# ACAM Sampling, Window, and Freshness Annex

**Version 0.1.0-draft** · Status: **draft for review** (pre-1.0; versions with `ACAM-SPEC.md` §17) ·
License: **CC BY 4.0** · apeiris.ai

> Normative annex to **`acam/ACAM-SPEC.md`** §11 (sampling and time rules) and §12.1 (expiry).
> Machine-readable half: **`acam/acam-sampling.json`** (the minimum-n table, the freshness table,
> the selection-method rules, and the deviation rules as data — this file and that file are one
> release unit with the core spec and version together, ACAM-SPEC V-1).
> Design of record: `COVERAGE_ASSESSMENT_PLAN.md` §4, §13, §14/B2.
>
> **Drafting discipline (inherited from ACAM-SPEC, normative for this annex):** every normative
> sentence must pass the noun-vs-procedure test; each rule below carries an **Enforcement:** line.
> The verifier checks named `SAMP-V-nn` are **specified here, not yet implemented** — they are the
> sampling module of the WS-B B4 deterministic verifier. A `SAMP-V-nn` reference is a stub name
> reserved for that implementation, exactly as the CAP catalog reserves its verifier behavior.

---

## 1. Scope and binding

This annex supplies the tables and procedures that ACAM-SPEC §11–§12 bind by reference:

- the **population definition requirements** (§3 here; consumed by CAP-06, CAP-14, CAP-15);
- the **entity-risk band derivation** and the stated sampling parameters (§4 here; consumed by
  the minimum-n key of CAP-05);
- the **minimum-n table** (§5 here; consumed by CAP-05);
- the **selection-method rules** including the reproducible seed derivation (§6 here; consumed
  by CAP-07);
- the **deviation-handling and extended-testing rules** (§7 here; consumed by CAP-08);
- the **window rules W1/W2** (§8 here; the annex restatement of §11.3, consumed by CAP-09,
  CAP-10);
- the **freshness re-cut table** (§9 here; consumed by CAP-11, CAP-12, CAP-13, and the CAP-25
  verifier staleness state).

Nothing in this annex relaxes a core rule. Where a rule here is stricter than the cap catalog,
both apply and consequences compose by `min` over the ladder order (ACAM-SPEC §13). Rules are
numbered **SAMP-01..30**; each names its enforcing check. Enforcement: `acam-sampling.json`
ships every rule as data; the B4 verifier's sampling module (`SAMP-V-*`) is required to
implement every rule in that file, and the defective-dossier conformance corpus (WS-B B5) must
contain a triggering specimen per rule.

## 2. Statistical basis — stated plainly, honesty first

### 2.1 The stated assumptions (verbatim, per the design of record)

The minimum-n table is an **attribute-sampling** table for tests of controls, computed under:

- **tolerable deviation rate: 5%** for blocking-or-heightened testing, **10%** for standard
  testing;
- **confidence: 95%** for blocking-or-heightened testing, **90%** for standard testing;
- **expected deviations: 0** (the zero-expected-deviation basis: the sample plan assumes no
  deviations; any deviation found means the plan's assumption failed and §7 applies).

The parameter pairing follows the design of record: 5%/95% attaches to blocking controls,
10%/90% to non-blocking; the entity-risk band can only tighten a non-blocking control up to the
blocking parameters, never relax a blocking control down (§4).

### 2.2 The two disclaimers (verbatim, mandatory)

First, the table-level disclaimer ACAM-SPEC §11.2 binds, quoted exactly:

> the table reflects **practice norms, not standards mandates, and is not represented as
> statistically valid inference for any particular population**.

Second, the cell-level disclaimer for every cell marked `practice-norm`:

> **Samples drawn at this cell's minimum are not statistically valid projections of the
> population.** The cell value is a practice-norm test extent; no confidence or tolerable-
> deviation statement attaches to it.

Both texts ship in `acam-sampling.json` (`disclaimers`) and are rendering requirements, not
commentary (SAMP-12).

### 2.3 Which cells are statistics and which are practice norms

Every cell in §5 carries a `basis` marker, one of:

- **`statistically-derived-with-margin`** — the published n is at or above the exact binomial
  minimum for the stated confidence/tolerable-deviation/zero-expected parameters over a large
  population, so the confidence statement holds at the published value. Only the two
  `continuous` cells qualify.
- **`practice-norm`** — the published n follows the widely used frequency-tier pattern for
  tests of controls (the 1 / 2 / 2–4 / 5–10 / 15–40 / 25–60 pattern by frequency). These
  populations (1 to a few hundred occurrences per window) are too small for the attribute-
  sampling model, or the pattern value sits below the statistical minimum. **No statistical
  inference is claimed for any practice-norm cell**; the §2.2 cell-level disclaimer attaches.

The exact binomial minimums (derivations in Annex A):

| Parameters | Exact minimum n (0 deviations) | Published value |
|---|---|---|
| 90% confidence · 10% tolerable | 22 | 25 |
| 95% confidence · 5% tolerable | 59 | 60 |

| Parameters | Exact minimum combined n (exactly 1 deviation, §7) | Published value |
|---|---|---|
| 90% confidence · 10% tolerable | 38 | 40 |
| 95% confidence · 5% tolerable | 93 | 95 |

Published values are rounded up from the exact minimums (a small practice cushion); a published
value below its exact minimum would be a defect in this standard. Enforcement: the exact
minimums and published values ship side-by-side in `acam-sampling.json`
(`statistical_minimums`); recomputing them is Annex A, reproducible by any reader.

## 3. Population definition requirements

- **SAMP-01 (declaration completeness).** Every population-governing control carries the full
  ACAM-SPEC §11.1 declaration set: population definition · `population_enumeration_basis` ·
  population size · control frequency · selection method · sample size · deviations found ·
  deviation disposition; plus `ipe_basis` wherever the system-of-record count is automated.
  A missing `population_enumeration_basis` caps the control at `documented` (CAP-06).
  Enforcement: dossier schema (WS-B B1) required fields; verifier check SAMP-V-01.
- **SAMP-02 (system-of-record declaration, once).** System-of-record object counts are declared
  once in the scoping header; every control-level population declaration reconciles against
  them with typed variances. The reconciliation establishes **internal consistency against a
  declared basis, never population assurance** (ACAM-SPEC §11.1 D3). Enforcement: verifier
  check SAMP-V-02; exception class 4 (`population-reconciliation`) fires on failure.
- **SAMP-03 (enumeration-basis vocabulary).** `population_enumeration_basis` takes exactly one
  value from the closed enum in `acam-core.json` (`enums.enumeration_basis`):
  `provider-api-export` · `registry-export` · `cmdb-export` · `financial-system-tie` ·
  `interview-assertion` · `estimate`. There is no `other`; an out-of-vocabulary basis is a
  missing basis (CAP-06). Enforcement: schema enum; verifier check SAMP-V-03.
- **SAMP-04 (corroboration; the interview-assertion cap).** Where obtainable, the declaration
  carries ≥1 corroborating count from a source other than the primary system of record. Where
  no corroborating count is obtainable, or where the basis is `interview-assertion`, the
  affected controls cap at `documented` (CAP-14, fail-closed). An assertion about what the
  population is can never support item-level effectiveness inference over that population.
  Enforcement: CAP-14; verifier check SAMP-V-03.
- **SAMP-05 (the estimate cap).** `population_enumeration_basis: estimate` caps the affected
  controls at `documented`, identically to `interview-assertion`: a population that can only be
  estimated has no enumerable items to sample from, so no selection over it is verifiable.
  *(Draft decision D-A2-2 — the core spec names only the interview-assertion cap; this annex
  extends the same consequence to `estimate`, strictly fail-closed.)* Enforcement: verifier
  check SAMP-V-03; exception class 5 (`unsupported-enumeration-basis`).
- **SAMP-06 (typed variances).** Every difference between a declared count and a reconciled or
  corroborating count carries a `variance_reason` from the closed enum (adopted here from the
  A1 draft set, unchanged: `timing-difference` · `scope-boundary-difference` ·
  `decommissioned-not-yet-removed` · `provisioning-in-flight` · `duplicate-record` ·
  `source-refresh-lag` · `classification-difference`), each quantitatively accounting for its
  share of the variance with a linked evidence reference. The same discipline applies to
  sample-size and coverage deviations. An absent, out-of-enum, arithmetically-unaccounted, or
  unevidenced variance is treated as a missing enumeration basis (CAP-15). *(Decision D-5:
  this annex carries the seven draft values forward unchanged as the working set; founder
  ratification still gates the 0.1.0 release.)* Enforcement: CAP-15; verifier check SAMP-V-02
  recomputes the arithmetic; exception class 4 fires.
- **SAMP-07 (`ipe_basis` on the count).** Wherever the system-of-record count is produced by an
  automated query or export, the declaration records `ipe_basis` — how the completeness and
  accuracy of that entity-produced information was established (ACAM-SPEC §10.1). Enforcement:
  schema conditional requirement; verifier check SAMP-V-01; exception class 9
  (`ipe-basis-absent`).

## 4. Entity-risk bands and sampling parameters

The minimum-n table (§5) is keyed by **control frequency × sampling band**. The band folds the
control's blocking posture and the engagement's entity-risk declaration (ACAM-SPEC §14.3:
consequence class [financial/safety/rights] · autonomy · reversibility · population exposed ·
regulatory classification — ordinal axis value sets finalize in work package A5) into one
two-value key:

- **SAMP-08 (parameters by band).** Testing under band `heightened` uses **95% confidence / 5%
  tolerable deviation**; band `standard` uses **90% confidence / 10% tolerable deviation**;
  both at **0 expected deviations**. No other parameter set exists in this version.
  Enforcement: the parameters ship as data (`parameters` in `acam-sampling.json`); verifier
  check SAMP-V-04.
- **SAMP-09 (band derivation, fail-closed).** Per control, `band = heightened` when **any** of
  the following holds, else `standard`:
  1. the control is a blocking control (`blocking_effect` ∈ `blocks-deployment` ·
     `blocks-runtime-action`) — the design-of-record 5%-tolerable assignment for blocking
     controls;
  2. any declared entity-risk axis sits at its maximum ordinal value;
  3. any entity-risk axis is undeclared (fail-closed default: missing judgment is treated as
     highest risk, never lowest).
  The band can only move a control **up** to `heightened`; nothing moves a blocking control
  down to `standard`. *(Draft decision D-A2-5 — condition 2's "maximum ordinal value" predicate **[RESOLVED at A5 integration: the risk_tier derivation in ACAM-ENTITY-RISK.md (dominance predicates, fail-closed max-ordinal defaults) supersedes this pre-A5 stopgap; the minimum-n table keys on that risk_tier.]**
  binds to the A5 axis value sets when they ship; until then condition 3 makes the derivation
  fail-closed rather than undefined.)* Enforcement: the derivation is a pure function over
  recorded fields; verifier check SAMP-V-04 recomputes it and ignores any recorded band.

## 5. The minimum-n table

- **SAMP-10 (minimum-n binding).** The minimum sample size for a population-governing control
  is `min(cell value, population size)`, where the cell is selected by the control's declared
  frequency and the SAMP-09 band. A sample below the minimum caps the control at `tested`
  (CAP-05). An **undeclared control frequency selects the `continuous` row** (fail-closed:
  largest n). Enforcement: the table ships as data; verifier check SAMP-V-05 recomputes the
  lookup and applies CAP-05.
- **SAMP-11 (full-population rule).** Where the population size is at or below the cell value,
  the full population is tested (`selection_method: full-population`); this satisfies CAP-05 by
  construction and no sampling inference applies (there is no sampling). Enforcement: verifier
  check SAMP-V-05.

The table (minimum n per window; `S` = standard band, `H` = heightened band):

| Control frequency | Typical population per ≤12-month window | S | H | Basis (S / H) |
|---|---|---|---|---|
| `continuous` (automated or many times daily) | > 250 | **25** | **60** | statistically-derived-with-margin / statistically-derived-with-margin |
| `daily` | ~250–365 | **15** | **40** | practice-norm / practice-norm |
| `weekly` | ~52 | **5** | **10** | practice-norm / practice-norm |
| `monthly` | ~12 | **2** | **4** | practice-norm / practice-norm |
| `quarterly` | ~4 | **2** | **2** | practice-norm / practice-norm |
| `annual` | ~1 | **1** | **1** | practice-norm / practice-norm (full population where the population is 1) |

Cell-by-cell honesty (the §2.3 markers, stated in prose):

- **`continuous` S=25 / H=60** — at or above the exact binomial minimums (22 / 59) for the
  stated parameters over a large population: the confidence statement holds at the published
  values. These are the only two statistically supportable cells.
- **`daily` S=15 / H=40** — practice-norm values; **both sit below the exact minimums (22 /
  59)** even though a daily population (~250–365) is near the attribute-sampling regime. They
  follow the widely used daily-tier pattern (15–40). A daily sample of 40 does **not** support
  a 95%/5% statement; the §2.2 cell disclaimer attaches. An assessor wanting the statistical
  statement on a daily control samples at the `continuous` cell values instead.
- **`weekly` through `annual`** — practice-norm values; populations of ~52, ~12, ~4, and ~1 are
  categorically too small for the attribute-sampling model (a 95%/5% statement over 52 items
  would require testing nearly the whole population). These cells are test extents, not
  inference designs; the §2.2 cell disclaimer attaches.

- **SAMP-12 (disclaimer and marker rendering).** Every dossier surface that renders a
  sampling-supported rung renders (a) the §2.2 table-level disclaimer once, and (b) the cell
  `basis` marker per control, with the cell-level disclaimer wherever the marker is
  `practice-norm`. A rendering that attaches a confidence or tolerable-deviation figure to a
  `practice-norm` cell violates the claim-language register (ACAM-SPEC §16.4). Enforcement:
  the markers are recorded fields computed from the table, not presentation-layer choices;
  verifier check SAMP-V-06 checks their propagation into the dossier's rendered summary
  fields.
- **SAMP-13 (the below-minimum headline).** The rollup headline line **"N controls reached
  `effective` on samples below ACAM minimums"** is verifier-computed and mandatory when
  non-zero; by construction it reads zero in a conforming dossier (CAP-05 prevents it), and a
  non-zero value is exception class 6 (`sample-below-minimum-uncapped`) marking a
  non-conforming producer. Enforcement: verifier check SAMP-V-07 (restates ACAM-SPEC §11.2).

## 6. Selection methods

- **SAMP-14 (closed vocabulary).** `selection_method` takes exactly one value from the closed
  enum in `acam-core.json` (`enums.selection_method`): `full-population` · `random` ·
  `systematic` · `haphazard` · `judgmental-with-rationale` · `management-selected`.
  Enforcement: schema enum; verifier check SAMP-V-10.
- **SAMP-15 (random = seeded and reproducible; no wall clock).** `random` selection is a
  deterministic seeded draw any verifier can recompute:
  1. **ordering** — the enumerated population is sorted by its canonical item identifiers
     (byte-order of the recorded identifier strings), so the input sequence is reproducible
     from the recorded enumeration;
  2. **seed** — `seed = first 8 hex chars of sha256("<dossier_id>@<corpus_version>#<control_canonical_uri>#draw-1")`,
     parsed as an unsigned 32-bit integer. No wall clock, no live RNG, no assessor-chosen
     seed;
  3. **draw** — the seed feeds a `mulberry32` PRNG driving a Fisher–Yates shuffle of the
     ordered population; the sample is the first `n` items of the shuffled sequence.
  This is the corpus's standing selection discipline (the AP-87 study sampler and the
  quarterly sampling-audit selector both derive a seed from a fixed identifier plus the corpus
  version and drive a seeded PRNG — no wall clock anywhere). Enforcement: the seed formula,
  PRNG name, and ordering rule ship as data (`seed_derivation`); verifier check SAMP-V-08
  recomputes the draw from the recorded population enumeration and fails conformance on any
  divergent selected set.
- **SAMP-16 (systematic).** `systematic` selection declares the canonical ordering key and
  samples every `k`-th item with `k = floor(population_size / n)` and a start offset
  `start = seed mod k` using the SAMP-15 seed. A systematic selection without a declared
  ordering key, or with an ordering key correlated with the control's failure modes as
  recorded in the workpaper rationale, is treated as `haphazard`. Enforcement: verifier check
  SAMP-V-09 recomputes the arithmetic; the ordering-key correlation judgment is a recorded
  workpaper field the review lane screens, not a verifier computation.
- **SAMP-17 (effectiveness-eligible methods).** Only `full-population`, `random`, and
  `systematic` selections are **effectiveness-eligible**: they are the selection methods whose
  recorded inputs a verifier can recompute and whose extents the §5 table prices.
  `haphazard`, `judgmental-with-rationale`, and `management-selected` selections cap the
  control at `tested` — a purposive or non-reproducible selection supports no
  representativeness statement, whatever its size. This annex composes with CAP-07 (which caps
  `management-selected` and unrationalized judgmental selection): the cap here is broader and
  strictly tightening; consequences compose by `min`. *(Draft decision D-A2-1 — the core spec
  caps judgmental selection only when the rationale is missing; this annex caps it with the
  rationale recorded too, and caps `haphazard`, which the core spec's catalog does not name.
  Flagged because it makes `tested` the ceiling for every non-reproducible selection.)*
  Enforcement: verifier check SAMP-V-10; the cap is a pure function of the recorded
  `selection_method`.
- **SAMP-18 (judgmental rationale).** `judgmental-with-rationale` requires the recorded
  rationale naming the selection criterion and why it was preferred over a seeded draw; absent
  the rationale, CAP-07 applies (and the SAMP-17 cap already binds). Enforcement: schema
  conditional requirement; verifier check SAMP-V-10.

## 7. Deviation handling and extended testing

- **SAMP-19 (deviations are recorded, typed, disposed).** Every sampling deviation is recorded
  with the item identifier, the observed condition, and a `deviation_disposition` from the
  closed enum: `isolated-root-caused` (a specific, evidenced, non-recurring cause) ·
  `systematic` (the cause applies to other population items) · `undetermined`. A `systematic`
  or `undetermined` disposition is a control failure: the operating sub-state records
  `tested-exception` with no extended-testing path inside this window. Enforcement: schema
  required fields; verifier check SAMP-V-11.
- **SAMP-20 (the blocking-deviation rule).** Any deviation on a blocking control forces the
  failure token `tested-exception` until an extended-testing sub-record satisfying SAMP-21 is
  appended (CAP-08). The deviation record itself is append-only and immutable (DOM-3): the
  extension lifts the CAP-08 *forcing*, never the record. Enforcement: CAP-08; verifier check
  SAMP-V-12.
- **SAMP-21 (extended-testing requirements).** An extended-testing sub-record qualifies only
  when all of the following hold:
  1. the original deviation's disposition is `isolated-root-caused`, with the root-cause
     evidence referenced;
  2. the extension sample is a **second deterministic seeded draw** from the same declared
     population excluding all previously selected items, with the seed derived per SAMP-15
     using suffix `#draw-2` (then `#draw-3`, … — the draw index is the count of prior draws
     plus one);
  3. the extension sample size is at least the control's original §5 minimum;
  4. the extension sample contains **zero further deviations**;
  5. the sub-record is append-only and references the deviation it extends (DOM-3).
  A qualifying extension permits the operating sub-state to record `tested-held` with the
  deviation retained and rendered alongside it; a non-qualifying extension changes nothing.
  On non-blocking controls the same requirements govern the same lift: without a qualifying
  extension, a deviation records `tested-exception` (the nine-cell table then issues the
  token). Enforcement: verifier check SAMP-V-12 recomputes the extension draw and the
  conditions; the conformance corpus contains a lifted and an unlifted specimen.
- **SAMP-22 (post-extension ceiling).** After a qualifying extension, `effective` is reachable
  only when the **combined** sample (original + all extensions) contains exactly one deviation
  and its size is at least the **one-deviation minimum** for the control's band: **95**
  (`heightened`; exact binomial minimum 93) or **40** (`standard`; exact 38), and only where
  the frequency cell is `statistically-derived-with-margin` (`continuous`). In every other
  case the control caps at `tested`: with a deviation in hand, the zero-expected-deviation
  plan failed, and the honest ceiling without the recomputed statistical basis is `tested`.
  On practice-norm cells no one-deviation arithmetic exists (no statistical basis existed at
  zero deviations either), so a deviation on a practice-norm cell caps the control at `tested`
  for the window regardless of extension size. *(Draft decision D-A2-3 — the published
  one-deviation minimums and the continuous-only scope of the post-extension `effective`
  path.)* Enforcement: the minimums ship as data (`extended_testing`); verifier check
  SAMP-V-13 recomputes the ceiling.
- **SAMP-23 (two or more deviations).** Two or more deviations in the combined sample end the
  extension path for the window: the operating sub-state is `tested-exception` (on blocking
  controls the CAP-08 token stands unlifted). Re-testing belongs to the next assessment
  window. Enforcement: verifier check SAMP-V-12.

## 8. Window rules (restated from ACAM-SPEC §11.3)

- **SAMP-24 (W1, non-overridable).** Operating evidence supporting `tested` or `effective`
  falls inside `assessment_window` (start, end; ≤ 12 months). No override, no justification
  path, no counted-exception path; out-of-window operating evidence is excluded before any
  rung computation (CAP-09). Sample items are drawn from the population **as it existed within
  the window**; an item whose occurrence date falls outside the window is not a population
  member. Enforcement: CAP-09; verifier check SAMP-V-14.
- **SAMP-25 (W2).** Design evidence may predate the window start by ≤ 90 days with a recorded
  justification; beyond 90 days, or within 90 days without the justification, the item is
  inadmissible (CAP-10). Enforcement: CAP-10; verifier check SAMP-V-14.

## 9. Freshness and the re-cut table

Freshness is keyed **window-first, evidence-type-second, change-frequency-modified**
(ACAM-SPEC §11.4): the window rules of §8 always bind first; the re-cut table then bounds how
old a **state** item may be, measured **backward from `assessment_window.end`**
(`age_days = assessment_window.end − collected_at`; deterministic, no wall clock at assessment
time). At verification time the same horizons drive the CAP-25 `stale` state against the
verifier's clock.

- **SAMP-26 (state vs event, fail-closed).** Every evidence item is classed `state` (describes
  a condition at a point in time: configuration snapshots, access listings, third-party
  reports, policy documents, walkthrough observations) or `event` (records an occurrence
  inside the window: approvals, tickets, execution logs, incident records — the population
  items themselves). **Event evidence is never re-cut** — its admissibility is governed by W1
  alone; an event does not go stale, it *is* the sample. An undeclared class is treated as
  `state` (fail-closed: state evidence is the class that can expire). Enforcement: schema
  field; verifier check SAMP-V-15.
- **SAMP-27 (subject change frequency, fail-closed).** Every state item declares
  `subject_change_frequency` for the thing the evidence describes: `high` (the subject changes
  monthly or more often) · `moderate` (roughly quarterly) · `low` (annually or less).
  Undeclared ⇒ `high` (fail-closed: the shortest horizon). Enforcement: schema field with the
  fail-closed default applied by the verifier; check SAMP-V-15.
- **SAMP-28 (the re-cut table).** A state item older than its horizon at
  `assessment_window.end` is **stale ⇒ unsatisfied**, and the rung is recomputed without it
  (CAP-11). Maximum age in days by evidence class (rows are the ACAM-SPEC §10.2 reliability
  classes applied to state evidence):

  | State-evidence class | `high` | `moderate` | `low` |
  |---|---|---|---|
  | `state-automated` (system-generated state: configuration snapshot, automated inventory or access export) | 90 | 180 | 365 |
  | `state-third-party` (third-party report on state: external audit report, certification, penetration-test report; its own period of coverage must intersect the window) | 180 | 365 | 365 |
  | `state-human` (human-contemporaneous observation of state: walkthrough record, reviewed screenshot-of-record) | 90 | 180 | 365 |
  | `state-attested` (attested document: policy, standard, management representation — already capped by CAP-01/CAP-03 on the reliability axis) | 90 | 180 | 365 |

  All horizons are additionally capped by the window (365 means "the whole ≤12-month window").
  **These horizons are practice norms, not statistical derivations — there is no statistical
  model of evidence decay behind them, and none is claimed.** *(Draft decision D-A2-4 — the
  horizon values.)* Enforcement: the table ships as data (`freshness.table`); CAP-11; verifier
  check SAMP-V-15 computes `age_days` per item.
- **SAMP-29 (interview notes, non-overridable).** Interview notes are `state-human` inquiry
  records and may never be the sole support on a blocking control, at any age (CAP-12).
  Enforcement: CAP-12; verifier check SAMP-V-16.
- **SAMP-30 (the one freshness override, counted).** Exactly one override exists (OVR-1): on a
  **non-blocking** control, a state item past its horizon by **≤ 90 days** may be retained
  with a recorded justification; every use is counted on the dossier cover (CAP-13). No
  override exists for blocking controls, for W1 (CAP-09), or for the interview-note rule
  (CAP-12) — those appear in no override count. *(Draft decision D-A2-4 also covers the
  90-day extension length.)* Enforcement: CAP-13; verifier check SAMP-V-17 recomputes the
  override count from the override records.

## 10. Verifier checks (B4 sampling module — specified, not implemented)

| Check | Implements | Computation |
|---|---|---|
| SAMP-V-01 | SAMP-01, SAMP-07 | Declaration-set completeness per population-governing control; `ipe_basis` conditional presence. |
| SAMP-V-02 | SAMP-02, SAMP-06 | Recompute the scoping-header reconciliation and every variance's arithmetic accounting; fire exception class 4 on failure. |
| SAMP-V-03 | SAMP-03, SAMP-04, SAMP-05 | Enum-validate the basis; apply the CAP-14 / estimate caps. |
| SAMP-V-04 | SAMP-08, SAMP-09 | Recompute the band from `blocking_effect` + entity-risk axes (fail-closed on undeclared); ignore any recorded band; bind the parameter pair. |
| SAMP-V-05 | SAMP-10, SAMP-11 | Table lookup `min(cell, population)`; apply CAP-05; apply the full-population rule. |
| SAMP-V-06 | SAMP-12 | Check basis-marker + disclaimer propagation into the rendered summary fields. |
| SAMP-V-07 | SAMP-13 | Compute the below-minimum headline count; fire exception class 6 when non-zero. |
| SAMP-V-08 | SAMP-15 | Recompute the seeded draw (sha256 seed → mulberry32 → Fisher–Yates over canonically ordered identifiers) and compare selected sets. |
| SAMP-V-09 | SAMP-16 | Recompute interval + start arithmetic for systematic selections. |
| SAMP-V-10 | SAMP-14, SAMP-17, SAMP-18 | Enum-validate the method; apply the effectiveness-eligibility cap; check the judgmental rationale presence. |
| SAMP-V-11 | SAMP-19 | Deviation record completeness + disposition enum. |
| SAMP-V-12 | SAMP-20, SAMP-21, SAMP-23 | Apply CAP-08; recompute extension draws and the five qualifying conditions; end the path at ≥2 deviations. |
| SAMP-V-13 | SAMP-22 | Recompute the post-extension ceiling against the one-deviation minimums and the cell basis. |
| SAMP-V-14 | SAMP-24, SAMP-25 | Window-membership arithmetic (W1 exclusion; W2 90-day + justification admissibility). |
| SAMP-V-15 | SAMP-26, SAMP-27, SAMP-28 | Class + change-frequency fail-closed defaults; `age_days` per state item; apply CAP-11. |
| SAMP-V-16 | SAMP-29 | Sole-support scan on blocking controls (CAP-12). |
| SAMP-V-17 | SAMP-30 | Recompute the OVR-1 count; verify no blocking/W1/CAP-12 record appears in it (CAP-13). |

## Annex A — Worked statistical derivations (reproduce these yourself)

For attribute sampling with zero expected deviations over a large population, the minimum n
satisfying "confidence C that the true deviation rate ≤ tolerable rate p" given 0 observed
deviations is the smallest n with `(1 − p)^n ≤ 1 − C`:

- **90% / 10%:** `0.9^n ≤ 0.10` → `n ≥ ln(0.10)/ln(0.90) = 2.302585/0.105361 = 21.85` →
  **exact minimum 22** (0.9^22 = 0.0985 ≤ 0.10; 0.9^21 = 0.1094 > 0.10). Published 25.
- **95% / 5%:** `0.95^n ≤ 0.05` → `n ≥ ln(0.05)/ln(0.95) = 2.995732/0.051293 = 58.40` →
  **exact minimum 59** (0.95^59 = 0.0485 ≤ 0.05; 0.95^58 = 0.0510 > 0.05). Published 60.

With exactly one observed deviation, the smallest n with
`(1 − p)^n + n·p·(1 − p)^(n−1) ≤ 1 − C`:

- **90% / 10%:** n = 38 (0.9^38 + 38·0.1·0.9^37 = 0.01825 + 0.07705 = 0.09530 ≤ 0.10;
  n = 37 gives 0.10363 > 0.10). **Exact minimum 38.** Published 40.
- **95% / 5%:** n = 93 (0.95^93 + 93·0.05·0.95^92 = 0.00848 + 0.04150 = 0.04998 ≤ 0.05;
  n = 92 gives 0.05214 > 0.05). **Exact minimum 93.** Published 95.

Cells not derived above (`daily` and slower) are practice norms per §2.3 and §5 — the
frequency-tier pattern in long-standing tests-of-controls practice — and carry the cell-level
disclaimer. No cell publishes a value below a derivation it claims; the two `continuous` cells
are the only cells claiming a derivation.

## Annex B — Draft decisions introduced by this annex (flagged for founder review)

Numbered `D-A2-n` to avoid colliding with the core spec's D-1..D-6 register (nothing here
renumbers an existing decision):

- **D-A2-1** (SAMP-17): `haphazard` and `judgmental-with-rationale` (even with the rationale
  recorded) cap at `tested` — only reproducible selections are effectiveness-eligible.
  Strictly tightens CAP-07.
- **D-A2-2** (SAMP-05): `population_enumeration_basis: estimate` caps at `documented`,
  identically to `interview-assertion`.
- **D-A2-3** (SAMP-22): the one-deviation combined minimums (95 heightened / 40 standard) and
  the continuous-cell-only scope of the post-extension `effective` path.
- **D-A2-4** (SAMP-28, SAMP-30): the freshness horizon values and the OVR-1 ≤90-day extension
  length.
- **D-A2-5** (SAMP-09): the pre-A5 band derivation (any axis at maximum, or any axis
  undeclared, ⇒ `heightened`).

Decision **D-5** (the `variance_reason` enum) is carried forward unchanged by SAMP-06; founder
ratification still gates the 0.1.0 release.