feat(analysis): bind Pareto candidate-K selection to an analysis-run profile

CHANGELOG.md

@@ -38,6 +38,8 @@ All notable changes to TEPP are documented here. The format follows Keep a Chang
 
 ## [Unreleased]
 
+- **Pareto candidate-`K` analysis-run profile**: cutoff-safe `pareto_candidate_k_v1` binds `select_candidate_k` and selected-`K` RMSE and refuses LLM-vote authority (`analysis_engine`). Not Schwarz fitted selection, not a Bayesian sampler, and not implemented-main.
+
 - `event_core` adds bounded Allen interval-consistency classification, atomic path-consistency closure, contradiction/resource refusals, and an explicit dependency-error fallback without claiming unrestricted global satisfiability.
 
 - `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, Table 2, p. 12 `MANIFESTTRAITVAR`; §7.1, p. 19; p. 16 `MANIFESTTRAITVARstd`; footnote 4; 2017-era ctsem `summary.ctsemFit.R`; JSS PDF re-opened 2026-08-27T14:20Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar standardised manifest-trait variance on current main after `0ce16e8` dropped the pre-consolidation code while research notes already named the map (register items 83–84). Table 2 names `MANIFESTTRAITVAR` `Ψ_τ` the additional time-invariant variance-covariance on the measurement level and sets it `NULL` when there is no manifest trait. Equation 5 writes `Γ ~ N(τ, Ψ)` and names that covariance the manifest traits. Section 7.1 names manifest traits stable individual differences in indicator levels, distinct from process-level `TRAITVAR` `φ_ξ`. Page 16 prints standardised matrices with the suffix `std` when appropriate. The printed example on p. 16 is `discreteDRIFTstd`, not `MANIFESTTRAITVARstd`. Footnote 4 standardises using only the relevant variance, not the total. The relevant variance for that named indicator-level correlation is `MANIFESTTRAITVAR`, not process-level `TRAITVAR` and not residual `MANIFESTVAR` `θ`. The 2017-era source forms `MANIFESTTRAITVARstd` only when `MANIFESTTRAITVAR != 0`, as `solve(sqrt(diag(MANIFESTTRAITVAR) + ridging)) %&% MANIFESTTRAITVAR` when `verbose = TRUE`. OpenMx `%&%` is `t(A) %*% B %*% A`. Unlike `TRAITVARstd`, that formation adds `diag(c(ridging), n.manifest)`. The default `ridging = FALSE` adds 0, not `0.0001`; that ridge is a numerical hack and is not this exact map. The scalar correlation is `ψ / ψ = 1` after strictly positive `MANIFESTTRAITVAR`. Form strictly positive `ψ` first, then `1 / √ψ`, then `(1 / √ψ) ψ (1 / √ψ)`. Unstandardised `MANIFESTTRAITVAR` is defined for a zero trait; standardised `MANIFESTTRAITVAR` is not. Zero `MANIFESTTRAITVAR` skips forming `MANIFESTTRAITVARstd` in the 2017-era source and fails closed here. Indicator-level trait variance is an event-time structural quantity, so a non-event clock fails closed. `MANIFESTTRAITVAR` does not require stable `a < 0`. Distinct positive `ψ` recover the same 1. `trait / trait = 1` is `TRAITVARstd` and recovers the same number and remains a distinct named quantity. `θ` is `MANIFESTVAR` and is measurement error, not this correlation. Meredith (1993) remains unread (web search 2026-08-27T14:20Z: Springer/Cambridge Core paywalled; Unpaywall historically `is_oa: false`; Springer `content/pdf` is an HTML stub). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread on the same terms (DOI `10.1007/bf02294457`). Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation.

crates/analysis_engine/Cargo.toml

@@ -15,6 +15,7 @@ publish = false
 
 [dependencies]
 event_core = { path = "../event_core", version = "0.2.0" }
+model_selection = { path = "../model_selection", version = "0.2.0" }
 serde = { workspace = true }
 serde_json = { workspace = true }
 sha2 = { workspace = true }

crates/analysis_engine/src/lib.rs

@@ -8,13 +8,17 @@
 //! through [`tepp_api`]. It deliberately does not claim latent-variable or topic
 //! estimation authority; those estimators remain separate scientific crates.
 //! estimation authority; it invokes estimators through their scientific crate
-//! contracts and preserves their artifact meaning.
+//! contracts and preserves their artifact meaning. Pareto candidate-`K`
+//! selection is invoked through [`model_selection`] and is not a Bayesian
+//! sampler.
 
 mod case_deletion_refit;
 mod lineage_criterion;
+mod pareto_candidate_k_artifact;
 mod topic_context_posterior;
 mod topic_lineage_artifact;
 
+use model_selection::ModelSelectionError;
 use serde::Serialize;
 use sha2::{Digest, Sha256};
 use std::collections::BTreeSet;
@@ -46,6 +50,13 @@ pub use lineage_criterion::{
     LineageCriterionFit, LineageCriterionFitError, LineageCriterionObservation,
     fit_lineage_criterion_posteriors,
 };
+/// Pareto candidate-`K` artifact and execution contracts from this engine.
+pub use pareto_candidate_k_artifact::{
+    PARETO_CANDIDATE_K_ARTIFACT_BYTE_LIMIT, PARETO_CANDIDATE_K_ARTIFACT_SCHEMA_VERSION,
+    PARETO_CANDIDATE_K_MODEL_CONTRACT_VERSION, PARETO_CANDIDATE_K_OUTPUT_PROFILE,
+    ParetoCandidateKArtifact, ParetoCandidateKExecution, ParetoCandidateKInput,
+    execute_pareto_candidate_k_run,
+};
 /// Bounded posterior topic-context producer contract and record types.
 pub use topic_context_posterior::{
     TOPIC_CONTEXT_POSTERIOR_BYTE_LIMIT, TOPIC_CONTEXT_POSTERIOR_SCHEMA_VERSION,
@@ -248,6 +259,10 @@ pub enum AnalysisEngineError {
     TopicMeasurement(TopicMeasurementError),
     /// A topic-lineage artifact violated its bounded schema or count invariants.
     InvalidTopicLineageArtifact,
+    /// A model-selection gate rejected the offered candidates or method.
+    ModelSelection(ModelSelectionError),
+    /// A Pareto candidate-`K` artifact violated its bounded schema or counts.
+    InvalidParetoCandidateKArtifact,
 }
 
 impl fmt::Display for AnalysisEngineError {
@@ -262,6 +277,8 @@ impl fmt::Display for AnalysisEngineError {
             Self::LimitExceeded => "analysis corpus exceeded its execution bound",
             Self::TopicMeasurement(error) => return error.fmt(formatter),
             Self::InvalidTopicLineageArtifact => "invalid topic lineage artifact",
+            Self::ModelSelection(error) => return error.fmt(formatter),
+            Self::InvalidParetoCandidateKArtifact => "invalid pareto candidate-k artifact",
         };
         formatter.write_str(message)
     }
@@ -281,6 +298,12 @@ impl From<TopicMeasurementError> for AnalysisEngineError {
     }
 }
 
+impl From<ModelSelectionError> for AnalysisEngineError {
+    fn from(error: ModelSelectionError) -> Self {
+        Self::ModelSelection(error)
+    }
+}
+
 /// Execute the cutoff-safe temporal evidence readiness analysis.
 ///
 /// Evidence whose `available_time` is later than the request cutoff is excluded
@@ -413,7 +436,8 @@ mod tests {
     use super::{
         ANALYSIS_ARTIFACT_SCHEMA_VERSION, ANALYSIS_STATISTIC_COUNT, AnalysisCorpus,
         AnalysisEngineError, AnalysisEvidenceUnit, MAX_ANALYSIS_IDENTIFIER_BYTES,
-        MAX_EVIDENCE_UNITS, TopicMeasurementError, add_membership_count, execute_analysis_run,
+        MAX_EVIDENCE_UNITS, ModelSelectionError, TopicMeasurementError, add_membership_count,
+        execute_analysis_run,
     };
     use temporal_core::{AvailableTime, EventTime};
     use tepp_api::{AnalysisRunAccepted, AnalysisRunRequest, AnalysisRunTerminalState, ApiError};
@@ -681,6 +705,14 @@ mod tests {
                 AnalysisEngineError::InvalidTopicLineageArtifact,
                 "invalid topic lineage artifact",
             ),
+            (
+                AnalysisEngineError::InvalidParetoCandidateKArtifact,
+                "invalid pareto candidate-k artifact",
+            ),
+            (
+                AnalysisEngineError::ModelSelection(ModelSelectionError::EmptyCandidateSet),
+                "empty model-selection candidate set",
+            ),
         ];
         for (error, message) in messages {
             assert_eq!(error.to_string(), message);
@@ -689,6 +721,12 @@ mod tests {
         assert_eq!(converted.to_string(), "invalid API wire payload");
         let from_topic: AnalysisEngineError = TopicMeasurementError::DidNotConverge.into();
         assert_eq!(from_topic.to_string(), "topic estimator did not converge");
+        let from_selection: AnalysisEngineError =
+            ModelSelectionError::LlmVoteIsNotStatisticalAuthority.into();
+        assert_eq!(
+            from_selection.to_string(),
+            "llm vote is not statistical authority"
+        );
         assert_eq!(
             add_membership_count(u64::MAX, 1),
             Err(AnalysisEngineError::ArithmeticOverflow)