When Can a Machine Trust a Statute? A Survival Certificate for Machine-Extracted Legal Logic

# When Can a Machine Trust a Statute? A Survival Certificate for Machine-Extracted Legal Logic
Source: [https://arxiv.org/html/2609.01741](https://arxiv.org/html/2609.01741)
###### Abstract

Statutes are increasingly parsed by machines before people read them, and the parsers disagree: on Missouri’s statutes, two independently written extractors diverge on numeric\-threshold presence at a false\-negative rate of 0\.43\. We ask what formal logic survives such noise\. We build a passive survival certificate for the Duquenne–Guigues implication basis of machine\-extracted statutory contexts: per\-attribute inter\-extractor disagreement is measured, replayed against the basis in 1,000 Monte Carlo trials, and an implication is certified only when a one\-sided Wilson 95% lower bound on survival reaches 0\.95; every certified implication carries premise spans and a minimal counterexample\. On 29,365 Missouri sections and 502 Indian central\-Act sections, the preregistered held\-out gate passes \(10 statute families across 7 Titles exact; 16 across 11 with 5% tolerance\), yet under one globally deployed error model 93\.2% of held\-out chapters fall below the informativeness floor, and a2×22\\times 2factorial assigns that to calibration\-rate transfer, not selection\. The certificate is usable but fragile: deploy it per\-chapter\-calibrated or error\-tolerant\. Code, data products, and the audit trail, including one retracted claim, are released\.

## Introduction

Machine extraction is the first step of every statutory pipeline we know: a parser reads the text and writes down structured attributes, and downstream symbolic logic treats those attributes as exact\. They are not exact\. On the pooled Missouri context used in this study, two rule\-based parsers written independently of each other disagree about the presence of a numeric threshold at a false\-negative rate of 0\.43\. The disagreement is not noise at the margins; it sits on attributes that legal logic depends on\.

The problem this creates is concrete, and one pair of implications from our own results states it better than any framing\. Over 2,555 pooled Missouri sections, the canonical implication basis contains\{\\\{deadline\}→\{\\\}\\to\\\{numthresh\}\\\}with support 792: nearly eight hundred sections state a deadline as a numeric duration, and the implication looks like the safest rule in the corpus\. Under the measured disagreement model its survival probability is 0\.000, because the second extractor misses spelled\-out numeric thresholds almost half the time and each miss manufactures a counterexample\. The same basis contains\{\\\{oblig,proviso,unless,numthresh,penalty,deadline\}→\{\\\}\\to\\\{prohib\}\\\}with support 12, an unglamorous regularity about heavily conditioned regulatory sections, and its survival probability is 0\.965, high enough to certify, because the attributes it depends on are ones the two extractors almost never delete\. Support, the quantity every symbolic pipeline can see, does not predict robustness, the quantity that matters at deployment\. What predicts robustness is the interaction between an implication’s attribute footprint and the measured error structure of the extractor\.

This paper builds the instrument that makes that interaction explicit: a*survival certificate*for the Duquenne–Guigues \(DG\) implication basis of a machine\-extracted statutory context\. Two extractors, a reference and an independently authored token\-adjacency parser, are run over the same statutes\. Their per\-attribute disagreement calibrates a conditional error model\. That model is replayed against the reference basis inN=1000N\{=\}1000Monte Carlo trials, and each canonical implication receives a survival probability under measured noise\. An implication is certified when a one\-sided Wilson 95% lower bound on survival reachesτ=0\.95\\tau\{=\}0\.95\[[16](https://arxiv.org/html/2609.01741#bib.bib16)\], with a Benjamini–Hochberg companion for the certified set\[[4](https://arxiv.org/html/2609.01741#bib.bib4)\]\. Every certified implication carries provenance: premise and consequent spans, a minimal counterexample, and the calibration\-linked most likely way it breaks\.

Three empirical findings organize the paper\. First, support is not a reliable proxy for robustness of machine\-extracted legal implications; the certificate separates implications that look identical under any support\- or confidence\-based view \(§[5\.1](https://arxiv.org/html/2609.01741#S5.SS1)\)\. Second, global calibration is fragile because extraction disagreement is heterogeneous across statutory chapters: under one pooled error model shipped to every chapter, 93\.2% of held\-out Missouri chapters fall below the informativeness floor, and a preregistered2×22\{\\times\}2factorial assigns the failure to calibration\-rate transfer across heterogeneous chapters, not to held\-out selection \(§[5\.3](https://arxiv.org/html/2609.01741#S5.SS3)\)\. Third, per\-chapter calibration materially improves informativeness, lifting the held\-out mean certified fraction from 0\.038 to 0\.128, while the instrument remains conditional and fragile: it is a statistical lower bound on survival under an empirically measured inter\-extractor disagreement model, not a guarantee of legal correctness \(§[5\.4](https://arxiv.org/html/2609.01741#S5.SS4), §[6](https://arxiv.org/html/2609.01741#S6)\)\.

The controlling evaluation is preregistered and held out\. The gate requires the certificate to be informative on at least two held\-out Missouri families from at least two distinct Titles, with the error model measured on a disjoint calibration half\. It passes: 10 eligible chapters across 7 Titles under exact semantics, 16 across 11 under a 5% error\-tolerant semantics\. The cross\-jurisdiction replication fails: on IndiaCode, 0 of 6 eligible Acts land in the informative band\. We report both without smoothing either\.

Contributions\. \(i\) A passive survival certificate for the DG basis over machine\-extracted statutory contexts: per\-implication survival under a measured conditional error model, Wilson lower\-bound certification at a common Monte Carlo budget, exact andε\\varepsilon\-tolerant semantics, and a premise\-collapse/violation decomposition \(§[3](https://arxiv.org/html/2609.01741#S3)\)\. \(ii\) A counterexample\-carrying provenance layer that makes every certified implication auditable by hand \(§[3\.6](https://arxiv.org/html/2609.01741#S3.SS6)\)\. \(iii\) A preregistered held\-out evaluation on Missouri and IndiaCode, with a factorial deconfounding of selection from calibration\-rate transfer, negative controls, and a 458\-chapter scale run \(§[4](https://arxiv.org/html/2609.01741#S4), §[5](https://arxiv.org/html/2609.01741#S5)\)\.

Scope\. The certificate bounds the probability that an implication survives parser disagreement\. It says nothing about whether the parser is legally correct, whether the reference extraction is ground truth, or whether a certified implication is a real legal rule\. The distinction betweenPr⁡\[implication survives measured disagreement\]\\Pr\[\\text\{implication survives measured disagreement\}\]andPr⁡\[extraction is legally correct\]\\Pr\[\\text\{extraction is legally correct\}\]is maintained throughout, and §[6\.2](https://arxiv.org/html/2609.01741#S6.SS2)states the limits of the instrument exactly\.

## Related Work

#### FCA and implication bases\.

Formal Concept Analysis turns a binary object–attribute table into a concept lattice; the Duquenne–Guigues basis is its canonical, minimal, complete implication set\[[9](https://arxiv.org/html/2609.01741#bib.bib9)\]\. The basis’s combinatorics are settled\[[12](https://arxiv.org/html/2609.01741#bib.bib12)\]and enumeration is fast in practice\[[10](https://arxiv.org/html/2609.01741#bib.bib10)\]\. This literature assumes a correct context\. We study what happens to the basis when the context is machine\-extracted and measurably noisy\.

#### Noisy and approximate implication bases\.

Approximate bases of exact association rules\[[11](https://arxiv.org/html/2609.01741#bib.bib11)\], approximate computation of exact rules\[[3](https://arxiv.org/html/2609.01741#bib.bib3)\], and confidence\-based redundancy removal\[[2](https://arxiv.org/html/2609.01741#bib.bib2)\]relax the object to gain robustness; the robustness of full\-implication inference has also been analysed directly\[[8](https://arxiv.org/html/2609.01741#bib.bib8)\]\. Ourε\\varepsilon\-tolerant semantics follows Borchmann’s error\-tolerant construction ofℰ​ℒ⊥\\mathcal\{EL\}^\{\\bot\}ontologies\[[5](https://arxiv.org/html/2609.01741#bib.bib5)\]\. These works deliver a new, approximate object\. We keep the exact canonical basis as the artifact and ask which of its members survive a measured perturbation, withε\\varepsilontreated as a declared sensitivity parameter\.

#### Stability and PAC\-style robustness\.

Concept stability ranks concepts by resistance to object deletion\[[1](https://arxiv.org/html/2609.01741#bib.bib1),[7](https://arxiv.org/html/2609.01741#bib.bib7)\]; it uses no noise model and answers a resampling question, not an extraction question\. PAC implication bases carry distributional learning guarantees\[[6](https://arxiv.org/html/2609.01741#bib.bib6)\]\. Our guarantee is per\-implication and frequentist: a Wilson lower bound on survival under the calibrated error process, with set\-level multiplicity handled by Benjamini–Hochberg\[[16](https://arxiv.org/html/2609.01741#bib.bib16),[4](https://arxiv.org/html/2609.01741#bib.bib4)\]\.

#### Interactive error correction\.

The closest line corrects implications over erroneous contexts through expert interaction\[[13](https://arxiv.org/html/2609.01741#bib.bib13)\]and uses canonical implications to flag errors in corrupted rows\[[15](https://arxiv.org/html/2609.01741#bib.bib15)\]\. Both assume a human adjudicator\. We replace adjudication with a measured error model and certify passively; our counterexample carrier points the opposite way from\[[15](https://arxiv.org/html/2609.01741#bib.bib15)\], explaining how a certified implication would break rather than convicting a corrupt row\.

#### Legal and statutory NLP\.

Legal FCA applications are sparse; the closest we could verify applies concept lattices to Brazil’s LGPD without modelling extraction noise\[[14](https://arxiv.org/html/2609.01741#bib.bib14)\]\. Production legal tools operate above the formal layer and compute no implication bases, so there is nothing in that ecosystem to certify against\.

The gap this paper occupies: robustness of exact symbolic implications induced from machine\-extracted legal attributes, under measured extraction disagreement, with an auditable counterexample and provenance layer\.

## Method

Figure[1](https://arxiv.org/html/2609.01741#S3.F1)shows the pipeline end to end\. This section defines each stage; implementation detail that does not affect the scientific argument is deferred to the appendices\.

Statutory corpusRSMo 29,365 sec\.IndiaCode 502 sec\.Extractionreference parserRRindependent parserEEFormal context12 binary attributesoperative text onlyDG canonical basisNextClosure\+ 2 cross\-checksCalibrationper\-attributepfp,pfnp\_\{\\mathrm\{fp\}\},p\_\{\\mathrm\{fn\}\}fromEEvs\.RRPerturbationMethod A \(primary\)N=1000N\{=\}1000trialsCertificateWilson LB≥τ=0\.95\\geq\\tau\{=\}0\.95\+ BH\-FDR companionProvenancespans \+ minimalcounterexampleFigure 1:Pipeline\.The reference context is documentary truth by construction; calibration measures how a second, independently authored parser disagrees with it; certification asks which canonical implications survive that measured disagreement\.### Binary statutory context

A formal context𝕂=\(G,M,I\)\\mathbb\{K\}=\(G,M,I\)has sectionsGGas objects, binary attributesMM, and incidenceI⊆G×MI\\subseteq G\\times M\[[9](https://arxiv.org/html/2609.01741#bib.bib9)\]\. ForX⊆MX\\subseteq Mthe derivationX′=\{g∈G:g𝐼m​∀m∈X\}X^\{\\prime\}=\\\{g\\in G:g\\mathrel\{I\}m\\ \\forall m\\in X\\\}and its dual give the closure operatorX′′X^\{\\prime\\prime\}; an implicationX→YX\\to Yholds in𝕂\\mathbb\{K\}iffY⊆X′′Y\\subseteq X^\{\\prime\\prime\}, i\.e\. every section carrying all ofXXalso carries all ofYY\. The support ofXXissupp⁡\(X\)=\|X′\|\\mathrm\{supp\}\(X\)=\|X^\{\\prime\}\|\.

The schema is frozen at 12 machine\-verifiable attributes over operative text:oblig,prohib,permis,proviso,unless,except,xref,xref\_res,def,numthresh,penalty,deadline\(definitions in Appendix[A](https://arxiv.org/html/2609.01741#A1)\)\. The reference context produced by the reference parser is treated as documentary truth inside the experiment\. Everything we measure is robustness of downstream logic to extraction disagreement, not correctness of the extraction itself\.

### Duquenne–Guigues basis

We compute the DG canonical basis with NextClosure\[[9](https://arxiv.org/html/2609.01741#bib.bib9)\]and cross\-check it against an independent definition\-based pseudo\-intent oracle and theconceptslibrary; the three agree on every real context\. Enumeration is sub\-second and bounded \(max basis 59 over the nine headline contexts, 62 over the 304/458\-chapter sweeps, against a preregistered cap of 10,000\)\. The evaluation target is the set of implications with premise support at leastSmin=1S\_\{\\min\}\{=\}1; zero\-support implications are dropped, and the schema tautologyxref\_res→xref\\textsc\{xref\\\_res\}\\to\\textsc\{xref\}is tagged and reported separately\.

### Calibration: measured inter\-extractor disagreement

The error model is measured, not assumed\. A second parser, written independently of the reference \(token\-adjacency scanning, separately authored vocabulary, negation\-window polarity, digit and spelled\-number recognition, no shared pattern table\), is run over the same sections\. For each attributemmwe record the conditional disagreement ratespfp​\(m\)=Pr⁡\[m∈E⁡\(g\)∣m∉R⁡\(g\)\]p\_\{\\mathrm\{fp\}\}\(m\)=\\Pr\[m\\in E\(g\)\\mid m\\notin R\(g\)\]andpfn​\(m\)=Pr⁡\[m∉E⁡\(g\)∣m∈R⁡\(g\)\]p\_\{\\mathrm\{fn\}\}\(m\)=\\Pr\[m\\notin E\(g\)\\mid m\\in R\(g\)\]\. Table[9](https://arxiv.org/html/2609.01741#A4.T9)\(Appendix[D](https://arxiv.org/html/2609.01741#A4)\) gives the pooled matrix:numthreshdominates false negatives \(pfn=0\.429p\_\{\\mathrm\{fn\}\}\{=\}0\.429\), whileprohib,xref,except,deadlinehave measuredpfn=0p\_\{\\mathrm\{fn\}\}=0\.

This quantity is*inter\-extractor disagreement between two hand\-built parsers*\. It is not externally validated extraction error, and the two parsers share the upstream operative\-text split and schema, so disagreement plausibly understates real error \(§[6\.2](https://arxiv.org/html/2609.01741#S6.SS2)\)\. The certificate is therefore conditional: it bounds survival under the measured disagreement model, nothing more\.

### Perturbation model

Method A \(primary\)\.Independent per\-attribute conditional flips: in each Monte Carlo trial, cell\(g,m\)\(g,m\)is added with probabilitypfp​\(m\)p\_\{\\mathrm\{fp\}\}\(m\)if absent and removed with probabilitypfn​\(m\)p\_\{\\mathrm\{fn\}\}\(m\)if present\. Method A generates genuinely new errors and assumes per\-attribute independence; that assumption is disclosed and stress\-tested, not hidden\.

Method D⋆\(joint\-error diagnostic\)\.A polarity\-conditional joint residual bootstrap: whole observed per\-section error vectors are drawn from the calibration pool and applied cell\-wise only where donor and target reference polarity match, preserving joint co\-error structure under the measured conditional rates\. D⋆exists to test whether Method A’s independence assumption understates damage; it is not a second independent extractor\. Mechanics and the invalid estimator it replaces are documented in Appendix[K](https://arxiv.org/html/2609.01741#A11)\.

### Survival and certification

Given a perturbed context𝕂~\\tilde\{\\mathbb\{K\}\}, implicationX→YX\\to Y*survives non\-vacuously*iff some row still supportsXXand the implication holds on all supported rows \(exact,ε=0\\varepsilon\{=\}0\) or on at least1−ε1\{\-\}\\varepsilonof them \(tolerant, primaryε=0\.05\\varepsilon\{=\}0\.05;[5](https://arxiv.org/html/2609.01741#bib.bib5)\)\. We additionally recordSlogicS\_\{\\mathrm\{logic\}\}, where vacuous retention counts as survival, and decompose non\-survival into*premise collapse*\(noise erases every supporting row\) versus*instantiated violation*\(a supported counterexample appears\)\. The distinction matters operationally: a violation is checkable, because the killing row exists and the certificate names it; a collapse is a support artifact\.

OverN=1000N\{=\}1000trials the survival estimate isp^=\#​survivals/N\\hat\{p\}=\\\#\\text\{survivals\}/N, and an implication is certified iff the one\-sided Wilson 95% lower bound onp^\\hat\{p\}reachesτ=0\.95\\tau\{=\}0\.95\[[16](https://arxiv.org/html/2609.01741#bib.bib16)\]:

LB⁡\(p^,N\)=p^\+z22​N−z​p^​\(1−p^\)N\+z24​N21\+z2N≥τ,\\mathrm\{LB\}\(\\hat\{p\},N\)=\\frac\{\\hat\{p\}\+\\frac\{z^\{2\}\}\{2N\}\-z\\sqrt\{\\frac\{\\hat\{p\}\(1\-\\hat\{p\}\)\}\{N\}\+\\frac\{z^\{2\}\}\{4N^\{2\}\}\}\}\{1\+\\frac\{z^\{2\}\}\{N\}\}\\;\\geq\\;\\tau,\(1\)withz=1\.645z\{=\}1\.645\. The decision rule is budget\-dependent \(the minimum observable survival that certifies falls from 0\.980 atN=200N\{=\}200to 0\.962 atN=1000N\{=\}1000\), soNNis part of the disclosed rule, fixed at 1000 for every reported comparison and varied only in the sensitivity sweep \(Appendix[J](https://arxiv.org/html/2609.01741#A10)\)\. For claims about certified*sets*we add a Benjamini–Hochberg FDR \(q=0\.05q\{=\}0\.05\) certified fraction\[[4](https://arxiv.org/html/2609.01741#bib.bib4)\]\. The second preregistered outcome is the whole\-basis semantic edit distance between reference and trial bases, averaged over trials; it measures basis\-level stability rather than implication\-level survival, and §[6](https://arxiv.org/html/2609.01741#S6)keeps the two quantities separate\.

### Counterexample and provenance carrier

Every evaluated implication carries: premise and consequent text spans; a minimal counterexample, the cheapest perturbation producing a supported violating row; a calibration\-linked likely counterexample, the counterexample whose flipped attributes carry the highest measured disagreement; observed counterexamples from the independent extractor’s own context; and colocated exception markers, recorded as proximity signals only\. The purpose is audit cost: a reviewer can falsify a certified implication against the statute text against the statute text, and a fragile implication fails with a named witness\.

## Experimental Setup

#### Corpora\.

The primary corpus is the Missouri Revised Statutes: 29,365 section entries \(29,350 unique section ids; 15 duplicate files in chapters 1–3, disclosed\) across 458 chapters\. Title membership is recovered from the official Title→\\tochapter structure, verified to reproduce all eight design\-family pairs before use\. The replication corpus is 15 Indian central Acts from IndiaCode, 502 parsed sections, with act\-scoped cross\-reference resolution\.

#### Design and held\-out split\.

The exploratory headline pools 2,555 sections from 8 highlighted chapters spanning 8 Titles; these families were selected during development, so in\-sample numbers are descriptive only\. The*controlling*evaluation is held out: evaluation chapters exclude the 8 design families \(148 evaluated, 146 eligible under the min\-eval filter\), the error model is measured on a disjoint calibration half and transferred to every evaluation chapter, and IndiaCode is a held\-out jurisdiction\. This design is controlling because it is the only configuration that answers the deployment question: does the certificate stay informative on statute families the method was not tuned on, under an error model estimated elsewhere?

#### Scale views\.

Beyond the held\-out design, an anti\-cherry\-pick sweep covers all 304 chapters with at least 30 sections \(26,787 sections\), and a full\-corpus scale run covers all 458 chapters under the primary extractor, including a stability curve over a noise\-scaling grid\.

#### Protocol constants\.

All confirmatory runs share the Monte Carlo budgetN=1000N\{=\}1000and pinned seeds \(headline seed 0; variance study\{0,1,2\}\\\{0,1,2\\\}\)\. Certification usesτ=0\.95\\tau\{=\}0\.95with the Wilson lower bound \(Eq\.[1](https://arxiv.org/html/2609.01741#S3.E1)\) and a BH\-FDR \(q=0\.05q\{=\}0\.05\) companion\. The informative band is\[0\.10,0\.90\]\[0\.10,0\.90\]: below the floor the certificate says nothing useful, above the ceiling it certifies nearly everything and stops discriminating\. The preregistered controlling gate: certified fraction in band on at least 2 held\-out families from at least 2 distinct Titles, each withneval≥10n\_\{\\mathrm\{eval\}\}\\geq 10, basis bounded below 10,000\. A stricter majority\-in\-band criterion from an earlier revision is reported as a post\-hoc prevalence diagnostic only \(Appendix[K](https://arxiv.org/html/2609.01741#A11)\)\.

#### Metrics\.

Per context we report: certified fraction \(Wilson and FDR\) underexactandtolerantsemantics, mean survival, premise\-collapse share, and mean whole\-basis edit distance\. Per implication: survival probability and the provenance payload of §[3\.6](https://arxiv.org/html/2609.01741#S3.SS6)\.

## Results

The results are organized around the scientific questions, not around every experiment performed\. The in\-sample headline table, fullε\\varepsilongrid, per\-attribute confusion, support strata, per\-Act India rows, ablations, and seed variance are in the appendices and regenerate from the released artifact\.

### Support does not predict survival

The motivating contrast of §[1](https://arxiv.org/html/2609.01741#S1)is a real pair of basis members from the pooled Missouri context:

High support, zero survival\{\\\{deadline\}→\{\\\}\\to\\\{numthresh\}\\\}, support 792, survival 0\.000\. Deadlines are nearly always expressed numerically, so the rule looks safe\. Butnumthreshcarries the largest measured false\-negative rate in the schema \(0\.429\): the second extractor misses spelled\-out thresholds nearly half the time, and every miss on one of 792 supporting rows is an instantiated counterexample\. The certificate’s likely\-counterexample pointer namesnumthreshwith its measured rate and cites §115\.004 \(“twenty\-six weeks”\); the minimal counterexample needs a singledeadlineinsertion on §115\.003\.

Low support, certified\{\\\{oblig,proviso,unless,numthresh,penalty,deadline\}→\{\\\}\\to\\\{prohib\}\\\}, support 12, survival 0\.965, above the 0\.962 certification cutoff atN=1000N\{=\}1000\. Heavily conditioned regulatory sections also prohibit\. Its consequent sits onprohib, whose measured false\-negative rate is exactly 0: the measured noise almost never deletes a prohibition, so the implication is structurally hard to kill\. Its cheapest death costs one flip \(addprovisoto §115\.631, whereprohibis already absent\)\.

A support\- or confidence\-based ranker cannot separate these two rules\. The survival certificate separates them, and the separation is explained, not oracular: each outcome points at the attribute and the section responsible\.

### Does the certificate survive on held\-out Missouri?

Yes, at the preregistered bar\. Under the controlling held\-out design, theexactcertificate is informative on10 of 146eligible chapters spanning7 distinct Titles\(IX, XI, XV, XVII, XXXVI, XL, XLI\); thetolerantcertificate on16 of 146across 11 Titles \(Table[1](https://arxiv.org/html/2609.01741#S5.T1)\)\. The controlling gate \(≥2\{\\geq\}2families,≥2\{\\geq\}2Titles,neval≥10n\_\{\\mathrm\{eval\}\}\\geq 10, band\[0\.10,0\.90\]\[0\.10,0\.90\]\) passes on both semantics\.

The same table carries the caution: the meanexactcertified fraction across held\-out chapters is 0\.038 \(chapter\-bootstrap 95% CI \[0\.033, 0\.044\]\), and 93\.2% of chapters fall below the floor \(Wilson 95% \[0\.879, 0\.962\]\)\. The gate passes and the naive deployment mode is weak\. Both are true, and the next subsection explains the weakness\.

Table 1:Held\-out confirmatory results\(commonN=1000N\{=\}1000\)\. Evaluation chapters exclude the 8 design families; the error model is measured on a disjoint calibration half and transferred; India is a held\-out jurisdiction\. One excluded India Act carries a non\-trivial 0\.25 certificate atneval=8n\_\{\\mathrm\{eval\}\}\{=\}8; denominators are shown before the min\-eval filter\.Table 2:Gate table\(commonN=1000N\{=\}1000\)\. “Pooled” is the in\-sample pooled context, descriptive only\. The controlling criterion \(≥2\{\\geq\}2held\-out families from≥2\{\\geq\}2distinct Titles, eachneval≥10n\_\{\\mathrm\{eval\}\}\{\\geq\}10, band\[0\.10,0\.90\]\[0\.10,0\.90\]\) passes onexactandtolerant\. Theshallowrow is an engineered stress fixture that shares code with the reference on 5/12 attributes; it is shown for contrast and never gates\.
### Why does global deployment fail?

The natural first explanation of the 93\.2% below\-floor figure is generalization failure: the method was tuned on the design families and degrades off them\. The preregistered2×22\{\\times\}2factorial \(Table[3](https://arxiv.org/html/2609.01741#S5.T3), Figure[2](https://arxiv.org/html/2609.01741#S5.F2)\) tests this by varying family set \{design, held\-out\} against calibration source \{transferred pooled, local per\-chapter\} at commonNN\.

The verdict is clean\. Moving from transferred to local calibration lifts the mean certified fraction by\+0\.090\+0\.090on held\-out chapters and\+0\.070\+0\.070on design chapters: a large effect, similar in both rows\. Moving from design to held\-out families at a fixed calibration source changes the mean by−0\.031\-0\.031\(transferred\) and−0\.051\-0\.051\(local\): small, and negative, meaning design chapters certify slightly*lower*than held\-out ones once the calibration source is held fixed\. The below\-floor prevalence is therefore a property of the global\-deployment estimand, one pooled error model shipped everywhere, and not a held\-out selection effect\.

The mechanism is chapter\-level heterogeneity of the disagreement process\. Across chapters,numthreshpfnp\_\{\\mathrm\{fn\}\}has mean0\.499±0\.2170\.499\\pm 0\.217,provisopfnp\_\{\\mathrm\{fn\}\}0\.152±0\.2040\.152\\pm 0\.204,obligpfpp\_\{\\mathrm\{fp\}\}0\.138±0\.1530\.138\\pm 0\.153\. A single transferred rate set cannot represent 146 chapters whose error structure varies at that amplitude\.

Table 3:Preregistered2×22\{\\times\}2: selection vs\. calibration\-rate transfer\.Method Aexactmean certified fraction \(in\-band share in parentheses\), min\-eval subset, commonN=1000N\{=\}1000\.Figure 2:The2×22\{\\times\}2as a picture\.Switching the calibration source lifts the mean certified fraction 3–10×\\timeson both family sets; switching the family set at a fixed calibration source changes little, and in the wrong direction for a selection story\.
### Does local calibration help?

Yes, materially\. Under per\-chapter calibration the held\-out mean certified fraction rises from 0\.038 to 0\.128 and the in\-band share from 6\.9% to 52\.7% \(Table[3](https://arxiv.org/html/2609.01741#S5.T3), right column\)\. The 304\-chapter sweep under the primary extractor tells the same story at distribution level:exactmean 0\.134 with 53\.6% of chapters in band, and the full\-corpus scale run puts theexactmean at 0\.212 over all 458 chapters \(0\.168 on the 419\-chapter min\-eval subset, 63\.3% in band; Figure[3](https://arxiv.org/html/2609.01741#S5.F3)\)\. The stability curve decays gracefully with noise scaling: 78\.5% of chapters in band at half the measured rate, 49\.9% at twice it \(Appendix[G](https://arxiv.org/html/2609.01741#A7)\)\.

The 0\.038 of Table[1](https://arxiv.org/html/2609.01741#S5.T1)and the 0\.212 here are different estimands, not a contradiction\. Table[1](https://arxiv.org/html/2609.01741#S5.T1)measures*global deployment*: one error model, estimated on a disjoint calibration half, transferred to chapters the method never saw, which is the configuration a shipped tool would use by default\. Table[3](https://arxiv.org/html/2609.01741#S5.T3)varies exactly one factor of that design, the calibration source, and Figure[3](https://arxiv.org/html/2609.01741#S5.F3)measures the full corpus under the primary extractor’s in\-corpus calibration\. The gap between the two numbers is precisely the price of rate transfer, which is why Table[3](https://arxiv.org/html/2609.01741#S5.T3), not either headline number alone, carries the paper’s second finding\.

The operational consequence is the deployment doctrine: calibrate per chapter or per family, or run tolerant with theε\\varepsilongrid attached, and report survival probability and edit distance next to every certified implication\. A single globally shipped exact error model is the one mode the evidence rules out\.

Figure 3:Scale distribution\.EXACT certified fraction across all 458 Missouri chapters \(independent extractor,N=1000N\{=\}1000\)\. Shaded: the informative band; red line: the 0\.212 mean\.
### Cross\-jurisdiction replication

India fails, and we report it plainly\. The pooled IndiaCode context \(502 sections, basis 60, 57 evaluated\) certifiesexact0\.000 under Method A \(D⋆0\.053\)\. In the held\-out\-jurisdiction design, 6 of 8 Acts pass the min\-eval filter andexactlands in band on0 of 6\(mean 0\.041\)\. Per\-Act values span 0\.0–1\.0, but the top of the range is small\-sample noise: the 1\.0 belongs to a 6\-section Act with 3 evaluated implications \(Appendix[H](https://arxiv.org/html/2609.01741#A8), Figure[4](https://arxiv.org/html/2609.01741#S5.F4)\)\.

A plausible stressor is visible: cross\-references are dense in IndiaCode \(xreffires on 36\.7% of sections; 34\.1% resolve within the same Act\), and the Missouri ablations show the two cross\-reference attributes are load\-bearing for certification \(dropping either sends the pooled certificate to 0\.0; Appendix[J](https://arxiv.org/html/2609.01741#A10)\)\. We did not isolate the cause in India and do not claim one\. What we claim is the fact: the certificate that passes its Missouri gate does not transfer to this jurisdiction under the reported setup\.

Figure 4:IndiaCode, per Act\.EXACT certified fraction \(independent extractor,N=1000N\{=\}1000\)\. Tall bars are small\-sample Acts; the min\-eval\-eligible set lands in band 0/6\.
### Controls: calibration, not noise volume

Three negative controls establish that the certificate responds to measured attribute\-specific error rather than to generic noise \(Table[4](https://arxiv.org/html/2609.01741#S5.T4)\)\. Permuting the measured rates across attributes \(NC1\) collapses and disjoints the certified set \(Jaccard 0\.0 with the calibrated set on POOLED, ch375, ch115\)\. An attribute\-agnostic uniform flip at the matched marginal rate \(NC3\) certifies 0\.0 everywhere calibration yields 0\.017–0\.067: which attribute errs matters, not how much error there is\. Marginal shuffling \(NC2\) shows the real bases \(30/59/52 implications on POOLED/ch375/ch115\) are far smaller than marginal\-matched random contexts \(151/133/125\), so the target sets reflect joint statutory structure\. The independent DG cross\-check agrees with NextClosure on every real context\.

controlquantityPOOLEDch375ch115NC1calibrated cert\. frac\. \(baseline\)0\.0670\.0170\.020shuffled cert\. frac\. \(mean\)0\.0070\.027—Jaccard\(cert\., shuffled\)0\.00\.00\.0NC2real basis size305952marginal\-matched basis \(mean\)151\.1133125NC3matched global flip rate0\.0550\.062—uniform\-flip cert\. frac\.0\.00\.00\.0Table 4:Negative controls\(commonN=1000N\{=\}1000\)\. Dashes mark cells the artifact leaves empty\.

## Discussion and Limitations

### Interpretation

The instrument is usable but fragile, and both halves of that verdict carry numbers\.

Usable, because the certificate identifies a statistically supported core of implications and makes failures auditable\. It passes a preregistered held\-out gate it was allowed to fail, on exact and tolerant semantics, across 7 to 11 distinct Titles\. The controls show the signal is measured calibration rather than noise volume\. The provenance layer turns every certified implication into an auditable object and every fragile implication into a named, checkable death: across the headline contexts, non\-survival is overwhelmingly instantiated violation rather than premise collapse \(Table[5](https://arxiv.org/html/2609.01741#S6.T5)\), so the killing row almost always exists and can be read\.

Table 5:Survival decomposition\(Method A, measured rate\)\.SnvS\_\{\\mathrm\{nv\}\}counts only non\-vacuous survivals;SlogicS\_\{\\mathrm\{logic\}\}counts vacuous retention as survival; the gap is premise collapse \(share of non\-survival\)\.Fragile, on four measured axes\. The calibration is inter\-extractor disagreement, so the certificate is conditional on that disagreement model\. A single global error model misrepresents heterogeneous chapters \(93\.2% below floor under global deployment; §[5\.3](https://arxiv.org/html/2609.01741#S5.SS3)\)\. Cross\-jurisdiction transfer fails on IndiaCode \(0/6; §[5\.5](https://arxiv.org/html/2609.01741#S5.SS5)\)\. And per\-implication survival does not imply basis\-level stability: the mean whole\-basis edit distance at the measured rate is 21\.0 across the 419\-chapter scale run and peaks at 59\.7 on ch407, against a reference basis of 57 implications\. Implication\-level robustness asks whether a given rule survives; basis\-level stability asks whether the basis as a document survives\. The first is what the certificate delivers; the second is what no deployment should assume\.

The tolerant semantics needs the same care\. The lift concentrates where premise support is real \(certified fraction 0\.047→\\to0\.330 at support 20–49; 0\.147→\\to0\.618 at support≥50\\geq 50; nothing below support 20, because a 5% allowance cannot absorb even one violation there\), and atε=0\.20\\varepsilon\{=\}0\.20the pooled context certifies 0\.967, above the informativeness ceiling \(Appendix[C](https://arxiv.org/html/2609.01741#A3)\)\. Enough tolerance trivializes the instrument, soε\\varepsilonstays a declared sensitivity parameter, not a tuned forward path\.

### Limitations

1. 1\.The reference extractor is not validated ground truth\.It is documentary truth by construction inside the experiment\. The certificate bounds survival under parser disagreement; it does not bound the probability that the extraction, or the implication, is legally correct\.
2. 2\.Disagreement may understate real error\.Both extractors are rule\-based and share the upstream operative\-text split, the schema, and some vocabulary;unlessandxref\_resconverge exactly\. Converting measured disagreement into validated extraction error needs a construction\-gold corpus or a third, differently built extractor, neither of which we ran\.
3. 3\.Method A assumes per\-attribute independence\.The D⋆diagnostic, which preserves polarity\-conditioned joint co\-errors, does not certify less \(it matches or beats A in 8 of 9 headline contexts\), but it is a diagnostic, not a second independent extractor\.
4. 4\.Basis algorithm\.We use NextClosure rather than the originally specified LinCbO/In\-Close class; correctness is cross\-checked against a definition\-based oracle and theconceptslibrary on every real context\.
5. 5\.India fails under the reported setup\(0/6 eligible Acts in band\)\. We do not generalize beyond Missouri, and the India failure is a result, not an omission\.
6. 6\.The favourable core is modest\.The gate pass rests on 10 held\-out families under global deployment; the instrument is weak in absolute terms in that mode and should be deployed per\-chapter\-calibrated or tolerant\.
7. 7\.Protocol\.Preregistration is hash\-frozen locally without a third\-party timestamped registry; the in\-sample band analysis is retrospective by construction, which is why the held\-out design carries the verdict\.

The correct reading of the certificate throughout is: a statistical lower bound on implication survival under the calibrated inter\-extractor disagreement model\. Anything stronger is outside the evidence\.

### Deployment protocol

The evidence supports one concrete operating procedure and rules out one other\.

1. 1\.Calibrate per chapter or per family rather than globally\.Run both extractors on the target chapter, estimatepfp/pfnp\_\{\\mathrm\{fp\}\}/p\_\{\\mathrm\{fn\}\}locally, and certify against that model\. The factorial says this is the difference between a 0\.038 and a 0\.128 held\-out mean\.
2. 2\.If local calibration is impossible, run tolerantand attach the fullε\\varepsilongrid, readingε\\varepsilonas a sensitivity axis\. Do not selectε\\varepsilonpost hoc to reach a desired certified fraction\.
3. 3\.Ship the payload with each certified implication: survival probability, Wilson lower bound, minimal counterexample, likely counterexample, and the context’s whole\-basis edit distance\. A certified implication without its counterexample is only half the instrument\.
4. 4\.Treat below\-floor contexts as no\-certificate zones\.Under a transferred global model, most chapters are below the floor; the correct output there is silence plus the diagnostic, not a weak certificate\.
5. 5\.Do not transfer across jurisdictions without recalibration\.The IndiaCode result is the evidence that the certificate’s validity is jurisdiction\-conditional\.

## Conclusion

We set out to learn how much of the symbolic logic extracted from statutes survives the extraction itself\. The measured answer: a small, auditable core survives with a certified lower bound on survival under the measured disagreement model, and the rest dies in checkable ways\. Support does not predict which is which; the attribute footprint of an implication, crossed with the measured error structure of the extractor, does\. The survival certificate we built on that finding passes a preregistered held\-out gate on Missouri and fails cleanly on IndiaCode, and the difference between its weak and strong deployment modes is not the method but the calibration: per chapter, not global\.

The deployment doctrine follows directly\. Calibrate locally or run tolerant with the grid attached; ship every certified implication with its survival probability, edit distance, and minimal counterexample; treat the certificate as a conditional reliability instrument\. The open problems are the ones our scope statements point at: validated extraction error via a construction\-gold corpus or a third extractor, and a cross\-jurisdiction account of why India resists the certificate Missouri admits\.

## References

- \[1\]Babin and Kuznetsov\.Approximating concept stability\.In*Formal Concept Analysis \(ICFCA\)*, Lecture Notes in Computer Science\. Springer, 2012\.doi:10\.1007/978\-3\-642\-29892\-9\_7\.
- \[2\]Balcázar\.Formal and computational properties of the confidence boost of association rules\.*ACM Transactions on Knowledge Discovery from Data*, 2013\.doi:10\.1145/2541268\.2541272\.
- \[3\]Bansal, Kailasam, and Obiedkov\.Approximate computation of exact association rules\.In*Formal Concept Analysis \(ICFCA\)*, Lecture Notes in Computer Science\. Springer, 2021\.doi:10\.1007/978\-3\-030\-77867\-5\_7\.
- \[4\]Benjamini and Hochberg\.Controlling the false discovery rate: A practical and powerful approach to multiple testing\.*Journal of the Royal Statistical Society Series B: Statistical Methodology*, 1995\.doi:10\.1111/j\.2517\-6161\.1995\.tb02031\.x\.
- \[5\]Borchmann\.Towards an error\-tolerant construction ofℰ​ℒ⊥\\mathcal\{EL\}^\{\\bot\}\-ontologies from data using formal concept analysis\.In*Formal Concept Analysis \(ICFCA\)*, Lecture Notes in Computer Science\. Springer, 2013\.doi:10\.1007/978\-3\-642\-38317\-5\_4\.
- \[6\]Borchmann, Hanika, and Obiedkov\.On the usability of probably approximately correct implication bases\.In*Formal Concept Analysis \(ICFCA\)*, Lecture Notes in Computer Science\. Springer, 2017\.doi:10\.1007/978\-3\-319\-59271\-8\_5\.
- \[7\]Buzmakov, Kuznetsov, and Napoli\.Scalable estimates of concept stability\.In*Formal Concept Analysis \(ICFCA\)*, Lecture Notes in Computer Science\. Springer, 2014\.doi:10\.1007/978\-3\-319\-07248\-7\_12\.
- \[8\]Dai, Pei, and Guo\.Robustness analysis of full implication inference method\.*International Journal of Approximate Reasoning*, 2013\.doi:10\.1016/j\.ijar\.2012\.11\.007\.
- \[9\]Ganter and Wille\.*Formal Concept Analysis: Mathematical Foundations*\.Springer, 1999\.doi:10\.1007/978\-3\-642\-59830\-2\.
- \[10\]Janostik, Konecny, and Krajča\.LinCbO: Fast algorithm for computation of the Duquenne–Guigues basis\.*Information Sciences*, 2021\.doi:10\.1016/j\.ins\.2021\.04\.104\.
- \[11\]Kanda, Haraguchi, and Okubo\.Constructing approximate informative basis of association rules\.In*Lecture Notes in Computer Science*\. Springer, 2001\.doi:10\.1007/3\-540\-45650\-3\_15\.
- \[12\]Kuznetsov and Obiedkov\.Some decision and counting problems of the Duquenne–Guigues basis of implications\.*Discrete Applied Mathematics*, 2008\.doi:10\.1016/j\.dam\.2007\.04\.014\.
- \[13\]Kuznetsov and Revenko\.Interactive error correction in implicative theories\.*International Journal of Approximate Reasoning*, 2015\.doi:10\.1016/j\.ijar\.2015\.06\.004\.
- \[14\]Martins, Barros, Monteiro, and Machado\.LGPD: A formal concept analysis and its evaluation\.In*Anais do XXXV Simpósio Brasileiro de Banco de Dados \(SBBD 2020\)*, 2020\.doi:10\.5753/sbbd\.2020\.13651\.
- \[15\]Revenko and Kuznetsov\.Finding errors in new object intents\.In*Proceedings of the Ninth International Conference on Concept Lattices and Their Applications \(CLA 2012\)*, 2012\.OpenAlex:[https://openalex\.org/W2294228335](https://openalex.org/W2294228335)\.
- \[16\]Wilson\.Probable inference, the law of succession, and statistical inference\.*Journal of the American Statistical Association*, 1927\.doi:10\.1080/01621459\.1927\.10502953\.

## Appendix AAttribute schema

Table[6](https://arxiv.org/html/2609.01741#A1.T6)defines the frozen 12\-attribute schema exactly as the reference parser implements it \(code/attributes\.py\)\.

Table 6:The frozen 12\-attribute schema\.All matching is over operative text only;xref\_resis act\-scoped\.
## Appendix BIn\-sample headline

Table[7](https://arxiv.org/html/2609.01741#A2.T7)reports the nine development contexts\. These families were selected during development, so the numbers are descriptive; the controlling verdict is the held\-out design of §[5\.2](https://arxiv.org/html/2609.01741#S5.SS2)\.

Table 7:Headline contexts, in\-sample \(exploratory, descriptive only\)\.Certified fraction==Wilson one\-sided 95% lower bound on survival≥τ=0\.95\{\\geq\}\\,\\tau\{=\}0\.95, commonN=1000N\{=\}1000, independent extractor, seed 0\.Figure 5:Headline contexts\.Certified fraction by estimator and semantics\. The shaded band is the preregistered informative region\.
## Appendix CFullε\\varepsilongrid

Table 8:Fullε\\varepsilongrid, Method A certified fraction, all headline contexts \(commonN=1000N\{=\}1000\)\.Figure 6:Theε\\varepsilongrid as curves\.Tolerance rescues dense, high\-support contexts first; atε=0\.20\\varepsilon\{=\}0\.20POOLED exceeds the 0\.90 informativeness ceiling\.
## Appendix DPer\-attribute confusion matrix

Table 9:Measured per\-attribute confusion\(POOLED, independent extractor vs\. reference\)\. Inter\-extractor disagreement, not validated extraction error\.
## Appendix EPremise\-support strata

Table 10:Premise\-support strata: mean survival and certified fraction,exactvs\.tolerant\(ε=0\.05\\varepsilon\{=\}0\.05\), pooled over headline contexts\.Figure 7:Premise support decides whether tolerance helps\.Below support 20 thetolerantandexactcertificates coincide; above it the lift is large\.
## Appendix FSurvival decomposition

The survival decomposition is reported in the main text \(Table[5](https://arxiv.org/html/2609.01741#S6.T5)\) because it carries the interpretive claim that implication deaths are checkable violations rather than support artifacts\.

## Appendix GStability under noise scaling

Table 11:Aggregate stability curve, all 458 chapters \(independent extractor\): mean certifiedexactfraction vs\. noise scalingλ\\lambda\(λ=1\\lambda\{=\}1is the measured disagreement rate\)\.Figure 8:Stability under noise scaling, four headline contexts\. The dashed line is the 0\.10 informativeness floor\.Figure 9:Basis\-level movement vs\. per\-implication survival, 419 min\-eval chapters\. High certified fraction does not imply a stable basis\.
## Appendix HIndiaCode per\-Act results

Table 12:IndiaCode replication, acts by year–serial identifier\. Act\-scopedxref\_resthroughout\. Small Acts are high\-variance; the held\-out design applies theneval≥10n\_\{\\mathrm\{eval\}\}\\geq 10filter\.
## Appendix IHeld\-out in\-band families

Table[13](https://arxiv.org/html/2609.01741#A9.T13)lists the ten held\-out Missouri chapters that carry the controlling gate underexactsemantics, with their Titles\. These are the families on which the certificate stays informative even under the global\-deployment estimand; the remaining 136 eligible chapters fall below the 0\.10 floor\.

Table 13:The tenexactin\-band held\-out chapters\(commonN=1000N\{=\}1000\), spanning Titles IX, XI, XV, XVII, XXXVI, XL, XLI\.
## Appendix JAblations and sensitivity

Ablationson POOLED: droppingxreforxref\_ressends the certified fraction to 0\.0; droppingnumthreshto 0\.037; droppingoblig\(basis shrinks 30→\\to13\) leaves 0\.077\. Fragility follows the measured per\-attribute error and the schema’s load\-bearing cross\-references\.

Sensitivity\.The certification threshold moves the POOLEDexactfraction throughτ∈\{0\.90,0\.95,0\.99\}→\{0\.133,0\.067,0\.033\}\\tau\\in\\\{0\.90,0\.95,0\.99\\\}\\to\\\{0\.133,0\.067,0\.033\\\}; the budget moves it throughN∈\{200,500,1000\}→\{0\.033,0\.033,0\.067\}N\\in\\\{200,500,1000\\\}\\to\\\{0\.033,0\.033,0\.067\\\}; the support floorSmin∈\{1,3,5,10\}S\_\{\\min\}\\in\\\{1,3,5,10\\\}leaves POOLED unchanged\. AtN=500N\{=\}500the controlling gate also passes \(4exact/ 9tolerantin band\)\.

Seed variance\.Across seeds\{0,1,2\}\\\{0,1,2\\\}the certified\-fraction standard deviation is 0\.000–0\.0157 \(max at POOLED:\{0\.067,0\.033,0\.033\}\\\{0\.067,0\.033,0\.033\\\}\)\. Same\-seed reruns reproduce all survival counts exactly \(run\_variance\.py:all\_identical\_seed\_survival\_counts\)\.

## Appendix KAudit trail and disowned estimators

This appendix records, as reproducibility documentation, the defects an independent red\-team review found in an earlier revision of this pipeline and what the fixes changed\.

A1\. Gate substitution\.The earlier revision evaluated a stricter majority\-in\-band gate in place of the preregistered≥2\{\\geq\}\\,2\-family rule and reported a “confirmatory FAIL” that was arithmetically inconsistent with its own outputs \(4 eligibleexactfamilies in band against a≥2\{\\geq\}\\,2rule\)\. The controlling gate is restored and passes \(10exactfamilies / 7 Titles atN=1000N\{=\}1000; 4exact/ 9tolerantat the reviewer’sN=500N\{=\}500\); the majority rule is reported as a post\-hoc prevalence diagnostic \(fails on both semantics\)\.

A2\. Confounded explanation\.The earlier analysis attributed the held\-out below\-floor prevalence to post\-selection generalization\. The preregistered2×22\{\\times\}2factorial \(§[5\.3](https://arxiv.org/html/2609.01741#S5.SS3)\) separates the factors: rate transfer is the large effect, selection is small and negative\. The causal claim was replaced\.

A3\. Invalid joint\-error estimator\.The earlier Method D drew whole donor error vectors and XOR\-ed them unconditionally, manufacturing false negatives on attributes whose measuredpfnp\_\{\\mathrm\{fn\}\}is exactly 0 \(prohib0\.079,xref0\.047,except0\.032,deadline0\.030 injected\)\. The resulting “joint errors are more destructive” claim isretracted\. The corrected polarity\-conditional D⋆applies donor residuals only where donor and target reference polarity match; under it, D⋆≥\{\\geq\}A in 8 of 9 headline contexts \(equal at ch375/ch407, lower only at POOLED; per\-implication correlation up toρ=0\.97\\rho\{=\}0\.97\), so joint co\-error structure is not more destructive than independent flips\. The disowned estimator is retained in the artifact as a labelled ablation, certifying≈0\{\\approx\}\\,0everywhere\.

Method C\.Section resampling of the fixed observed matrix; it quantifies sampling uncertainty of the observed context and never gates \(headline range 0\.263–0\.600\)\.

Review provenance\.The red team reproduced the pipeline from a fresh copy \(0 SHA\-256 mismatches, byte\-identical headline outputs, zero non\-timing differences across scientific leaves\) before issuing the findings above\.