, by training exclusively on successful trajectories and scoring each step of a failed one by its deviation from the learned dynamics of success\. The present work adopts that formulation and develops its statistical theory\.

The statistical properties of attribution under this formulation have not yet been characterized\. An audit that reports a set of operations raises three questions that benchmark accuracy does not answer: what fraction of the reported operations should be expected to be spurious, how large an error must be before detection is possible at all, and what a report means when the fitted model of successful execution is itself approximate\. For audits that inform decisions about scientific results, these properties matter alongside accuracy\.

This paper supplies that account\. We analyze audits in which each operation is scored by the one\-step innovation of a predictable predictive model fitted to successful trajectories\. Localization is exact: conditional on its realized input state, an operation executed correctly after an earlier error has a null residual, so inherited corruption produces no signal and the masking problem above does not arise \(Theorem 1\)\. The result requires predictable conditioning and a one\-step score; Sections 3\.2 and 6\.1 characterize which scoring rules satisfy these conditions and what remains available when they do not\. The prediction horizon governs a trade\-off between localization and accumulation, so errors introduced gradually, which are invisible to one\-step scores, are recoverable at a matched horizon \(Section 3\.2\)\. False discovery control over the flagged set is available under arbitrary within\-trajectory dependence, in a form requiring only exchangeability across trajectories rather than correct specification of the fitted model, together with a sensitivity analysis reporting how much selection into the audit would be needed to remove each flag \(Section 5\)\.

Three further results concern the deployed model and the population of trajectories\. Cost\-normalized time is predictable only under a joint model of execution cost and operation embedding, a factorization that additionally makes cost an auditable channel \(Section 6\.1\), and explicit conditions on off\-support variance inflation are what leave operations inheriting an earlier error conservatively null rather than uncontrolled \(Section 7\)\. Pooling recurrent operation types across many trajectories lowers the detectable perturbation by a factormc\\sqrt\{m\_\{c\}\}\(Section 10\)\. Finally, the estimand itself is untestable without a minimum\-effect threshold, and with one the smallest attributable error is bounded below by a floor that additional calibration data does not remove \(Section 11\)\.

Part I develops localization, score selection, and multiplicity control for arbitrary predictable one\-step predictive families\. Part II studies a Gaussian bridge implementation, including time normalization, terminal anchoring, and behavior outside the training support\. Part III treats recurrence across trajectories, identifiability, and detection limits\. Every result holds within stated modeling assumptions, and Section 5\.6 prices deviations from them rather than treating specification as exact\.

### 1\.1Related work

Zhang et al\. \(2025\) formulated step\-level failure attribution and released the Who&When benchmark, establishing the difficulty of the task: the best reported step\-level accuracy was 14\.2%\. Subsequent studies used prompting pipelines or post\-trained attribution models with step\-level failure labels obtained by manual annotation, counterfactual replay, or programmatic fault injection\. Feng et al\. \(2026\) applied conformal prediction to produce contiguous prediction sets with finite\-sample coverage\. Zhang et al\. \(2026\) formulated online auditing as detection of the earliest decisive error\. These approaches assume a single decisive error per trajectory and require annotated failures\.

Yeh et al\. \(2026\) remove the annotation requirement\. They embed each operation as a hidden\-state vector from the acting model, treat the sequence as irregular observations of a continuous latent path from the query representation to a terminal goal state, fit a neural controlled differential equation to successful trajectories under squared reconstruction loss, and score each step by‖ht−h^​\(ut\)‖22\\\|h\_\{t\}\-\\hat\{h\}\(u\_\{t\}\)\\\|\_\{2\}^\{2\}\. Steps are flagged by selecting the topkkscores or by thresholding at the\(1−α\)\(1\-\\alpha\)quantile of pooled per\-step scores from held\-out successful trajectories\. Four elements are adopted from that work: the one\-class formulation, the continuous latent path between an initial query state and a terminal goal state, the pooled conformal threshold calibrated on successful trajectories, and the representation of the result as a set of contributing steps\.

Building on that formulation, the present work develops four elements of its theory\.

The first is a predictable time grid\. Sequential conditioning requires the time index entering the predictive law to be measurable with respect to the past\. Grids normalized by realized trajectory length, a natural choice when trajectories vary in length, are functions of the complete trajectory and do not have this property; neither does budget normalization on its own, since an operation’s cost is a property of that operation\. Section 6\.1 gives a construction that does, by modeling cost and embedding jointly, which additionally makes execution cost a second audit channel\.

The second is a characterization of the scoring rule\. A reconstruction score computed against a path driven by an interpolant of the observed trajectory lies between the one\-step innovation and the free\-running rollout\. Its effective prediction horizon is a property of the fitted vector field rather than a design parameter, because the control path allows the dynamics to track the audited trajectory; Proposition 1 shows that this localization window can be measured\. Two properties of such scores bear on the guarantees developed here\. Because the dynamics track the observed trajectory, a corruption partly predicts itself, attenuating its own score along with those downstream\. And when the interpolant is bidirectional, as smoothing and natural cubic splines are, the value atutu\_\{t\}depends on knots aftertt, so the score at a step is a function of later steps and is not predictable in the sense Theorem 1 requires\. Implementations can be checked against both conditions directly\.

The third is error control over the reported set\. A fixed quantile of pooled calibration scores controls a marginal false\-positive rate for in\-distribution steps\. The fraction of false flags among the operations actually reported is a distinct quantity, and the two differ because flags within a trajectory are dependent through the shared calibration set and through the trajectory itself\. Section 5 supplies the latter under that dependence, together with a sensitivity analysis for selection of trajectories into the audit population\.

The fourth is a set of limits: Sections 4 and 11 derive detection boundaries, minimum detectable perturbations, and identifiability results for this formulation, which bound what any procedure within it can report\.

The control path of Yeh et al\. \(2026\) also resolves the multimodal endpoint problem of Section 8, and does so more directly than the construction developed here\. A latent path determined only by its initial condition is a deterministic flow from query to endpoint and cannot represent two distinct valid conclusions, as formalized in Proposition 10\. Conditioning the dynamics on the observed trajectory can represent multiple endpoints without the state sensitivity required by the predictable anchor in Proposition 11\. However, tracking the audited trajectory may also absorb part of the anomaly\. The relative importance of these effects depends on the fitted model and should be evaluated empirically\.

One\-class and reconstruction\-based anomaly detection has an extensive literature\. The closest work in robotics detects failed executions from models trained on normal trajectories, but generally localizes failures at the trajectory rather than step level, as noted by Yeh et al\. \(2026\)\. The relevant statistical foundations include innovations, model\-based fault detection and isolation, conformal inference, and multiple testing; Sections 2\.2 and 5 summarize these connections\.

Part I: Innovation auditing for predictable sequential models

## 2Setting

### 2\.1Trajectories, cost, and filtrations

A trajectory is a sequence of operationso1,…,oTo\_\{1\},\\ldots,o\_\{T\}issued in response to a research question embedded asx0∈ℝdx\_\{0\}\\in\\mathbb\{R\}^\{d\}\. Each operation carries an embeddingxt=ϕ​\(ot\)∈ℝdx\_\{t\}=\\phi\(o\_\{t\}\)\\in\\mathbb\{R\}^\{d\}and an execution costct=cost​\(ot\)\>0c\_\{t\}=\\mathrm\{cost\}\(o\_\{t\}\)\>0, both functions of the same object\. The run operates under a cost budgetCmaxC\_\{\\max\}fixed before execution, and every operation costs at leastcmin\>0c\_\{\\min\}\>0, so

T≤Tmax:=⌊Cmax/cmin⌋T\\leq T\_\{\\max\}:=\\lfloor C\_\{\\max\}/c\_\{\\min\}\\rfloor
deterministically\. This bound is used in Section 5\.3 and motivates normalization by a fixed budget\.

Two filtrations are required\. Write

ℱt=σ​\(x0,…,xt,c1,…,ct\),𝒢t=ℱt−1∨σ​\(ct\),\\mathcal\{F\}\_\{t\}=\\sigma\(x\_\{0\},\\ldots,x\_\{t\},c\_\{1\},\\ldots,c\_\{t\}\),\\qquad\\mathcal\{G\}\_\{t\}=\\mathcal\{F\}\_\{t\-1\}\\vee\\sigma\(c\_\{t\}\),
so𝒢t\\mathcal\{G\}\_\{t\}is what is known immediately before the embedding of operationttis realized\. Normalized time and its increment,

st=1Cmax​∑i≤tci,Δt=ctCmax,s\_\{t\}=\\frac\{1\}\{C\_\{\\max\}\}\\sum\_\{i\\leq t\}c\_\{i\},\\qquad\\Delta\_\{t\}=\\frac\{c\_\{t\}\}\{C\_\{\\max\}\},
are𝒢t\\mathcal\{G\}\_\{t\}\-measurable but notℱt−1\\mathcal\{F\}\_\{t\-1\}\-measurable, because the cost of operationttis a property of that operation\. All conditioning statements therefore use𝒢t\\mathcal\{G\}\_\{t\}\. Section 6\.1 specifies the joint model required for this conditioning\.

The termination timeTTis a stopping time for\{ℱt\}\\\{\\mathcal\{F\}\_\{t\}\\\}, andI⊆\{1,…,T\}I\\subseteq\\\{1,\\ldots,T\\\}denotes the set of corrupted operations\. Both are random\. We requireIIto be predictable in the sense that\{t∈I\}∈𝒢t\\\{t\\in I\\\}\\in\\mathcal\{G\}\_\{t\}: whether operationttviolates the mechanism is determined by the state entering that operation, not by its realized outcome\. The results do not condition on the realized values ofTTorII\. Conditioning onTTcan bias earlier innovations when the stopping decision depends on the observed history\.

### 2\.2Predictive families and generalized residuals

The modelℳ\\mathcal\{M\}is a predictable family of conditional laws: for eachtt, a probability measureQtQ\_\{t\}onℝd\\mathbb\{R\}^\{d\}whose parameters are𝒢t\\mathcal\{G\}\_\{t\}\-measurable, together with a conditional lawPtP\_\{t\}forctc\_\{t\}givenℱt−1\\mathcal\{F\}\_\{t\-1\}\. LetRtR\_\{t\}denote the Rosenblatt transform ofQtQ\_\{t\}, that is, the vector of successive conditional distribution functions \(Rosenblatt, 1952\), and define the generalized residuals

ut=Rt​\(xt\)∈\[0,1\]d,ϱt=Pt​\(\(−∞,ct\]\)∈\[0,1\]\.u\_\{t\}=R\_\{t\}\(x\_\{t\}\)\\in\[0,1\]^\{d\},\\qquad\\varrho\_\{t\}=P\_\{t\}\\big\(\(\-\\infty,c\_\{t\}\]\\big\)\\in\[0,1\]\.
These are the generalized residuals of Cox and Snell \(1968\) in prequential form \(Dawid, 1984\)\. A score is any measurableS:\[0,1\]d→ℝS:\[0,1\]^\{d\}\\to\\mathbb\{R\}, and the audit statistic isat=S​\(ut\)a\_\{t\}=S\(u\_\{t\}\)\.

The Gaussian bridge of Part II is the instance

Qt=𝒩​\(μt,Σt\),εt=Σt−1/2​\(xt−μt\),ut=Φ​\(εt\),S​\(u\)=‖Φ−1​\(u\)‖22,Q\_\{t\}=\\mathcal\{N\}\\big\(\\mu\_\{t\},\\Sigma\_\{t\}\\big\),\\qquad\\varepsilon\_\{t\}=\\Sigma\_\{t\}^\{\-1/2\}\(x\_\{t\}\-\\mu\_\{t\}\),\\qquad u\_\{t\}=\\Phi\(\\varepsilon\_\{t\}\),\\qquad S\(u\)=\\\|\\Phi^\{\-1\}\(u\)\\\|\_\{2\}^\{2\},
recoveringat=‖εt‖22a\_\{t\}=\\\|\\varepsilon\_\{t\}\\\|\_\{2\}^\{2\}\. Part I does not depend on this Gaussian specification\. The formulation in terms of predictive distributions also accommodates the multimodal predictive models required in Section 8\.

For a correctly specified sequential model, whitened one\-step prediction errors are innovations and therefore form a white sequence \(Kailath, 1968\)\. Quadratic forms in Kalman innovations are standard tools for model\-based fault detection and isolation \(Willsky, 1976; Basseville and Nikiforov, 1993\), and the distinction in Section 3\.2 between one\-step and accumulated residuals follows the structured\-residual literature \(Gertler, 1998\)\. The present contribution combines these residuals with distribution\-free calibration and trajectory\-level error control\.

### 2\.3Assumptions

Each is invoked only where stated\.

\(A0\) Cost non\-degeneracy\.ct≥cmin\>0c\_\{t\}\\geq c\_\{\\min\}\>0, andℒ​\(xt∣𝒢t\)\\mathcal\{L\}\(x\_\{t\}\\mid\\mathcal\{G\}\_\{t\}\)is atomless\. The second condition fails if cost determines the embedding, because conditioning onΔt\\Delta\_\{t\}would then condition on a function ofxtx\_\{t\}and the predictive law ofxtx\_\{t\}given𝒢t\\mathcal\{G\}\_\{t\}would be degenerate\. The assumption is plausible whenϕ\\phiis lossy and cost depends on data volume as well as operation semantics, but it must be assessed for the deployed representation\.

\(A1\) Calibration exchangeability\.Calibration trajectories are i\.i\.d\. draws from the population of valid trajectories, and the benign steps of a suspect trajectory are drawn from the same population\.

\(A1∗\) Calibration correctness\.The population law isℳ\\mathcal\{M\}\. This assumption is strictly stronger than \(A1\) and is used only for pooling across steps within a trajectory and for the exact\-null e\-values in Section 5\.4\.

\(A2a\) On\-support benign validity\.For a benign step whose conditioning state lies in the training support,ℒ​\(xt∣𝒢t\)=Qt\\mathcal\{L\}\(x\_\{t\}\\mid\\mathcal\{G\}\_\{t\}\)=Q\_\{t\}\.

\(A2b\) Off\-support benign conservatism\.For a benign step whose conditioning state lies outside the training support, the conditions of Theorem 7 hold\.

\(A3\) Predictable corruption\.\{t∈I\}∈𝒢t\\\{t\\in I\\\}\\in\\mathcal\{G\}\_\{t\}\.

\(A4\) Regular drift\.In the bridge instance,uθ​\(⋅,s,⋅\)u\_\{\\theta\}\(\\cdot,s,\\cdot\)isLL\-Lipschitz in its first argument uniformly inss\. Used in Sections 3\.2 and 8 only\.

\(A5\) Uninformative selection\.The event that a trajectory is submitted for audit is conditionally independent of the benign generalized residuals givenx0x\_\{0\}and the corrupted steps\.

Assumptions \(A2a\) and \(A2b\) distinguish on\-support and off\-support behavior\. Requiring benign steps to followℳ\\mathcal\{M\}exactly after arbitrary corrupted states would require the fitted model to be correct at states absent from training\. Exact validity is therefore assumed only on support; off\-support benign steps are required to satisfy the conservative\-tail conditions in Section 7\.

Assumption \(A5\) addresses selection into the audit sample\. A prior process has already classified the trajectory as unsound, and that decision depends on the complete trajectory\. Conditioning on selection can therefore alter the residual distribution\. If selection is driven primarily by corrupted operations, \(A5\) may be a reasonable approximation\. Section 5\.2 treats settings in which selection also depends on benign residuals\.

## 3Localization

### 3\.1Exact localization

Corruption is modeled by replacing the predictive law: fort∈It\\in I, the conditional law ofxtx\_\{t\}given𝒢t\\mathcal\{G\}\_\{t\}isQ~t≠Qt\\tilde\{Q\}\_\{t\}\\neq Q\_\{t\}, with predictable parameters\. An additive Gaussian mean shift is the special caseQ~t=𝒩​\(μt\+bt,Σt\)\\tilde\{Q\}\_\{t\}=\\mathcal\{N\}\(\\mu\_\{t\}\+b\_\{t\},\\Sigma\_\{t\}\)\.

Theorem 1 \(localization\)\.Assume \(A0\), \(A2a\), \(A3\), and that everyQtQ\_\{t\}is atomless\.

\(i\) For eachttand each bounded measurableff,

𝔼​\[f​\(ut\)​1​\{t≤T,t∉I\}\]=𝔼​\[f​\(U\)\]​ℙ​\(t≤T,t∉I\),U∼Unif​\[0,1\]d,\\mathbb\{E\}\\big\[f\(u\_\{t\}\)\\,\\mathbf\{1\}\\\{t\\leq T,\\ t\\notin I\\\}\\big\]=\\mathbb\{E\}\[f\(U\)\]\\;\\mathbb\{P\}\(t\\leq T,\\ t\\notin I\),\\qquad U\\sim\\mathrm\{Unif\}\[0,1\]^\{d\},and for anyt1<⋯<trt\_\{1\}<\\cdots<t\_\{r\}the analogous product identity holds on the event that all oft1,…,trt\_\{1\},\\ldots,t\_\{r\}are benign and at mostTT\. The benign generalized residuals are i\.i\.d\. uniform on the event that they exist, whatever corrupted states precede them\.

\(ii\) Fort∈It\\in I, conditionally on𝒢t\\mathcal\{G\}\_\{t\}the residual has lawRt​\#​Q~tR\_\{t\\\#\}\\tilde\{Q\}\_\{t\}and the score has the corresponding pushforward law\. No interaction between distinct corrupted steps arises\.

The proof is given in Appendix A\.1\. Exactness follows from specifying the model at the level of realized discrete transitions\. The events\{t≤T\}\\\{t\\leq T\\\}and\{t∉I\}\\\{t\\notin I\\\}belong to𝒢t\\mathcal\{G\}\_\{t\}, so the result accommodates both a stopping time and a random predictable corruption set\. The identity is not conditioned on the realized value ofTT, because such conditioning can alter earlier innovation distributions\.

Conditional on its input state, a correctly executed operation after a corruption follows the null predictive law\. Under the stated assumptions, signal is therefore confined toII\. Theorem 1 does not impose a causal ordering on the elements ofII\.

Corollary 1 \(Gaussian mean shift\)\.IfQ~t=𝒩​\(μt\+bt,Σt\)\\tilde\{Q\}\_\{t\}=\\mathcal\{N\}\(\\mu\_\{t\}\+b\_\{t\},\\Sigma\_\{t\}\)withbtb\_\{t\}being𝒢t\\mathcal\{G\}\_\{t\}\-measurable, then writingνt=Σt−1/2​bt\\nu\_\{t\}=\\Sigma\_\{t\}^\{\-1/2\}b\_\{t\}andλt=‖νt‖22\\lambda\_\{t\}=\\\|\\nu\_\{t\}\\\|\_\{2\}^\{2\}, conditionally on𝒢t\\mathcal\{G\}\_\{t\}we haveat∼χd2​\(λt\)a\_\{t\}\\sim\\chi^\{2\}\_\{d\}\(\\lambda\_\{t\}\), with tail probability strictly increasing inλt\\lambda\_\{t\}\(Johnson, Kotz and Balakrishnan, 1995\)\.

Corollary 2 \(dispersion shifts and two\-sided scoring\)\.IfQ~t=𝒩​\(μt,Σt1/2​\(I\+Γt\)​Σt1/2\)\\tilde\{Q\}\_\{t\}=\\mathcal\{N\}\(\\mu\_\{t\},\\Sigma\_\{t\}^\{1/2\}\(I\+\\Gamma\_\{t\}\)\\Sigma\_\{t\}^\{1/2\}\)withΓt≻−I\\Gamma\_\{t\}\\succ\-Ihaving eigenvaluesγt,1,…,γt,d\\gamma\_\{t,1\},\\ldots,\\gamma\_\{t,d\}, thenat∼∑i\(1\+γt,i\)​χ12a\_\{t\}\\sim\\sum\_\{i\}\(1\+\\gamma\_\{t,i\}\)\\chi^\{2\}\_\{1\}\. WhenΓt≺0\\Gamma\_\{t\}\\prec 0the score is stochastically smaller thanχd2\\chi^\{2\}\_\{d\}, and a one\-sided upper\-tail test has power below its level\.

Corollary 2 identifies a class of failures that an upper\-tail score cannot detect\. Reduced exploration, including repeated templates or highly stereotyped analysis sequences, may produce residuals that are systematically smaller than the null distribution\. A two\-sided score addresses this alternative; Section 4\.4 gives specific constructions\.

### 3\.2Multi\-horizon residuals

The natural competitor to one\-step scoring reconstructs the trajectory from its start and scores each step by its distance to the rollout\. In the bridge instance that comparison has an exact form\. Consider the drift flowz˙=\(x^T−z\)/\(1−s\)\+uθ​\(z,s\)\\dot\{z\}=\(\\hat\{x\}\_\{T\}\-z\)/\(1\-s\)\+u\_\{\\theta\}\(z,s\)on\[0,s¯\]\[0,\\bar\{s\}\],s¯<1\\bar\{s\}<1, and two solutions whose states ats0s\_\{0\}differ byb≠0b\\neq 0\.

Theorem 2 \(propagation envelope\)\.Under \(A4\), the gapD​\(s\)D\(s\)satisfies for alls∈\[s0,s¯\]s\\in\[s\_\{0\},\\bar\{s\}\]

‖b‖​1−s1−s0​e−L​\(s−s0\)≤‖D​\(s\)‖≤‖b‖​1−s1−s0​eL​\(s−s0\)\.\\\|b\\\|\\,\\frac\{1\-s\}\{1\-s\_\{0\}\}\\,e^\{\-L\(s\-s\_\{0\}\)\}\\;\\leq\\;\\\|D\(s\)\\\|\\;\\leq\\;\\\|b\\\|\\,\\frac\{1\-s\}\{1\-s\_\{0\}\}\\,e^\{L\(s\-s\_\{0\}\)\}\.
The proof \(Appendix A\.2\) uses a two\-sided comparison argument \(Grönwall, 1919\)\. If the diffusion is state\-independent, synchronous coupling cancels the noise and the envelope holds pathwise for the stochastic dynamics\. With state\-dependent diffusion, the result applies only to the drift flow\.

The bounds imply decay toward the shared anchor only whenL<1/\(1−s¯\)L<1/\(1\-\\bar\{s\}\), in which case both envelopes decrease\. For largerLL, the lower envelope still decreases, but the upper envelope increases\. The result then establishes only a range of possible behavior\. For example, atL=20L=20,s0=0\.5s\_\{0\}=0\.5, ands¯=0\.9\\bar\{s\}=0\.9, the envelope is\[6\.7×10−5,596\]​‖b‖\[6\.7\\times 10^\{\-5\},\\,596\]\\\|b\\\|\.

The comparison with the innovation residual relies on the strictly positive lower envelope\. Reconstruction fromx0x\_\{0\}assigns a nonzero deviation to every downstream operation, whereas a correctly specified one\-step innovation is null after the corrupted transition\. The two\-sided bound does not determine whether the reconstruction deviation decreases, persists, or increases\.

Free\-running reconstruction fromx0x\_\{0\}is only one member of a broader class of residuals\. Fork≥1k\\geq 1, define thekk\-step predictiveQt\(k\)=ℒℳ​\(xt∣ℱt−k,ct−k\+1,…,ct\)Q\_\{t\}^\{\(k\)\}=\\mathcal\{L\}\_\{\\mathcal\{M\}\}\(x\_\{t\}\\mid\\mathcal\{F\}\_\{t\-k\},c\_\{t\-k\+1\},\\ldots,c\_\{t\}\)and the corresponding residualut\(k\)u\_\{t\}^\{\(k\)\}and scoreat\(k\)a\_\{t\}^\{\(k\)\}\. Theorem 1 does not apply verbatim to these residuals\. Sliding windows overlap:ut\(k\)u\_\{t\}^\{\(k\)\}andut\+1\(k\)u\_\{t\+1\}^\{\(k\)\}sharek−1k\-1transitions, andut\(k\)u\_\{t\}^\{\(k\)\}is not measurable with respect to the conditioningσ\\sigma\-field forut\+1\(k\)u\_\{t\+1\}^\{\(k\)\}\. The peeling argument in Appendix A\.1 therefore does not yield a product identity\. Marginal uniformity and independence across sufficiently separated indices remain available under the conditions below\.

Proposition 1 \(width, validity, and dependence of thekk\-step channel\)\.Fixk≥1k\\geq 1and letI=\{t0\}I=\\\{t\_\{0\}\\\}\.

\(i\)*Width\.*at\(k\)a\_\{t\}^\{\(k\)\}has its null law for everyt≥t0\+kt\\geq t\_\{0\}\+k, and its law is affected by the corruption only fort0≤t≤t0\+k−1t\_\{0\}\\leq t\\leq t\_\{0\}\+k\-1\.

\(ii\)*Marginal validity\.*If\{t≤T\}∈ℱt−k\\\{t\\leq T\\\}\\in\\mathcal\{F\}\_\{t\-k\}, so that the agent commits to the complete window at its start, thenut\(k\)u\_\{t\}^\{\(k\)\}is marginally uniform on\{t≤T,t∉I\}\\\{t\\leq T,\\ t\\notin I\\\}by the argument of Appendix A\.1 applied to the coarser filtration\. Without this condition, halting decisions within the window can depend on its innovations, and marginal uniformity does not follow from the model\.

\(iii\)*Dependence\.*For indicest1<⋯<trt\_\{1\}<\\cdots<t\_\{r\}withtj\+1−tj≥kt\_\{j\+1\}\-t\_\{j\}\\geq k, the residualsut1\(k\),…,utr\(k\)u\_\{t\_\{1\}\}^\{\(k\)\},\\ldots,u\_\{t\_\{r\}\}^\{\(k\)\}are jointly independent uniform on the corresponding benign event\. For overlapping indices they are dependent, and no joint law is claimed\.

Fort≥t0\+kt\\geq t\_\{0\}\+k, the conditioningσ\\sigma\-field containsxt−kx\_\{t\-k\}witht−k≥t0t\-k\\geq t\_\{0\}, so the corrupted state is conditioned on rather than predicted through\. Reconstruction fromx0x\_\{0\}corresponds tok=tk=tand affects the complete suffix; the one\-step innovation corresponds tok=1k=1and affects only the corrupted transition\. Intermediate horizons yield intermediate localization widths\.

Parts \(ii\) and \(iii\) determine which error\-control results apply to the horizon channel\. Benjamini–Yekutieli and e\-BH require marginal super\-uniformity and therefore accept the horizon channel\. Proposition 6 requires independent null p\-values and does not apply to overlappingkk\-step windows\. It may be restricted to the one\-step channel or evaluated on a non\-overlapping subsequencet∈\{t0,t0\+k,t0\+2​k,…\}t\\in\\\{t\_\{0\},t\_\{0\}\+k,t\_\{0\}\+2k,\\ldots\\\}, with a factor\-kkreduction in the effective number of tests\. If the window\-commitment condition in part \(ii\) fails, the horizon channel can instead be calibrated under the exchangeability regime of Lemma 1\(ii\), stratified by trajectory length\.

The wider localization window can increase power for temporally distributed perturbations\. LetΣ≡σ2​I\\Sigma\\equiv\\sigma^\{2\}Ibe state\-independent and let the drift be locally the identity over a window ofkksteps\.

Proposition 2 \(accumulation gain\)\.Suppose a corruption of total displacementbbis injected evenly acrosskkconsecutive steps,bt=b/kb\_\{t\}=b/k\. The one\-step score at each of those steps has noncentrality‖b‖2/\(k2​σ2\)\\\|b\\\|^\{2\}/\(k^\{2\}\\sigma^\{2\}\); thekk\-step score at the end of the window has noncentrality‖b‖2/\(k​σ2\)\\\|b\\\|^\{2\}/\(k\\sigma^\{2\}\)\.

Combining with the detection boundary of Proposition 3, the one\-step channel detects such a corruption only when‖b‖2≳k2​σ2​2​d\\\|b\\\|^\{2\}\\gtrsim k^\{2\}\\sigma^\{2\}\\sqrt\{2d\}, while thekk\-step channel detects it when‖b‖2≳k​σ2​2​d\\\|b\\\|^\{2\}\\gtrsim k\\sigma^\{2\}\\sqrt\{2d\}\. In the intervening range

k​σ2​2​d≲‖b‖2<k2​σ2​2​dk\\,\\sigma^\{2\}\\sqrt\{2d\}\\;\\lesssim\\;\\\|b\\\|^\{2\}\\;<\\;k^\{2\}\\sigma^\{2\}\\sqrt\{2d\}
the corruption is undetectable by one\-step scoring but detectable by thekk\-step score\. Thus, gradual perturbations are a limitation of the one\-step horizon rather than of innovation scoring in general\. A small set of horizons, such ask∈\{1,4,16\}k\\in\\\{1,4,16\\\}, can recover these alternatives, with a corresponding increase in the number of hypotheses and localization width\. Sequential accumulation methods derived from Page’s CUSUM \(Page, 1954\) remain appropriate for detecting the onset of an unbounded regime change; Section 12 distinguishes that problem from bounded gradual perturbations\.

## 4Choice of score

Because every measurable functional of the generalized residual is pivotal under Theorem 1, the score affects power but not null validity\. This section compares power across score choices\.

### 4\.1The detection boundary

In the Gaussian instance with a mean shift, per\-step detection reduces to testingχd2\\chi^\{2\}\_\{d\}againstχd2​\(λ\)\\chi^\{2\}\_\{d\}\(\\lambda\)\.

Proposition 3 \(chi\-square detection boundary\)\.Letχd,1−α2\\chi^\{2\}\_\{d,1\-\\alpha\}denote the\(1−α\)\(1\-\\alpha\)\-quantile ofχd2\\chi^\{2\}\_\{d\}anda∼χd2​\(λd\)a\\sim\\chi^\{2\}\_\{d\}\(\\lambda\_\{d\}\)\. Asd→∞d\\to\\infty: ifλd/2​d→0\\lambda\_\{d\}/\\sqrt\{2d\}\\to 0thenℙ​\(a\>χd,1−α2\)→α\\mathbb\{P\}\(a\>\\chi^\{2\}\_\{d,1\-\\alpha\}\)\\to\\alpha; ifλd/2​d→c∈\(0,∞\)\\lambda\_\{d\}/\\sqrt\{2d\}\\to c\\in\(0,\\infty\)then the power tends toΦ​\(c−zα\)\\Phi\(c\-z\_\{\\alpha\}\); ifλd/2​d→∞\\lambda\_\{d\}/\\sqrt\{2d\}\\to\\inftythe power tends to one\.

The quadratic score has asymptotically negligible power when the noncentrality iso​\(d\)o\(\\sqrt\{d\}\)\. A perturbation confined to a few coordinates can therefore be diluted in a high\-dimensional embedding\.

### 4\.2Sparse alternatives at finite dimension

Proposition 4 \(asymptotic separation\)\.Supposeν\\nuhaskdk\_\{d\}nonzero coordinates of common magnitudeδd=2​\(1\+η\)​log⁡d\\delta\_\{d\}=\\sqrt\{2\(1\+\\eta\)\\log d\}for someη\>0\\eta\>0, withkd=o​\(d/log⁡d\)k\_\{d\}=o\(\\sqrt\{d\}/\\log d\)\. The level\-α\\alphaBonferroni test rejecting whenmaxi⁡\|εi\|\>zα/\(2​d\)\\max\_\{i\}\|\\varepsilon\_\{i\}\|\>z\_\{\\alpha/\(2d\)\}has power tending to one, while the level\-α\\alphachi\-square test has power tending toα\\alpha\.

The sparse\-versus\-dense dichotomy is classical in Gaussian sequence detection \(Ingster and Suslina, 2003; Fan, 1996\), and higher criticism interpolates between the regimes \(Donoho and Jin, 2004\)\.

Proposition 4 describes an asymptotic regime\. The table below reports exact requirements atα=0\.01\\alpha=0\.01and 80% power:λ∗\\lambda^\{\\ast\}is the noncentrality required by the chi\-square channel, andλk∗=k​δ2\\lambda\_\{k\}^\{\\ast\}=k\\delta^\{2\}is the requirement for the maximum channel when the signal occupieskkcoordinates with common magnitudeδ\\delta\.

Atd=256d=256, the maximum channel requires 3\.3\-fold less noncentrality than the chi\-square channel for a one\-coordinate perturbation and 1\.8\-fold less for a three\-coordinate perturbation, but requires more for a ten\-coordinate perturbation\. The largest sparsity for which the maximum is more powerful isk∗=1,2,5,7k^\{\\ast\}=1,2,5,7atd=8,32,128,256d=8,32,128,256, respectively; atd=256d=256, this is less than 3% of coordinates\. Thus, the finite\-dimensional advantage is moderate and restricted to highly sparse alternatives\. Both channels should be evaluated at the deployed dimension rather than selected from the asymptotic result alone\.

Projection dimension affects power only when the projection preserves the perturbation\. Suppose the corruption lies in a fixed subspace and the audit projectsℝ256\\mathbb\{R\}^\{256\}ontommdimensions\. A signal\-preserving projection lowers the required noncentrality from 80\.0 atm=256m=256to 33\.5 atm=32m=32and 20\.6 atm=8m=8\. A projection selected without reference to the perturbation retains an expected fractionm/dm/dof the noncentrality; the required ambient noncentrality then increases asmmdecreases \(80 atm=256m=256, 118 atm=128m=128, 268 atm=32m=32, and 660 atm=8m=8\)\. Dimension reduction therefore improves power only when it preserves the alternatives of interest\. Section 11\.2 gives a stronger reason to reduce effective dimension: the smallest attributable corruption has a floor of ordern−1/\(d\+2\)n^\{\-1/\(d\+2\)\}, so dimension determines the rate at which calibration data improve attribution\.

### 4\.3Sparsity in the whitened basis

Proposition 4 concerns sparsity ofν=Σ−1/2​b\\nu=\\Sigma^\{\-1/2\}b, not ofbb\.

Proposition 5\.For generalΣ≻0\\Sigma\\succ 0there exist 1\-sparsebbwithΣ−1/2​b\\Sigma^\{\-1/2\}bhavingddnonzero coordinates\. IfΣ\\Sigmais diagonal, the supports ofbbandΣ−1/2​b\\Sigma^\{\-1/2\}bcoincide\.

Whitened\-coordinate sparsity is not a generic consequence of semantic localization; it depends on the covariance parameterization\. ConstrainingΣθ\\Sigma\_\{\\theta\}to be diagonal preserves coordinate support\. Under a diagonal\-plus\-low\-rank formΛ\+U​U⊤\\Lambda\+UU^\{\\top\}, whitening mixes coordinates within the low\-rank subspace, and the maximum channel should be evaluated in an appropriate covariance eigenbasis\. The deployed covariance structure should be reported\.

### 4\.4Two\-sided scores and channel combination

Corollary 2 requires attention to the lower tail\. Definept\+p\_\{t\}^\{\+\}from the upper tail of the calibration scores andpt−p\_\{t\}^\{\-\}from the lower, and use2​min⁡\(pt\+,pt−\)2\\min\(p\_\{t\}^\{\+\},p\_\{t\}^\{\-\}\); or score directly by a functional sensitive to both, such as the Anderson–Darling distance of the coordinates ofutu\_\{t\}from uniformity, which is pivotal by Theorem 1 like any other\.

Running several channels at levelqqand taking their union generally inflates the error rate\. A single combined statistic can instead be formed by standardizing each channel on the calibration set, taking the maximum, and conformalizing that maximum\. Theorem 1 then gives a single pivotal statistic and one family of p\-values for Section 5\. Higher criticism \(Donoho and Jin, 2004\) provides another single statistic that adapts across sparsity regimes\.

### 4\.5Joint effect of the sensitivity parameters

Sensitivity is governed jointly by the embedding dimensiondd, the variance floorσmin2\\sigma\_\{\\min\}^\{2\}, and the off\-support inflation rateγ\\gammaof Section 7\. These are not independent choices\. Write

σeff2​\(D\)=max⁡\{σmin2,σ02​\(1\+γ​D2\)\}\\sigma^\{2\}\_\{\\mathrm\{eff\}\}\(D\)=\\max\\big\\\{\\sigma^\{2\}\_\{\\min\},\\ \\sigma\_\{0\}^\{2\}\(1\+\\gamma D^\{2\}\)\\big\\\}
for a step whose conditioning state lies at distanceDDfrom the training support\.

Corollary 3 \(minimum detectable perturbation\)\.At levelα\\alphaand power1−β1\-\\beta, a mean\-shift corruptionbbis detectable by the chi\-square channel only if

‖b‖22≥σeff2​\(D\)​2​d​\(zα\+z1−β\),\\\|b\\\|\_\{2\}^\{2\}\\;\\geq\\;\\sigma^\{2\}\_\{\\mathrm\{eff\}\}\(D\)\\,\\sqrt\{2d\}\\,\\big\(z\_\{\\alpha\}\+z\_\{1\-\\beta\}\\big\),and by the maximum channel only if

‖b‖∞≥σeff​\(D\)​\(zα/\(2​d\)\+z1−β\)\.\\\|b\\\|\_\{\\infty\}\\;\\geq\\;\\sigma\_\{\\mathrm\{eff\}\}\(D\)\\,\\big\(z\_\{\\alpha/\(2d\)\}\+z\_\{1\-\\beta\}\\big\)\.
Increasingddraises the dense threshold on‖b‖\\\|b\\\|at rated1/4d^\{1/4\}and the sparse threshold at ratelog⁡d\\sqrt\{\\log d\}\. Increasingγ\\gammaorσmin\\sigma\_\{\\min\}raises both thresholds linearly inσeff\\sigma\_\{\\mathrm\{eff\}\}\. Robustness choices involving these parameters should therefore be reported together with their effects on detection sensitivity\.

## 5Error control

### 5\.1Two calibration regimes

Under \(A1∗\), all calibration residuals across all calibration trajectories are i\.i\.d\. uniform, so their scores form an i\.i\.d\. sampleΩ=\{ω1,…,ωn\}\\Omega=\\\{\\omega\_\{1\},\\ldots,\\omega\_\{n\}\\\}from the null score law\. Pooling across steps and across trajectories is then exact by pivotality\. For a suspect trajectory,

pt=1\+\#​\{j:ωj≥at\}n\+1\.p\_\{t\}=\\frac\{1\+\\\#\\\{j:\\omega\_\{j\}\\geq a\_\{t\}\\\}\}\{n\+1\}\.
Lemma 1 \(validity\)\.\(i\) Under \(A1∗\), \(A2a\), \(A3\), and \(A5\), for each benigntt,ℙ\(pt≤u∣t≤T,t∉I\)≤u\\mathbb\{P\}\(p\_\{t\}\\leq u\\mid t\\leq T,\\ t\\notin I\)\\leq ufor allu∈\[0,1\]u\\in\[0,1\]\(Vovk, Gammerman and Shafer, 2005\)\. \(ii\) Under \(A1\) and \(A5\) alone, the same result holds for a stratified p\-value in whichΩ\\Omegais restricted to calibration scores at the same step index astt, or to the same bin ofst−1s\_\{t\-1\}, provided the benign test step and calibration trajectories are exchangeable within that stratum\.

The two regimes impose different requirements on the fitted model\. Pooling across steps within a trajectory requires correct specification, because pivotality makes scores at different positions comparable\. Pooling across trajectories at a matched index requires only exchangeability and stable application of the fitted model, even under systematic misspecification\. The second regime has lower resolution: withBBstrata, the smallest attainable p\-value is1/\(n/B\+1\)1/\(n/B\+1\)\. With many strata and only several hundred calibration trajectories, this discreteness can materially affect Benjamini–Yekutieli thresholds\. A small number of prespecified bins ofst−1s\_\{t\-1\}provides a practical compromise, and the binning rule should be reported\.

### 5\.2Selection of the audited trajectory

The audit is applied after a prior process has classified a trajectory as unsound\. The calibration results are valid under this conditioning only if \(A5\) holds\. When selection depends mainly on corrupted operations, the distribution of benign residuals may be approximately preserved\. When selection depends on the overall atypicality of the trajectory, benign residuals in selected trajectories can be stochastically larger than those in the calibration population, making the p\-values anti\-conservative\.

Two approaches address selection\. If the selection probabilityπ​\(trajectory\)\\pi\(\\text\{trajectory\}\)can be estimated from reviewer scores or from labeled selected and unselected trajectories, weighted conformal prediction reweights the calibration distribution by the selected\-to\-unselected likelihood ratio \(Tibshirani, Barber, Candès and Ramdas, 2019\)\. Alternatively, calibration trajectories can be sampled from the selected population and independently adjudicated as valid\. The latter avoids assumption \(A5\) but may yield a smaller calibration set\. Section 5\.7 develops a sensitivity analysis that does not require estimating the selection model\.

### 5\.3A p\-value procedure with a fixed number of hypotheses

Within one trajectory the null p\-values share the calibration set and are therefore dependent even though the underlying null scores are independent\. Corrupted\-step scores may depend on earlier benign residuals through the state, since corruption parameters are predictable\.

A second issue is thatTTis random\. The procedures of Benjamini and Hochberg \(1995\) and Benjamini and Yekutieli \(2001\) are formulated for a fixed number of hypotheses\. BecauseT≤TmaxT\\leq T\_\{\\max\}deterministically, the family can be padded toTmaxT\_\{\\max\}hypotheses by settingpt=1p\_\{t\}=1fort\>Tt\>T\. The padded p\-values are super\-uniform and cannot be rejected, so the observed rejection set is unchanged and the number of hypotheses is fixed\.

Theorem 3 \(arbitrary dependence\)\.Under \(A1∗\) or \(A1\) as appropriate, together with \(A2a\), \(A3\), \(A5\), applying the Benjamini–Yekutieli procedure to the padded family ofTmaxT\_\{\\max\}p\-values at levelq/HTmaxq/H\_\{T\_\{\\max\}\}, whereHm=∑k≤m1/kH\_\{m\}=\\sum\_\{k\\leq m\}1/k, controls the trajectory false discovery rate atq​m0/Tmax≤qq\\,m\_\{0\}/T\_\{\\max\}\\leq qunder arbitrary joint dependence \(Benjamini and Yekutieli, 2001\)\.

A stronger result at the nominal Benjamini–Hochberg level requires additional dependence conditions\. In the present corruption model, corrupted\-step scores may depend on earlier benign residuals through predictable corruption parameters, so joint independence generally fails\. It does hold in controlled fault\-injection benchmarks when the corruption is fixed conditional onx0x\_\{0\}\. In that setting, the shared\-calibration positive\-dependence result of Bates, Candès, Lei, Romano and Sesia \(2023\) supports Benjamini–Hochberg at the nominal level\. This result should therefore be stated as benchmark\-specific rather than as a deployment\-wide guarantee\.

### 5\.4An e\-value procedure

AtTmax=40T\_\{\\max\}=40,HTmaxH\_\{T\_\{\\max\}\}is approximately 4\.3, so the Benjamini–Yekutieli adjustment substantially reduces the rejection threshold\. An e\-value procedure avoids this harmonic factor\.

Under \(A1∗\), the null score law is known exactly \(χd2\\chi^\{2\}\_\{d\}in the Gaussian instance\), so likelihood\-ratio e\-values are available in closed form\. For a mixing distributionπ\\piover noncentralities,

et=∫fd,λ​\(at\)fd​\(at\)​π​\(d​λ\),fd,λ​\(a\)fd​\(a\)=e−λ/2​Γ​\(d/2\)​\(λ​a2\)−\(d/2−1\)​Id/2−1​\(λ​a\),e\_\{t\}\\;=\\;\\int\\frac\{f\_\{d,\\lambda\}\(a\_\{t\}\)\}\{f\_\{d\}\(a\_\{t\}\)\}\\,\\pi\(d\\lambda\),\\qquad\\frac\{f\_\{d,\\lambda\}\(a\)\}\{f\_\{d\}\(a\)\}\\;=\\;e^\{\-\\lambda/2\}\\,\\Gamma\(d/2\)\\,\\Big\(\\tfrac\{\\sqrt\{\\lambda a\}\}\{2\}\\Big\)^\{\-\(d/2\-1\)\}I\_\{d/2\-1\}\\big\(\\sqrt\{\\lambda a\}\\big\),
whereIνI\_\{\\nu\}is the modified Bessel function of the first kind\. Eachete\_\{t\}has null expectation one because it is a likelihood ratio\. Under exchangeability alone, conformal p\-values can be converted to e\-values with any decreasing calibratorffsatisfying∫01f=1\\int\_\{0\}^\{1\}f=1; for example,f​\(p\)=κ​pκ−1f\(p\)=\\kappa p^\{\\kappa\-1\}withκ∈\(0,1\)\\kappa\\in\(0,1\)\(Vovk and Wang, 2021\)\.

Theorem 4 \(e\-BH\)\.Lete1,…,eTmaxe\_\{1\},\\ldots,e\_\{T\_\{\\max\}\}be e\-values for the padded family, valid for the nulls in the sense that𝔼​\[et\]≤1\\mathbb\{E\}\[e\_\{t\}\]\\leq 1\. Order them ase\(1\)≥⋯≥e\(Tmax\)e\_\{\(1\)\}\\geq\\cdots\\geq e\_\{\(T\_\{\\max\}\)\}and setk∗=max⁡\{k:e\(k\)≥Tmax/\(q​k\)\}k^\{\\ast\}=\\max\\\{k:e\_\{\(k\)\}\\geq T\_\{\\max\}/\(qk\)\\\}\. Rejecting thek∗k^\{\\ast\}largest e\-values controls the trajectory FDR atq​m0/Tmax≤qq\\,m\_\{0\}/T\_\{\\max\}\\leq qunder arbitrary dependence \(Wang and Ramdas, 2022\)\.

The absence of a harmonic factor does not imply uniformly greater power\. A likelihood\-ratio e\-value requires a mixing distributionπ\\pi, and power depends on its mass near the relevant alternatives; Corollary 3 identifies the corresponding detection scale\. Converting conformal p\-values to e\-values also reduces efficiency\. Relative power should therefore be evaluated for the intended trajectory length and alternative class\. Boosting against a known null can recover part of this loss \(Wang and Ramdas, 2022\)\.

### 5\.5Per\-report false discovery proportion

Trajectory\-level false discovery rate is an expectation over an ensemble of audited trajectories\. It is not a high\-probability guarantee for the realized false discovery proportion in a single report\.

A high\-probability statement for a single report requires a simultaneous bound on the realized false discovery proportion\. Under \(A1∗\) and \(A2a\), the benign p\-values from the one\-step channel are i\.i\.d\. uniform, so the Dvoretzky–Kiefer–Wolfowitz inequality with Massart’s constant applies \(Dvoretzky, Kiefer and Wolfowitz, 1956; Massart, 1990\)\. Independence is required: overlapping horizon scores in Section 3\.2 and the anchor correction in Section 6\.3 do not satisfy this condition\.

Proposition 6 \(simultaneous FDP bound, one\-step channel\)\.With probability at least1−δ1\-\\delta, simultaneously over all thresholdss∈\[0,1\]s\\in\[0,1\],

FDP​\(s\)≤T​s\+T​log⁡\(2/δ\)/21∨R​\(s\),\\mathrm\{FDP\}\(s\)\\;\\leq\\;\\frac\{Ts\+\\sqrt\{T\\log\(2/\\delta\)/2\}\}\{1\\vee R\(s\)\},whereR​\(s\)R\(s\)is the number of p\-values at mostss\. Sharper simultaneous bounds tuned to BH\-type threshold families are available \(Katsevich and Ramdas, 2020\)\.

Atδ=0\.1\\delta=0\.1, the additive term equals 3\.9 flags atT=10T=10, 5\.5 atT=20T=20, and 8\.7 atT=50T=50\. The bound is therefore uninformative unless the number of reported operations is large relative to typical trajectory length\. At the trajectory lengths considered here, Sections 5\.3 and 5\.4 provide long\-run FDR guarantees rather than report\-specific probability statements\. The trajectory remains the appropriate unit of multiplicity adjustment because the number of true errors may vary substantially across analyses, but the guarantee is an ensemble property\.

### 5\.6Robustness to misspecification

Theorem 5 \(total\-variation robustness\)\.Suppose corrupted steps have arbitrary predictable kernels, and each benign step’s true conditional law given𝒢t\\mathcal\{G\}\_\{t\}is within total variationδt\\delta\_\{t\}ofQtQ\_\{t\}, uniformly over histories\. Letψ\\psibe any flagging procedure, measurable in the scores and the calibration set, whose FDR is at mostqqwhen benign steps followℳ\\mathcal\{M\}\. Then under the true dynamicsFDR​\(ψ\)≤q\+∑t∉Iδt\\mathrm\{FDR\}\(\\psi\)\\leq q\+\\sum\_\{t\\notin I\}\\delta\_\{t\}\.

The proof \(Appendix A\.7\) is a sequential maximal coupling \(Lindvall, 2002\)\.

Applying the same coupling argument to calibration misspecification yields an additive termn​ϵn\\epsilonfornncalibration points whose laws are each withinϵ\\epsilonof the model\. This bound is generally uninformative for realisticnn\. Validity depends on the calibration empirical distribution function, which permits a sharper concentration argument\.

Proposition 7 \(sharpened calibration term\)\.Suppose each calibration score is drawn independently from a lawGGwith‖G−F‖∞≤ϵ\\\|G\-F\\\|\_\{\\infty\}\\leq\\epsilon, whereFFis the model null score law\. Fixδ∈\(0,1\)\\delta\\in\(0,1\)and set

η=ϵ\+log⁡\(2/δ\)2​n\+1n\+1\.\\eta\\;=\\;\\epsilon\+\\sqrt\{\\frac\{\\log\(2/\\delta\)\}\{2n\}\}\+\\frac\{1\}\{n\+1\}\.Then with probability at least1−δ1\-\\deltathe inflated p\-valuesp~t=min⁡\(1,pt\+η\)\\tilde\{p\}\_\{t\}=\\min\(1,p\_\{t\}\+\\eta\)are super\-uniform for benigntt, so every guarantee of Sections 5\.3 and 5\.4 holds forp~\\tilde\{p\}with an additionalδ\\deltaadded to the FDR\.

The correction improves the bound fromn​ϵn\\epsilontoϵ\+O​\(n−1/2\)\\epsilon\+O\(n^\{\-1/2\}\)and is directly implementable by inflating each p\-value byη\\eta\. Estimation error requires no separate term because assumptions \(A1\), \(A2a\), and \(A2b\) concern the deployed kernels; discrepancies between the fitted model and the data\-generating law are included in these assumptions\.

A remaining limitation is that total variation between transition kernels can be much larger than total variation between the induced score laws, although flagging depends on the trajectory only through the scores\. A bound stated in terms of score laws would be sharper and estimable from held\-out valid trajectories\. Such a bound is not derived here because the sequential coupling requires equality of states, whereas equality of scores does not imply equality of states\. Section 9 describes diagnostics that can be evaluated directly\.

### 5\.7Sensitivity to the selection mechanism

The submission propensity is difficult to model because the dependence of the upstream judgment on benign operations is not directly observable\. A sensitivity analysis can instead bound the propensity variation and report how much selection would be required to remove each flag\.

Theorem 6 \(selection sensitivity\)\.LetSSbe the event that a trajectory is submitted for audit,π​\(τ\)=ℙ​\(S∣τ\)\\pi\(\\tau\)=\\mathbb\{P\}\(S\\mid\\tau\)its propensity, and suppose that across valid trajectories the propensity odds vary by at most a factorΓ≥1\\Gamma\\geq 1:

Γ−1≤π​\(τ\)/\(1−π​\(τ\)\)π​\(τ′\)/\(1−π​\(τ′\)\)≤Γfor all valid​τ,τ′\.\\Gamma^\{\-1\}\\;\\leq\\;\\frac\{\\pi\(\\tau\)\\big/\\big\(1\-\\pi\(\\tau\)\\big\)\}\{\\pi\(\\tau^\{\\prime\}\)\\big/\\big\(1\-\\pi\(\\tau^\{\\prime\}\)\\big\)\}\\;\\leq\\;\\Gamma\\qquad\\text\{for all valid \}\\tau,\\tau^\{\\prime\}\.Then for every benign step,ℙ​\(pt≤u∣S\)≤Γ​u\\mathbb\{P\}\(p\_\{t\}\\leq u\\mid S\)\\leq\\Gamma ufor allu∈\[0,1\]u\\in\[0,1\], and Benjamini–Yekutieli or e\-BH applied at levelq/Γq/\\Gammacontrols the trajectory false discovery rate atqqwithin the selected population\.

The proof \(Appendix A\.11\) follows because the odds bound impliesπ​\(τ\)≤Γ​π​\(τ′\)\\pi\(\\tau\)\\leq\\Gamma\\pi\(\\tau^\{\\prime\}\)pointwise, so selection can increase any benign\-event probability by at mostΓ\\Gamma\. WhenΓ=1\\Gamma=1, submission is exchangeable and \(A5\) holds\. A valueΓ=2\\Gamma=2permits a twofold difference in submission probabilities and requires a corresponding twofold reduction in the operating level\.

For a Benjamini–Yekutieli rejection at rankkkwith p\-valuep\(k\)p\_\{\(k\)\}, the largest propensity ratio under which the rejection remains is

Γ∗=q​kTmax​HTmax​p\(k\)\.\\Gamma^\{\\ast\}\\;=\\;\\frac\{q\\,k\}\{T\_\{\\max\}\\,H\_\{T\_\{\\max\}\}\\;p\_\{\(k\)\}\}\.Thus, each flag can be accompanied by the selection\-strength value that would remove it\. Larger values ofΓ∗\\Gamma^\{\\ast\}indicate greater robustness to selection; values near one indicate substantial sensitivity\. The quantity is available from the observed p\-values and requires no fitted selection model\.

Part II: The bridge instantiation

## 6The bridge model

### 6\.1Time, cost, and predictability of the grid

Normalization by realized total cost,∑i≤Tci\\sum\_\{i\\leq T\}c\_\{i\}, makes early time points depend on future operation costs and is therefore incompatible with predictable conditioning\. Budget normalization,st=Cmax−1​∑i≤tcis\_\{t\}=C\_\{\\max\}^\{\-1\}\\sum\_\{i\\leq t\}c\_\{i\}, removes this dependence\. It also ensuressT<1s\_\{T\}<1on valid runs, so the bridge drift does not reach the1/\(1−s\)1/\(1\-s\)singularity, and gives the deterministic boundT≤TmaxT\\leq T\_\{\\max\}used in Section 5\.3\.

Budget normalization alone does not make the grid predictable\. The incrementΔt=ct/Cmax\\Delta\_\{t\}=c\_\{t\}/C\_\{\\max\}and the embeddingxtx\_\{t\}are both properties of operationtt\. A model that conditions the law ofxtx\_\{t\}onΔt\\Delta\_\{t\}therefore conditions on another feature of the same operation\. Under \(A0\), this conditional law is well defined and non\-degenerate, but the joint distribution must be factorized explicitly:

p​\(ct,xt∣ℱt−1\)=pψ​\(ct∣ℱt−1\)⏟cost model⋅pθ​\(xt∣ct,ℱt−1\)⏟embedding model,=Qt\.p\(c\_\{t\},x\_\{t\}\\mid\\mathcal\{F\}\_\{t\-1\}\)\\;=\\;\\underbrace\{p\_\{\\psi\}\(c\_\{t\}\\mid\\mathcal\{F\}\_\{t\-1\}\)\}\_\{\\text\{cost model\}\}\\;\\cdot\\;\\underbrace\{p\_\{\\theta\}\(x\_\{t\}\\mid c\_\{t\},\\mathcal\{F\}\_\{t\-1\}\)\}\_\{\\text\{embedding model, \}=Q\_\{t\}\}\.
The second factor is the Gaussian bridge transition defined below and is conditioned on𝒢t\\mathcal\{G\}\_\{t\}\. The first factor is necessary unless operation cost is treated as exogenous\.

Execution cost provides an additional audit channel\. An operation that processes substantially fewer records than predicted may indicate an unintended cohort restriction, whereas a substantially larger cost may indicate a join or keying error\. The cost residualϱt\\varrho\_\{t\}can be standardized on the calibration set, combined with the embedding score before conformalization, and represented by one p\-value per operation for the multiplicity procedures in Section 5\.

A deployment that does not model cost can setΔt≡1/Tmax\\Delta\_\{t\}\\equiv 1/T\_\{\\max\}and include realized cost only as a covariate ofΣθ\\Sigma\_\{\\theta\}throughℱt−1\\mathcal\{F\}\_\{t\-1\}\. This alternative is predictable but does not preserve the geometry of cost\-normalized time\.

### 6\.2Dynamics

Letx^T\(t\)=gη​\(x0,xt−1,st−1\)\\hat\{x\}\_\{T\}^\{\(t\)\}=g\_\{\\eta\}\(x\_\{0\},x\_\{t\-1\},s\_\{t\-1\}\)be a terminal anchor\. Fort=1,…,Tt=1,\\ldots,T,

xt=μt​\(xt−1\)\+Σt​\(xt−1\)1/2​ξt,ξt∼𝒩​\(0,Id\)​i\.i\.d\.,x\_\{t\}=\\mu\_\{t\}\(x\_\{t\-1\}\)\+\\Sigma\_\{t\}\(x\_\{t\-1\}\)^\{1/2\}\\xi\_\{t\},\\qquad\\xi\_\{t\}\\sim\\mathcal\{N\}\(0,I\_\{d\}\)\\ \\text\{i\.i\.d\.\},μt​\(x\)=x\+\[x^T\(t\)−x1−st−1\+uθ​\(x,st−1,x^T\(t\)\)\]​Δt,Σt​\(x\)=Σθ​\(x,st−1,Δt\)⪰σmin2​Id\.\\mu\_\{t\}\(x\)=x\+\\left\[\\frac\{\\hat\{x\}\_\{T\}^\{\(t\)\}\-x\}\{1\-s\_\{t\-1\}\}\+u\_\{\\theta\}\\big\(x,s\_\{t\-1\},\\hat\{x\}\_\{T\}^\{\(t\)\}\\big\)\\right\]\\Delta\_\{t\},\\qquad\\Sigma\_\{t\}\(x\)=\\Sigma\_\{\\theta\}\\big\(x,s\_\{t\-1\},\\Delta\_\{t\}\\big\)\\succeq\\sigma\_\{\\min\}^\{2\}I\_\{d\}\.
Three aspects of this specification require comment\. First, the anchor is re\-estimated from the current state at each step rather than fixed atgη​\(x0\)g\_\{\\eta\}\(x\_\{0\}\)\. Becausex^T\(t\)\\hat\{x\}\_\{T\}^\{\(t\)\}is𝒢t\\mathcal\{G\}\_\{t\}\-measurable, the conditioning statements in Part I remain valid\. The anchor head should be trained against held\-out realized endpoints rather than through the trajectory likelihood; otherwise, the degenerate solutionx^T\(t\)→xt−1\\hat\{x\}\_\{T\}^\{\(t\)\}\\to x\_\{t\-1\}can eliminate the bridge drift while increasing the likelihood\.

Second, the covariance is a free function of state and time rather than being proportional toΔt\\Delta\_\{t\}\. Proportionality would impose diffusiveΔt\\sqrt\{\\Delta\_\{t\}\}scaling, which can underweight operations that have low execution cost but large semantic effects, such as a restrictive cohort filter\. Section 4\.3 further motivates a diagonal or diagonal\-plus\-low\-rank covariance so that sparse alternatives remain interpretable after whitening\.

Third, the covariance floor prevents degeneracy of the heteroscedastic Gaussian likelihood when fitted variances collapse on interpolated observations \(Seitzer et al\., 2022\)\. Corollary 3 also shows that the floor determines detection sensitivity and should be selected with reference to a minimum perturbation of scientific interest\.

The mean is an Euler discretization \(Kloeden and Platen, 1992\) of a bridge stochastic differential equation whose leading drift is thehh\-transform of Brownian motion pinned at the anchor \(Doob, 1957; Rogers and Williams, 2000\)\. The discrete recursion, rather than the continuous\-time equation, is the statistical model\. Its transition law is therefore exact by construction, whereas an exact transition density for the nonlinear stochastic differential equation is not assumed\.

### 6\.3The anchor as a nuisance parameter

Anchor error affects every step through a known loading structure\. If the fitted anchor isx^T\(t\)\\hat\{x\}\_\{T\}^\{\(t\)\}but the trajectory is directed towardx^T\(t\)\+g\\hat\{x\}\_\{T\}^\{\(t\)\}\+g, the true conditional mean differs fromμt\\mu\_\{t\}byg​wtg\\,w\_\{t\}, where

wt=Δt1−st−1w\_\{t\}=\\frac\{\\Delta\_\{t\}\}\{1\-s\_\{t\-1\}\}
is known\. In the isotropic caseΣt=σt2​I\\Sigma\_\{t\}=\\sigma\_\{t\}^\{2\}I, definevt=wt/σtv\_\{t\}=w\_\{t\}/\\sigma\_\{t\}andW=∑t≤Tvt2W=\\sum\_\{t\\leq T\}v\_\{t\}^\{2\}\. Thenεt=ξt\+vt​g\\varepsilon\_\{t\}=\\xi\_\{t\}\+v\_\{t\}g, which is a fixed\-effect model with a vector parameterggand known scalar loadings\.

Proposition 8 \(anchor projection and induced contamination\)\.Forϱ≥0\\varrho\\geq 0letg^ϱ=\(W\+ϱ\)−1​∑tvt​εt\\hat\{g\}\_\{\\varrho\}=\(W\+\\varrho\)^\{\-1\}\\sum\_\{t\}v\_\{t\}\\varepsilon\_\{t\},ε~t=εt−vt​g^ϱ\\tilde\{\\varepsilon\}\_\{t\}=\\varepsilon\_\{t\}\-v\_\{t\}\\hat\{g\}\_\{\\varrho\}andht=vt2/\(W\+ϱ\)h\_\{t\}=v\_\{t\}^\{2\}/\(W\+\\varrho\), with∑tht=W/\(W\+ϱ\)≤1\\sum\_\{t\}h\_\{t\}=W/\(W\+\\varrho\)\\leq 1\.

\(i\) If no step is corrupted thena~t=‖ε~t‖2/\(1−ht\)\\tilde\{a\}\_\{t\}=\\\|\\tilde\{\\varepsilon\}\_\{t\}\\\|^\{2\}/\(1\-h\_\{t\}\)is marginallyχd2\\chi^\{2\}\_\{d\}for everygg, but the corrected residuals are cross\-correlated:Cov​\(ε~t,ε~s\)=−vt​vs​\(W\+ϱ\)−1​Id\\mathrm\{Cov\}\(\\tilde\{\\varepsilon\}\_\{t\},\\tilde\{\\varepsilon\}\_\{s\}\)=\-v\_\{t\}v\_\{s\}\(W\+\\varrho\)^\{\-1\}I\_\{d\}fors≠ts\\neq t\.

\(ii\) A mean shift at a corrupted stepttcontributes noncentrality\(1−ht\)​λt\(1\-h\_\{t\}\)\\lambda\_\{t\}atttandμs=hs​ht​λt/\(1−hs\)\\mu\_\{s\}=h\_\{s\}h\_\{t\}\\lambda\_\{t\}/\(1\-h\_\{s\}\)at every benigns≠ts\\neq t\.

Part \(ii\) concerns validity rather than only power\. Because the anchor estimate uses all operations, a corruption at one step induces a nonzero mean at otherwise benign steps, so their null hypotheses in Theorems 3 and 4 no longer hold\. The effect is largest near the end of the trajectory, wherewtw\_\{t\}and leverage are greatest\. For example, whenhs=ht=0\.3h\_\{s\}=h\_\{t\}=0\.3andλt=100\\lambda\_\{t\}=100, the induced noncentrality at stepssis 12\.9\.

The induced misspecification can be bounded\. Since the total variation distance between𝒩​\(θ,Id\)\\mathcal\{N\}\(\\theta,I\_\{d\}\)and𝒩​\(0,Id\)\\mathcal\{N\}\(0,I\_\{d\}\)is at most‖θ‖/2​π\\\|\\theta\\\|/\\sqrt\{2\\pi\}, Theorem 5 gives

∑s≠tδs≤ht​λt2​π​∑s≠ths1−hs,\\sum\_\{s\\neq t\}\\delta\_\{s\}\\;\\leq\\;\\frac\{\\sqrt\{h\_\{t\}\\lambda\_\{t\}\}\}\{\\sqrt\{2\\pi\}\}\\sum\_\{s\\neq t\}\\sqrt\{\\frac\{h\_\{s\}\}\{1\-h\_\{s\}\}\},
which grows asλt\\sqrt\{\\lambda\_\{t\}\}and is unbounded in the corruption magnitude\. Shrinkage throughϱ\\varrhochanges the scale but does not remove this dependence\.

A bounded\-influence estimator addresses this problem\. Estimatingggfrom\{εt/vt\}\\\{\\varepsilon\_\{t\}/v\_\{t\}\\\}with a Huberized or trimmed procedure caps the influence of any one operation independently ofλt\\lambda\_\{t\}, so the induced means and total\-variation bound remain uniformly bounded\. The corrected score then need not have an exactχd2\\chi^\{2\}\_\{d\}null distribution\. Applying the same correction to calibration trajectories and using the exchangeability regime of Lemma 1\(ii\) avoids reliance on that parametric null\.

Part \(i\) has two additional consequences\. The induced cross\-correlation invalidates Proposition 6, which requires independent nulls, but does not affect Benjamini–Yekutieli or e\-BH\. For non\-isotropicΣt\\Sigma\_\{t\}, the same construction usesWt=wt​Σt−1/2W\_\{t\}=w\_\{t\}\\Sigma\_\{t\}^\{\-1/2\}and leverage matricesHtH\_\{t\}, with corrected residual covarianceI−HtI\-H\_\{t\}\.

Anchor correction is therefore most appropriate as a sensitivity analysis reported alongside the uncorrected scores and per\-step leverage, rather than as the primary score\. Because leverage is greatest near the terminal operations, the correction further reduces sensitivity in the region already affected by a point\-valued terminal predictive\.

## 7Off\-support behavior

### 7\.1Sufficient conditions for off\-support conservatism

A learned heteroscedastic variance does not, by itself, control false alarms on out\-of\-distribution trajectories; an unconstrained variance head may extrapolate to arbitrarily small values\. Sufficient conditions require variance to increase with distance from the training support and require the mean extrapolation error to be bounded by that distance\. Spectral normalization can provide the required Lipschitz control \(Miyato et al\., 2018; Liu et al\., 2020\)\. Under a bi\-Lipschitz representation, feature\-space distance to the training set also controls input\-space distance up to fixed constants\.

For composition with the procedures in Section 5, the relevant condition is upper\-tail dominance rather than validity at a single threshold\.

Theorem 7 \(off\-support tail conservatism\)\.Consider a benign step whose conditioning state lies at distanceD≥d0D\\geq d\_\{0\}from the training support\. Suppose the model is isotropic with varianceσ2​\(D\)=σ02​\(1\+γ​D2\)\\sigma^\{2\}\(D\)=\\sigma\_\{0\}^\{2\}\(1\+\\gamma D^\{2\}\); the true conditional law has mean withinκ​D\+η0\\kappa D\+\\eta\_\{0\}of the model mean and covariance⪯σ¯2​Id\\preceq\\bar\{\\sigma\}^\{2\}I\_\{d\}\. Put

A∞=2​\(κ\+η0/d0\)2σ02​γ,B0=2​σ¯2σ02​\(1\+γ​d02\)\.A\_\{\\infty\}=\\frac\{2\(\\kappa\+\\eta\_\{0\}/d\_\{0\}\)^\{2\}\}\{\\sigma\_\{0\}^\{2\}\\,\\gamma\},\\qquad B\_\{0\}=\\frac\{2\\bar\{\\sigma\}^\{2\}\}\{\\sigma\_\{0\}^\{2\}\(1\+\\gamma d\_\{0\}^\{2\}\)\}\.IfB0<1B\_\{0\}<1then for everyu≥A∞/\(1−B0\)u\\geq A\_\{\\infty\}/\(1\-B\_\{0\}\),

ℙ​\(at\>u\)≤ℙ​\(χd2\>u\)\.\\mathbb\{P\}\(a\_\{t\}\>u\)\\;\\leq\\;\\mathbb\{P\}\(\\chi^\{2\}\_\{d\}\>u\)\.In particular, ifA∞/\(1−B0\)≤χd,1−α2A\_\{\\infty\}/\(1\-B\_\{0\}\)\\leq\\chi^\{2\}\_\{d,1\-\\alpha\}, the benign p\-value isα\\alpha\-tail super\-uniform:ℙ​\(pt≤u\)≤u\\mathbb\{P\}\(p\_\{t\}\\leq u\)\\leq ufor everyu≤αu\\leq\\alpha\.

BothA∞A\_\{\\infty\}andB0B\_\{0\}decrease withγ\\gamma, so the conditions hold above an explicit inflation threshold\. With a spectrally normalized mean head of Lipschitz constantLμL\_\{\\mu\}and a true mean map assumed to beL∗L^\{\\ast\}\-Lipschitz,κ≤Lμ\+L∗\\kappa\\leq L\_\{\\mu\}\+L^\{\\ast\}, whileη0\\eta\_\{0\}is the on\-support fit error\. The assumption of Gaussian off\-support deviations can be replaced by a sub\-Gaussian condition, with corresponding changes to the constants\.

Benjamini–Hochberg, Benjamini–Yekutieli, and e\-BH use super\-uniformity only at levels below their operating level\. Thus, whenq≤αq\\leq\\alpha, Theorem 7 supplies assumption \(A2b\) and extends the error\-control results of Part I to trajectories that leave the training support\.

Proposition 9 \(off\-support detection threshold\)\.At a corrupted step at the same distanceDD, a shiftbbyields effective noncentralityλeff=‖b‖2/σ2​\(D\)\\lambda\_\{\\mathrm\{eff\}\}=\\\|b\\\|^\{2\}/\\sigma^\{2\}\(D\)\. By Corollary 3, detection at levelα\\alphaand power1−β1\-\\betarequires‖b‖2≥σ02​\(1\+γ​D2\)​2​d​\(zα\+z1−β\)\\\|b\\\|^\{2\}\\geq\\sigma\_\{0\}^\{2\}\(1\+\\gamma D^\{2\}\)\\sqrt\{2d\}\\,\(z\_\{\\alpha\}\+z\_\{1\-\\beta\}\)\.

The variance inflation that makes off\-support null scores conservative reduces the noncentrality of genuine off\-support perturbations by the same factor\.

### 7\.2Inherited corruption

Exact on\-path validity at every benign step is incompatible with unconstrained off\-support behavior after a corruption\. A downstream benign operation may receive a conditioning state that is absent from the training support even though its transition mechanism is valid\. Theorem 7 addresses this case through tail conservatism rather than exact equality\.

Theorem 7 yields the following conservative localization result\.

Corollary 4\.Lett∉It\\notin Ifollow a corrupted step, so that its conditioning state lies at distanceD≥d0D\\geq d\_\{0\}from the training support, and suppose the conditions of Theorem 7 hold\. Thenℙ​\(at\>u\)≤ℙ​\(χd2\>u\)\\mathbb\{P\}\(a\_\{t\}\>u\)\\leq\\mathbb\{P\}\(\\chi^\{2\}\_\{d\}\>u\)for allu≥A∞/\(1−B0\)u\\geq A\_\{\\infty\}/\(1\-B\_\{0\}\), and the step is flagged with probability at most its nominal level\.

Exact localization is replaced by conservative localization\. Downstream residuals are exactly null when the model is correct at the inherited state and have upper tails no heavier than the null when variance inflation is required off support\.

The same variance inflation also reduces sensitivity to a second genuine error committed after the trajectory has left the training support, by the factor in Proposition 9\. Control of downstream false alarms and detection of subsequent errors therefore constitute a direct trade\-off\.

## 8Terminal anchoring with multimodal endpoints

Valid analyses of the same question may terminate at different endpoints, such as distinct defensible covariate sets or compatible estimands\. A point\-valued anchor conditions the drift on one endpoint\. Under \(A4\), routing trajectories to well\-separated modes late in the run requires state sensitivity that grows as1/\(1−s\)1/\(1\-s\), which a uniformly Lipschitzuθu\_\{\\theta\}cannot provide\. In addition, anℓ2\\ell\_\{2\}\-trained point anchor converges to the conditional mean of the valid endpoints, which may lie in a low\-density region between modes\.

Proposition 10 \(terminal multimodality\)\.Consider the terminal step with isotropic model varianceσT2\\sigma\_\{T\}^\{2\}, flag thresholdτ\\tau, and \(A4\) in force\. Letz,z′z,z^\{\\prime\}be two benign pre\-terminal states with‖z−z′‖≤w\\\|z\-z^\{\\prime\}\\\|\\leq wwhose true terminal laws are𝒩​\(mi,σc2​Id\)\\mathcal\{N\}\(m\_\{i\},\\sigma\_\{c\}^\{2\}I\_\{d\}\)with‖m1−m2‖≥2​r\\\|m\_\{1\}\-m\_\{2\}\\\|\\geq 2r\. LetLgL\_\{g\}be the Lipschitz constant of the anchor head in its state argument, puthT=1−sT−1h\_\{T\}=1\-s\_\{T\-1\}andκT=1\+Lg​ΔT/hT\+L​ΔT\\kappa\_\{T\}=1\+L\_\{g\}\\Delta\_\{T\}/h\_\{T\}\+L\\Delta\_\{T\}, and setρ=r−w​κT/2\\rho=r\-w\\kappa\_\{T\}/2\. Ifρ≥2​σc​\(d\+t\)\\rho\\geq 2\\sigma\_\{c\}\(\\sqrt\{d\}\+t\), then at least one of the following holds: \(a\) the benign terminal flag probability at one of the two states exceeds1−e−t2/21\-e^\{\-t^\{2\}/2\}; or \(b\)σT2≥ρ2/\(4​τ\)\\sigma\_\{T\}^\{2\}\\geq\\rho^\{2\}/\(4\\tau\), in which case every terminal shift with‖b‖2≤c1​ρ2/d\\\|b\\\|^\{2\}\\leq c\_\{1\}\\rho^\{2\}/\\sqrt\{d\}for a universal constantc1c\_\{1\}is undetectable at the boundary of Proposition 3\.

Maximum\-likelihood training strongly penalizes under\-coverage and may therefore favor alternative \(b\), with an inflated terminal variance\. Under this behavior, endpoint multimodality appears as reduced sensitivity to corruptions in the final operations rather than as an increased terminal false\-positive rate\. Section 9 describes an empirical test of this prediction\.

Two modifications are compatible with the framework in Part I\.

The predictable anchor in Section 6\.2 is useful when the terminal mode is identifiable from the pre\-terminal state\. The functiongη​\(x0,xt−1,st−1\)g\_\{\\eta\}\(x\_\{0\},x\_\{t\-1\},s\_\{t\-1\}\)can then select an endpoint without increasing the Lipschitz constant of the complete drift\. Appendix A\.10 shows that the dichotomy applies only whileρ\>0\\rho\>0and that this condition fails when the anchor head’s state sensitivity exceeds\(2​r/w−1−L​ΔT\)​hT/ΔT\(2r/w\-1\-L\\Delta\_\{T\}\)h\_\{T\}/\\Delta\_\{T\}\. Exceeding this threshold provides capacity to separate the modes but does not establish accurate routing\. Section 8\.1 gives an additional accuracy condition\. A point anchor remains inadequate when more than one endpoint is plausible from the same pre\-terminal state\.

A more general modification replaces the point anchor with a multimodal predictive distribution, such as a mixture over endpoints or a conditional normalizing flow\. Because Part I is formulated through generalized residuals for arbitrary predictive families, this modification changesQtQ\_\{t\}but leaves Theorem 1, Lemma 1, Theorems 3–5, and Proposition 6 unchanged\. The Gaussian closed forms in Section 4 and the bridge\-specific results in Part II would require corresponding modification\.

### 8\.1Routing capacity and off\-support sensitivity

The anchor head contributes to the terminal mean and therefore to the extrapolation constant in Theorem 7\. WithκT=1\+Lg​ΔT/hT\+L​ΔT\\kappa\_\{T\}=1\+L\_\{g\}\\Delta\_\{T\}/h\_\{T\}\+L\\Delta\_\{T\}, the terminal mean map satisfiesκ≤κT\+L∗\\kappa\\leq\\kappa\_\{T\}\+L^\{\\ast\}\.

Proposition 11 \(off\-support consequence of routing capacity\)\.Under the conditions of Theorem 7 applied at the terminal step, the second design condition forces

γ≥2​\(κT\+L∗\+η0/d0\)2σ02​χd,1−α2​\(1−B0\),\\gamma\\;\\geq\\;\\frac\{2\\big\(\\kappa\_\{T\}\+L^\{\\ast\}\+\\eta\_\{0\}/d\_\{0\}\\big\)^\{2\}\}\{\\sigma\_\{0\}^\{2\}\\,\\chi^\{2\}\_\{d,1\-\\alpha\}\\,\(1\-B\_\{0\}\)\},and hence, by Proposition 9 and forγ​D2≫1\\gamma D^\{2\}\\gg 1, a minimum detectable terminal perturbation at distanceDDof

‖b‖min2≥2​\(κT\+L∗\+η0/d0\)2​D2​2​d​\(zα\+z1−β\)χd,1−α2​\(1−B0\),\\\|b\\\|^\{2\}\_\{\\min\}\\;\\geq\\;\\frac\{2\\big\(\\kappa\_\{T\}\+L^\{\\ast\}\+\\eta\_\{0\}/d\_\{0\}\\big\)^\{2\}\\,D^\{2\}\\,\\sqrt\{2d\}\\,\(z\_\{\\alpha\}\+z\_\{1\-\\beta\}\)\}\{\\chi^\{2\}\_\{d,1\-\\alpha\}\\,\(1\-B\_\{0\}\)\},in whichσ02\\sigma\_\{0\}^\{2\}cancels\. IfLgL\_\{g\}exceeds the separation threshold in Proposition 10, thenκT\>2​r/w\\kappa\_\{T\}\>2r/w, so the off\-support minimum detectable perturbation grows at least quadratically with the mode\-separation ratior/wr/w\.

Increasing the anchor’s capacity to separate endpoints also increases the Lipschitz constant of the terminal mean\. Theorem 7 then requires greater variance inflation, and Proposition 9 implies lower off\-support sensitivity\. The effect is quadratic in the separation ratio\. This trade\-off is less restrictive near the training support, whereDDis small, but can be substantial for trajectories that are both strongly routed and far off support\.

Exceeding the capacity threshold removes the obstruction in Proposition 10 but does not ensure that the fitted anchor maps each state to the appropriate mode\. An accuracy condition is also required\.

Proposition 12 \(accurate routing avoids both failure modes\)\.In the setting of Proposition 10, suppose the anchor routes accurately in the sense that‖μ​\(z\)−m​\(z\)‖≤e0\\\|\\mu\(z\)\-m\(z\)\\\|\\leq e\_\{0\}at every benign pre\-terminal statezz, wherem​\(z\)m\(z\)is the mean of that state’s true terminal law\. If

σT2≥2​σc2\+2​e02χd,1−α2,\\sigma\_\{T\}^\{2\}\\;\\geq\\;2\\sigma\_\{c\}^\{2\}\+\\frac\{2e\_\{0\}^\{2\}\}\{\\chi^\{2\}\_\{d,1\-\\alpha\}\},then the benign terminal score is tail\-dominated byχd2\\chi^\{2\}\_\{d\}aboveχd,1−α2\\chi^\{2\}\_\{d,1\-\\alpha\}, so alternative \(a\) does not occur\. A terminal shift is detectable at levelα\\alphaand power1−β1\-\\betaonce‖b‖2≥σT2​2​d​\(zα\+z1−β\)\\\|b\\\|^\{2\}\\geq\\sigma\_\{T\}^\{2\}\\sqrt\{2d\}\(z\_\{\\alpha\}\+z\_\{1\-\\beta\}\), which is of orderσc2​2​d\\sigma\_\{c\}^\{2\}\\sqrt\{2d\}whene02≲σc2​χd,1−α2e\_\{0\}^\{2\}\\lesssim\\sigma\_\{c\}^\{2\}\\chi^\{2\}\_\{d,1\-\\alpha\}\.

Under alternative \(b\) of Proposition 10, blindness extends to‖b‖2≲ρ2/d\\\|b\\\|^\{2\}\\lesssim\\rho^\{2\}/\\sqrt\{d\}\. Under accurate routing, it extends only to orderσc2​d\\sigma\_\{c\}^\{2\}\\sqrt\{d\}\. The improvement factor isρ2/\(σc2​d\)\\rho^\{2\}/\(\\sigma\_\{c\}^\{2\}d\), which is at least four under the hypothesisρ≥2​σc​\(d\+t\)\\rho\\geq 2\\sigma\_\{c\}\(\\sqrt\{d\}\+t\)and increases with mode separation\. Accurate routing therefore replaces the between\-mode separation by the within\-mode spread and routing error as the scale governing terminal sensitivity\. It cannot remove the intrinsic detection boundary associated with terminal spreadσc\\sigma\_\{c\}\.

The routing modification therefore requires three conditions: sufficient capacity to separate the modes \(Proposition 10\), sufficient accuracy to route each state to its mode \(Proposition 12\), and acceptable off\-support sensitivity at the resulting Lipschitz constant \(Proposition 11\)\. A mixture predictive can represent separated modes without requiring a steep point\-valued anchor and may therefore avoid the first and third constraints\.

## 9Diagnostics

Two assumptions can be assessed using data already available in deployment\.

Under \(A1∗\), pooled calibration scores followχd2\\chi^\{2\}\_\{d\}\. Quantile–quantile plots and Kolmogorov–Smirnov or Anderson–Darling statistics on held\-out valid trajectories can assess this implication\. Diagnostics should be reported both overall and within strata ofst−1s\_\{t\-1\}, because localized misspecification may be obscured by pooling\. Rejection indicates that the uninflated guarantees in Section 5\.3 do not apply; failure to reject does not establish correct specification\. Deployment documentation should state this asymmetry\.

Four simulation studies can assess whether the fitted implementation exhibits the predicted behavior\. First, trajectories sampled fromℳ\\mathcal\{M\}should produceχd2\\chi^\{2\}\_\{d\}benign scores and null downstream scores after an injected shift\. Second, power should be evaluated across noncentralities at the deployed dimension to assess the approximation in Proposition 3\. Third, one\-step, intermediate\-horizon, and free\-running scores can be compared on the same injected perturbation to measure the localization window in Proposition 1\. Fourth, a bimodal\-endpoint simulation can evaluate terminal sensitivity\.

The final simulation directly tests the prediction of Proposition 10\. If a model with demonstrably multimodal endpoints exhibits elevated terminal false\-positive rates rather than reduced terminal sensitivity, then training has selected alternative \(a\) rather than alternative \(b\), and the assumed training behavior in Section 8 does not hold for that implementation\.

Part III: Population\-level auditing and identifiability

## 10Recurrent errors across trajectories

The preceding results concern one trajectory\. In deployment, recurrent execution errors may appear across many trajectories, including repeated cohort restrictions, join failures, or omitted adjustments\. Pooling repeated occurrences provides information that is unavailable in a single\-trajectory analysis\.

Let each operation have a type labelc​\(ot\)∈\{1,…,C\}c\(o\_\{t\}\)\\in\\\{1,\\ldots,C\\\}, defined by the invoked tool or by a cluster of operation embeddings\. AcrossMMaudited trajectories, let𝒯c\\mathcal\{T\}\_\{c\}contain the steps of typecc, withmc=\|𝒯c\|m\_\{c\}=\|\\mathcal\{T\}\_\{c\}\|, and letHcH\_\{c\}denote the hypothesis that typeccis executed validly wherever it occurs\. This estimand concerns recurrent type\-level departures rather than the corrupted set within one trajectory\.

Proposition 13 \(recurrence gain\)\.Suppose \(A1∗\) and \(A2a\) hold, a type\-ccdefect contributes noncentralityλ\\lambdaat each of its occurrences, and the occurrences lie in distinct trajectories\. Then the pooled scoreAc=∑t∈𝒯catA\_\{c\}=\\sum\_\{t\\in\\mathcal\{T\}\_\{c\}\}a\_\{t\}isχmc​d2​\(mc​λ\)\\chi^\{2\}\_\{m\_\{c\}d\}\(m\_\{c\}\\lambda\), and detection at levelα\\alphawith power1−β1\-\\betarequires

λ≥2​dmc​\(zα\+z1−β\),\\lambda\\;\\geq\\;\\sqrt\{\\frac\{2d\}\{m\_\{c\}\}\}\\,\\big\(z\_\{\\alpha\}\+z\_\{1\-\\beta\}\\big\),a factormc\\sqrt\{m\_\{c\}\}below the per\-step boundary of Proposition 3\.

For type\-level error control, averaging the e\-values in Section 5\.4 within a type yields a valid type\-level e\-value\. Applying e\-BH across theCCtypes controls type\-level FDR atqqunder arbitrary dependence, including dependence among occurrences within the same trajectory\.

The recurrence gain applies only to the noise\-limited component of the detection boundary\.

Corollary 5 \(recurrence does not resolve confusability\)\.Themc\\sqrt\{m\_\{c\}\}improvement applies to the noise\-limited boundary of Section 11\.2 only\. The confusability floor of Theorem 9 concerns the distinction between a corruption and an unmodelled feature of the*valid*dynamics, and is governed by the number of valid calibration trajectoriesnn, never by the number of audited occurrencesmcm\_\{c\}\.

Audited occurrences cannot resolve uncertainty about the valid mechanism itself\. A recurrent departure concentrated in one region of state space may be observationally similar to systematic misspecification of the valid drift\. Recurrence increases statistical power against known null dynamics but does not reduce the identifiability limit\. Analyses that pool across trajectories should distinguish these two sources of uncertainty\.

## 11Identifiability and detection limits

The guarantees in Parts I and II address the error rate of the reported set\. This section addresses the interpretation of that set\. Three results limit the departures that can be identified from observational trajectories\.

### 11\.1Testability of the estimand

Exact inequality between transition kernels is not a statistically separated estimand\.

Theorem 8 \(non\-testability of the exact\-departure estimand\)\.Fix a valid mechanismK∗K^\{\\ast\}with transition densities, a stept0<Tt\_\{0\}<T, andη∈\(0,1\)\\eta\\in\(0,1\)\. There exist mechanismsK\(1\),K\(2\)K^\{\(1\)\},K^\{\(2\)\}with

I​\(K\(1\)\)=\{t0\},I​\(K\(2\)\)=\{t0,t0\+1,…,T\},TV​\(P\(1\),P\(2\)\)≤η,I\(K^\{\(1\)\}\)=\\\{t\_\{0\}\\\},\\qquad I\(K^\{\(2\)\}\)=\\\{t\_\{0\},t\_\{0\}\+1,\\ldots,T\\\},\\qquad\\mathrm\{TV\}\\big\(P^\{\(1\)\},P^\{\(2\)\}\\big\)\\leq\\eta,whereI​\(K\)=\{t≤T:Kt≠Kt∗\}I\(K\)=\\\{t\\leq T:K\_\{t\}\\neq K^\{\\ast\}\_\{t\}\\\}andP\(i\)P^\{\(i\)\}is the law of the audited trajectory underK\(i\)K^\{\(i\)\}, the calibration law being the same under both\. Consequently every auditorψ\\psisatisfies

𝔼1​\|ψ​△​I​\(K\(1\)\)\|\+𝔼2​\|ψ​△​I​\(K\(2\)\)\|≥\(T−t0\)​\(1−η\)\.\\mathbb\{E\}\_\{1\}\\big\|\\psi\\,\\triangle\\,I\(K^\{\(1\)\}\)\\big\|\+\\mathbb\{E\}\_\{2\}\\big\|\\psi\\,\\triangle\\,I\(K^\{\(2\)\}\)\\big\|\\;\\geq\\;\(T\-t\_\{0\}\)\(1\-\\eta\)\.
The construction in Appendix A\.13 modifies every kernel aftert0t\_\{0\}by anϵ\\epsilon\-mixture of the valid kernel and an alternative\. Each subsequent kernel differs fromK∗K^\{\\ast\}, while the total variation distance between the resulting trajectory laws can be made arbitrarily small\. Thus, a set estimator that is correct under one mechanism can have large symmetric\-difference loss under an observationally indistinguishable mechanism\.

Corollary 6\.No auditor estimatesI​\(K\)I\(K\)consistently, at any sample size, for any score, under any assumption onK∗K^\{\\ast\}that does not restrict the size of departures\.

The estimand must therefore include a minimum departure magnitude\. Forδ\>0\\delta\>0, defineIδ​\(K\)=\{t:TV​\(Kt,Kt∗\)\>δ\}I\_\{\\delta\}\(K\)=\\\{t:\\mathrm\{TV\}\(K\_\{t\},K\_\{t\}^\{\\ast\}\)\>\\delta\\\}and leave departures belowδ\\deltain an indifference region\. The audit then reports operations whose conditional mechanisms differ from the valid mechanism by more than a prespecified threshold\. Section 2\.3 should be interpreted with this qualification\.

Assumption \(A2a\) provides a positive result under competence preservation\.

Proposition 14 \(factorization under competence\)\.SupposeK∗K^\{\\ast\}is known and every benign step satisfiesKt=Kt∗K\_\{t\}=K^\{\\ast\}\_\{t\}conditionally on𝒢t\\mathcal\{G\}\_\{t\}whatever the past states\. Then the likelihood ratio of any corruption hypothesis against the null factorizes over steps, the generalized residuals are jointly sufficient forIδI\_\{\\delta\}, and every admissible auditor is a function of them\. If the mechanism may instead change after an error and remain changed, no such factorization holds: the minimal sufficient statistic is the whole trajectory, the natural hypothesis family is nested rather than indexed by individual steps, and step\-wise testing is inadmissible\.

Competence preservation is the condition under which step\-level attribution is well posed\. If the mechanism changes after an error and remains changed, the appropriate estimand is the time at which the process leaves the valid regime, not a set of independent corrupted operations\. Controlled replay and counterfactual intervention can restore step\-level identification by fixing the downstream mechanism\.

### 11\.2A detection floor from finite calibration

After introducing a magnitude threshold, the attribution rate is limited by uncertainty in the valid dynamics\. A local mean shift at one operation can be observationally equivalent to a legitimate local feature of the valid drift\. Distinguishing these cases requires sufficient calibration trajectories in the same region of state space and is therefore a local nonparametric estimation problem\.

Fix a class𝒰​\(L\)\\mathcal\{U\}\(L\)of driftsLL\-Lipschitz in the state, noise levelσ2\\sigma^\{2\}, per\-step incrementΔ\\Delta, and a visited\-state density bounded above bycc\. WriteN=n​TN=nTfor the total number of calibration transitions\.

Theorem 9 \(confusability floor\)\.For anybbwith‖b‖d\+2≲σ2​\(L​Δ\)d/\(c​N\)\\\|b\\\|^\{d\+2\}\\lesssim\\sigma^\{2\}\(L\\Delta\)^\{d\}/\(cN\)there existu∈𝒰​\(L\)u\\in\\mathcal\{U\}\(L\), a statezz, andu′∈𝒰​\(L\)u^\{\\prime\}\\in\\mathcal\{U\}\(L\)agreeing withuuoutside a neighbourhood ofzz, such that the joint law of calibration and audited data under \(a\) driftuuwith a single corruption of displacementbbat the operation visitingzz, soIδ=\{t\}I\_\{\\delta\}=\\\{t\\\}, and \(b\) driftu′u^\{\\prime\}with no corruption, soIδ=∅I\_\{\\delta\}=\\varnothing, differ by at most1/41/4in total variation\. Every auditor then satisfies𝔼a​\|ψ​△​Ia\|\+𝔼b​\|ψ​△​Ib\|≥3/4\\mathbb\{E\}\_\{a\}\|\\psi\\triangle I\_\{a\}\|\+\\mathbb\{E\}\_\{b\}\|\\psi\\triangle I\_\{b\}\|\\geq 3/4\.

Combining with the noise\-limited boundary for a corruption at an unknown one ofTTlocations, the smallest attributable corruption satisfies

ρmin2≍σ2​2​d​log⁡T\+ρfloor2,ρfloor≍\(σ2​\(L​Δ\)dc​n​T\)1d\+2\.\\rho^\{2\}\_\{\\min\}\\;\\asymp\\;\\sigma^\{2\}\\sqrt\{2d\\log T\}\\;\+\\;\\rho^\{2\}\_\{\\mathrm\{floor\}\},\\qquad\\rho\_\{\\mathrm\{floor\}\}\\asymp\\left\(\\frac\{\\sigma^\{2\}\(L\\Delta\)^\{d\}\}\{c\\,nT\}\\right\)^\{\\frac\{1\}\{d\+2\}\}\.
Corollary 7\.The floor decays in the number of valid trajectories asn−1/\(d\+2\)n^\{\-1/\(d\+2\)\}; halving it requires2d\+22^\{d\+2\}times more calibration data\.

Atd=256d=256, a 100\-fold increase in valid trajectories reduces this floor by less than 2%\.

Corollary 8\.The dependence onddis through the exponent, so reducing the dimension in which the dynamics are modeled changes the rate rather than the constant\. Fromd=256d=256tod=8d=8turns a floor effectively fixed innninto one decaying asn−1/5n^\{\-1/5\}\.

This rate provides a stronger motivation for dimension reduction than the finite\-dimensional score comparison in Section 4\.2\. The relevant dimension is the intrinsic dimension of the fitted dynamics, not necessarily the width of the embedding\. A 256\-dimensional embedding concentrated near an 8\-dimensional manifold can have the more favorable rate if the model is fitted in a representation that exposes that structure\. The intrinsic dimension of agent trajectories must be evaluated empirically\.

Corollary 9\.Asddgrows with the other quantities fixed,ρfloor→L​Δ\\rho\_\{\\mathrm\{floor\}\}\\to L\\Delta: no auditor can distinguish a corruption from a legitimate feature of the dynamics when the corruption is smaller than what the dynamics may do over one operation\.

The floor is an identifiability limit rather than an estimation\-error term\. For an auditor trained only on valid trajectories, a sufficiently small local corruption cannot be distinguished from an unobserved feature of the valid dynamics\. Theorem 9 therefore limits the magnitude of departures that can be attributed, while the error\-control results in Section 5 remain valid for the resulting scores\.

### 11\.3Adversarially chosen corruption

The corruptions in Section 3\.1 are exogenous\. If the location of a perturbation is selected to maximize terminal effect while limiting detectability, its position along the trajectory becomes relevant\.

Measure damage by terminal displacement\. In the noiseless limit, a shiftbbat normalized times0s\_\{0\}produces terminal displacement‖b‖​\(1−s¯\)/\(1−s0\)\\\|b\\\|\(1\-\\bar\{s\}\)/\(1\-s\_\{0\}\)and detection noncentralityλ=‖b‖2/σeff2​\(s0\)\\lambda=\\\|b\\\|^\{2\}/\\sigma\_\{\\mathrm\{eff\}\}^\{2\}\(s\_\{0\}\)\. Define the damage\-to\-detectability ratioℰ​\(s0\)=σeff​\(s0\)​\(1−s¯\)/\(1−s0\)\\mathcal\{E\}\(s\_\{0\}\)=\\sigma\_\{\\mathrm\{eff\}\}\(s\_\{0\}\)\(1\-\\bar\{s\}\)/\(1\-s\_\{0\}\)\.

Proposition 15 \(late shifts have greater damage\-to\-detectability ratio\)\.Withσeff\\sigma\_\{\\mathrm\{eff\}\}constant,ℰ\\mathcal\{E\}is strictly increasing ins0s\_\{0\}\. Ats¯=0\.9\\bar\{s\}=0\.9, a shift ats0=0\.75s\_\{0\}=0\.75is four times as efficient as the same shift at the start of the trajectory, and a shift ats0=0\.89s\_\{0\}=0\.89is nine times as efficient\.

Early shifts are contracted toward the anchor by the factor\(1−s¯\)/\(1−s0\)\(1\-\\bar\{s\}\)/\(1\-s\_\{0\}\), whereas late shifts are less attenuated\. With constantσeff\\sigma\_\{\\mathrm\{eff\}\}, innovation detectability does not depend on position\. The bridge therefore reduces terminal effects of early perturbations more strongly than those of late perturbations\.

Corollary 10\.Proposition 10 places reduced terminal sensitivity and Proposition 8 places high anchor leverage in the final operations\. Under the stated model, the single shift with the largest terminal effect relative to detectability therefore occurs near the end of the trajectory\.

A second strategy distributes the perturbation across operations\. A displacementbbspread evenly overkkconsecutive operations has noncentralityλ\(h\)\(k\)=∥b∥2min\(h,k\)2/\(k2hσ2\)\\lambda^\{\(h\)\}\(k\)=\\\|b\\\|^\{2\}\\min\(h,k\)^\{2\}/\(k^\{2\}h\\sigma^\{2\}\)in thehh\-step channel, which is maximized ath=kh=k\. Relative to this matched horizon, a one\-step score loses a factorkkin noncentrality\.

Theorem 10 \(dyadic horizon ladder\)\.With horizonsℋ=\{1,2,4,…,2J\}\\mathcal\{H\}=\\\{1,2,4,\\ldots,2^\{J\}\\\}and a corruption spread over anyk≤2Jk\\leq 2^\{J\}operations,

maxh∈ℋ⁡λ\(h\)​\(k\)≥12​λ\(k\)​\(k\),\\max\_\{h\\in\\mathcal\{H\}\}\\lambda^\{\(h\)\}\(k\)\\;\\geq\\;\\tfrac\{1\}\{\\sqrt\{2\}\}\\,\\lambda^\{\(k\)\}\(k\),with equality atk=2​2jk=\\sqrt\{2\}\\,2^\{j\}\. The number of tested horizons isJ\+1=O​\(log⁡T\)J\+1=O\(\\log T\)\.

The dyadic horizon set is therefore minimax within a factor2\\sqrt\{2\}of the matched horizon, compared with a factor\-kkloss for one\-step scoring\. The most difficult perturbations under the bridge model are gradual displacements concentrated in the final operations\. Examples include progressive narrowing of a cohort definition, gradual relaxation of inclusion criteria, or drift in the selected covariate set\. These results further motivate a multimodal terminal predictive in Section 8\.

## 12Limitations

Three limitations are structural\.

First, the flagged set has no causal interpretation\. The setIIcontains mechanism violations but does not distinguish an initiating error from an independent later error or identify a causal chain among flagged operations\.

Second, assumption \(A2a\) may fail when the agent’s mechanism changes after an error\. Sustained procedural changes invalidate the benign\-step model even if individual downstream operations are locally coherent\. The total\-variation bound in Theorem 5 can then approach its trivial limit, and off\-support variance inflation in Corollary 4 does not address a changed transition mechanism\. A latent\-regime model is more appropriate in this setting: the estimand becomes the time at which the process leaves the valid regime, yielding a changepoint problem with an unknown post\-change law\. E\-detectors provide non\-asymptotic guarantees for this setting \(Shin, Ramdas and Rinaldo, 2024\), and conformal test martingales provide an exchangeability\-based alternative \(Vovk, Nouretdinov and Gammerman, 2003\)\. Multi\-horizon residuals address bounded gradual perturbations, but not a persistent regime change\.

Third, report\-specific false\-discovery guarantees are weak at the trajectory lengths considered here\. Proposition 6 bounds the realized false discovery proportion simultaneously over thresholds, but the additive term is large whenTTis in the tens\. A reader therefore receives a long\-run FDR guarantee and a realized point estimate, not a high\-probability statement for the individual report\.

The identifiability results in Section 11 impose two additional limits\. The exact corrupted set is not testable without a minimum\-effect threshold, and the smallest attributable departure has a confusability floor that decreases extremely slowly with calibration sample size in high dimension\.

Accordingly, the strongest guarantees apply when a departure occurs near the training support and the post\-error transition mechanism remains within the modeled family\.

## Appendix AProofs

Throughout,\{T≥t\}∈ℱt−1\\\{T\\geq t\\\}\\in\\mathcal\{F\}\_\{t\-1\}because the decision to continue after operationt−1t\-1is made from the realized history\. Part I invokes \(A2a\) at on\-support benign steps\. Off\-support benign steps are treated through \(A2b\) and Theorem 7, which provides tail dominance rather than equality and preserves results that require only super\-uniformity\.

### A\.1Theorem 1

WriteEt=\{t≤T,t∉I\}E\_\{t\}=\\\{t\\leq T,\\ t\\notin I\\\}\. Since\{T≥t\}∈ℱt−1⊆𝒢t\\\{T\\geq t\\\}\\in\\mathcal\{F\}\_\{t\-1\}\\subseteq\\mathcal\{G\}\_\{t\}and\{t∈I\}∈𝒢t\\\{t\\in I\\\}\\in\\mathcal\{G\}\_\{t\}by \(A3\), we haveEt∈𝒢tE\_\{t\}\\in\\mathcal\{G\}\_\{t\}\. The parameters ofQtQ\_\{t\}are𝒢t\\mathcal\{G\}\_\{t\}\-measurable, soRtR\_\{t\}is a𝒢t\\mathcal\{G\}\_\{t\}\-measurable map; under \(A2a\) and \(A0\),ℒ​\(xt∣𝒢t\)=Qt\\mathcal\{L\}\(x\_\{t\}\\mid\\mathcal\{G\}\_\{t\}\)=Q\_\{t\}is atomless onEtE\_\{t\}, and the Rosenblatt transform of a law by itself is uniform \(Rosenblatt, 1952\), givingℒ​\(ut∣𝒢t\)=Unif​\[0,1\]d\\mathcal\{L\}\(u\_\{t\}\\mid\\mathcal\{G\}\_\{t\}\)=\\mathrm\{Unif\}\[0,1\]^\{d\}onEtE\_\{t\}\. Hence

𝔼​\[f​\(ut\)​𝟏Et\]=𝔼​\[𝟏Et​𝔼​\[f​\(ut\)∣𝒢t\]\]=𝔼​\[f​\(U\)\]​ℙ​\(Et\)\.\\mathbb\{E\}\[f\(u\_\{t\}\)\\mathbf\{1\}\_\{E\_\{t\}\}\]=\\mathbb\{E\}\\big\[\\mathbf\{1\}\_\{E\_\{t\}\}\\,\\mathbb\{E\}\[f\(u\_\{t\}\)\\mid\\mathcal\{G\}\_\{t\}\]\\big\]=\\mathbb\{E\}\[f\(U\)\]\\,\\mathbb\{P\}\(E\_\{t\}\)\.
Fort1<⋯<trt\_\{1\}<\\cdots<t\_\{r\}, the variablesut1,…,utr−1u\_\{t\_\{1\}\},\\ldots,u\_\{t\_\{r\-1\}\}and the event⋂j<rEtj\\bigcap\_\{j<r\}E\_\{t\_\{j\}\}are measurable with respect toℱtr−1⊆𝒢tr\\mathcal\{F\}\_\{t\_\{r\}\-1\}\\subseteq\\mathcal\{G\}\_\{t\_\{r\}\}\. Conditioning on𝒢tr\\mathcal\{G\}\_\{t\_\{r\}\}separates the last factor, and iteration gives the product identity\. The argument does not condition on the realized value ofTTorII, which permits a stopping time and random predictable corruption set\.

For \(ii\), on\{t∈I\}\\\{t\\in I\\\}the conditional law ofxtx\_\{t\}given𝒢t\\mathcal\{G\}\_\{t\}isQ~t\\tilde\{Q\}\_\{t\}by definition, sout∣𝒢t∼Rt​\#​Q~tu\_\{t\}\\mid\\mathcal\{G\}\_\{t\}\\sim R\_\{t\\\#\}\\tilde\{Q\}\_\{t\}\. Corollary 1 follows becauseεt=νt\+ξt\\varepsilon\_\{t\}=\\nu\_\{t\}\+\\xi\_\{t\}withνt\\nu\_\{t\}being𝒢t\\mathcal\{G\}\_\{t\}\-measurable, and the monotonicity of the noncentral chi\-square tail in its noncentrality is classical \(Johnson, Kotz and Balakrishnan, 1995, Ch\. 29\)\. Corollary 2 follows by diagonalizingΓt\\Gamma\_\{t\}; ifΓt≺0\\Gamma\_\{t\}\\prec 0then∑i\(1\+γt,i\)​χ12\\sum\_\{i\}\(1\+\\gamma\_\{t,i\}\)\\chi^\{2\}\_\{1\}is stochastically smaller thanχd2\\chi^\{2\}\_\{d\}, so the upper\-tail rejection probability is belowα\\alpha\.□\\square

### A\.2Theorem 2

LetD​\(s\)=z~​\(s\)−z​\(s\)D\(s\)=\\tilde\{z\}\(s\)\-z\(s\), soD′=−D/\(1−s\)\+\[uθ​\(z~,s\)−uθ​\(z,s\)\]D^\{\\prime\}=\-D/\(1\-s\)\+\[u\_\{\\theta\}\(\\tilde\{z\},s\)\-u\_\{\\theta\}\(z,s\)\]\. WhereverD≠0D\\neq 0,

dd​s​‖D‖=−‖D‖1−s\+⟨D/‖D‖,uθ​\(z~,s\)−uθ​\(z,s\)⟩,\\frac\{d\}\{ds\}\\\|D\\\|=\-\\frac\{\\\|D\\\|\}\{1\-s\}\+\\big\\langle D/\\\|D\\\|,\\ u\_\{\\theta\}\(\\tilde\{z\},s\)\-u\_\{\\theta\}\(z,s\)\\big\\rangle,and the inner product is bounded in modulus byL​‖D‖L\\\|D\\\|under \(A4\)\. Hence

−11−s−L≤dd​s​log⁡‖D​\(s\)‖≤−11−s\+L\.\-\\frac\{1\}\{1\-s\}\-L\\;\\leq\\;\\frac\{d\}\{ds\}\\log\\\|D\(s\)\\\|\\;\\leq\\;\-\\frac\{1\}\{1\-s\}\+L\.Integrating froms0s\_\{0\}and using∫s0s\(1−v\)−1​𝑑v=log⁡1−s01−s\\int\_\{s\_\{0\}\}^\{s\}\(1\-v\)^\{\-1\}dv=\\log\\frac\{1\-s\_\{0\}\}\{1\-s\}gives the envelopes\. The lower envelope is strictly positive on\[s0,s¯\]\[s\_\{0\},\\bar\{s\}\], soDDnever vanishes and the differentiation is justified; at isolated points of non\-differentiability of‖D‖\\\|D\\\|the same bounds hold for the Dini derivatives\. IfΣ\\Sigmais state\-independent, running both stochastic dynamics with the same noise cancels the noise in the difference and the envelope holds pathwise\. The lower envelope decays for everyLL, sincedd​s​log⁡\[\(1−s\)​e−L​\(s−s0\)\]=−1/\(1−s\)−L<0\\frac\{d\}\{ds\}\\log\[\(1\-s\)e^\{\-L\(s\-s\_\{0\}\)\}\]=\-1/\(1\-s\)\-L<0; the upper envelope decays only whenL<1/\(1−s\)L<1/\(1\-s\)\. ForLLabove that the two envelopes separate and the bound determines only that the gap is nonzero, not whether it decays\. For repeated shiftsbib\_\{i\}at timessis\_\{i\}, superposition of the upper envelope gives‖D​\(s\)‖≤∑si≤s‖bi‖​1−s1−si​eL​\(s−si\)\\\|D\(s\)\\\|\\leq\\sum\_\{s\_\{i\}\\leq s\}\\\|b\_\{i\}\\\|\\frac\{1\-s\}\{1\-s\_\{i\}\}e^\{L\(s\-s\_\{i\}\)\}; the lower bound does not superpose, since shifts can cancel\.□\\square

### A\.3Propositions 1 and 2

*Proposition 1\(i\)\.*Fixt≥t0\+kt\\geq t\_\{0\}\+k\. The conditioningσ\\sigma\-field ofQt\(k\)Q^\{\(k\)\}\_\{t\}containsxt−kx\_\{t\-k\}witht−k≥t0t\-k\\geq t\_\{0\}, so the corrupted transition att0t\_\{0\}lies in the past of the prediction\. Every transition fromt−k\+1t\-k\+1tottis benign and followsℳ\\mathcal\{M\}under \(A2a\), soQt\(k\)Q^\{\(k\)\}\_\{t\}is the correct conditional law and the residual is uniform by the argument of Appendix A\.1 applied to the coarser filtration\. Fort0≤t≤t0\+k−1t\_\{0\}\\leq t\\leq t\_\{0\}\+k\-1we havet−k<t0t\-k<t\_\{0\}, so the corrupted transition lies strictly inside the prediction window and enters the predictive mean\.

*Proposition 1\(ii\)\.*The conditioningσ\\sigma\-field ofQt\(k\)Q\_\{t\}^\{\(k\)\}is𝒢t\(k\)=ℱt−k∨σ​\(ct−k\+1,…,ct\)\\mathcal\{G\}^\{\(k\)\}\_\{t\}=\\mathcal\{F\}\_\{t\-k\}\\vee\\sigma\(c\_\{t\-k\+1\},\\ldots,c\_\{t\}\)\. The argument of Appendix A\.1 requires the benign event to lie in that field\. Now\{t∉I\}∈𝒢t\\\{t\\notin I\\\}\\in\\mathcal\{G\}\_\{t\}need not lie in𝒢t\(k\)\\mathcal\{G\}^\{\(k\)\}\_\{t\}, and\{t≤T\}\\\{t\\leq T\\\}depends on the halting decisions att−k\+1,…,t−1t\-k\+1,\\ldots,t\-1and hence onxt−k\+1,…,xt−1x\_\{t\-k\+1\},\\ldots,x\_\{t\-1\}, which are not inℱt−k\\mathcal\{F\}\_\{t\-k\}\. Under the stated commitment condition both events lie in𝒢t\(k\)\\mathcal\{G\}^\{\(k\)\}\_\{t\}and Appendix A\.1 applies unchanged\. Without it, conditioning on survival tottselects on the intervening innovations and the residual is not uniform\.

*Proposition 1\(iii\)\.*Iftj\+1−tj≥kt\_\{j\+1\}\-t\_\{j\}\\geq kthenutj\(k\)u^\{\(k\)\}\_\{t\_\{j\}\}isℱtj\\mathcal\{F\}\_\{t\_\{j\}\}\-measurable andℱtj⊆ℱtj\+1−k⊆𝒢tj\+1\(k\)\\mathcal\{F\}\_\{t\_\{j\}\}\\subseteq\\mathcal\{F\}\_\{t\_\{j\+1\}\-k\}\\subseteq\\mathcal\{G\}^\{\(k\)\}\_\{t\_\{j\+1\}\}, so the peeling argument of Appendix A\.1 goes through\. Iftj\+1−tj<kt\_\{j\+1\}\-t\_\{j\}<kthenxtjx\_\{t\_\{j\}\}lies strictly inside the prediction window oftj\+1t\_\{j\+1\}and the two residuals sharek−\(tj\+1−tj\)k\-\(t\_\{j\+1\}\-t\_\{j\}\)innovations, so they are dependent; nothing above bounds that dependence\.□\\square

*Proposition 2\.*WithΣ≡σ2​I\\Sigma\\equiv\\sigma^\{2\}Iand identity drift over the window,xt−𝔼​\[xt∣ℱt−k\]=∑j=t−k\+1t\(bj\+σ​ξj\)x\_\{t\}\-\\mathbb\{E\}\[x\_\{t\}\\mid\\mathcal\{F\}\_\{t\-k\}\]=\\sum\_\{j=t\-k\+1\}^\{t\}\(b\_\{j\}\+\\sigma\\xi\_\{j\}\), which has mean∑jbj\\sum\_\{j\}b\_\{j\}and covariancek​σ2​Ik\\sigma^\{2\}I\. Att=t0\+k−1t=t\_\{0\}\+k\-1the accumulated shift isbb, so the whitened mean has squared norm‖b‖2/\(k​σ2\)\\\|b\\\|^\{2\}/\(k\\sigma^\{2\}\)\. The one\-step residual at any single step of the window has whitened meanb/\(k​σ\)b/\(k\\sigma\), giving‖b‖2/\(k2​σ2\)\\\|b\\\|^\{2\}/\(k^\{2\}\\sigma^\{2\}\)\.□\\square

### A\.4Propositions 3, 4 and 5

*Proposition 3\.*Writea=∑i\(νi\+ξi\)2=d\+λd\+S1\+S2a=\\sum\_\{i\}\(\\nu\_\{i\}\+\\xi\_\{i\}\)^\{2\}=d\+\\lambda\_\{d\}\+S\_\{1\}\+S\_\{2\}withS1=∑i\(ξi2−1\)S\_\{1\}=\\sum\_\{i\}\(\\xi\_\{i\}^\{2\}\-1\)andS2=2​∑iνi​ξiS\_\{2\}=2\\sum\_\{i\}\\nu\_\{i\}\\xi\_\{i\}\. ThenS1/2​d⇒𝒩​\(0,1\)S\_\{1\}/\\sqrt\{2d\}\\Rightarrow\\mathcal\{N\}\(0,1\),S2∼𝒩​\(0,4​λd\)S\_\{2\}\\sim\\mathcal\{N\}\(0,4\\lambda\_\{d\}\)exactly, andCov​\(S1,S2\)=0\\mathrm\{Cov\}\(S\_\{1\},S\_\{2\}\)=0since𝔼​\[ξ3\]=0\\mathbb\{E\}\[\\xi^\{3\}\]=0\. Whenλd=O​\(d\)\\lambda\_\{d\}=O\(\\sqrt\{d\}\),S2/2​dS\_\{2\}/\\sqrt\{2d\}has standard deviation2​λd/d→0\\sqrt\{2\\lambda\_\{d\}/d\}\\to 0, so\(a−d\)/2​d=λd/2​d\+S1/2​d\+oP​\(1\)\(a\-d\)/\\sqrt\{2d\}=\\lambda\_\{d\}/\\sqrt\{2d\}\+S\_\{1\}/\\sqrt\{2d\}\+o\_\{P\}\(1\)while\(χd,1−α2−d\)/2​d→zα\(\\chi^\{2\}\_\{d,1\-\\alpha\}\-d\)/\\sqrt\{2d\}\\to z\_\{\\alpha\}\. Ifλd/2​d→∞\\lambda\_\{d\}/\\sqrt\{2d\}\\to\\infty, thenaahas meand\+λdd\+\\lambda\_\{d\}and standard deviation2​d\+4​λd=o​\(λd\)\+O​\(d\)\\sqrt\{2d\+4\\lambda\_\{d\}\}=o\(\\lambda\_\{d\}\)\+O\(\\sqrt\{d\}\), and Chebyshev gives power tending to one\.□\\square

*Proposition 4\.*The Bonferroni test has level at mostα\\alphaby the union bound\. For power, fix a signal coordinate:ℙ​\(\|δd\+ξ\|\>zα/\(2​d\)\)≥ℙ​\(ξ\>zα/\(2​d\)−δd\)\\mathbb\{P\}\(\|\\delta\_\{d\}\+\\xi\|\>z\_\{\\alpha/\(2d\)\}\)\\geq\\mathbb\{P\}\(\\xi\>z\_\{\\alpha/\(2d\)\}\-\\delta\_\{d\}\), and sincezα/\(2​d\)≤2​log⁡\(2​d/α\)=2​log⁡d​\(1\+o​\(1\)\)z\_\{\\alpha/\(2d\)\}\\leq\\sqrt\{2\\log\(2d/\\alpha\)\}=\\sqrt\{2\\log d\}\(1\+o\(1\)\)whileδd=2​\(1\+η\)​log⁡d\\delta\_\{d\}=\\sqrt\{2\(1\+\\eta\)\\log d\}, the gap diverges\. For the chi\-square test,λd=kd​δd2=2​\(1\+η\)​kd​log⁡d=o​\(d\)\\lambda\_\{d\}=k\_\{d\}\\delta\_\{d\}^\{2\}=2\(1\+\\eta\)k\_\{d\}\\log d=o\(\\sqrt\{d\}\)by hypothesis, and Proposition 3 applies\. The finite\-dimensional entries in the table of Section 4\.2 are exact:λ∗\\lambda^\{\\ast\}solvesℙ​\(χd2​\(λ\)\>χd,0\.992\)=0\.8\\mathbb\{P\}\(\\chi^\{2\}\_\{d\}\(\\lambda\)\>\\chi^\{2\}\_\{d,0\.99\}\)=0\.8, andλk∗=k​δ2\\lambda^\{\\ast\}\_\{k\}=k\\delta^\{2\}whereδ\\deltasolves1−\[Φ​\(c−δ\)−Φ​\(−c−δ\)\]k​\[2​Φ​\(c\)−1\]d−k=0\.81\-\[\\Phi\(c\-\\delta\)\-\\Phi\(\-c\-\\delta\)\]^\{k\}\[2\\Phi\(c\)\-1\]^\{d\-k\}=0\.8withccthe exact level\-α\\alphamaximum threshold,2​\(1−Φ​\(c\)\)=1−\(1−α\)1/d2\(1\-\\Phi\(c\)\)=1\-\(1\-\\alpha\)^\{1/d\}\.□\\square

*Proposition 5\.*IfΣ\\Sigmais diagonal so isΣ−1/2\\Sigma^\{\-1/2\}, and supports are preserved\. Otherwise takeΣ−1/2\\Sigma^\{\-1/2\}with a dense first column andb=e1b=e\_\{1\}; thenΣ−1/2​b\\Sigma^\{\-1/2\}bis that column\.□\\square

### A\.5Lemma 1, Theorems 3 and 4

Under \(A1∗\) the calibration scores are i\.i\.d\. from the null score law; under \(A2a\) and Theorem 1 each benign test score has the same law and is independent of the calibration set, which comes from distinct trajectories\. Then\+1n\+1scores are exchangeable with continuous common law, so the rank ofata\_\{t\}is uniform andℙ​\(pt≤u\)≤u\\mathbb\{P\}\(p\_\{t\}\\leq u\)\\leq u\(Vovk, Gammerman and Shafer, 2005\)\. Under \(A1\) alone the same argument runs within a stratum, where exchangeability of the test score with the calibration scores at that index is assumed directly rather than derived from correct specification\. \(A5\) is what permits the statement to be read conditionally on the trajectory having been submitted for audit\.

For Theorem 3, pad withpt=1p\_\{t\}=1forT<t≤TmaxT<t\\leq T\_\{\\max\}\. Padded p\-values satisfyℙ​\(pt≤u\)=0\\mathbb\{P\}\(p\_\{t\}\\leq u\)=0foru<1u<1, so the padded family hasTmaxT\_\{\\max\}hypotheses of which the padded ones are super\-uniform, and the count is now deterministic\. Benjamini–Yekutieli requires only marginal super\-uniformity of the nulls and controls FDR atq​m0/Tmaxq\\,m\_\{0\}/T\_\{\\max\}under arbitrary dependence \(Benjamini and Yekutieli, 2001, Theorem 1\.3\)\. A padded index is rejected only if1≤q​k/\(Tmax​HTmax\)1\\leq qk/\(T\_\{\\max\}H\_\{T\_\{\\max\}\}\), which fails for allk≤Tmaxk\\leq T\_\{\\max\}whenq<HTmaxq<H\_\{T\_\{\\max\}\}, so the realized discoveries are unchanged\.

For Theorem 4, the likelihood ratiofd,λ​\(a\)/fd​\(a\)f\_\{d,\\lambda\}\(a\)/f\_\{d\}\(a\)has expectation one underfdf\_\{d\}for eachλ\\lambda, hence so does any mixture; the closed form follows from the Poisson\-mixture representation of the noncentral density,fd,λ​\(a\)=e−λ/2​∑j≥0\(λ/2\)jj\!​fd\+2​j​\(a\)f\_\{d,\\lambda\}\(a\)=e^\{\-\\lambda/2\}\\sum\_\{j\\geq 0\}\\frac\{\(\\lambda/2\)^\{j\}\}\{j\!\}f\_\{d\+2j\}\(a\)together withfd\+2​j​\(a\)/fd​\(a\)=Γ​\(d/2\)Γ​\(d/2\+j\)​\(a/2\)jf\_\{d\+2j\}\(a\)/f\_\{d\}\(a\)=\\frac\{\\Gamma\(d/2\)\}\{\\Gamma\(d/2\+j\)\}\(a/2\)^\{j\}, so that the ratio ise−λ/2F10\(;d/2;λa/4\)e^\{\-\\lambda/2\}\\,\{\}\_\{0\}F\_\{1\}\(;d/2;\\lambda a/4\)and the Bessel form is the standard identity forF10\{\}\_\{0\}F\_\{1\}\. For a calibrated e\-value, ifffis decreasing with∫01f=1\\int\_\{0\}^\{1\}f=1andppis super\-uniform, then𝔼​\[f​\(p\)\]≤𝔼​\[f​\(U\)\]=1\\mathbb\{E\}\[f\(p\)\]\\leq\\mathbb\{E\}\[f\(U\)\]=1\. e\-BH controls FDR atq​m0/Tmaxq\\,m\_\{0\}/T\_\{\\max\}under arbitrary dependence \(Wang and Ramdas, 2022\)\.□\\square

### A\.6Proposition 6

Under \(A1∗\) and \(A2a\) the exact\-null p\-valuespt=ℙ​\(χd2≥at\)p\_\{t\}=\\mathbb\{P\}\(\\chi^\{2\}\_\{d\}\\geq a\_\{t\}\)are i\.i\.d\. uniform across benign steps by Theorem 1\. LetV​\(s\)V\(s\)count benign p\-values at mostss\. By the Dvoretzky–Kiefer–Wolfowitz inequality with Massart’s constant, with probability at least1−δ1\-\\delta,sups\|V​\(s\)/m0−s\|≤log⁡\(2/δ\)/\(2​m0\)\\sup\_\{s\}\|V\(s\)/m\_\{0\}\-s\|\\leq\\sqrt\{\\log\(2/\\delta\)/\(2m\_\{0\}\)\}, soV​\(s\)≤m0​s\+m0​log⁡\(2/δ\)/2V\(s\)\\leq m\_\{0\}s\+\\sqrt\{m\_\{0\}\\log\(2/\\delta\)/2\}simultaneously inss; boundingm0≤Tm\_\{0\}\\leq Tand dividing byR​\(s\)∨1R\(s\)\\vee 1gives the claim\.

With conformal rather than exact\-null p\-values the benign p\-values are dependent through the shared calibration set\. Conditioning on it restores independence, and a second application of the same inequality to the calibration sample givesℙ​\(pt≤s∣Ω\)≤s\+log⁡\(2/δ′\)/\(2​n\)\\mathbb\{P\}\(p\_\{t\}\\leq s\\mid\\Omega\)\\leq s\+\\sqrt\{\\log\(2/\\delta^\{\\prime\}\)/\(2n\)\}uniformly insswith probability1−δ′1\-\\delta^\{\\prime\}; the bound then holds withssreplaced bys\+log⁡\(2/δ′\)/\(2​n\)s\+\\sqrt\{\\log\(2/\\delta^\{\\prime\}\)/\(2n\)\}and total failure probabilityδ\+δ′\\delta\+\\delta^\{\\prime\}\.□\\square

### A\.7Theorem 5 and Proposition 7

*Theorem 5\.*Construct both worlds on one space, sequentially intt\. Given agreement of histories throught−1t\-1: ift∈It\\in I, both worlds apply the same corruption kernel to the same history and can be coupled to agree exactly; ift∉It\\notin I, maximally couple the true conditional law withQtQ\_\{t\}, which fail to agree with probability at mostδt\\delta\_\{t\}\(Lindvall, 2002\)\. If the histories already disagree, couple arbitrarily\. LetEEbe the event of agreement throughTT; a union bound over benign steps givesℙ​\(Ec\)≤∑t∉Iδt\\mathbb\{P\}\(E^\{c\}\)\\leq\\sum\_\{t\\notin I\}\\delta\_\{t\}\. The calibration set is shared and exact\. OnEEthe two worlds produce identical scores, flags and corrupted sets, hence identical false discovery proportions\. SinceFDP≤1\\mathrm\{FDP\}\\leq 1,

FDRtrue=𝔼\[FDP1E\]\+𝔼\[FDP1Ec\]≤FDRmodel\+ℙ\(Ec\)\.□\\mathrm\{FDR\}\_\{\\mathrm\{true\}\}=\\mathbb\{E\}\[\\mathrm\{FDP\}\\,\\mathbf\{1\}\_\{E\}\]\+\\mathbb\{E\}\[\\mathrm\{FDP\}\\,\\mathbf\{1\}\_\{E^\{c\}\}\]\\leq\\mathrm\{FDR\}\_\{\\mathrm\{model\}\}\+\\mathbb\{P\}\(E^\{c\}\)\.\\qquad\\square
*Proposition 7\.*LetS^n​\(a\)=n−1​\#​\{ωj≥a\}\\hat\{S\}\_\{n\}\(a\)=n^\{\-1\}\\\#\\\{\\omega\_\{j\}\\geq a\\\}, letSGS\_\{G\}be the survival function of the true calibration score law andSSthat of the model null\. Thenpt=nn\+1​S^n​\(at\)\+1n\+1p\_\{t\}=\\frac\{n\}\{n\+1\}\\hat\{S\}\_\{n\}\(a\_\{t\}\)\+\\frac\{1\}\{n\+1\}, so\|pt−S​\(at\)\|≤‖S^n−S‖∞\+1n\+1\|p\_\{t\}\-S\(a\_\{t\}\)\|\\leq\\\|\\hat\{S\}\_\{n\}\-S\\\|\_\{\\infty\}\+\\frac\{1\}\{n\+1\}, and‖S^n−S‖∞≤‖S^n−SG‖∞\+ϵ\\\|\\hat\{S\}\_\{n\}\-S\\\|\_\{\\infty\}\\leq\\\|\\hat\{S\}\_\{n\}\-S\_\{G\}\\\|\_\{\\infty\}\+\\epsilon\. The Dvoretzky–Kiefer–Wolfowitz inequality bounds the first term bylog⁡\(2/δ\)/\(2​n\)\\sqrt\{\\log\(2/\\delta\)/\(2n\)\}with probability1−δ1\-\\delta\. On that eventp~t=pt\+η≥S​\(at\)\\tilde\{p\}\_\{t\}=p\_\{t\}\+\\eta\\geq S\(a\_\{t\}\), which is uniform under \(A2a\) at the test step, sop~t\\tilde\{p\}\_\{t\}is super\-uniform and every procedure valid for super\-uniform nulls applies, withδ\\deltaadded to the error rate to account for the complement\.□\\square

### A\.8Theorem 7, Corollary 4 and Proposition 9

Writex−μm=\(μ∗−μm\)\+C1/2​ζx\-\\mu\_\{m\}=\(\\mu^\{\\ast\}\-\\mu\_\{m\}\)\+C^\{1/2\}\\zetawith‖μ∗−μm‖≤κ​D\+η0\\\|\\mu^\{\\ast\}\-\\mu\_\{m\}\\\|\\leq\\kappa D\+\\eta\_\{0\},C⪯σ¯2​IC\\preceq\\bar\{\\sigma\}^\{2\}Iandζ∼𝒩​\(0,Id\)\\zeta\\sim\\mathcal\{N\}\(0,I\_\{d\}\)\. Pointwise,‖x−μm‖2≤2​\(κ​D\+η0\)2\+2​σ¯2​‖ζ‖2\\\|x\-\\mu\_\{m\}\\\|^\{2\}\\leq 2\(\\kappa D\+\\eta\_\{0\}\)^\{2\}\+2\\bar\{\\sigma\}^\{2\}\\\|\\zeta\\\|^\{2\}, so withA​\(D\)=2​\(κ​D\+η0\)2/σ2​\(D\)A\(D\)=2\(\\kappa D\+\\eta\_\{0\}\)^\{2\}/\\sigma^\{2\}\(D\)andB​\(D\)=2​σ¯2/σ2​\(D\)B\(D\)=2\\bar\{\\sigma\}^\{2\}/\\sigma^\{2\}\(D\),

at≤A​\(D\)\+B​\(D\)​χd2pointwise in​ζ\.a\_\{t\}\\leq A\(D\)\+B\(D\)\\,\\chi^\{2\}\_\{d\}\\quad\\text\{pointwise in \}\\zeta\.ForD≥d0D\\geq d\_\{0\},A​\(D\)≤2​\(κ​D\+η0\)2/\(σ02​γ​D2\)≤2​\(κ\+η0/d0\)2/\(σ02​γ\)=A∞A\(D\)\\leq 2\(\\kappa D\+\\eta\_\{0\}\)^\{2\}/\(\\sigma\_\{0\}^\{2\}\\gamma D^\{2\}\)\\leq 2\(\\kappa\+\\eta\_\{0\}/d\_\{0\}\)^\{2\}/\(\\sigma\_\{0\}^\{2\}\\gamma\)=A\_\{\\infty\}andB​\(D\)≤B​\(d0\)=B0B\(D\)\\leq B\(d\_\{0\}\)=B\_\{0\}\. Hence for anyuu,

ℙ​\(at\>u\)≤ℙ​\(A∞\+B0​χd2\>u\)=ℙ​\(χd2\>\(u−A∞\)/B0\),\\mathbb\{P\}\(a\_\{t\}\>u\)\\leq\\mathbb\{P\}\\big\(A\_\{\\infty\}\+B\_\{0\}\\chi^\{2\}\_\{d\}\>u\\big\)=\\mathbb\{P\}\\big\(\\chi^\{2\}\_\{d\}\>\(u\-A\_\{\\infty\}\)/B\_\{0\}\\big\),which is at mostℙ​\(χd2\>u\)\\mathbb\{P\}\(\\chi^\{2\}\_\{d\}\>u\)precisely when\(u−A∞\)/B0≥u\(u\-A\_\{\\infty\}\)/B\_\{0\}\\geq u, that isu≥A∞/\(1−B0\)u\\geq A\_\{\\infty\}/\(1\-B\_\{0\}\)\. BothA∞A\_\{\\infty\}andB0B\_\{0\}are decreasing inγ\\gamma, so the two conditionsB0<1B\_\{0\}<1andA∞/\(1−B0\)≤χd,1−α2A\_\{\\infty\}/\(1\-B\_\{0\}\)\\leq\\chi^\{2\}\_\{d,1\-\\alpha\}hold for allγ\\gammaabove an explicit threshold\. Super\-uniformity at levelsu≤αu\\leq\\alphafollows becausept≤u≤αp\_\{t\}\\leq u\\leq\\alphacorresponds toata\_\{t\}exceeding a threshold at leastχd,1−α2\\chi^\{2\}\_\{d,1\-\\alpha\}\. If the true deviation isσ¯2\\bar\{\\sigma\}^\{2\}\-sub\-Gaussian rather than Gaussian, replace‖ζ‖2\\\|\\zeta\\\|^\{2\}by its sub\-Gaussian envelope\(d\+t\)2\(\\sqrt\{d\}\+t\)^\{2\}with failure probabilitye−t2/2e^\{\-t^\{2\}/2\}; the conclusion holds withχd2\\chi^\{2\}\_\{d\}replaced by that envelope and an additivee−t2/2e^\{\-t^\{2\}/2\}\.

Corollary 4 is the special case in which the state is off\-support because it inherits a corruption\. Proposition 9 is immediate:ε=b/σ​\(D\)\+ξ\\varepsilon=b/\\sigma\(D\)\+\\xigivesa∼χd2​\(‖b‖2/σ2​\(D\)\)a\\sim\\chi^\{2\}\_\{d\}\(\\\|b\\\|^\{2\}/\\sigma^\{2\}\(D\)\), and Corollary 3 converts the noncentrality into a requirement on‖b‖\\\|b\\\|\.□\\square

### A\.9Proposition 8

Takeϱ=0\\varrho=0for legibility; the general case replacesWWbyW\+ϱW\+\\varrhothroughout\. Withεt=ξt\+vt​g\\varepsilon\_\{t\}=\\xi\_\{t\}\+v\_\{t\}g,g^=W−1​∑svs​εs=g\+W−1​∑svs​ξs\\hat\{g\}=W^\{\-1\}\\sum\_\{s\}v\_\{s\}\\varepsilon\_\{s\}=g\+W^\{\-1\}\\sum\_\{s\}v\_\{s\}\\xi\_\{s\}, soε~t=ξt−vt​W−1​∑svs​ξs\\tilde\{\\varepsilon\}\_\{t\}=\\xi\_\{t\}\-v\_\{t\}W^\{\-1\}\\sum\_\{s\}v\_\{s\}\\xi\_\{s\}is free ofgg\. Its covariance is

\(1−2​vt2/W\+vt2​W/W2\)​Id=\(1−ht\)​Id,ht=vt2/W,\\big\(1\-2v\_\{t\}^\{2\}/W\+v\_\{t\}^\{2\}W/W^\{2\}\\big\)I\_\{d\}=\(1\-h\_\{t\}\)I\_\{d\},\\qquad h\_\{t\}=v\_\{t\}^\{2\}/W,andCov​\(ε~t,ε~s\)=−vt​vs​W−1​Id\\mathrm\{Cov\}\(\\tilde\{\\varepsilon\}\_\{t\},\\tilde\{\\varepsilon\}\_\{s\}\)=\-v\_\{t\}v\_\{s\}W^\{\-1\}I\_\{d\}fors≠ts\\neq t, which is the cross\-correlation in part \(i\)\. Hencea~t=‖ε~t‖2/\(1−ht\)∼χd2\\tilde\{a\}\_\{t\}=\\\|\\tilde\{\\varepsilon\}\_\{t\}\\\|^\{2\}/\(1\-h\_\{t\}\)\\sim\\chi^\{2\}\_\{d\}marginally when no step is corrupted\. If a shiftνt\\nu\_\{t\}is present at stepttonly,𝔼​\[ε~t\]=\(1−ht\)​νt\\mathbb\{E\}\[\\tilde\{\\varepsilon\}\_\{t\}\]=\(1\-h\_\{t\}\)\\nu\_\{t\}and𝔼​\[ε~s\]=−vs​vt​W−1​νt\\mathbb\{E\}\[\\tilde\{\\varepsilon\}\_\{s\}\]=\-v\_\{s\}v\_\{t\}W^\{\-1\}\\nu\_\{t\}, so the standardized residual atssis𝒩​\(θs,Id\)\\mathcal\{N\}\(\\theta\_\{s\},I\_\{d\}\)with‖θs‖2=μs=hs​ht​λt/\(1−hs\)\\\|\\theta\_\{s\}\\\|^\{2\}=\\mu\_\{s\}=h\_\{s\}h\_\{t\}\\lambda\_\{t\}/\(1\-h\_\{s\}\)\.

For the resulting bound,TV​\(𝒩​\(θ,Id\),𝒩​\(0,Id\)\)=2​Φ​\(‖θ‖/2\)−1≤‖θ‖/2​π\\mathrm\{TV\}\(\\mathcal\{N\}\(\\theta,I\_\{d\}\),\\mathcal\{N\}\(0,I\_\{d\}\)\)=2\\Phi\(\\\|\\theta\\\|/2\)\-1\\leq\\\|\\theta\\\|/\\sqrt\{2\\pi\}, and total variation between the score laws is no greater than total variation between the residual laws\. Summingμs=ht​λt​hs/\(1−hs\)\\sqrt\{\\mu\_\{s\}\}=\\sqrt\{h\_\{t\}\\lambda\_\{t\}\}\\sqrt\{h\_\{s\}/\(1\-h\_\{s\}\)\}overs≠ts\\neq tgives the displayed bound, which grows asλt\\sqrt\{\\lambda\_\{t\}\}\. Under a bounded\-influence estimator with influence bounded byς\\varsigma, the induced mean satisfies‖θs‖≤vs​ς/1−hs\\\|\\theta\_\{s\}\\\|\\leq v\_\{s\}\\varsigma/\\sqrt\{1\-h\_\{s\}\}independently ofλt\\lambda\_\{t\}, and the sum is uniformly bounded in the corruption magnitude\.□\\square

### A\.10Proposition 10

With the predictable anchorgηg\_\{\\eta\}of Lipschitz constantLgL\_\{g\}andhT=1−sT−1≥ΔTh\_\{T\}=1\-s\_\{T\-1\}\\geq\\Delta\_\{T\}, the terminal model mean satisfies

μ​\(z\)−μ​\(z′\)=\(z−z′\)​\(1−ΔThT\)\+ΔThT​\(gη​\(z\)−gη​\(z′\)\)\+ΔT​\(uθ​\(z\)−uθ​\(z′\)\),\\mu\(z\)\-\\mu\(z^\{\\prime\}\)=\(z\-z^\{\\prime\}\)\\Big\(1\-\\frac\{\\Delta\_\{T\}\}\{h\_\{T\}\}\\Big\)\+\\frac\{\\Delta\_\{T\}\}\{h\_\{T\}\}\\big\(g\_\{\\eta\}\(z\)\-g\_\{\\eta\}\(z^\{\\prime\}\)\\big\)\+\\Delta\_\{T\}\\big\(u\_\{\\theta\}\(z\)\-u\_\{\\theta\}\(z^\{\\prime\}\)\\big\),so‖μ​\(z\)−μ​\(z′\)‖≤w​κT\\\|\\mu\(z\)\-\\mu\(z^\{\\prime\}\)\\\|\\leq w\\,\\kappa\_\{T\}withκT=1\+Lg​ΔT/hT\+L​ΔT\\kappa\_\{T\}=1\+L\_\{g\}\\Delta\_\{T\}/h\_\{T\}\+L\\Delta\_\{T\}\. Since‖m1−m2‖≥2​r\\\|m\_\{1\}\-m\_\{2\}\\\|\\geq 2r, the triangle inequality impliesmaxi⁡‖μ​\(zi\)−mi‖≥r−w​κT/2=ρ\\max\_\{i\}\\\|\\mu\(z\_\{i\}\)\-m\_\{i\}\\\|\\geq r\-w\\kappa\_\{T\}/2=\\rho\. At the state with the larger discrepancy,‖x−μ‖≥ρ−σc​‖ζ‖\\\|x\-\\mu\\\|\\geq\\rho\-\\sigma\_\{c\}\\\|\\zeta\\\|, so the flag probability is at leastℙ​\(σc​‖ζ‖<ρ−σT​τ\)\\mathbb\{P\}\(\\sigma\_\{c\}\\\|\\zeta\\\|<\\rho\-\\sigma\_\{T\}\\sqrt\{\\tau\}\)\. If alternative \(b\) fails, thenσT​τ<ρ/2\\sigma\_\{T\}\\sqrt\{\\tau\}<\\rho/2, andρ≥2​σc​\(d\+t\)\\rho\\geq 2\\sigma\_\{c\}\(\\sqrt\{d\}\+t\)gives a probability of at least1−e−t2/21\-e^\{\-t^\{2\}/2\}by Gaussian norm concentration\. If insteadσT2≥ρ2/\(4​τ\)\\sigma\_\{T\}^\{2\}\\geq\\rho^\{2\}/\(4\\tau\), a terminal shift hasλeff=‖b‖2/σT2≤4​τ​‖b‖2/ρ2\\lambda\_\{\\mathrm\{eff\}\}=\\\|b\\\|^\{2\}/\\sigma\_\{T\}^\{2\}\\leq 4\\tau\\\|b\\\|^\{2\}/\\rho^\{2\}\. Forτ≤2​d\\tau\\leq 2dat largedd, the noncentrality reaches the2​d\\sqrt\{2d\}boundary of Proposition 3 only when‖b‖2≥ρ2​2​d/\(8​d\)\\\|b\\\|^\{2\}\\geq\\rho^\{2\}\\sqrt\{2d\}/\(8d\), which givesc1c\_\{1\}\.

The hypothesisρ\>0\\rho\>0is what makes the dichotomy bind, and it fails when

Lg\>\(2​rw−1−L​ΔT\)​hTΔT\.L\_\{g\}\\;\>\\;\\Big\(\\frac\{2r\}\{w\}\-1\-L\\Delta\_\{T\}\\Big\)\\frac\{h\_\{T\}\}\{\\Delta\_\{T\}\}\.An anchor head whose state sensitivity exceeds this threshold can map the two states to different terminal means, so the hypothesis of Proposition 10 no longer holds\. This capacity condition does not establish that either alternative is avoided; accurate routing is addressed in Proposition 12\. The threshold increases withhT/ΔTh\_\{T\}/\\Delta\_\{T\}, making separation most difficult when the final operation has low cost while substantial budget remains\.□\\square

### A\.11Theorem 6 and Proposition 13

*Theorem 6\.*The odds bound gives, for any validτ,τ′\\tau,\\tau^\{\\prime\},π​\(τ\)​\(1−π​\(τ′\)\)≤Γ​π​\(τ′\)​\(1−π​\(τ\)\)\\pi\(\\tau\)\\big\(1\-\\pi\(\\tau^\{\\prime\}\)\\big\)\\leq\\Gamma\\,\\pi\(\\tau^\{\\prime\}\)\\big\(1\-\\pi\(\\tau\)\\big\), henceπ​\(τ\)≤Γ​π​\(τ′\)\+π​\(τ\)​π​\(τ′\)​\(1−Γ\)≤Γ​π​\(τ′\)\\pi\(\\tau\)\\leq\\Gamma\\pi\(\\tau^\{\\prime\}\)\+\\pi\(\\tau\)\\pi\(\\tau^\{\\prime\}\)\(1\-\\Gamma\)\\leq\\Gamma\\pi\(\\tau^\{\\prime\}\)sinceΓ≥1\\Gamma\\geq 1\. Condition on the calibration setΩ\\Omega, which is drawn without selection\. For any eventAAmeasurable in the audited trajectory,

ℙ​\(A∣S,Ω\)=𝔼​\[π​\(τ\)​𝟏A∣Ω\]𝔼​\[π​\(τ\)∣Ω\]≤supπinfπ​ℙ​\(A∣Ω\)≤Γ​ℙ​\(A∣Ω\)\.\\mathbb\{P\}\(A\\mid S,\\Omega\)=\\frac\{\\mathbb\{E\}\[\\pi\(\\tau\)\\mathbf\{1\}\_\{A\}\\mid\\Omega\]\}\{\\mathbb\{E\}\[\\pi\(\\tau\)\\mid\\Omega\]\}\\leq\\frac\{\\sup\\pi\}\{\\inf\\pi\}\\,\\mathbb\{P\}\(A\\mid\\Omega\)\\leq\\Gamma\\,\\mathbb\{P\}\(A\\mid\\Omega\)\.TakingA=\{pt≤u\}A=\\\{p\_\{t\}\\leq u\\\}for a benignttand averaging overΩ\\Omegagivesℙ​\(pt≤u∣S\)≤Γ​u\\mathbb\{P\}\(p\_\{t\}\\leq u\\mid S\)\\leq\\Gamma uby Lemma 1\. Substituting the inflated super\-uniformity into the Benjamini–Yekutieli or e\-BH argument multiplies the bound byΓ\\Gamma, so running atq/Γq/\\Gammarestores levelqq\. The expression forΓ∗\\Gamma^\{\\ast\}is the largestΓ\\Gammafor which the realizedp\(k\)p\_\{\(k\)\}still satisfies the Benjamini–Yekutieli threshold at levelq/Γq/\\Gamma\.□\\square

*Proposition 13\.*Under \(A2a\) and correct specification, the occurrences of typeccin distinct trajectories are independent, each contributingχd2​\(λ\)\\chi^\{2\}\_\{d\}\(\\lambda\)by Corollary 1, so the sum isχmc​d2​\(mc​λ\)\\chi^\{2\}\_\{m\_\{c\}d\}\(m\_\{c\}\\lambda\)by additivity of independent noncentral chi\-squares\. Proposition 3 applied in dimensionmc​dm\_\{c\}drequires noncentrality of order2​mc​d​\(zα\+z1−β\)\\sqrt\{2m\_\{c\}d\}\\,\(z\_\{\\alpha\}\+z\_\{1\-\\beta\}\); settingmc​λm\_\{c\}\\lambdaequal to that and dividing bymcm\_\{c\}gives the stated bound\. For Corollary 5, the confusability construction in Appendix A\.14 perturbs the drift of the*valid*mechanism and is distinguished only by calibration transitions passing through the perturbed region; audited occurrences are draws from the corrupted mechanism and enter neither side of that comparison\.□\\square

### A\.12Propositions 11 and 12

*Proposition 11\.*The terminal model mean isμ​\(z\)=z​\(1−ΔT/hT\)\+\(ΔT/hT\)​gη​\(z\)\+ΔT​uθ​\(z\)\\mu\(z\)=z\(1\-\\Delta\_\{T\}/h\_\{T\}\)\+\(\\Delta\_\{T\}/h\_\{T\}\)g\_\{\\eta\}\(z\)\+\\Delta\_\{T\}u\_\{\\theta\}\(z\), soLip​\(μ\)≤1\+Lg​ΔT/hT\+L​ΔT=κT\\mathrm\{Lip\}\(\\mu\)\\leq 1\+L\_\{g\}\\Delta\_\{T\}/h\_\{T\}\+L\\Delta\_\{T\}=\\kappa\_\{T\}, and the extrapolation bound of Theorem 7 holds withκ≤κT\+L∗\\kappa\\leq\\kappa\_\{T\}\+L^\{\\ast\}\. Solving the second design condition of Theorem 7,A∞/\(1−B0\)≤χd,1−α2A\_\{\\infty\}/\(1\-B\_\{0\}\)\\leq\\chi^\{2\}\_\{d,1\-\\alpha\}withA∞=2​\(κ\+η0/d0\)2/\(σ02​γ\)A\_\{\\infty\}=2\(\\kappa\+\\eta\_\{0\}/d\_\{0\}\)^\{2\}/\(\\sigma\_\{0\}^\{2\}\\gamma\), forγ\\gammagives the first display\. Substituting into‖b‖min2=σ02​\(1\+γ​D2\)​2​d​\(zα\+z1−β\)\\\|b\\\|^\{2\}\_\{\\min\}=\\sigma\_\{0\}^\{2\}\(1\+\\gamma D^\{2\}\)\\sqrt\{2d\}\(z\_\{\\alpha\}\+z\_\{1\-\\beta\}\)of Proposition 9 and dropping the additive one gives the second, withσ02\\sigma\_\{0\}^\{2\}cancelling\. IfLg\>\(2​r/w−1−L​ΔT\)​hT/ΔTL\_\{g\}\>\(2r/w\-1\-L\\Delta\_\{T\}\)h\_\{T\}/\\Delta\_\{T\}thenLg​ΔT/hT\>2​r/w−1−L​ΔTL\_\{g\}\\Delta\_\{T\}/h\_\{T\}\>2r/w\-1\-L\\Delta\_\{T\}, soκT\>2​r/w\\kappa\_\{T\}\>2r/w\.□\\square

*Proposition 12\.*At the terminal step,x−μ​\(z\)=\(m​\(z\)−μ​\(z\)\)\+σc​ζx\-\\mu\(z\)=\(m\(z\)\-\\mu\(z\)\)\+\\sigma\_\{c\}\\zetawith‖m​\(z\)−μ​\(z\)‖≤e0\\\|m\(z\)\-\\mu\(z\)\\\|\\leq e\_\{0\}andζ∼𝒩​\(0,Id\)\\zeta\\sim\\mathcal\{N\}\(0,I\_\{d\}\), so pointwisea≤A\+B​χd2a\\leq A\+B\\chi^\{2\}\_\{d\}withA=2​e02/σT2A=2e\_\{0\}^\{2\}/\\sigma\_\{T\}^\{2\}andB=2​σc2/σT2B=2\\sigma\_\{c\}^\{2\}/\\sigma\_\{T\}^\{2\}\. This has the form used in Theorem 7, and the argument of Appendix A\.8 givesℙ​\(a\>u\)≤ℙ​\(χd2\>u\)\\mathbb\{P\}\(a\>u\)\\leq\\mathbb\{P\}\(\\chi^\{2\}\_\{d\}\>u\)foru≥A/\(1−B\)u\\geq A/\(1\-B\)\. The conditionsB<1B<1andA/\(1−B\)≤χd,1−α2A/\(1\-B\)\\leq\\chi^\{2\}\_\{d,1\-\\alpha\}are jointly equivalent to the stated lower bound onσT2\\sigma\_\{T\}^\{2\}\. Detectability follows from Proposition 9 withσ2​\(D\)\\sigma^\{2\}\(D\)replaced byσT2\\sigma\_\{T\}^\{2\}\. Alternative \(b\) of Proposition 10 gives blindness up to‖b‖2≤c1​ρ2/d\\\|b\\\|^\{2\}\\leq c\_\{1\}\\rho^\{2\}/\\sqrt\{d\}, whereas accurate routing gives detectability from‖b‖2≳σc2​2​d\\\|b\\\|^\{2\}\\gtrsim\\sigma\_\{c\}^\{2\}\\sqrt\{2d\}\. Their ratio is of orderρ2/\(σc2​d\)\\rho^\{2\}/\(\\sigma\_\{c\}^\{2\}d\)and is at least four whenρ≥2​σc​d\\rho\\geq 2\\sigma\_\{c\}\\sqrt\{d\}\.□\\square

### A\.13Theorem 8 and Corollary 6

LetK\(1\)K^\{\(1\)\}agree withK∗K^\{\\ast\}except att0t\_\{0\}, where it equals an arbitraryQ≠Kt0∗Q\\neq K^\{\\ast\}\_\{t\_\{0\}\}\. LetK\(2\)K^\{\(2\)\}agree withK\(1\)K^\{\(1\)\}att0t\_\{0\}and, fort\>t0t\>t\_\{0\}, takeKt\(2\)=\(1−ϵ\)​Kt∗\+ϵ​RtK^\{\(2\)\}\_\{t\}=\(1\-\\epsilon\)K^\{\\ast\}\_\{t\}\+\\epsilon R\_\{t\}withRt≠Kt∗R\_\{t\}\\neq K^\{\\ast\}\_\{t\}arbitrary\. Everyt\>t0t\>t\_\{0\}satisfiesKt\(2\)≠Kt∗K^\{\(2\)\}\_\{t\}\\neq K^\{\\ast\}\_\{t\}, soI​\(K\(2\)\)=\{t0,…,T\}I\(K^\{\(2\)\}\)=\\\{t\_\{0\},\\ldots,T\\\}, whileTV​\(Kt\(2\),Kt∗\)≤ϵ\\mathrm\{TV\}\(K^\{\(2\)\}\_\{t\},K^\{\\ast\}\_\{t\}\)\\leq\\epsilonuniformly; sequential maximal coupling givesTV​\(P\(1\),P\(2\)\)≤\(T−t0\)​ϵ\\mathrm\{TV\}\(P^\{\(1\)\},P^\{\(2\)\}\)\\leq\(T\-t\_\{0\}\)\\epsilon, andϵ=η/\(T−t0\)\\epsilon=\\eta/\(T\-t\_\{0\}\)gives the bound\. Symmetric difference obeys the triangle inequality, so for every setSS,\|S​△​I\(1\)\|\+\|S​△​I\(2\)\|≥\|I\(1\)​△​I\(2\)\|=T−t0\|S\\triangle I^\{\(1\)\}\|\+\|S\\triangle I^\{\(2\)\}\|\\geq\|I^\{\(1\)\}\\triangle I^\{\(2\)\}\|=T\-t\_\{0\}pointwise, whence

𝔼1​\|ψ​△​I\(1\)\|\+𝔼2​\|ψ​△​I\(2\)\|≥\(T−t0\)​∫min⁡\(d​P\(1\),d​P\(2\)\)≥\(T−t0\)​\(1−η\)\.\\mathbb\{E\}\_\{1\}\|\\psi\\triangle I^\{\(1\)\}\|\+\\mathbb\{E\}\_\{2\}\|\\psi\\triangle I^\{\(2\)\}\|\\geq\(T\-t\_\{0\}\)\\int\\min\(dP^\{\(1\)\},dP^\{\(2\)\}\)\\geq\(T\-t\_\{0\}\)\(1\-\\eta\)\.Corollary 6 follows sinceη\\etais arbitrary and neither the sample size nor the score enters the bound\.□\\square

### A\.14Theorem 9

Fixzzin the interior of the visited region and letϕ\\phibe a smooth bump supported on the ball of radiushhaboutzzwith‖ϕ‖∞=1\\\|\\phi\\\|\_\{\\infty\}=1and Lipschitz constant of order1/h1/h\. Putβ=\(b/Δ\)​ϕ\\beta=\(b/\\Delta\)\\phiandu′=u\+βu^\{\\prime\}=u\+\\beta; membership in𝒰​\(L\)\\mathcal\{U\}\(L\)requiresh≳‖b‖/\(L​Δ\)h\\gtrsim\\\|b\\\|/\(L\\Delta\), andhhis taken at that bound, which minimizes the calibration signal\.

Under \(a\) the calibration trajectories have driftuuand under \(b\) driftu′u^\{\\prime\}\. The laws differ only at transitions originating insupp​ϕ\\mathrm\{supp\}\\,\\phi, each contributing Kullback–Leibler divergence at most‖b‖2/\(2​σ2\)\\\|b\\\|^\{2\}/\(2\\sigma^\{2\}\)\. Withp=ℙ​\(X∈supp​ϕ\)≲c​hdp=\\mathbb\{P\}\(X\\in\\mathrm\{supp\}\\,\\phi\)\\lesssim ch^\{d\}, the chain rule and Pinsker’s inequality give

TVcal≲c​N​‖b‖2σ2​\(‖b‖L​Δ\)d\.\\mathrm\{TV\}\_\{\\mathrm\{cal\}\}\\lesssim\\sqrt\{\\frac\{cN\\\|b\\\|^\{2\}\}\{\\sigma^\{2\}\}\\left\(\\frac\{\\\|b\\\|\}\{L\\Delta\}\\right\)^\{d\}\}\.Under the stated condition, this quantity is at most a small constant\. Conditional on the audited trajectory visitingsupp​ϕ\\mathrm\{supp\}\\,\\phionce, at the step carrying the corruption in \(a\), the two audited laws coincide: in \(a\) that transition has meanμt\+b\\mu\_\{t\}\+bby construction and in \(b\) meanμt\+β​\(z\)​Δ=μt\+b\\mu\_\{t\}\+\\beta\(z\)\\Delta=\\mu\_\{t\}\+bbecause the drift carries the bump, all other transitions followinguuin both\. An additional visit has probability at mostT​pTp, negligible under the same condition whenT≲nT\\lesssim n\. Summing and choosing constants givesTV≤1/4\\mathrm\{TV\}\\leq 1/4; since\|Ia​△​Ib\|=1\|I\_\{a\}\\triangle I\_\{b\}\|=1, the argument in Appendix A\.13 gives the risk bound\. For the noise term, withTTcandidate locations and known dynamics the maximum ofTTindependentχd2\\chi^\{2\}\_\{d\}scores exceedsd\+2​d​log⁡T​\(1\+o​\(1\)\)d\+\\sqrt\{2d\\log T\}\(1\+o\(1\)\), so noncentrality of order2​d​log⁡T\\sqrt\{2d\\log T\}is required\.□\\square

### A\.15Proposition 15 and Theorem 10

*Proposition 15\.*In the noiseless bridge flow the gap between perturbed and unperturbed solutions is‖D​\(s\)‖=‖b‖​\(1−s\)/\(1−s0\)\\\|D\(s\)\\\|=\\\|b\\\|\(1\-s\)/\(1\-s\_\{0\}\)when the drift correction is absent, which is Theorem 2 withL=0L=0\. Evaluating ats¯\\bar\{s\}and dividing byλ=‖b‖/σeff​\(s0\)\\sqrt\{\\lambda\}=\\\|b\\\|/\\sigma\_\{\\mathrm\{eff\}\}\(s\_\{0\}\)givesℰ\\mathcal\{E\}\. Monotonicity holds wheneverσeff​\(s\)​\(1−s\)−1\\sigma\_\{\\mathrm\{eff\}\}\(s\)\(1\-s\)^\{\-1\}is nondecreasing, in particular for constantσeff\\sigma\_\{\\mathrm\{eff\}\}\.□\\square

*Theorem 10\.*Writek=2j​tk=2^\{j\}twitht∈\[1,2\)t\\in\[1,2\)\. For ladder pointsh≤kh\\leq k,λ\(h\)​\(k\)=‖b‖2​h/\(k2​σ2\)\\lambda^\{\(h\)\}\(k\)=\\\|b\\\|^\{2\}h/\(k^\{2\}\\sigma^\{2\}\)increases withhh, so the maximizing choice ish=2jh=2^\{j\}\. Forh≥kh\\geq k,λ\(h\)​\(k\)=‖b‖2/\(h​σ2\)\\lambda^\{\(h\)\}\(k\)=\\\|b\\\|^\{2\}/\(h\\sigma^\{2\}\)decreases withhh, so the maximizing choice ish=2j\+1h=2^\{j\+1\}\. Relative to the oracle‖b‖2/\(k​σ2\)\\\|b\\\|^\{2\}/\(k\\sigma^\{2\}\), the ratio ismax⁡\(2j/k,k/2j\+1\)=max⁡\(1/t,t/2\)\\max\(2^\{j\}/k,k/2^\{j\+1\}\)=\\max\(1/t,t/2\), whose minimum overt∈\[1,2\)t\\in\[1,2\)is1/21/\\sqrt\{2\}att=2t=\\sqrt\{2\}\. Direct evaluation fork≤2048k\\leq 2048gives the same worst\-case ratio, attained neark=181≈2​128k=181\\approx\\sqrt\{2\}\\,128\.□\\square

## References

Basseville, M\. and Nikiforov, I\. V\. \(1993\)\.*Detection of Abrupt Changes: Theory and Application*\. Prentice Hall, Englewood Cliffs, NJ\.

Bates, S\., Candès, E\., Lei, L\., Romano, Y\., and Sesia, M\. \(2023\)\. Testing for outliers with conformal p\-values\.*The Annals of Statistics*, 51\(1\):149–178\.

Benjamini, Y\. and Hochberg, Y\. \(1995\)\. Controlling the false discovery rate: a practical and powerful approach to multiple testing\.*Journal of the Royal Statistical Society, Series B*, 57\(1\):289–300\.

Benjamini, Y\. and Yekutieli, D\. \(2001\)\. The control of the false discovery rate in multiple testing under dependency\.*The Annals of Statistics*, 29\(4\):1165–1188\.

Cox, D\. R\. and Snell, E\. J\. \(1968\)\. A general definition of residuals\.*Journal of the Royal Statistical Society, Series B*, 30\(2\):248–265\.

Dawid, A\. P\. \(1984\)\. Present position and potential developments: some personal views\. Statistical theory: the prequential approach\.*Journal of the Royal Statistical Society, Series A*, 147\(2\):278–290\.

Donoho, D\. and Jin, J\. \(2004\)\. Higher criticism for detecting sparse heterogeneous mixtures\.*The Annals of Statistics*, 32\(3\):962–994\.

Doob, J\. L\. \(1957\)\. Conditional Brownian motion and the boundary limits of harmonic functions\.*Bulletin de la Société Mathématique de France*, 85:431–458\.

Dvoretzky, A\., Kiefer, J\., and Wolfowitz, J\. \(1956\)\. Asymptotic minimax character of the sample distribution function and of the classical multinomial estimator\.*The Annals of Mathematical Statistics*, 27\(3\):642–669\.

Fan, J\. \(1996\)\. Test of significance based on wavelet thresholding and Neyman’s truncation\.*Journal of the American Statistical Association*, 91\(434\):674–688\.

Feng, N\., Sui, Y\., Hou, S\., Wu, G\., and Cresswell, J\. C\. \(2026\)\. Conformal agent error attribution\. arXiv:2605\.06788\.

Gertler, J\. \(1998\)\.*Fault Detection and Diagnosis in Engineering Systems*\. Marcel Dekker, New York\.

Grönwall, T\. H\. \(1919\)\. Note on the derivatives with respect to a parameter of the solutions of a system of differential equations\.*Annals of Mathematics*, 20\(4\):292–296\.

Ingster, Y\. I\. and Suslina, I\. A\. \(2003\)\.*Nonparametric Goodness\-of\-Fit Testing Under Gaussian Models*\. Lecture Notes in Statistics 169\. Springer, New York\.

Johnson, N\. L\., Kotz, S\., and Balakrishnan, N\. \(1995\)\.*Continuous Univariate Distributions, Volume 2*, 2nd ed\. Wiley, New York\.

Kailath, T\. \(1968\)\. An innovations approach to least\-squares estimation, Part I: linear filtering in additive white noise\.*IEEE Transactions on Automatic Control*, 13\(6\):646–655\.

Katsevich, E\. and Ramdas, A\. \(2020\)\. Simultaneous high\-probability bounds on the false discovery proportion in structured, regression, and online settings\.*The Annals of Statistics*, 48\(6\):3465–3487\.

Kidger, P\., Morrill, J\., Foster, J\., and Lyons, T\. \(2020\)\. Neural controlled differential equations for irregular time series\.*Advances in Neural Information Processing Systems*, 33:6696–6707\.

Kloeden, P\. E\. and Platen, E\. \(1992\)\.*Numerical Solution of Stochastic Differential Equations*\. Springer, Berlin\.

Lindvall, T\. \(2002\)\.*Lectures on the Coupling Method*\. Dover, Mineola, NY\.

Liu, J\., Lin, Z\., Padhy, S\., Tran, D\., Bedrax Weiss, T\., and Lakshminarayanan, B\. \(2020\)\. Simple and principled uncertainty estimation with deterministic deep learning via distance awareness\.*Advances in Neural Information Processing Systems*, 33:7498–7512\.

Massart, P\. \(1990\)\. The tight constant in the Dvoretzky–Kiefer–Wolfowitz inequality\.*The Annals of Probability*, 18\(3\):1269–1283\.

Miyato, T\., Kataoka, T\., Koyama, M\., and Yoshida, Y\. \(2018\)\. Spectral normalization for generative adversarial networks\.*International Conference on Learning Representations*\.

Page, E\. S\. \(1954\)\. Continuous inspection schemes\.*Biometrika*, 41\(1–2\):100–115\.

Rogers, L\. C\. G\. and Williams, D\. \(2000\)\.*Diffusions, Markov Processes and Martingales, Volume 2: Itô Calculus*, 2nd ed\. Cambridge University Press, Cambridge\.

Rosenblatt, M\. \(1952\)\. Remarks on a multivariate transformation\.*The Annals of Mathematical Statistics*, 23\(3\):470–472\.

Seitzer, M\., Tavakoli, A\., Antić, D\., and Martius, G\. \(2022\)\. On the pitfalls of heteroscedastic uncertainty estimation with probabilistic neural networks\.*International Conference on Learning Representations*\.

Shin, J\., Ramdas, A\., and Rinaldo, A\. \(2024\)\. E\-detectors: a nonparametric framework for sequential change detection\.*New England Journal of Statistics in Data Science*, 2:229–260\.

Tibshirani, R\. J\., Barber, R\. F\., Candès, E\., and Ramdas, A\. \(2019\)\. Conformal prediction under covariate shift\.*Advances in Neural Information Processing Systems*, 32\.

Vovk, V\., Gammerman, A\., and Shafer, G\. \(2005\)\.*Algorithmic Learning in a Random World*\. Springer, New York\.

Vovk, V\., Nouretdinov, I\., and Gammerman, A\. \(2003\)\. Testing exchangeability on\-line\. In*Proceedings of the 20th International Conference on Machine Learning*, pp\. 768–775\. AAAI Press\.

Vovk, V\. and Wang, R\. \(2021\)\. E\-values: calibration, combination, and applications\.*The Annals of Statistics*, 49\(3\):1736–1754\.

Wang, R\. and Ramdas, A\. \(2022\)\. False discovery rate control with e\-values\.*Journal of the Royal Statistical Society, Series B*, 84\(3\):822–852\.

Willsky, A\. S\. \(1976\)\. A survey of design methods for failure detection in dynamic systems\.*Automatica*, 12\(6\):601–611\.

Yeh, S\., Zhu, Y\., Deep, S\., and Li, S\. \(2026\)\. Tracing agentic failure from the flow of success\. arXiv:2607\.12747\.

Zhang, B\., Zhu, J\., Shi, Z\., Liu, D\., and Tang, R\. \(2026\)\. AgentForesight: online auditing for early failure prediction in multi\-agent systems\. arXiv:2605\.08715\.

Zhang, S\., Yin, M\., Zhang, J\., Liu, J\., Han, Z\., Zhang, J\., Li, B\., Wang, C\., Wang, H\., Chen, Y\., and Wu, Q\. \(2025\)\. Which agent causes task failures and when? On automated failure attribution of LLM multi\-agent systems\. In*Proceedings of the 42nd International Conference on Machine Learning*, volume 267 of*Proceedings of Machine Learning Research*, pp\. 76583–76599\. PMLR\.