# Paired recovery: what an all-negative record can exclude

Companion to **When can a negative recovery assay exclude a recoverable subpopulation? Sharp coverage, stage mismatch and allocation bounds for paired observations** (17 September 2026). Manuscript SHA-256: `6b957282b3d264241c9e0c6a5636a45e73229a71721ce5fecd9942089b48302b`.

A negative record may mean no recoverable units were present, or that the experiment did not observe their recovery. This package connects explicit two-stage source assumptions to a sharp detection floor, allocation design, exact sample-size checks and a conditional all-negative decision. It does not estimate those assumptions from the synthetic example or identify non-detection with death.

## Run and inputs

```sh
python -m venv .venv
# Windows: .venv\Scripts\activate
# macOS/Linux: source .venv/bin/activate
python -m pip install -r requirements.txt
python -m unittest -v test_example.py
python example.py --output outputs
```

Python 3.11+; pinned dependencies, no network or external data. Runtime is a few seconds. The ZIP includes code, tests, setup guide, generated tables and figures. Source/manuscript/output hashes are in `run_metadata.json`.

The top input block contains coverage c, mismatch bound D, conditional recording floor kappa, exceptional recoverable mass eta, calibration-failure allowance delta, target recoverable fraction theta, total error alpha, both group sizes and positive/unevaluable counts. Reference task, eligible population, exposure, activation deadline and observation deadline are declared separately. Their default descriptions and numbers are **synthetic placeholders**, not properties of an actual assay. The clocks identify the events to which the stage probabilities refer; the model does not infer those probabilities from elapsed time.

All probability inputs use rational strings. Coverage naturally ranges from 0 to **2**, because it bounds a sum across two conditions. The default c=0.95, D=0.5, kappa=0.9, eta=0.05, delta=0.01, theta=0.01, alpha=0.05 reproduces the 2,300-unit planning row. Raising c to 1.5 with the other robust inputs fixed reproduces 750 units.

## Components and reuse

* `TwoStageType` owns activation, conditional progeny and conditional recording probabilities in both conditions. `terminals` derives the five normalized outcomes: non-target, no activation, no progeny, unrecorded completed path, recorded positive. The stage product is the chain rule, not an independence assumption between stages.
* `CoverageContract` implements the full-range sharp floor, the three-regime allocation profile and an explicit attaining source for every allocation weight. It constructs the least detectable population including invisible exceptional types.
* `TypePopulation` mixes types conditional on reference recoverability. It checks per-type stage coverage and conditional recording, and either a uniform or a covered-population mean-square mismatch budget. It exposes actual per-condition responses and the correctly activation-weighted pooled second-stage conditional.
* `Allocation` keeps the fixed-count likelihood distinct from independently randomized assignment. `NegativeHistoryLaw` enumerates short complete negative histories under a history-dependent policy, including terminal failure-stage information. Its explicit leaf budget prevents pretending a truncated tree is an exact law.
* `NegativePlanner` computes finite feasibility, minimal random-assignment and balanced sample sizes, exact neighboring power comparisons, an outward interval confidence endpoint, and a record decision. Large rational powers raise `ExactBudgetExceeded` rather than silently returning an approximate integer certificate.

Example:

```python
from fractions import Fraction as F
from example import CoverageContract, NegativePlanner, Allocation

contract = CoverageContract(c='3/2', mismatch='1/2', kappa='9/10', eta='1/20')
planner = NegativePlanner(contract.recorded_floor, theta='1/100', delta='1/100', alpha='1/20')
print(planner.plan())
print(contract.witness(F(1,3)))

# The flag asserts an externally established contract; it does not perform calibration.
print(planner.record(Allocation(375,375), positives=0, unevaluable=0,
                     contract_validated=True))
```

For direct calibration of recorded recovery probability g, instantiate `NegativePlanner(g=...)` without a two-stage contract. The same sampling assumptions still apply. A representative reference-positive calibration must not select units merely because the test already detected them.

## The sharp source result

For each covered recoverable type, x+a≥c and y+b≥c. Within condition 1, mismatch is bounded uniformly by d or in conditional mean square by D². Put h=min(c,2−c) and t=min(D,h). The equally weighted complete-path floor is

`R=(c²−t²)/4`, and recorded floor `g=(1−eta) kappa R`.

The balanced attaining source is `((c+t)/2,(c−t)/2,(c−t)/2,(c+t)/2)`, whose two path products both equal R. Invisible exceptional mass and recording exactly kappa then attain u=v=g. Exact assertions verify these constructions rather than only plotting a lower bound.

For c≤1, the floor is `max(0,c²−D²)/4`. For c>1, it is at least c−1 even without useful mismatch information. The apparent 1/4 ceiling belongs to the restricted domain. At c=2, all four stage probabilities are one, the floor is one, and every allocation has the same response.

For a fixed random allocation weight w, `profile(w)` returns the exact minimum of wxy+(1−w)ab. Its three regimes depend on |2w−1|c relative to h−t and h. When t<h and c>0, balance is uniquely maximin. When t=h, a plateau may remain; at c=1.5,d=0.5 it spans w∈[1/3,2/3]. The code tests degenerate endpoints separately. Numerical dots solve the original four-variable constrained problem from several starts, independently of the piecewise formula. They are diagnostics, while exact rational witnesses establish attainment at the displayed inputs.

The nonbalanced profile is a **uniform per-type mismatch** result. The equal-weight RMS theorem does not automatically supply the same nonbalanced profile for heterogeneous populations under only a mean-square constraint. The two APIs and documentation retain that distinction.

## Heterogeneity and the sampling law

Mean-square mismatch is taken within the covered **recoverable** population, with its own normalized weights. A rare badly mismatched type is allowed if that average remains within budget. Averaging stage means separately is inadequate: equal mixtures of (x,y)=(1,0) and (0,1), with complementary partners, have E[x]=E[y]=1/2 but zero completed paths. The pooled conditional progeny probability is E[xy]/E[x]=0, not E[y]=1/2. Off-path second-stage probabilities when activation is zero are structural assumptions, not observed conditional frequencies.

For independent eligible units and fixed group sizes n1,n2, actual all-negative mass is `(1−p u)^n1 (1−p v)^n2`. Independently random assignment instead gives `(1−p(wu+(1−w)v))^n`. Substituting an observed allocation fraction into the latter does not reproduce the former. At even n, the fixed balanced law is no worse than equal random assignment for a fixed response pair. The library refuses to apply its balanced certificate to an unbalanced fixed record.

On the least detectable source u=v=g, no policy assigning **fresh independent units** can improve the minimax all-negative mass. A short exact history-tree example permits choices based on previous negative terminal stages and confirms the same product. This does not rule out benefits on other sources, switching conditions within one unit, or adding a different readout. Those interventions need new causal assumptions.

## Planning and record decisions

The worst-case total false-certificate probability is

`delta+(1−delta)(1−theta g)^n`.

The source and sampling guarantee must hold conditionally in every good calibration environment. This formula does not assume independence of calibration and the future experiment, but an unadjusted marginal confidence interval alone does not establish its premise. Shared physical run failure also has a persistent floor; it should not be silently identified with or added to delta without specifying their relationship.

The default exact floor is R=261/1600 and g=44631/320000. Exact rational powers prove 2,300 units succeed and 2,299 narrowly fail: total errors are approximately 0.0499494 and 0.0500052. The all-negative confidence endpoint is approximately 0.0099961, enclosed by outward interval arithmetic. The full-range row has g=171/400, random-assignment minimum 749 and balanced minimum 750. The five reproduced balanced rows are 1598,1836,2148,2300,750.

Finite balanced feasibility requires theta g>0 and delta<alpha, except that theta g=1 permits delta=alpha too. The latter has random minimum one and balanced minimum two; the logarithmic confidence-endpoint formula is unavailable when delta=alpha, even though the target exclusion edge is valid. Zero detection floor or an excessive calibration allowance cannot be repaired by adding units.

The main run reports `conditional calculation only` for the synthetic record. It also shows what the conclusion would be **if** the explicit contract were established. The library's `contract_validated=True` flag is a caller-supplied premise, not an empirical validation routine. Positive or unevaluable records return no all-negative certificate and the uninformative endpoint one. Lost units are not removed to manufacture a smaller clean denominator. Unknown/blocked contract conditions return an unavailable endpoint rather than a numeric assertion.

An exclusion concerns the declared reference-recoverable fraction in the stated eligible population. It is a repeated-sampling error guarantee, not a posterior probability of sterility, a claim that a particular negative unit is dead, or a killing curve relative to an original exposed population. Changing eligibility changes the denominator.

## Finite follow-up and outputs

`finite_followup.csv` constructs a single observable cumulative event law r(t) with two different recoverable fractions, 0.2 and 0.8. Their conditional detection CDFs differ, with the unseen remainder placed after the deadline, while pF(t) agrees throughout the observed interval. The compatible set is [r(T),1]. Timing normalized only among detected positives agrees as well and cannot identify the missing denominator.

`allocation.csv` records exact-form profile values, attaining source coordinates and independent numerical minima. `planning.csv` reproduces the five synthetic rows. `results.json` separates source checks, hypothetical planning, actual record status, pooled-summary obstruction and adaptive-history calculation. The PNG/SVG figures visualize the full coverage range, allocation regimes and calibration floor.

Seven test groups verify exact profile attainment, 625 independent rational source points, RMS versus uniform mismatch, normalized path masses, fixed/random sampling distinctions, exact integer neighbors and perfect-detection edges, adaptive negative histories, and loss/denominator handling. These finite checks support the implementation; the manuscript supplies the general inequalities. **Lean is not rerun.** No experimental data, calibrated assay sensitivity or biological death definition is supplied.

## License

MIT is proposed for the newly authored example, pending owner confirmation. This note does not grant a license. The manuscript and cited material retain their own terms.