cost: a price that cannot be multiplied is refused, and a curve is a chart

Two arithmetic facts the money path was relying on and neither was true. A stated price is multiplied by a COUNT and summed in int64. At the volumes this plane measures, a price above about ninety-two thousand units wraps — and a wrapped cost does not surface as an error. It surfaces as the minimum of the sweep, which is returned as the threshold to adopt. policy refuses such a price at the door, where the caller-supplied number arrives, and evaluate refuses it again in the arithmetic rather than trusting it was called correctly: a policy sealed before the bound existed reads back through the same path. The cost then goes ABSENT with a refusal, and the rank statistics, which never touch a price, are unaffected. Curve returned one point per distinct score with no bound — fifty thousand points on a full history, a megabyte no browser plots. The sweep still runs over every distinct score and the metrics behind it are unchanged; what is RETURNED is an evenly spaced subsequence keeping both ends, so the shape, the extremes and the monotonicity survive. Truncating would have cut the curve off at one end and described a model that stops. It is the argument Listed already makes about Moved, applied to the other rendering. Both are mutation-proven: reintroduce the wrap or drop the sampling and the test that names it goes red. Co-authored-by: Hanzo Dev <[email protected]>
2026-09-24 00:25:20 +00:00 · 2026-08-01 18:08:46 -07:00
parent 53c8fe2bac
commit 5a75cfcfe0
4 changed files with 221 additions and 18 deletions
@@ -227,9 +227,14 @@ func Measure(obs []Observation, threshold float64, cost policy.Cost, cal calibra
 		m.F1 = ptr(round6(2 * *m.Precision * *m.Recall / (*m.Precision + *m.Recall)))
 	}
 	if cost.Stated() {
-		m.CostNano = ptrInt(nano(c, cost))
-		best, at := minimum(judged, cost)
-		m.BestNano, m.BestThreshold = ptrInt(best), ptr(round6(at))
+		v, ok := nano(c, cost)
+		best, at, okBest := minimum(judged, cost)
+		if ok && okBest {
+			m.CostNano = ptrInt(v)
+			m.BestNano, m.BestThreshold = ptrInt(best), ptr(round6(at))
+		} else if m.Refusal == "" {
+			m.Refusal = "the stated prices cannot be multiplied by this many observations without overflowing, so no cost is reported"
+		}
 	}
 	if cal.Fitted() {
 		if b, ok := brier(judged, cal); ok {
@@ -264,6 +269,7 @@ func Curve(obs []Observation, cost policy.Cost) []Point {
 		return nil
 	}
 	sort.SliceStable(judged, func(i, j int) bool { return judged[i].Score > judged[j].Score })
+	priced := cost.Stated()

 	out := make([]Point, 0, len(judged))
 	var tp, fp float64
@@ -283,13 +289,46 @@ func Curve(obs []Observation, cost policy.Cost) []Point {
 			FalsePositive: round6(fp / neg),
 			Precision:     round6(tp / (tp + fp)),
 		}
-		if cost.Stated() {
-			p.CostNano = nano(Confusion{TP: tp, FP: fp, FN: pos - tp, TN: neg - fp}, cost)
+		if priced {
+			v, ok := nano(Confusion{TP: tp, FP: fp, FN: pos - tp, TN: neg - fp}, cost)
+			if !ok {
+				// One unrepresentable point makes the whole cost dimension
+				// unreadable: a curve with a hole in it plots as a cliff. Drop it
+				// for the sweep and let Metrics carry the refusal.
+				priced = false
+				for k := range out {
+					out[k].CostNano = 0
+				}
+			}
+			p.CostNano = v
 		}
 		out = append(out, p)
 		i = j
 	}
-	return out
+	return sample(out)
+}
+
+// sample bounds what a curve RETURNS without moving where its points sit.
+//
+// The sweep above is over every distinct score and stays that way: Metrics and
+// the cost minimum are exact whatever this does. A curve is a CHART, and the
+// argument that bounds Moved applies unchanged — a person reading one does not
+// need the ten-thousandth point, and a response carrying fifty thousand of them
+// is a megabyte nobody renders.
+//
+// It takes an evenly spaced subsequence and always keeps both ends, so the
+// shape, the extremes and the monotonicity survive. Truncating instead would cut
+// the curve off at one end and describe a model that stops.
+func sample(points []Point) []Point {
+	if len(points) <= Plotted {
+		return points
+	}
+	out := make([]Point, 0, Plotted)
+	last := len(points) - 1
+	for i := range Plotted - 1 {
+		out = append(out, points[i*last/(Plotted-1)])
+	}
+	return append(out, points[last])
 }

 // confusionAt counts the four cells at one threshold. Flagged is score >= t, so
@@ -313,16 +352,53 @@ func confusionAt(judged []Observation, t float64) Confusion {
 	return c
 }

-// nano prices a confusion. Counts are weighted and therefore float; the
-// MULTIPLICATION is done once, per cell, and rounded to the nearest nano before
-// summing, so the result is an exact integer number of nano-units and two calls
-// on the same counts cannot differ.
-func nano(c Confusion, cost policy.Cost) int64 {
-	miss := int64(math.Round(c.FN)) * cost.Miss
-	alarm := int64(math.Round(c.FP)) * cost.Alarm
-	return miss + alarm
+// nano prices a confusion, and says whether the price is representable.
+//
+// Counts are weighted and therefore float; the MULTIPLICATION is done once, per
+// cell, and rounded to the nearest nano before summing, so the result is an
+// exact integer number of nano-units and two calls on the same counts cannot
+// differ.
+//
+// It returns false rather than a wrapped number. policy.MaxPrice already keeps a
+// sealed ladder's prices inside the range where this cannot happen, but a
+// wrapped cost is the one arithmetic failure here that does not look like a
+// failure — it looks like a recommendation — so the arithmetic refuses on its
+// own account and does not rely on having been called correctly. A policy
+// recorded before that bound existed reads back through this same path.
+func nano(c Confusion, cost policy.Cost) (int64, bool) {
+	miss, ok := mul(int64(math.Round(c.FN)), cost.Miss)
+	if !ok {
+		return 0, false
+	}
+	alarm, ok := mul(int64(math.Round(c.FP)), cost.Alarm)
+	if !ok {
+		return 0, false
+	}
+	sum := miss + alarm
+	if sum < miss {
+		return 0, false
+	}
+	return sum, true
 }

+// mul multiplies a count by a price, reporting whether the product fits. Both
+// are non-negative here, so the check is the single division that inverts the
+// multiplication exactly.
+func mul(count, price int64) (int64, bool) {
+	if count <= 0 || price <= 0 {
+		return 0, true
+	}
+	if count > math.MaxInt64/price {
+		return 0, false
+	}
+	return count * price, true
+}
+
+// Plotted bounds how many points a curve returns. A thousand is denser than any
+// screen, and the metrics behind it are computed over every distinct score
+// regardless — this bounds the rendering, never the arithmetic.
+const Plotted = 1000
+
 // minimum sweeps every reachable threshold and returns the lowest cost and where
 // it is reached.
 //
@@ -330,7 +406,7 @@ func nano(c Confusion, cost policy.Cost) int64 {
 // cost the same are not equivalent to the business: the one that stops fewer
 // customers is the one to choose, and leaving the tie to iteration order would
 // make the recommendation move between runs on identical data.
-func minimum(judged []Observation, cost policy.Cost) (int64, float64) {
+func minimum(judged []Observation, cost policy.Cost) (int64, float64, bool) {
 	sorted := append([]Observation(nil), judged...)
 	sort.SliceStable(sorted, func(i, j int) bool { return sorted[i].Score > sorted[j].Score })

@@ -344,7 +420,11 @@ func minimum(judged []Observation, cost policy.Cost) (int64, float64) {
 	}
 	// The empty flagged set is a real operating point — flag nothing, pay for
 	// every miss — and it is the right answer when alarms cost more than misses.
-	best, at := nano(Confusion{FN: pos, TN: neg}, cost), math.Nextafter(1, 2)
+	best, ok := nano(Confusion{FN: pos, TN: neg}, cost)
+	if !ok {
+		return 0, 0, false
+	}
+	at := math.Nextafter(1, 2)
 	var tp, fp float64
 	for i := 0; i < len(sorted); {
 		j := i
@@ -356,12 +436,16 @@ func minimum(judged []Observation, cost policy.Cost) (int64, float64) {
 			}
 			j++
 		}
-		if v := nano(Confusion{TP: tp, FP: fp, FN: pos - tp, TN: neg - fp}, cost); v < best {
+		v, ok := nano(Confusion{TP: tp, FP: fp, FN: pos - tp, TN: neg - fp}, cost)
+		if !ok {
+			return 0, 0, false
+		}
+		if v < best {
 			best, at = v, sorted[i].Score
 		}
 		i = j
 	}
-	return best, at
+	return best, at, true
 }

 // roc is the area under the receiver-operating curve, by the Mann-Whitney
@@ -220,4 +220,67 @@ func TestCurveIsEmptyWithoutBothClasses(t *testing.T) {
 	}
 }

+// A price that cannot be multiplied by the count without wrapping produces NO
+// cost and says why. The wrapped number would be negative, would be the minimum
+// of the sweep, and would therefore be returned as the threshold to adopt — an
+// arithmetic failure wearing the shape of a recommendation.
+func TestAnUnrepresentablePriceIsAbsentAndNotWrapped(t *testing.T) {
+	var obsv []Observation
+	for i := range 200 {
+		obsv = append(obsv, obs(float64(i)/200, i%3 == 0))
+	}
+	huge := policy.Cost{Miss: math.MaxInt64 / 4, Alarm: math.MaxInt64 / 4}
+	m := Measure(obsv, 0.5, huge, calibrate.Map{})
+	if m.CostNano != nil {
+		t.Errorf("a cost of %d was reported from a product that does not fit in an int64", *m.CostNano)
+	}
+	if m.BestNano != nil || m.BestThreshold != nil {
+		t.Error("an operating point was recommended from arithmetic that overflowed")
+	}
+	if m.Refusal == "" {
+		t.Error("the cost was dropped in silence, which reads as an unpriced policy")
+	}
+	// The rank statistics are unaffected: they never touch the prices.
+	if m.ROC == nil || m.PR == nil {
+		t.Error("separation went missing because a price did not fit")
+	}
+	// And nowhere on the curve is a wrapped number plotted.
+	for i, p := range Curve(obsv, huge) {
+		if p.CostNano != 0 {
+			t.Fatalf("curve point %d carries %d, a price the arithmetic could not represent", i, p.CostNano)
+		}
+	}
+}
+
+// A curve is a chart and the response carrying it is read by a browser. The
+// metrics behind it stay exact over every distinct score; what is RETURNED is
+// bounded, keeps both ends, and stays descending — a truncated curve would
+// describe a model that stops.
+func TestTheCurveIsBoundedAndKeepsItsEnds(t *testing.T) {
+	n := Plotted * 7
+	var obsv []Observation
+	for i := range n {
+		obsv = append(obsv, obs(float64(i)/float64(n), i%5 == 0))
+	}
+	full := Curve(obsv, policy.Cost{})
+	if len(full) > Plotted {
+		t.Fatalf("the curve returned %d points, above the bound of %d", len(full), Plotted)
+	}
+	if len(full) < Plotted {
+		t.Fatalf("the curve returned %d points from %d distinct scores; it should fill the bound", len(full), n)
+	}
+	last := full[len(full)-1]
+	if last.TruePositive != 1 || last.FalsePositive != 1 {
+		t.Errorf("the sampled curve lost its far end: %+v", last)
+	}
+	if full[0].Threshold <= full[len(full)-1].Threshold {
+		t.Error("the sampled curve is not descending")
+	}
+	for i := 1; i < len(full); i++ {
+		if full[i].TruePositive < full[i-1].TruePositive || full[i].FalsePositive < full[i-1].FalsePositive {
+			t.Fatalf("sampling reordered the curve at %d", i)
+		}
+	}
+}
+
 func at(i int) time.Time { return time.Unix(int64(1_700_000_000+i*60), 0).UTC() }
@@ -54,6 +54,7 @@ var (
 	ErrNoAction   = errors.New("policy: a rung with no action")
 	ErrSameAction = errors.New("policy: a rung asks for the action already in force below it")
 	ErrCost       = errors.New("policy: a cost cannot be negative")
+	ErrPrice      = errors.New("policy: a price above the bound cannot be multiplied by a count without overflowing, and a wrapped cost reads as a recommendation")
 )

 // Rung is one step of the ladder: at or above this probability, this action.
@@ -82,6 +83,26 @@ type Cost struct {
 	Alarm int64 `json:"alarm"`
 }

+// Volume and MaxPrice are the bound that keeps the cost arithmetic exact.
+//
+// A price is multiplied by a COUNT of observations and the products are summed
+// in int64. An int64 that overflows does not fail — it wraps, silently, and the
+// cost-minimising threshold then becomes a number chosen by the wrap rather than
+// by the evidence. That is the worst failure this package could have: it does
+// not look like an error, it looks like a recommendation.
+//
+// Volume is the largest number of observations any one measurement will price.
+// It is set well above the bounded read every measurement is taken under, so
+// raising that read does not quietly invalidate the invariant. MaxPrice is
+// int64's ceiling divided by it, which comes to roughly 92 thousand units of the
+// tenant's currency for the price of ONE mistake — far above any average a
+// lifecycle stage would state, and below the point where the arithmetic stops
+// being exact.
+const (
+	Volume   = 100_000
+	MaxPrice = math.MaxInt64 / Volume
+)
+
 // Stated reports whether this cost says anything. A zero cost is not a free
 // mistake, it is an unstated price, and every metric derived from it is absent
 // rather than zero.
@@ -183,6 +204,9 @@ func (p Policy) Validate() error {
 	if p.Cost.Miss < 0 || p.Cost.Alarm < 0 {
 		return ErrCost
 	}
+	if p.Cost.Miss > MaxPrice || p.Cost.Alarm > MaxPrice {
+		return fmt.Errorf("%w: %d and %d against a bound of %d", ErrPrice, p.Cost.Miss, p.Cost.Alarm, MaxPrice)
+	}
 	prev, prevAction := -1.0, p.Floor
 	for i, r := range p.Rungs {
 		switch {
@@ -2,6 +2,7 @@ package policy

 import (
 	"errors"
+	"math"
 	"testing"
 	"time"
 )
@@ -150,3 +151,34 @@ func TestUnstatedCostIsNotZeroCost(t *testing.T) {
 		t.Error("a stated alarm price reads as unstated")
 	}
 }
+
+// A price is multiplied by a count and summed in int64. Above the bound that
+// product wraps, and a wrapped cost does not read as an error — it reads as a
+// recommendation about where to put a threshold. The ladder is refused at the
+// door, which is the one place a caller-supplied number arrives.
+func TestAPriceAboveTheBoundIsRefused(t *testing.T) {
+	l := ladder()
+	l.Cost = Cost{Miss: MaxPrice + 1, Alarm: 1}
+	if _, err := Seal(l); !errors.Is(err, ErrPrice) {
+		t.Errorf("a price of %d was accepted: %v", l.Cost.Miss, err)
+	}
+	l.Cost = Cost{Miss: 1, Alarm: MaxPrice + 1}
+	if _, err := Seal(l); !errors.Is(err, ErrPrice) {
+		t.Errorf("an alarm price of %d was accepted: %v", l.Cost.Alarm, err)
+	}
+	// And the bound itself is reachable: refusing at the boundary would make the
+	// stated maximum a number nobody can use.
+	l.Cost = Cost{Miss: MaxPrice, Alarm: MaxPrice}
+	if _, err := Seal(l); err != nil {
+		t.Errorf("the stated maximum was refused: %v", err)
+	}
+	// The bound has to be worth something. A price that cannot express an
+	// ordinary large loss would push a tenant into understating one.
+	if MaxPrice < 10_000*1_000_000_000 {
+		t.Errorf("MaxPrice is %d nano — under ten thousand units, which is too small to state a real loss", MaxPrice)
+	}
+	// And it has to actually prevent the wrap it exists for.
+	if MaxPrice > math.MaxInt64/Volume {
+		t.Errorf("MaxPrice %d times Volume %d overflows int64", MaxPrice, Volume)
+	}
+}