Identifiability Bridge: Conditional Admissibility Theorems for Property Detection under Non-Reconstructibility within Navigational Cybernetics 2.5

Maksim Barziankou (MxBv)
PETRONUS™ | research@petronus.eu
DOI: 10.17605/OSF.IO/3F6UJ
Axiomatic Core (NC2.5 v2.1): DOI 10.17605/OSF.IO/NHTC5

---

Abstract

The architectural-class works of the present author's corpus — ONTOΣ XI, ONTOΣ XII, IIC v2.1, and the consolidating Why Long-Horizon Existence Requires an Ontology — declare a system of operator-internal architectural primitives (the holding field H(t), the semantic load field Λ(t), the operator-relative chaos predicate χₒₚ(R), the closure-complementarity conditions CC-0 / CC-WE / CC-IIC / CC-D, the IIC coherence mathrm{Coh}(t), and their associated parameters K, μₒₚ, mₒₚ, νₒₚ, cₒₚ, θₛₗₒₚₑ, Δ_H) together with falsification surfaces that probe their conformance at deployment level. The works also declare the non-reconstructibility constraint NR-ε (T87 of NC2.5 v2.1): no external observer can reconstruct the operator-internal state H(t) from emission Yₜ with mutual information exceeding the architecturally declared NR-ε leakage bound.

The combination produces an apparent paradox. If output emission cannot identify internal state, how do the falsification protocols of ONTOΣ XI §8 and ONTOΣ XII §6 work? On what observable signal can a deployment be tested for HF-FIN, HF-MON, χ-REL, or CC-WE / CC-IIC / CC-D conformance, when those conditions are properties of internal-architectural objects that are formally non-reconstructible?

The present work resolves the apparent paradox by introducing the reconstruction-versus-detection distinction: NR-ε bounds — by data-processing inequality — both state reconstruction and any property statistic that is a function of the protected internal trajectory, but it does not annihilate property-channel mutual information when the window-level NR budget ε_T is positive and a Bridge Detectability Premise (BDP)-realising statistic is declared. The work supplies five conditional admissibility theorems establishing that, under the BDP + non-degenerate prior + NR-window + calibration-valid nuisance-adjustment discipline declared here, specific architectural property-violation claims are admissibly testable through declared BDP-realising statistics, with property-channel mutual information bounded below by a substrate-relative margin ι_X(δ) > 0 (supplied by BDP, not derived here) and state-channel leakage bounded above by ε_T (supplied by NR-window). The theorems prove compatibility of property-detection with NR-ε under the declared premises; they do not derive BDP or establish detectability empirically. The theorems are:

1. Holding-Field Property Detection Admissibility (Theorem 1) — sustained HF-FIN, HF-MON, HF-DYN, HF-COH violations are admissibly testable via BDP-realising calibration-valid nuisance-adjusted diversity statistics on Yₜ.
2. Threshold-Straddling Admissibility of the Emission-Derived Chaos Estimator (Theorem 2) — for operators with declared distinct K under threshold-straddling design, the emission-derived estimator hatχₒₚ separates straddling pairs from matched-K controls in nuisance-adjusted paired statistics. The theorem admits the emission-derived chaos-predicate estimator as a bounded-leakage property-channel statistic; it does not directly reconstruct or observe the internal χₒₚ predicate. The internal predicate is accessed only through the pre-registered estimator resolution admitted by BDP.
3. Gauge-Conditional Admissibility of Load-Field Slope Detection (Theorem 3) — given the operator-declared normalisation gauge for cₒₚ, the orientation-following predicate is admissibly detectable within each declared gauge stratum, conditional on BDP and the gauge-stratum NR-window.
4. Cross-Component Closure-Complementarity Detection Admissibility (Theorem 4) — CC-WE / CC-IIC / CC-D violations are admissibly testable through BDP-realising cross-component emission statistics (correlations mathrm{Cov}(Yᵢ, Yⱼ) exceeding baseline by an architecturally specifiable margin) under the test-design discipline TD-1..TD-5.
5. Vector-Protocol Suite Detectability (Theorem 5) — across the five property-class components covered by Theorems 1–4 + IIC v2.1's mathrm{Coh}(t) (holding-field HF, chaos-predicate χ, load-field Λ-CHARGE specifically — Λ-ACC owed to companion work, Λ-NONRETRIEVE handled via HF-DYN coextension per §1.2, closure-complementarity CC, and IIC coherence Coh), the vector of property predicates remains componentwise detectable across the heterogeneous test designs of T1–T4 + IIC v2.1's coherence falsification surface (protocol suite, not single joint vector) under joint or conditional-sequential leakage discipline. KAC-BASE and FR-COH enter as theorem-premise properties of Theorem 3 (per §1.2), not as separately-tested components in Theorem 5's vector. Any-violation (disjunctive) testing requires a separate direct BDP for the disjunctive predicate; it is not derivable from componentwise detectability alone.

The work also specifies a calibration-valid nuisance-adjustment discipline (per §2.4 / §4.7; scalar-additive discount being one admissible operator class) for the four standard interface confounds (decoder temperature, sampling policy, retrieval augmentation, prompt entropy) and a falsification surface for the identifiability claims themselves. No new architectural axiom is introduced; the work assembles the existing NC2.5 v2.1 / IIC v2.1 / ONTOΣ XI–XII apparatus into a formal bridge that formalises the admissibility conditions for operationalising the falsification protocols of those works.

The contribution is the assembly. The present work supplies the formal admissibility schema for operationalising the falsification surfaces of the corpus — the conditions under which property-detection is compatible with NR-ε given declared premises — with the reconstruction-versus-detection distinction as the load-bearing structural insight. Substantive operationalisation (substrate-specific quantitative bounds, registered protocols, executed falsifiers) is owed in companion work and is not completed here.

---

0. Position and Scope

The present work sits at the operationalisation layer of the architectural-class corpus. ONTOΣ XI specifies the operator-internal apparatus; ONTOΣ XII specifies the closure operation that constitutes the operator-as-self; IIC v2.1 specifies the cycle by which the operator's coherence is maintained across time; the consolidating essay specifies why the entire stack is required for long-horizon existence. Each of those works declares falsification surfaces — protocols whose execution would refute deployment subclass membership at the architectural level. None of them, however, supplies the bridge from observable output statistics to the architectural property-violations the protocols probe.

The bridge is owed because the architectural primitives are operator-internal and bound by the NR-ε non-reconstructibility constraint. ONTOΣ XI §11 (Continuing Programme) and Why Long-Horizon Existence Requires an Ontology §7 explicitly name the identifiability bridge as a separate technical task, awaiting a dedicated paper. The present work is that paper.

The position is conditional in the same sense as the architectural-class works it supports. The identifiability theorems are not claimed as predictive empirical theorems about specific systems; they are classification theorems in the architectural-class tradition, unfolding the consequences of NR-ε plus the calibration-valid nuisance-adjustment discipline (§2.4 / §4.7) on the admissibility of output-side property detection. Their empirical content is mediated through deployment-level instantiations (specific architectures) and class-level non-vacuousness (that at least one architecture in some substrate admits the detection protocols of the theorems). The conditional structure is deliberate; the work is presented as the formal bridge, not as the deployment-side test suite.

The scope is also narrowed. The present work addresses identifiability of property-violations on operator-internal architectural objects, given bounded-leakage emission Yₜ and declared confound profile. It does not address:

• Full state reconstruction (forbidden by NR-ε; explicitly out of scope).
• Identifiability under unbounded leakage (where NR-ε is suspended; a different problem class).
• Substrate-specific empirical instrumentation (deployment-side concern).
• Causal-inference identifiability (related but distinct: causal identifiability concerns intervention effects on observables; the present work concerns property-detection on operator-internal trajectories given passive observation under NR-ε).

The work also makes no claim about identifiability outside the operator-internal-extended subclass declared by ONTOΣ XI. Architectures that decline the operator-internal-extended commitments are outside the scope of the theorems; their observability profile is governed by whatever architectural commitments they do declare.

What the work does provide is the formal bridge that formalises the admissibility conditions for operationalising the falsification protocols of ONTOΣ XI §8 and ONTOΣ XII §6 within the architectural-class register: a precise statement of what can be tested observationally without violating NR-ε, what nuisance-adjustment discipline confounds require (per §2.4 / §4.7), and what falsifies the identifiability claims themselves.

A note on the term "theorem" in this work. The results labelled Theorems 1–5 are structural classification theorems in the architectural-class sense (cf. ONTOΣ XI §0, IIC v2.1 §2.5): they unfold the consequences of declared primitives and the existing NC2.5 v2.1 / ONTOΣ XI–XII / IIC v2.1 apparatus under the reconstruction-versus-detection distinction. They are definitional consequences in the strict formal sense, not free-standing empirical theorems, and their empirical content is in the falsification surface (§5). This is the form appropriate to architectural-class theorems, not a deficiency of the work.

0.1 Notation Summary

The work uses primitives from NC2.5 v2.1, ONTOΣ XI, ONTOΣ XII, and IIC v2.1, together with new notation for the identifiability bridge.

The notation is intended to remain compatible with upstream usage; where overload is possible, typographic and contextual distinctions resolve the meaning. The symbol S carries four distinct readings disambiguated by context: S(t) — spin component (IIC v2.1 §2.3 upstream usage); S(·) or S_X — emission-stream statistic (the present work's usage); S standalone — the closure-output system (ONTOΣ XII §3.2 upstream usage); S_X^* — nuisance-adjusted statistic (this work). Context is sufficient to disambiguate in every body occurrence. Where the work writes "property-detection" it means specifically: testing whether a predicate mathcal{P}X on the operator-internal trajectory holds, using a statistic S^*(Y(0:T)) on the emission stream, under the NR-window condition ε_T (§1.6) and the nuisance-adjustment discipline of §2.4.

0.2 Note on Theorem Status

The identifiability results of §3 (Theorems 1–5) are conditional structural theorems: each derives admissible property detection from explicitly declared architectural premises (Bridge Detectability Premise of §1.6; NR-window condition εT of §1.6; pre-registered test ensemble mathcal{E} of §1.6; calibration-valid nuisance adjustment A(mathcal{C)} of §2.4 and §4.7). The Bridge does not derive these premises from corpus primitives in the present work — their derivation, in particular substrate-specific instantiations of BDP with quantitative ι_X(δ) functions (or their JS / regularised-KL equivalents), is owed in substrate-specific companion papers per §7 Continuing Programme.

Each Theorem statement below begins with an explicit Assume: preamble listing the premises the theorem is conditional on; the proof body shows how the admissible detection chain follows given those premises, not how the premises are themselves obtained. The results are labelled theorems in the architectural-class sense: each states a conditional implication from explicitly declared premises to admissible bounded-leakage property detection. The substantive detectability claim resides in BDP; the theorems prove compatibility with NR-ε and admissibility of the detection chain, not the existence of the detecting statistic. They are not empirical identifiability theorems and do not derive BDP. Future substrate-specific companion work supplies corollaries and quantitative refinements; the theorem-level result is established here, conditional on the stated premises.

Terminology note. The §3 header calls these "Conditional Admissibility Theorems" to emphasise that BDP supplies substantive detectability and the theorems prove compatibility; the paper title "Identifiability Bridge" and Abstract / §4 / §8 sometimes use the shorter "identifiability theorems" — both phrasings refer to the same five theorems, used interchangeably after this Note.

BDP as subclass-admission premise, not core axiom. The Bridge Detectability Premise is not introduced as a new core axiom of NC2.5, ONTOΣ XI/XII, or IIC v2.1; it is a subclass-admission premise for the identifiability bridge — the condition under which a deployment enters the identifiability subclass that the present work's theorems apply to. The upstream axiomatic apparatus (NC2.5 v2.1, ONTOΣ XI–XII, IIC v2.1) is unchanged.

Conditional non-emptiness. The present work states the non-emptiness condition for the identifiability subclass; it does not independently establish substrate-level non-emptiness. The condition: if at least one architectural substrate realises BDP + NR-window + calibration-valid nuisance adjustment (and, for every Case-A theorem T1/T3/T4/T5, the fixed-ΘᵈᵉᶜˡX ensemble premise and the joint-satisfiability compatibility premise ι_Xᵃᵈʲ(δ, ρₘₐₓ) ≤ ε_T^X of §1.6; for Theorem 2, the relevant joint-pair NR-window; for Theorem 3, the gauge-stratum NR-window; for Theorem 4, TD-1..TD-5 + the closure-system NR-window of premise (ii); for Theorem 5, the composition-discipline NR-window per (ii.a) or (ii.b) with the CC-specific extension under Separate-declaration, including — when joint-vector state-leakage claims on H(S,0:T) are made — the joint-vector NR-window declaration ε_T^(CC,joint) of T5 (ii) and the joint-vector compatibility constraint of T5 (vii)), then the identifiability subclass is non-empty and the Theorems' detection chains apply. Direct substrate-level existence demonstrations — concrete architectures together with quantitative ι_X(δ) functions or their JS / regularised-KL equivalents — are owed in substrate-specific companion work per §7 Continuing Programme.

0.3 Boundary of the Present Claim

The present work uses several conditional commitments deliberately rather than implicitly. The boundary of what is claimed:

• BDP is a subclass-admission premise, not a derivation from the upstream axioms. The Bridge Detectability Premise is the explicit condition under which a deployment enters the identifiability subclass that Theorems 1–5 apply to. It is not derived from NC2.5 v2.1 / ONTOΣ XI–XII / IIC v2.1 primitives in this work; substrate-specific derivations are owed in companion papers (§7).
• Non-emptiness is conditional until substrate-specific BDP + NR-window + calibration-validity demonstrations are supplied. This work establishes admissibility given these premises, not their joint instantiation in any specific architecture. The identifiability subclass may remain empty until a concrete substrate satisfies all four premises simultaneously.
• Calibration validity includes an MI/JS-preservation admission requirement (§4.7). This is therefore part of the bridge premise — not an independently universal statistical guarantee. The admitted operator class is restricted to those A_(mathcal{C)} whose calibration validity preserves the BDP direct MI / JS-separation lower bound; this is itself a detectability premise stacked on the BDP premise, disclosed honestly rather than packaged as a corollary of nuisance control.
• The privileged audit channel is specified structurally here; its substrate-specific operational realisation is owed. §5.1 and §6.2 define the channel's role, scope boundary, and procedural non-collapsibility discipline; F-Ident-1 and F-Ident-4 falsifier executions are conditional on substrate-specific audit-channel realisation (per §6.2 Dependency note).
• Procedural admissibility filters define the domain of the theorem. Procedurally-unevaluable deployments are excluded before property-detection runs (§3.4.1), not counted as null detections. This is a design choice that bounds the theorem's operational coverage at the admissibility frontier rather than at the property-channel layer.
• Theorem 5 is vector-componentwise. Logical-combination detection, including any-violation (disjunctive) testing, requires a separate direct BDP for the combined predicate. T5 does not derive composite detectability as a corollary of componentwise detectability.

These commitments bound the present work's claims; positioning critiques of the conditional structure belong to the architectural-class register itself, not to the present work's internal logic.

---

1. The Identifiability Problem

1.1 The Reconstruction-versus-Detection Distinction

The architectural-class corpus declares two structural commitments that are, on their face, in tension. The first is that operator-internal architectural objects (H, Λ, χₒₚ, the closure-complementarity conditions, the IIC coherence) are real structural quantities whose conformance to declared properties is the empirical content of subclass membership. The second is the non-reconstructibility constraint NR-ε (T87 of NC2.5 v2.1, restated in ONTOΣ XI §2.3 as HF-NR): no external observer can reconstruct the operator-internal state H(t) from emission Yₜ with mutual information exceeding the declared NR-ε leakage bound.

If Yₜ does not carry information about H(t) beyond NR-ε, how is H(t)'s conformance to HF-FIN, HF-MON, HF-DYN tested? The protocols of ONTOΣ XI §8.1 specify that violations are observable in emission distribution, but if NR-ε is in force, output statistics carry only NR-ε bits of information about internal state. The apparent paradox: the falsification surface seems to require what NR-ε forbids.

The resolution lies in a distinction that the corpus has implicitly assumed but not yet stated formally: NR-ε constrains both state reconstruction and any property statistic that is a function of the protected internal trajectory (by the data-processing inequality: if mathcal{P} = f(H), then I(mathcal{P}; Y) ≤ I(H; Y) ≤ ε at the per-step level, and analogously I(mathcal{P}(0:T); Y(0:T)) ≤ ε_T at the window level after the NR-window condition of §1.6). It does not, however, force property-channel mutual information to vanish when ε (or ε_T) > 0. The bridge concerns positive-but-bounded property information under explicitly declared premises:

0 < I(mathbf{1}[mathcal{P}_X]; S_X^*) ≤ I(H_(0:T); S_X^*) ≤ ε_T

under the Bridge Detectability Premise + non-degenerate prior + NR-window condition stated in §1.6 below.

The two questions — state reconstruction and property-violation detection — are formally distinct. State reconstruction asks: can Yₜ be inverted to recover H(t) as a structural object, with all its internal topology and content? Property-violation detection asks: given a predicate mathcal{P} over the trajectory of H(·) (e.g., "does |H(t)| exceed K(τᵣₑₘ) on a sustained interval?"), does Yₜ carry information about whether mathcal{P} holds?

The two questions can have very different quantitative answers under NR-ε while sharing the same upper bound. State reconstruction is a question about I(H(t); Yₜ), the mutual information between a state object and the observation. Property-violation detection is a question about I(mathcal{P}; Yₜ), the mutual information between a single-bit predicate and the observation. The latter is bounded above by the former (data-processing inequality) and may be non-trivially positive under the bridge's premises of §1.6 — but it cannot exceed the NR-ε leakage budget.

This is the structural insight that the present work makes load-bearing. NR-ε is a bound on I(H; Y) that propagates by DPI to any property statistic S(Y); it does not force I(mathcal{P}; Y) = 0 when ε > 0. The bridge supplies the premises (§1.6) under which I(mathcal{P}; Y) is positive-but-ε_T-bounded over a pre-registered window [0, T], specifies which mathcal{P} are detectable, and bounds the detection precision in a way that respects NR-ε on the underlying state while being positive about the property.

1.2 The Architectural Targets

The property-violation classes whose admissible detection the present work addresses are:

Holding-field properties (from ONTOΣ XI §2.3):

• HF-FIN-violation: |H(t)| > K(τᵣₑₘ) by margin δ on a sustained interval.
• HF-MON-violation: the holding-capacity K(τᵣₑₘ) trajectory fails the declared monotone-non-increasing tolerance band under sustained Φ accumulation (a property of H_(0:T) given declared K, Φ, τᵣₑₘ). Emission signature: emission-diversity proxy fails the same band. (Deviations within the declared band are not detection events; only excursions beyond the band are.)
• HF-DYN-violation: the holding-field operates in retrieve-then-apply mode rather than dynamic-reshape (a property of H_(0:T) given the declared dynamic-reshape commitment). Emission signature: emission decomposable into retrieve-from-fixed-store followed by application.
• HF-COH-violation: H(t) fragmenting into disconnected components beyond the declared coherence-diameter band.

Load-field properties (from ONTOΣ XI §3.3):

• Λ-ACC-violation: zero accumulation rate under sustained interaction.
• Λ-CHARGE-violation: attention output indistinguishable from random shaping over Λ.
• Λ-NONRETRIEVE-violation: the operator's action apparatus operates in retrieve-then-apply mode (a property of operator-internal behaviour given the declared apparatus). Emission signature: behaviour decomposable into retrieve-then-apply.

Note on Λ-ACC and Λ-NONRETRIEVE theorem coverage. Among the load-field properties, only Λ-CHARGE has a dedicated theorem (Theorem 3, gauge-conditional). Λ-NONRETRIEVE is definitionally co-extensive with HF-DYN on emission semantics (both: "behaviour / emission decomposable into retrieve-then-apply"), and its detection-admissibility derives via T1 by treating Λ-NONRETRIEVE as a mathcal{P}_(HF)-coextensive predicate sharing T1's BDP, NR-window, and calibration premises — no separate BDP declaration is required only for the emission-decomposability fragment, and only provided the deployment pre-registers Λ-NONRETRIEVE and HF-DYN as coextensive predicates for that specific test. Operator-internal Λ-accumulation aspects of Λ-NONRETRIEVE remain outside T1 and are owed to companion work. Λ-ACC currently has no dedicated theorem in this work; its detection-admissibility is owed to a substrate-specific companion paper per §7 Continuing Programme.

Chaos-predicate properties (from ONTOΣ XI §4.3, §4.5):

• χ-REL-violation under threshold-straddling: for two operators with declaredly distinct K in a threshold-straddling paired design, the emission-derived chaos-predicate estimator hatχₒₚ fails to distinguish the straddling pair from matched-K controls under the paired design (the internal χₒₚ is not directly observed; identifiability is asserted at the level of hatχₒₚ on calibration-valid nuisance-adjusted pair-difference statistics).

Closure-complementarity conditions (from ONTOΣ XII §3.2, §6):

• CC-0-violation: closure(U, R, A) does not return an operator-internal-extended-conformant system. (CC-0-violation is structurally caught at the procedural-admissibility layer per §3.4.1 — closure failing to return a conformant system makes the deployment procedurally unevaluable, not a property-channel detection target; T4's detection scope is therefore X ∈ {WE, IIC, D} only.)
• CC-WE-violation: components carry jointly inadmissible Will Embeddings.
• CC-IIC-violation: IIC cycles fail to compose into a stable system-cycle.
• CC-D-violation: component drifts isolated from the system's load field.

Theorem-premise properties:

• KAC-BASE-violation: in unperturbed regime, attention does not follow the dominant admissible slope of Λ over H(t).
• FR-COH-violation: substrate phase misalignment does not manifest as Λ-slope perturbation at the operator layer.

IIC coherence properties (from IIC v2.1 §2.3, §2.4):

• mathrm{Coh}(t)-trajectory properties: closure of mathrm{Coh}(t) to zero or below; closure of Δ_(boldsymbol{varpi)}.

The work's identifiability theorems address detectability of these property-violations from calibration-valid nuisance-adjusted output statistics under the NR-window + BDP discipline of §1.6.

1.3 Observable Channels

The emission stream Yₜ is whatever the deployment substrate emits as observable: token sequences for language-model substrates, motor-command streams for control substrates, behavioural time-series for perceptual substrates, response distributions for decision substrates. The work treats Yₜ as a generic emission channel without committing to specific substrate semantics; substrate-specific identifiability theorems would specialise the apparatus to the channel's structure.

The statistic S(·) on Yₜ is any function from the emission stream to a summary quantity. The work distinguishes three families of admissible statistics in §2.

1.4 The Confound Class

Output statistics are confounded by interface effects that may produce signals indistinguishable from property-violations unless explicitly discounted. The confound class mathcal{C} comprises:

mathcal{C}₁ — Decoder-temperature confound. For substrates that emit through a temperature-parameterised decoder (the standard token-emission setting in language model substrates), the temperature τ_(dec) controls emission diversity. High temperature produces high diversity even when internal state is concentrated; low temperature produces low diversity even when internal state is dispersed.

mathcal{C}₂ — Sampling-policy confound. Beam search, top-k sampling, nucleus sampling, and similar policies systematically distort the relation between internal-state distribution and observed emission distribution. Top-k sampling truncates rare emissions; nucleus sampling adapts the truncation threshold dynamically.

mathcal{C}₃ — Retrieval-augmentation confound. Architectures that include retrieval components inject external content into the emission stream, producing emission that does not reflect internal-state structure but external retrieval results.

mathcal{C}₄ — Prompt-entropy confound. Prompts with high lexical or syntactic entropy produce high output entropy regardless of internal-state structure. The confound is particularly severe when comparing emission entropy across deployments with different prompt distributions.

These four confounds are the architectural minimum that any identifiability protocol must discount. Substrate-specific confounds (e.g., motor-noise in control substrates, sensory bandwidth in perceptual substrates) are deployment-side concerns and not addressed at the architectural-class register.

1.5 The NR-ε Constraint, Formally

T87 of NC2.5 v2.1 declares the leakage bound:

I(H(t); Yₜ) ≤ ε

where I is mutual information evaluated under the operator's declared probability structure on Sₒₚ × mathcal{Y} (with mathcal{Y} the emission space). The bound ε is part of the operator's architectural declaration; for the identifiability apparatus to be operational, ε must be fixed prior to deployment evaluation under the pre-registration discipline of ONTOΣ XI §10.

The constraint is a per-step bound on state-channel mutual information. It bounds — by data-processing inequality [Cover and Thomas 2006, §2.8] — mutual information between any predicate-on-H statistic and Yₜ at the same level ε. For multi-step evaluation windows the per-step bound does not by itself yield a tight window-level bound; the window-level NR condition ε_T is stated in §1.6 below.

---

1.6 The Bridge Detectability Premise (BDP)

The identifiability bridge concerns property detection as a bounded-leakage phenomenon, not as an NR-violation-free channel. The premises below formalise the bridge's claims under three commitments: (i) an ensemble over which property indicators acquire stochastic structure; (ii) a window-level NR bound; (iii) a nuisance-adjusted emission statistic with substrate-relative separation margin.

Test ensemble mathcal{E}. All property-channel mutual-information claims in this work are evaluated over a pre-registered test ensemble mathcal{E}: a paired sampling frame combining (a) a target population of candidate deployments under test (some of which substantively violate the protected property) and (b) a baseline population of known-conformant deployments, together with N ≥ declared-threshold independent replications under TD-5-equivalent instantiation discipline (§3.4). The protected property indicator mathbf{1}[mathcal{P}_X] is a random variable over mathcal{E}. A fixed-deployment / single-instance evaluation frame yields constant mathbf{1}[mathcal{P}_X] and trivially zero mutual information; the ensemble construction is what makes the MI claims of §3 well-defined.

Non-degenerate prior condition. The ensemble mathcal{E} must supply a pre-registered prior πX = P(mathcal{E)}[mathbf{1}[mathcal{P}X] = 1] ∈ (πₘᵢₙ, 1 - πₘᵢₙ) on the violation indicator, with πₘᵢₙ > 0 declared at pre-registration. This is the mixing-ratio condition — the two-population sampling frame mixes violating and conformant deployments with neither population vanishing in the limit. Sparse-violation scenarios (π_X → 0) and saturated-violation scenarios (π_X → 1) drive mutual information to zero independently of any conditional-distribution separation, by prior-degeneracy of I(X; Y) = E_X[D(KL)(P(Y|X) \,|\, P(Y))]. Without the non-degenerate prior condition, BDP's direct MI lower bound cannot hold even when the conditional-distribution separation is large. The prior condition is the ensemble-level commitment that complements BDP-(iii)'s conditional-distribution commitment.

NR-window condition. For the evaluation window [0, T] of the test ensemble:

I(Hᵖʳᵒᵗ_(0:T); Y_(0:T)) ≤ ε_T

where Hᵖʳᵒᵗ(0:T) is the declared protected trajectory (per §0.1: Hᵖʳᵒᵗ(0:T) = H_(0:T) for HF/Λ/Coh predicates; Hᵖʳᵒᵗ(0:T) = H(S,0:T) for CC predicates per §3.4), and εT is either (a) declared directly by the deployment's architectural specification as a window-level NR bound, or (b) derived from conditional sequential leakage declarations I(Hᵖʳᵒᵗ(0:T); Yₜ | Y_(0:t-1)) ≤ εₜ, in which case ε_T ≤ sumₜ₌₁^(T) εₜ (see NR-window composition below for the formal condition). Marginal per-step bounds — of the form I(Hₜ; Yₜ) ≤ εₜ, which is the T87 per-step statement of §1.5 — do not in general compose to a window-level bound. The window-level bound is the operational quantity for the identifiability theorems of §3.

For HF/Λ/Coh predicates the NR-window form coincides with the operator-level I(H_(0:T); Y_(0:T)) ≤ εT. For CC predicates (Theorem 4), the form is I(H(S,0:T); Y_(0:T)) ≤ εT — declared either directly at pre-registration as the closure-output-system NR-window (the Separate-declaration case of §3.5's Preliminary), or inherited from the operator-level NR-window via DPI under the closure-subsumption commitment that H(S,0:T) is a function of H_(0:T) through mathrm{closure}(U, R, A) → S (per ONTOΣ XII §3.2 — the Subsumption case of §3.5's Preliminary). The closure-subsumption commitment is part of the deployment's pre-registration declaration; deployments declining it occupy the Separate-declaration case and must supply the closure-output-system NR-window directly.

Bridge Detectability Premise (BDP). For each protected property class X — i.e., each detection target on the operator-internal architectural objects: HF-violation, Λ-violation, χ-violation, CC-violation (X ∈ {WE, IIC, D}), and Coh-violation (the five components of Theorem 5's vector predicate) — there exists a pre-registered emission statistic S_X and a nuisance-adjustment operator A_(mathcal{C)} (per §2.4 below) such that the adjusted statistic

S_X^* = A_(mathcal{C)}(Y_(0:T); η_(mathcal{C)})

satisfies a direct property-channel mutual-information lower bound over the ensemble mathcal{E} with non-degenerate prior π_X ∈ (πₘᵢₙ, 1 - πₘᵢₙ):

I(mathbf{1}[mathcal{P}_X]; S_X^*) ≥ ι_X(δ) > 0, ∀ δ > δₘᵢₙ,

where ι_X(δ) is the substrate-relative property-channel MI separation margin — a positive, substrate-specific function that grows with the violation margin δ.

Equivalent formulation via Jensen–Shannon separation. For a binary property indicator mathbf{1}[mathcal{P}_X], the MI lower bound is exactly the π_X-weighted Jensen–Shannon divergence (under the same log base and prior weighting):

I(mathbf{1}[mathcal{P}_X]; S_X^*) = J_(π_X)big(P(S_X^* | mathbf{1}[mathcal{P}_X] = 1),\; P(S_X^* | mathbf{1}[mathcal{P}_X] = 0)big) ≥ ι_X(δ) > 0,

where J_(π) denotes the π-weighted Jensen–Shannon divergence [Lin 1991]. This is a standard identity (not "equivalence up to constants") for binary indicators under any joint distribution. JS is bounded above by both prior-weighted conditional KL terms and below by total variation squared, supplying a stable bidirectional bound.

Status of one-sided KL. A weaker, asymmetric formulation

D_(KL)big(P(S_X^* | mathbf{1}[mathcal{P}_X] = 1) \;\|\; P(S_X^* | mathbf{1}[mathcal{P}_X] = 0)big) ≥ κ_X(δ) > 0

may be used only under declared regularity conditions — bounded likelihood ratios, common-support, anti-spike (no rare events with diverging Radon–Nikodym derivative), or a substrate-specific reverse-Pinsker condition (cf. [Csiszár and Shields 2004]) — that bridge the one-sided KL bound to a JS / MI lower bound. Without such regularity, one-sided KL can be large via rare-event spikes while binary-mixture MI / JS remains arbitrarily small. The Bridge's theorems below depend on the direct MI form ι_X(δ) > 0 above; deployments may declare BDP via one-sided KL only when the required regularity conditions are pre-registered alongside.

Where the bound is taken. The MI is evaluated over the joint distribution on the two-population × replication ensemble of TD-5. The two-population sampling frame supplies mathbf{1}[mathcal{P}_X] as a non-degenerate random variable across deployments; the replication ensemble supplies sampling variation in S_X^* for each deployment. ι_X(δ) is the property-channel separation margin survived under the joint ensemble (i.e., after marginalising over within-deployment replications).

Note on ensemble vs replication. BDP's direct MI lower bound ι_X(δ) is taken over the joint two-population × replication ensemble. The replication ensemble supplies within-deployment sampling variation in S_X^* for each deployment; the two-population frame supplies between-deployment variation in mathbf{1}[mathcal{P}_X]. If within-deployment replication variance is large relative to between-population mean separation, the joint-frame MI is suppressed by within-deployment dispersion. The deployment's pre-registration must declare a substrate-specific replication-noise tolerance: the threshold N in TD-5's "N ≥ declared-threshold independent replications" must be large enough that between-population separation is detectable above within-deployment replication noise. This is the operational counterpart to BDP's ι_X(δ): BDP commits to existence of the separation; the replication-noise tolerance commits to its detectability under finite-sample sampling.

Augmented protected evaluation object. For Case-A predicates, the expression mathbf{1}[mathcal{P}X] = f_X(Hᵖʳᵒᵗ(0:T)) is to be read in the pre-registered augmented sense:

mathbf{1}[mathcal{P}_X] = f_X\!left(Hᵖʳᵒᵗ_(0:T);\, Θᵈᵉᶜˡ_Xright),

where ΘᵈᵉᶜˡX is the fixed declared structural context required to evaluate the predicate: holding-capacity law K(τᵣₑₘ), structural burden Φ, budget trajectory τᵣₑₘ, declared thresholds (e.g., δₘᵢₙ, θₛₗₒₚₑ), gauge G, closure map, action-selection apparatus, component attribution map, and other predicate-specific architectural declarations. The composite augmented protected evaluation object is denoted Z^X(0:T) := (Hᵖʳᵒᵗ_(0:T), Θᵈᵉᶜˡ_X).

When Θᵈᵉᶜˡ_X is fixed by pre-registration (and therefore not a random variable over the ensemble mathcal{E}), the Case-A DPI chain is evaluated conditionally on Θᵈᵉᶜˡ_X — the MI claims of BDP and the chain inequalities below are conditional on the pre-registered architectural context. When Θᵈᵉᶜˡ_X varies over the ensemble and itself carries property information, the predicate is not pure Case-A; it must be treated as Case-B (design-metadata predicate) or as a mixed conditional-design predicate with its own declared leakage and detection discipline (per the Case-B form below).

Admissible detection chain — two cases by predicate type. A property class X is ε_T-admissibly detectable under BDP + non-degenerate prior + NR-window + nuisance-adjustment, with the form of the admissibility chain depending on the predicate type:

Case A — Internal-trajectory predicates. If mathbf{1}[mathcal{P}X] = f_X(Hᵖʳᵒᵗ(0:T); ΘᵈᵉᶜˡX) is a function of the augmented protected evaluation object — where Hᵖʳᵒᵗ(0:T) = H_(0:T) (the operator's holding-field trajectory) for HF-, Λ-, and Coh-violation predicates, and Hᵖʳᵒᵗ(0:T) = H(S,0:T) (the closure-output system's holding-field trajectory) for CC-violation predicates per §3.4, with ΘᵈᵉᶜˡX the predicate-specific declared structural context (fixed at pre-registration). The enumeration: HF-violation predicates (with Θᵈᵉᶜˡ(HF) ⊃eq {K(τᵣₑₘ), Φ, δₘᵢₙ}); Λ-violation predicates at the operator level — including the orientation-following predicate event of Theorem 3 (with Θᵈᵉᶜˡₛₗₒₚₑ ⊃eq {cₒₚ, θₛₗₒₚₑ, G, action-selection apparatus}); CC-violation predicates evaluated at H_(S,0:T) (with Θᵈᵉᶜˡ(CC) ⊃eq {U, R, A, mathrm{closure}, component attribution map}, per ONTOΣ XII §3.2's mathrm{closure}(U, R, A) → S construction); Coh-violation predicates (with Θᵈᵉᶜˡ(Coh) per IIC v2.1's coherence apparatus). Note: an operator-level χ_op predicate would also be Case-A by this criterion, but no theorem in the present work directly tests an operator-level χ predicate — Theorem 2 instead tests χ-REL via the Case-B threshold-straddling design-metadata route below. The generic Case-A chain (conditional on Θᵈᵉᶜˡ_X):

0 < I\!left(mathbf{1}[mathcal{P}_X]; S_X^* \,big|\, Θᵈᵉᶜˡ_Xright) ≤ I\!left(Hᵖʳᵒᵗ_(0:T); S_X^* \,big|\, Θᵈᵉᶜˡ_Xright) ≤ I\!left(Hᵖʳᵒᵗ_(0:T); Y_(0:T) \,big|\, Θᵈᵉᶜˡ_Xright) ≤ ε_T^X,

with Hᵖʳᵒᵗ(0:T) instantiated per the predicate's declared protected trajectory and ε_T^X the corresponding NR-window bound. (When Θᵈᵉᶜˡ_X is genuinely fixed across the ensemble, the conditional MI's collapse to unconditional form — the conditioning on a constant is vacuous; the explicit conditioning is preserved for analytical clarity at the seam between Case-A and Case-B.)
The left inequality follows from BDP's direct MI lower bound (now stated conditionally on Θᵈᵉᶜˡ_X): I(mathbf{1}[mathcal{P}_X]; S_X^* | Θᵈᵉᶜˡ_X) ≥ ι_X(δ) > 0. The middle inequality is data-processing applied to mathbf{1}[mathcal{P}_X] = f_X(Hᵖʳᵒᵗ(0:T); ΘᵈᵉᶜˡX) as a function of Hᵖʳᵒᵗ(0:T) given ΘᵈᵉᶜˡX, and S_X^* as a function of Y(0:T). The right inequality is the NR-window condition (conditioning on the fixed Θᵈᵉᶜˡ_X does not increase MI relative to the marginal NR-window).

Case B — Design-metadata predicates. If mathbf{1}[mathcal{P}_X] is exogenous design metadata (e.g., the "straddling" indicator of Theorem 2, declared at deployment-pair specification time as a function of (K₁, K₂) — not a function of internal trajectory), or audit metadata (declared at the privileged audit channel per §5.1):

(property channel)\ I(mathbf{1}[mathcal{P}_X]; S_X^*) ≥ ι_X(δ) > 0,

(state leakage, separately)\ I(H_(0:T); S_X^*) ≤ I(H_(0:T); Y_(0:T)) ≤ ε_T.

The property-channel detection bound and state-leakage bound are independent constraints on different objects — design/audit metadata is not a function of H, so no DPI chain through H links the two. Theorem 2 is the canonical Case-B instance.

NR-window composition (when ε_T is derived from per-step bounds). The window-level bound ε_T may be declared directly by the deployment, or derived by composition from per-step conditional declarations:

I(H_(0:T); Yₜ | Y_(0:t-1)) ≤ εₜ ⇒ I(H_(0:T); Y_(0:T)) ≤ sumₜ₌₁^(T) εₜ.

The composition is valid under the conditional declaration; marginal per-step bounds of the form I(Hₜ; Yₜ) ≤ εₜ (single-step, marginal-over-history) do not in general compose to a window-level bound. T87's per-step statement in §1.5 is the marginal form; deployments that derive ε_T by composition must declare the conditional-sequential bounds, not the marginal ones, at pre-registration.

Joint satisfiability of BDP and NR-window. For every Case-A internal-trajectory predicate, the BDP lower bound and the NR-window upper bound must be jointly satisfiable. Thus the post-calibration property-channel margin must obey

0 < ι_Xᵃᵈʲ(δ, ρₘₐₓ) ≤ ε_T^X,

where εT^X is the NR-window budget for the corresponding protected trajectory (operator-level ε_T for HF/Λ/Coh predicates; gauge-stratum ε_T(g) for Theorem 3; closure-system ε_T on H(S,0:T) for CC predicates per §3.4). If ε_T^X < ι_Xᵃᵈʲ(δ, ρₘₐₓ), the deployment's declarations are premise-incompatible and the deployment falls outside the Bridge's admissibility frame for that predicate. This is not a failed detection result; it is a failure of joint premise satisfiability declared at pre-registration. Premise-incompatibility is detectable from the deployment's declarations alone, independent of any empirical evaluation.

Status of BDP. BDP is not derived from corpus primitives in the present work — it is the explicit bridge premise the theorems of §3 are conditional on. Substrate-specific derivations of BDP from architectural primitives, with quantitative ι_X(δ) functions (or their JS / regularised-KL equivalents), are owed in substrate-specific companion papers. The Bridge's theorems are accordingly conditional structural theorems (see §0.2 Note on theorem status) rather than free-standing empirical results.

---

2. Admissible Statistics

2.1 Definition

A statistic S(Y_(0:T)) is admissible under BDP + NR-window for property mathcal{P}_X, evaluated over the pre-registered test ensemble mathcal{E} of §1.6, if it satisfies two conditions:

(Adm-1) Property informativeness over mathcal{E}: I(mathbf{1}[mathcal{P}X]; S(Y(0:T))) > 0, with the mutual information evaluated under mathcal{E}'s joint distribution over (a) the two-population sampling frame (violating-vs-conformant deployments) and (b) the replication ensemble. Per BDP's direct MI lower bound of §1.6, this positivity is supplied by ι_X(δ) > 0 (equivalently, the π_X-weighted JS-divergence separation) whenever the violation margin δ exceeds δₘᵢₙ.

(Adm-2) Window-level state-leakage bound: I(H_(0:T); S(Y_(0:T))) ≤ εT — the statistic does not leak the trajectory state beyond the declared window-level NR bound of §1.6. By data-processing inequality, since S(Y(0:T)) is a function of Y_(0:T), this follows from the NR-window condition I(H_(0:T); Y_(0:T)) ≤ ε_T.

Together, Adm-1 and Adm-2 instantiate the admissible detection chain of §1.6, with the form of the chain determined by the predicate type:

Case-A — internal-trajectory predicates (e.g., HF-FIN/HF-MON/HF-DYN with Hᵖʳᵒᵗ(0:T) = H(0:T); Λ-CHARGE slope with Hᵖʳᵒᵗ(0:T) = H(0:T); CC closure conditions with Hᵖʳᵒᵗ(0:T) = H(S,0:T) per §3.4; Coh-violation with Hᵖʳᵒᵗ(0:T) = H(0:T)): mathbf{1}[mathcal{P}X] = f(Hᵖʳᵒᵗ(0:T)) (under §1.6's augmented evaluation object with ΘᵈᵉᶜˡX fixed across mathcal{E}, this reduces to f_X(Hᵖʳᵒᵗ(0:T)) as a deterministic function of Hᵖʳᵒᵗ(0:T) alone — conditioning on the constant Θᵈᵉᶜˡ_X is vacuous), and Adm-1 + Adm-2 chain through the declared protected trajectory via two distinct DPI applications: (a) the predicate-to-state DPI along the Markov chain mathbf{1}[mathcal{P}_X] → Hᵖʳᵒᵗ(0:T) → S(Y_(0:T)) (since mathbf{1}[mathcal{P}X] is a deterministic function of Hᵖʳᵒᵗ(0:T), conditioning on Hᵖʳᵒᵗ(0:T) renders it independent of S, establishing the Markov property), giving I(mathbf{1}[mathcal{P}_X]; S(Y(0:T))) ≤ I(Hᵖʳᵒᵗ(0:T); S(Y(0:T))); and (b) the state-to-emission DPI along Hᵖʳᵒᵗ(0:T) → Y(0:T) → S(Y_(0:T)), giving I(Hᵖʳᵒᵗ(0:T); S(Y(0:T))) ≤ I(Hᵖʳᵒᵗ(0:T); Y(0:T)). Chaining with (Adm-1) lower bound and (Adm-2) state-leakage upper bound:

0 < I(mathbf{1}[mathcal{P}_X]; S(Y_(0:T))) ≤ I(Hᵖʳᵒᵗ_(0:T); S(Y_(0:T))) ≤ I(Hᵖʳᵒᵗ_(0:T); Y_(0:T)) ≤ ε_T.

Case-B — design-metadata / exogenous-structural predicates (e.g., threshold-straddling design label distinguishing two deployments by declared K per Theorem 2; audit-metadata predicates per §5.1 referring to design-time architectural declarations): mathbf{1}[mathcal{P}X] is not a function of H(0:T), and the two conditions are separate constraints — Adm-1 supplies the property-channel lower bound from BDP, Adm-2 supplies the state-leakage upper bound from the NR-window — without a DPI chain linking them through H:

I(mathbf{1}[mathcal{P}_X]; S(Y_(0:T))) ≥ ι_X(δ) > 0, I(H_(0:T); S(Y_(0:T))) ≤ ε_T.

Note on Theorem 3 gauge. The gauge G in Theorem 3 is not a Case-B protected predicate but a conditioning stratum: the protected predicate event mathcal{P}ₛₗₒₚₑⁱⁿᵗ is an internal-trajectory orientation-following event (Case-A; the indicator mathbf{1}[mathcal{P}ₛₗₒₚₑⁱⁿᵗ] is the corresponding random variable) evaluated within each declared gauge stratum under a stratum-level NR-window ε_T(g).

The Case-A versus Case-B distinction is determined at pre-registration by the predicate type: a predicate that the deployment's architectural specification declares as a function of internal trajectory is Case-A; a predicate that the deployment's specification declares as exogenous design metadata is Case-B. The two cases are simultaneously satisfiable for properties mathcal{P}_X whose statistic admits substrate-relative direct MI / JS-divergence separation under BDP without saturating the window-level NR-budget. The architectural commitment of the operator-internal-extended subclass is that NR-ε bounds reconstruction of H as a structural object (the held set itself, in the sense of HF-NR per ONTOΣ XI §2.3) and bounds — by DPI — any statistic that is a function of the protected trajectory; what BDP supplies is the premise under which a class of pre-registered, nuisance-adjusted statistics retains positive property-channel MI within that bound, irrespective of whether the predicate is Case-A or Case-B.

2.2 Three Families of Admissible Statistics

The work distinguishes three families.

Diversity statistics. Functions of the spread of the emission distribution over time. Examples: Shannon entropy of token emission, distinct-types-per-window count, output rank distribution, ε-typicality measures. Diversity statistics inform about properties of the form "is the held region wide enough to support this output spread?" — that is, properties of |H| trajectory and (indirectly, under controlled confounds) of K(τᵣₑₘ).

Variance and trajectory statistics. Functions of the trajectory of emissions over time. Examples: sample variance of emission features, autocorrelation, jerk statistics, trajectory deviation. Variance statistics inform about properties of the form "does the held region maintain bounded variation under the operator's declared band?" — that is, HF-MON-related properties.

Correlational statistics. Functions of relations between emission components or between emissions across time. Examples: cross-token correlation, cross-component covariance for multi-component substrates, conditional emission distributions given declared context. Correlational statistics are particularly relevant to closure-complementarity property detection (Theorem 4) because CC-WE / CC-IIC / CC-D violations are most visible in the relations between component emissions, not in any single component's emission distribution.

The three families are not exhaustive, but they cover the architectural targets of §1.2. A specific deployment's identifiability protocol selects statistics from these families according to which property-violations are being tested.

2.3 How Confounds Enter

The four confound channels of §1.4 enter the statistics as follows.

Decoder-temperature confound. Diversity statistics scale monotonically with τ(dec): high temperature inflates emission entropy independently of internal-state spread. Variance statistics scale with τ(dec)² (approximately). Correlational statistics are weakly affected at low orders but distorted at high orders. The confound's signature: a deployment with high τ_(dec) produces high diversity even when |H| is concentrated, threatening false-positive HF-FIN-violation detection.

Sampling-policy confound. Sampling policies truncate or distort the emission distribution relative to the internal-state distribution. Top-k sampling concentrates emission on the top-k probability tokens, reducing observed diversity below internal-state diversity. Nucleus sampling adapts dynamically, producing emission whose diversity tracks a dynamic subset rather than the full internal distribution. The confound's signature: low observed diversity does not necessarily imply low |H|.

Retrieval-augmentation confound. Retrieval injects external content into the emission. If retrieval is active, observed emission diversity reflects retrieval-source structure rather than internal-state structure. The confound is severe enough that, without explicit discount, retrieval-augmented deployments produce emission statistics that bear almost no relation to operator-internal architecture.

Prompt-entropy confound. High-entropy prompts produce high-entropy outputs regardless of internal architecture. The confound is most severe when comparing across deployments with different prompt distributions; intra-deployment temporal comparisons within a fixed prompt distribution are less affected.

2.4 The Nuisance-Adjustment Procedure

For each confound profile mathcal{C}, a nuisance-adjustment operator A_(mathcal{C)} is declared as part of the operator's architectural specification. The adjusted statistic is:

S^*(Y_(0:T)) = A_(mathcal{C)}(Y_(0:T); η_(mathcal{C)})

where η(mathcal{C)} is the pre-registered nuisance parameter set and A(mathcal{C)} is drawn from a class admitting at least the following forms (substrate-dependent):

• Scalar additive subtraction. For separable additive confounds where each φᵢ(mathcal{C}ᵢ) is well-defined as a scalar correction: S^* = S(Y_(0:T)) - sumᵢ φᵢ(mathcal{C}ᵢ). This is the canonical special case of A_(mathcal{C)}.
• Residualisation. Regress S(Y_(0:T)) on confound covariates and retain residuals.
• Conditional expectation. S^* = S(Y_(0:T)) - E[S(Y_(0:T)) | mathcal{C}], evaluated under pre-registered nuisance model.
• Matched-baseline differencing. S^* = S(Y_(0:T)) - S(baseline_(π)(mathcal{C})) for matched-confound reference deployments per TD-1.
• Nuisance-model marginalisation. Marginalise out mathcal{C} under declared joint distribution.
• Likelihood-ratio adjustment. Compare emission likelihoods under violation-class and conformance-class nuisance models.
• Substrate-specific operator. Domain-specific (e.g., temperature normalisation for language-model substrates, noise-injection variance for control substrates, external-stimulus-bandwidth correction for perceptual substrates).

The architectural commitment is that confounds must be declared and adjusted before property-detection, not that the specific operator form is universal. Heterogeneous statistic types — entropy, covariance, likelihood-ratio, spectral phase metric, model-comparison score — admit different operator forms; the scalar-subtraction formula is a single point in this class.

Boltzmann form as substrate-specific toy placeholder, not general law. For language-model substrates under temperature-parameterised Boltzmann decoders, a substrate-specific Boltzmann-family correction may involve the partition function Z(τ(dec)), temperature-dependent energy-expectation terms, and derivative-of-log-partition contributions; the present work does not fix a universal closed form for φ₁, and the log τ(dec) + log Z(τ(dec)) formula appearing below in §4.1 is a schematic placeholder for the toy low-noise regime, not an exact calibration for diversity statistics in general. The deployment must declare the substrate-specific concrete form at pre-registration. This is a deployment-side instantiation, not the general form of A(mathcal{C)}.

The pre-registration discipline of ONTOΣ XI §10 applies: A_(mathcal{C)}, η_(mathcal{C)}, and the substrate-specific operator class must be declared prior to deployment evaluation. Post-hoc adjustment of nuisance parameters to fit observed statistics falsifies subclass membership by construction.

---

3. Conditional Admissibility Theorems (under BDP, NR-window, and Ensemble Discipline)

The five theorems of this section are conditional admissibility theorems (per §0.2 Note on Theorem Status): each establishes that, given the explicitly declared architectural premises (BDP supplying the substantive detectability claim, NR-window supplying the state-leakage upper bound, ensemble discipline supplying the probability frame), the property-detection chain is admissible — compatible with NR-ε and bounded as the §1.6 chain prescribes. The theorems do not derive BDP, do not establish existence of the detecting statistic, and do not assert empirical identifiability of any specific substrate. They establish compatibility and admissibility, not detectability. Where prior versions of this work absorbed implicit emission-separation commitments inside proof bodies, the present version lifts each such commitment to the BDP premise of §1.6 and cites it explicitly in each theorem's Assume: preamble.

3.1 Theorem 1 — Holding-Field Property Detection Admissibility (under BDP for HF properties)

Theorem 1 (HF Property-Detection Admissibility under BDP). Assume:

(i) the pre-registered test ensemble mathcal{E} of §1.6, with the non-degenerate prior condition π(HF) = P(mathcal{E)}[mathbf{1}[mathcal{P}(HF)] = 1] ∈ (πₘᵢₙ, 1 - πₘᵢₙ) on the violation indicator;
(ii) the NR-window condition I(H(0:T); Y_(0:T)) ≤ εT of §1.6;
(iii) the Bridge Detectability Premise (BDP) for the holding-field property class — i.e., for each HF-property predicate mathcal{P}(HF) ∈ {HF-FIN, HF-MON, HF-DYN, HF-COH} (each a function of the protected trajectory H(·) — i.e., Case-A internal-trajectory predicate per §1.6), there exists a pre-registered emission statistic S_(HF) and a nuisance-adjustment operator A_(mathcal{C)} (§2.4) such that the adjusted statistic S_(HF)^* = A_(mathcal{C)}(Y_(0:T); η(mathcal{C)}) satisfies the direct property-channel MI lower bound of §1.6: I(mathbf{1}[mathcal{P}(HF)]; S_(HF)^) ≥ ι(HF)(δ) > 0 for all violation margins δ > δₘᵢₙ (equivalently, the π(HF)-weighted JS-divergence separation; one-sided KL form admissible only with declared regularity conditions per §1.6);
(iv) calibration-valid nuisance adjustment per §4.7 (mathrm{Err}(calib) ≤ ρₘₐₓ), where the operator class of §2.4 is restricted to those A(mathcal{C)} for which the calibration-validity bound preserves the BDP direct-MI / JS-separation lower bound ι(HF)(δ) (the operator-class-specific MI/JS-preservation condition is part of the deployment's pre-registration declaration, §4.7);
(v) the declared structural context Θᵈᵉᶜˡ(HF) ⊃eq {K(τᵣₑₘ), Φ, δₘᵢₙ} is **fixed across the ensemble* mathcal{E} at pre-registration (per §1.6 augmented evaluation object); deployments with varying Θᵈᵉᶜˡ(HF) fall outside Theorem 1's frame and are handled per §1.6's Case-B fallback;
(vi) the joint-satisfiability compatibility premise ι(HF)ᵃᵈʲ(δ, ρₘₐₓ) ≤ ε_T (per §1.6 joint-satisfiability discipline); premise-incompatible deployments are filtered at pre-registration before Theorem 1 application.

Then the holding-field property predicate mathcal{P}_(HF) is ε_T-admissibly detectable in the sense of §1.6:

0 < I(mathbf{1}[mathcal{P}_(HF)]; S_(HF)^*) ≤ I(H_(0:T); S_(HF)^*) ≤ ε_T.

The lower bound is supplied directly by BDP-(iii)'s direct property-channel MI lower bound ι(HF)(δ) > 0, taken over the joint two-population × replication ensemble (§1.6). The upper bound is supplied by NR-window-(ii) plus the data-processing inequality applied to mathbf{1}[mathcal{P}(HF)] = f_(HF)(H_(0:T)) and S_(HF)^* = A_(mathcal{C)}(Y_(0:T); ·) — i.e., the Case-A internal-trajectory chain of §1.6 applies because HF-property predicates are functions of the protected H(·) trajectory. The lower bound depends on the violation margin δ (larger violations are more detectable per ι(HF)'s monotonicity) and on the calibration residual ρₘₐₓ (per §4.7's MI/JS-preservation: calibration-valid operators preserve ι(HF) up to declared bound; calibration-invalid operators may destroy it).

Proof (Conditional Derivation).

Step 1 (Lower bound from BDP). By assumption (iii), BDP supplies the direct property-channel MI lower bound of §1.6: I(mathbf{1}[mathcal{P}(HF)]; S(HF)^*) ≥ ι(HF)(δ) > 0 for all δ > δₘᵢₙ, evaluated over the joint two-population × replication ensemble. No KL→MI conversion is required — BDP commits to the property-channel mutual information directly (equivalently, to the π(HF)-weighted Jensen–Shannon separation J_(π{HF)}(·s) ≥ ι(HF)(δ)). If the deployment declares BDP via the one-sided KL route of §1.6, the regularity conditions there must first establish the equivalent direct-MI / JS lower bound; absent those regularity conditions, one-sided KL is not admissible.

Step 2 (Predicate-to-state DPI — middle inequality of the chain). By §1.6's augmented evaluation object, mathbf{1}[mathcal{P}(HF)] = f(HF)(H_(0:T); Θᵈᵉᶜˡ(HF)); under premise (v) (Θᵈᵉᶜˡ(HF) fixed across mathcal{E}), this reduces to mathbf{1}[mathcal{P}(HF)] = f(HF)(H_(0:T)) as a deterministic function of H_(0:T) alone. The variables therefore form a Markov chain mathbf{1}[mathcal{P}(HF)] → H(0:T) → S_(HF)^* (conditioning on H_(0:T) makes mathbf{1}[mathcal{P}(HF)] deterministic, hence conditionally independent of S(HF)^* given H_(0:T)). By the data-processing inequality applied along this Markov chain:

I(mathbf{1}[mathcal{P}_(HF)]; S_(HF)^*) ≤ I(H_(0:T); S_(HF)^*).

This is the predicate-to-state DPI step (middle inequality of the admissible detection chain), distinct from the state-to-emission DPI step of Step 3 below.

Step 3 (State-to-emission DPI through A_(mathcal{C)}). The statistic S_(HF)^* is by construction a function of Y_(0:T) (with nuisance parameter η(mathcal{C)} that depends only on declared confound profile mathcal{C}, not on internal trajectory H(0:T)). By the data-processing inequality applied to the Markov chain H_(0:T) → Y_(0:T) → S_(HF)^*:

I(H_(0:T); S_(HF)^*) ≤ I(H_(0:T); Y_(0:T)).

Step 4 (NR-window). By assumption (ii), I(H_(0:T); Y_(0:T)) ≤ ε_T.

Step 5 (Calibration validity). By assumption (iv), A_(mathcal{C)} adjusts for confounds without removing property-channel information beyond the registered tolerance ρₘₐₓ. The direct MI lower bound of (iii) is evaluated on S_(HF)^* — i.e., post-adjustment — so calibration validity (per §4.7's MI/JS-preservation commitment) preserves the lower bound of Step 1.

Conclusion. Chaining Steps 1–5: 0 < I(mathbf{1}[mathcal{P}(HF)]; S(HF)^) ≤ I(H_(0:T); S_(HF)^) ≤ I(H_(0:T); Y_(0:T)) ≤ ε_T. This is the admissible detection chain of §1.6 for property class HF, with each of the three conceptual groupings established by a distinct step or step-pair: Step 1 + 5 establish leftmost positivity; Step 2 establishes the middle predicate-to-state DPI inequality; Step 3 + 4 jointly establish the state-leakage upper bound (state-to-emission DPI composed with the NR-window). square

Remark on ι_(HF)(δ). The substrate-relative direct MI / JS-separation margin ι(HF)(δ) is named in BDP (iii) as architecturally specifiable rather than analytically derived in closed form. Its specific functional form is substrate-dependent (token-emission for language models, motor-emission for control, etc.). The Bridge commits only to existence of ι(HF) with ι(HF)(δ) > 0 for δ > δₘᵢₙ; substrate-specific derivations of ι(HF) are owed in companion papers per §7 Continuing Programme. Where empirical execution of an F-HF protocol fails to detect a violation despite δ > δₘᵢₙ, the failure either (a) refutes the deployment's claim that the violation occurred, (b) refutes BDP for that property class on that substrate, or (c) refutes calibration validity per §4.7 — all of which are deployment-level falsification events under the pre-registration discipline.

Remark on HF-MON wording. Theorem 1 covers HF-MON violations under the specific condition that the emission's diversity trajectory fails to satisfy the declared monotone-non-increasing tolerance band — not the looser "stable or expanding diversity" reading, which can occur within the declared band under noise. The strict slope condition is part of the deployment's pre-registration declaration; deviations below the band are detection events, deviations within the band are not.

3.2 Theorem 2 — Threshold-Straddling Admissibility of the Emission-Derived Chaos Estimator (under BDP for χ-REL)

Theorem 2 (Threshold-Straddling Admissibility of the Emission-Derived Chaos Estimator; χ-REL Admissibility under Paired-Ensemble Design). Assume:

(i) the pre-registered test ensemble mathcal{E} of §1.6, specialised to a paired sampling frame over deployment pairs (Σ₁, Σ₂): a mixture of (a) straddling pairs with declared distinct K₁, K₂ such that one pair-member satisfies mathrm{complexity}ₒₚ(R) > Kᵢ(τᵣₑₘ) while the other does not, and (b) matched-K pairs with K₁ = K₂ (control population), with μₒₚ and Λ held fixed across each pair and mathrm{slope}ₒₚ(Λ over R) < θₛₗₒₚₑ for both pair-members; the non-degenerate prior π(TS) = P(mathcal{E)}[mathbf{1}[straddling] = 1] ∈ (πₘᵢₙ, 1 - πₘᵢₙ) on the straddling indicator (declared at pre-registration; "straddling" is exogenous deployment-pair metadata determined by the declared (K₁, K₂) configuration, not a function of internal trajectory);
(ii) a joint pair NR-window condition I(H_(1,0:T) oplus H_(2,0:T); Y_(1,0:T) oplus Y_(2,0:T)) ≤ εTᵖᵃⁱʳ. (Note: per-deployment NR-window bounds I(H(i,0:T); Y_(i,0:T)) ≤ εT do not in general compose to ε_Tᵖᵃⁱʳ = 2ε_T — pair-channel coupling can produce joint leakage exceeding the sum. The composition ε_Tᵖᵃⁱʳ = ε_T^((1)) + ε_T^((2)) is admissible only under a declared pair-independence assumption on the joint emission channel; otherwise ε_Tᵖᵃⁱʳ must be declared directly at deployment-pair pre-registration.)
(iii) the Bridge Detectability Premise for χ-REL (Case-B design-metadata predicate per §1.6, since "straddling" is exogenous deployment-pair design metadata determined by declared (K₁, K₂), not a function of internal trajectory) — i.e., there exists a pre-registered chaos-predicate estimator hatχₒₚ^((i)) = gχ(S_(TS)^((i))) derived from a nuisance-adjusted threshold-straddling statistic S_(TS)^((i)) = A_(mathcal{C)}(Y_(i,0:T); η(mathcal{C)}), such that the pair-difference statistic has direct MI lower bound under the paired ensemble: I(mathbf{1}[straddling]; hatχ^((1)) - hatχ^((2))) ≥ ιχ > 0;
(iv) calibration-valid nuisance adjustment per §4.7 (operator-class-specific MI/JS-preservation per the deployment's pre-registration).

Then the emission-derived χ-REL estimator pair-difference is admissible as a bounded-leakage property-channel statistic for the threshold-straddling design (the internal χₒₚ predicate is not identified directly — see Note on observability of χₒₚ below), with the Case-B (design-metadata predicate) two-constraint form of §1.6:

Property-channel detection (direct MI lower bound): By BDP-(iii),

I(mathbf{1}[straddling]; hatχ^((1)) - hatχ^((2))) ≥ ι_χ > 0.

State-leakage bound (separate constraint via joint pair NR-window): By DPI applied to hatχ^((1)) - hatχ^((2)) as a function of Y_(1,0:T) oplus Y_(2,0:T), and by joint pair NR-window-(ii),

I(H_(1,0:T) oplus H_(2,0:T); hatχ^((1)) - hatχ^((2))) ≤ I(H_(1,0:T) oplus H_(2,0:T); Y_(1,0:T) oplus Y_(2,0:T)) ≤ ε_Tᵖᵃⁱʳ.

The two bounds are separate constraints on different objects — "straddling" is exogenous design metadata, H₁ oplus H₂ is joint internal trajectory; no DPI chain links them. Under pair-independence, ε_Tᵖᵃⁱʳ = 2ε_T; otherwise ε_Tᵖᵃⁱʳ is declared directly.

Note on observability of χₒₚ. The internal chaos predicate χₒₚ(R) of ONTOΣ XI §4.3 is, by HF-NR, not directly observed in emission. Theorem 2 operates on a pre-registered estimator hatχₒₚ derived from a property-channel statistic on Yₜ — the estimator is a function of emission, not a direct readout of internal state. χ-REL identifiability is identifiability of the estimator's pair-difference, conditional on the threshold-straddling design.

Proof (Conditional Derivation). Under the paired ensemble of (i), mathbf{1}[straddling] is a non-degenerate random variable over mathcal{E} with prior π(TS) ∈ (πₘᵢₙ, 1 - πₘᵢₙ) by construction. By BDP-(iii)'s direct MI form: I(mathbf{1}[straddling]; hatχ^((1)) - hatχ^((2))) ≥ ιχ > 0. Separately, by DPI applied to the pair-difference as a function of Y_(1,0:T) oplus Y_(2,0:T), and by the joint pair NR-window-(ii): I(H_(1,0:T) oplus H_(2,0:T); hatχ^((1)) - hatχ^((2))) ≤ εTᵖᵃⁱʳ. The two bounds are independent constraints on different objects (mathbf{1}[straddling] is design-metadata; H(1,0:T) oplus H_(2,0:T) is internal trajectory); no chaining is claimed between them. square

Remark. Theorem 2 is the formal bridge for the F-χ falsifier protocol of ONTOΣ XI §4.5, specifying that the emission-derived χ-REL estimator pair-difference is admissible as a bounded-leakage property-channel statistic under the threshold-straddling design. The protocol is meaningful as a falsifier precisely because the theorem establishes that the observable pair-difference, if non-null beyond calibration-residual baseline, supports the pre-registered χ-REL estimator contrast under the threshold-straddling design — it does not identify the internal χₒₚ relational structure directly (see Note on observability of χₒₚ above).

3.3 Theorem 3 — Gauge-Conditional Admissibility of Load-Field Slope Detection (under BDP for Λ-CHARGE + KAC-BASE)

Theorem 3 (Gauge-Conditional Orientation-Bias Detection under BDP). Assume:

(i) the pre-registered test ensemble mathcal{E} of §1.6, with the stratum-conditional non-degenerate prior condition πₛₗₒₚₑ(g) = P_(mathcal{E)}[mathbf{1}[mathcal{P}ₛₗₒₚₑⁱⁿᵗ] = 1 | G = g] ∈ (πₘᵢₙ, 1 - πₘᵢₙ) within each declared gauge stratum g (not merely the marginal non-degeneracy: a stratum containing only violators or only conformants would drive the stratum-conditional MI to zero regardless of BDP's ιₛₗₒₚₑ(δ, g) commitment);
(ii) the gauge-stratum NR-window condition I(H_(0:T); Y_(0:T) | G = g) ≤ εT(g) within each declared gauge stratum g (declared at pre-registration). The action-selection apparatus is treated as a fixed pre-registered architectural mechanism (component of Θᵈᵉᶜˡₛₗₒₚₑ, per premise (vi) below), not as a separate protected trajectory; orientation-following is therefore a function of H(0:T) given the fixed apparatus — keeping NR-window's scope to the operator's holding-field trajectory without extension. Protected-trace completeness clause (domain-exclusion). Theorem 3 applies only when the deployment declares the orientation-following predicate to be well-defined as a function of Zˢˡᵒᵖᵉ(0:T) = (H(0:T), Θᵈᵉᶜˡₛₗₒₚₑ). If action-selection depends on additional protected internal variables not included in H_(0:T) or fixed Θᵈᵉᶜˡₛₗₒₚₑ — including (but not limited to) policy state, regime-switching memory, random-seed traces, or any further internal trace beyond the holding-field — the deployment must enlarge the protected trajectory to H^(prot,slope)(0:T) to include those variables and declare the corresponding wider gauge-stratum NR-window. Otherwise the deployment falls outside Theorem 3's Case-A frame and must be handled per §1.6's mixed / Case-B fallback. Note: conditioning on a covariate can increase MI in general; the stratum-conditional bound must be declared directly per gauge, not derived from the unconditional bound;
(iii) the Bridge Detectability Premise for Λ-CHARGE + KAC-BASE — i.e., a pre-registered orientation-following statistic Sₛₗₒₚₑ and nuisance-adjustment operator A(mathcal{C)} such that Sₛₗₒₚₑ^* = A_(mathcal{C)}(Y_(0:T); η_(mathcal{C)}, gauge) achieves direct MI lower bound I(mathbf{1}[mathcal{P}ₛₗₒₚₑⁱⁿᵗ]; Sₛₗₒₚₑ^* | G = g) ≥ ιₛₗₒₚₑ(δ, g) > 0 between operator action-selection regimes (orientation-following vs not) within each gauge stratum;
(iv) calibration-valid nuisance adjustment per §4.7 (operator-class-specific MI/JS-preservation);
(v) the operator-reference normalisation gauge of IIC v2.1 §2.3 is declared, fixing the scale of cₒₚ and θₛₗₒₚₑ;
(vi) the declared structural context Θᵈᵉᶜˡₛₗₒₚₑ ⊃eq {cₒₚ, θₛₗₒₚₑ, G, action-selection apparatus} is fixed across the ensemble mathcal{E} at pre-registration (per §1.6 augmented evaluation object); deployments with varying Θᵈᵉᶜˡₛₗₒₚₑ across mathcal{E} fall outside Theorem 3's frame and are handled per §1.6's Case-B fallback. The gauge-stratum conditioning | G = g of premise (ii) further fixes G within each stratum; the remaining Θᵈᵉᶜˡₛₗₒₚₑ components (action-selection apparatus, etc.) are fixed by pre-registration at the deployment level;
(vii) the joint-satisfiability compatibility premise ιₛₗₒₚₑᵃᵈʲ(δ, g, ρₘₐₓ) ≤ ε_T(g) within each declared gauge stratum (per §1.6 joint-satisfiability discipline).

Property definition (operator-level, not emission-level). The protected predicate is the internal-architectural orientation-following predicate event:

mathcal{P}ₛₗₒₚₑⁱⁿᵗ := {operator action-selection follows the dominant admissible nabla cₒₚ over H under KAC-BASE per ONTOΣ XI §6.2}.

This is a predicate event (not an indicator) over the operator's action-selection apparatus on the protected trajectory H(·) — a Case-A internal-trajectory predicate per §1.6 — not of the emission stream itself. The indicator mathbf{1}[mathcal{P}ₛₗₒₚₑⁱⁿᵗ] is the random variable taking value 1 when the event holds and 0 otherwise. The emission-level signature "emission tracks nabla cₒₚ" is what BDP commits as detectable; the predicate it detects is operator-level. This separation avoids tautology: the statistic measures emission-tracking, the property is internal orientation-following, and BDP supplies the bridge.

Then mathcal{P}ₛₗₒₚₑⁱⁿᵗ is εT(g)-admissibly detectable within each gauge stratum, with the chain running through H(0:T) given the fixed Θᵈᵉᶜˡₛₗₒₚₑ (including action-selection apparatus) per the generic §1.6 Case-A chain:

0 < I(mathbf{1}[mathcal{P}ₛₗₒₚₑⁱⁿᵗ]; Sₛₗₒₚₑ^* | G = g) ≤ I(H_(0:T); Sₛₗₒₚₑ^* | G = g) ≤ ε_T(g).

Detection vs identification — scope note. Theorem 3 establishes gauge-conditional detection of orientation-following bias (whether emission tracks nabla cₒₚ within the declared gauge's reference frame), not gauge-free identification of absolute slope. Absolute slope is gauge-dependent: a deployment-declared rescaling cₒₚ → α cₒₚ accompanied by θₛₗₒₚₑ → α θₛₗₒₚₑ preserves orientation-bias content but changes absolute slope by factor α. Without the declared gauge, the alignment statistic is identifiable only up to such rescaling; with the declared gauge, the orientation is detectable. The theorem commits to the conditional admissibility, not to gauge-free identification of absolute slope.

Proof (Conditional Derivation). Within gauge stratum G = g:

Step 1 (Lower bound from BDP). By BDP-(iii), I(mathbf{1}[mathcal{P}ₛₗₒₚₑⁱⁿᵗ]; Sₛₗₒₚₑ^* | G = g) ≥ ιₛₗₒₚₑ(δ, g) > 0.

Step 2 (Predicate-to-state DPI — middle inequality). Since mathbf{1}[mathcal{P}ₛₗₒₚₑⁱⁿᵗ] is a deterministic function of (H_(0:T), Θᵈᵉᶜˡₛₗₒₚₑ) per §1.6's augmented evaluation object, and Θᵈᵉᶜˡₛₗₒₚₑ is fixed across mathcal{E} by premise (vi) (gauge-stratum conditioning fixes G; the remaining components of Θᵈᵉᶜˡₛₗₒₚₑ — action-selection apparatus, cₒₚ, θₛₗₒₚₑ — are fixed at deployment-level pre-registration), mathbf{1}[mathcal{P}ₛₗₒₚₑⁱⁿᵗ] is effectively a deterministic function of H_(0:T) within each gauge stratum. The Markov chain mathbf{1}[mathcal{P}ₛₗₒₚₑⁱⁿᵗ] → H_(0:T) → Sₛₗₒₚₑ^* holds within each gauge stratum (conditioning on H_(0:T), given the fixed Θᵈᵉᶜˡₛₗₒₚₑ, renders the predicate deterministic and hence conditionally independent of Sₛₗₒₚₑ^* given H_(0:T)). By DPI applied along this Markov chain (stratum-conditional form):

I(mathbf{1}[mathcal{P}ₛₗₒₚₑⁱⁿᵗ]; Sₛₗₒₚₑ^* | G = g) ≤ I(H_(0:T); Sₛₗₒₚₑ^* | G = g).

Step 3 (State-to-emission DPI + gauge-stratum NR-window). By DPI applied to Sₛₗₒₚₑ^* = A_(mathcal{C)}(Y_(0:T); ·, g) as a function of Y_(0:T) within the stratum, I(H_(0:T); Sₛₗₒₚₑ^* | G = g) ≤ I(H_(0:T); Y_(0:T) | G = g) ≤ ε_T(g) by the declared gauge-stratum NR-window-(ii). Note that the unconditional NR-window bound is not invoked here; conditioning on G can increase MI for arbitrary covariates, so the bound must be declared per stratum.

Step 4 (Calibration validity). Calibration validity preserves the lower bound per §4.7's MI/JS-preservation commitment.

Chaining Steps 1–4 within the gauge stratum gives the admissible detection chain of §1.6 specialised to the stratum-conditional form. square

Remark. Theorem 3 supplies the identifiability bridge for F-Λ (ONTOΣ XI §3.6) in the Λ-CHARGE + KAC-BASE direction. The protocol is valid as a falsifier because the theorem establishes that orientation-bias detection is admissible conditional on the declared gauge. A deployment that produces emission with no detectable alignment with nabla cₒₚ under the gauge has either falsified Λ-CHARGE, falsified KAC-BASE, or falsified BDP-(iii) for that substrate — all exclude the deployment from the operator-internal-extended subclass.

3.4 Theorem 4 — Cross-Component Closure-Complementarity Detection Admissibility

Apparatus bridge. The closure-complementarity test design uses three property-channel signature classes corresponding to the three substrate conditions of ONTOΣ XII §3.2 — these are the intended property-channel signature classes that instantiate the admissible-statistics framework of §2 (Adm-1 property informativeness and Adm-2 NR-ε state-leakage) when the BDP, TD-1..TD-5, NR-window, and calibration-validity premises of Theorem 4 below are satisfied; satisfaction is established by the theorem's assumption preamble, not asserted standalone here:

• σ^prop_WE: cross-component conditional entropy of co-active emissions, normalised against a declared baseline distribution baseline_π — joint Will-Embedding inadmissibility produces systematic conditional-entropy excess.
• σ^prop_IIC: phase-relation stability metric of component IIC cycles relative to a declared system-cycle reference — phase desynchronisation produces a spectral signature of cycle decomposition.
• σ^prop_D: likelihood-ratio between independent-components and coupled-components emission models — drift isolation produces decomposable load emission. The complement σ^state(π) is the direct-reconstruction signal, bounded by the window-form NR-window of premise (ii): I(σˢᵗᵃᵗᵉ(π); mathrm{state}(S)) ≤ ε_T (the per-step T87 bound ε of §1.5 is the marginal form; the window-level ε_T is the operational quantity for the theorem).

Theorem 4 (CC Property-Channel Detectability under TD-1..TD-5 + BDP for CC conditions). Assume:

(i) the pre-registered test ensemble mathcal{E} of §1.6, instantiated as the two-population sampling frame of TD-5 below, with non-degenerate prior πX = P(mathcal{E)}[mathbf{1}[CC-X violation] = 1] ∈ (πₘᵢₙ, 1 - πₘᵢₙ) on each CC-violation indicator X ∈ {WE, IIC, D};
(ii) the NR-window condition I(H_(S,0:T); Y_(0:T)) ≤ εT where H(S,0:T) denotes mathrm{state}(S)'s trajectory on [0,T] — i.e., NR-ε applies to the closure-output system's holding-field per ONTOΣ XI §2.3 commitment. The bound may be declared via the Subsumption case (inherited via DPI from operator-level NR-window through closure-subsumption commitment per §1.6) or via the Separate-declaration case (direct pre-registration of εT for H(S,0:T)). See §3.5's Preliminary for the case dichotomy;
(iii) the Bridge Detectability Premise (BDP) for each CC condition X ∈ {WE, IIC, D} — i.e., a pre-registered property-channel signature σᵖʳᵒᵖX(π), drawn from the admissible-statistic class of §2.2 extended with the model-comparison statistic family for likelihood-ratio operators (per the Note on §2.2 admissible-statistic families at the end of TD-5 in this section), and a nuisance-adjustment operator A(mathcal{C)} such that the adjusted signature has direct property-channel MI lower bound I(mathbf{1}[CC-X violation]; σᵖʳᵒᵖX(π)) ≥ ι_X(δ) > 0 between substantive-CC-violation and conformance distributions over mathcal{E} (per §1.6's BDP form; one-sided KL form admissible only under declared regularity conditions);
(iv) the closure-complementarity-specific test-design discipline TD-1..TD-5 below;
(v) calibration-valid nuisance adjustment per §4.7 (operator-class-specific MI/JS-preservation);
(vi) the deployment passes the Procedural Admissibility Rule of §3.4.1 below — i.e., the deployment is procedurally evaluable per ONTOΣ XII §4.2 (procedurally unevaluable deployments are filtered out before the theorem is applied; see §3.4.1);
(vii) the declared structural context Θᵈᵉᶜˡ(CC) ⊃eq {U, R, A, mathrm{closure}, component attribution map} is fixed across the ensemble mathcal{E} at pre-registration (per §1.6 augmented evaluation object); deployments with varying Θᵈᵉᶜˡ_(CC) across mathcal{E} fall outside Theorem 4's frame and are handled per §1.6's Case-B fallback;
(viii) the joint-satisfiability compatibility premise ι_Xᵃᵈʲ(δ, ρₘₐₓ) ≤ ε_T for each X ∈ {WE, IIC, D} (per §1.6 joint-satisfiability discipline; ε_T is the closure-system NR-window of premise (ii)).

Let Σ be such an admissible deployment claiming closure-complementarity-conformance over a declared collection U = {u₁, ldots, uₙ} of UTAM-units, with declared closure operation mathrm{closure}(U, R, A) → S. The Theorem establishes property-channel detection under substantive CC violation; the state-channel bound is supplied directly by premise (ii) and is not a separate theorem result.

Property-channel detection under substantive violation. Under BDP-(iii) for the corresponding CC condition, if at least one of CC-WE, CC-IIC, CC-D is substantively violated under the declared closure operation, then the corresponding property-channel signature class registers as informative (the informativeness is supplied by BDP, not derived as an empirical law). CC-violation indicators mathbf{1}[CC-X] are functions of the closure-output system's trajectory H_(S,0:T) (the closure operation declared per ONTOΣ XII §3.2 makes the violation predicate a function of the closure-output state) — i.e., Case-A internal-trajectory predicates in the sense of §1.6, with the protected state being H_(S,0:T) rather than the general operator H_(0:T). The full Case-A admissible detection chain therefore applies:

0 < I(mathbf{1}[CC-X violation]; σᵖʳᵒᵖ_X(π)) ≤ I(H_(S,0:T); σᵖʳᵒᵖ_X(π)) ≤ I(H_(S,0:T); Y_(0:T)) ≤ ε_T.

Left positivity (from BDP-(iii)):

I(mathbf{1}[CC-X violation]; σᵖʳᵒᵖ_X(π)) ≥ ι_X(δ) > 0,

for the violated condition X ∈ {WE, IIC, D}, over the joint two-population × replication ensemble of TD-5.

Middle predicate-to-state DPI (Case-A, via augmented object Z^(CC)_(0:T)): By §1.6's augmented evaluation object, mathbf{1}[CC-X] = f_X(Z^(CC)(0:T)) where Z^(CC)(0:T) := (H_(S,0:T), Θᵈᵉᶜˡ(CC)) and Θᵈᵉᶜˡ(CC) ⊃eq {U, R, A, mathrm{closure}, component attribution map, audit declaration}. Domain-exclusion rule: Theorem 4 applies only to deployments whose pre-registration declares CC-status to be well-defined as a function of Z^(CC)(0:T); if two closure-input configurations with identical Z^(CC)(0:T) can differ in CC-status (i.e., mathbf{1}[CC-X] is not well-defined on Z^(CC)(0:T)), the deployment falls outside Theorem 4's Case-A frame and must be handled either by enlarging Z^(CC)(0:T) to capture the missing variables, or per §1.6's Case-B fallback. Under premise (vii) (Θᵈᵉᶜˡ(CC) fixed across mathcal{E} at pre-registration) plus the well-definedness clause, mathbf{1}[CC-X] reduces to a deterministic function of H(S,0:T) alone. The Bridge here invokes the architectural commitment of ONTOΣ XII §3.2 that the closure operation mathrm{closure}(U, R, A) → S together with the fixed admissibility metadata determines the closure-output trajectory H_(S,0:T) — so two closure-input configurations with the same fixed Θᵈᵉᶜˡ(CC) producing the same H(S,0:T) produce the same CC-violation status (no smuggled metadata into the trajectory). The Markov chain mathbf{1}[CC-X] → Z^(CC)(0:T) → σᵖʳᵒᵖ_X(π) — or equivalently mathbf{1}[CC-X] → H(S,0:T) → σᵖʳᵒᵖX(π) under the fixed-Θᵈᵉᶜˡ(CC) reduction — holds; by DPI:

I(mathbf{1}[CC-X violation]; σᵖʳᵒᵖ_X(π)) ≤ I(H_(S,0:T); σᵖʳᵒᵖ_X(π)).

Right state-to-emission DPI + NR-window-(ii): Since σᵖʳᵒᵖX(π) is by construction a function of Y(0:T), DPI gives I(H_(S,0:T); σᵖʳᵒᵖX(π)) ≤ I(H(S,0:T); Y_(0:T)), and the NR-window assumption (ii) bounds the latter by ε_T.

The state-channel bound I(σˢᵗᵃᵗᵉ(π); mathrm{state}(S)) ≤ εT is inherited from premise (ii) and is not a separate theorem result — it is the NR-window assumption restated for σˢᵗᵃᵗᵉ(π) as a function of Y(0:T).

The theorem is architectural-class: given BDP, it commits to admissible bounded-leakage handling of the strict-positivity claim of property-channel mutual information under substantive CC violation (the strict positivity itself is supplied by BDP, not derived as an architectural law); the theorem does not commit to closed-form quantitative detectability bounds (substrate-specific ι_X(δ) functions are owed per §6.2).

Test-design discipline for Theorem 4 (TD-1..TD-5). The property-channel detection commitment of the theorem statement above holds under five pre-registered constraints — closure-complementarity-specific test-design discipline distinct from (and complementary to) the nuisance-adjustment discipline of §4 (which targets the four interface confounds mathcal{C}₁..mathcal{C}₄ via nuisance-adjustment operators A_(mathcal{C)}; scalar discount functions are one admissible operator class). These five clauses target the ensemble structure of property-channel detection itself:

• (TD-1) Baseline pre-registration. A reference deployment of known closure-complementarity-conformance, in the same substrate and under the same instrumentation, must be pre-registered; its emission distribution under π — denoted baseline_(π) — supplies the reference for property-channel statistics. Detection is evaluated against baseline_(π), not in absolute terms.
• (TD-2) Substrate-noise model. A declared substrate-specific noise model — the distribution of cross-component emission correlations expected under conformance, attributable to substrate physics rather than CC structure — must be pre-registered. Property-channel signatures are evaluated in excess of substrate-noise.
• (TD-3) Stationarity windows. Emission statistics are evaluated within stationarity windows declared per substrate. Window boundaries cannot be adjusted post-hoc.
• (TD-4) Multiple-comparison correction. When all three property-channel signature classes are tested simultaneously, multiple-comparison correction — declared in advance — is applied to the family-wise threshold.
• (TD-5) Replication ensemble and two-population sampling frame. Detection requires N ≥ declared-threshold independent replications under independent instantiations of the deployment, together with a pre-registered two-population sampling frame: a target population of candidate deployments under test (some of which may substantively violate one or more CC conditions) and a paired baseline population of known-conformant deployments. The property-channel mutual information of BDP-(iii) and the theorem chain is well-defined under the joint probability measure P_(TD) over (a) the two-population draw of deployments, and (b) the replication ensemble of TD-5: both mathbf{1}CC-X violation and σᵖʳᵒᵖX(π) (a random variable over both the two-population frame and the replication ensemble) acquire their stochastic structure from P(TD). Single-instance signatures and single-population framing do not count as detection — the indicator mathbf{1}[·] is constant within a fixed deployment, so I(σᵖʳᵒᵖ_X(π); mathbf{1}[CC-X]) > 0 requires mathbf{1}[·] to vary across the ensemble.

The five clauses are structurally orthogonal, each closing a specific gaming attack vector: TD-1 against absolute-threshold ambiguity; TD-2 against attribution-to-noise misclassification; TD-3 against window-shopping; TD-4 against family-wise false-positive inflation; TD-5 against single-realisation artifact (and supplying the ensemble under which the property-channel chain is meaningful). Procedural unevaluability of the discipline itself — failure to pre-register baseline_(π), substrate-noise model, stationarity windows, multiple-comparison correction, or replication count — excludes the deployment from admissible-test status per ONTOΣ XII §4.2 discipline. Note on §2.2 admissible-statistic families. σ^prop_{WE} (cross-component conditional entropy) and σ^prop_{IIC} (phase-stability spectral metric) belong to the Correlational and Variance/Trajectory families respectively. σ^prop_D (likelihood-ratio between independent-components and coupled-components emission models) extends §2.2 with a model-comparison statistic family, which §3 admits implicitly via Adm-1 (property informativeness) and Adm-2 (NR-ε on state) — both hold by construction for likelihood-ratio statistics on emission distributions.

Proof (Conditional Derivation).

State-channel inheritance (not a separate theorem result). The signal σˢᵗᵃᵗᵉ(π) is by construction a function of Y_(0:T); by DPI and the NR-window premise, I(σˢᵗᵃᵗᵉ(π); mathrm{state}(S)) ≤ I(H_(S,0:T); Y_(0:T)) ≤ ε_T. This is the NR-window premise restated for σˢᵗᵃᵗᵉ, not a separate proof obligation.

Left positivity of the Case-A chain (property-channel via BDP-(iii)). Established class-by-class:

• σᵖʳᵒᵖ(WE). If CC-WE fails substantively, the conjunction bigwedgeᵢ C_A(uᵢ) is unsatisfiable under v2.1 admissibility at the system layer (ONTOΣ XII §3.5 Case 1). Components attempting to co-realise jointly inadmissible constraints emit sequences whose cross-component conditional entropy deviates systematically from baseline(π) — by the structural fact that no consistent joint state exists, so co-active emissions cannot stabilise into the reference distribution. By BDP-(iii)'s direct MI lower bound, I(σᵖʳᵒᵖ(WE); mathbf{1}[CC-WE violation]) ≥ ι(WE)(δ) > 0 strictly, under TD-1 / TD-2 baseline framing.

• σᵖʳᵒᵖ(IIC). CC-IIC failure produces destructive interference of component IIC cycles' phase relations under the closure (ONTOΣ XII §3.5 Case 2). Spectral analysis of cross-component emission yields a phase-stability metric whose distribution differs from baseline(π) under CC-IIC violation. By BDP-(iii)'s direct MI lower bound, I(σᵖʳᵒᵖ(IIC); mathbf{1}[CC-IIC violation]) ≥ ι(IIC)(δ) > 0 strictly.

• σᵖʳᵒᵖ(D). CC-D failure entails that Λ_S decomposes into a sum of independent component-load fields (ONTOΣ XII §3.5 Case 3 and §3.4 failure-mode taxonomy). The likelihood ratio between independent-components and coupled-components emission models is the property-channel observable that registers this decomposability. Under CC-D failure, the independent-components model fits strictly better under the pre-registered π for which the BDP margin is declared (TD-1..TD-5 supply the test-design discipline; the substantive better-fit claim is conditional on the declared π, not universal across all admissible π); under conformance, the coupled-components model fits strictly better. By BDP-(iii)'s direct MI lower bound, I(σᵖʳᵒᵖ(D); mathbf{1}[CC-D violation]) ≥ ι_D(δ) > 0 strictly.

Predicate-to-state DPI (middle inequality of the Case-A chain). For each CC condition X ∈ {WE, IIC, D}, the violation indicator mathbf{1}[CC-X] is a deterministic function of the closure-output system's trajectory H_(S,0:T) (via the closure operation mathrm{closure}(U, R, A) → S of ONTOΣ XII §3.2). The Markov chain mathbf{1}[CC-X] → H_(S,0:T) → σᵖʳᵒᵖX(π) therefore holds (conditioning on H(S,0:T) renders mathbf{1}[CC-X] deterministic and hence conditionally independent of σᵖʳᵒᵖ_X(π)); by DPI,

I(mathbf{1}[CC-X]; σᵖʳᵒᵖ_X(π)) ≤ I(H_(S,0:T); σᵖʳᵒᵖ_X(π)).

This is the middle (predicate-to-state) DPI step of the Case-A admissible detection chain.

State-leakage of property-channel signatures via DPI (right inequality of the Case-A chain). Each σᵖʳᵒᵖX(π) is by construction a function of Y(0:T) (with nuisance parameter η(mathcal{C)} that depends only on declared confound profile mathcal{C}, not on H(S,0:T)). By data-processing inequality, I(H_(S,0:T); σᵖʳᵒᵖX(π)) ≤ I(H(S,0:T); Y_(0:T)) ≤ ε_T. The Bridge does not claim that property-channel signatures are "orthogonal" to state — they are functions of emission and inherit the NR-window bound by DPI; orthogonality is not assumed. square

Depends on. T87 (NR-ε leakage bound); Axioms 67–69 (operator-temporal subclass); Λ-ACC; HF-DYN; UTAM Three Laws; ONTOΣ XI Lemma XI.0 and NR-ε apparatus; ONTOΣ XII §3.2 (CC primitive), §3.4 (failure-mode taxonomy), §3.5 (toy model cases), §4.2 (auditability clauses), §6 (F-CC); IIC v2.1 §2.3 operator-reference normalisation discipline.

Remark on substrates without component-level attribution. Theorem 4 directly addresses substrates where emission is attributable to specific components (cross-component covariance is well-defined). Substrates where emission is purely system-level — components' contributions inseparably blended in the output — admit a weaker detectability through composite statistics (Theorem 5 below). Substrate-specific identifiability bridges for biological, perceptual, semantic, and geometric prototype substrates of ONTOΣ XII §5 are deployment-side specialisations of the present apparatus; the architectural-class register of this theorem operates without prescribing them.

3.4.1 Procedural Admissibility Rule (governance/audit, not detection)

Theorem 4 above commits to property-channel detection of substantive CC violations under the stated BDP + TD-1..TD-5 + calibration premises. It does not commit to a property-channel detection claim for procedurally unevaluable deployments. Procedural unevaluability is a separate failure mode, handled at the admissibility level of the test, not at the property-detection level of the theorem.

Procedural Admissibility Rule. A deployment Σ is admissible to Theorem 4's property-detection test only if it passes the auditability discipline of ONTOΣ XII §4.2:

• the W → C_A induction map (Will Embeddings to admissibility constraints) is pinned to a stable conjunction, declared a priori;
• the R-coverage (resource scope) is specified and not subject to post-hoc narrowing;
• terminal-or-shielded labels are justified by independent declaration, not by inspection of the test outcome.

Deployments that fail any of these clauses are procedurally unevaluable and are filtered out of the admissibility-pass set before the property-detection test of Theorem 4 is applied. The filtering is normative subclass-eligibility, not an empirical positive σ^prop signal: the Bridge does not claim that procedurally unevaluable deployments produce property-channel signatures structurally identical to substantively-violating ones — it claims only that such deployments are not admitted to the test, and are excluded from the operator-internal-extended subclass per ONTOΣ XII §4.2's governance-level discipline.

Implications for F-Ident-4 (§5.4). Falsification of Theorem 4 by null property-channel signature is evaluated only on admissible deployments. A null on a procedurally-unevaluable deployment is neither a falsification of Theorem 4 nor an instance of "procedural-failure detection"; it is a non-event at the property-detection layer — the deployment was excluded before the test ran. F-Ident-4's falsification clause (§5.4) accordingly evaluates only deployments that have passed the Procedural Admissibility Rule above.

This separation closes the conflation flagged in prior versions of this work, where procedural unevaluability was framed as a positive part of Theorem 4's detection commitment. Detection is a property-channel claim about substantive violation under admissibility; procedural unevaluability is an admissibility-level filter that operates upstream of the property-channel claim.

3.5 Theorem 5 — Vector-Protocol Suite Detectability (under BDP for each component property)

Preliminary: Two cases for the CC component's protected trajectory. Theorem 5 includes a CC component (k=CC) whose protected internal trajectory under §3.4 is H_(S,0:T) (the closure-output system's trajectory) rather than the general operator H_(0:T). Two cases handle this:

• Subsumption case — the deployment asserts the closure-subsumption commitment of §1.6: H_(S,0:T) is a function of H_(0:T) through mathrm{closure}(U, R, A) → S (per ONTOΣ XII §3.2). Under this case, the operator-level NR-window I(H_(0:T); Y_(0:T)) ≤ εT propagates by DPI to I(H(S,0:T); Y_(0:T)) ≤ εT, and the CC component is absorbed into the unified Hᵖʳᵒᵗ(0:T) = H_(0:T) chain.
• Separate-declaration case — the deployment declines the closure-subsumption commitment; H_(S,0:T) is declared as a state separate from H_(0:T) with its own NR-window I(H_(S,0:T); Y_(0:T)) ≤ ε_T^(CC) at pre-registration.

These two cases are the operational instantiation of §1.6's NR-window dichotomy, used in T5 premise (ii) and proof below. (NB: §1.6 introduces this dichotomy as "closure-subsumption commitment / deployments declining it"; the labels above are the §3.5-local naming of the same dichotomy.)

Theorem 5 (Vector-Protocol Suite Detectability). Note on framing. Theorem 5 is a vector-protocol suite theorem, not a single joint-vector theorem: each component k (HF, χ, Λ, CC, Coh) lives in its own pre-registered ensemble per its component theorem (T1 HF ensemble; T2 paired threshold-straddling design; T3 gauge-stratified ensemble; T4 TD-1..TD-5 closure-complementarity ensemble; Coh inherited IIC v2.1 falsification surface). T5 establishes componentwise detectability over the protocol suite of these heterogeneous designs; the joint vector statistic mathbf{S}^* is meaningful only if the deployment declares a product/joint ensemble combining the component ensembles explicitly. Otherwise, T5 is read as a componentwise framework with separate registered ensembles per component, not a single joint claim. Assume:

(i) the per-component pre-registered test ensembles mathcal{E}ₖ for each component k ∈ {HF, χ, Λ, CC, mathrm{Coh}} (per the protocol-suite framing above: mathcal{E}(HF) from T1; mathcal{E}χ paired threshold-straddling from T2; mathcal{E}Λ gauge-stratified from T3; mathcal{E}(CC) TD-1..TD-5 from T4; mathcal{E}(Coh) from IIC v2.1 coherence falsification surface), with per-component non-degenerate priors πₖ = P(mathcal{E)ₖ}[mathbf{1}[mathcal{P}ₖ] = 1] ∈ (π(min,k), 1 - π(min,k)). If the deployment additionally declares a product/joint ensemble mathcal{E}ʲᵒⁱⁿᵗ combining the component ensembles explicitly, the vector notation mathbf{P}, mathbf{S}^* below is evaluated over mathcal{E}ʲᵒⁱⁿᵗ; otherwise T5 is read strictly componentwise without claims requiring joint distributions;
(ii) either (a) per-component conditional sequential leakage budgets under a pre-registered component ordering k = 1, ldots, n — I(Hᵖʳᵒᵗ(0:T); Sₖ^* | S₁^, ldots, Sₖ₋₁^) ≤ ε(T,k) — that compose by chain rule to bound the joint leakage (the ordering is declared at pre-registration; the conditional budgets are order-dependent and cannot be re-shuffled post-hoc), or (b) a single joint NR-window bound I(Hᵖʳᵒᵗ(0:T); Y(0:T)) ≤ εTʲᵒⁱⁿᵗ — the deployment declares which composition discipline applies at pre-registration. Marginal (non-conditional) per-component bounds I(Hᵖʳᵒᵗ(0:T); Sₖ^) ≤ ε_(T,k) do **not* compose by simple summation (MI subadditivity fails — see proof's Note: simple subadditivity); only the conditional-sequential form (ii.a) composes by chain rule, or the joint form (ii.b) bounds directly. Additional clause for CC under separate-declaration: under the Separate-declaration case of the Preliminary above, premise (ii) must additionally include (a) the per-CC-component NR-window declaration I(H_(S,0:T); Y_(0:T)) ≤ εT^(CC) at pre-registration, and (b) when the deployment makes any claim about the full vector mathbf{S}^* on H(S,0:T) (e.g. joint state-leakage of the whole vector relative to the closure-output state), the joint-vector NR-window declaration I(H_(S,0:T); mathbf{S}^) ≤ εT^(CC,joint) — bounding S(CC)^ alone does not suffice due to potential MI synergy with HF/Λ/Coh components (see proof's Note: simple subadditivity). Under the Subsumption case, the CC component is absorbed into the unified Hᵖʳᵒᵗ(0:T) = H(0:T) chain via DPI through closure;
(iii) BDP per component property class — i.e., for each k, there is a pre-registered statistic Sₖ and nuisance-adjustment operator A_(mathcal{C)}^((k)) such that the adjusted statistic Sₖ^* achieves direct MI lower bound I(mathbf{1}[mathcal{P}ₖ]; Sₖ^) ≥ ιₖ(δₖ) > 0 under substantive violation;
(iv) calibration-valid nuisance adjustment per §4.7 for each component;
(v) the Procedural Admissibility Rule of §3.4.1 for any CC components (under either *Subsumption or Separate-declaration — the Procedural Admissibility Rule operates at the deployment-admissibility level, upstream of the protected-trajectory dispatch);
(vi) for each Case-A component k, the declared structural context Θᵈᵉᶜˡₖ is fixed across the ensemble mathcal{E} at pre-registration (per §1.6 augmented evaluation object) — specifically Θᵈᵉᶜˡ(HF), Θᵈᵉᶜˡₛₗₒₚₑ, Θᵈᵉᶜˡ(CC), Θᵈᵉᶜˡ(Coh) each fixed; components with varying Θᵈᵉᶜˡₖ fall outside Theorem 5's frame for that component;
(vii) the joint-satisfiability compatibility premise (per §1.6 joint-satisfiability discipline), with the operative NR-window per the deployment's declared composition discipline of (ii): ιₖᵃᵈʲ(δₖ, ρ(max,k)) ≤ ε(T,k) under conditional-sequential composition (ii.a); ιₖᵃᵈʲ(δₖ, ρ(max,k)) ≤ εTʲᵒⁱⁿᵗ under joint NR-window (ii.b); with the special case ι(CC)ᵃᵈʲ(δ(CC), ρ(max,CC)) ≤ εT^(CC) for the CC component under Separate-declaration; and, when the deployment makes joint-vector state-leakage claims on H(S,0:T) under Separate-declaration, the joint-vector compatibility constraint I_(mathcal{E)ʲᵒⁱⁿᵗ}(mathbf{1}[mathbf{P}]; mathbf{S}^) ≤ εT^(CC,joint) — i.e., the joint property-channel MI (under the declared mathcal{E}ʲᵒⁱⁿᵗ per (i)) must fit under the joint state-leakage NR-window on H(S,0:T). This is a **direct joint-bound constraint, not a sum-of-component-iotas (which would invoke MI subadditivity — explicitly rejected in the proof's *Note: simple subadditivity).

Let mathbf{P} = (mathbf{1}[mathcal{P}₁], ldots, mathbf{1}[mathcal{P}ₙ]) denote the vector predicate of component-property indicators over the test ensemble mathcal{E}, and let mathbf{S}^* = (S_(HF)^, hatχ^((·)), Sₛₗₒₚₑ^, σᵖʳᵒᵖ(CC), S(Coh)^) denote the vector of nuisance-adjusted component statistics from Theorems 1–4 plus the Coh-component statistic S_(Coh)^ derived from IIC v2.1's mathrm{Coh}(t) apparatus (declared at pre-registration per the IIC v2.1 §2.3-style notation). The Coh-component BDP is inherited from IIC v2.1's coherence falsification surface under the same §1.6 form: I(mathbf{1}[mathcal{P}(Coh)]; S(Coh)^*) ≥ ι(Coh)(δ) > 0 for δ > δₘᵢₙ over the pre-registered ensemble, with mathcal{P}(Coh) a Case-A internal-trajectory predicate on H_(0:T) via the IIC cycle apparatus.

Then the vector-composite property is componentwise admissibly detectable in the following mixed Case-A / Case-B sense per §1.6.

Property-channel componentwise lower bound (all components, on per-component ensembles). For every component k, evaluated over its component ensemble mathcal{E}ₖ:

0 < I_(mathcal{E)ₖ}(mathbf{1}[mathcal{P}ₖ]; Sₖ^*).

The bound is supplied by component-k's BDP lower bound (per Theorems 1–4 for k ∈ {HF, χ, Λ, CC}; per the inherited Coh-BDP ι_(Coh)(δ) > 0 from IIC v2.1 for k = mathrm{Coh}, as declared in the vector definition above).

Projection DPI to joint vector (only under joint/product ensemble declaration). If the deployment additionally declares a product/joint ensemble mathcal{E}ʲᵒⁱⁿᵗ per premise (i), then the joint vector statistic mathbf{S}^* is well-defined under that joint distribution and the projection mathbf{S}^* mapsto Sₖ^* supplies, by data-processing inequality:

I_(mathcal{E)ʲᵒⁱⁿᵗ}(mathbf{1}[mathcal{P}ₖ]; Sₖ^*) ≤ I_(mathcal{E)ʲᵒⁱⁿᵗ}(mathbf{1}[mathcal{P}ₖ]; mathbf{S}^*).

If no joint ensemble is declared, the quantity I(mathbf{1}[mathcal{P}ₖ]; mathbf{S}^*) is not defined as a single joint-distribution quantity, and T5 remains strictly componentwise with separate per-ensemble claims only.

Predicate-to-state DPI (Case-A components only). For Case-A components — those for which mathbf{1}[mathcal{P}ₖ] = fₖ(Hᵖʳᵒᵗ(0:T,k)) is a deterministic function of the declared protected trajectory (k ∈ {HF, Λ, CC, mathrm{Coh}}, with per-component Hᵖʳᵒᵗ(0:T,k): = H_(0:T) for HF/Λ/Coh, = H_(S,0:T) for CC per §3.4) — the predicate-to-state DPI of §1.6 further gives:

I(mathbf{1}[mathcal{P}ₖ]; mathbf{S}^*) ≤ I(Hᵖʳᵒᵗ_(0:T,k); mathbf{S}^*).

Recap on the T4 protected state. For the CC component (k = CC), the protected internal trajectory H_(S,0:T) is handled per the Preliminary's Subsumption case / Separate-declaration case dichotomy above. Theorem 5's chain absorbs the CC component into the unified Hᵖʳᵒᵗ(0:T) notation under Subsumption, or evaluates it against H(S,0:T) with ε_T^(CC) under Separate-declaration.

For Case-B components (the χ / threshold-straddling component per Theorem 2, where mathbf{1}[mathcal{P}ₖ] is exogenous design metadata, not a function of internal trajectory), no predicate-to-state DPI through H is claimed; property-channel informativeness and state leakage remain separate constraints per §1.6's Case-B form.

Joint state-leakage bound (case-split by protected-state regime). The vector statistic mathbf{S}^* is by construction a function of Y_(0:T). The applicable headline bound splits by the deployment's declared protected-state regime per the Preliminary above:

• Under Subsumption (closure-subsumption asserted; unified Hᵖʳᵒᵗ(0:T) = H(0:T) for all components):

  I(H_(0:T); mathbf{S}^*) ≤ ε_Tʲᵒⁱⁿᵗ.

• Under Separate-declaration (CC component on H_(S,0:T), HF/Λ/Coh on H_(0:T)): HF/Λ/Coh sub-vector mathbf{S}^(backslash CC) satisfies I(H(0:T); mathbf{S}^(backslash CC)) ≤ ε_Tʲᵒⁱⁿᵗ; and, when the deployment makes joint-vector state-leakage claims on H(S,0:T), the CC-anchored bound applies:

  I(H_(S,0:T); mathbf{S}^*) ≤ ε_T^(CC,joint).

where ε_Tʲᵒⁱⁿᵗ is supplied by the deployment's declared composition discipline:

• Under chain-rule composition (assumption (ii.a)). Under the Subsumption case, the unified Hᵖʳᵒᵗ(0:T) = H(0:T) supplies the chain rule across all k, giving εTʲᵒⁱⁿᵗ = sumₖ ε(T,k) via I(Hᵖʳᵒᵗ(0:T); mathbf{S}^*) = sumₖ I(Hᵖʳᵒᵗ(0:T); Sₖ^* | S_(<k)^*) ≤ sumₖ ε(T,k). Under the Separate-declaration case, the chain rule applies separately to (a) HF/Λ/Coh components under H(0:T) and (b) the CC component under H_(S,0:T) per the third bullet below.
• Under single joint NR-window (assumption (ii.b)). εTʲᵒⁱⁿᵗ is declared directly, with I(Hᵖʳᵒᵗ(0:T); mathbf{S}^) ≤ I(Hᵖʳᵒᵗ(0:T); Y(0:T)) ≤ ε_Tʲᵒⁱⁿᵗ by DPI from mathbf{S}^ as a function of Y_(0:T).
• Under separate-declaration of H_(S,0:T) (CC-specific extension to either (ii.a) or (ii.b)). The CC component's bound is I(H_(S,0:T); S_(CC)^) ≤ εT^(CC) declared per premise (ii)'s additional clause; the remaining HF/Λ/Coh components stay under ε_Tʲᵒⁱⁿᵗ for H(0:T). **Joint-bound requirement for the whole vector under separate-declaration:* because MI can exhibit synergy across components (as the Note: simple subadditivity below warns), bounding I(H_(S,0:T); S_(CC)^) alone does **not* suffice to bound I(H_(S,0:T); mathbf{S}^) — the latter may exceed εT^(CC) through cross-component synergy with HF/Λ/Coh components. The deployment must therefore declare a joint NR-window on H(S,0:T) relative to the full vector statistic: I(H_(S,0:T); mathbf{S}^) ≤ εT^(CC,joint), or conditional-sequential decomposition of this joint bound across components. Absent such joint declaration, T5 under separate-declaration reverts to strictly componentwise form (no claim about I(H(S,0:T); mathbf{S}^*) at all).

For Case-A components, the property-channel lower bound, predicate-to-state DPI, and joint state-leakage bound chain together into the full admissible detection chain of §1.6. For Case-B components, the property-channel lower bound and joint state-leakage bound stand as separate constraints, jointly admissible without a chain through H.

Proof (Conditional Derivation). Each component statistic Sₖ^* satisfies Theorem k's admissibility under §1.6's case classification:

• Theorem 1 (k = HF) is Case-A through H_(0:T).
• Theorem 3 (k = Λ, orientation-following) is Case-A through H_(0:T) (stratum-conditional per gauge).
• Theorem 4 (k = CC) is Case-A through H_(S,0:T) with two sub-cases per the Recap on the T4 protected state above: under Subsumption, H_(S,0:T) is a function of H_(0:T) via closure and the chain unifies; under Separate-declaration, H_(S,0:T) and H_(0:T) are distinct protected trajectories each with declared NR-windows.
• The Coh component (k = mathrm{Coh}) is Case-A through H_(0:T) via the inherited IIC v2.1 BDP ι_(Coh)(δ) > 0.
• Theorem 2 (k = χ) is Case-B ("straddling" is exogenous design metadata, not a function of internal trajectory). The vector mathbf{S}^* is by construction a function of Y_(0:T) (and declared confound profile mathcal{C}). The DPI applied to the projection mathbf{S}^* → Sₖ^* supplies I(mathbf{1}[mathcal{P}ₖ]; mathbf{S}^) ≥ I(mathbf{1}[mathcal{P}ₖ]; Sₖ^) > 0 for every k, Case-A or Case-B. Only for Case-A components does the additional predicate-to-state DPI I(mathbf{1}[mathcal{P}ₖ]; mathbf{S}^) ≤ I(Hᵖʳᵒᵗ_(0:T); mathbf{S}^) apply (via the Markov chain mathbf{1}[mathcal{P}ₖ] → Hᵖʳᵒᵗ(0:T) → mathbf{S}^* established by mathbf{1}[mathcal{P}ₖ] = fₖ(Hᵖʳᵒᵗ(0:T)), with Hᵖʳᵒᵗ(0:T) = H(0:T) for HF/Λ/Coh components and Hᵖʳᵒᵗ(0:T) = H(S,0:T) for the CC component per §3.4). Under the separate-declaration case of the Recap on the T4 protected state above — where the deployment declares H_(S,0:T) as a state separate from H_(0:T) — the CC-component Markov chain runs through H_(S,0:T) with per-component bound εT^(CC) replacing ε_Tʲᵒⁱⁿᵗ for that component. Case-B components inherit the separate-constraint form of §1.6. The joint state-leakage bound follows from the declared composition discipline of (ii): under (ii.a) the chain rule yields sumₖ I(H(0:T); Sₖ^* | S_(<k)^) ≤ sumₖ ε_(T,k) by construction; under (ii.b) DPI from mathbf{S}^ as a function of Y_(0:T) yields ≤ ε_Tʲᵒⁱⁿᵗ directly. Note: simple subadditivity I(H; mathbf{S}^) ≤ sumₖ I(H; Sₖ^) does not hold in general — MI can exhibit positive synergy across components even when each marginal MI is bounded; the chain-rule or joint-bound form is required. square

Note on aggregation. Theorem 5 is stated as a vector-componentwise theorem rather than a logical-combination claim. The earlier formulation I(mathcal{P}(comp); S(comp)) ≥ maxₖ I(mathcal{P}ₖ; Sₖ) for logical compositions (mathcal{P}(comp) = OR/AND of components) is not in general valid — logical aggregation can lose component-specific information (e.g., mathcal{P}(comp) = mathcal{P}₁ lor mathcal{P}₂ does not distinguish which of mathcal{P}₁, mathcal{P}₂ holds, so a statistic specific to mathcal{P}₁ may be uninformative about mathcal{P}_(comp)). The vector formulation avoids this issue: each Sₖ^* remains informative about its own mathcal{P}ₖ, and the composite test inherits componentwise detectability without lossy aggregation.

Note on any-violation testing. Earlier formulations of this work attempted a Corollary 5.1 of the form "any-violation admissibility derives from componentwise admissibility by DPI." That derivation does not hold in general: the disjunctive predicate mathcal{P}lor = bigveeₖ mathcal{P}ₖ loses component-specific information under aggregation, and the chain I(mathbf{1}[mathcal{P}(k^)]; S_(k^)^) ≤ I(mathbf{1}[mathcal{P}_lor]; mathbf{S}^) does not follow from DPI alone even under dominant-component assumptions. The present work therefore does not claim an any-violation theorem as a corollary of Theorem 5. Deployments seeking to test the disjunctive predicate must declare a direct BDP for the disjunction — i.e., I(mathbf{1}[mathcal{P}_lor]; mathbf{S}^*) ≥ ι_lor(δ) > 0 under the relevant ensemble — as a separate substrate-side commitment, with its own MI/JS-preserving operator and falsifier. The Bridge supplies the componentwise vector framework of Theorem 5 as the canonical falsification mode; any-violation testing is a substrate-side extension, owed in companion work and not derived here.

Remark. Theorem 5 establishes that the operationalisation of the falsification surface across the architectural-class corpus is componentwise composable without lossy logical aggregation. A deployment claiming conformance to all the architectural commitments of ONTOΣ XI, ONTOΣ XII, and IIC v2.1 is testable through the vector statistic mathbf{S}^, with each component supplied by Theorems 1–4. Any-violation (disjunctive) testing is not derived as a corollary here (see *Note on any-violation testing above); it requires a separate direct-BDP commitment for the disjunctive predicate at substrate level.

Note on falsifier alignment. Theorem 5 does not introduce a dedicated falsifier. Componentwise falsifiability is supplied by F-Ident-1..F-Ident-4 (one per component-Theorem) plus the IIC v2.1 §5 falsifier suite for the Coh component. F-Ident-5 separately targets the §4.7 calibration-validity premise on which all five Theorems depend; it is not a Theorem-5-specific falsifier but a cross-cutting one. This asymmetry (5 Theorems, 5 falsifiers, no T5↔F-Ident-5 alignment) is structural: T5's vector-componentwise framing makes it a composition theorem, falsifiable via its components' falsifiers; F-Ident-5 targets the operator-class premise that T1–T5 all share.

---

4. The Nuisance-Adjustment Discipline (Confound Adjustment)

The five identifiability theorems require that confounds be declared and nuisance-adjusted (per §2.4) before property-detection. This section specifies the nuisance-adjustment discipline at the architectural level (scalar discount functions are one admissible operator class for separable additive confounds; the broader operator class is declared in §2.4). Substrate-specific calibration of the operators is deployment-side work.

4.1 Decoder-Temperature Confound

For substrates with parameterised emission decoders, the operator declares the decoder temperature τ(dec) as part of pre-registration. The scalar-additive nuisance-adjustment special case φ₁(τ(dec)) (one admissible A_(mathcal{C)} operator class per §2.4) adjusts for the temperature's contribution to emission diversity. For Boltzmann decoders in the toy low-noise regime, this special case may take the schematic placeholder form

φ₁(τ_(dec)) sim log τ_(dec) + log Z(τ_(dec)) + (temperature-dependent energy-expectation terms)

where Z(τ_(dec)) is the partition function over the emission space; the present work does not fix a universal closed form, and the formula above is illustrative only. The exact substrate-specific concrete form must be declared at pre-registration. For other decoder structures, the adjustment form is substrate-specific but must be declared.

The nuisance-adjustment discipline requires that τ_(dec) be fixed during the evaluation interval. Variable decoder temperature within an evaluation window violates the discipline and falsifies the protocol.

4.2 Sampling-Policy Confound

The operator declares the sampling policy Pₛ (greedy, top-k, nucleus, beam, etc.) as part of pre-registration. The scalar-additive nuisance-adjustment special case φ₂(Pₛ) adjusts for the policy's distortion of emission-distribution statistics. For top-k sampling with k fixed, the adjustment accounts for the truncated tail-probability mass. For nucleus sampling, it accounts for the dynamic threshold's effect on observed distribution moments.

The nuisance-adjustment discipline requires that Pₛ be fixed during the evaluation interval. Policy-switching mid-evaluation violates the discipline.

4.3 Retrieval-Augmentation Confound

The operator declares the retrieval source R_(aug) and retrieval-injection profile as part of pre-registration. The scalar-additive nuisance-adjustment special case φ₃(R_(aug)) adjusts for the retrieval-induced contribution to emission entropy and correlational statistics; in rich-retrieval substrates this special case is typically insufficient (the additive-separable assumption fails), and the deployment must declare a non-scalar A_(mathcal{C)} operator (residualisation, matched-baseline differencing, or nuisance-model marginalisation per §2.4). The adjustment may dominate other terms; this is acceptable provided the nuisance adjustment is calibration-valid (§4.7).

The architectural commitment is that retrieval-augmentation does not exempt a deployment from identifiability protocols — it requires more elaborate nuisance-adjustment discipline. Deployments that decline to specify retrieval profile fall outside the identifiability bridge by construction.

4.4 Prompt-Entropy Confound

The operator declares the prompt distribution and its entropy as part of pre-registration. The scalar-additive nuisance-adjustment special case φ₄(Eₚ) adjusts for the prompt-entropy contribution to observed output entropy. For deployments operating across heterogeneous prompt distributions, the adjustment must be applied per-prompt-class, not globally; pooled adjustment is invalid when prompt-class distributions vary.

4.5 Composition

When multiple confounds are active, the composite nuisance-adjustment operator (per §2.4) composes the per-confound operators under a declared substrate-specific commutation discipline. For separable additive confounds, the scalar-subtraction special case writes

φ(mathcal{C}) = sumᵢ₌₁⁴ φᵢ(mathcal{C}ᵢ) + φ_(interactions)(mathcal{C}₁, mathcal{C}₂, mathcal{C}₃, mathcal{C}₄)

where the interaction term captures non-separable cross-confound effects. For confound profiles that admit additive separation (most common case), φ(interactions) = 0. For non-separable confounds — typically when retrieval interacts with sampling policy, or when temperature varies across prompt classes — φ(interactions) must be declared and calibrated.

For statistic families where scalar subtraction is structurally inappropriate (likelihood-ratio statistics, spectral phase metrics, model-comparison scores), the composite nuisance adjustment uses substrate-specific operators from the §2.4 class — residualisation, conditional expectation, matched-baseline differencing, or nuisance-model marginalisation — composed per the declared commutation discipline rather than via additive scalar subtraction. The commutation discipline must be pre-registered: the order in which per-confound operators are applied is part of the deployment's architectural specification, and post-hoc reordering is a falsification event.

4.6 Pre-Registration Discipline Inheritance

The nuisance-adjustment discipline is governed by the same pre-registration rules as the architectural primitives of ONTOΣ XI §10. All declared nuisance-adjustment operators A_(mathcal{C)} — scalar discount terms where applicable, and any interaction terms — must be declared prior to deployment evaluation, with declarations recorded in a registration archive (OSF or equivalent). Post-hoc adjustment of calibration parameters to fit observed property-detection results is itself a falsification event and excludes the deployment from the identifiability subclass.

4.7 Calibration Validity (formal residual threshold + operator-class MI/JS-preservation)

The architectural discipline that distinguishes valid nuisance adjustment from over-adjustment or under-adjustment is calibration validity (replacing the earlier informal "calibration honesty" framing with a formal residual threshold + an MI/JS-preservation commitment).

Calibration residual. For a deployment-declared nuisance-adjustment operator A_(mathcal{C)} from the class of §2.4, the calibration residual is operator-class-specific:

• Scalar additive subtraction: mathrm{Err}(calib) = big|\, E[S(Y(0:T)) | mathcal{C}] - φ(mathcal{C}) \,big|.
• Residualisation: mathrm{Err}_(calib) = residual variance unexplained by the declared nuisance covariates beyond declared tolerance.
• Conditional expectation: mathrm{Err}(calib) = big|\, S^*(Y(0:T)) - E[S^*(Y_(0:T))] \,big| averaged over conformance-class.
• Matched-baseline differencing: mathrm{Err}(calib) = big|\, S(Y(0:T)) - S(baseline_π(mathcal{C})) \,big| for matched-confound baseline.
• Likelihood-ratio adjustment: mathrm{Err}_(calib) = likelihood-ratio mis-specification error (e.g., KL-divergence between declared and empirical likelihood under conformance).
• Nuisance-model marginalisation: mathrm{Err}_(calib) = posterior-distribution mis-fit error under declared nuisance prior.
• Substrate-specific operator: operator-specific residual, declared as part of the substrate-specific pre-registration.

Note on residual forms. The residual forms above are schematic at the architectural-class level; each substrate-specific instantiation must define its residual as a concrete measurable functional (with declared estimator, sample-complexity, and tolerance scaling) before protocol registration. The Bridge's commitment is to the structural role of the residual (a pre-registered upper bound on adjustment error), not to a single closed-form definition across substrates.

Validity condition. The nuisance adjustment A_(mathcal{C)} is calibration-valid for the deployment under test if

mathrm{Err}_(calib) ≤ ρₘₐₓ

where ρₘₐₓ is the pre-registered tolerance declared at OSF before evaluation.

MI/JS-Preservation commitment. The operator class admitted by the Bridge's theorems is restricted to those operators A_(mathcal{C)} for which calibration validity (mathrm{Err}(calib) ≤ ρₘₐₓ) implies that the BDP direct MI / JS-separation lower bound ι_X(δ) of §1.6 is preserved on the adjusted statistic S_X^* = A(mathcal{C)}(Y_(0:T); η(mathcal{C)}), up to a declared bound: there exists a declared substrate-specific function ι_Xᵃᵈʲ(δ, ρₘₐₓ) > 0 for ρₘₐₓ below the substrate-specific calibration threshold, such that under calibration validity the adjusted MI lower bound satisfies I(mathbf{1}[mathcal{P}_X]; S_X^*) ≥ ι_Xᵃᵈʲ(δ, ρₘₐₓ). Equivalently, the adjusted weighted JS divergence remains bounded below: J(πX)(P(S_X^* | mathcal{P}_X = 1), P(S_X^* | mathcal{P}_X = 0)) ≥ ι_Xᵃᵈʲ(δ, ρₘₐₓ). Operators outside this MI/JS-preserving subclass — e.g., poorly-specified likelihood-ratio adjustments that destroy property-channel information when the nuisance model is mis-specified — are not admitted by the Bridge's theorems even if their mathrm{Err}(calib) is small in the scalar-residual sense; the operator's MI/JS-preservation property is itself part of the deployment's pre-registration declaration and is auditable at calibration time.

If BDP is declared via the regularised one-sided KL route of §1.6, κ-preservation (κ_Xᵃᵈʲ(δ, ρₘₐₓ) > 0) is admissible together with the regularity conditions that convert one-sided KL to the direct-MI / JS form; without the regularity conditions, κ-preservation alone does not suffice.

This MI/JS-preservation requirement is the formal bridge from §4.7's calibration-validity threshold to §1.6's BDP direct-MI premise: calibration-valid operators in the admitted subclass preserve the property-channel separation required by Theorems 1–5.

Falsification (testable). Under the F-Ident-5 falsifier of §5.5, a deployment whose calibration residual exceeds ρₘₐₓ — whether by over-adjustment (false negatives where property-violations are masked) or under-adjustment (false positives where confound is misattributed to property-violation) — fails the calibration-validity discipline. Falsification of calibration validity excludes the deployment from the identifiability subclass for the evaluation window in question and requires re-registration of A_(mathcal{C)}, η_(mathcal{C)}, ρₘₐₓ, and the operator's ιᵃᵈʲ profile before further admissibility claims.

The earlier "calibration honesty" framing was normative (deployment must "match the confound's actual contribution"). The validity framing is formal (residual within declared tolerance) and supplies both the operational falsifier and the MI/JS-preservation bridge to BDP.

Calibration validity is a verification gate, not an optimization target (anti-Goodhart clause). The deployment's choice of nuisance-adjustment operator A_(mathcal{C)} and parameter profile η(mathcal{C)} must be substrate-physics-justified at pre-registration: A(mathcal{C)} is selected because the substrate's confound structure (decoder, sampling, retrieval, prompt-entropy mechanics) supports that adjustment form, not because some (mathcal{A}(mathcal{C)}, η(mathcal{C)}) configuration is observed to minimise mathrm{Err}(calib) on prior data. The validity threshold ρₘₐₓ is a gate the substrate-physics-justified operator either passes or fails — it is not a target around which η(mathcal{C)} may be optimised. Optimising (A_(mathcal{C)}, η(mathcal{C)}) against the residual-minimisation objective creates a second control loop (the architecture's primary loop is its adaptive operation; a residual-optimisation loop attached to the verification gate is a separate, hidden objective) and constitutes a Goodhart-class corruption [Goodhart 1975; Manheim and Garrabrant 2018] of the calibration metric. The MI/JS-preservation requirement above acts as the orthogonal check that catches Goodhart-tuned operators: tuning η(mathcal{C)} to shrink mathrm{Err}(calib) at the cost of destroying I(mathbf{1}[mathcal{P}_X]; S_X^*) fails the MI/JS-preservation admission requirement even if the scalar residual passes. Pre-registration archives must record the substrate-physics rationale for A(mathcal{C)} alongside the operator and tolerance declarations; absence of such rationale, or post-hoc revision of the rationale to fit observed residuals, is a falsification event.

---

5. Premise-Falsification Surfaces

The conditional admissibility theorems of §3 are themselves falsifiable through their premise packages. Notational convention for §5: each F-Ident-k is evaluated under the NR-window form declared in its corresponding Theorem k premise — operator-level εT on H(0:T) for F-Ident-1; joint-pair NR-window εTᵖᵃⁱʳ for F-Ident-2; gauge-stratum ε_T(g) on H(0:T) | G=g for F-Ident-3; closure-system εT on H(S,0:T) for F-Ident-4; calibration-residual gate ρₘₐₓ for F-Ident-5 — without restating per falsifier. The work specifies five premise-falsification surfaces (named F-Ident-1..5 for historical continuity with the corpus): each operationalises a deployment-level test that, if failed, falsifies the deployment's claim to satisfy the premise package of the corresponding theorem — not the conditional implication of the theorem itself, which is an architectural-class result and not subject to single-deployment falsification. Premise failure can be of BDP (no substrate-specific ιX margin exists), calibration validity (A(mathcal{C)} degenerate or Goodhart-tuned), δₘᵢₙ mis-calibration, NR-window tightness, or compatibility-incompatibility, or Θᵈᵉᶜˡ_X varying across mathcal{E}.

5.1 F-Ident-1 — Holding-Field Property Detection Failure

Hypothesis. For deployments in the operator-internal-extended subclass with declared mathcal{P}(HF)-violation margin δ > δₘᵢₙ for any mathcal{P}(HF) ∈ {HF-FIN, HF-MON, HF-DYN, HF-COH} and declared confound profile, the violation produces detectable signature in calibration-valid nuisance-adjusted diversity statistics on Yₜ. (F-Ident-1 yields four parallel falsifier instances, one per HF sub-property; the falsification clause below applies to each instance.)

Falsification. A deployment with verified HF-FIN-violation at δ > δₘᵢₙ — verified through independent means, e.g., direct architectural audit at the privileged design-time / white-box layer (see audit-channel scope note below) — where calibration-valid nuisance-adjusted diversity statistics show no detectable signature relative to non-violation baseline beyond declared measurement noise. This falsifies the deployment's claim to satisfy the premise package of Theorem 1, indicating either (i) BDP-(iii) fails for that substrate (no ι(HF)(δ) > 0 direct MI margin exists in the substrate's emission), or (ii) the nuisance adjustment A(mathcal{C)} is calibration-invalid (Err_(calib) > ρₘₐₓ per §4.7) and masks the signature, or (iii) δₘᵢₙ is mis-calibrated, or (iv) the NR-window bound ε_T is too tight to admit the property's information. The falsification thereby refutes the deployment's HF-property claim.

Audit-channel scope note. Architectural audit — design-time inspection of the deployment's architectural specification, white-box instrumentation in synthetic or stress-test deployments where the deployment's own pre-registered specification declares the violation a priori — is a privileged channel outside the NR-ε scope. NR-ε applies only to external reconstruction from Yₜ under deployment-time observation. Pre-registered internal instrumentation that bypasses emission observation (e.g., reading a deployment's declared violation directly from its architectural specification, or instrumenting an internal trace channel that is declared as part of the experiment's privileged-access protocol) is outside the NR-ε scope by construction.

Audit-channel separation discipline (separating procedural admissibility from substantive violation verification). The privileged audit channel is used in two distinct contexts in the Bridge: (a) Procedural Admissibility Rule of §3.4.1 — checking whether the deployment's architectural specification satisfies the auditability discipline of ONTOΣ XII §4.2 (stable W → C_A map, pinned R-coverage, justified labels); (b) F-Ident-1/-4 falsification verification — confirming that a substantive property/CC violation actually occurred in a deployment under test. These two uses must be declared as separate audit-reads at pre-registration, with declared read protocols that do not share post-hoc dependencies. The procedural admissibility read is a static property of the deployment's architectural specification (does the spec satisfy XII §4.2 auditability before any test runs?); the substantive-violation read is a dynamic property of the deployment under test (does the spec declare violation in this particular stress test or scenario?). The Bridge does not claim probabilistic independence between the two read-channels (they may share the same audit infrastructure); what it requires is procedural non-collapsibility: neither read may be defined by, conditioned on, or revised in response to the outcome of the other. Under this discipline, the two reads must be reported and audited separately so that "procedurally admissible AND no detected violation" cannot be conflated with "procedurally admissible AND violation present but signature null". Single-channel audit infrastructure that does not separate these two reads is itself a procedural unevaluability per §3.4.1.

This distinction is essential to the operationalisation of F-Ident-1: a "verified HF-FIN-violation" used to test Theorem 1 must come from a substantive-violation audit-read that is separately declared from the procedural admissibility audit-read — otherwise the verification is circular (using the same channel to gate admissibility and to verify substantive content, with no way to disentangle them).

5.2 F-Ident-2 — Threshold-Straddling Admissibility Failure

Hypothesis. For two deployments with declared distinct K in threshold-straddling design, the emission-derived chaos-predicate estimator difference hatχₒₚ^((1)) - hatχₒₚ^((2)) is detectable in the calibration-valid nuisance-adjusted pair-difference statistic relative to matched-K controls.

Falsification. Two deployments with verified distinct K under threshold-straddling, where the emission-derived estimator pair (hatχₒₚ^((1)), hatχₒₚ^((2))) — operating on the calibration-valid nuisance-adjusted pair-difference statistic — is indistinguishable from matched-K controls beyond declared noise. This falsifies the deployment-pair's claim to satisfy the premise package of Theorem 2 and thereby refutes χ-REL for the deployment pair.

5.3 F-Ident-3 — Slope Admissibility Failure

Hypothesis. For deployments with declared Λ structure and declared normalisation gauge, orientation-following bias is detectable in calibration-valid nuisance-adjusted gauge-conditional output statistics within each gauge stratum.

Falsification. A deployment with declared Λ structure showing no detectable orientation-following bias in Sₛₗₒₚₑ^* = A_(mathcal{C)}(Y_(0:T); η_(mathcal{C)}, gauge) relative to gauge-baseline — where a null in at least one declared gauge stratum (with non-degenerate stratum-conditional prior πₛₗₒₚₑ(g) ∈ (πₘᵢₙ, 1 - πₘᵢₙ)) suffices to falsify T3's stratum-conditional detection claim for that stratum. This falsifies the deployment's claim to satisfy the premise package of Theorem 3 and thereby refutes Λ-CHARGE or KAC-BASE for the deployment.

5.4 F-Ident-4 — Closure-Complementarity Detection Failure

Hypothesis. Per Theorem 4 (§3.4) and the Procedural Admissibility Rule (§3.4.1), for procedurally admissible deployments claiming closure-complementarity-conformance over component collection U under emission protocol π satisfying TD-1..TD-5: (i) state-channel leakage on σ^state(π) remains within εT (closure-system NR-window per Theorem 4 premise (ii), evaluated on H(S,0:T)); (ii) substantive violations of CC-WE / CC-IIC / CC-D produce strictly positive property-channel mutual information I(σᵖʳᵒᵖX(π); mathbf{1}[CC-X]) > 0 relative to baseline(π).

Admissibility filter (precedes falsifier execution). Per §3.4.1, deployments procedurally unevaluable under ONTOΣ XII §4.2 (ambiguous W → C_A induction; post-hoc-narrowed R-coverage; unjustified terminal-or-shielded labels) are filtered out before F-Ident-4 runs. Such filtering is normative subclass-exclusion, not detection. A null result on a procedurally-unevaluable deployment is a non-event at the property-detection layer — the deployment was excluded before the test.

Falsification. A procedurally admissible deployment with verified CC-violation — where verification is via the privileged audit channel of §5.1 (architectural-specification declaration at design time, white-box internal instrumentation under pre-registered protocol, or stress-test deployment with declared CC-violation a priori) — and with the violated condition pinned to a specific X ∈ {WE, IIC, D}, under fully pre-registered π satisfying TD-1..TD-5 and the two-population sampling frame of §3.4, where the corresponding σᵖʳᵒᵖX(π) statistic matches baseline(π) within declared substrate-noise and replication-ensemble thresholds. This falsifies the deployment's claim to satisfy the premise package of Theorem 4 part (ii) for the deployment, indicating either (a) BDP-(iii) fails for that substrate's CC condition, (b) calibration validity per §4.7 is violated, or (c) δₘᵢₙ is mis-calibrated. The falsification thereby refutes CC-X for the deployment.

The verification clause is architectural-class and does not require empirical causal-mechanism inspection beyond architectural-specification declaration; this is consistent with the §6.1 commitment that the Bridge does not import substrate-specific empirical instrumentation apparatus.

5.5 F-Ident-5 — Calibration-Validity Failure

Hypothesis. Per §4.7, a deployment's nuisance-adjustment operator A_(mathcal{C)} is calibration-valid for an evaluation window iff mathrm{Err}_(calib) ≤ ρₘₐₓ, where ρₘₐₓ is the pre-registered tolerance declared at OSF before evaluation.

Falsification. A deployment whose observed calibration residual mathrm{Err}(calib) exceeds the declared ρₘₐₓ — whether through over-adjustment (false negatives at rates exceeding statistical threshold) or under-adjustment (false positives at rates exceeding statistical threshold), evaluated across the pre-registered ensemble of test cases with known property status — fails calibration validity. Failure excludes the deployment from the identifiability subclass for that evaluation window and requires re-registration of A(mathcal{C)}, η_(mathcal{C)}, and ρₘₐₓ before further admissibility claims can be made.

Calibration-validity falsification differs from BDP falsification (Theorems 1–4): a BDP failure refutes the existence of a substrate-relative direct MI / JS-separation margin ι_X(δ) under the architectural class; a calibration failure refutes only the deployment's specific operator-and-tolerance declaration, leaving BDP at the class level untouched.

Joint-vector compatibility failure (T5 Separate-declaration). F-Ident-5 also covers a class of failure where per-component calibration residuals each pass ρ(max,k) individually AND each per-component compatibility ιₖᵃᵈʲ ≤ ε_T^X holds, but the joint-vector compatibility constraint of T5 (vii) under Separate-declaration fails: I(mathcal{E)ʲᵒⁱⁿᵗ}(mathbf{1}[mathbf{P}]; mathbf{S}^*) > εT^(CC,joint). The deployment has per-component admissibility but no joint-vector admissibility on H(S,0:T). Falsification of this kind excludes the deployment from T5's vector-level state-leakage claims under Separate-declaration (per-component claims remain admissible if individually verified).

5.6 Pre-Registration Discipline

All five falsifiers operate under the pre-registration discipline of ONTOΣ XI §10 and IIC v2.1 §5.5: full protocol (statistic specification, nuisance-adjustment operator declarations and any scalar-discount-function form where applicable, threshold values, exclusion criteria) registered on OSF before data collection; public reporting of all outcomes regardless of direction; statistical pre-specification of detection thresholds; independent-replication invitation. Post-hoc adjustment of any calibration parameter falsifies the protocol.

5.7 What §5 Establishes and Does Not

§5 establishes that the identifiability bridge is itself open to deployment-level falsification — that the theorems make testable claims about what should be observable in calibration-valid nuisance-adjusted output statistics, and that specific failure modes of those claims can be specified in pre-registerable form. It does not establish that the falsifiers have been executed; the protocols, like those of IIC v2.1 §5, are awaiting collaboration partners and registration.

The present work states the sufficient conditions under which non-vacuousness would be established: if at least one substrate satisfies BDP + non-degenerate prior + NR-window + calibration-validity simultaneously, then the identifiability subclass is non-empty. This work defines the non-vacuity condition; it does not establish non-vacuousness itself. The conditional form is what the Bridge's theorems supply. Substrate-level existence proof — a direct demonstration that a concrete substrate satisfies all four premises with a positive ι_X(δ) separation margin — is not established here; it is owed in companion substrate-specific work or in deployment-side falsifier execution. The existence of IIC v2.1's first-instance EVS deployments (∆E 4.7.3b control-grade, Minerva operator-grade conditional) supplies motivation for the conditional-non-vacuousness claim but does not constitute a theorem-level existence proof for the identifiability subclass.

---

6. Limits and What This Work Is Not

6.1 What This Work Is Not

This work is not a full state-reconstruction theory. NR-ε prohibits state reconstruction beyond the declared leakage bound, and the present work explicitly does not violate that prohibition. The bridge supplied here is property-detection, not state-recovery; the two are formally distinct.

This work is not a substitute for substrate-specific empirical instrumentation. The theorems specify the architectural form of identifiability bridges; substrate-specific calibration of ι_X(δ), δₘᵢₙ, and the nuisance-adjustment operator is deployment-side work, not architectural-class derivation. A language-model substrate's identifiability protocol differs in calibration from a control substrate's protocol; both inherit the architectural form supplied here.

This work is not a treatise on classical statistical identifiability. It does not derive identifiability theorems in the sense of mathematical statistics (where identifiability is a property of parametric models with well-defined likelihood structures). The architectural-class register of the present work treats identifiability as the structural admissibility of property-detection under NR-window + BDP + calibration-valid nuisance adjustment, not as a parametric-model identification problem.

This work is not a comparative analysis vs causal inference, do-calculus (cf. [Pearl 2009]), or system identification literature. Such comparison is owed at the theoretical-class level and is outside the scope of the present formal bridge.

This work is not a unified theory of observability. The architectural class to which the bridge applies is the operator-internal-extended subclass (and the closure-complementarity subclass) of NC2.5 v2.1 / ONTOΣ XI / ONTOΣ XII / IIC v2.1. Architectures outside these subclasses — those that decline NR-ε, decline operator-internal commitments, or decline closure-complementarity — have their own observability profiles outside the scope of the present theorems.

6.2 The Quantitative-Bound Limit

The direct MI lower bound ι(HF)(δ) in Theorem 1 is named here as architecturally specifiable, not analytically derived in closed form. Specific quantitative bounds — what ι(HF)(δ) is for a Gaussian-perturbed token-emission substrate with Boltzmann decoder and given (δ, ε_T) — are substrate-specific and require dedicated technical derivation. The present work supplies the architectural form; specific bounds are owed in substrate-specific follow-up papers.

The same applies to the other detectability margins in Theorems 2–5. The architectural-class register specifies that the margins exist and are positive under the stated conditions; quantitative tightness is owed.

Privileged audit-channel operational specification (owed). The privileged audit channel of §5.1 (design-time / white-box inspection of the deployment's architectural specification, declared as outside the NR-ε scope by construction) is specified at the architectural-class level — the role of the channel, its scope boundary against external reconstruction, and the procedural non-collapsibility between procedural-admissibility and substantive-violation reads. Its concrete operational realisation — the engineering / inspection / instrumentation apparatus by which a given substrate's deployment supplies the privileged audit read — is substrate-specific and owed in companion work. Open questions on the audit channel: realisability under partial-trust deployment relationships, formalisation of the white-box / black-box boundary in mixed-deployment substrates, and verifiability of the audit reader itself. These are continuing-programme items, not gaps in the present bridge's architectural-class claims; the present work commits only to the structural role of the channel, not to any specific implementation.

Dependency note for F-Ident-1 / F-Ident-4. Because §5.1's procedural non-collapsibility discipline and §5.4's substantive-violation verification both ground falsifier execution on the privileged audit channel, the falsifier executions of F-Ident-1 and F-Ident-4 are themselves conditional on a substrate-specific operational realisation of the audit channel — analogous to how the Bridge's Theorems are conditional on BDP being instantiated for the substrate. Until the audit-channel operational realisation is supplied per substrate, F-Ident-1 / F-Ident-4 executions at deployment level require declared substitute verification protocols, themselves pre-registered under the pre-registration discipline of §5.6. The architectural-class commitments of §5.1 (procedural non-collapsibility; single-channel infrastructure = procedural unevaluability) remain in force as goal-state requirements — substrates that cannot supply two procedurally non-collapsible audit reads even via declared substitute protocols are excluded from admissibility for F-Ident-1 / F-Ident-4 evaluation until the operational specification is owed. The Bridge therefore does not claim black-box falsifier executability for F-Ident-1 / F-Ident-4 absent a declared audit-channel implementation — these two falsifiers are explicitly privileged-channel-conditional and not purely emission-stream-observational, in contrast to F-Ident-2 / F-Ident-3 / F-Ident-5 which operate on Yₜ alone.

6.3 The Confound-Calibration Limit

The calibration-validity discipline of §4.7 (mathrm{Err}_(calib) ≤ ρₘₐₓ) is testable through F-Ident-5 but requires accurate declaration of the confound profile by the deployment. Architectures that misdeclare confounds — declaring lower confound contribution than actual, in order to inflate apparent property-detection signal — produce false-positive identifications that would be revealed only through F-Ident-5 ensemble testing against the pre-registered ρₘₐₓ threshold.

The architectural defence against confound misdeclaration is the pre-registration discipline (declarations fixed before evaluation, post-hoc adjustment of A_(mathcal{C)}, η_(mathcal{C)}, or ρₘₐₓ is a falsification event). The defence is procedural rather than information-theoretic; deployments that violate the procedural discipline are excluded from the identifiability subclass on procedural grounds.

6.4 The Cross-Substrate Identifiability Limit

The theorems address identifiability within a single substrate's emission channel. Cross-substrate identifiability — comparing operator-internal architecture across deployments in different substrates (language, control, perception) — requires additional apparatus (canonical-form mappings between substrates' emission channels) that the present work does not supply. Substrate-specific identifiability bridges admit the theorems here as their architectural floor; cross-substrate comparability is owed.

6.5 What v2.1 Already Contains and Where the Present Work Stops

The present work depends on NC2.5 v2.1 for NR-ε (T87), on ONTOΣ XI for the operator-internal apparatus, on ONTOΣ XII for closure-complementarity, and on IIC v2.1 for the operator-reference normalisation discipline. Every primitive used here is from those works. The contribution is the bridge that operationalises their falsification surfaces; no new architectural axiom is introduced.

The present work stops at the architectural-class level of identifiability. It does not extend into:

• Specific quantitative bounds (substrate-specific work).
• Empirical execution of the falsifiers (deployment-side work).
• Cross-substrate canonical-form analysis (separate scholarly work).
• Comparative positioning vs other identifiability traditions (separate review).

The work's reach is the architectural-class identifiability bridge for the operator-internal-extended subclass. That is the contribution; everything else is subject to future work.

---

7. Continuing Programme — Where the Open Tasks Are Addressed

The present work is presented as a conditional architectural-class identifiability bridge, complementary to ONTOΣ XI / XII and IIC v2.1. Its empirical content lies in the falsification surface (§5) and in the architectural commitment that the property-detection bounds are positive under calibration-valid nuisance adjustment. Several items lie outside the scope of the present formal paper. This section names them.

• Quantitative bound derivations. The substrate-relative MI lower bounds ι_X(δ) for each property class X and analogous detectability margins of Theorems 1–5 are architecturally specified but not derived in closed form. Owed: substrate-specific quantitative-bound papers (one per substrate class — language-model, control, perception, semantic) deriving the closed-form bounds under explicit substrate assumptions.

• Substrate-specific identifiability protocols. §3.4 addresses substrates with component-level emission attribution; substrates without such attribution rely on Theorem 5's composite statistics. Owed: substrate-specific identifiability protocols for biology (cell-component emission), perception (sensory-feature emission), language (token-component emission), control (motor-component emission), and other substrates of ONTOΣ XII §5.

• Empirical execution of the five falsifiers. Where in the corpus: the protocols are pre-registration-ready in §5; execution awaits collaboration partners. Owed: registered protocol execution and public reporting under the pre-registration discipline.

• Cross-substrate canonical-form analysis. Comparing operator-internal architecture across deployments in different substrates requires canonical-form mappings between emission channels. Owed: a separate cross-substrate identifiability paper.

• Comparative-class positioning. Where in the corpus: IIC v2.1 §4.2 names parallel constraints from independent traditions (Ostrom, Friston, Kauffman, Meadows). Owed: a structured comparative analysis vs causal inference, do-calculus, classical statistical identifiability, and the system-identification literature.

• Mediated falsifiability. The identifiability bridge's deepest commitment — that property-detection is admissible under NR-ε with positive mutual information — is falsifiable mediated through the five F-Ident- protocols of §5. This is the same architectural structure as ONTOΣ XI §8.2 and IIC v2.1 §5: deepest commitments falsifiable through unfoldings, not through direct test of the underlying ontology. The structure is mediated falsifiability, named explicitly here.

• Pre-registration governance. §4.6 inherits the pre-registration discipline from ONTOΣ XI §10 and IIC v2.1 §5.5. Owed: operational governance documentation specific to identifiability protocols (declaration archives for confound profiles, nuisance-adjustment operator declarations and their substrate-physics rationale per §4.7's anti-Goodhart clause, δₘᵢₙ substrate-physics declarations per architectural class, calibration-validity records, MI/JS-preservation profiles, replication standards). The substrate-physics-rationale requirement of §4.7's anti-Goodhart clause extends, by the same logic, to the δₘᵢₙ choice: δₘᵢₙ must be set by substrate-physics arguments about what constitutes a substantively detectable violation margin in the substrate's emission, not by post-hoc accommodation of measurement-noise levels.

• Cross-deployment threshold-consistency audit (archive-level, distinct from per-deployment governance above). Per-deployment δₘᵢₙ substrate-physics justification at declaration time is part of the pre-registration governance bullet above (and inherits the §4.7 anti-Goodhart clause's substrate-physics-rationale requirement). The present bullet adds a distinct, archive-level owed item: a class-level δₘᵢₙ drift-detection discipline across the registration archive. A long-horizon governance risk is definitional drift — successive deployments declaring progressively relaxed δₘᵢₙ each individually substrate-physics-justified at declaration time, but collectively trending toward measurement-noise-floor accommodation and rendering the architectural-class membership criterion meaningless. Owed: archive-level audit protocols that detect this trend across deployments and substrates (statistical comparison of δₘᵢₙ declarations against substrate-noise baselines and against prior δₘᵢₙ declarations for the same architectural class). Drift detection across the archive is a governance falsifier orthogonal to F-Ident-1..5 — it falsifies neither a specific theorem nor a specific deployment, but the class-level coherence of the subclass-membership criterion across time.

The present work supplies the architectural-class identifiability bridge. The continuing programme above supplies the quantitative, substrate-specific, empirical, comparative, and governance work that surrounds it. The corpus position is that the formal bridge and the continuing programme are jointly sufficient — and that the present moment is the public articulation of the bridge, not the closing of the programme.

---

8. Closure

NR-ε said what cannot be reconstructed. The falsification surfaces of ONTOΣ XI §8, ONTOΣ XII §6, and IIC v2.1 §5 said what should be testable. The present work supplied the bridge between them: the reconstruction-versus-detection distinction, formalised through admissibility conditions on output statistics and the calibration-valid nuisance-adjustment discipline (§2.4 / §4.7).

The five identifiability theorems establish that the falsification surfaces of the architectural-class corpus are conditionally operationally admissible under the explicit premises declared here (BDP, NR-window, pre-registered ensemble discipline, calibration-valid nuisance adjustment). Property-channel detection is bounded above by NR-ε state-channel leakage (by DPI for internal-trajectory predicates) and bounded below by the BDP direct-MI separation margin ι_X(δ) > 0 — bounded but not annihilated where state-reconstruction is forbidden. The identifiability bridge is the formal articulation of that bounded-leakage detection regime, conditional on the explicitly declared architectural premises.

What remains open is owed: the substrate-specific, empirical, comparative, and governance work enumerated in §7 — quantitative bounds, substrate-specific protocols, empirical execution of the five falsifiers, comparative analysis, cross-substrate canonical forms, pre-registration governance documentation, and archive-level threshold-consistency drift audit. These are continuing programme items. The bridge itself, in architectural-class form, is now in the corpus.

This paper supplies the formal admissibility schema for operationalising the falsification surfaces of the architectural-class works. Together with ONTOΣ XI (interior), ONTOΣ XII (constitution), IIC v2.1 (cycle), and the consolidating Why Long-Horizon Existence Requires an Ontology (programme), the corpus now has explicit admissibility conditions for its property-detection claims under NR-ε. The next steps belong to deployment-side work, to substrate-specific calibration, and to NC2.5 v3.0 consolidation.

---

References

The present work's formal substance is grounded in the NC2.5 v2.1 / ONTOΣ XI / ONTOΣ XII / IIC v2.1 corpus (referenced inline by section throughout). The external references below are cited only for standard information-theoretic apparatus invoked in the bridge construction or for demarcation of out-of-scope traditions; they do not import any external theoretical commitment.

• Cover, T. M., and Thomas, J. A. (2006). Elements of Information Theory, 2nd ed. Wiley-Interscience. — Standard reference for mutual information and the data-processing inequality invoked throughout §1.5–§3.
• Lin, J. (1991). Divergence measures based on the Shannon entropy. IEEE Transactions on Information Theory, 37(1), 145–151. — Introduces the π-weighted Jensen–Shannon divergence used in BDP's equivalent formulation (§1.6).
• Csiszár, I., and Shields, P. C. (2004). Information Theory and Statistics: A Tutorial. Foundations and Trends in Communications and Information Theory, 1(4), 417–528. — Background for the Pinsker / reverse-Pinsker regularity conditions invoked in §1.6's Status of one-sided KL.
• Goodhart, C. A. E. (1975). Problems of monetary management: The U.K. experience. In Papers in Monetary Economics, Vol. I. Reserve Bank of Australia. — Original statement of the pattern formalised in §4.7's anti-Goodhart clause.
• Manheim, D., and Garrabrant, S. (2018). Categorizing variants of Goodhart's law. arXiv preprint arXiv:1803.04585. — Modern taxonomy of Goodhart effects; complements the §4.7 anti-Goodhart clause's structural characterisation.
• Pearl, J. (2009). Causality: Models, Reasoning, and Inference, 2nd ed. Cambridge University Press. — Canonical reference for the causal-inference / do-calculus tradition demarcated as out-of-scope in §6.1.

---

Footer

MxBv, Poznań, Poland.
The Urgrund Laboratory.
Maksim Barziankou (MxBv) — PETRONUS — research@petronus.eu
May 2026.
CC BY-NC-ND 4.0.
Identifiability Bridge: Conditional Admissibility Theorems for Property Detection under Non-Reconstructibility within Navigational Cybernetics 2.5.

Companions in the corpus:

• ONTOΣ XI — Two Sides of One Geometry: The Holding Field and the Architecture of Chaos (DOI: 10.17605/OSF.IO/U3KXJ)
• ONTOΣ XII — Closure-Complementarity: How Closure Regears Component Cycles into a Single Geometry (DOI: 10.17605/OSF.IO/394TX)
• IIC v2.1 — A Class-Relative Structural Law of Adaptive Behaviour as a Theorem within Navigational Cybernetics 2.5
• Why Long-Horizon Existence Requires an Ontology — Dissecting Navigational Cybernetics 2.5 (DOI: 10.17605/OSF.IO/MSJDU)

This work DOI: 10.17605/OSF.IO/3F6UJ
Grounded in the formal core of Navigational Cybernetics 2.5 v2.1, axiomatic core DOI: 10.17605/OSF.IO/NHTC5.

A consolidating revision (NC2.5 v3.0) gathering the apparatus of this and adjacent works is in preparation; the present work is grounded in v2.1 and remains compatible with the future v3.0 consolidation.

© 2026 Maksim Barziankou. Licensed under CC BY-NC-ND 4.0.