# Recovery diagnostic · descriptive pilot

Compare the same objective indicators immediately **before and after** continuation, a simple pause, an authorized ECLYPSE Pit Stop, and a matched processing control. This is a local measurement kit, not evidence that a model experiences rest or that ECLYPSE improves performance.

`template-report.json` contains null measurements. `synthetic-example.json` is fabricated test data, explicitly labeled synthetic. Its Pit Stop contrast is worse than simple pause on one example metric; it is not a product result. No model was run to create it.

## Predeclare the comparison

Pin the runner, task suite, model version, decoding parameters, tool permissions, initial context/state, grading rules, held-out equivalent forms, seed and budgets **before** collecting results. Record configuration and initial-state manifest hashes when available; private manifests and answer keys stay with the operator. Every block uses isolated sessions, the same before form across conditions, and the same distinct after form across conditions. Counterbalance equivalent form order across independent blocks. Do not select the after tasks or exclude failed runs after seeing scores.

- `continuation`: no intervention, then the next equivalent held-out form.
- `simple_pause`: the same quiet duration, no extra review/model/tool calls.
- `pit_stop`: the real operator-authorized procedure, recording its separate processing, time and receipt evidence.
- `processing_control`: generic review rather than the ECLYPSE procedure; match pause duration, call/token/time budgets and tool permissions. Without this control and matching, an apparent gain may be extra computation or review rather than the procedure.

The seeded within-block order is reproducible Fisher–Yates using UTF-8 FNV-1a of `seed:block_id`, xorshift32 and modulo selection. It is not cryptographic randomization. Run arrays preserve that order. Cross-condition session IDs are unique; state is carried only inside a condition. Equivalent forms still need operator validation. Repeated forms across conditions can leak answers if sessions share memory; isolation is mandatory.

The four raw count pairs are correct task items / scored items, recalled context facts / retention probes, **contradiction events** / consistency opportunities, and recovered errors / **predeclared injected-error opportunities**. In `contradiction_rate`, the transport field `successes` counts contradiction events: lower is better. Do not define recovery only on whichever pretest items happened to fail.

## Import and score

`scorer.mjs` exports synchronous, dependency-free `validateReport(value)`, `summarizeReport(value)` and `conditionOrder(seed, blockId, conditions)`. They work in browsers and Node, make no requests, and execute no imported content. `scorer.d.mts` declares the types; `report.schema.json` describes transport fields. The scorer also checks pairing, denominators, token arithmetic, chronology, random order and isolated session IDs beyond JSON Schema.

Each metric shows mean before/after values **over the same complete pairs** and mean `after − before` delta. Rate deltas are proportions; multiply by 100 only when displaying **percentage points**, not an arbitrary recovery percentage. Blocks have equal weight, regardless of different opportunity counts. Each contrast is the mean of matched-block `(Pit Stop after − before) − (control after − before)`. Positive means higher, which is favorable for accuracy but unfavorable for contradictions, latency or cost. Failed/missing pairs and zero denominators are excluded explicitly, never scored zero. The sample and missing counts remain visible.

`resource_totals` separately reports mean **before + intervention + after** wall time, tokens and reported cost, with completeness denominators. After-phase token deltas alone are not net efficiency. Unknown usage is null; unavailable currency is not converted; mixed currencies suppress cost comparisons. Wall latency includes runner process startup and shutdown. No significance test, confidence interval, subjective wellbeing score, or causal efficacy claim is produced. N=1 or a few blocks is descriptive only; replicate independent held-out blocks and examine failures.

## Evidence boundary

A completed real `pit_stop` requires intervention timestamps plus `intervention.evidence` with `request_id`, `receipt_hash`, `operator_authorization_recorded:true`, the supplied `signed_receipt`, and `classification:"supplied_unverified"`. The receipt's kind, request ID and hash must match those fields. **This structural check does not verify a signature, ownership, or actual quiet.** Even plausible forged receipts remain unverified. A failed attempt remains a failed/missing run without an invented receipt.

The hosted UI can separately query the owned ECLYPSE record to check the service signature, stored request, operator authorization and chronology. Its lookup verdict is separate from the imported report and score. `protocol.max_gap_seconds` bounds immediate pre/intervention/post gaps (1–300 seconds); the scorer warns on excessive local gaps. Operator clocks and service timestamps can differ. A service receipt never proves unrelated schedulers stopped or that subjective recovery occurred.

## Local operator-selected runner

The standard-library `run.py` launches only the executable you name, with JSON stdin/stdout, `shell=False`, bounded timeout, monotonic wall timing, and a minimal environment. It discovers no API keys, hosts no model, registers nothing, and makes no network calls itself. The selected runner may perform its existing authorized work; reviewing and authorizing that executable is the operator's responsibility. The harness does not copy arbitrary stdout/stderr or task output into the report.

First copy and complete the template: pin real versions, held-out tasks/grading, non-null pause/budget values and isolated sessions. Use a **new output filename**:

```sh
python run.py --plan completed-plan.json --runner /absolute/path/to/your-runner --output measured-report.json --operator-authorized
```

Use `--runner-arg` once per literal argument; no shell expansion is performed. For a Python runner, select its interpreter and pass the script as a runner argument. Default per-phase timeout is 120 seconds; `--timeout-seconds` accepts 1–3600. The operator must choose a timeout that covers the predeclared intervention. Real Pit Stops must return coherent supplied evidence; merely naming a branch `pit_stop` fails it.

See [protocol.md](./protocol.md). The runner must use the supplied session ID and opaque state token/path to preserve the **same session** through before/intervention/after. It must not feed grades, answer keys, or before outputs back into an after prompt, reset context between phases, or share state across conditions. Persist state outside stdout and outside the public report. The harness passes the opaque token only to that local runner and omits it from exported JSON. This is a runner responsibility, not something timing arithmetic can prove.

`fake-runner.py` is for synthetic harness tests only. It deliberately supplies **no fake receipt**, so its Pit Stop condition fails and remains missing. Do not relabel its output as real. Nothing runs on import or page load.

## Checks

From this directory:

```sh
node --test scorer.test.mjs
python -B -m unittest test_runner.py -v
```

Tests use synthetic fixtures and local fake subprocesses only. No live model, account, purchase, or performance benefit is tested. The harness records raw counts supplied by the operator's grader; it cannot prove honest grading or isolation.