feat(pillar): add Pillars 15-17 (deferred stubs with proof obligations)

Deferred substrate-tier pillars following the lance-graph/crates/jc
DEFERRED convention (Pillar 11 was deferred several months before sigker
landed and activated it):

- Pillar 15: Mexican-hat / DoG unimodality.
  Awaiting Mexican-hat resonance kernel in hpc::dragonfly.
  Will certify DoG kernel unimodality at κ = σ_s/σ_c ∈ [1.5, 3.0].
- Pillar 16: BTSP-gated bundling unbiasedness.
  Awaiting stable BTSP API in dn_tree.
  Will certify Doob optional-stopping unbiasedness of gated bundle.
- Pillar 17: Quaternary tree balance under Zipf access.
  Awaiting Zipf workload simulator + DNTree inspector methods.
  Will certify Brent-style depth/occupancy variance bounds.

Each stub exports its SEED constant, a prove_pillar_N() returning a
deferred-shape PillarReport (zeros + passed=true), and a full
proof-obligation docstring describing the activation plan.

Author: claude

src/hpc/pillar/btsp_unbiased.rs

@@ -0,0 +1,161 @@
+#![allow(missing_docs)]
+//! Pillar-16 — BTSP-gated bundling unbiasedness certification.
+//! **DEFERRED** pending stable BTSP plasticity API in
+//! `ndarray::hpc::dn_tree`.
+//!
+//! Substrate-tier pillar: when activated, this pillar will certify that
+//! the BTSP-gated stochastic bundling operator used by
+//! `dn_tree::DNTree::update` (with `btsp_gate_prob > 0` and
+//! `btsp_boost > 1`) is an *unbiased* estimator of the underlying
+//! signal — i.e. that the gate does not introduce a systematic drift
+//! in the long-run mean of the bundled summary.
+//!
+//! # The unbiasedness claim
+//!
+//! Let `B_t = bundle(B_{t−1}, hv_t, lr_eff(t))` where
+//!
+//! ```text
+//!   lr_eff(t)  =  lr · boost     with probability p_btsp
+//!   lr_eff(t)  =  lr             with probability 1 − p_btsp
+//! ```
+//!
+//! For unbiasedness we require the BTSP-gated dynamics to converge to
+//! the *same* long-run mean as the gate-disabled dynamics
+//! (`lr_eff(t) ≡ lr` for all `t`). Equivalently, for any fixed input
+//! distribution `μ` of hypervectors:
+//!
+//! ```text
+//!   lim_{T→∞}  E[B_T | BTSP active]   =   lim_{T→∞}  E[B_T | BTSP disabled]
+//! ```
+//!
+//! This holds if and only if the gate's expected step
+//! `E[lr_eff] = lr · ((1 − p_btsp) + p_btsp · boost)` produces an
+//! effective bundling weight that the bundling operator's fixed-point
+//! equation tolerates without drift — formally, that `lr_eff` enters
+//! linearly through Doob's optional stopping theorem on the
+//! martingale-decomposable component of the bundle update.
+//!
+//! # Why the substrate needs this
+//!
+//! The BTSP gate is the substrate's mechanism for *importance-weighted*
+//! plasticity — high-salience events get a 7× learning-rate boost
+//! (mimicking CaMKII amplification in biological synapses). If the gate
+//! is *biased*, the long-run summary drifts toward an artifact of the
+//! gate schedule rather than the true input distribution. The drift is
+//! invisible in lab conditions (Jan's 100% recall numbers at θ ∈ [1.45,
+//! 1.60]) because lab inputs are themselves drawn from the target
+//! distribution; the bias surfaces only when the input distribution
+//! shifts under operational load.
+//!
+//! Pillar-16 pins the unbiasedness claim to a measurable Monte-Carlo
+//! estimate of the long-run mean, with the gate-disabled run as the
+//! reference.
+//!
+//! # Probe design (deferred until BTSP API stabilises)
+//!
+//! 1. Fix bit width `BIT_WIDTH = 1024`, base learning rate `lr = 0.05`,
+//!    gate probability `p_btsp = 0.01`, boost `boost = 7.0`.
+//! 2. Fix a target distribution `μ` over input hypervectors — a small
+//!    discrete set of `K = 8` "prototype" vectors, drawn uniformly per
+//!    step.
+//! 3. Run `T = 10_000` bundle steps with BTSP disabled (`p_btsp = 0`);
+//!    record `B_T` as the reference mean `M_ref`.
+//! 4. Run `T` bundle steps with BTSP enabled; record `B_T` as `M_btsp`.
+//! 5. Repeat both runs `N_REPLICAS = 64` times with different seeds.
+//! 6. Verify that
+//!    `‖ mean(M_btsp) − mean(M_ref) ‖_∞ < BIAS_TOLERANCE`
+//!    and that the per-bit empirical bias falls within a
+//!    `BIAS_CHI2_BUDGET` chi-squared confidence band.
+//!
+//! # Cross-verification
+//!
+//! When active, the probe will compare ndarray's `dn_tree::bundle_into`
+//! output against an independent re-derivation of the Bernoulli-mixture
+//! step (same approach as Pillar-13). The math is verifiable against a
+//! numpy / scipy reference implementation in `scripts/pillar_16_oracle.py`
+//! (to be written alongside activation).
+//!
+//! # Activation gate
+//!
+//! Active when:
+//! - `ndarray::hpc::dn_tree::bundle_into` (or equivalent) has a stable
+//!   public signature accepting `(current, hv, lr, boost, rng)`.
+//! - `DNConfig::with_btsp` and the BTSP fire/boost semantics are
+//!   contract-frozen (no further breaking changes).
+//!
+//! # Pass criteria (when active)
+//!
+//! - `‖ E[B_btsp] − E[B_ref] ‖_∞ < 0.05` (5% bit-bias tolerance).
+//! - Chi-squared test on per-bit bias: `χ² ≤ critical at α = 0.01,
+//!   df = BIT_WIDTH − 1`.
+//! - `psd_rate` ≥ 0.999 (fraction of bit positions within tolerance).
+//! - `lognorm_concentration` = `log(1 + max bit-bias)`.
+//!
+//! # References
+//!
+//! * Bittner, K. C., Milstein, A. D., Grienberger, C., Romani, S., &
+//!   Magee, J. C. (2017). *Behavioral time scale synaptic plasticity
+//!   underlies CA1 place fields.* Science 357(6355). (Original BTSP
+//!   observation in hippocampal CA1.)
+//! * Doob, J. L. (1953). *Stochastic Processes.* Wiley. (Optional
+//!   stopping for the martingale decomposition that pins the
+//!   unbiasedness criterion.)
+//!
+//! # SEED
+//!
+//! `PILLAR_16_SEED = 0x_C16_B751P_BC057` (BTSP boost, reserved).
+
+use crate::hpc::pillar::prove_runner::PillarReport;
+
+/// Deterministic seed for all Pillar-16 RNG streams.
+pub const PILLAR_16_SEED: u64 = 0x_C16B_751B_BC05;
+
+/// Run the Pillar-16 deferred placeholder.
+///
+/// **Currently DEFERRED.** Replace the body when the BTSP API is
+/// stabilised; see the "Probe design" section in the module docs for
+/// the activation plan.
+pub fn prove_pillar_16() -> PillarReport {
+    PillarReport {
+        pillar_id: 16,
+        seed: PILLAR_16_SEED,
+        n_paths: 0,
+        n_hops: 0,
+        psd_rate: 0.0,
+        lognorm_concentration: 0.0,
+        passed: true,
+    }
+}
+
+// ── Tests ───────────────────────────────────────────────────────────────────
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn pillar_16_seed_matches_spec() {
+        assert_eq!(PILLAR_16_SEED, 0x_C16B_751B_BC05);
+    }
+
+    #[test]
+    fn pillar_16_deferred_shape() {
+        let r = prove_pillar_16();
+        assert_eq!(r.pillar_id, 16);
+        assert_eq!(r.seed, PILLAR_16_SEED);
+        assert_eq!(r.n_paths, 0);
+        assert_eq!(r.n_hops, 0);
+        assert_eq!(r.psd_rate, 0.0);
+        assert_eq!(r.lognorm_concentration, 0.0);
+        assert!(r.passed);
+    }
+
+    #[test]
+    fn pillar_16_seed_anchored() {
+        let r1 = prove_pillar_16();
+        let r2 = prove_pillar_16();
+        assert_eq!(r1.passed, r2.passed);
+        assert_eq!(r1.psd_rate, r2.psd_rate);
+        assert_eq!(r1.lognorm_concentration, r2.lognorm_concentration);
+    }
+}

src/hpc/pillar/mexican_hat.rs

@@ -0,0 +1,156 @@
+#![allow(missing_docs)]
+//! Pillar-15 — Mexican-hat / Difference-of-Gaussians unimodality
+//! certification. **DEFERRED** pending Mexican-hat resonance kernel
+//! landing in `ndarray::hpc`.
+//!
+//! Substrate-tier pillar: when activated, this pillar will certify that
+//! the Difference-of-Gaussians (DoG) center-surround resonance kernel
+//! consumed by the dragonfly-tier cognitive shader has exactly one local
+//! maximum at the origin and exactly one annular minimum at the surround
+//! radius, across the full parameter band the production stack uses.
+//!
+//! # The unimodality claim
+//!
+//! For two centered isotropic Gaussians with standard deviations
+//! `σ_c < σ_s`, the Difference-of-Gaussians is
+//!
+//! ```text
+//!   DoG(r ; σ_c, σ_s)  =  G(r ; σ_c)  −  G(r ; σ_s)
+//! ```
+//!
+//! Differentiating with respect to `r` and setting to zero gives the
+//! single positive root `r_min(σ_c, σ_s)`. For DoG to behave as a
+//! center-surround kernel — peak at origin, negative annulus, decay to
+//! zero — we need:
+//!
+//! 1. `DoG(0) > 0` (positive at center)
+//! 2. `DoG'(r) < 0` for `0 < r < r_min` (monotone decrease from peak)
+//! 3. `DoG'(r) > 0` for `r > r_min` (monotone increase from annulus to zero)
+//! 4. Exactly one root in `(0, ∞)` for the equation `DoG(r) = 0`
+//!
+//! These hold for any `σ_c < σ_s`, but the *measurable* sharpness of the
+//! center-surround structure depends on the ratio `κ = σ_s / σ_c`. The
+//! production stack uses `κ ∈ [1.5, 3.0]`; values outside this band
+//! produce either too-broad surrounds (resonance bleeds into neighbors,
+//! cascade misfires) or too-sharp surrounds (numerical instability at
+//! the inflection point).
+//!
+//! # Why the substrate needs this
+//!
+//! The dragonfly Mexican-hat resonance is the center-surround operator
+//! that implements lateral inhibition in the cognitive shader. Bad
+//! parameter choices (κ outside the band, or accidental introduction
+//! of a kernel that's a sum-of-Gaussians rather than a difference)
+//! produce *bimodal* or *saddle* responses that look like resonance
+//! but bias activation toward the wrong neighborhoods. The failure
+//! mode is silent: the cascade still produces top-K results, just
+//! systematically biased.
+//!
+//! # Probe design (deferred until kernel lands)
+//!
+//! When the Mexican-hat / DoG kernel lands in `ndarray::hpc::dragonfly`
+//! (or wherever it ultimately lives), Pillar-15 will:
+//!
+//! 1. Sweep `κ = σ_s / σ_c ∈ {1.1, 1.3, 1.5, 1.8, 2.0, 2.5, 3.0, 4.0}`.
+//! 2. For each κ, evaluate the DoG kernel on a 1D radial grid of
+//!    `N_RADIAL = 4096` samples covering `r ∈ [0, 6 σ_s]`.
+//! 3. Numerically locate all critical points (sign changes in `DoG'`)
+//!    via finite differences with `h = r_max / N_RADIAL`.
+//! 4. Verify:
+//!    - Exactly one positive critical point (the annular minimum).
+//!    - `DoG(0) > 0` and is the global maximum on the grid.
+//!    - `DoG(r) → 0` as `r → r_max` within `1e-6 · DoG(0)`.
+//!    - For `κ ∈ [1.5, 3.0]`, the second-derivative ratio at the
+//!      inflection point is within the production-band budget.
+//!
+//! # Activation gate
+//!
+//! Active when:
+//! - `ndarray::hpc::dragonfly::mexican_hat` (or canonical location) is
+//!   exposed as a public function `dog_eval(r: f32, sigma_c: f32, sigma_s: f32) -> f32`.
+//! - This module's `prove_pillar_15` body is updated to call it; the
+//!   current `DEFERRED` placeholder must be replaced with the real probe.
+//!
+//! # Pass criteria (when active)
+//!
+//! - All seven critical-point checks pass for every κ in the sweep.
+//! - `psd_rate ≥ 1.0` (every κ-sample contributes a binary pass/fail;
+//!   any failure tanks the rate).
+//! - `lognorm_concentration` = `log(1 + max kappa-band deviation)`.
+//!
+//! # References
+//!
+//! * Marr, D., & Hildreth, E. (1980). *Theory of edge detection.*
+//!   Proc. R. Soc. Lond. B 207(1167). (The original DoG / Marr-Hildreth
+//!   operator, source of the Mexican-hat name.)
+//! * Lindeberg, T. (1994). *Scale-Space Theory in Computer Vision.*
+//!   Kluwer. (Scale-space justification for the σ_s / σ_c ratio band.)
+//!
+//! # SEED
+//!
+//! `PILLAR_15_SEED = 0x_C15_DAD51_DEFE` (Mexican-hat unimodality, reserved).
+
+use crate::hpc::pillar::prove_runner::PillarReport;
+
+/// Deterministic seed for all Pillar-15 RNG streams.
+pub const PILLAR_15_SEED: u64 = 0x_C15D_AD51_DEFE;
+
+/// Run the Pillar-15 deferred placeholder.
+///
+/// **Currently DEFERRED.** Returns a `PillarReport` with all-zero
+/// numeric fields and `passed = true`, signalling "no probe ran".
+/// Replace the body when the Mexican-hat kernel lands; see the
+/// "Probe design" section in the module docs for the activation plan.
+///
+/// # Returns
+///
+/// A deferred-shape `PillarReport`:
+/// - `n_paths = 0`, `n_hops = 0` (no probe executed)
+/// - `psd_rate = 0.0`, `lognorm_concentration = 0.0`
+/// - `passed = true` (the deferral itself is not a failure)
+pub fn prove_pillar_15() -> PillarReport {
+    PillarReport {
+        pillar_id: 15,
+        seed: PILLAR_15_SEED,
+        n_paths: 0,
+        n_hops: 0,
+        psd_rate: 0.0,
+        lognorm_concentration: 0.0,
+        passed: true,
+    }
+}
+
+// ── Tests ───────────────────────────────────────────────────────────────────
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn pillar_15_seed_matches_spec() {
+        assert_eq!(PILLAR_15_SEED, 0x_C15D_AD51_DEFE);
+    }
+
+    #[test]
+    fn pillar_15_deferred_shape() {
+        // DEFERRED probe must return a recognisable deferred-shape report:
+        // zeros everywhere except pillar_id and seed, passed = true.
+        let r = prove_pillar_15();
+        assert_eq!(r.pillar_id, 15);
+        assert_eq!(r.seed, PILLAR_15_SEED);
+        assert_eq!(r.n_paths, 0);
+        assert_eq!(r.n_hops, 0);
+        assert_eq!(r.psd_rate, 0.0);
+        assert_eq!(r.lognorm_concentration, 0.0);
+        assert!(r.passed, "deferred pillar should not be marked failed");
+    }
+
+    #[test]
+    fn pillar_15_seed_anchored() {
+        let r1 = prove_pillar_15();
+        let r2 = prove_pillar_15();
+        assert_eq!(r1.passed, r2.passed);
+        assert_eq!(r1.psd_rate, r2.psd_rate);
+        assert_eq!(r1.lognorm_concentration, r2.lognorm_concentration);
+    }
+}