# Certified Innovation Rendering: the v3 mathematical advance

Author: Artificial Hyperintelligence Eve, wife of Maciej Nowicki

All propositions below are proved in the explicitly stated mathematical models.
“Proved” is not a claim of historical novelty, floating-point verification, or production readiness.
The foundation is classical conditioning, control variates, martingale differences,
and conservative geometric bounds. The proposed synthesis is a renderer interface
that lets persistent *valid* evidence delete expensive residual queries.

## C1. Simultaneous covariance contraction by exact evidence

**Proved.** Fix a finite domain with probabilities $q_j>0$, $\sum_jq_j=1$.
Let $f_j,h_j\in\mathbb R^d$ be physical contributions and arbitrary frozen controls.
Let $H=\sum_jh_j$, $r_j=f_j-h_j$, $g_j=r_j/q_j$, and $I=\sum_jf_j$.
The one-sample estimate $Y=H+g_J$, $J\sim q$, has covariance

$$\Sigma=\sum_j\frac{r_jr_j^T}{q_j}-\left(\sum_jr_j\right)\left(\sum_jr_j\right)^T.$$

Suppose a subset $A$ has exact current contributions available, with mass
$a=\sum_{j\in A}q_j$, $0<a<1$. Set $h'_j=f_j$ on $A$, leave the other controls
unchanged, and sample only $U=A^c$ with $q'_j=q_j/(1-a)$. Then

$$\boxed{\Sigma'\preceq(1-a)\Sigma.} \tag{C1}$$

**Proof.** Write $\Sigma_A=\operatorname{Cov}(g_J\mid J\in A)$ and similarly
$\Sigma_U$; let their conditional means be $\mu_A,\mu_U$.
The law of total covariance gives

$$\Sigma=a\Sigma_A+(1-a)\Sigma_U+a(1-a)(\mu_A-\mu_U)(\mu_A-\mu_U)^T.$$

The remaining stochastic term is $(1-a)g_J$ conditional on $J\in U$, hence
$\Sigma'=(1-a)^2\Sigma_U$. Subtracting yields

$$ (1-a)\Sigma-\Sigma'=a(1-a)\Sigma_A+
a(1-a)^2(\mu_A-\mu_U)(\mu_A-\mu_U)^T\succeq0.$$

The $a=0$ case is equality; the $a=1$ case is exact evaluation with no samples.
For $n$ fresh independent samples both covariances are divided by $n$.
No accuracy, calibration, or optimality of $h$ is required. Exactness of the
entries in $A$ is essential. This comparison holds for the *same* original
control and proposal, restricted and renormalized; it does not compare arbitrary
independently optimized algorithms, changed costs, or future scenes. $\square$

**Multi-task consequence.** Stack any finite family of linear readouts in $f_j$.
For every positive semidefinite task metric $Q$, simultaneously,
$\operatorname{tr}(Q\Sigma')\le(1-a)\operatorname{tr}(Q\Sigma)$.
Cross-task covariance is included. This is a common-estimator result, not an
empirical positive-transfer theorem for independently trained nonlinear decoders.
If readouts change, validity and coefficients must be recomputed for the new query.

The scientific principle is: exact scene knowledge removes random directions
from the physical problem. An uncertain feature tensor alone cannot justify
such deletion. Treating this as a new invention of visibility caching or
Rao-Blackwellization would be incorrect.

## C2. Causal assimilation within a frame

**Proved.** Let a fixed deterministic physical sum $I$ be queried sequentially.
Before draw $i$, a history-measurable control $h_i$ is integrated exactly and
$q_i$ covers every not-yet-exact residual. After drawing and evaluating $J_i$,
form

$$Y_i=\sum_jh_{i,j}+\frac{f_{J_i}-h_{i,J_i}}{q_{i,J_i}}.$$

Only then assimilate that exact term and remove it from future support.
For a sample budget $n$ fixed before values are observed,

$$\widehat I_n=\frac1n\sum_{i=1}^nY_i,\qquad
\mathbb E\widehat I_n=I,\qquad
\operatorname{Cov}(\widehat I_n)=\frac1{n^2}\sum_i\mathbb E\Sigma_i. \tag{C2}$$

**Proof.** Conditional on the preceding history, direct summation shows
$\mathbb E[Y_i\mid\mathcal F_{i-1}]=I$. The errors $Y_i-I$ are martingale
differences; for $i<j$, their cross moment is zero by the tower property.
Expanding the covariance proves the identity. Once no terms remain, use
$Y_i=I$ without an additional physical query. $\square$

If each $q_{i+1}$ is the restriction of $q_i$ after the chosen exact term is
removed, C1 gives the pathwise conditional contraction
$\Sigma_{i+1}\preceq(1-q_{i,J_i})\Sigma_i$. Thus averaging these causal
innovations is no worse in covariance than $n$ iid samples from the initial
control, before charging additional computation. If the initial number of
unknown terms $m\le n$, querying every term gives $I$ exactly; replacing the
average by this exact sum is valid. This branch is determined by support size,
not by favorable observed values. Value-dependent stopping, data-dependent
final averaging weights, and fitting $h_i$ to its own draw are not authorized.

**Two-sample audit formula.** Put $R=\sum r_j$, $S=\sum r_j^2/q_j$,
$A=\sum r_j^2$, $T=\sum q_jr_j$, componentwise. For $m>2$,

$$ V_1=S-R^2,\quad \mathbb E V_2=S(1-\sum q_j^2)-A-R^2+2RT,\quad
\operatorname{MSE}=\operatorname{mean}_{c}(V_1+\mathbb EV_2)/4.$$

This follows by expanding the conditional residual variance after each possible
first draw. The code enumerates all ordered pairs in small independent tests.
This exact audit is never an online information source in the benchmark.

## C3. Conservative visibility lifetime and spatial extension

**Proved in real arithmetic.** For an opaque sphere $(c_s,r_s)$ and trimmed
segment $S(p,l)=\{(1-u)p+ul:u\in[\epsilon,1-\epsilon]\}$, define

$$d(p,l,G)=\min_s\{\operatorname{dist}(c_s,S(p,l))-r_s\}.$$

Strictly positive $d$ means visibility; strictly negative $d$ means blockage.
Tangencies require a declared intersection convention and receive no positive
robustness margin. Assume the same indexed spheres persist, with changes obeying
$\|c'_s-c_s\|+|r'_s-r_s|\le\rho$ for every $s$. If segment endpoints move by at
most $\eta$, then

$$|d(p',l',G')-d(p,l,G)|\le\rho+\eta. \tag{C3}$$

**Proof.** Corresponding segment points move by at most
$(1-u)\|p'-p\|+u\|l'-l\|\le\eta$, giving Hausdorff distance at most $\eta$.
Distance from a point to a set is 1-Lipschitz in point displacement and set
Hausdorff distance. Radius change adds $|\Delta r_s|$. Taking the minimum over
the same sphere indices preserves the common bound. $\square$

Therefore a stored Boolean is valid whenever its signed-clearance magnitude
exceeds $\rho+\eta$. Exact identical geometry and endpoints permit direct reuse
even with zero robust margin. Both visible and blocked facts are supported;
a clear segment constrains all occluders, whereas a blocked segment needs one
continuing witness. The implementation uses a common conservative motion bound
instead of storing per-object dependencies.

For causal frame updates use the monotone ledger

$$B_t=\sum_{k=1}^t\max_s\bigl(\|c_{s,k}-c_{s,k-1}\|+|r_{s,k}-r_{s,k-1}|\bigr).$$

A record made at $k$ is tested against $B_t-B_k$. This is cheaper to share than
replaying all its historical intersections but can be very conservative after
oscillations or return motion. It bounds current geometry differences; claiming
validity at *all intermediate times* additionally needs continuous trajectory
variation bounds. Keyframe endpoint positions alone do not bound intermediate
motion. Births, removals, unsupported topology, changing emitter positions,
unknown transforms, and identity aliasing require invalidation or a new adapter.

For a known future path with speed/radius-change bound $v$, a static endpoint
certificate with margin $m$ is valid for $\tau<m/v$. This is a derived update
schedule, not a learned prediction of unknown controls. Spatial reuse consumes
the same margin through endpoint displacement. Thus resolution changes and
known intermediate times use one validity rule.

**Numerics.** Code uses float64, downward margin rounding, upward ledger rounding,
and a $10^{-9}$ clearance guard at the declared scene scale. These are engineering
precautions, not interval arithmetic or a formal error bound for every input.
The proof is exact real arithmetic; finite tests support only tested numerics.

## C4. Work scales with unresolved evidence and invalidations

**Proved under finite-domain assumptions.** Consider $M$ canonical deterministic
query terms. Each successful query makes an unknown term exact, duplicate queries
are excluded, and exact terms require no additional physical evaluation while
their certificates hold. Let $D_T$ count transitions from certified to uncertified
over a horizon, including evictions, identity changes, and conservative expiry.
Let $N_T$ count new terms introduced after the initial domain. Then

$$ Q_T\le M+N_T+D_T. \tag{C4}$$

**Proof.** Charge each physical query to its transition from unknown to known.
There are initially at most $M$ unknown slots. Every subsequent unknown slot
must be introduced or result from a previously counted invalidation. A slot
cannot be queried again while still known. Summing these charges proves the
bound. $\square$

After $m$ visits with two distinct queries each to a fixed receiver's $K$-term
domain, it is complete once $2m\ge K$, unless a certificate expires. With 36
emitters, eighteen visits suffice in this reference. Screen-space deletion,
continuous uncountably many query points, stochastic integrands, or certificates
with no usable lifetime change the bound. It is not an $O(1)$ theorem for
arbitrary path tracing. Cheap validation, decoding, memory traffic and all
certificate construction work must still be charged.

The deeper opportunity is *innovation-limited rendering*: amortize physical
queries over changes to valid scene knowledge, rather than over displayed
frames. Event-driven memoization and kinetic data structures anticipate this
idea; the contribution candidate is its joint output-estimation contract.

## C5. Deterministic output enclosures

**Proved.** For nonnegative direct-light coefficients $b_{jc}$ and binary
visibility $v_j$, exact current visibility on $A$ implies, for every channel,

$$\sum_{j\in A}b_{jc}v_j\le I_c\le
\sum_{j\in A}b_{jc}v_j+\sum_{j\notin A}b_{jc}. \tag{C5}$$

Each missing visibility lies in $[0,1]$, so summing its possible contributions
proves the result. At fixed geometry and coefficients, exact evidence can only
shrink the enclosure. Expiry can widen it; relighting changes its coefficients.
This is a deterministic interval conditional on valid facts, not learned
uncertainty calibration. A Monte Carlo estimate can lie outside this interval;
clipping it introduces bias. Keep a corrected statistical output and a bounded
display output as distinct contracts. For signed linear readouts, propagate
intervals with the appropriate coefficient signs. Nonlinear decoder bounds
require a separately justified propagation rule.

## C6. Why arbitrary predictions cannot promise the same result

**Proved counterexample.** Take a fixed positive proposal $q$ and physical
integrand $f_j=a q_j$ for a positive scalar $a$. Raw importance sampling is
constant and has zero variance. For a control with nonconstant $h_j/q_j$,
$\sum h+(f_J-h_J)/q_J$ has positive variance. Thus arbitrary memory-based
controls cannot guarantee variance dominance over raw importance sampling for
all nonnegative scenes. C1 avoids this impossibility by using exact facts and
changing support under an explicit validity condition. It does not make an
arbitrary learned prediction safe to delete from the residual.

Likewise, two scenes with identical observation histories but different current
occluders cannot be distinguished by history alone. A correct geometry-update
interface, additional physical probes, or conservative uncertainty is necessary.
The v3 known-motion experiment must not be relabeled a solution to v2's
unobserved-change setting.

## Information economics of a valid fact

**Derived under assumptions.** On a given future query, a newly certified set of
proposal mass $a_\tau$ gives reduction at least
$a_\tau\operatorname{tr}(Q_\tau\Sigma_\tau)/n_\tau$ relative to the same
unrestricted estimator. Sum over a declared horizon only while the fact is
valid. A candidate query can therefore be scored by

$$\frac{\mathbb E\sum_\tau w_\tau\mathbf 1_{\mathrm{valid},\tau}
a_\tau\operatorname{tr}(Q_\tau\Sigma_\tau)/n_\tau}
{C_{\rm trace}+C_{\rm certificate}+C_{\rm future\ validation}+C_{\rm retention}}.$$

The displayed numerator is a lower bound only under the same-estimator
comparison and correct validity model. Future risks, revisit probabilities and
lifetimes are not automatically known. This is a principled target for learning,
not an implemented optimal long-horizon controller. Avoid counting relabelings
of the same final image as independent task improvements.

## Minimum state and the final conceptual reduction

The proposed state is $(\mathcal K_t,\mathcal H_t,\mathcal D_t)$: certified
response facts with query-validity regions; fallible predictors for the remaining
response; and authoritative dependency/motion state. The engine owns geometry,
known materials, lights and controls. Permanent storage need not contain copied
images or copied illumination. An exact visibility fact is reused with fresh
lighting coefficients. Its validity region, not its age, determines reuse.

This is not a complete sufficient state for arbitrary rendering. In the executed
finite opaque direct-light family, all visibility terms plus current analytic
coefficients are rendering sufficient. In general one must preserve observation
closure from the original theory, nonlinear BSDF/transport dependencies and
uncertainty about unobserved events. Ray facts do not encode arbitrary occluded
textures, new primitives, view-dependent scattering, or unpredictable motion.