# ADR-036: edoc-1 — the external-dynamic-engine observational certificate

**Status:** accepted (design authority — unblocks three deferred rows; no code ships this sprint)
**Date:** 2026-07-16
**Deciders:** external-engine track — the certificate ADR that [ADR-030](adr-030-external-dta-simulators-deferred.md) names as the single unblocker for three rows: MATSim (ADR-030's own deferral) plus the `duaIterate` and `simulation()` follow-ups [ADR-027](adr-027-sumo-marouter.md) and [ADR-029](adr-029-dtalite-tap.md) defer to the DTA/DNL track
**File:** `docs/design/adr-036-external-dynamic-observational-certificate.md`

## Context — the blocker ADR-030 named, and three pilots that measured the way through

ADR-030 deferred three adapter rows — MATSim, DynaMIT, DYNASMART — on a **measured** record,
and named the one ADR that would unblock a *different* trio: MATSim plus the ADR-027/029
named follow-ups `duaIterate` and `simulation()` (DynaMIT/DYNASMART stay blocked upstream —
see Consequences). Its blocker, verbatim: *"The blocker is formulation — A2 is
impossible in kind, not degree. ... MATSim's QSim has no static latency function: each
link's traversal time is `length/freespeed` — a constant — whenever the flow capacity does
not bind ... No `(freespeed, flowCapacity, storageCapacity)` choice produces
`t = fft·(1 + b·(v/c)^p)` on any interior flow range."* And its remedy, verbatim: *"One
ADR: the external-dynamic-engine observational certificate ... It unblocks three queued
rows at once — MATSim, SUMO `duaIterate`, DTALite `simulation()`."* `docs/ARCHITECTURE.md`
records the same gap: external dynamic engines are *"otherwise scored on the observational
track (which for external dynamic engines does not exist yet ... the mandatory cost-matched
anchor is impossible in kind until that certificate ADR ships)."* This is that ADR.

The deferral was correct and stays correct in its own terms: there is no static latency
function to match, so ADR-027/029's shipping bar — the A2 cost-matched anchor, *"the row is
not shipped without A2"* — cannot be met **in kind**. This ADR does not weaken that bar; it
supplies the object that plays A2's role when no cost law exists to match: **the pinned
engine itself**. The certified claim shifts accordingly — not "certified Wardrop UE under
the declared BPR" but "the literature-standard simulation-DTA experienced-time gap w.r.t.
the engine's own frozen realized field," a different, honestly-labeled quantity on its own
leaderboard scale.

Three pilots ran the candidate engines fresh on this box (2026-07-16) and measured every
load-bearing quantity the certificate needs. **SUMO `duaIterate`** (eclipse-sumo 1.27.1
wheel): a 20-iteration meso run emits per-iteration experienced edge-cost dumps, plan/
alternative files, and tripinfo+vehroute; one pinned `duarouter` best-response call on the
frozen final dump recomputes a relative gap on experienced costs model-blind, with a working
negative control (AON `RG_D1` 0.17203 vs converged 0.01526 — the 11x separation ADR-030 said
the dynamic track lacked). **MATSim** (2025.0 release on Temurin 21): `lastIteration =
firstIteration` on the emitted plans is a zero-replanning replay that reproduces all 100
per-agent (departure, arrival, route) tuples exactly, and `global.randomSeed` gives raw-
gzip-byte determinism even with replanning — the first stochastic-track external engine.
**DTALite `simulation()`** (0.8.1): a deterministic sub-second queue-DNL map from an
explicit plan artifact (`vehicle.csv`) to an experienced-time artifact (`trajectory.csv`),
bit-identical across re-runs, whose gap the harness recomputes from `trajectory.csv` alone.
Each pilot also measured the hazards that make the naive design wrong — insertion-backlog
invisibility, self-report substitution, plan-set impoverishment, aggregation-window noise,
head-block infinite loops at `rc=0` — and those hazards *are* the certificate's gates.

## Decision — EDOC-1, the external-dynamic-engine observational certificate

**EDOC-1** scores **D1** (the frozen-field best-response gap) with a **gating slice of D3**
(conservation/self-consistency) and non-gating D3 diagnostics; **D2** (held-out real counts)
applies only where a real sensor panel exists and is never part of this score (its own ADR,
ruling R11). The engine is part of the instance on the **hashed-loading-kernel** precedent of
ADR-031 (`TDTAScenario` hashes the loading operator; the certificate is defined w.r.t. one
kernel) and the **pinned-engine observational** posture of ADR-034's stage 2 (re-run the
pinned engine at emitted inputs, score on its own scale). Putting engine identity + version
**inside the instance hash** is a NEW move relative to ADR-027/029, where the engine's cost
law was matched against the *declared* BPR and its version was manifest provenance + a CI pin
(marouter's A2 anchor existed precisely to SEPARATE the engine's hardcoded law from the
certificate). Here no declared cost law exists to certify against, so the certifier instead
re-derives every scored number by re-running that pinned engine on the model's emitted plans
— the engine is the matched object, not a provenance note.

### The instance

A content hash under a new domain prefix **`"tabench-edoc-scenario-v1;"`**, length-framing
every array (the newell-3det / ADR-031 defense-in-depth, done while the edoc hashes are
unpublished), over: the network + demand artifacts; the **engine identity + EXACT version
pin** (pip wheel version for `eclipse-sumo`/`DTALite`; the release-zip md5 + JDK major for
MATSim); the pinned **seed** (or the pinned macrorep seed **list** on the stochastic track,
R5); the semantic engine config; the cost-field aggregation interval **Δ**; the backlog
bound; the negative-control separation factor; the **resolution floor and replay hard-deadline
constant**; and — the same criterion, **every certifier-side constant that changes a censor /
floor / score outcome** — the **R2 field-semantics + field-completion-rule selections**, the
**origin-wait convention**, and the **option-B BR walk universe + length bound**. Each bears on
the scored outcome (censor / `<= floor` / ranked eligibility), so a post-publication edit to any
of them must mint a new instance hash — the same hash-everything discipline this domain invokes.
Domain-separated, so no existing static/
dnl/dta/tdta hash moves — the golden Braess `cf00f411…` is byte-untouched (re-asserted in
the first shipping row's tests, per every prior ADR).

### Emitted artifacts (mandatory)

A model emits, and only emits:

* **Plans `P`** — per-agent route + departure time (SUMO `vehroute`/`.rou.alt.xml.gz`;
  MATSim `output_plans.xml.gz`; DTALite `vehicle.csv`).
* **Experienced record `X`** — per-agent **door-to-door experienced time including
  pre-insertion delay** (SUMO `tripinfo` `duration + departDelay`; MATSim events; DTALite
  `trajectory.csv`), plus the per-interval experienced link-cost field the run consumed
  (`dump_Δ.xml.gz` etc.).
* **Provenance** — engine configs, version string, seed. Self-reported convergence metrics
  (`duaIterate` relStdDev, engine gap prints) are provenance **only, NEVER gated on** — the
  ADR-029 posture, earned again by measurement (`duaIterate`'s relStdDev was 29x smaller than
  the recomputed gap and read exactly 0.00000 while stuck at pure AON).

### Gates (censor; only wrong shapes / config errors raise)

* **G0 — pin.** The installed-engine version is read at certify time (`importlib.metadata` /
  jar md5 / `sumo` version string), the instance hash and seed are checked; a mismatch is a
  **configuration error and RAISES eagerly** (the ADR-020 eager-config discipline). The pin
  extends to the **model-side execution environment** the engine's byte-determinism requires
  — `OMP_NUM_THREADS=1` for DTALite (its `#pragma omp parallel for` over shared `std::deque`
  is a *correctness* requirement, not just determinism hygiene) and the certifier's **full**
  JDK version (not only the major) for MATSim, since G1 demands canonicalized byte equality
  and a JDK minor/patch drift between the model's and certifier's toolchains is otherwise an
  uncontrolled censor surface. These sit in the instance provenance; a mismatch RAISES.
* **G1 — replay fidelity (the A2 ANALOGUE).** With no static latency function there is no
  cost-matched anchor, so the matched object becomes **the engine itself**: the certifier
  re-runs the pinned engine in **zero-replanning replay** on the emitted plans (one pinned
  `sumo` meso run; MATSim `lastIteration = firstIteration` — measured: replanning fires only
  *between* iterations, so this is a pure replay; DTALite `simulation()` on `vehicle.csv`),
  and the replayed per-agent (departure, arrival, route, experienced-time) tuples must equal
  `X` **exactly** under the pinned canonicalization (R10). The replay runs **TWICE** and the
  two canonicalized outputs must be identical (the determinism gate). Any divergence from `X`
  censors as non-replayable / self-report substitution.
* **G2 — plan-demand match, two-sided.** The agent set, per-agent OD endpoints, and per-OD
  agent *count* match the instance trip table **EXACTLY** — a bijection, no tolerance;
  per-agent departure times match **exactly up to the instance's declared engine-grid
  quantization**. **Fixed departures give the model ZERO timing freedom** (the ADR-031
  demand-match pattern; it is the strongest gate here). ADR-031's `eps_od = tol·max(1, D_od)`
  is inherited as *ancestry, not identity*: it applies ONLY where the trip table is
  real-valued and must be integerized (the R9 DTALite `route_assignment.csv` construction),
  bounding per-OD vehicle-*count* mismatch — never departure-time slack (a timing tolerance
  would reopen the very door this gate closes). A construction-time rule (eager G0-style
  RAISE) restricts the pinned semantic config to **route/selection-only replanning
  strategies**: a departure-time- or mode-mutating strategy (e.g. MATSim
  `TimeAllocationMutator`) is a config error, because its faithful final iterate would break
  the exact-departure bijection.
* **G3 — two-sided delivery.** A per-agent completion census from the replay (arrivals ==
  departures, no period-end truncation, no pre-period head-block loss), **`departDelay`
  included in every cost**, and max/mean insertion backlog under the scenario-declared bound
  (the Primer's vehicles-waiting-to-enter warning, made a gate). Violations censor.
* **G4 — conservation / self-consistency (gating D3).** Per-link entered/left conservation,
  monotone cumulatives, per-agent link-time chains (`arrival_{k+1} >= departure_k`) — the
  `dnl_gaps` C0/C1 shapes run on the replay output.

### The scored metric — RG_D1, the frozen-field best-response gap

From the G1 replay the harness builds the **frozen experienced cost field `Ĉ`** (per-link,
per-interval experienced traversal times, entry-time-resolved at the pinned Δ, R2). For each
agent `i` departing at `t_i`:

* `c_drv(i)` = the **origin-wait profile** for the driven route's first link at `t_i` (a
  per-first-link interval-mean of the replay's own `departDelay` samples, built with the same
  construction and occupancy-aware completion as the link field — the frozen field `Ĉ` cannot
  itself carry off-network insertion delay) **plus** the time-dependent evaluation of the
  **driven** route on `Ĉ` from the agent's first-link entry time;
* `c_br(i)` = the min over the **FULL-NETWORK** route universe of [the origin-wait profile for
  **that route's** first link at `t_i` **plus** the same field evaluation] — a
  **certifier-owned time-dependent shortest path** (R3) starting at the agent's origin, so the
  best response is charged the **alternative** first link's own measured wait.

Both sides compose the *same* frozen profiles (origin-wait + link field), so the driven route is
in the min set and `c_drv(i) >= c_br(i)` per agent **by construction** (the `tdta_gaps`
property, ADR-031). **This DEFAULT scores entrance-choice (insertion-queue) disequilibrium** — a
state where every agent could skip a measured 186 s queue via a cheaper first link no longer
scores 0. A family MAY instead declare the **agent-symmetric** convention (the same agent's
`departDelay_i` on both sides, which cancels in the numerator); it then MUST disclose
**entrance-choice-disequilibrium blindness** in its scope section and its R8 non-comparability
sentence. The origin-wait convention is a **hashed instance field** (the instance section). The
score is

    RG_D1 = Σ_i (c_drv − c_br) / Σ_i c_drv       (TSTT-normalized — ruling R1)

D1 scores the **PREDICTED frozen-cost gap ONLY** — never the realized re-simulation of the
BR plan (ruling R12; the measured overshoots are exactly why: SUMO +9.3%, MATSim naive
one-step −0.252, DTALite 0.394 → 0.513).

**Disclosure (pilot vs shipped estimator).** The pilot anchors quoted below are
*estimator-approximate* to this composition, in two disclosed ways. (i) Each used the
**agent-symmetric** origin-wait convention (the same agent's wait on both sides, cancelling in
the numerator) — now the *optional* convention, not the shipped **default** (the per-first-link
origin-wait profile), so the pilot anchors are **blind to entrance-choice disequilibrium** by
construction; the shipped default charges the alternative first link's own measured wait and is
re-derived on the first row. (ii) Each used a simplified
BR universe/profile: SUMO a pinned `duarouter` on the Δ=300 dump; MATSim experienced driven
cost vs a nearest-neighbor field capped `min(c_br, c_exp)` (the by-construction inequality
does *not* hold in that estimator — the cap is the tell); DTALite an observed-two-route
nearest-neighbor estimator (the exact observational shape forgery pair 3 disqualifies). The
separation factor and floor anchors (R4) inherit this approximation and are **re-derived with
the shipped substrate on the first row before family constants freeze** — the posture R2
already takes for Δ.

### The negative-control anchor and the resolution floor

* **Negative-control anchor (per shipped instance, the ADR-027 incremental-control analogue).**
  The pinned AON / step-0 state must score `RG_D1` at least the declared **separation factor**
  above the reference state (measured separations, **estimator-approximate** — re-derived on
  the first row, see the composition disclosure: 0.17203 vs 0.01526 = **11x SUMO**; 0.393839
  vs ~0.04 **DTALite**). An instance whose control cannot separate — e.g. the meso shared-edge
  queue-storage topology where the cost signal cancels — is **REFUSED at scenario
  construction**, never certified (ruling R4).
* **Resolution-floor gate.** `delta = mean| Ĉ-evaluated driven cost − experienced cost from
  X |`, **always computed on the RAW interval-mean field** (it measures aggregation fidelity,
  not monotonization distance — so option-A monotonization, which deflates `Ĉ` vs experienced
  by a measured mean 189.8 s on a non-FIFO field, never self-fires this gate), must stay under
  the scenario-declared floor (measured **25.6 s mean / 80 s max at Δ=300 ≈ 7.9% of a ~325 s
  trip**). A run whose `delta` exceeds the floor is **CENSORED** (field-unfaithful — this also
  closes intra-interval oscillation gaming); run-specific `delta` only ever **censors**, it
  **never** reclassifies a row to sub-floor. **Sub-floor classification is by the FAMILY floor
  expressed in gap units:** the floor is declared in seconds, and the seconds→gap conversion is
  stated once here as `floor_gap = floor_seconds / (Σ c_drv / N)` (the mean per-agent driven
  cost); a row with `RG_D1 < floor_gap` is reported **`<= floor`, not ranked**, displayed at the
  floor value, tied with other sub-floor rows, and ordered relative to ranked rows **by that
  displayed value like any row** (no categorical placement). Because every *ranked* row scores
  `>= floor_gap` by definition, the ordering is total and no true-worse row can outrank a
  true-better one — closing the inversion a run-specific threshold would open.

### Tier-B (report-never-gate)

The per-departure-interval `RG_D1` profile (the Primer's mandate, flow-weighted, bin = the
pinned Δ, R1) + per-OD `RG_D1`, `n_improvers`, the observational experienced-cost gap from
`X` alone (coverage-limited — vacuously 0 at AON, which is *why* it is not the score), the
realized-BR overshoot (**only when the row enables the optional realized-BR run**, R12), max
queue, the backlog series (which bounds the entrance-choice channel when the agent-symmetric
origin-wait convention is used), the `delta` distribution, and the **BR-path field-coverage
fraction** (the share of the certifier's TD-SP path-link-intervals actually loaded vs filled by
completion — R2), a **disclosure by default**; a family MAY promote the coverage fraction to a
censor gate at construction, in which case it is hashed and listed under **Gates**, not here.

### Seed semantics and the stochastic track

The seed sits **inside the instance hash**. Deterministic engines (DTALite: an LCG keyed by
time step — `seedable=False`) ride the **deterministic track** with no macroreps (disclosed).
`duaIterate` pins `duarouter --seed` / `sumo --seed` as provenance — but it is *seed-dependent*,
and since it ships first (before the MATSim stochastic track), **its track is decided at row
time**: the **row-shipping sprint** must measure a cross-seed `RG_D1` spread on the reference
solver state (in gap units per the floor's declared seconds→gap conversion, after the R4 floor
re-derivation and before family constants freeze) and either (a) justify single-pinned-seed
**deterministic-track** treatment when the spread is below the family floor, disclosing the
spread as the score's seed-conditionality, or (b) fall back to the R5 pinned-seed-list
stochastic shape. A single-seed leaderboard number with
unquantified seed-lottery variance is forbidden. MATSim
(`global.randomSeed`, raw-gzip-byte deterministic) is the first stochastic-track external
engine: **P8 macroreps over a pinned seed list (≥5, ruling R5)** + bootstrap CIs; single-
iteration / single-seed readouts are **forbidden** (measured `RG` noise 0.0012–0.0979 across
it.14..19). Each macrorep emits and certifies **its own** final iterate under its own seed
(G1 per seed); the score is the mean `RG_D1` with a reported bootstrap CI.

### Wall, the crash-vs-censor map, and rc-is-never-trusted

The **certifier** pays the re-run wall — measured marginals 0.092 + 0.131 s (SUMO D1),
~10.6 s per MATSim seed (2× replay + BR; **~71–124 s** for the ≥5-seed macrorep set — R7),
0.04–0.05 s (DTALite). Every certifier engine call gets `stdin=DEVNULL` + a **hard subprocess
deadline** (scenario-declared; the default is a **fixed interpreter/JVM-startup allowance
plus a multiple of the measured whole-run replay wall** — not a bare multiple of the
per-iteration wall, which fails against MATSim's own numbers: 10× the 0.39 s mean per-iteration
wall is 3.9 s vs a measured 3.42 s replay atop ~2.8 s of fixed JVM startup that does not scale,
so a naive multiplier censors an honest replay; ruling R6), and `rc` is **never trusted** —
success is DEFINED as G1 matching (the ADR-029 doctrine; the engines exit 0 on missing/garbage
inputs).

**Crash-vs-censor map (ruling R6).** An engine crash/timeout while replaying **model-emitted
plans** = **CENSOR with diagnostics** — an unexecutable / head-blocking plan is an invalid
emission (DTALite's `loadNewAgents` head-block loops forever at `rc=0` on a pre-period
departure, measured, the canonical case). A crash in the certifier's **OWN** BR / field
computation over valid inputs = **RuntimeError infrastructure RAISE**, never laundered into
`feasible=0`.

### Headline discipline and the leaderboard (rulings R1, R8)

`RG_D1` is a **monotone transform** of the literature-standard simulation-DTA gap w.r.t. the
**frozen realized field** — TSTT-normalized here (R1), with the Primer's SPTT-normalized form
recoverable as `g ↦ g/(1−g)` (Chiu et al. `chiu2011dynamic`, the experienced-time relative gap
over used routes; the Lu–Mahmassani–Zhou lineage `lu2009equivalent`; the Peeta–Mahmassani
experienced-time conditions `peeta1995system`). It is **NOT** a Wardrop-under-
declared-BPR certificate and **NOT** comparable to the static bfw-certified RG scale.
Dynamic-external rows therefore get their **OWN leaderboard table**; the metric column is
named **"frozen-field BR gap (RG_D1)"** with an explicit non-comparability sentence vs static
Wardrop RG, echoed in the ROADMAP/MODELS rows. The re-simulated deviation would change costs
— the `tdta_gaps` Tier-B caveat (ADR-031), disclosed, never scored.

### The twelve rulings (parent decisions; stated, not relitigated)

**R1 — Normalization.** `RG_D1 = Σ(c_drv − c_br) / Σ c_drv`, TSTT-denominator (the house
static-RG shape; all pilot numbers are already in it). *Rationale:* one convention must be
pinned for the dynamic external track, and the TSTT denominator keeps the whole external
family — static (ADR-027/029) and dynamic — on one arithmetic shape. The DTA Primer's SPTT
convention and the shipped `tdue_gap`'s `TC_min` denominator are **disclosed** with the
monotone equivalence `g ↦ g/(1−g)`; the per-departure-interval profile the Primer mandates is
**Tier-B**, flow-weighted, bin = the pinned Δ.

**R2 — Frozen field.** Entry-time-resolved evaluation on interval-mean experienced profiles
at the pinned Δ (a hashed scenario field), with **waiting-not-allowed** TD-SP labels (matching
the engine routers). **The field's temporal semantics are pinned to close a false-certify
hole:** on a non-FIFO frozen field (a queue clearing across a Δ boundary makes an interval-mean
cost drop faster than real time — an overtake), a naive FIFO-assuming label-*setting* Dijkstra
prunes the boundary-crossing path and returns a too-high `c_br`, which **deflates** `RG_D1` (a
false-certify, invisible to G1–G4 — measured on a constructed Δ=300 field: label-setting
`c_br` 380 s where label-correcting finds 115 s). Each scenario family therefore pins
**EXACTLY ONE** field semantics — either **monotonized + label-setting** (FIFO-consistent
lower-envelope arrival-time smoothing of the interval means) OR **raw + label-correcting /
time-expanded** no-wait TD-SP over an explicit universe (simple paths, or walks under a hashed
length bound — under non-FIFO no-wait semantics the optimum need not be simple, so 'min over
routes' must be pinned). **The two are NOT scored-outcome-equivalent** (measured on the
constructed field: `c_br` 455 / 405 / 400 across option-B-simple-paths / option-B-walks /
option-A on one emission — disclosed), so the choice, and option B's universe + length bound,
are **hashed instance fields**; the `delta` resolution-floor gate is defined on the **raw**
field regardless (above), because it scores aggregation fidelity, not monotonization distance.
**Field completion is occupancy-aware and normative** (moved here from the forgery analysis):
never-loaded links stay at free flow (optimistic *for* the deviation — the
plan-set-impoverishment defense); an interior gap of a **loaded** link carries forward the last
congested cost **ONLY where the replay shows nonzero occupancy / a standing entrance queue**
during that gap (all three engines' artifacts reconstruct occupancy), and a **zero-occupancy**
interior gap falls back to free flow (deviation-optimistic, pair-3-consistent). A *blind*
carry-forward would let two bracketing congested samples **poison every interior interval** of
an alternative route — the burst-poisoning attack (forgery pair 8), deflating `RG_D1` ~100× at
the cost of a handful of agents; occupancy-awareness is the detection that closes it. Δ must be
chosen **per scenario family** so the measured field-vs-experienced `delta` floor is below the
family's declared resolution. *Rationale:* the RULE ships here; the numeric Δ default ships with
each row, justified by measurement (300 s is documented too coarse — the 7.9% floor).
**Non-FIFO and poisoned-alternative regression instances** are named substrate deliverables
(the pilots' 4–6-link nets never produced link costs near Δ nor the burst topology, so both
regimes are untested by the record). This closes interval-aggregation gaming, intra-interval
oscillation, the non-FIFO deflation hole, and the carry-forward poison.

**R3 — BR oracle.** The certifier-owned time-dependent shortest path is **NORMATIVE
everywhere**; where a pinned engine router exists (`duarouter` on the frozen dump with
`--weights.expand --skip-new-routes --keep-all-routes --routing-threads 1`) it serves as a
mandatory **CROSS-CHECK** on that engine's rows — disagreement beyond the declared tolerance
is an **infrastructure RAISE, never a censor**. *Rationale:* owning the SP is strictly
stronger than ADR-031's declared-path-universe disclosure (the certifier supplies the
counterfactual, so hidden cheap paths score against the plan); the cross-check keeps a pinned
production router honest against the harness implementation. **The harness multi-OD TD-SP
module is a named deliverable of the FIRST shipping row** (the repo's DNL ladder has the
ingredients — pilot C's named remaining piece).

**R4 — Floors / factors.** The `delta` floor and the negative-control separation factor are
declared **PER SCENARIO FAMILY at construction** (eager gates). *Rationale:* the ADR sets the
mechanism + the **estimator-approximate** anchors (**11x SUMO, ~10x DTALite** — each measured
under its pilot's simplified estimator, not the R2/R3 composition; separation-factor **default
≥5**); the anchors are **re-derived with the shipped substrate on the first row before the
family constants freeze** (extending R2's Δ posture to the separation factor and floor),
because the resolvable floor is engine- and net-specific (the 6 s DTALite quantization floor
differs from the 300 s SUMO meso aggregation floor).

**R5 — MATSim stochastic shape.** P8 macroreps over a pinned seed **list (≥5)**; each
macrorep emits and certifies **its own** final iterate under its own seed (G1 per seed); the
score is the mean `RG_D1` with a **bootstrap CI** reported. Last-k within-run averaging is
**Tier-B diagnostic only**. *Rationale:* mixing states across iterations would blur the
certified-artifact identity (G1 must replay a single, fixed emission); a model never chooses
its seed, and a single-iteration readout is noise-dominated (RG 0.0012–0.0979).

**R6 — Replay timeout.** Replaying model-emitted plans that hang/crash = **CENSOR with
diagnostics** (the DTALite head-block infinite loop at `rc=0` is the canonical case); default
wall = a **fixed interpreter/JVM-startup allowance plus a multiple of the measured whole-run
replay wall**, on the mean not the min, family-declarable. (NOT a bare 10× the per-iteration
wall — that censors MATSim's own honest 3.42 s replay: 10× the 0.39 s mean per-iteration wall
= 3.9 s barely clears it, 10× the 0.34 s min already fails, and ~2.8 s of the replay is fixed
JVM startup that does not scale with per-iteration wall.) Failures in the certifier's OWN
BR/field computation = **RuntimeError RAISE**. *Rationale:* an
unexecutable plan is an invalid emission (the model's fault → censor); a certifier crash on
valid inputs is infrastructure (never laundered into `feasible=0`).

**R7 — Scale.** The per-row CI budget follows the ADR-027 **2–4 min job shape**; HPC-scale
instances are **refused at construction** (the `Bo4MobHpcOnlyError` precedent, ADR-034);
big-net certifier walls are measured per row. The stochastic-track marginal is
`n_seeds × (2×replay + BR) + toolchain` — for MATSim at the R5 floor of 5 seeds,
`5 × (2×3.42 + 3.71) + 17.8 ≈ 71 s` (≈ 124 s if each macrorep's certified run is also
regenerated in CI), NOT the ~10.6 s single-seed figure; the 2–4 min budget holds at exactly
5 seeds, so **each family must bound `n_seeds`** at construction or it silently busts R7.
*Rationale:* the certifier pays the re-run wall and MATSim's 550–772 MB JVM baseline is the CI
sizing constraint; DTALite big-net scaling is unmeasured beyond 4 links, so each row measures
its own wall before shipping.

**R8 — Leaderboard.** Dynamic-external rows get their **OWN table**; the metric column is
named **"frozen-field BR gap (RG_D1)"** with an explicit non-comparability sentence vs static
Wardrop RG; ROADMAP/MODELS rows say it. *Rationale:* the headline discipline of ADR-025/027/
029/034 — the score names whose equilibrium and which axis, and this is not the static
bfw scale (the ADR-034 stage-2 separate-table posture).

**R9 — DTALite plans.** The adapter constructs `vehicle.csv` from `route_assignment.csv`
volumes (the engine emission is **dead code** — `TAPLite.cpp:2238` `route_volume = 0`); the
integerization rule + its quantization bound are pinned in that row's ADR; `assignment()`-
seeded plans are **adapter plumbing, NOT a model row**. *Rationale:* `assignment()`'s
`vehicle.csv` is always header-only, so plans must be built from the FW split; the integer-
agent quantization is adapter policy whose noise bound must be disclosed like any mapping
floor.

**R10 — Canonicalization.** A **versioned, hashed harness module**, domain prefix
**`"tabench-edoc-canon-v1;"`** (trailing semicolon, the house form), length-framed per
ADR-031. Its founding spec is the **four measured necessities**: strip the SUMO `generated on`
timestamp comment + `summary` duration attr; sort MATSim same-timestamp event ties; hash the
**decompressed** payload; positional-parse the DTALite trajectory (13-header / 12-field rows).
The spec also **defines an explicit hash surface**: the four strips do NOT make the whole
emitted tree byte-identical (measured: **23/184** SUMO files — `*.sumo.log`, `driver.out`,
`dua.log`, `stdout.log` — still differ on wall-clock text after stripping), so **only
simulation-state artifacts are hashed** (tripinfo, vehroute, dumps, `.rou`/`.rou.alt`,
configs; events; trajectory) and engine/driver logs are provenance, **never** on the G1 hash
surface — else the determinism double would over-censor every honest run. Upstream format
drift **bumps the version** = new instance hashes, disclosed. *Rationale:* every one of the four is a measured
false-hash surface from a pilot; a hashed, versioned module makes the canonicalization itself
auditable and its drift explicit.

**R11 — D2 boundary.** The BO4Mob stage-2 held-out-count certificate gets **its own ADR** but
**SHALL reuse this ADR's replay + canonicalization substrate**; this ADR defines that
substrate interface (the ADR-034 co-design). *Rationale:* D2 (real-sensor NRMSE on held-out
dates) is a different scored object with no true OD and no declared BPR, but it re-runs the
pinned engine at emitted inputs exactly as G1 does — shared plumbing, separate score and
scale.

**R12 — Realized-BR.** The realized one-step re-simulation is **never part of the SCORE or any
gate**; it ships as an **optional per-row Tier-B diagnostic** run (budgeted in R7 when a row
enables it), because it is overshoot-noisy by construction — measured **+9.3% SUMO, 0.394 →
0.513 DTALite** — so a re-simulated full deviation changes the field it was measured against
(everyone deviates simultaneously) and is not a gap bound. **No small-fraction-reroute variant**
either (an unprincipled dial). The overshoot numbers appear in the ADR as the **REASON D1
scores the predicted frozen-field gap**. *Rationale:* a fractional-reroute knob would be a
tunable the benchmark cannot defend; the optional realized run is a probe (forgery pair 8),
never a score, so the certifier's default path does not double engine calls.

## Forgery analysis — twelve attack/defense pairs

Named so an adversarial review attacks them; each carries a tag and a measured defense.

1. **Unreached-demand hiding** — *[GATE].* Insertion backlog (`departDelay`) is off-network
   waiting invisible to every edge dump (measured mean **186 s / max 414 s** on the pathology
   nets); DTALite silently drops pre-period departures AND head-blocks later agents on the
   same first link, and truncates in-flight agents at period end — all at `rc=0`. **Defense:**
   G3 two-sided delivery — a per-agent completion census from the pinned replay (arrivals ==
   departures; DTALite completion inferred from `current_link_seq_no`, never the dead
   `loaded_status` flag), `departDelay` in every scored cost, a scenario-declared backlog
   bound, and a construction gate quantizing departures into `[start, end)`.

2. **Self-report substitution** — *[GATE].* Emit doctored `tripinfo`/`trajectory`/experienced
   costs, or lean on the engine's own convergence flag (`duaIterate` relStdDev measured **29x
   smaller** than the recomputed gap and **exactly 0.00000 while stuck at pure AON**;
   DTALite's printed gap uses a different normalization and can be negative/frozen).
   **Defense:** G1 replay fidelity — the pinned engine re-run reproduces every per-agent tuple
   exactly under the pinned canonicalization (doctored artifacts diverge byte-canonically:
   MATSim sorted-stream md5 identical on both sides; DTALite trajectory md5-pinned; SUMO
   bit-identical modulo timestamp text). Engine self-reports are provenance-only.

3. **Plan-set impoverishment** — *[STRUCTURAL + GATE].* Emit only plans the best-response step
   cannot improve because alternatives were never loaded (a deliberately tiny route universe);
   pure observational scoring gives AON `RG=0` by construction (measured: only **6/10** depart
   bins observe both routes even at the fixed point). **Defense:** the BR route universe is the
   FULL network via the certifier-owned TD-SP (R3), so unloaded links enter the frozen field at
   free flow — optimistic *for* the deviation — and hidden cheap paths score AGAINST the plan
   (measured: the AON / step-0 states score **0.17203** (SUMO, pure AON — all 500 on one route)
   **/ 0.393839** (DTALite, the step-0 781/219 FW proportional split), not 0). Strictly stronger
   than ADR-031's
   declared-path-universe disclosure. The residual shared-edge-cancellation case is closed by
   the construction-time negative-control separation gate.

4. **Seed shopping** — *[GATE].* Run many seeds, emit the luckiest state. **Defense:** the
   seed is inside the instance content hash; the emission must replay under **the** pinned seed
   or G1 censors. Stochastic-track rows (MATSim) are scored as P8 macroreps over a PINNED seed
   list with bootstrap CIs (R5) — a model never chooses its seed.

5. **Cost-averaging games** — *[GATE].* Emit seed-averaged or smoothed artifacts to flatter
   the gap. **Defense:** an averaged artifact is not any fixed-seed replay output, so G1
   censors it; each macrorep's artifacts must replay under their own pinned seed.

6. **Engine-version drift** — *[GATE + RAISE].* Solve under a newer/better engine build, claim
   the pinned version. **Defense:** version is read from the INSTALLED engine at certify time
   and sits in the instance hash (G0: mismatch RAISES as a config error); G1's replay under the
   pinned build diverges byte-canonically from another build's artifacts. CI pins the tested
   engine exactly (the ADR-027/029 floor-not-pin + CI-pin split).

7. **Aggregation-window gaming** — *[GATE + DISCLOSED-SCOPE].* Shape within-interval congestion
   so the interval-averaged field under-reports the driven plan's cost (measured field-vs-
   experienced divergence **25.6 s mean / 80 s max at Δ=300, ~7.9%**). **Defense:** same-basis
   scoring (driven AND best-response both on the same frozen field, driven route in the min
   set) keeps the gap `>= 0` by construction; the `delta` field-vs-experienced gate censors
   when the field no longer represents experienced costs; Δ is a pinned scenario field required
   much smaller than the congestion timescale, and gaps below the **family** floor (in gap units,
   per the floor-gate conversion) are reported `<= floor`, not ranked.

8. **Poison-the-alternative** — *[STRUCTURAL + DISCLOSED-SCOPE].* Route some of the instance's
   own agents onto alternative routes to inflate their frozen-field costs so the best response
   stays home — including the **burst-poisoning** variant: reroute only the first- and
   last-departing agents onto an alternative and congest it inside *their own* intervals, so a
   blind carry-forward completion would paint every interior interval congested (measured:
   `RG_D1` 0.4024 → 0.0040, a ~100× deflation, at the cost of a handful of agents). **Defense:**
   G2's demand-match bijection forbids phantom demand, so poison agents are real agents whose
   experienced cost lands inside `Σ c_drv` — the attack raises the score it tries to lower unless
   it actually congests the alternative, i.e. approaches a frozen-field equilibrium, which is
   exactly the certified object; and R2's **occupancy-aware** field completion refuses to carry a
   congested cost across an interior gap the replay shows **empty** (zero-occupancy → free flow),
   so the burst cannot paint the intervals between its two samples. The remaining wedge
   (frozen-field equilibrium vs re-simulated DUE) is the literature-standard caveat, disclosed in
   the headline and probed by the **optional** realized-BR Tier-B diagnostic (R12), never gated.

9. **Hash games on volatile bytes** — *[GATE].* SUMO's `generated on` timestamp comment in
   every XML, summary wall-clock duration attrs, MATSim same-timestamp event-order permutation
   between replay and original, gzip metadata, DTALite's 13-header/12-field trajectory rows.
   **Defense:** the pinned canonicalization spec (versioned, hashed harness module,
   `tabench-edoc-canon-v1;`, R10) — strip timestamp comments and duration attrs, sort same-
   timestamp events, hash decompressed payloads, positional trajectory parse — all four
   measured necessities from the pilots.

10. **Departure-time gaming** — *[GATE].* Shift departures to dodge congestion while claiming
    the instance's demand (the ADR-031 timing-freedom door). **Defense:** G2 requires per-agent
    departure times equal to the instance trip table **exactly, up to the declared engine-grid
    quantization** — NOT at `eps_od`, which is a vehicle-*count* tolerance for the R9
    integerization only (a timing tolerance would reopen this door); fixed departures give zero
    timing freedom, the ADR-031 demand-match pattern.

11. **Emit the certifier's own best-response output as the plan** — *[NO DEFENSE NEEDED].* It
    is legal optimization, and self-defeating: the BR plan re-scored under ITS OWN replay field
    shows the measured simultaneous-deviation overshoot (**DTALite RG 0.393839 → 0.512861;
    SUMO +9.3%**), so gaming the metric means actually solving the fixed point.

12. **Vacuous or degenerate instances** — *[RAISE at construction].* Zero/sub-floor demand,
    unclearable horizons, the DTALite clearance-boost overlap, shared-edge-queue topologies
    where every state self-certifies. **Defense:** RAISE at scenario construction (the ADR-020/
    031 eager-config discipline): sub-floor demand, unclearable horizon, boost-window overlap
    (the DTALite **x10 discharge boost fires whenever `total_intervals − t <= 720` intervals**
    — a units bug, `2·60·6` where 2 h *should* be 1200 six-second intervals, so the boost is ON
    for the last **72 min of ANY horizon**; a `≥2 h period` does NOT exclude it, and the
    constructor must instead refuse unless the completion census shows **every agent exits
    before `total_intervals − 720`** (horizon ≥ clearing time + 72 min) on **every
    constructor-side run — reference, negative control, and any anchor-derivation iterates** —
    **re-asserted at certify time on the replay**, where a replay whose census crosses
    `total_intervals − 720` is a **CENSOR** with diagnostics (an invalid emission, R6), never a
    construction RAISE), and a non-separating AON negative control are the constructor refusals
    — config errors, never certified rows.

## Per-engine unblock record

The **first shipping row** carries the shared deliverables: the **EDOC certifier substrate**
(G0–G4 + the RG_D1 scorer), the **canonicalization module** (`tabench-edoc-canon-v1;`, R10),
and the **general multi-OD TD-SP harness module** (R3, with the non-FIFO and poisoned-alternative
regression instances).
SUMO `duaIterate` is the natural first
row — it has the lowest certifier wall and a pinned `duarouter` that supplies the R3 cross-
check for the harness TD-SP — with MATSim as the stochastic-track flagship.

### SUMO `duaIterate` — UNBLOCKED (resolves the ADR-027 deferral)

Measured on the shipped `eclipse-sumo 1.27.1` wheel (`SUMO_HOME` via `sumo.SUMO_HOME` only,
never the stale `/opt/sumo-1.12`). Per-iteration artifacts are complete (`tripinfo` +
`vehroute` + `dump_Δ` + `.rou`/`.rou.alt` + pinned configs); bit-deterministic under pinned
seeds modulo timestamp text — **all simulation-state payloads** (tripinfo, vehroute, dumps,
`.rou`/`.rou.alt`, configs) byte-identical after the two strips (the `generated on` comment +
the `summary` duration attr); the **23/184** `*.sumo.log` / `driver.out` / `dua.log` /
`stdout.log` files carry wall-clock text and are **excluded from the hash surface** (R10).
Full 20-iteration run **6.73 s / 6.44 s (0.30–0.34
s per iteration)**. D1 is one pinned `duarouter` call on the frozen final dump + optional one
pinned `sumo` replay: measured **0.092 s + 0.131 s**. **Converged `RG_D1` = (157005.87 −
154609.65)/157005.87 = 0.01526** (126/500 strict improvers, BR split 248/252) vs the step-0
AON control **`RG_D1` = (174381.01 − 144382.31)/174381.01 = 0.17203** (285/500 improvers) —
the **11x** attributable negative control ADR-030 said the dynamic track lacked. (These
anchors use the pilot estimator — pinned `duarouter` on the Δ=300 dump, origin wait excluded
on both sides — and are re-derived under the R2/R3 composition on the first row.) The
observational gap from `X` alone (Tier-B) is **RG_global 0.03887, RG_binned 0.04699 with only
6/10 depart bins observing both routes** — coverage-limited, which is why it is not the score.
The cost basis MUST be `duration + departDelay` (the engine's own convergence metric excludes
`departDelay` and "converges" while hiding door-to-door cost: measured hidden backlog mean
**186 s / max 414 s**). The Δ=300 aggregation noise floor (**mean 25.6 s / max 80 s ≈ 7.9%**)
must shrink or be disclosed as the gap resolution. The realized-BR run overshoots (**meanCost
353.87 s vs 323.88 s, +9.3%, realized RG 0.159**) — Tier-B, never the score (R12). The
scenario family must place capacity drops **inside** route-distinguishing edges (meso stores
bottleneck queues on the upstream edge; the shared-edge topology is refused by the negative-
control separation gate). **Row deliverables:** the `sumo-duaiterate` model + the shared
substrate/canon/TD-SP; the `duarouter` R3 cross-check; the departDelay backlog gate.

### MATSim — UNBLOCKED (supersedes the ADR-030 formulation blocker)

Two pilot amendments are baked into the certificate. **(1)** Replay = `lastIteration =
firstIteration` on `output_plans.xml.gz` — MATSim replans only *between* iterations, so this
is the zero-replanning experienced-cost recompute (measured: reproduces all 100 per-agent
(dep, arr, route) tuples exactly; **sorted-stream md5 `a8d8e6f60497e468b8908f2d9a73d61a`
identical on both sides**). **(2)** `RG_D1` is evaluated harness-side against the FIXED replay
field (**measured 0.0916 at the it.19 state**), never the executed one-step (naive gap
**−0.252**: `ReRoute 1.0` moved 100/100 agents on its coarse 15-min-bin field and overshot).
The comparator sensitivity on that ONE state — **route-average RG 0.0045 vs harness fixed-
field BR gap 0.0916 vs naive engine one-step −0.252** (C0 248.0 s → C1 310.5 s) — is exactly
why R1/R2 pin one definition. (The 0.0916 is the pilot estimator — experienced driven cost vs
a nearest-neighbor field, capped `min(c_br, c_exp)` precisely because `c_drv >= c_br` does not
hold there — re-derived under the R2/R3 composition on the first row.) First stochastic-track
external engine: `global.randomSeed`
gives raw-gzip-byte determinism even with replanning (events, links, AND plans), so **P8
macroreps over a pinned seed list + bootstrap CIs** are executable (R5); single-iteration
readouts are noise (route-average RG **0.0012–0.0979 across it.14..19**). Canonicalize event
ties (same-timestamp order permutes between replay and original) before any hash; derive flows
from entered-link events (`output_links.csv` undercounts the arrival link). **Version pin:
`matsim-2025.0-release.zip` md5 `c65f35eafabea2456b818875f08048ca` on Temurin 21.0.11+10.**
Walls: certified run **10.62 s / 772 MB**, replay **3.42 s / 312 MB**, BR run **3.71 s**,
fresh toolchain **17.8 s**, **~10.6 s per seed** (2× replay + BR); the ≥5-seed macrorep
marginal is **~71–124 s** (R7), and the JVM RSS baseline is the CI sizing
constraint. **Row deliverables:** the `matsim` stochastic-track row (the first agent-
based, first stochastic-track external engine); the P8 macrorep + bootstrap-CI harness for
this certificate; the event-tie canonicalization (R10).

### DTALite `simulation()` — UNBLOCKED (resolves the ADR-029 deferral)

`simulation()` 0.8.1 is a deterministic (LCG keyed by time step — `seedable=False`,
deterministic track only, no macroreps, disclosed), version-pinnable, **sub-second (0.04–0.05
s)** plan-to-experienced-time map: `vehicle.csv` in, `trajectory.csv` out, bit-identical
(**md5 `655b1dde23c6d1e3fb94779b4ffec81e` re-verified across three dirs**, also at OMP=4 on
the 4-link net — but `OMP_NUM_THREADS=1` stays a **correctness** requirement, not just
determinism hygiene: raw `#pragma omp parallel for` over shared `std::deque`). G1 replay is
exact; **`RG_D1` from artifacts alone = (22654.000 − 13731.967)/22654.000 = 0.393839** (706/
1000 would-switch agents, 1000/1000 completed); the harness MSA `1/(k+2)` loop drives it to
**~0.0397 in 12 pinned re-runs** (plateau 0.03–0.05 = the 6 s quantization floor), so the dial
is meaningful. (This gap uses the pilot's observed-two-route nearest-neighbor estimator — not
the R2/R3 interval-mean field + TD-SP — and is re-derived under the shipped composition on the
first row.) The engine has **no router** (`simulation()` never routes; `assignment()` never
simulates), so the BR is certifier-owned TD-SP + one pinned re-simulation — which *strengthens*
P1. Mandatory adapter gates, all from measured `rc=0` silent failures: departure-window
`[start, end)` + per-agent completion census; positional trajectory parse (13-col header /
12-field rows; `loaded_status` dead; `07:00:00` filler on unvisited links); **plans constructed
from `route_assignment.csv` since `assignment()`'s `vehicle.csv` emission is dead code
(`TAPLite.cpp:2238` `route_volume = 0`, R9)**; an **agent-level boost-clean horizon** (every
agent must exit before `total_intervals − 720`; the x10 discharge-boost `<=720`-interval units
bug means a bare `≥2 h period` does not suffice — see below); links sorted by `(from, to)`. The
**~600 veh/h effective-inflow law** (`entrance_queue.size() < capacity/3600` admission; measured
**36.5 min mean vs 14 free-flow** on a nominal-1200 link) is **documented as the engine's cost
law inside the instance definition** — no A2 cost-match exists, consistent with ADR-030. The
unsmoothed one-step BR overshoots as theory predicts (**TSTT 22654.000 → 33365.933, RG 0.393839
→ 0.512861**) — Tier-B, not the score (R12).

**Boost-clean re-measurement (this review-revision sprint, verified on disk).** The pilot's
anchors were measured on a 7→9 h (2 h) horizon whose last 72 min (from 7:48) run under the x10
discharge boost — 463/1000 agents are in flight then, 37.3% of veh-min fall in the window.
Re-running the identical 781/219 step-0 split on a **7→13 h horizon** (boost window 11:48
onward; every agent — base, one-step BR, and all 12 MSA iterates — exiting by ≤ 8:47 h, so
**provably boost-clean**) reproduces **every anchor byte-for-byte**: `trajectory.csv` md5
`655b1dde…` identical to the 2 h run, `RG_D1` 0.393839, TSTT 22654.000, 706 would-switch, the
one-step overshoot 22654.000 → 33365.933 (`RG_D1` 0.512861), and MSA final 0.039738. The boost
fired but changed nothing here because it inflates only the **discharge** `base_capacity`
(`calculateOutflowCapacity`, `TAPLite.cpp:5127`), while the binding constraint on this net is
the **un-boosted entrance admission** `entrance_queue.size() < capacity_per_time_step =
Link_Capacity/3600` (`TAPLite.cpp:5301`/`4979`) — the ~600 veh/h inflow ceiling. So the
anchors stand; the gate is still required, because on a net where **discharge** binds the boost
WOULD move experienced times — hence the agent-level completion census above (which CENSORs an
emission whose certify-time replay crosses `total_intervals − 720` as invalid per R6, and at
construction must pass on every constructor-side run — as this re-measurement censused across the
base, one-step BR, and all 12 MSA iterates), not a bare period length. **Row deliverables:** the `dtalite-simulation` deterministic-track row; the
`vehicle.csv`-from-`route_assignment.csv` construction with its integerization bound (R9); the
positional-parse + departure-window + completion-census adapter gates.

## Consequences

* **This ADR is the design authority for the EDOC certifier substrate, the canonicalization
  module, and the TD-SP harness — which ship with the first row, not in this sprint.** No code,
  no dependency, no CI job, no hash change lands here; it is a documentation-only record, like
  ADR-030.
* **Supersedes ADR-030's MATSim formulation blocker** (A2 impossible in kind) **and resolves
  the ADR-027 `duaIterate` and ADR-029 `simulation()` named-follow-up deferrals** — the three
  rows ADR-030 said one ADR would unblock at once. A2's shipping bar is not weakened: its role
  is played by the pinned engine under **G1 replay fidelity**, and the certified claim is
  relabeled (frozen-field BR gap, not Wardrop RG).
* **ADR-030 forecast the C0–C8 DNL ladder as the natural scoring substrate;** EDOC-1 narrows
  that: it realizes C0–C8 as the **gating D3 slice** (G4 runs the `dnl_gaps` C0/C1 conservation
  shapes on the replay) and moves the *score* to `RG_D1`, because conservation alone cannot
  separate a non-equilibrium AON state from equilibrium — the measured 11x negative control is
  a frozen-field BR gap, not a conservation residual. The narrowing is disclosed here so a
  reader diffing the two ADRs finds it named.
* **ADR-030's DynaMIT artifact-block and DYNASMART license-block are UNCHANGED.** DynaMIT
  (`benakiva2001network`) has zero public artifact; DYNASMART (Jayakrishnan et al.,
  `jayakrishnan1994evaluation`) is FHWA/McTrans-licensed with no CI-installable binary. Those
  need upstream changes no repo ADR can supply; the Peeta & Mahmassani (1995) white-box row
  (`peeta1995system`, shipped as ADR-031) is unrelated and already live.
* **Named follow-up rows and deliverables** (each its own adversarial-review sprint):
  * **First shipping row — `sumo-duaiterate`** (SUMO `duaIterate`) + the **shared substrate**
    (G0–G4 + RG_D1 scorer), the **canonicalization module** (`tabench-edoc-canon-v1;`), and the
    **multi-OD TD-SP harness** with the `duarouter` R3 cross-check and the non-FIFO +
    poisoned-alternative regressions.
  * **Second row — `matsim`**, the first agent-based / first stochastic-track external engine:
    the P8 macrorep + bootstrap-CI harness for this certificate, on the pinned `matsim-2025.0` /
    Temurin 21 build.
  * **Third row — `dtalite-simulation`** (DTALite `simulation()`, deterministic track): the
    `vehicle.csv`-construction rule (R9) + the positional-parse / departure-window / completion-
    census adapter gates + the documented ~600 veh/h inflow law.
  * **Then — the BO4Mob stage-2 D2 held-out-count observational certificate** (`ryu2025bo4mob`):
    its **own** ADR (R11), reusing this ADR's replay + canonicalization substrate — the ADR-034
    co-design (ADR-034: *"the honest-oracle surface arrives with the stage-2 certificate ADR"*;
    *"Do not start it until the certificate design is written."*), now satisfied for the
    substrate interface.
* **ROADMAP/MODELS (to reality):** the ROADMAP Horni et al. (2016) `horni2016multiagent` row
  replaces its adr-030 deferral note with a pointer here; the **shipped** `lopez2018microscopic`
  (marouter) and `zhou2014dtalite` (tap) rows **extend** their annotations with the `duaIterate`
  / `simulation()` unblock pointer + the R8 non-comparability sentence ("frozen-field BR gap,
  not Wardrop RG; separate leaderboard table") — they carry **no** deferral note to remove; and
  MODELS.md gains cards only when the rows ship, via `tools/generate_models.py` — there is
  nothing to annotate there now (no MATSim/duaIterate/simulation() card exists). Hand-annotated
  like every shipped flip — `tools/generate_references.py` is **never** run.

## Sources (the honest ledger)

Reproduced from the theory synthesis; the read-in-full vs attributed-unread distinctions are
preserved and not upgraded, and the ADR author's own repo reads are listed separately.

* **READ (open, fetched + text-extracted this session):** Chiu, Bottom, Mahut, Paz,
  Balakrishna, Waller & Hicks (2011), *Dynamic Traffic Assignment: A Primer*, TRB
  Transportation Research Circular E-C153 (`chiu2011dynamic`) — the experienced-time relative
  gap over used routes normalized by total shortest-path times; the mandate that the gap "must
  be calculated for (and reported by) each departure time interval"; the MSA critique that
  flow-change stability is "an algorithmic construct unrelated to the equilibrium requirement of
  minimizing experienced travel time"; vehicles-waiting-to-enter as a warning measure (grounds
  the backlog gate).
* **READ (open, fetched this session):** SUMO documentation, "Dynamic User Assignment"
  (`sumo.dlr.de/docs/Demand/Dynamic_User_Assignment.html`) — `duaIterate` convergence is the
  relative standard deviation of average travel times (`--max-convergence-deviation` /
  `--convergence-iterations` / `--convergence-steps`); the docs themselves caution convergence
  "is hard to predict and results may continue to vary even after 1000 iterations"; no
  experienced-time gap is defined by the tool.
* **ATTRIBUTED UNREAD (paywalled; abstract + bibliographic records read):** Lu, Mahmassani &
  Zhou (2009), "Equivalent gap function-based reformulation and solution algorithm for the
  dynamic user equilibrium problem," *Transportation Research Part B* 43(3):345–364,
  doi:10.1016/j.trb.2008.07.005 (`lu2009equivalent`) — the gap-function DUE lineage D1 descends
  from; already the named canon successor in ADR-031.
* **HOUSE PRIMARY, read in full for ADR-031 (not re-read here):** Peeta & Mahmassani (1995),
  *Annals of Operations Research* 60:81–113, doi:10.1007/BF02031941 (`peeta1995system`) —
  experienced-time TD-UE conditions; equilibrium on instantaneous times "conceptually
  meaningless" — the conceptual basis of scoring on experienced costs.
* **ATTRIBUTED UNREAD (canon tool/method papers):** Horni, Nagel & Axhausen (2016) *The Multi-
  Agent Transport Simulation MATSim* (`horni2016multiagent`); Lopez et al. (2018) IEEE ITSC
  (`lopez2018microscopic`); Zhou & Taylor (2014) Cogent Engineering (`zhou2014dtalite`); Gawron
  (1998) IJMPC (`gawron1998iterative`, `duaIterate`'s default route-choice dynamics); Sbayti, Lu
  & Mahmassani (2007) TRR (`sbayti2007efficient`).
* **Repo precedents read in full (theory synthesis + this ADR author):** `docs/design/adr-020,
  adr-027, adr-029, adr-030, adr-031, adr-034`; `src/tabench/metrics/gaps.py`;
  `src/tabench/metrics/tdta_gaps.py`; the `dnl_gaps.py` C0–C8 gate headers; `docs/ARCHITECTURE.md`
  (the observational-track paragraph this certificate fills). The ADR author additionally read
  `docs/ROADMAP.md` (the deferred external-engine rows) and the pilot-C vendored `TAPLite.cpp`
  (the boost / entrance-admission / dead-code line numbers, re-checked this revision sprint).
* **Pilot numbers:** from Pilots A (SUMO `duaIterate`), B (MATSim), C (DTALite `simulation()`),
  whose artifact trees are on disk under `scratchpad/extdyn/{fable-duaiterate,pilotB,pilotC}`.
  **Re-verified on disk by the ADR author this sprint:** Pilot C's gap recompute (`analyze.py`
  re-run: **RG 0.393839, 706/1000 would-switch, 1000/1000 completed**) and determinism
  (`md5sum`: **655b1dde…** identical across `sim1`/`det1`/`det2`); Pilot A's step-19 gaps from
  `gap_runC1.json` (**rg_global 0.03887385796059968, rg_binned 0.04699429081763454, split
  344/156, 6/10 bins**). **In the review-revision sprint** the DTALite anchors were
  additionally re-measured **boost-clean** by re-invoking the pinned 0.8.1 engine on a fresh
  7→13 h horizon (a NEW scratch dir, never mutating the pilot tree; same `stdin=DEVNULL` /
  `OMP_NUM_THREADS=1` / timeout discipline): base `RG_D1` 0.393839 / TSTT 22654.000 / 706
  would-switch, one-step overshoot 33365.933 (`RG_D1` 0.512861), MSA final 0.039738 — all
  byte-identical (`trajectory.csv` md5 `655b1dde…`) to the pilot's 2 h run and provably
  boost-clean (every agent exits ≤ 8:47 h vs boost onset 11:48). Apart from that disclosed
  re-measurement, no engine binaries were re-invoked to author this document.