feat(topic): logistic-normal ALR coordinates with true-parameter RMSE

ARCHITECTURE.md

@@ -43,6 +43,11 @@ flowchart LR
 
 Every boundary must be independently usable and expose versioned contracts for integration with organization repositories, `naruon`, and `contextual-orchestrator`.
 
+The `analysis_engine` vertical slice is intentionally separate from `tepp_api`:
+the API owns wire contracts while the engine owns deterministic execution. It
+does not replace the future topic or psychometric estimators and does not read
+another service's application tables.
+
 ## Implemented foundation topology
 
 Task 1 materializes the first storage-independent workspace boundaries. The
@@ -61,7 +66,7 @@ boundaries above remain the target modular MSA architecture.
 | `corpus_split` | cutoff-safe, relation-aware partitioning |
 | `tepp_simulation` | known-truth temporal/event data generation |
 | `validation_core` | RMSE, bias, coverage, graph, and Monte Carlo metrics |
-| `tepp_api` | versioned DTO, schema, and export contracts |
+| `tepp_api` | versioned DTO, schema, terminal-result, and export contracts |
 | `location_membership` | location is not entity identity and not a language channel |
 | `prompt_source` | prompt boilerplate is not unique latent content and not stopword deletion |
 | `corpus_background` | corpus-background wording is not unique latent content and not stopword deletion |
@@ -100,6 +105,8 @@ boundaries above remain the target modular MSA architecture.
 | `model_selection` | statistical/Pareto candidate-`K` gates; LLM votes are not numerical authority |
 | `checkpoint_authority` | a model checkpoint is not the CPU `f64` estimator |
 | `membership_target` | language, episode, template, department, and opportunity-pool targets cannot collapse into entity or project |
+| `topic_measurement` | logistic-normal ALR and sequential Egozcue ILR topic coordinates |
+| `analysis_engine` | bounded cutoff-safe temporal evidence readiness execution and digest-bound terminal artifacts |
 
 
 Foundation crates expose only tested contracts. Empty façades are not public

CHANGELOG.md

@@ -6,6 +6,18 @@ All notable changes to TEPP are documented here. The format follows Keep a Chang
 
 ### Added
 
+- `topic_measurement` bounded deterministic CPU `f64` TRSL-TM reference estimator: canonical CSR/CSC inputs, cutoff-safe documents, standardized event time, weighted multiple memberships, prevalence covariates, explicit predecessor/successor regularization, multi-seed generalized EM, diagonal Laplace uncertainty, and fitted topic-lineage counts with known-truth RMSE plus exact line/branch coverage (ADR 0012; no persistence or accelerated-backend claim).
+- `topic_measurement` logistic-normal additive log-ratio and sequential Egozcue isometric log-ratio coordinates: fail-closed simplex validation, max-shifted stable ALR/ILR inverses with true-parameter RMSE, pairwise CLR Aitchison distance recovered by ILR Euclidean isometry for valid composition pairs, and refusal of TF-IDF/BM25/keyword scores as inferential topic coordinates (ADR 0012 first production slice; no new migration).
+- Coverage contract now excludes Rust multiline string continuation records emitted by LLVM LCOV, keeping the 100% authored-line gate focused on executable production lines.
+- Coverage source classification now scans Rust normal/raw/byte strings, comments, and character literals with escape-aware state, preserving executable string method calls and ignoring quoted comments.
+- Registered the analysis-engine gap-closure doctoring in the canonical documentation map so its product and scientific traceability record is discoverable.
+- Authored Rust coverage classification now ignores standalone structural closing parentheses, preventing formatting-only LCOV rows from appearing as uncovered production behavior.
+- `analysis_engine` vertical slice (ADR 0021): bounded Rust execution from an accepted analysis run to either a cutoff-safe readiness result or a validated `tepp.trsl_topic_lineage.v1` artifact from the ADR-0012 estimator. Topic artifacts preserve fitted predecessor/successor edges, connectable-post and lineage counts, request/snapshot/cutoff bindings, SHA-256 identity, and fail-closed non-convergence/tamper behavior with exact line/branch coverage. This remains active-PR evidence and does not claim causal or psychometric authority.
+- Coverage classification preserves the final expression line of multiline Rust `match` guards while respecting preceding-arm boundaries, keeping the 100% authored-line gate conservative.
+- `tepp_api` fail-closed analysis-result boundaries: status constructors reject
+  terminal envelopes that cannot fit the default 64 KiB status limit, and
+  standalone terminal results reject knowledge cutoffs in the future.
+- `tepp_api` request-bound terminal analysis results and typed analysis-run status/read responses: accepted/running states cannot carry measurement evidence, terminal results bind exact request and receipt identities, and succeeded/failed payloads remain digest-bound or content-redacted.
 - `persistence_postgres` entity/project target SQL now rejects empty, oversized, or hostile type/status labels before insert; interpolated codes are restricted to lowercase ASCII `snake_case` characters so membership foreign keys remain referentially safe (ADR 0003 / ADR 0013).
 - `persistence_postgres` live SQLx transport retains one pool-backed PostgreSQL connection per session so tenant binding and the following statement share a session, and closes the connection and owned runtime safely from another Tokio runtime (ADR 0013).
 - The authored-line coverage gate now filters LLVM-only literal and expression continuation records while retaining branch coverage for their executable decisions; Rust function signatures and structural branch lines are no longer counted as uncovered statements.
@@ -90,13 +102,12 @@ All notable changes to TEPP are documented here. The format follows Keep a Chang
 - `event_core` now requires and retains `EventEvidenceLayer::PromotedTransition` when constructing an `EventInstance`; every other layer is rejected at the promotion boundary, and TDT story classification uses a caller-owned hash set for expected constant-time membership checks.
 - `event_core` ADR 0016 evidence-status gates: TDT detections and CHRONOS predictions cannot admit a forward state transition; first-story detection scores miss/false-alarm rates against a known story stream (Allan 2002 task).
 - `membership_target` identity gate: language, episode, template, department, and opportunity-pool memberships cannot collapse into the entity/project pair stored by migration `0006`; comparison-contract tests record recovered target kinds against an entity-collapse baseline (ADR 0003).
-
 - `tepp_api` naruon live loopback HTTP/1.1 listener: `serve_one` installs a read/write deadline, requires a loopback `Host`, refuses `Transfer-Encoding` and NIM/proxy credential headers, parses `knowledge_cutoff` as RFC 3339 and refuses a future cutoff, keys analysis-run idempotency by tenant plus key, and proves both analysis-run and export POSTs over a real `TcpStream`. Not a production TLS/`$PORT` service (ADR 0011).
 - `tepp_api` adaptive orchestration router (ADR 0010): versioned `direct`/`verify`/`committee`/`conductor`/`abstain` selection from CPU `f64` risk, ambiguity, evidence, and token-budget inputs; recorded stages, recursion, decomposition, access lists, and role-specific reasoning effort; fail-closed document-controlled policy/access/credentials; LLM plans remain proposals under deterministic statistical authority; comparable-budget ablation requires a direct baseline; credential-free contextual-orchestrator binding. Live NIM HTTP remains accepted-target.
 - `tepp_api` purpose-bound provider-payload minimization: time-bounded `PurposeGrant` evaluation, fail-closed expired/not-yet-valid/inverted/cross-tenant/impossible-calendar denial, semantic UTC calendar validation, refusal to copy identity mappings into model-provider payloads or ordinary logs, preservation of opaque analytical identifiers and membership roles (no blanket PII mask), a separately authorized scientific re-identification path, and an internally bound FIPS 180-4 SHA-256 audit digest appended through `ReidentificationAuditSink` before disclosure.
 - `persistence_postgres` backup/restore integrity: restored snapshots stay unusable until tenant, canonical `SHA-256`, knowledge-cutoff eligibility, temporal window order, and append-only triggers revalidate; SQL probes raise `restore integrity failed` (ADR 0013).
 - `persistence_postgres` concurrent document-write stress: atomic revise `DO` block that requires exactly one open `system_to` close, SQLSTATE mapping onto `ConcurrentWriteConflict` / `DuplicateDocumentRecord`, and live multi-session insert/revise/append-only proofs. No new migration number.
-- `tepp_api` naruon HTTP interchange: versioned `https` POST contracts for analysis-run create and modular export authorization that refuse table-access URLs, review/Copilot credential headers, reserved standard-header redefinition, principal-only export idempotency keys, and lexical inference claims (ADR 0011).
+- `tepp_api` naruon HTTP interchange: versioned `https` POST contracts for analysis-run create and modular export authorization that refuse table-access URLs, provider-specific API-key/secret and review/Copilot credential headers, malformed extra HTTP fields, reserved standard-header redefinition, principal-only export idempotency keys, and lexical inference claims (ADR 0011).
 - `persistence_postgres` audit-event SQL contracts: append-only insert that refuses empty, oversized, or hostile `action_code` values before SQL is rendered.
 - `network_analysis` compositional cluster gates: raw topic proportions cannot be treated as Euclidean coordinates; recovered clusters are scored with label-invariant pair precision and recall against known truth.
 - `persistence_postgres` event-instance SQL contracts: bitemporal insert and as-known-at lookup that refuse inverted valid/system windows and hostile type/lifecycle labels before SQL is rendered.
@@ -162,6 +173,9 @@ All notable changes to TEPP are documented here. The format follows Keep a Chang
 
 ### Changed
 
+- ALR and ILR inverse normalization now fails closed when division would turn
+  a representable subnormal weight into a zero simplex part; runtime images
+  are pinned to the reviewed multi-platform Rust and Debian OCI digests.
 - The docstring discovery test compares crate-root names to `EXPECTED_CRATES` instead of a hardcoded count of 10, so `semantic_core` is required and an unapproved extra crate fails closed.
 - The LineageWeave temporal-context read exchange no longer emits a fabricated
   `idempotency-key`; that header remains reserved for retryable write/export
@@ -189,6 +203,9 @@ All notable changes to TEPP are documented here. The format follows Keep a Chang
   #202–#204, and #164 `ff2e645b1785` as the predecessor register head. Duplicate
  PR #179 remains closed. Stacked-merged heads and queued Checks are not
  implemented-main.
+- Rust LCOV quality gating now ignores visibility-qualified function signatures
+  and structural match-arm labels that LLVM reports as zero-hit non-executable
+  lines.
 - Clarified ADR 0001 so it owns Rust-first numerical/reference-backend authority while ADR 0011 owns cross-service MSA/service authority.
 - Clarified ADR 0006 so it owns GPU/VRAM and model-credential boundaries; ADR 0010 now owns LLM orchestration policy and ADR 0015 owns autonomous repository-write/review/merge authority.
 - Expanded ADR 0002–0005 and 0009–0011 with explicit implementation maturity, alternatives, failure/recovery, compatibility/migration, verification, and rollback/supersession boundaries where they were previously implicit.

Cargo.toml

@@ -12,6 +12,7 @@ members = [
     "crates/tepp_simulation",
     "crates/validation_core",
     "crates/tepp_api",
+
     "crates/location_membership",
     "crates/prompt_source",
     "crates/corpus_background",
@@ -50,7 +51,8 @@ members = [
     "crates/model_selection",
     "crates/checkpoint_authority",
     "crates/membership_target",
-
+    "crates/topic_measurement",
+    "crates/analysis_engine",
 ]
 default-members = [
     "crates/evidence_core",
@@ -64,6 +66,7 @@ default-members = [
     "crates/tepp_simulation",
     "crates/validation_core",
     "crates/tepp_api",
+
     "crates/location_membership",
     "crates/prompt_source",
     "crates/corpus_background",
@@ -102,7 +105,8 @@ default-members = [
     "crates/model_selection",
     "crates/checkpoint_authority",
     "crates/membership_target",
-
+    "crates/topic_measurement",
+    "crates/analysis_engine",
 ]
 
 [workspace.package]

DOCUMENTATION.md

@@ -41,7 +41,10 @@ TEPP's approved PRD v0.4 and implementation plan are the primary product baselin
 | Stopword-deletion doctoring | [`docs/research/stopword-deletion.md`](docs/research/stopword-deletion.md) |
 | Provider-payload minimization doctoring | [`docs/research/provider-payload-minimization.md`](docs/research/provider-payload-minimization.md) |
 | Adaptive orchestration router doctoring | [`docs/research/adaptive-orchestration-router.md`](docs/research/adaptive-orchestration-router.md) |
+| Topic log-ratio coordinate doctoring | [`docs/research/topic-logratio-coordinates.md`](docs/research/topic-logratio-coordinates.md) |
 | Hourly NIM OpenCode doctoring | [`docs/doctoring/hourly-nim-opencode-development.md`](docs/doctoring/hourly-nim-opencode-development.md) |
+| Analysis engine v1 doctoring | [`docs/doctoring/analysis-engine-v1.md`](docs/doctoring/analysis-engine-v1.md) |
+| Analysis engine gap-closure doctoring | [`docs/doctoring/analysis-engine-gap-closure.md`](docs/doctoring/analysis-engine-gap-closure.md) |
 | Corpus-split leakage-audit wire doctoring | [`docs/research/corpus-split-manifest-wire.md`](docs/research/corpus-split-manifest-wire.md) |
 | Unicode canonical-identity doctoring | [`docs/research/unicode-canonical-identity.md`](docs/research/unicode-canonical-identity.md) |
 | Change history | [`CHANGELOG.md`](CHANGELOG.md) |

README.md

@@ -6,84 +6,62 @@ implemented in Rust.
 
 ## Current implementation state
 
-This branch keeps the Rust workspace quality foundation and the bounded
-foundation crates. Domain crates expose only tested contracts: immutable
-evidence, six-clock temporal values, event mentions/instances, relations,
-membership, persistence, splits, simulation, validation, API DTOs, and the
-predicted-versus-observed promotion gate.
-This branch establishes the Rust workspace, quality-gate foundation, and the
-longitudinal within/between decomposition capability. The eleven bounded crates
-compile independently. `longitudinal_core` exposes within/between decomposition
-and component RMSE APIs; the remaining crates expose no placeholder production
-APIs, and domain behavior for them begins in Task 2 with immutable evidence
-identifiers and source records.
-This branch establishes the Task 1 Rust workspace and quality-gate foundation.
-The twelve bounded crates compile independently but intentionally expose no
-The eleven bounded crates compile independently; Task 1 includes the
-implemented `encrypted_mapping` crate with AES-256-GCM sealing and
-purpose-bound opening, while the remaining domain behavior begins in Task 2
-with immutable evidence identifiers and source records.
-The eleven bounded crates compile independently. `derived_sensitivity` inherits
-source Restricted/Internal classes onto topic, factor, and relation artifacts
-and fails closed on unknown kinds; derivation and blanket PII masking are not
-declassification. Other crates still begin domain behavior in Task 2 with
-immutable evidence identifiers and source records.
-
-The eleven bounded crates compile independently but intentionally expose no
-placeholder production APIs. Domain behavior begins in Task 2 with immutable
-evidence identifiers and source records.
+This branch establishes the Rust workspace and quality-gate foundation. The
+bounded crates compile independently; domain behavior includes immutable
+evidence records, topic measurement, and cutoff-safe analysis execution.
 
 ```text
-crates/evidence_core
-crates/semantic_core
-crates/temporal_core
-crates/event_core
-crates/relation_graph
-crates/membership_core
-crates/persistence_postgres
-crates/corpus_split
-crates/tepp_simulation
-crates/validation_core
-crates/tepp_api
-crates/prompt_source
-crates/corpus_background
-crates/modality_source
+crates/analysis_engine
+crates/assertion_clock
+crates/available_clock
+crates/checkpoint_authority
+crates/citation_edge
 crates/copied_text
-crates/style_source
-crates/stopword_deletion
 crates/copy_identity
-crates/provider_receipt
-crates/intake_authorization
-crates/summarizes_edge
-crates/outcome_order
-crates/retrospective_edge
-crates/payload_bound
-crates/inferred_status
-crates/support_edge
-crates/system_clock
-crates/event_clock
-crates/assertion_clock
+crates/corpus_background
+crates/corpus_split
 crates/cutoff_clock
-crates/available_clock
+crates/derived_sensitivity
 crates/document_clocks
-crates/revision_order
 crates/encrypted_mapping
-crates/citation_edge
-crates/psychometric_fit
-crates/subevent_containment
+crates/event_clock
+crates/event_core
+crates/evidence_core
+crates/inferred_status
+crates/intake_authorization
+crates/interpretation_gateway
+crates/location_membership
+crates/longitudinal_core
+crates/membership_core
+crates/membership_target
+crates/modality_source
+crates/model_selection
+crates/network_analysis
+crates/operational_log
+crates/outcome_order
+crates/payload_bound
+crates/persistence_postgres
 crates/prediction_contradiction
+crates/prompt_source
 crates/provider_receipt
-crates/operational_log
+crates/psychometric_fit
+crates/relation_graph
+crates/retrospective_edge
+crates/revision_order
+crates/semantic_core
 crates/service_tls
-crates/derived_sensitivity
-crates/longitudinal_core
+crates/stopword_deletion
+crates/style_source
+crates/subevent_containment
+crates/summarizes_edge
+crates/support_edge
+crates/system_clock
+crates/temporal_core
+crates/tepp_api
+crates/tepp_simulation
 crates/topic_lineage
-crates/network_analysis
-crates/interpretation_gateway
-crates/model_selection
-crates/checkpoint_authority
-crates/membership_target
-
+crates/topic_measurement
+crates/validation_core
 ```
 
 ## Local verification
@@ -118,3 +96,7 @@ this skeleton-only slice; it must never conceal uncovered production behavior.
 
 No release, production-readiness, GPU, database, or statistical-recovery claim is
 made by this foundation slice.
+
+The active stacked analysis-engine slice adds a bounded executable readiness path
+from an accepted run to a digest-bound terminal artifact. It is not yet
+implemented-main and does not replace scientific estimator contracts.