# Implemented estimator contract

The reusable component is a NumPy CPU reference for **finite-domain, residual-corrected rendering**. The package does not contain a DLSS plugin, a game integration, a GPU backend, super resolution, or frame generation. Those remain research objectives in the manuscript.

For each receiver, let `f[j,c]` be its current physical contribution from term `j`. Contributions already include any quadrature weights. Let `h[j,c]` be a frozen prediction and let `q[j] > 0` sum to one. The desired linear signal is `sum_j f[j,c]`.

```python
import numpy as np
from aureole import freeze, sample

h = np.zeros((1, 4, 3))  # receivers, physical terms, color channels
q = np.full((1, 4), 0.25)
snapshot = freeze(h, q)
physical_table = np.arange(12, dtype=float).reshape(1, 4, 3) / 12

def oracle(indices):
    # A real adapter traces only these selected physical contributions.
    return physical_table[np.arange(len(indices))[:, None], indices]

estimate, indices, values = sample(snapshot, oracle, n=2,
                                  rng=np.random.default_rng(23))
```

In the example the table is pedagogical. In an engine the oracle executes actual physical queries; a full reference table must never be available to a purportedly sparse sampling policy.

`sample()` returns the exact sum of the frozen control plus the sample mean of `(physical - control) / q`. Update memory **after** it returns. The public low-level `correct()` supports integration with an external sampling system, whose caller is responsible for correct probabilities and independence.

The guarantee requires all of the following:

1. The control and its sum refer to the same frozen arrays.
2. The proposal has support wherever the residual can be nonzero.
3. Indices are genuinely drawn from the recorded proposal, freshly conditional on the history.
4. The physical oracle evaluates the current scene and correct units. For the supplied variance formula it is deterministic; unbiased noisy oracles require an added noise-variance term.
5. The number of draws is fixed before this batch. Repeated categorical draws are valid independent index draws; copying one noisy path is not independent evidence.
6. The physical scene is frozen during the batch. Camera/geometry/light changes create another batch.
7. Neither clamping nor a nonlinear denoiser is included in the unbiased signal guarantee.

A trained prior can be arbitrarily inaccurate or stale without changing conditional expectation. It can still cause very large variance, negative estimates, poor finite-sample images, and slow convergence. The guarantee does **not** mean that every frame is correct, nonnegative, or hallucination-free.

The pure prediction `snapshot.integral` is useful for a preview or a deliberately biased display policy, but it has no general unbiasedness or truth guarantee. `exact_mse()` is an offline audit operation requiring all physical contributions; it is never a legal sparse runtime uncertainty estimator.

`hoeffding_radius()` supplies a fixed-sample conservative bound when actual physical term bounds are known. It is simultaneous over channels for one receiver. Divide the requested failure probability by receiver count for a frame-wide union bound. It is not a neural calibration result, an anytime confidence sequence, or generally useful at two samples per receiver.

## Persistence and correction

`WorldMemory` maps canonical receiver and emitter IDs to observed binary visibility and geometry epochs. IDs are owned by the renderer. A new surface, remesh, emitter basis, or reused object ID requires a namespace change or reset. Lighting intensity and material color changes do not invalidate visibility in this particular direct-light model.

An epoch change revokes trust while retaining old values as fallible controls. `commit(..., revise_on_conflict=True)` detects a contradiction with previously trusted deterministic visibility, revokes all trust, then accepts the current batch. It does this **after** correcting the current output, so it cannot fix the first surprise frame. This exact contradiction rule is inapplicable to noisy radiance observations without a statistical change detector.

Saving/loading uses an NPZ of numeric arrays with `allow_pickle=False` and validates namespace and array contents. It does not deserialize Python objects. This is a fixed-capacity dense reference; streaming, hash collision handling, deformation charts, local dependency invalidation, and GPU layout are not implemented.

## Integration boundary

To extend the contract to an arbitrary neural integrand, its integral must be exact under the same physical measure. A separately predicted integral does not qualify: its error becomes estimator bias. A continuous integrable basis or valid auxiliary integral estimator is required. A finite discretization is unbiased for that finite problem, not automatically for a different continuous emitter or full path integral.

For SR, motion blur, and time queries the physical domain must include the requested footprint and time. For unknown future player input the current engine cannot supply the future physical oracle. The present guarantee cannot validate speculative generated frames.