Repository navigation
scientific(longitudinal): preserve time-varying cross-classified membership in CWC admission #604
Description
Scientific / DDD finding
Draft longitudinal_cwc_v1 on #372 currently admits each LongitudinalClusterScore with exactly one caller-supplied cluster_key: u64. That representation is narrower than TEPP's protected-main Membership model: membership_core::MembershipAssignment is explicitly the atomic unit of time-varying weighted multiple membership, and one member may hold simultaneous assignments across non-nested groups (cross-classification), roles, and event-time validity intervals.
This is not only a missing feature. It is an estimand/admission ambiguity. A caller that starts from a cross-classified or multiple-membership population must currently collapse that structure to one cluster_key before the Analysis Run boundary. #600 will faithfully digest the collapsed key, but the artifact does not prove that the collapse was scientifically authorized, preserve the omitted membership weights/roles/time validity, or fail closed when the declared design is outside the single-membership CWC profile. #602 Measurement authority and #603 Evidence source/availability authority do not solve this structural problem.
The risk is atomistic or wrong-level inference: within/between/contextual decomposition changes when the same observation legitimately belongs to more than one group or when membership changes over event time. Silent pre-boundary collapse can therefore change cluster means, within deviations, effective weighting, between contrasts, and the contextual effect while still yielding a syntactically valid digest-bound artifact.
Current exact evidence
At TEPP#372@47b6a6c85c69983bd843d8bb6d19001cfd3629d8, LongitudinalClusterScore contains evidence_id, snapshot_id, one cluster_key, predictor/outcome coordinates, and AvailableTime. admit_scores_at_cutoff projects that single key directly to psychometric_core::ClusteredScore; the admitted-evidence digest also commits only that one key per row.
Protected main@a243f18da4a4ca8a8d068c39922537f1f8ed6ad0 already defines membership_core::MembershipAssignment { member_id, group_id, role, weight, validity }, with documentation stating that a single member may hold many simultaneous assignments across non-nested groups and roles. Canonical TRACEABILITY likewise names time-varying cross-classified multiple membership as a TEPP requirement.
Issue #501 already requires recovery work not to reinterpret cluster membership or repeated observations as independent atomic evidence, but it does not provide an executable admission contract that prevents a multiple-membership population from being silently reduced to the current one-key row type.
Required RED
Before broadening the estimator, freeze the boundary test-first.
- Construct two scientifically distinct membership structures that have the same evidence IDs, source snapshot/cutoff, Measurement authorities, predictor/outcome
f64bits, and a caller-selected primarycluster_key, but differ in an additional simultaneous valid group assignment and/or membership weight at the observation event time. - The current single-membership profile must not allow both structures to collapse to the same successful artifact/terminal identity.
- Until a versioned multiple-membership estimand is explicitly implemented and validated, the v1 CWC path should fail closed when authoritative membership evidence says an admitted row is cross-classified or multiply assigned rather than silently selecting one group.
- A positive nested/single-membership control must continue to compose through the existing CWC owner without changing the Enders–Tofighi estimand.
The RED should enter through a TEPP-owned Membership/Longitudinal ACL, not by adding fields that callers can freely self-assert.
Ownership / design boundary
membership_core is the canonical TEPP domain owner for assignment identity, group identity, role, weight, and event-time validity. Analysis Run owns cutoff-safe composition and result provenance. Reusable numerical CWC arithmetic remains in psychometric_core / its released static-arithmetic owner path; this issue does not authorize a second estimator in Analysis.
Do not add a free-form membership_contract_version or a second caller-selected clock/key as a substitute for owner state. Do not flatten multiple memberships into duplicated pseudo-independent rows. If a future weighted/cross-classified CWC profile is added, its estimand, weighting rule, failure denominator, true-parameter recovery, and relationship to #501 must be explicit and versioned; until then the existing single-membership profile should make the scope limitation executable.
Acceptance / traceability
- preserve scientific(analysis): preserve evidence identity in longitudinal CWC composition #592 evidence-identity anti-pseudoreplication;
- preserve scientific(analysis): exclude future-only cross-snapshot rows before provenance admission #595 cutoff-before-domain admission and evidence(longitudinal): bind CWC cutoff admission to owner-issued source snapshot receipts #603 owner-issued source/availability boundary;
- preserve validation(longitudinal): bind CWC artifacts to the exact cutoff-visible evidence payload #600 exact admitted-evidence commitment and measurement(longitudinal): bind CWC coordinates to a versioned measurement contract #602 separate predictor/outcome Measurement authority;
- preserve scientific(longitudinal): make CWC cluster means permutation-stable through released binary64 owner #596 numerical permutation RED and do not solve this by sorting or duplicating rows;
- add known-truth recovery only after the structural admission invariant is explicit, with multilevel/cross-classified/multiple-membership/time preserved rather than collapsed;
- trace the owner aggregate/API/test and eventual artifact provenance through docs(ddd): restore queue authority and bounded-context ownership #435 without calling this issue scientific acceptance by itself.
Keep this issue open until the surviving Analysis Run vehicle contains the RED, the minimal causal admission/ACL repair (or a separately versioned multiple-membership profile), exact-head evidence, and #501 is re-run for the supported design. No mutable foreign dependency, source copy, skip/xfail, tolerance weakening, or atomistic fallback is authorized.
Activity
test(membership): reject unsupported CWC membership structures (#604)
feat(membership): add owner-issued single-membership admission (#604)
feat(membership): expose single-membership admission failure (#604)
feat(membership): export single-membership owner admission (#604)
seonghobae commentedon Sep 19, 2026
Owner-path progress: Draft #605 is now the canonical Membership prerequisite for this issue.
main@a243f18da4a4ca8a8d068c39922537f1f8ed6ad03b0f46eaeca77d88aedad93c9bade5438e2b3af1f4ca5a698b5ebc2ac4254c8b335f3fcec4f2df90SingleMembershipAdmission/admit_single_membership(&MembershipNetwork, MemberId, EventTime)The owner API fails closed unless canonical Membership state has exactly one active assignment at the event time with exact full weight
1.0. Simultaneous same-role groups, simultaneous cross-role assignments, partial weights, and inactive membership are rejected asSingleMembershipProfileInapplicable.This is intentionally not yet consumed by #372: #605 must first get exact-head gates + qualifying independent review + normal protected-main landing. The downstream #604 Analysis RED/ACL should then derive the v1 cluster mapping from admitted
GroupIdrather than trust caller-selectedLongitudinalClusterScore.cluster_key; it must remain compatible with #603's future Evidence-to-member/event-time authority. #604 stays open through downstream ACL and #501 recovery.seonghobae commentedon Sep 19, 2026
One downstream detail is now explicit from #605:
SingleMembershipAdmissionreturns canonicalGroupId(UUID), whilepsychometric_core::ClusteredScorecurrently acceptsu64. The Analysis ACL must not truncate/hashGroupIdinto a caller-styleu64, because collisions would silently reintroduce cluster collapse. For the existing static estimator, use a run-local collision-free bijection over the admitted ownerGroupIdset (for example canonical GroupId ordering → dense ordinal) only as an internal numerical index, while artifact/provenance commitment binds the canonical owner GroupId/role/weight/event-time admission rather than the transient ordinal. Two distinct authoritative GroupIds must therefore remain distinct even if any lossy numeric projection would collide. This remains part of #604 downstream RED/ACL, not a new estimator.seonghobae commentedon Sep 19, 2026
Scientific traceability note for the eventual #435 canonical fold: the fail-closed v1 boundary is consistent with the classical MMMC model distinction rather than a software-only preference. Browne, Goldstein, & Rasbash (2001) explicitly distinguish cross-classified structures from multiple-membership structures and model them without forcing a nested hierarchy: Multiple membership multiple classification (MMMC) models, Statistical Modelling, 1(2), 103–124. https://doi.org/10.1177/1471082X0100100202
This citation supports the requirement to preserve known non-nested/multiple-membership structure. It does not define TEPP's wire format, owner API, weighting semantics, or recovery acceptance. Those remain repository-owned decisions. #605 deliberately keeps the current v1 estimand narrower and fail-closed; a future MMMC-capable profile must specify its own estimand/weights/failure denominator and empirical recovery evidence rather than treating the 2001 paper as an implementation contract.
seonghobae commentedon Sep 19, 2026
Membership owner prerequisite advanced on #605 to exact
9928f99bc37ee7584f45f0a31f47da44bfdff0eaand now also carries #607. The new owner invariant is finiteMembershipWeight ∈ [0,1]through both constructor and serde admission; super-unit weights and deserialization bypasses fail closed. This does not change #604's estimand or authorize weighted/multiple-membership CWC. It removes an invalid canonical Membership state before the later Analysis ACL derives a single-membership group from owner-issued admission. #604 remains open pending #605 exact-head acceptance/review/protected landing, #603-compatible member/event-time authority, downstream Analysis RED/ACL, and #501 recovery.seonghobae commentedon Sep 19, 2026
#604 owner prerequisite is now
TEPP#605@7e52f864e3294f412075916629a21e6799ed6888. In addition to #606 re-entry and #607 bounded/validated weights, #608 now prevents a lone partial-weight membership from being classified as full nested structure and passed to the unweighted nested ICC; a separate full-weight two-role control preservesCrossClassified. This remains owner-side preparation only. #604 must still wait for #605 exact-head acceptance/review/protected landing and #603-compatible member/event-time authority before adding the Analysis RED/ACL and deriving its collision-free internal group ordinal from admitted ownerGroupId.seonghobae commentedon Sep 19, 2026
Owner-path update: Membership prerequisite #605 has advanced ordinary-forward to exact
b653eed5963efde246a9224078e1a51d979c53e6and now includes #607/#608/#609 in addition to the original admission/re-entry work. #609 is material to this issue: predecessorclassify_membership_designcould not preserve a population carrying both cross-classification and multiple-membership structure. Public REDcb2abf79b608e29c8deb0085dc0ce5224dd4158arequires the mixed MMMC state; causal repairedaddb1f202d07ee5b92b1f32238ad175241b98daddsMembershipDesign::CrossClassifiedMultipleMembershipand independent cross/multiple signal tracking;b653eed5963efde246a9224078e1a51d979c53e6restores the older pure-cross fixture to full-weight semantics. This remains mutable owner evidence only. #604 must still wait for exact-head #605 gates + independent review + ordinary protected-main landing before adding the Analysis/Longitudinal ACL RED/repair. The future ACL must preserve this combined design state rather than coerce it to eitherCrossClassifiedorMultipleMembership, and the v1 single-membership CWC profile must continue to fail closed.seonghobae commentedon Sep 19, 2026
Owner prerequisite advanced on Draft #605. New #610 closes a composition invariant that #607 could not cover: even with every
MembershipWeightindividually bounded to[0,1], overlapping assignments for one(member, role)could previously compose to a known active share above unity. Public RED49bce45705bb3d9b2bce763c851bbdbb6fecd265→ owner repair01c6f72b6c1ec320d3b63d922e566d30e096fc00→ aggregate/atomic edge contractfa91ab88d2a563b74a66a0a69e6227fc6f25f259→ formatting-only head766dfaf12ba6a326c23a52e119776cc40e8726c2. The rule rejects only known overfull same-role budgets; sub-unity partial views remain representable as incomplete/multiple-membership structure, cross-role budgets remain independent, and temporally disjoint spells do not accumulate. #604 remains downstream: do not consume #605 until exact-head gates, independent review, and ordinary protected-main landing.seonghobae commentedon Sep 19, 2026
Membership owner update: #605 advanced from #610 into #611 without touching the CWC consumer. New RED
1f2b1131d3c85ea1ab33150bb88958f87f558e38proves a population whose members are individually full-weight/single-membership but split acrossDepartmentandProjectroles cannot be treated as one nested classification. Causal repair29d38e39832c8d2f93ce5fbdc46388dab2b4f312adds explicitHeterogeneousClassification/HeterogeneousClassificationMultipleMembershipowner states and tracks population-wide active roles; edge contract2b87d3ed1868c058b48a27f64f676cc88a2ffab3proves role heterogeneity does not erase an independent partial/multiple-membership signal. #605 current exact head is2b87d3ed1868c058b48a27f64f676cc88a2ffab3, still Draft/open/mergeable with fresh exact-head gates queued and no independent approval. #604 must continue to wait for normal owner landing; no mutable source copy or CWC-local classifier workaround.seonghobae commentedon Sep 19, 2026
Membership owner prerequisite advanced again on #605. New #612 fixes a domain-admission hole in #610: ordinary
f64summation could round an exact represented binary64 overrun back to1.0and admit an impossible same-role share budget. Public REDab37ccb672e5bdf0330bfe86a3c14f439f499006; causal owner repair/current head2c278741db46dff5a5537d49b49ef9b5c7861e8cuses exact dyadic-bin comparison for the represented weights, preserving exact-unity/sub-unity cases without tolerance, normalization or estimator changes. #604 still must not consume #605 until exact-head gates + independent review + normal protected-main landing; the downstream Analysis ACL remains responsible for authoritative GroupId mapping/provenance and #603-compatible member/event-time authority.