docs(offset): mechanism campaign — five hypotheses dead, onset is a ramp

Records the mechanism investigation in journal 8c. The headline: still unknown,
but the shape is now constrained and a long list of dead ends is closed.

Onset is a ramp of minutes-to-hours, not a step — BE18438 Vert resolved to
one-minute cadence via the histogram corpus, 50% of the excursion in 7 minutes,
>=25 intermediates, validated 75/75 against Blastware's own ASCII. That kills
both poles of the original dichotomy: not a latched digital step, not slow
component wear. What survives is a reversible two-time-constant settling
process, which is a shape constraint and not a mechanism.

Thermal, ground-motion shock, handling/redeployment, accumulated duty, age,
firmware and a mechanical element fault are each refuted or explicitly bounded,
with the power behind every negative stated.

Retracts two claims this journal carried: polarity consistency was a tautology
of offset_scan3's spread gate, and the fleet is 8-9 units rather than 5 once
that gate is dropped. Also notes the gate is blind to onsets by construction --
it rejects a moving floor, and it rejected the one record where the ramp shows.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HgTe8CamXAHcAmaQ6QNcog

docs/offset_investigation.md

@@ -662,6 +662,191 @@ BE9557|Tran 2021-06-28, BE9557|Vert 2025-06-12.
 
 ---
 
+## 8c. Mechanism — five hypotheses tested, all dead (2026-09-06)
+
+**The mechanism is still unknown.** Five campaigns, ~105 effectively independent
+tests, seven nominally significant results against **5.2 expected by chance**
+under a global null. Every one died to its own confound analysis. What the
+campaign bought is a set of *shape constraints* and a long list of dead ends.
+
+### ⚠ Two things retracted from this journal
+
+**1. "Polarity is perfectly consistent — 11 of 11, zero mixed cases."** That is
+a **tautology of the spread gate**, not a property of the fault. `spread <= 0.02`
+requires pre/mid/end to agree, which forces one sign. Amplitude-only at the same
+0.025 threshold: **12 of 53 unit-channels are mixed**, including BE18438|Vert
+(88+/1−) and BE9558|Vert (1+/35−). Withdrawn.
+
+**2. "5 of 45 units, unchanged across a 2x threshold range."** The
+threshold-insensitivity is also a property of the gate. Amplitude-only gives
+**9 units at 0.020, 8 at 0.025** (adding BA10895, BE12844, BE18003), 5 at 0.040.
+The fleet is **8–9 units, not 5**.
+
+**3. "Persistent — it stays until the geophone is serviced."** Weakened, not
+withdrawn. There are **23 recoveries after runs of >=3 flagged events, median
+gap 6.03 days**, three inside ten minutes. BE18438|Vert reads `pre=mid=end=
++0.0000` on 2026-02-10, +0.185→+0.370 across 02-25/26, and `+0.0000` again on
+2026-03-22 — identical Project, Seis Loc, calibration date, geo range and
+trigger throughout. The one thing that cannot be excluded is a **field
+autozero**: it is a button sequence at the unit and writes nothing into the
+event header. So "persistent" may be "persistent unless somebody pressed the
+buttons," and the archive cannot tell those apart.
+
+### The one positive finding: onset is a RAMP, minutes to hours
+
+Both onsets resolvable at minute cadence are ramps. **BE18438|Vert,
+2026-02-20** — the histogram corpus collapses a 14 d 21 h waveform bracket to
+**one minute**:
+
+```
+~14,200 consecutive quiet minutes at 0.000–0.005   (ten full daily files)
+09:32 +0.005   09:39 +0.045   10:20 +0.125   16:00 +0.165
+09:33 +0.010   09:42 +0.070   13:13 +0.150   20:17 +0.185  plateau
+```
+
+**50% of the excursion in 7 minutes**, the rest asymptotic over ~10 h, **>=25
+distinct one-minute intermediates**. Validated **75/75** against Blastware's own
+ASCII export. Its 2025-11-15 onset is the same shape over 2.7 h. BE13117 stage B
+is a 91-minute monotone rise, +0.035 → +1.745 in/s over ~40 samples.
+
+**This kills both poles of the original dichotomy** (journal Q1): not an
+instantaneous latched step (a bad autozero, a stuck trim-DAC), and not slow
+component degradation over days or weeks.
+
+⚠ It rests on **2 of 45 instruments**. Clopper-Pearson on 4/4 resolved onsets
+gives 95% CI [0.40, 1.00] — a mixed population with up to 60% true steps is not
+excluded. BE13117 has zero paired ASCII, so its ramp rests on our decoder alone.
+
+### The methodological corollary — more important than the finding
+
+**A waveform-only bracket manufactures the appearance of a step, and the spread
+gate is blind to onsets by construction.**
+
+The offset is what fires the trigger, so no waveform event can exist until the
+ramp has nearly reached the trigger level. BE18438's first event of each episode
+sits at 0.280 against a 0.300 trigger, and 0.185 against 0.200. At daily cadence
+against a 3 h ramp, P(catching an intermediate) = **0.125**.
+
+And `spread <= 0.02` rejects any record in which the floor is *moving* — which
+is exactly what an onset is. **The gate rejected the very BE18438 record where
+the ramp is visible.** If the operational goal is catching a fault early, before
+the unit floods the store with junk events, the current detector is the wrong
+shape for the job.
+
+### The surviving shape
+
+An **electrical, reversible, two-time-constant settling process** (~10 min and
+~hours), saturating at a ceiling, with occasional sub-3-minute discrete jumps
+superposed (BE18438 2026-02-26: 13:24 pre +0.180 / mid +0.240 / end +0.255 →
+13:27 +0.325, identical metadata). That is the signature of a **bias or leakage
+path charging a high-impedance node** — the class of fault Instantel's autozero
+recovers ~10% of the time, and what the X1/X8 gains measure.
+
+**It is a shape constraint, not a mechanism. Do not write it up as one.**
+
+### Dead — with the evidence, so none of this is re-derived
+
+| Killed | Evidence |
+|---|---|
+| **Latched step at onset** | >=25 one-minute intermediates over ~10 h, ASCII-validated. Direct observation, not a test. |
+| **Slow degradation over days/weeks** | Same observation — bulk of the excursion in 7 min to 2.7 h. |
+| **Thermal driving of pedestal magnitude** | BE13117, 365-count pedestal, n=128: full-day modulation **−0.42% ± 0.42%**, 95% CI [−1.25%, +0.40%]. Healthy-fleet seasonal zero drift totals **~0.3 A/D counts** — 15x to 1200x too small. Best-powered result in the campaign. |
+| **Ground-motion shock** | 30-day window-max percentile ranks 0.03/0.98/0.15/0.01/0.68/0.24, median **0.194** against a null of 0.5. **0 of 7 events >=9 in/s** was followed by an onset within 30 d. BE12599 hit 10.220 in/s (2023-11) and 10.005 (2025-04) and did not onset until 2026-08-14. |
+| **Handling / redeployment** | **0 of 9** onsets had a Project/Client/Seis Loc change. Widened to 30 d: 2 observed vs 4.90 expected, P(X>=2)=0.995 — *depleted*, the wrong direction. The apparent gap effect (p=0.035) died on histogram coverage: BE18438's "59.7-day gap" contains 122 histogram files; true silence 0.52 d. |
+| **Mechanical resonance / damping change** | BE18438|Vert at a 64-count pedestal (3x outside Instantel's ±21): ΔTest-Freq **CI [−0.090, +0.021]** against 0.127 Hz for a real calibration. Block permutation p=0.658. |
+| **Accumulated-duty threshold** | ~4 clean units logged more monitoring than the largest positive onset dose; BE18193 logged **13.45M intervals, 6.2x**. A counterexample — no power argument weakens it. |
+| **Firmware** | **14,338 of 14,340** exports read `V 10.72-8.17`. A constant cannot explain a variable. |
+| **Unit age** | Serial rank-sum 118.0 vs null 115.0, p=0.549; unchanged on the 8-unit re-cut (p=0.586). Serial is a poor age proxy anyway (Spearman +0.113 against archive entry). |
+| **Strong seasonal clustering** | 25 onsets, exposure-weighted permutation **p=0.59**. Excludes >=75%-in-one-season only; a 2x seasonal hazard is *not* excluded. |
+
+Also retire two overstated bounds. H6's dose-response exclusion "|r| > 0.03" is
+a **10x overstatement** once clustering is corrected — the honest bound is
+|r| > 0.1–0.3, so a real r=0.2 is not excluded. And **any statistic quoted
+per-event**: 512 flagged channel-events collapse to **4.9 effective independent
+observations** (unequal-cluster design effect 104.6 at ICC=1), and **55% of the
+flagged corpus is one instrument on two calendar days** (BE13117, 2023-05-03/04).
+
+### Power — read every negative in this section as bounded
+
+Fisher exact, 5 positives of 45, one-sided α=0.05, exposure a third of the fleet:
+
+| relative risk | power |
+|---|---|
+| 1.5 | 0.059 |
+| 2 | 0.112 |
+| 3 | 0.231 |
+| 6 | 0.497 |
+| 15 | 0.753 |
+
+80% power needs **RR ≈ 13–20**. Even a *perfect* split reaches p<0.05 only if
+the exposed group is <=25 of 45 units. **This archive can detect only
+near-deterministic unit-level causes.** Every negative above excludes a strong
+effect, not a real one.
+
+### What this archive can NEVER answer
+
+- **The A/D zero and the X1/X8 gains.** The 2027–2069 numbers appear in no file,
+  header or decoded record. They exist only on a live device behind `SUB 0x0E`.
+  Q1 is structurally unanswerable from data.
+- **Unit-level vs component-level cause.** **Zero of 14,340** exports carry a
+  geophone or sensor serial. Q4 is dead — there is no way to know whether the
+  same physical geophone came back after service.
+- **Service history.** The only service-adjacent field is `Calibration: <date>`
+  — 30 distinct dates fleet-wide, none before 2023, ASCII corpus entirely
+  2025–26. BE9558's 2020 and BE13117's 2023 episodes have no calibration record.
+- **Temperature.** Zero exports carry it. Battery Level is a verified coarse
+  thermometer (+0.204 V winter over summer, 20/20 unit-years, p=9.5e−7, matching
+  lead-acid tempco) but quantised at 0.1 V ≈ 10 °C — useless within a day. The
+  archive can *bound* thermal; it can never *test* it.
+- **BE13117 specifically** — 55% of the flagged corpus, the largest pedestal at
+  1.92 in/s, **zero** ASCII exports, histogram record ending eight months before
+  its episode. The most informative case in the archive is permanently outside
+  every metadata test.
+- **The mild-offset rate**, and therefore the base rate's denominator. Event
+  files only see offsets large enough to dominate the trace.
+
+### The experiment to run — `SUB 0x0E`, one afternoon
+
+Point Blastware at `bridges/ach_mitm.py` and run **Unit Channel Test** against
+(1) a faulting unit, (2) a known-good control, (3) the same unit before and
+after an autozero. BW's sequence is `0x0E x8 → 0x98 x2 → 0x0E x8`, the second
+pass carrying live ADC. Eight 10-byte payloads with expected values near 2048 is
+a very constrained puzzle.
+
+- **Proves:** whether the X1/X8 gains are readable over the wire, and whether
+  the fault sits at or upstream of the ADC zero reference. Gains walk out of
+  2027–2069 with the pedestal → the fault *is* the zero reference, Q1 answered.
+  Gains hold while the trace moves → the fault is downstream, look at the front
+  end.
+- **§8c hands it a falsifiable time course:** poll at ~1-minute cadence and the
+  numbers should **ramp over minutes-to-hours, not step**. If they step while
+  the trace ramps, the two are decoupled.
+- **Payoff:** converts the 10%/90% ship-it-or-not gamble into a decision made
+  before packing a box, remotely, for the whole fleet.
+- ⚠ In the MITM topology filenames are reversed — `raw_s3_*.bin` holds
+  Blastware's bytes.
+
+**Second: swap the geophone** between a faulted base and a healthy one. Fault
+follows the sensor → element or cable. Fault stays with the base → front-end
+board. One afternoon, zero code, and it settles the one question the archive is
+permanently blind to.
+
+**Third: log a faulting unit for 72 h untouched.** Every recovery we have is
+confounded by a possible field autozero. A shelf and a logger settles whether
+the fault genuinely self-reverses.
+
+**Fourth, free: re-cut the fleet label** — drop the spread gate, re-score
+amplitude-only, screen the 11 unscreened thin-coverage units. Might reach 9–10
+positives. Be honest about the gain: power against "older half carries 3x the
+hazard" rises only 0.23 → 0.30.
+
+**Highest-value item overall, and not an experiment: the RMA/repair records.**
+Which unit went back, when, what was done (autozero vs geophone replaced vs
+board), and the geophone serial fitted. "Same channel after a documented
+geophone *replacement*" is component-level-negative in one observation.
+
+---
+
 ### ⚠ Serial prefixes — four of these units are BlastMates, not MiniMates
 
 Corrected 2026-09-06, after Brian queried "BA10895?" against a report that
@@ -707,3 +892,7 @@ decoder lost the geo threshold along with the serial. See commit `9ceff65`.
 | 2026-09-04 | **BA10895 reclassified** from transient to a genuine Vert fault of a different subtype — 49.4% single-axis-dominant events, the highest in the fleet, 100% on Vert. The other six marginal units are clean. |
 | 2026-09-04 | **Defect found in `offset_scan3.py`**: its `spread <= 0.02` gate discards 18.8% of rows with \|pre\| >= 0.025, concentrated on 41 negative unit-channels; 4 would be sustained positives without it. The fleet label is three-state, not two. |
 | 2026-09-06 | **Four units relabelled BA, not BE** — BA9229, BA10060, BA10895, BA15957 are BlastMates. The BW filename carries only the serial number; the family prefix must be read from the file body. Fixed in the scanners and in two production sites. |
+| 2026-09-06 | **Mechanism campaign — five hypotheses, all dead.** Thermal, ground-motion shock, handling/redeployment, accumulated duty, unit age, firmware and a mechanical element fault are each refuted or bounded. 7 nominally significant results against 5.2 expected by chance. |
+| 2026-09-06 | **Onset is a RAMP of minutes-to-hours, not a step** — BE18438 Vert resolved to one-minute cadence, 50% of the excursion in 7 min, >=25 intermediates, ASCII-validated 75/75. Kills both a latched digital step AND slow component degradation. Surviving shape: a reversible two-time-constant settling process — a bias/leakage path charging a high-impedance node. |
+| 2026-09-06 | **Polarity consistency RETRACTED** (a tautology of the spread gate; amplitude-only gives 12 of 53 unit-channels mixed) and the fleet **re-cut to 8–9 units, not 5**. "Persistent until serviced" weakened: 23 recoveries, median gap 6 days — though a field autozero cannot be excluded. |
+| 2026-09-06 | The spread gate is **blind to onsets by construction** — it rejects a moving floor, which is what an onset is. It rejected the very record in which the ramp is visible. |