Online Causal Configuration for Networked Systems via Doubly Robust Steady-State Learning

Online Causal Configuration for Networked Systems via Doubly Robust Steady-State Learning

Yuli Liu3

arXiv:2611.09665v1 [cs.LG] 6 Nov 2026

1

Zhiheng Zhang1,2∗

School of Statistics and Data Science, Shanghai University of Finance and Economics 2 Institute of Big Data Research, Shanghai University of Finance and Economics Shanghai 200433, P.R. China 3 Smart Ocean Technology, University of Macau, Macao SAR, China

Abstract Measurement exploration reveals how interacting local controllers behave but can alter the steady-state regime a network operator seeks to optimize. Exploratory rewards may therefore fail to identify a configuration’s no-exploration value: under full exploration, identical logged distributions can conceal different target values. Identification requires accounting for both action-law mismatch and shifts in the steady-state context distribution. We introduce CAUSAL-UCB, which selects configurations using optimistic bounds on target causal values. Its interference-aware clipped doubly robust evaluator produces predecision certificates separating statistical variation from calibrated identification, transport, and temporal-dependence errors. For any finite horizon and predeterminedP schedule of measurement-exploration rates {ηt },P we prove lower bounds of Ω((1+ t ηt )−1/2 ) on minimax inference error and Ω( t ηt ) on measurement-induced deployment loss in a stationary, potentially slow-mixing family. We bound regret under valid certificates and selected-information growth, and establish an anytime finite-sample certificate with a shared radius for estimation, selection, and reporting in a restricted known-local-interference model. In a high-mismatch benchmark with 24 paired seeds and 200 rounds, CAUSAL-UCB attains target regret of 1.732 versus 6.326 for certified IPS-UCB, with deployment gaps of 30.607 and 23.217, respectively. Independent-audit coverage tests and trace-driven semi-synthetic studies further assess certificate coverage and deployment trade-offs.

1

Introduction

At each slow decision round, a network operator chooses a global configuration, while adaptive, interacting local controllers determine the realized actions and settle into a steady state. The deployment objective is the configuration’s no-exploration steady-state utility, not the reward observed under the measurement policy used to collect data. Exploration can improve action support, but it also changes local actions and post-burn-in contexts. Consequently, a configuration that performs well under exploratory logging need not maximize deployment utility. Different controllers can generate identical exploratory observations while having different noexploration steady-state values (Proposition 3). Identifying the target value therefore requires information beyond an accurate outcome model. Evaluation requires an appropriate exposure representation for network interference, correction for target-action mismatch, and a justified link between exploratory and target context distributions. In particular, action overlap supports comparisons ∗ Accepted at NeurIPS 2026. Corresponding author: Zhiheng Zhang. Email: zhangzhiheng@mail.shufe.edu.cn. Project: https://ylliua1116.github.io/causal-ucb/. Code: https://github.com/ylliua1116/causal-ucb.

Preprint.

conditional on observed contexts, but does not by itself identify the context distribution that would arise without exploration. These requirements must be distinguished when evaluating configurations and making online choices. 1

Black-box deployment setting Global configuration z

2

Causal Measurement and Exposure Modeling Network state

3

Exposure mapping

Doubly Robust Steady-State Evaluation

4

Logged steady-state data

Optimism over causal value certificates

Optimistic Online Selection

Local action A Exposure context C

Observed reward R

Doubly robust evaluation (with clipping)

Measurement-level exploration 𝜼

Select maximum optimistic value

+ Adaptive local controllers (black-box, interfering)

Post-burn-in telemetry only (no immediate reward)

Exploratory law 𝜂>0

Target deployment law 𝜂=0

Outcome model

Weight model

Value estimate & uncertainty

✓ z₂ selected

Selected configuration 𝒛𝒕

Overlap

...

Next round: deploy and collect steady-state logs

Figure 1: The CAUSAL-UCB deployment loop. A global configuration induces interacting local actions; post-burn-in measurements enter an exposure-aware evaluator, whose value certificate guides the next optimistic configuration choice. Visual elements are conceptual. Our setting connects causal inference under network interference [1–3], doubly robust off-policy evaluation and logged-feedback learning [4–6], and online decision-making with network interference [7–10]. These research lines provide tools for representing interference, correcting action-law mismatch, and guiding sequential decisions. Our setting differs in both the decision unit and the target: the operator selects a global configuration, while its value is defined after black-box controllers settle under the no-exploration law. The resulting problem is to use exploratory steady-state telemetry for online selection while accounting for the distinct measurement and deployment regimes. We address this problem with CAUSAL-UCB. An exposure-aware clipped doubly robust evaluator estimates each configuration’s target value, and a predecision certificate separates sampling fluctuation from identification, transport, and temporal-dependence errors. The certificate is used to select configurations by optimistic target values rather than raw exploratory rewards. The corresponding guarantees rely on the calibration conditions developed in Section 4. This separation makes explicit which uncertainties are estimated from logged data and which require additional assumptions or independent information. Measurement also has two distinct consequences: it affects the information available for identifying target values and can perturb the state whose utility is being optimized. We formalize this identification–deployment tension through a minimax lower bound for predetermined exploration schedules in a stationary, potentially slow-mixing family. Separately, we establish a regret guarantee for online selection when the certificates are valid and selected information grows. Under known local interference, we also derive an anytime finite-sample certificate with a shared predecision radius for estimation, selection, and reporting. Contributions. (1) We formalize online causal configuration around the no-exploration steady-state estimand and derive an exposure-aware doubly robust evaluator with a uniform certificate separating sampling fluctuation from identification, transport, and temporal-dependence errors. (2) For every finite horizon and Ppredetermined exploration schedule in Pthe stated family, we prove minimax lower bounds Ω((1 + t ηt )−1/2 ) for inference error and Ω( t ηt ) for measurement-induced deployment loss. We also establish a regret guarantee under valid certificates and selected-information growth. (3) Under known local interference, we establish an anytime finite-sample certificate whose predecision radius is shared by estimation, selection, and reporting. The remainder of the paper is organized as follows. Section 2 reviews related work; Section 3 formalizes the operational setting and target estimand; Section 4 develops the estimator, certificates, and theoretical guarantees; Section 5 evaluates decision quality, identification–deployment trade-offs, and transfer across network traces. Section 6 concludes. Additional proofs, experimental protocols, and robustness analyses are provided in the appendices. 2

2

Related Work

1 Causal inference with interference. Potential-outcome methods formalize causal effects under ⃝ partial or general interference [1–3]. Causal representation learning further investigates interventional structure, temporal effects, and partial observability [11–13]. Recent design-based work studies covariate adjustment under approximate neighborhood interference [14], but does not address exploration-induced shifts in the steady-state context law. We explicitly budget exposure and transport error. Table 1: Representative research scope. 2 Off-policy evaluation and overlap. ⃝ Research line I L G S R ✓ ◦ – – – Doubly robust evaluation, counterfactual risk min- Interf. estimands OPE – ✓ – ◦ – imization, and orthogonal nuisance fitting provide DR Network bandits ✓ ◦ ◦ – ✓ ✓ ◦ ◦ – ✓ complementary tools for learning from logged data Design bandits – ✓ – ◦ – [4–6, 15]. Exponential smoothing [16] and marginal Temporal overlap ✓ ✓ ✓ ✓ ✓ density-ratio estimation [17] address related off- CAUSAL-UCB interference; L: logged evaluation; G: global configuration; S: target policy evaluation difficulties, while risk–return bench- I:steady state; R: online cost/regret. ✓: explicit; ◦: related; –: outside scope. marking studies downstream policy selection [18]. Overlap-weighted temporal estimation [19] and future-dependent evaluation under partial observability [20] address distinct longitudinal challenges. These methods do not by themselves align exploratory contexts with the no-exploration steady-state law. Action correction and context transport therefore remain separate identification requirements here.

3 Sequential choice and information cost. Optimism-based bandits use uncertainty to guide se⃝ quential decisions [21–23]. Contextual bandit methods examine cumulative versus simple regret [24], heterogeneous multi-agent learning [25], and structured cross-learning [26]. Network-interference bandits and design-based approaches study interacting rewards and inference–regret trade-offs [7–10]. Variance-dependent and second-order regret analyses provide complementary contextual-bandit guarantees [27, 28]. These lines do not directly address the identification of a global configuration’s no-exploration steady-state value from exploration-perturbed telemetry. Proposition 3 formalizes this identification requirement.

3

Operational Setup and Causal Identification

We formalize deployment logs and an interference-aware action–exposure representation, then define the no-exploration steady-state value as the target of configuration selection. This formulation distinguishes exploratory measurements from deployment objectives and makes explicit the identification requirements underlying subsequent causal evaluation and certification. 3.1

Deployment Logs and the Target Object

We consider a networked system with N nodes and a compact configuration set Z. At slow round t, the operator deploys a global configuration zt ∈ Z and a measurement-level exploration rate ηt ∈ [0, 1]. After Tburn fast adaptation steps, the operator records T0 post-burn-in windows. A logged (t) (t) (t) window contains the realized low-level action Ai,s , context Ci,s , and normalized utility Ri,s for (t)

(t)

(t)

(t)

(t)

node i and window s, with |Ri,s | ≤ Bu after KPI normalization. We write Oi,s = (Ai,s , Ci,s , Ri,s ) (t)

for each logged observation, Dt = {Oi,s : i = 1, . . . , N, s = 1, . . . , T0 } for the batch collected in St round t, and D≤t = r=1 Dr for the cumulative log. 3.2

Exposure Interface for Network Interference (t)

A direct formulation over the full node-level action profile A1:N,s is statistically and operationally impractical because local controllers are black-box and mutually interfering. We instead use an auditable exposure interface:  
(t) (t) e(t) = A(t) , E (t) . E = ϕi {A }j∈N (s) , Ss(t) , G(t) , A (1) s i,s

j,s

i,s

i

i,s

i,s

e(t) is the joint action/exposure treatment unit. The pre-action context C −,(t) contains only Here A i,s i,s information available before the focal action is generated; contemporaneous telemetry used by ϕi 3

e (t) = A e(t) , C −,(t) , R(t) , while retaining the raw belongs to the observed exposure. We score O i,s i,s i,s i,s telemetry in Dt . The map ϕi may summarize neighbor load, interference power, top-k congestion, or (t) (t) graph features [1–3]; Ss and Gs denote system telemetry and graph state. Exposure summarizes realized neighboring actions, not an assigned treatment. Let Ae be the joint action/exposure space. For candidate z, gz,0 (e a | c− ) is the target law and obs − gz,η (e a | c ) is the law induced by the actual logging mechanism; a round-r observation uses its source-regime law (zr , ηr ), fitted as gbb,r . Because exposure depends on multiple contemporaneous actions, the joint law need not inherit the marginal focal-action mixture. The DR score therefore requires the actual joint action/exposure probability or density, not merely the marginal propensity of Ai . Identification requires consistency for this treatment/exposure unit, conditional exchangeability and overlap given C − , absolute continuity of the target joint law with respect to the source behavior law, and calibrated response transport across source regimes. These assumptions are not implied by relabeling context. These identification conditions follow standard causal principles [29]. The calibrated budget ϵexp (z) accounts for exposure approximation and response-transport discrepancies (Section 4). We audit exposure sufficiency by comparing ϕi with an enriched map ϕ+ i , using the ϕ+ ϕ b c c discrepancy ∆exp,t (z) = Wt (z; 0) − Wt (z; 0) . A large discrepancy motivates enrichment or a larger calibrated budget; the comparison is a sensitivity diagnostic, not an independently valid certificate. 3.3

Identification-Only Exploration and the No-Exploration Benchmark

The operator ultimately wants the value of a configuration without measurement perturbations. Let νz,η be the post-burn-in distribution of pre-action contexts C − induced by configuration z and exploration rate η. Let mz (e a, c− ) denote the no-exploration target-regime conditional response for the joint action/exposure unit. The target value is Z  − − W∞ (z; 0) = EC − ∼νz,0 mz (e a, C ) gz,0 (de a|C ) , z ⋆ ∈ arg max W∞ (z; 0). (2) z∈Z

e A

e the integral is the corresponding sum. The deployment-facing regret is For discrete A, RegT =

T X

[W∞ (z ⋆ ; 0) − W∞ (zt ; 0)] .

(3)

t=1 obs The local-action logging mechanism retains its mixture form πz,η (a | c− ) = (1 − η)πz,0 (a | obs c− ) + ηξ(a | c− ), with ξ(a | c− ) > 0. Its induced joint law is gz,η , and each historical score uses the behavior law for its actual source regime (zr , ηr ). This marginal mixture does not determine the joint exposure propensity, and action correction does not transport the exploratory context law to νz,0 ; see Appendix B.3. Define the steady-state value under exploration by Z  obs W∞ (z; η) = EC − ∼νz,η mz (e a, C − ) gz,η (de a | C −) . (4) e A

The source-regime response discrepancy remains part of the calibrated response-transport budget.

4

Causal Value Certificates and Online Optimization Normalized magnitude (schematic)

Identification–Deployment Frontier Identification-limited

Deployment-cost-limited

1.0

We develop an exposure-aware clipped doubly robust estimator for the no-exploration steady-state value, together with calibrated deviation certificates. We then characterize the identification–deployment trade-off, analyze optimistic online selection under explicit information-growth conditions, and give an anytime certificate for a restricted known-localFigure 2: Identification–deployment trade-off. interference model. 0.8 0.6 0.4 0.2

Illustrative balance

Identification error (proxy)

0.0

0.00

0.05

0.10

0.15

Deployment gap (proxy)

Measurement-level exploration rate η

0.20

Weighted trade-off (illustrative)

0.25

Blue: error; orange: cost; purple: combined; dashed: illustrative balance.

4

4.1

Clipped Doubly Robust Evaluation

Evaluation uses the candidate target joint law gbz,0 , response regression m b z , and source-round behavior joint propensity gbb,r . The target law supplies the direct term and importance numerator; the behavior law supplies the denominator. These nuisance fits are frozen before the corresponding network window is scored, and stored historical scores are never recomputed using later fits. For candidate z, let e=e mz (e a, c− ) = E[R | A a, C − = c− , z, η = 0], Z µz (c− ) = mz (e a, c− ) gz,0 (de a | c− ). e A

For an observation from round r, define the clipped joint importance weight   gbz,0 (e a | c− ) , w . w bz,r (e a, c− ) = min max max{b gb,r (e a | c− ), πmin }

(5)

The ratio is a probability ratio for discrete treatments and a density ratio (under a common dominating measure) for continuous treatments; πmin uses the same convention. The score and pooled estimator are e =µ e C − ){R − m e C − )}, ψbz,r (O) bz (C − ) + w bz,r (A, b z (A, Z µ bz (C − ) = m b z (e a, C − )b gz,0 (de a | C − ),

(6)

e A

ct (z; 0) = W

  X 1 e (r) . ψbz,r O i,s N T0 t r=1,...,t

(7)

s=1,...,T0 i=1,...,N

The inverse-probability component is connected to classical estimation under incomplete observation [30]. Here, the weighting must additionally account for the joint action/exposure treatment law and the distinction between exploratory and target steady-state regimes. For discrete treatments, the direct-method integrals are sums. The pooled estimator uses D≤t and is available after round t for the decision in round t + 1. Cross-configuration response differences require the calibrated transport allowance below. With m b z clipped to [−Bu , Bu ] and weights clipped e ≤ Bψ = 2Bu (1 + wmax ). Appendices B.5–B.7 derive the joint-ratio bounds, at wmax , |ψbz,r (O)| DR identity, clipping bias, and nuisance-product expansion [4–6]. For each candidate z, nuisance fitting  weights past  rounds by context similarity rather than pooling them uniformly, using αr,z ∝ Kh dbF (b νr , νbz,0 ) , normalized over r < t. The resulting trainingz context marginal νbtrain,t defines the fits for m b z and gbz,0 . Weighting addresses context mismatch but does not establish response invariance; a large ϵ̄cfg,t (z) triggers local refitting or a wider radius. 4.2

Uniform Causal Value Certificate

The certificate combines fluctuation with calibrated error allowances. For monitoring, let Jt = T0 t PN ei,j ), where j indexes the timeand define the network-window scores as Yj,z = N −1 i=1 ψbz,r(j) (O ordered network windows and r(j) is the deployment round containing window j. An autocorrelationbased effective sample size is estimated from this aggregated sequence as n beff,t (z) =

Jt 1+2

PLt

ρℓ,t (z), 0} ℓ=1 max{b

.

The plug-in ESS is diagnostic; neff,t (z) must be a calibrated lower-information bound for the aggregated network-window sequence, without assuming within-window node independence. Concentration also requires bounded conditional drift and validated dependence control, such as mixing or block coupling, under the calibration conditions specified in Appendix B.4 and D.1. The adjacent-block diagnostic κ bt (z) enters the radius only when calibrated as an upper bound on residual drift. The calibrated context-shift budget ϵ̄shift,t (z) controls score-averaging transport from the pooled z source contexts to νz,0 ; ϵ̄cfg,t (z) controls transfer of bounded context-level nuisance risk from νbtrain,t 5

to νz,0 . Joint-ratio and response-nuisance errors require separate calibration under the actual sourcewindow score laws: context-marginal similarity alone bounds neither joint input-law error nor the no-exploration context law. The budget ϵexp (z) covers exposure-map approximation and cross-configuration/measurement-regime response transport. For the proof, it must dominate the historical average of both target-context response discrepancy and score-level response residual, uniformly over source regimes and prefixes (Appendices B.9, D.3). A narrower exposure-only budget must therefore be expanded and recalibrated. Together with target-joint-law estimation error, nuisance-product error, clipping bias, context transport, and configuration mismatch, the budgets form ϵ̄tot,t (z) = ϵm,t (z)ϵπ,t (z) + ϵ̄target,t (z) + ϵclip,t (z) + ϵexp (z) + ϵ̄shift,t (z) + ϵ̄cfg,t (z).

(8)

Here ϵm,t (z) is the response-regression error under source-window score laws, while ϵπ,t (z) is the induced clipped joint-ratio error ∥w bz,r − w̄z,r ∥L2 (νzr ,ηr ,gb,r ) , not raw propensity-fit error. The independently calibrated ϵ̄target,t (z) bounds first-order error in gbz,0 ; calibration details appear in Appendices B.4, B.10, and E.1. Theorem 1 (Unified deviation certificate). Fix t. Assume bounded, predictable/cross-fitted scores; overlap for the joint action/exposure law; a valid exposure/response, shift, and mismatch error budget; and conditional dependence and drift bounds that certify neff,t (z) and κ bt (z) (Appendices B.4 and D.1). With probability at least 1 − δ, simultaneously for all z ∈ Z, s ct (z; 0) − W∞ (z; 0) ≤ 2Bψ comp(Z) + log(2/δ) + ϵ̄tot,t (z) + κ W bt (z). (9) neff,t (z) Theorem 1 separates sampling error from calibrated nuisance, transport, clipping, and dependence contributions. Diagnostics guide refitting and radius inflation but do not establish coverage; see Appendices B.6–C.1 and C.3. 4.3

The Identification–Deployment Frontier

Exploration affects both the information available for causal evaluation and the utility experienced during deployment. The following lower bound quantifies this identification–deployment tension in a slow-mixing steady-state family. Theorem 2 (Steady-state identification–deployment frontier). For each finite horizon T and predetermined measurement-exploration schedule {ηt }Tt=1 , there exists a two-configuration, two-action stationary steady-state family, with potentially horizon-dependent mixing time, such that for any adaptive configuration-selection rule, the minimax expected absolute error of estimating W∞ (z1 ; 0) and the measurement-induced deployment gap satisfy, for universal c1 , c2 > 0, c1 InferenceErrorT ≥ q , PT 1 + t=1 ηt

DeploymentGapT ≥ c2

T X

ηt .

(10)

t=1

Measurement actions reveal latent state through refresh events while also perturbing deployment. The adaptive-data KL and two-point proof is in Appendix D.4; the lower bound characterizes the joint information–deployment problem, not Pareto optimality of CAUSAL-UCB. 4.4

CAUSAL-UCB: Certified Online Optimization

CAUSAL-UCB selects the largest certified upper value after updating nuisance models and diagnostics; the selection schematic is in Appendix E.2. Theorem 3 (Regret of CAUSAL-UCB). Assume the confidence event in Theorem 1 holds uniformly over rounds (with roundwise failure-probability allocation), and the selected effective sample sizes satisfy square-root summability. Define et (z) = ϵ̄tot,t (z) + κ bt (z). Then ! T X p e Bψ T comp(Z) + RegT = O et−1 (zt ) . (11) t=2

6

If et−1 (zt ) ≤ ct−γ for 0 < γ < 1, the cumulative error is O(T 1−γ ). First-round regret is at most 2Bu . If W∞ (z; η) is uniformly LW -Lipschitz in η for every z ∈ Z, then the cumulative deployment PT PT gap t=1 |W∞ (zt ; ηt ) − W∞ (zt ; 0)| is at most LW t=1 ηt . For finite Z, assume the per-visit condition neff,t−1 (zt ) ≥ λ{1 + Nzt (t − 1)}. This yields, up to initialization constants, r X |Z|T 1 q ≤2 , λ n (z ) t eligible

eff,t−1

t

p

e ψ |Z|T comp(Z)/λ). For fixed |Z| and λ, this gives the stated and hence statistical regret O(B p square-root rate; growing |Z| retains the factor |Z|/λ unless stronger square-root summability is assumed. The information-growth condition is substantive, not implied by optimism; certificate-error and deployment-gap contributions are already stated in Theorem 3. Proofs appear in Appendices D.5, D.6, and C.3. With known local interference, fixed exploration, homogeneous matched rewards, and Algorithm 1 CAUSAL-UCB known noise scale, the general certificate spe- Input: Z, T, Tburn , T0 , {ηt }, wmax , πmin . cializes to a computable anytime radius. In c0 (z; 0) = 0, b0 (z) = +∞. Initialize: D≤0 = ∅, W this restricted setting, known neighborhood 1: for t = 1, . . . , T do Fit predictable/cross-fitted nuisance models on D≤t−1 actions determine whether a logged observa- 2: with configuration-mismatch weighting. tion matches the no-exploration target proct−1 (z; 0) and bt−1 (z) for all z ∈ Z using Compute W file. Because the exploration mechanism is 3: calibrated diagnostics. fixed and known, the matching probability ct−1 (z; 0) + bt−1 (z) over Z. Select zt maximizing W can be computed directly. We specify the 4: 5: Deploy (zt , ηt ); wait Tburn ; log T0 windows into Dt and corresponding model and certificate below. update D . ≤t

Consider K configurations and N nodes. 6: end for With no-exploration action fixed at zero and 7: Return: Configurations, value estimates, and certificates. exploration action Bernoulli(1/2), local actions are independent Bernoulli(η/2) for fixed, known η. Let each known interference neighborhood contain d = 2r + 1 nodes. Define Ij,i = 1{all actions in node i’s neighborhood equal zero}, with matching probability q = (1 − η/2)d > 0. Conditional on Ij,i = 1, rewards follow clip(µz + σZj,i , 0, 1), with iid Gaussian noise independent of actions and prior deployments and a common law across nodes/windows for each z. Assume known noise-scale upper bound σ, wmax ≥ 1/q, and no hidden interference, context transport, nonstationarity, or burn-in dependence. The target profile is the all-zero neighborhood, logged with probability q, so the ratio is 1/q on matched windows and zero otherwise; at η = 0 all nodes are matched, giving the target value Wz = E[clip(µz + σZ, 0, 1)] ∈ [0, 1]. PN For each configuration z, index its n logged network windows by j. Let Kj = i=1 Ij,i , hj = Kj /(N q), and define the prequential, unclipped, doubly robust score Yj,z = m b j− (z) +

N
1 X Ij,i Rj,i − m b j− (z) , N q i=1

n X cz,n = 1 Yj,z . W n j=1

(12)

Here m b j− (z) is the matched-reward mean available before the deployment round containing window j (set to 1/2 if none exists); all windows in that round use this frozen mean. With M = N T T0 , define 2K(M + 1) L = log , (13) δ  1/2, m = 0, p ϵ(m) = (14) min{1, σ 2L/m}, m ≥ 1. Pn Let mj− be the matched count available before that deployment round, and mn = j=1 Kj . 7

Proposition 1 (Anytime calibrated DR certificate, restricted model). With probability at least 1 − δ, simultaneously over every configuration z ∈ Z and every time at which its data are examined, the fz,n = Π[0,1] W cz,n satisfies projected estimator W n 1X mn fz,n − Wz | ≤ bz,n , |W bz,n = |1 − hj |ϵ(mj− ) + ϵ(mn ). (15) n j=1 nN q fz,0 = 1/2 and bz,0 = 1/2. The certificate can be For an as-yet unvisited configuration, use W computed solely from previously logged actions and outcomes. In particular, bz,n may be used directly for online selection, and its corresponding interval may be reported as the experiment’s confidence interval. It is not a post-hoc interval. For online selection, let nz (t − 1) count windows under z before round t. Corollary 1 (Deployment regret conditional on the same certificate). Choose fz,n (t−1) + bz,n (t−1) }, zt ∈ arg max{W z

z∈Z

z

with optimism capped at 1 if desired. After at most H forced initialization rounds, on the simultaneous event of the proposition, T X RegT ≤ H + 2 bzt ,nzt (t−1) . (16) t=H+1

Appendix D.7 proves the proposition and corollary using one simultaneous matched-reward event over configurations and examined prefixes, including adaptive decisions. This is the known-mechanism special case of Theorem 1; the general setting instead requires separately calibrated target-law, transport, exposure, and dependence budgets. Decision implementation. The experiment initializes each of the five configurations twice (H = 10); thereafter it selects the configuration maximizing fz,n (t−1) + bz,n (t−1) } min{1, W z

z

and resolves exact upper-bound ties by the current center estimate. The same b governs selection, reported confidence width, and the corollary’s per-round bound; oracle target values are evaluationonly, while decisions use prior matched observations and predecision radii.

Experiments

(a) Spatial-network schematic

(b) Cumulative target regret

Cumulative target regret

CAUSAL-UCB (ours) Certified IPS-UCB Legacy DR-UCB Legacy IPS-UCB

(c) Maximum pairwise ATE error

0.3

0.2 0.15 0.1 0.05

Raw-UCB Greedy-Raw Switchback-OED

20 15 10 5 0

0

50

100 150 Deployment round

200

(d) Certified pairwise width

2

0.25

Certified interval diameter

We evaluate CAUSAL-UCB through four theory-driven 1 Certified decisions: Does target-value questions: ⃝ certification improve online selection under logging– 2 Interference and identification: target mismatch? ⃝ How do exposure, joint overlap, and context shift affect 3 Mechanisms and cost: Which causal evaluation? ⃝ components matter, and how does measurement exploration trade information against deployment utility? 4 Trace-driven transfer: Do the findings persist on ⃝ network-derived traces?

Maximum ATE error

5

1.5

1

Settings and scope. The controlled benchmark uses a 24-node ring, five configurations, 200 rounds, and 24 paired seeds. METR-LA and FlockLab provide Figure 3: Certified online selection (a) Conceptual topology and context traces for semi-synthetic replays spatial-network schematic; (b) cumulative target rewith model-generated counterfactual outcomes (180 gret; (c) maximum pairwise ATE error; (d) decisionrounds, eight independent seeds per condition); these active certificate diameter for Certified DR/IPS. Curves are not live deployments. A separate 300-seed inde- show 24-paired-seed means with pointwise 95% pendent audit assesses full-path certificate coverage Student-t intervals. (Appendix H.1). We report target regret, final optimality gap, pairwise causal-estimation error, uncertainty width, and deployment gap, distinguishing decision-active certificates from diagnostic widths. Details and robustness checks are in the appendices; empirical performance does not establish the identification assumptions. 0

8

0

50

100 150 Deployment round

200

0.5

0

50

100 150 Deployment round

200

5.1

Certified Decision Quality under Mismatch

Protocol. The frozen N = 24 ring benchmark uses five configurations, T = 200 rounds, T0 = 2 retained windows, radius-one interference, exploration rates η ∈ {0.55, 0.08}, and 24 paired seeds. Oracle target values are evaluation-only. Table 2: High-mismatch controlled compariWith clipped-Gaussian noise (σ = 0.08), we com- son. Means over 24 paired seeds and 200 rounds. pare certified/legacy DR/IPS, Raw-UCB, Greedy- Low-mismatch results are in Appendix F.3. Raw, and Switchback-OED [31] on five metrics. Method Reg.↓ Gap↓ ATE↓ W ↓ Dep.↓ Only certified widths are decision-active; each of CAUSAL-UCB (ours) 1.732 .000 .0230 .552 30.607 6.326 .022 .1718 1.541 23.217 five sensitivity levels uses 24 paired seeds and 200 Certified IPS-UCB Legacy DR-UCB 16.647 .060 .0081 1.961 12.279 rounds (Appendix F.3). Legacy IPS-UCB 16.647 .060 .0610 1.961 12.279 19.235 .085 .1595 1.919 8.016 Results. Under high mismatch, CAUSAL-UCB Raw-UCB Greedy-Raw 16.207 .080 .1626 2.000 4.120 attains the lowest regret (1.732), zero terminal Switchback-OED 20.000 .110 .1604 1.800 9.215 gap, and narrowest decision-active width (0.552), ATE: maximum pairwise ATE error; Dep.: expected simulator deployment gap. versus 6.326 regret and 1.541 width for Certified W is decision-active only for certified methods; all other widths are diagnostics. IPS-UCB. Legacy DR-UCB attains the lowest ATE error (0.0081 versus 0.0230 for CAUSAL-UCB), whereas CAUSAL-UCB achieves substantially lower target regret (1.732 versus 16.647). These results distinguish causal estimation accuracy from online configuration-selection performance. CAUSAL-UCB’s deployment gap (30.607) exceeds Certified IPS-UCB (23.217) and Greedy-Raw (4.120); under low mismatch, Greedy-Raw slightly lowers regret (1.000 vs. 1.018). The separate Pareto analysis is in Appendix F.3.

Interference, Overlap, and Context Transport (a) Target regret under interference

Cumulative target regret

CAUSAL-UCB (ours) Certified IPS-UCB Legacy DR-UCB

20 15 10 5 0 0.2

0.8

1

(a) Low overlap

0.15 0.1 0.05

1.4

0 0.2

0.4

0.6

0.8

1

Interference strength ;

(b) Moderate overlap

1.2

1.4

1

Local action A i

i

0.5

0

0 -2 0

Context C 1

1

Local action A i

1

0.5

0

(e) Moderate overlap

2

-2

0

2 0 -2

2

-2

(g) Low overlap

0

Context C 1

0

1

Local action A i

(f) High overlap

Context C 2

0

1

Neighborhood exposure E

0.5

0

(c) High overlap

i

Target Logging

1

Context C 2

Context C 2

1.2

0.2

Figure 4: Interference sensitivity. (a) Cumulative target regret and (b) maximum pairwise ATE error across five interference levels. Curves show means over 24 paired seeds with pointwise 95% Student-t intervals.

i

Neighborhood exposure E

0.6

Interference strength ;

(d) Low overlap

2 0 -2

2

-2

(h) Moderate overlap

0

Context C 1

2

(i) High overlap

2 0 -2 -2

0

2

2

Logging context C

Logging context C

2

2

No joint match Joint match

Logging context C

Conditional action overlap does not determine the no-exploration context law. Figure 5 illustrates context-dependent logging propensities and exploration-induced post-burn-in responses. The paired no-exploration target draws are used for visualization and evaluation only; the policies learn from logged observations. At η = 0.55, 0.30, 0.08, the joint clean-neighborhood probabilities are 0.402, 0.623, 0.891, respectively. The corresponding 10th-percentile match probabilities are 0.250, 0.511, 0.848, and descriptive node-level IPW effective counts are 4,228, 7,036, 10,255.

0.4

(b) Causal estimation under interference

0.25

Legacy IPS-UCB Greedy-Raw

Maximum pairwise ATE error

We vary network interference across five levels with 24 paired seeds per condition (Figure 4). Panels (a) and (b) report cumulative target regret and maximum pairwise ATE error, respectively, distinguishing decision quality from causal-estimation accuracy. Since neighboring actions affect realized exposure, focal-action propensity alone cannot characterize the joint action/exposure law. These controlled results assess sensitivity rather than establish identification under arbitrary interference. Oracle values are evaluation-only. We next examine joint-action support and its distinction from post-burnin context transport.

Neighborhood exposure E

5.2

2 0 -2 -2

0

2

2 0 -2 -2

0

2

These diagnostics indicate that action/exposure matching improves as measurement exploration de- Figure 5: Logging–target support and context shift. (a– creases in this controlled setting. However, better c) Action–exposure support; (d–f) logging–target context joint support does not imply that the exploratory distributions; (g–i) joint clean-neighborhood matches at η = 0.55, 0.30, 0.08. Blue/red indicate target/logging post-burn-in context distribution matches the no- draws in (a–f); green/yellow indicate match/no-match obexploration target distribution. Thus, action-law cor- servations in (g–i). rection and context transport remain separate requirements. The plotted comparisons are sensitivity diagnostics, not independent guarantees of identification or certificate coverage. Additional generator details and support analyses are provided in Appendix G.3.1.

9

Logging context C1

Logging context C1

Logging context C1

5.3

Mechanisms and the Identification–Deployment Trade-off

Five controlled variants (24 paired seeds, 200 rounds) assess DR correction, exposure, optimism, and exploration. (a) Target regret

20

Removing DR correction or exposure raises regret; omitting exposure yields the largest ATE error (about 0.16). No exploration lowers ATE error (about 0.005) but raises regret. The no-OFU ablation changes more than optimism, so it cannot isolate the OFU effect.

ATE

regret

10

0.1

5

0.05

0

0

-DR

No

RT

CE

(b) Maximum ATE error

0.2

0.15

15

DR No

re

osu

exp

No

U

OF

No

exp

tion

-DR

RT

lora

CE

No

DR No

re

osu

exp

No

U

OF

No

exp

tion

lora

Figure 6: Mechanism ablations. (a) Cumulative The paired optimism study (Appendix G.5) target regret and (b) maximum pairwise ATE error compares Certified-OFU, Certified-Greedy, and across controlled variants. Results illustrate the Greedy+Decaying-Forced across five initial- distinction between sequential decision quality and information regimes (96 paired seeds each) with causal-estimation accuracy. shared fits and audits. With an under-sampled optimum, OFU lowers regret from 0.467 to 0.241; across 33 initially misranked seeds, regret is 0.232 versus 1.077 (paired difference 0.845, 95% CI [0.621, 1.068]). Certified-Greedy wins in the other four regimes. (b) High-mismatch empirical Pareto

(a) Decision quality across exploration rates CAUSAL-UCB (ours) Certified IPS-UCB Legacy DR-UCB

Legacy DR-UCB CAUSAL-UCB (ours) Certified IPS-UCB

Legacy IPS-UCB Greedy-Raw

Greedy-Raw Legacy IPS-UCB Raw-UCB

Switchback-OED

We next sweep five fixed exploration rates. Regret increases for several baselines but remains relatively stable for Certified DR (Figure 7(a)); this illustrates, rather than proves, Theorem 2. The highmismatch regret/deployment-gap pairs in panel (b) are (1.732, 30.607) for CAUSAL-UCB, (16.207, 4.120) Figure 7: Exploration and deployment trade-off. (a) for Greedy-Raw, and (6.326, 23.217) for Certified IPS- Cumulative target regret versus exploration rate η and (b) high-mismatch Pareto frontier comparing UCB, exposing distinct decision and measurement cumulative target regret with deployment gap. costs across these methods. Target regret (lower is better)

Cumulative target regret

20 15 10

5 0

0

0.1

0.2 0.3 0.4 Exploration rate 2

0.5

0.6

20 15 10

5 0

5

10 15 20 25 Deployment gap (lower is better)

30

A matched-log 2 × 2 DR/IPS-by-exposure study at ρ = 1.40 separately examines estimator and exposure effects (Appendix G.4, Figure 21). Using identical logs across the four conditions separates these effects from differences in data collection. 5.4

Trace-Driven Transfer and Scope

Table 3: High-mismatch semi-synthetic comparison. Mean cumulative target regret We test transfer on METR-LA [32] and FlockLab [33] ± 95% Student-t CI half-width over eight topology/context traces with model-generated counterseeds (T = 180). Low-mismatch results factual outcomes (180 rounds, eight independent seeds are summarized in Appendix G.2. per condition). These are semi-synthetic replays, not Method Regret ↓ Gap ↓ ATE Dep. live deployments. ↓ ↓ Under high mismatch, CAUSAL-UCB reduces regret METR-LA CAUSAL-UCB 0.754 ± 0.035 0.000 0.0466 12.681 relative to IPS-UCB on METR-LA (0.754 vs. 0.774) IPS 0.774 ± 0.036 0.000 0.0670 12.663 Raw 8.438 ± 0.090 0.026 0.0703 4.177 and FlockLab (0.735 vs. 1.612), but has higher deploy- Greedy 5.640 ± 0.097 0.030 0.0743 3.567 8.745 ± 0.000 0.055 0.0713 4.116 ment gaps than Greedy-Raw. Under low mismatch, Switch Greedy-Raw wins on both traces (2.010 vs. 3.126; FlockLab 0.735 ± 0.000 0.000 0.0218 12.716 0.735 vs. 5.472), although CAUSAL-UCB attains the CAUSAL-UCB IPS-UCB 1.612 ± 1.582 0.004 0.1284 11.295 Raw-UCB 8.532 ± 0.034 0.041 0.0735 4.108 lowest FlockLab ATE error (0.0048). The benefits are Greedy-Raw 5.685 ± 0.000 0.030 0.0701 3.435 regime-dependent. Controlled-ring, trace-replay, and Switchback-OED 8.745 ± 0.000 0.055 0.0724 4.116 300-seed audit protocols remain separate; eight-seed Gap: final target gap; ATE: pairwise ATE error; Dep.: cumulative deployment trace intervals are marginal, not paired. General certifi- gap. cates require calibrated target-action, exposure, context-transport, clipping, and dependence budgets; the anytime result remains restricted to known interference (Appendices D.4, C.3, and C.2).

6

Conclusion

CAUSAL-UCB selects by certified no-exploration steady-state value. We prove a uniform certificate, an identification–deployment lower bound, and regret under calibrated conditions; known local interference yields an anytime radius for estimation, selection, and reporting. Experiments show high-mismatch gains, deployment costs, and low-mismatch reversals across experimental regimes. 10

Acknowledgments and Disclosure of Funding Zhiheng Zhang acknowledges support from the Fundamental Research Funds for the Central Universities at Shanghai University of Finance and Economics (Grant No. 2025110602) and the Shanghai Engineering Research Center of Finance Intelligence (Grant No. 19DZ2254600). The authors declare no competing interests.

References [1] Peter M. Aronow and Cyrus Samii. Estimating average causal effects under general interference, with application to a social network experiment. The Annals of Applied Statistics, 11(4):1912– 1947, 2017. [2] Michael G. Hudgens and M. Elizabeth Halloran. Toward causal inference with interference. Journal of the American Statistical Association, 103(482):832–842, 2008. [3] Fredrik Sävje, Peter M. Aronow, and Michael G. Hudgens. Average treatment effects in the presence of unknown interference. The Annals of Statistics, 49(2):673–701, 2021. [4] Miroslav Dudík, John Langford, and Lihong Li. Doubly robust policy evaluation and learning. In Proceedings of the 28th International Conference on Machine Learning (ICML), pages 1097–1104, 2011. [5] Yu-Xiang Wang, Alekh Agarwal, and Miroslav Dudík. Optimal and adaptive off-policy evaluation in contextual bandits. In Proceedings of the 34th International Conference on Machine Learning (ICML), PMLR 70:3589–3597, 2017. [6] Adith Swaminathan and Thorsten Joachims. Counterfactual risk minimization: Learning from logged bandit feedback. In Proceedings of the 32nd International Conference on Machine Learning (ICML), PMLR 37:814–823, 2015. [7] Abhineet Agarwal, Anish Agarwal, Lorenzo Masoero, and Justin Whitehouse. Multi-armed bandits with network interference. Advances in Neural Information Processing Systems, 37:36414– 36437, 2024. [8] Su Jia, Peter I. Frazier, and Nathan Kallus. Multi-armed bandits with interference: Bridging causal inference and adversarial bandits. In Proceedings of the 42nd International Conference on Machine Learning (ICML), PMLR 267:27271–27291, 2025. [9] Zichen Wang, Haoyang Hong, Chuanhao Li, Haoxuan Li, Zhiheng Zhang, and Huazheng Wang. Design-based bandits under network interference: Trade-off between regret and statistical inference. Advances in Neural Information Processing Systems, 2025. [10] Zhiheng Zhang and Zichen Wang. Online experimental design with estimation-regret trade-off under network interference. Advances in Neural Information Processing Systems, 2025. [11] Kartik Ahuja, Divyat Mahajan, Yixin Wang, and Yoshua Bengio. Interventional causal representation learning. In Proceedings of the 40th International Conference on Machine Learning (ICML), PMLR 202:372–407, 2023. [12] Phillip Lippe, Sara Magliacane, Sindy Löwe, Yuki M. Asano, Taco Cohen, and Efstratios Gavves. Causal representation learning for instantaneous and temporal effects in interactive systems. In International Conference on Learning Representations (ICLR), 2023. [13] Dingling Yao, Danru Xu, Sébastien Lachapelle, Sara Magliacane, Perouz Taslakian, Georg Martius, Julius von Kügelgen, and Francesco Locatello. Multi-view causal representation learning with partial observability. In International Conference on Learning Representations (ICLR), 2024. [14] Xin Lu, Yuhao Wang, and Zhiheng Zhang. Adjusting auxiliary variables under approximate neighborhood interference. Journal of the American Statistical Association, 2026.

11

[15] Victor Chernozhukov, Denis Chetverikov, Mert Demirer, Esther Duflo, Christian Hansen, Whitney Newey, and James Robins. Double/debiased machine learning for treatment and structural parameters. The Econometrics Journal, 21(1):C1–C68, 2018. [16] Imad Aouali, Victor-Emmanuel Brunel, David Rohde, and Anna Korba. Exponential smoothing for off-policy learning. In Proceedings of the 40th International Conference on Machine Learning (ICML), PMLR 202:984–1017, 2023. [17] Muhammad Faaiz Taufiq, Arnaud Doucet, Rob Cornish, and Jean-Francois Ton. Marginal density ratio for off-policy evaluation in contextual bandits. Advances in Neural Information Processing Systems, 36:52648–52691, 2023. [18] Haruka Kiyohara, Ren Kishimoto, Kosuke Kawakami, Ken Kobayashi, Kazuhide Nakata, and Yuta Saito. Towards assessing and benchmarking risk-return tradeoff of off-policy evaluation. In International Conference on Learning Representations (ICLR), 2024. [19] Konstantin Hess, Dennis Frauen, Mihaela van der Schaar, and Stefan Feuerriegel. Overlapweighted orthogonal meta-learner for treatment effect estimation over time. In International Conference on Learning Representations (ICLR), 2026. [20] Masatoshi Uehara, Haruka Kiyohara, Andrew Bennett, Victor Chernozhukov, Nan Jiang, Nathan Kallus, Chengchun Shi, and Wen Sun. Future-dependent value-based off-policy evaluation in POMDPs. Advances in Neural Information Processing Systems, 36:15991–16008, 2023. [21] Peter Auer, Nicolò Cesa-Bianchi, and Paul Fischer. Finite-time analysis of the multiarmed bandit problem. Machine Learning, 47:235–256, 2002. [22] Yasin Abbasi-Yadkori, Dávid Pál, and Csaba Szepesvári. Improved algorithms for linear stochastic bandits. Advances in Neural Information Processing Systems, 24:2312–2320, 2011. [23] Tor Lattimore and Csaba Szepesvári. Bandit Algorithms. Cambridge University Press, 2020. [24] Sanath Kumar Krishnamurthy, Ruohan Zhan, Susan Athey, and Emma Brunskill. Proportional response: Contextual bandits for simple and cumulative regret minimization. Advances in Neural Information Processing Systems, 36:30255–30266, 2023. [25] Anh Do, Thanh Nguyen-Tang, and Raman Arora. Multi-agent learning with heterogeneous linear contextual bandits. Advances in Neural Information Processing Systems, 36:78768–78790, 2023. [26] Jon Schneider and Julian Zimmert. Optimal cross-learning for contextual bandits with unknown context distributions. Advances in Neural Information Processing Systems, 36:51862–51880, 2023. [27] Zeyu Jia, Jian Qian, Alexander Rakhlin, and Chen-Yu Wei. How does variance shape the regret in contextual bandits? Advances in Neural Information Processing Systems, 37:83730–83785, 2024. [28] Aldo Pacchiano. Second order bounds for contextual bandits with function approximation. In International Conference on Learning Representations (ICLR), 2025. [29] Judea Pearl. Causality: Models, Reasoning, and Inference. 2nd edition, Cambridge University Press, 2009. [30] James M. Robins, Andrea Rotnitzky, and Lue Ping Zhao. Estimation of regression coefficients when some regressors are not always observed. Journal of the American Statistical Association, 89(427):846–866, 1994. [31] Iavor Bojinov, David Simchi-Levi, and Jinglong Zhao. Design and analysis of switchback experiments. Management Science, 69(7):3759–3777, 2023. [32] Yaguang Li, Rose Yu, Cyrus Shahabi, and Yan Liu. Diffusion convolutional recurrent neural network: Data-driven traffic forecasting. In International Conference on Learning Representations (ICLR), 2018. 12

[33] Romain Jacob, Reto Da Forno, Roman Trüb, Andreas Biri, and Lothar Thiele. Dataset: Wireless link quality estimation on FlockLab – and beyond. In Proceedings of the 2nd Workshop on Data Acquisition to Analysis (DATA), pages 57–60, 2019. [34] Tianyu Guo, Sai Praneeth Karimireddy, and Michael Jordan. Collaborative heterogeneous causal inference beyond meta-analysis. In Proceedings of the 41st International Conference on Machine Learning (ICML), PMLR 235:16849–16868, 2024. [35] Amirhossein Farzam, Allen Tannenbaum, and Guillermo Sapiro. From geometry to causality— Ricci curvature and the reliability of causal inference on networks. In Proceedings of the 41st International Conference on Machine Learning (ICML), PMLR 235:13086–13108, 2024.

13

A

Problem Origin and Detailed Closest-Work Comparison

The main text establishes the decision primitive: an operator selects a global configuration from postburn-in exploratory telemetry, but evaluates its no-exploration steady-state value. The identification obstruction and its precise assumptions are developed in Appendix C.2; this section locates the objective relative to the closest research lines. A.1

Closest-Work Comparison and Scope Boundaries

The main text summarizes the literature by problem dimensions. Here we clarify the closest methodological connections and the distinct estimand and guarantee regimes. Table 4: Representative connections and precise scope distinctions. Research line

Core contribution

Distinction in this work

Interference and designs [1, 2, Potential outcomes, exposure-based in- A global configuration induces local ac31] ference, and temporal treatment de- tions and a post-burn-in no-exploration target signs. regime. DR and orthogonal OPE [4, 5, 15] Logged-action correction and nuisance- The certificate separately budgets exposure, robust value estimation. target-context transport, and dependence errors. Longitudinal / latent evaluation Evaluation under partial observability The estimand here is a global configuration’s [19, 20] and overlap-weighted temporal treat- steady-state value without measurement exment effects. ploration. Contextual and network bandits Online learning with unknown context Selection uses certified causal values from [7, 8, 26] laws or interacting rewards. exploration-perturbed network telemetry. Design-based inference–regret Pareto trade-offs and anytime asymp- Our lower bound concerns identification ver[9] totic inference under network interfer- sus measurement-induced deployment loss ence. in a specified stationary, potentially slowmixing family.

Additional connections arise from heterogeneous causal inference and network geometry. Collaborative causal estimation under heterogeneous data distributions [34] addresses cross-site statistical heterogeneity, whereas geometric analyses of network causal inference [35] study how graph structure can affect the reliability of causal estimation. Neither line directly provides a predecision certificate for the no-exploration steady-state value of a global configuration under measurement-induced regime changes.

B

Extended Setup, Notation, and Estimation Foundations

B.1

Notation and Logged Probability Space

Compact notation table. Table 5 summarizes the main symbols and experimental settings. Related symbols are grouped by model component; theorem-calibrated quantities and diagnostic-only proxies are distinguished explicitly. The main causal evaluation uses the pre-action context C − and the joint e = (A, E). The original logged tuple O is distinguished from the derived action/exposure variable A e scoring record O. Table 5: Notation and experimental protocols. Symbol(s)

Meaning

Network, logging, and causal target N, Z, M Nodes, configuration set, and its size. ⋆ z, zt , z Candidate, chosen, and optimal configuration (arg maxz W∞ (z; 0)). Yτ(t) , Ht−1 Latent network state and predecision history.

Symbol(s)

Meaning

i, t, T

Node, deployment round, horizon.

τ, Tburn , s, T0

Fast time, burn-in, retained-window index/count.

(t)

Round-t logs and raw (A, C, R) tuple.

Dt , Oi,s

Continued on next page

14

Table 5: Notation and experimental protocols (continued) Symbol(s) A, R, Bu , C

Meaning −

e O e A, obs πz,0 , πz,η

gb,r , g bb,r

Symbol(s)

Meaning

+

Local action, response E, ϕ, ϕ (|R| ≤ Bu ), and pre-action context. Joint treatment (A, E) and score ηt , η, ξ e C − , R). record (A, obs Target and logged local-action gz,0 , gz,η laws. Behavior joint law and its estimate. νz,η , νz,0

Exposure and baseline/enriched maps.

z νbz , νtr ,ν b

Logging/training context laws and dF , Kh an estimated context law. Target/logging response regressions µz , µ bz and fitted nuisance. ct , W cz,n b exp,t W∞ , W No-exploration value and ∆ time/prefix estimates (indexed by z ). RegT , Gap Cumulative target regret; terminal ATE, ATE error optimality gap. DeploymentGap, LW Exploration-induced loss; value’s ρ, ∆, σ exploration-rate Lipschitz constant. DR estimation, certificates, and dependence bz,r , ψz ψ Fitted and oracle DR scores. w bz,r , wmax , πmin mz , mzlog , m bz

Score P bound 2Bu (1 + wmax ); t δt ≤ δ . bt (z), bz,n Predecision/finite-prefix certificate radius. ϵm,t , ϵπ,t Response-nuisance and fitted joint-ratio errors. ϵexp , ϵ̄shift,t Exposure/response-transport and context-transport budgets. κ bt , Nz (t) Excess block-drift diagnostic; times z is selected. n b eff,t , n e eff,t Plug-in ESS and operational shrinkage proxy: diagnostics only. Bt , Gt , Lt , cess , cB Block/group/lag settings and operational constants. c1 , c2 , λ, γ Lower-bound constants; information growth and approximation exponent. Finite-state audit and supplemental diagnostics Bψ , δ, δt

comp(Z) Et (z), et (z) ϵ̄target,t , ϵclip,t ϵ̄cfg,t , ϵ̄tot,t γℓ , ρ ℓ neff,t β(k), τmix CI95

Contexts, actions, and pz , p e, e b, m e audit-cell/union-bound dimensions. nmin , α, r, ϵ(m) Audit counts, error budget, radius, ep , eb , em , ew , eν and mismatch envelope. q, Kj , mj− , mn , hj Neighborhood-match budget probabilities/indicators, counts, weights. Experimental protocols (not theoretical assumptions) Main benchmark N = 24, M = 5, T = 200, Seven-term coverage T0 = 2; 24 paired seeds; η ∈ {.55, .08}, σ = .08. OFU–Greedy Five regimes, 96 paired seeds, 80 Gap–noise–budget rounds; 400 blocks/round; 10k fit/200k audit observations per cell. Concealed misspecification 64 paired seeds, 120 rounds, 1,200 METR-LA / FlockLab windows/round; ξ ∈ {0, .10, .20, .35, .50}. J, K, D

Exploration rates and exploratory action law. Target and logged joint action/exposure laws. Pre-action context laws with/without exploration. Context discrepancy and its error-envelope map. Target-law response average and fitted counterpart. Exposure-enrichment sensitivity diagnostic. Treatment effect; maximum pairwise error. Interference strength, value gap, noise scale. Clipped joint ratio, cap, denominator floor. Configuration-class complexity. Total predecision error, including excess drift. Target-law error and clipping bias. Configuration mismatch and total calibrated budget. Score lag covariance and autocorrelation. Dependence-calibrated ESS lower bound used in the theorem. Absolute regularity and mixing time. 95% interval (paired-t or Wilson, by study).

Target action law and independent audit means. Audit errors: actions, response, weights, context. Scored-window budget per decision.

300 seeds, 160 rounds; 2,000 scored windows/decision; 10k fit/200k audit observations per cell. ∆ ∈ {.005, .016, .030}, σ ∈ {.2, .6, 1}; 200/400 windows, 24 seeds, 80 rounds/cell. Observed topology/context traces; model-generated outcomes (semi-synthetic).

Slow and fast time. The operator chooses a deployment at slow round t = 1, . . . , T . Within each round, the system evolves for τ = 1, . . . , Tburn + T0 : the first Tburn steps are burn-in, and the final T0 windows are retained. The raw observation for node i and retained window s is (t)

(t)

(t)

(t)

Oi,s = (Ai,s , Ci,s , Ri,s ). For causal scoring, the raw log is supplemented with the exposure constructed from the observed network telemetry. We write   (t) (t) e(t) = (A(t) , E (t) ), Ei,s = ϕi {Aj,s }j∈Ni (s) , Ss(t) , G(t) , A s i,s i,s i,s

15

and define the corresponding scoring record as   e (t) = A e(t) , C −,(t) , R(t) . O i,s

−,(t)

Here Ci,s

i,s

i,s

i,s

contains only information available strictly before the focal action is generated. Con(t)

temporaneous neighboring actions and telemetry used to construct Ei,s belong to the observed joint −,(t)

action/exposure variable, not to Ci,s scoring record.

. The raw log retains the telemetry needed to construct this

Prequential scoring convention. The main-text notation suppresses the fitting cutoff on the target response regression and target joint law. In the cumulative estimator, ψbz,r denotes the score rule stored for source round r: its target-law fit, response-regression fit, and behavior joint-law fit are frozen before the corresponding scoring window is observed. Scores from earlier rounds are retained as stored; they are not retrospectively recomputed using nuisance fits trained on later observations. If nuisance fits are updated within a deployment round, the same convention applies at the networkwindow level, with a window-specific stored score rule. This is the predictability convention used in the filtration-based concentration arguments. (t)

Latent state and history. The full state Yτ may include queues, controller variables, channel histories, routing tables, or local filters; it and its transition kernel are unknown to the operator. Only logged tuples and runtime diagnostics (e.g., score autocorrelation, block drift, exposure histograms, and context two-sample statistics) are observed. Before round t, the history is n o (r) b exp,r : r < t, i ≤ N, s ≤ T0 . br , ϵ̄shift,r , ϵ̄cfg,r , ∆ Ht−1 = σ zr , ηr , Oi,s , neff,r , κ It contains realized deployments and telemetry, not counterfactual observations for configurations that were not deployed. Their values must therefore be evaluated through the exposure interface, the logging law, and the off-policy estimator. In particular, causal evaluation of a candidate configuration requires assumptions that relate the source-regime response to the candidate’s target response; the behavior propensity correction alone does not establish this cross-configuration response relationship. Target and logging distributions. Let νz,η be the post-burn-in distribution of pre-action contexts C − under configuration z and exploration rate η. Let πz,0 (a | c− ) denote the target conditional law of the focal local action without measurement exploration, and let ξ(a | c− ) be the known exploratory local-action law. The local-action logging mechanism retains its original mixture form: obs πz,η (a | c− ) = (1 − η)πz,0 (a | c− ) + ηξ(a | c− ).

This equation describes the conditional law of the focal local action. It does not, by itself, imply the e because the exposure may depend on same mixture identity for the joint action/exposure variable A, multiple contemporaneous actions and network telemetry. Write gz,0 (e a | c− ) for the target joint action/exposure law under no-exploration deployment, and obs − gz,η (e a | c ) for the joint law induced by the actual logging mechanism. The latter must be derived from that mechanism; it is not obtained merely by substituting the marginal local-action mixture into a joint propensity. For a historical observation generated in round r, the behavior joint law corresponds to its actual source regime (zr , ηr ) and is denoted gb,r (e a | c− ). Its fitted version is − denoted gbb,r (e a | c ). The target value uses the context law νz,0 and the target joint law gz,0 : Z  W∞ (z; 0) = EC − ∼νz,0 mz (e a, C − ) gz,0 (de a | C −) , where mz (e a, c− ) is the target-regime conditional response under the specified joint action/exposure treatment. The corresponding target conditional mean is Z µz (c− ) = mz (e a, c− ) gz,0 (de a | c− ).

16

For discrete joint treatments, these integrals are sums. For continuous joint treatments, the propensity ratio is interpreted as a density ratio with respect to a common dominating measure. The target joint law and context law differ from the laws under which historical exploratory observations are collected. The joint importance ratio corrects treatment/exposure-law mismatch only under the corresponding identification, overlap, and response-transport conditions. Context transport from νz,η to νz,0 and cross-configuration response transport remain distinct requirements; they are not established by the local-action mixture identity alone. B.2

Technical Foundations and Proof Roadmap

This appendix provides derivations and calibration details for the estimator, certificate, frontier, and regret guarantee. The proof chain is: 1. Appendix B.1 defines the logged probability space, timescales, and random variables. 2. Appendix B.3 derives the no-exploration target and the relationship between target and logging laws. 3. Appendix B.4 defines the post-burn-in score sequence, the plug-in effective sample size, its operational shrinkage proxy, and the excess block-drift diagnostic. The certified lower-information quantity neff,t requires the separate dependence calibration stated there. 4. Appendix B.5 records the mixture-induced ratio bounds and explains why the clipped stochastic term is controlled by Bψ rather than by an additional uncontrolled 1/η variance factor. 5. Appendix B.6 proves the oracle doubly robust identity. 6. Appendices B.7–B.10 derive clipping, nuisance product error, exposure sensitivity, context-shift proxies, and cross-configuration mismatch proxies. 7. Appendix B.11 gives the configuration-aware nuisance fitting rule used in the algorithm. 8. Appendices D.1–D.2 prove fixed-configuration and uniform deviation bounds. 9. Appendices C.1–D.6 prove the main certificate, frontier theorem, regret theorem, and deploymentgap corollary. 10. Appendices E.1–F.1 give the executable diagnostic and experimental protocol. B.3

Target Value and Logging Law Derivation

The no-exploration target for a candidate configuration z is Z  − − W∞ (z; 0) = EC − ∼νz,0 mz (e a, C ) gz,0 (de a|C ) .

(17)

e A

e = (A, E) is the joint action/exposure treatment unit, Here C − denotes the pre-action context, A gz,0 (· | C − ) is its target conditional distribution under no-exploration deployment, and mz (e a, C − ) is the corresponding target-regime conditional response mean. For discrete joint treatments, the integral is a sum; for continuous joint treatments, it is taken with respect to the target probability measure. For deployment under configuration z and exploration rate η, let νz,η denote the post-burn-in distribution of pre-action contexts. The observed focal local action follows the original measurementlevel mixture obs πz,η (a | c− ) = (1 − η)πz,0 (a | c− ) + ηξ(a | c− ). Consequently, obs πz,η (a | c− ) ≥ ηξ(a | c− ). If ξ(a | c− ) ≥ ξmin > 0 and η > 0, the focal-action target-to-logging ratio obeys πz,0 (a | c− ) 1 ≤ . obs (a | c− ) πz,η ηξmin This is a positivity bound for the marginal focal-action law only. It is not, by itself, a bound on the joint action/exposure importance ratio.

17

obs Let gz,η (· | c− ) denote the joint action/exposure law induced by the actual logging mechanism, including the contemporaneous neighboring actions and the exposure mapping. In general, the local-action mixture above does not imply obs gz,η (e a | c− ) = (1 − η)gz,0 (e a | c− ) + ηgξ (e a | c− )

for any particular joint exploratory law gξ unless that identity is established from the joint actiongeneration mechanism. In particular, the exposure component may depend on multiple contemporaneous actions and network telemetry, and the joint law must account for those dependencies. For a historical observation collected in round r, let (zr , ηr ) be its actual source regime. Its behavior joint law is the law induced by that source regime, denoted gzobs when the mechanism is known, or r ,ηr gb,r when represented by the corresponding behavior-law notation. The candidate target law remains gz,0 ; these laws need not coincide when zr ̸= z. The joint importance ratio used for causal evaluation is joint wz,r (e a, c− ) =

gz,0 (e a | c− ) . gb,r (e a | c− )

For continuous joint treatments, this ratio denotes the Radon–Nikodym derivative of the target joint law with respect to the behavior joint law, whenever that derivative exists. A necessary overlap condition is gz,0 (· | c− ) ≪ gb,r (· | c− ) for the relevant target contexts and historical source regimes. Any finite upper bound on this joint ratio must be established from the actual joint action/exposure mechanism; it does not follow solely from the marginal mixture formula. The clipped ratio used by the estimator limits the score’s range, while any resulting clipping bias must be included in the calibrated error budget. Finally, the target context distribution νz,0 may differ from the context distribution under which historical observations were collected. Joint action/exposure weighting addresses the treatment-law mismatch conditional on context; it does not, by itself, transport the context distribution or identify a candidate configuration’s response from observations generated under a different configuration. Those discrepancies require the separately stated context-transport and cross-configuration responsetransport conditions in the main certificate. B.4

Post-Burn-in Blocks, Effective Sample Calibration, and Excess Drift

This section defines the post-burn-in network-window score sequence, its plug-in effective sample size, the operational shrinkage proxy, and the excess block-drift diagnostic κ bt . The certified lowerinformation quantity neff,t requires a separate dependence calibration. B.4.1

From network windows to the clipped score sequence

For a fixed candidate configuration z, flatten the retained windows in observation order into j = 1, . . . , Jt , where Jt = T0 t and j indexes the pair (r, s) of deployment round and retained window. Define the network-window score J

N

Yj,z =

1 Xb e (r(j)) ), ψz,r(j) (O i,s(j) N i=1

Ȳt (z) =

t 1 X Yj,z . Jt j=1

The score rule stored for source round r(j) is frozen before the corresponding network window is scored. By the clipped-score bound in Appendix B.7, |Yj,z | ≤ Bψ . The within-window dependence among nodes is unrestricted; the time-series unit for the concentration and autocorrelation calculations is the aggregated network-window score Yj,z , not the N Jt node-level records. This convention ct (z; 0) in the main text. matches the normalization of W B.4.2

Variance identity for correlated network windows

If the post-burn-in network-window sequence is approximately second-order stationary, define γℓ (z) = Cov(Yj,z , Yj+ℓ,z ), 18

ρℓ (z) = γℓ (z)/γ0 (z).

Then J

J

t X t 1 X Cov(Yj,z , Yj ′ ,z ) Jt2 j=1 ′ j =1 " #  JX t −1  ℓ γ0 (z) 1+2 1− ρℓ (z) . = Jt Jt

Var{Ȳt (z)} =

(18)

ℓ=1

This motivates the plug-in effective sample size n beff,t (z) =

Jt 1+2

PLt

ρℓ,t (z), 0} ℓ=1 max{b

.

(19)

Positive autocorrelations reduce the estimated information. Negative empirical autocorrelations are not used to claim extra precision, because they are often noisy in short sequences. B.4.3

Operational ESS shrinkage and calibration requirement

The plug-in value n beff,t (z) is an empirical estimate. Let Bt be the number of post-burn-in blocks used to estimate autocorrelation. Define the operational shrinkage proxy ) ( n beff,t (z) p . (20) n eeff,t (z) = max 1, 1 + cess log(2T /δ)/Bt This shrinkage rule is an operational heuristic, not a finite-sample lower confidence bound. The quantity neff,t (z) used in Theorem 1 must instead be supplied by a proved dependence argument or an independently calibrated lower-information bound for the sequence {Yj,z }. Such calibration must establish that the reported quantity does not exceed the information certified by the dependence model or audit. Empirical autocorrelations alone do not establish coverage. If no valid lower-information calibration is available, the general confidence certificate is not certified. B.4.4

Excess block drift

The autocorrelation correction addresses temporal dependence but not continued drift after burn-in. Partition the network-window sequence into adjacent blocks B1,t , . . . , BGt ,t and define X Ȳg,t (z) = |Bg,t |−1 Yj,z . j∈Bg,t

The excess block-drift statistic is " κ bt (z) =

s

max |Ȳg,t (z) − Ȳg−1,t (z)| − cB Bψ

2≤g≤Gt

log(2T Gt /δ) ming |Bg,t |

# .

(21)

+

If adjacent block means differ only by concentration-scale noise, κ bt (z) = 0. If they move beyond that scale, the observed excess flags potential residual drift. The statistic is computable from the clipped network-window scores, but it enters a theorem-backed radius only when a dependence or audit argument validates it as an upper bound on residual mean drift at the stated confidence level. B.5

Mixture Logging Ratio Bounds

This section records the ratio bounds induced by the measurement-level mixture logging mechanism. We distinguish the marginal focal-action ratio from the joint action/exposure ratio, because the former does not, by itself, establish a bound on the latter. Lemma 1 (Marginal mixture ratio bounds). Let obs πz,η (a | c− ) = (1 − η)πz,0 (a | c− ) + ηξ(a | c− ),

ξ(a | c− ) ≥ ξmin > 0,

where 0 < η < 1. Then the marginal focal-action target-to-logging ratio ⋆ wz,η (a, c− ) =

πz,0 (a | c− ) obs (a | c− ) πz,η

19

satisfies 1 whenever πz,0 (a | c− ) > 0, 1−η and also satisfies the conservative positivity bound 1 ⋆ wz,η (a, c− ) ≤ ηξmin ⋆ wz,η (a, c− ) ≤

for all feasible (a, c− ). Proof. The first bound follows from obs πz,η (a | c− ) = (1 − η)πz,0 (a | c− ) + ηξ(a | c− ) ≥ (1 − η)πz,0 (a | c− ).

Dividing by the positive denominator gives ⋆ wz,η (a, c− ) ≤

1 1−η

whenever πz,0 (a | c− ) > 0. The second bound follows from obs πz,η (a | c− ) ≥ ηξ(a | c− ) ≥ ηξmin

and πz,0 (a | c− ) ≤ 1. Scope of the marginal bounds. Lemma 1 concerns only the conditional distribution of the focal local action A given the pre-action context C − . Its bounds do not automatically apply to the joint e = (A, E). In particular, the exposure E may depend on neighboring action/exposure variable A actions and contemporaneous network telemetry, so the marginal mixture identity for A does not by e itself imply a corresponding mixture identity for A. Joint action/exposure ratio. For candidate configuration z, let gz,0 (· | c− ) denote the target joint action/exposure law under no-exploration deployment. Let gb,r (· | c− ) denote the behavior joint law associated with the actual source regime (zr , ηr ) of historical round r. The joint importance ratio is joint wz,r (e a, c− ) =

gz,0 (e a | c− ) gb,r (e a | c− )

when densities with respect to a common dominating measure exist and the denominator is positive on the target support. More generally, the ratio is the Radon–Nikodym derivative of the target joint law with respect to the behavior joint law. A necessary overlap condition is gz,0 (· | c− ) ≪ gb,r (· | c− ) for the relevant target contexts and historical source regimes. This absolute-continuity condition ensures that target events are not assigned zero probability under the corresponding behavior law. It does not, by itself, imply that the joint importance ratio is uniformly bounded. For clarity, a bound analogous to the first marginal bound would follow under the additional, explicitly verified joint-mixture condition gb,r (· | c− ) = (1 − ηr )gz,0 (· | c− ) + ηr qz,r (· | c− ),

0 ≤ ηr < 1,

where qz,r is a probability law on the same joint action/exposure space. Under this condition, 1 1 − ηr on the target support. However, this bound applies only when the stated joint-mixture identity actually holds. It cannot be inferred solely from the marginal local-action mixture, and it is not automatically valid when the historical source configuration zr differs from the candidate configuration z. joint wz,r (e a, c− ) ≤

Accordingly, any finite upper bound on the joint ratio must be justified from the actual joint actiongeneration mechanism, including the induced exposure distribution and any cross-configuration change. If such a bound cannot be established, the analysis must instead retain the appropriate overlap and clipping-bias conditions without claiming the marginal mixture bound for the joint ratio. 20

Interpretation. The marginal mixture bounds provide a positivity guarantee for the focal local action. The joint action/exposure formulation used by the main-text doubly robust estimator requires the corresponding joint-law overlap condition and, where a numerical ratio bound is used, its own justification. The cap wmax bounds the implemented clipped score; it does not establish joint overlap or eliminate clipping bias. Any clipping bias must remain accounted for in ϵclip,t (z), as specified in the main certificate. B.6

Oracle Doubly Robust Identity

e = (A, E) denote the Fix a candidate configuration z. Let C − denote the pre-action context and let A − joint action/exposure treatment unit. Write gz,0 (e a | c ) for the target joint law under no-exploration deployment and Z µz (c− ) = mz (e a, c− ) gz,0 (de a | c− ), e A

where mz (e a, c− ) is the target-regime conditional response mean. For a historical observation collected in round r, let gb,r (e a | c− ) denote the behavior joint law associated with its actual source regime. Assume that the target joint law is absolutely continuous with respect to this behavior law on the relevant support. The oracle joint importance ratio is gz,0 (e a | c− ) . wz,r (e a, c− ) = gb,r (e a | c− ) For continuous joint treatments, this expression denotes the Radon–Nikodym derivative with respect to a common dominating measure. Let mb,r (e a, c− ) denote the conditional mean of the observed response under the historical source regime. The oracle DR score for candidate z is e = µz (C − ) + wz,r (A, e C − ){R − mz (A, e C − )}, e = (A, e C − , R). ψz,r (O) O Conditionally on C − = c− , suppose the observed response has conditional mean mb,r (e a, c− ). Then, whenever the importance ratio is well-defined and the relevant expectations exist, Z h i   − − − e Eb,r ψz,r (O) | C = c = µz (c ) + gz,0 (de a | c− ) mb,r (e a, c− ) − mz (e a, c− ) . (22) e A

This follows by conditioning on the joint action/exposure variable and using wz,r gb,r = gz,0 on the target support. In particular, if the conditional response is invariant between the historical source regime and the target regime on the relevant support, so that mb,r (e a, c− ) = mz (e a, c− ), then the response-discrepancy term in Eq. (22) vanishes and h i e | C − = c− = µz (c− ). Eb,r ψz,r (O) Averaging this conditional identity over the target context law νz,0 gives h i e | C − = EC − ∼ν [µz (C − )] EC − ∼νz,0 Eb,r ψz,r (O) z,0 = W∞ (z; 0).

(23)

The conditional identity and its target-context average require distinct qualifications when historical observations come from other configurations or exploration regimes. If the conditional response differs across source and target regimes, the integral in Eq. (22) is a response-transport discrepancy and must be bounded by the separately calibrated response-transport budget. If the historical context law differs from νz,0 , averaging under the historical context law instead of the target context law introduces an additional context-transport discrepancy. Neither discrepancy is removed merely by correcting the joint action/exposure distribution. Consequently, the oracle identity establishes the DR correction under the stated joint-treatment overlap and response conditions; it does not, by itself, identify the counterfactual response of an unobserved configuration. The plug-in estimator inherits the corresponding target-joint-law estimation, nuisanceproduct, clipping, exposure/response-transport, context-shift, and cross-configuration mismatch terms, as accounted for in the main-text certificate and the following appendices. 21

B.7

Clipping Bias and Boundedness

Fix a candidate configuration z and a historical source round r. Let C − denote the pre-action context e = (A, E) denote the joint action/exposure treatment unit. Write gz,0 (· | c− ) for the target and let A joint law and gb,r (· | c− ) for the behavior joint law associated with the actual source regime in round r. Assume the target joint law is absolutely continuous with respect to the behavior joint law on the relevant support. Define the oracle joint importance ratio and its clipped version by gz,0 (e a | c− ) wz,r (e a, c− ) = , w̄z,r (e a, c− ) = min{wz,r (e a, c− ), wmax }. gb,r (e a | c− ) For continuous joint treatments, the ratio is understood as the Radon–Nikodym derivative with respect to a common dominating measure. The ratio is defined on the behavior support; values outside that support require the stated overlap condition. Boundedness of the clipped score. Suppose the normalized response and the fitted response regression satisfy |R| ≤ Bu , |m b z (e a, c− )| ≤ Bu . Suppose also that the fitted target joint law is a probability distribution and that Z − µ bz (c ) = m b z (e a, c− ) gbz,0 (de a | c− ), e A

so that |b µz (c− )| ≤ Bu . The fitted clipped weight satisfies 0 ≤ w bz,r ≤ wmax . Therefore, for the joint-treatment DR score e =µ e C − ){R − m e C − )}, ψbz,r (O) bz (C − ) + w bz,r (A, b z (A, e = (A, e C − , R), we have where O
e ≤ Bu + wmax |R| + |m e C − )| |ψbz,r (O)| b z (A, ≤ Bu (1 + 2wmax ) ≤ 2Bu (1 + wmax ) =: Bψ . (24) Thus the score bound used in the main-text concentration argument remains valid after replacing the marginal action weight by the clipped joint action/exposure weight. The same bound applies to the oracle score when its response regression and target mean satisfy the corresponding boundedness conditions. Clipping bias. Let mz (e a, c− ) denote the target-regime conditional response, with |mz | ≤ Bu . Define the oracle unclipped and clipped scores, respectively, by e = µz (C − ) + wz,r (A, e C − ){R − mz (A, e C − )}, ψ or (O) z,r

clip e e C − ){R − mz (A, e C − )}, ψz,r (O) = µz (C − ) + w̄z,r (A,

where µz (c− ) =

Z

mz (e a, c− ) gz,0 (de a | c− ).

e A

e C − )| ≤ 2Bu , their pointwise difference obeys Because |R − mz (A,
or e clip e e C − ) − wmax , ψz,r (O) − ψz,r (O) ≤ 2Bu wz,r (A, + where (x)+ = max{x, 0}. Consequently, under any common context law ν for which the relevant expectations exist, h i or e clip e − E ψz,r (O) − ψz,r (O) C ∼ν e b,r (·|C − ) A∼g

≤ 2Bu E

h

C − ∼ν e b,r (·|C − ) A∼g

i e C − ) − wmax wz,r (A, . +

(25)

The right-hand side is the clipping-bias allowance for this source regime and context law. When multiple historical rounds are pooled, the calibrated allowance must cover their corresponding averaged contributions; a bound for one round alone does not automatically bound the entire historical average. 22

Role in the causal value certificate. The clipping allowance ϵclip,t (z) must bound the historicalaverage truncation bias for the joint ratios used by the estimator. It neither establishes overlap when target-supported events are impossible under the behavior law nor covers source-to-target response transport. Likewise, fitted-ratio error is not included in the oracle clipping bound (25); it belongs to the nuisance decomposition in Appendix B.8. The certificate must therefore retain separate calibrated allowances for target-law estimation, nuisance error, context transport, exposure approximation, and response transport. B.8

Plug-in Nuisance Error: Exact Decomposition and Response Transport

Condition on the nuisance fits stored before a scoring window and on a common evaluation context law ν for the pre-action context C − . Fix a candidate configuration z and a historical source round r. For compactness, write p(e a | c− ) = gz,0 (e a | c− ),

b(e a | c− ) = gb,r (e a | c− ),

for the target and behavior joint action/exposure laws. Let mz (e a, c− ) be the target-regime conditional − response mean and mb,r (e a, c ) the conditional response mean under the historical source regime. The fitted quantities below are the versions used by the stored score ψbz,r ; their fitting-cutoff indices are suppressed only for readability. Let pb, bb, and m b z denote the fitted target joint law, behavior joint law, and target response regression. Define Z − µ bz (c ) = m b z (e a, c− )b p(de a | c− ), e A

and suppose the fitted joint laws are valid probability distributions. For continuous joint treatments, all ratios are density ratios with respect to a common dominating measure, and denominator regularization must be defined consistently with that measure. Write p w= , b

( w̄ = min{w, wmax },

w b = min

pb , wmax b max{b, πmin }

) ,

where ratios are evaluated at (e a, c− ). Define δm = m b z − mz ,

δw = w b − w̄,

∆b,r,z = mb,r − mz .

Thus δw is the error in the *induced clipped joint importance ratio*, not merely the raw behaviordensity estimation error. The fitted joint-treatment DR score is e =µ e C − ){R − m e C − )}, ψbz,r (O) bz (C − ) + w( b A, b z (A,

e = (A, e C − , R). O

Conditionally on C − = c− , the observed response has mean mb,r (e a, c− ) under the behavior law. The exact identity is Z e | C − = c− ] − Eb,r [ψbz,r (O) p(e a | c− )mz (e a, c− ) de a e A Z = [b p − p](e a | c− )m b z (e a, c− ) de a e A Z + [p − bw̄](e a | c− )δm (e a, c− ) de a e A Z − b(e a | c− )δw (e a, c− )δm (e a, c− ) de a e A Z + b(e a | c− )w(e b a, c− )∆b,r,z (e a, c− ) de a. (26) e A

For discrete joint treatments, the integrals above are sums. The first three terms are the target-jointlaw, clipping, and nuisance-product contributions. The fourth term is a separate source-to-target response-transport contribution; it vanishes only under a justified conditional response-invariance assumption. Correcting the joint action/exposure distribution alone does not remove this fourth term. 23

Bounds for the nuisance terms. |R| ≤ Bu ,

Suppose |mz | ≤ Bu ,

|m b z | ≤ Bu ,

|mb,r | ≤ Bu .

For the chosen context law ν, define e − Eν,b [f ] = EC − ∼ν EA∼b(·|C − ) [f (A, C )], e

1/2 . ∥f ∥L2 (ν,b) = Eν,b [f 2 ]

The first term is bounded by the first-order target-joint-law error   ϵtarget = Bu EC − ∼ν ∥b p(· | C − ) − p(· | C − )∥1 .

(27)

Since p − bw̄ = b(w − wmax )+ , the second term is bounded by

(x)+ = max{x, 0},

ϵclip,r = 2Bu Eν,b [(w − wmax )+ ].

(28)

Here |δm | ≤ 2Bu has been used. By Cauchy–Schwarz, the third term is bounded by ϵmπ,r = ∥δm ∥L2 (ν,b) ∥δw ∥L2 (ν,b) .

(29)

Accordingly, the main-text ϵm,t (z) and ϵπ,t (z) must control these two norms under the actual sourcewindow score laws. A sufficient pooled-prefix convention is to use uniform upper bounds over all source rounds and windows included in the prefix; alternatively, a directly calibrated historical average of the products may be used. A bound on the raw behavior law alone is not sufficient unless it is shown to imply the required bound on ∥w b − w̄∥L2 (ν,b) . Source-to-target response transport.

The fourth term in Eq. (26) is bounded by h i − − e e ϵresp,r (z) = EC − ∼ν EA∼b(·|C w( b A, C )|∆ ( A, C )| −) b,r,z e ≤ wmax Eν,b [|∆b,r,z |].

(30)

This bound controls the response-transport term when the score is compared directly with the target conditional mean. In the five-term proof telescope, where the third term is compared with the oracle log source-response functional Vz,r , the corresponding score-level residual is instead the signed integral involving (bw b − p)∆b,r,z ; it is defined and bounded in Appendix D.3. The two expressions serve different decompositions and must not be substituted for one another without the associated algebra. If the main-text exposure/response budget ϵexp (z) is calibrated to dominate the required sourceresponse terms for all admissible historical source regimes and all prefixes, those terms are included there. Otherwise, an additional explicit response-transport allowance is required in the theorem’s error budget. Such an allowance must not be silently omitted or counted twice. Implications for the certificate. After pooling, target-law, clipping, nuisance-product, and sourceresponse contributions must be calibrated under the same source regimes, target support, and historical averaging scheme; a one-round bound is insufficient. Target-law error remains first order, and neither cross-fitting nor estimating the marginal local-action mixture identifies the joint action/exposure law or an undeployed configuration’s response. B.9

Exposure Approximation and Enrichment Diagnostic

Let L denote the full interference state, which may contain network information not fully captured by the observed exposure mapping. Let C − denote the context available strictly before the focal action, e = (A, E) denote the observed joint action/exposure treatment unit, where E is constructed and let A from the available network telemetry. Under any single fixed probability law, the tower property gives e C − , z]]. E[E[R | L, z]] = E[R | z] = E[E[R | A, Consequently, the difference between these unconditional means under the same law cannot, by itself, quantify exposure approximation error. Such error concerns whether the observed context and 24

exposure representation is sufficient for the conditional response and transport arguments required by the causal estimand, rather than a difference between two representations of the same unconditional expectation. Let Pz,0 denote the target-regime law under configuration z without measurement exploration. Write νz,0 for its pre-action context law and gz,0 (· | c− ) for its conditional joint action/exposure law. When the target interventional response is identified on this representation, denote it by m0z (e a, c− ). Thus, Z  W∞ (z; 0) = EC − ∼νz,0 m0z (e a, C − )gz,0 (de a | C −) . e A

This representation requires the corresponding causal identification assumptions under interference; it is not implied merely by defining an observed exposure mapping. If the response mz used in the main-text score is not equal to this identified target response, the resulting representation discrepancy must be included in the exposure/response budget. For a historical observation collected in source round r, let mb,r (e a, c− ) denote the conditional response under that historical source regime, evaluated at the target context and joint action/exposure arguments. This notation presumes that the source response is meaningful on the relevant target support; the assumptions or error bounds needed to justify that transport must be stated separately. Define the target-joint-law average of the source response by Z log − Vz,r (c ) = mb,r (e a, c− )gz,0 (de a | c− ). e A

The source index r is retained because the response mechanism may vary with the deployed configuration and exploration regime. The target-context source-response discrepancy is log − ϵtarget exp,r (z) = W∞ (z; 0) − EC − ∼νz,0 Vz,r (C ) .

If the target response is identified as above and the relevant integrals exist, then Z − ϵtarget (z) = E [m0z (e a, C − ) − mb,r (e a, C − )]gz,0 (de a | C −) C ∼νz,0 exp,r e ZA ≤ EC − ∼νz,0 |m0z (e a, C − ) − mb,r (e a, C − )|gz,0 (de a | C − ).

(31)

(32)

e A

This is a sufficient bound for the response discrepancy under the target context and target joint action/exposure laws. It may be zero under a justified conditional response-invariance assumption, but that invariance does not follow from importance weighting alone. Scope of the main-text exposure/response budget. The quantity in Eq. (31) is only the targetcontext component of the transport argument. In the proof of Theorem 1, the third telescope term also contains the score-level response residual defined in Eq. (62) of Appendix D.3. Therefore the single main-text budget ϵexp (z) must be calibrated to dominate the exposure-representation discrepancy, the historical average of the score-level response residuals, and the historical average of the terms ϵtarget exp,r (z), uniformly over the admissible source regimes and prefixes used by the algorithm. Equivalently, one may directly calibrate a tighter bound on the combined response/exposure contribution in the exact telescope. A bound for Eq. (31) alone is not sufficient unless the score-level residual is separately shown to vanish or is otherwise covered. The component terms are used to define one calibrated envelope ϵexp (z) in the main theorem; they are not added again as separate terms in ϵ̄tot,t (z). This avoids counting the same response-transport contribution twice. If no single envelope has been calibrated for the actual scoring mechanism, the current theorem’s stated error budget is not yet certified for that implementation. Exposure enrichment as a sensitivity diagnostic. Let ϕ denote the baseline exposure mapping and let ϕ+ denote an enriched mapping using additional observed network information. The associated b exp,t (z), can be used to assess sensitivity to the chosen exposure change in the fitted value estimate, ∆ representation. However, a small change between two fitted regressors is not a certified upper bound on exposure approximation error: both regressors may omit the same latent component of L. 25

Accordingly, the exposure/response transport term in Theorem 1 is a valid error allowance only when its calibration covers the relevant representation and source-to-target response discrepancies over the historical windows used by the estimator. The enrichment diagnostic provides supporting sensitivity evidence, not an independent high-probability guarantee. Context -distribution shift and nuisance-training mismatch remain separate terms unless the calibration explicitly covers them. B.10

Context Shift and Cross-Configuration Mismatch

This section distinguishes context-distribution shift in score averaging from context-marginal mismatch in nuisance training. Neither term is a substitute for the joint action/exposure overlap condition or for the source-to-target conditional response discrepancy defined in Appendix B.9. Context-shift discrepancy. Fix a candidate configuration z and a historical source round r, whose deployed configuration and exploration rate are (zr , ηr ). Let νz,0 denote the target pre-action context law and let νzr ,ηr denote the source pre-action context law. Define Z log − Vz,r (c ) = mb,r (e a, c− )gz,0 (de a | c− ), e A

where mb,r is the conditional response under the historical source regime and gz,0 is the target joint action/exposure law. This expression presumes that the source response is meaningful on the relevant target support and that the required integrals exist. The context-shift discrepancy for this source round is log log ϵshift,r (z) = EC − ∼νzr ,ηr Vz,r (C − ) − EC − ∼νz,0 Vz,r (C − ) .

(33)

It compares the same source-response functional under two context laws, so it isolates contextdistribution shift from conditional response transport. Combining this definition with Eq. (31), the triangle inequality gives log W∞ (z; 0) − EC − ∼νzr ,ηr Vz,r (C − ) ≤ ϵtarget exp,r (z) + ϵshift,r (z).

(34)

Distributional calibration of context shift. Let dF be a context-distribution discrepancy, such as a suitably normalized integral probability metric. If a validated calibration map Kh satisfies Eν h(C − ) − Eν ′ h(C − ) ≤ Kh (dF (ν, ν ′ )) log for the relevant function h = Vz,r , then

ϵshift,r (z) ≤ Kh (dF (νzr ,ηr , νz,0 )) .

(35)

The calibration map and its conditions must be justified for the relevant function class. An empirical two-sample statistic alone does not establish this high-probability bound, and an observed context discrepancy does not identify an otherwise unobserved target context law. For the historical data available before round t, define ϵ̄shift,t−1 (z) =

t−1 1 X ϵshift,r (z), t − 1 r=1

(36)

when the same source context law applies to all T0 retained windows within each deployment round. If the relevant conditional laws vary across retained windows, the allowance must instead be averaged over those windows with the same normalization as the historical estimator. The bound used by the certificate must cover the actual historical average, not just a single source round. Cross-configuration nuisance-training context mismatch. The main text assigns past rounds tr weights based on their context-law discrepancy from the target context law. Let νz,t denote the population context marginal of that weighted training sample, and let νz,0 be the target context law. Let Hcfg be the class of bounded context-level conditional score or nuisance-risk functions for which transfer is calibrated, normalized so that |h(c− )| ≤ Bψ . Define ϵ̄cfg,t (z) = sup h∈Hcfg

− tr h(C ) − EC − ∼ν EC − ∼νz,t h(C − ) . z,0

26

(37)

If a validated calibration map Kcfg controls this function class, then
tr ϵ̄cfg,t (z) ≤ Kcfg dF (νz,t , νz,0 ) .

(38)

tr The context-discrepancy weighting in the main text is an operational way to construct νz,t ; the empirical discrepancy itself is not a high-probability calibration unless the relevant function-class bound is justified.

This ϵ̄cfg,t (z) is a context-marginal nuisance- transfer allowance, matching the main-text definition and the finite- state context-audit construction in Appendix C.2. It does not, by itself, bound a mismatch between joint action/exposure input laws or between conditional response functions. Therefore, ϵm,t (z) and ϵπ,t (z) must be calibrated under the actual source-window score measures used in Appendix B.8, or their transfer from the fitting measure must be justified separately. In particular, a raw behavior propensity error alone is not a substitute for a bound on the induced clipped joint-ratio error. Avoiding omissions and double counting. The context-shift term controls the change in expectation of the source-response functional between the source and target context laws. The configuration term controls only the calibrated context-marginal transfer of nuisance-risk functions. The exposure/response budget ϵexp (z) controls the response/exposure contributions specified in Appendix B.9 and the exact proof in Appendix D.3. A source-to-target conditional response discrepancy must not be counted again as a configuration mismatch if it is already included in ϵexp (z). Conversely, an input-law or nuisance error not covered by the direct nuisance bounds cannot be silently omitted just because the context marginals are close. The quantities above are population discrepancies or calibrated upper bounds, not automatic consequences of observed telemetry. Empirical context distances, exposure-enrichment comparisons, and fitted-model diagnostics support sensitivity analysis but do not independently establish the required transport or coverage guarantees. B.11

Configuration-Aware Nuisance Fitting

Fix a candidate configuration z and a predecision round t. The nuisance functions used to evaluate z target the no-exploration causal estimand, although their fitting sample may contain historical observations collected under other source configurations. This section distinguishes target nuisance functions, the weighted training-context law, and the assumptions required to transport historical response information to the target configuration. e = (A, E) the joint Target nuisance functions. Let C − denote the pre-action context and A − action/exposure treatment unit. Write gz,0 (· | c ) for the target joint law under configuration z without measurement exploration. Let mz (e a, c− ) be the target-regime conditional response mean and define Z − µz (c ) = mz (e a, c− )gz,0 (de a | c− ), W∞ (z; 0) = EC − ∼νz,0 [µz (C − )]. e A

The fitted response regression and target joint law induce Z µ bz,r (c− ) = m b z,r (e a, c− )b gz,0,r (de a | c− ). e A

Here the subscript r records the fitting cutoff used for the score stored for round r; the main text suppresses this cutoff inside ψbz,r for readability. The fitted joint law must be a valid probability distribution. For continuous joint treatments, all ratios and integrals use a common dominating measure. Historical training observations and context weighting. Let zr and ηr denote the deployed configuration and exploration rate in historical round r. The scoring record is e (r) = (A e(r) , C −,(r) , R(r) ). O i,s i,s i,s i,s The corresponding behavior joint law is gb,r (e a | c− ) and its fitted version is gbb,r (e a | c− ). 27

As specified in the main text, historical rounds receive fitting weights based on their context-law tr discrepancy from the target context law. Let νz,t denote the population context marginal of the resulting weighted training sample. The full training input law may also differ from the target joint input law µz,0 (dc− , de a) = νz,0 (dc− )gz,0 (de a | c− ). The context weights do not automatically identify or reconstruct the joint action/exposure law. Thus the induced clipped-ratio error and the target-joint-law error must be calibrated separately, under the joint laws used by the actual score. Predictable fitting and scoring. For the concentration arguments, the nuisance predictions used to score network window j must be fixed using information available before that window is scored. Accordingly, ψbz,r denotes the stored score rule for source round r: its target joint-law fit, responseregression fit, and behavior joint-law fit are frozen before the corresponding scoring window(s). Historical scores are not retrospectively recomputed using fits that depend on later observations. If the nuisance rule is updated within a round, the fitting cutoff and stored score must instead be indexed at the window level. This is the predictability condition used in Appendix C.1. Cross-fitting alone does not establish response transport, correct specification, or target-law overlap. Target response versus source response. Let mb,r (e a, c− ) denote the conditional response mean under the historical source regime. The response nuisance for candidate z targets mz (e a, c− ), not − automatically mb,r (e a, c ). When zr ̸= z, fitting a regression to historical responses does not by itself identify the candidatespecific response function. A sufficient special case is conditional response invariance on the relevant support: mb,r (e a, c− ) = mz (e a, c− ). When this equality is not assumed, the source-to-target response discrepancy must be bounded separately. It may be included in the calibrated exposure/response budget ϵexp (z) only if that budget covers the same source regimes, target support, and historical averaging scheme. It must not be silently absorbed into a nuisance-fitting error that measures estimation under the source response law only. Nuisance errors and the meaning of the budgets. The response-nuisance error ϵm,t (z) must control ∥m b z,r − mz ∥L2 (νr ,gb,r ) under the score-law measures, uniformly over the relevant source rounds or through a separately justified historical-average bound. The quantity ϵπ,t (z) must control ∥w bz,r − w̄z,r ∥L2 (νr ,gb,r ) , where w bz,r is the fitted clipped joint ratio and w̄z,r = min{gz,0 /gb,r , wmax } is its clipped oracle counterpart. A bound on the raw fitted behavior propensity alone is not sufficient unless it is shown to imply this induced-ratio bound. The target-joint-law error is first order and is accounted for by ϵ̄target,t (z). The context-shift term ϵ̄shift,t (z) controls score averaging across source and target context laws. The configuration term ϵ̄cfg,t (z) controls only the calibrated context-marginal nuisance transfer described in Appendix B.10; it does not, by itself, control joint-treatment-law mismatch or conditional-response transport. The nuisance-product, target-joint-law, clipping, context, and response terms therefore have distinct roles. A response discrepancy already included in ϵexp (z) must not be counted again as a configuration mismatch. Scope of the fitting guarantees. Configuration-aware fitting is a valid certificate component only when target-law, response-nuisance, induced-ratio, context-transport, and response-transport bounds are independently justified. Fit quality or small observed discrepancies alone do not guarantee target-law accuracy; the result remains conditional on Appendix B.6.

C

Assumptions, Calibration, and Information Growth

C.1

Finite-Sample Conditions for Causal Value Certification

This appendix supplies auditable mathematical sufficient conditions for the sampling component of Theorem 1 and for its use in Theorem 3. Its statements are conditional on the identification, overlap,

28

nuisance, and transport requirements in Appendices B.8–D.3. The target treatment unit is the joint e = (A, E), and the context used for causal scoring is the pre-action context C − . action/exposure A The resulting confidence certificate combines the concentration results below with the independently calibrated target-transport bounds in Appendix B.10. Network-window unit and predictable scoring. Index the available network windows in observation order by j = 1, . . . , n. For candidate configuration z, define N

Yj,z =

1 Xb ei,j ), ψz,j (O N i=1

ei,j = (A ei,j , C − , Ri,j ). O i,j

ei,j is the observed joint action/exposure treatment unit and C − contains only information Here A i,j available strictly before the focal action. The nuisance fits, fitted behavior joint law, and candidate scoring function used at window j are measurable with respect to a pre-window sigma field Fj−1 . A strictly forward, block-separated nuisance-training protocol satisfies this predictable-fit condition and preserves the temporal ordering required by the concentration argument. The within-window dependence among nodes is otherwise unrestricted by the martingale statement below. By the clipped-score range, |Yj,z | ≤ Bψ . The network-window count n, rather than the total number N n of dependent node-level records, is the unit in the following concentration arguments. Lemma 2 (Finite-sample martingale route). Fix a candidate z and assume the predictable-fit condition above. For every α ∈ (0, 1),   r n X 1 2 log(2/α)  ≤ α. [Yj,z − E(Yj,z | Fj−1 )] > 2Bψ (39) P n j=1 n No independence or mixing assumption across windows is needed for this centered martingale statement. It does not control the predictable-mean drift. Proof. The summands are martingale differences bounded in absolute value by 2Bψ . Azuma– Hoeffding and a two-sided union bound give ! x2 2 exp − 8nBψ2 as an upper bound on the probability that the absolute centered sum exceeds x. Setting p x = 2Bψ 2n log(2/α) and dividing by n yields Eq. (39). Calibrating predictable bias and stochastic fluctuation. For each window, condition on Fj−1 and use the conditional behavior and context laws in the exact nuisance and transport decomposition of Appendix B.8. Let ∆pred j,z = E(Yj,z | Fj−1 ) − W∞ (z; 0) denote the total signed predictable-mean discrepancy, distinct from the predictable-window drift term in the second line of Eq. (60). The following is a sufficient pathwise budget requirement on an event G: n

1 X pred ∆ ≤ ϵm,t (z)ϵπ,t (z) + ϵ̄target,t (z) + ϵclip,t (z) + ϵexp (z) + ϵ̄shift,t (z) + ϵ̄cfg,t (z) + κ bt (z). n j=1 j,z (40) For this inequality to hold, each budget on the right-hand side must be calibrated for the relevant joint action/exposure laws, source regimes, and historical-window averaging scheme. In particular, ϵm,t (z) and ϵπ,t (z) must control, respectively, ∥m b z,r − mz ∥L2 (νr ,gb,r ) and ∥w bz,r − w̄z,r ∥L2 (νr ,gb,r ) for the source-window score laws, uniformly over the source rounds in the prefix 29

or through a separately justified bound on the averaged products. The latter is an induced clipped joint-ratio error; a raw behavior-propensity estimation error is sufficient only if a valid inequality transfers it to this ratio norm. The clipping allowance must cover the clipping contributions appearing in the actual proof decomposition, and the target-joint-law term must control the first-order error in the fitted target joint distribution. The main-text exposure/response budget ϵexp (z) must dominate the historical average of both the score-level response residual in Eq. (62) and the target-context response discrepancy in Eq. (31), as well as any exposure-representation error not already included in those quantities. This is a calibration requirement for the actual stored scoring rules and admissible source regimes; the target-context bound in Eq. (31) alone does not establish it. A uniform bound over source regimes and prefixes is sufficient, while a direct bound on the combined contribution in the exact telescope may be tighter. These component bounds are folded into the single ϵexp (z) term and must not be added a second time as separate terms in ϵ̄tot,t (z). The context-shift allowance must apply to the source and target context laws and the source-response functional actually used in the historical average. The configuration-mismatch allowance is the calibrated context-marginal nuisance-transfer term defined in Appendix B.10. It does not, by itself, control joint action/exposure input-law mismatch or conditional response transport. The direct nuisance bounds must therefore be calibrated under the actual score-law measures, or any further transfer must be separately justified. A response discrepancy already included in ϵexp (z) must not be counted again as a configuration-mismatch term. Equation (40) is a sufficient calibration requirement, not a bound inferred from stationarity or an empirical block-drift statistic. It must be justified using the target-law, clipping, nuisance, exposure/response-transport, and context-law conditions in Appendices B.8–D.3. One sufficient route is to bound the window-averaged contributions of each of the four non-statistical terms in Eq. (60). Proposition 2 (Concrete conditional simultaneous certificate). Suppose Z is finite with M = |Z|, and P(G) ≥ 1 − δ/2, where on G Eq. (40) holds simultaneously for every z ∈ Z. Suppose the estimators use n network windows and the predictable-fit condition holds for every candidate. Define comp(Z) = log M and suppose the certified statistical effective information count satisfies 0 < neff,t (z) ≤ n/4,

z ∈ Z.

(41)

Then the bound in Theorem 1, with the same stated 2Bψ statistical coefficient, holds simultaneously for every z ∈ Z with probability at least 1 − δ. Proof. Apply Lemma 2 with α = δ/(2M ) and take a union bound over the M candidates. The resulting sampling failure probability is at most δ/2, and the stochastic radius for each candidate is r 2 log(4M/δ) 2Bψ . n Write L = log M + log(2/δ). Since L ≥ log 2, log(4M/δ) = L + log 2 ≤ 2L. Consequently, r 2Bψ

2 log(4M/δ) ≤ 2Bψ n

s

L ≤ 2Bψ n/4

s

L neff,t (z)

.

The last inequality follows from neff,t (z) ≤ n/4. Intersect this simultaneous sampling event with G and apply Eq. (40). The total failure probability is at most δ. Alternative mixing/block-coupling route. When nuisance scoring is fixed separately from a stationary evaluation stream and a conditional absolute-regularity bound is supplied, independentblock coupling provides an alternative finite-sample certificate. This route requires its own dependence assumptions and does not follow merely from the martingale result above. 30

Lemma 3 (Block-coupled sampling route). Let Y1 , . . . , Yn be a bounded sequence with |Yj | ≤ Bψ , stationary conditional on a separate fitting sigma field, and with absolute-regularity coefficient β(k). Choose integers q, m ≥ 1 such that n = 2mq + r, 0 ≤ r < 2q, and suppose 2mβ(q) ≤ α/2. Then, conditional on the fitting field, with probability at least 1 − α, r n 2 log(8/α) 4Bψ q 1X Yj − EY1 ≤ Bψ + . (42) n j=1 m n In particular, if β(q) ≤ Cβ exp(−q/τ ) with known constants and q is chosen to satisfy the coupling condition, the right-hand side is fully specified. One sufficient choice is q ≥ τ log(4Cβ n/α), provided n ≥ 2q. Proof. Partition the first 2mq observations into 2m successive blocks of length q. Form the m odd-indexed and m even-indexed block averages. Blocks within each parity group are separated by at least q observations. The absolute-regularity coupling bound controls the probability that either group differs from its independent block coupling by at most 2mβ(q) ≤ α/2. Conditional on successful coupling, each parity group consists of m independent block averages bounded in absolute value by Bψ . Hoeffding’s inequality and a union bound over the two groups give the stated stochastic radius with additional failure probability at most α/2. The r omitted observations change the full sample mean relative to the mean of the first 2mq observations by at most 2Bψ r 4Bψ q ≤ . n n Combining these bounds proves Eq. (42). Configuration covers and complete failure accounting. For infinite compact Z, a finite ε-net can be used only if the evaluated estimator and the target value are uniformly LZ -Lipschitz on the relevant confidence event. The lift from net points requires a 2LZ ε additive remainder, which must be included in the stated approximation/error budget. The local 1 − δ conclusion above is for one evaluation time. For the adaptive online algorithm, choose positive δt satisfying T X

δt ≤ δ

t=2

and allocate each δt among sampling, nuisance/transport calibration, and any covering event. A uniform-in-round guarantee does not follow from repeating a fixed-round confidence interval without this allocation. Effective information and drift calibration. The operational shrinkage proxy (20) is diagnostic only. The theorem uses a validated lower-information bound, such as Eq. (41) or a calibrated block-coupling counterpart, and not the proxy by itself. The adjacent-block statistic (21) is similarly usable as a drift allowance only when validated against the predictable-bias condition Eq. (40). These distinct inputs capture complementary features of post-burn-in data: effective information and residual predictable-mean drift. Independent calibration, model-dependent deviation bounds, or conservative deterministic bounds provide sufficient conditions. The slow-mixing family in Appendix D.4 clarifies their role. Limited-overlap local-action calibration example.

Under a correct known local-action mixture

bA = (1 − η)pA + ηξ, the target local-action law can be recovered as pA =

bA − ηξ , 1−η

31

η < 1,

provided the equality defines a valid probability vector. A fitted version obeys ∥b pA − pA ∥1 =

1 b ∥bA − bA ∥1 1−η

when the fitted quantities satisfy the same mixture relation. Thus an independently validated confidence bound on the local-action probabilities yields a corresponding local-action error bound. This inversion does not, by itself, recover the target joint action/exposure law gz,0 from the marginal local-action law. A joint-law reconstruction requires the actual joint action-generation mechanism, including dependencies among contemporaneous actions and the exposure mapping. At η = 1, the mixture inversion does not identify the target local-action law pA . Moreover, even a known target local-action law does not identify the counterfactual context distribution νz,0 from arbitrary exploratory logs. Calibrated joint-treatment, exposure, and context- transport conditions therefore remain separate requirements. C.2

Calibrated Error Budgets and Information Growth

This appendix develops two components of the causal decision guarantee: finite-sample calibration of target-value bias terms and growth of certified information along the selected configuration sequence. Independent audit observations provide explicit upper bounds for the identification and transport budgets; per-visit information conditions then yield the square-root summability used by Theorem 3. The construction gives operational interpretations to the sufficient conditions in Theorems 1 and 3. C.2.1

Target identification and observational equivalence

Proposition 3 (Observational indistinguishability). Without identifying restrictions or independent information about the no-exploration action law, the target-policy bias cannot have a uniformly vanishing, data-dependent high-probability bound based only on exploratory logs. The same conclusion applies to the full target certificate. Proof. Take one context, two actions A ∈ {0, 1}, and deterministic reward R = A. Suppose the only logged regime is η = 1 with known exploration law ξ(1) = 1/2. Consider two admissible target laws p+ (1) = 1 and p− (1) = 0. In both environments the observed law is A ∼ Ber(1/2) and R = A, independently of the target law. Yet the no-exploration values are W+ = 1 and W− = 0. Under the common law of the observed data, any interval I(D) having coverage at least 1 − δ for both targets must contain both 0 and 1 simultaneously with probability at least 1 − 2δ; on that event its width is at least 1. Thus no shrinking uniformly valid target certificate can be deduced from these logs. The construction is also an exact failure case for inversion of the mixture b = (1 − η)p + ηξ at η = 1. No statement here rules out identification when η < 1, the known mixture model is correct, and sufficiently informative observations are available. It rules out treating fitted target policies, enrichedexposure sensitivity, or empirical IPMs as automatically certified upper bounds. A separate context-shift obstruction can persist even for a fixed 0 < η < 1 if no structural relation between the context laws νz,η and νz,0 is assumed: take a logging context C ≡ 0 and reward R ≡ 0 in two systems at that positive exploration rate, but let the unobserved no-exploration regime have C ≡ 1 and deterministic target reward θ ∈ {0, 1}. The two logging laws coincide and the two target values differ by one. This counterexample is deliberately excluded when a verified transport condition links the regimes; its purpose is to show why that condition cannot be inferred from logged outcomes alone. C.2.2

Explicit componentwise calibration under a finite-state audit

We give one constructive, deliberately strong calibration protocol. Let Z, C − , and the joint treatment/exposure space Ae be finite, with cardinalities M , J, and K, respectively. Each e a ∈ Ae is a full joint action/exposure cell, not merely the focal local action. Let Rsrc be the number of source-regime types covered by the audit. Assume |R| ≤ Bu . Work conditionally on the data used to fit gbz,0,r , gbb,r , and m b z,r ; all audit data below are independent of those fitting data. For every candidate z, source regime r, context c− , and joint cell e a, assume audit sampling can identify the target interventional response m0z (e a, c− ) and the source-regime response mb,r (e a, c− ). It also identifies the target joint law 32

gz,0 (· | c− ) and source behavior joint law gb,r (· | c− ). These are substantive identification assumptions; observing an exposure feature alone does not supply them. For the displayed nuisance-error formula, assume that the target response mz used by the score equals the identified audit response m0z on the relevant support. If it does not, the response-nuisance error must still be calibrated against the actual mz , and the representation discrepancy must be separately included in the exposure/response budget. Independent context-only audit samples identify the target context law νz,0 , each source tr context law νzr ,ηr in the audited source set, and the weighted nuisance-training context law νz,t . Assume every audited source joint cell on the target support satisfies gb,r (e a | c− ) ≥ β > 0. All bounds below are uniform over the audited source-regime set; for a pooled estimator, that set must include every source regime used in the corresponding historical prefix. Let nmin ≥ 1 be the minimum independent sample count per audited scalar stratum. With s s log(2D/α) 2 log(2D/α) D = M Rsrc (4JK + 3J), rp = , rm = Bu , (43) 2nmin nmin each audited joint-cell probability or context probability is within rp of its true value and each conditional response mean is within rm , jointly with probability at least 1 − α, by Hoeffding and a union bound over at most D scalar estimates. If audit observations are dependent, these radii must be replaced by independently justified block or dependence-aware bounds. On this audit event, define the computable majorants X
− − eg (z) = max |b g a | c ) − g e a | c )| + r z,0,r (e z,0 (e p , − r,c

e a

eb = max |b gb,r (e a | c− ) − geb,r (e a | c− )| + rp , r,c− ,e a
em (z) = max |m b z,r (e a, c− ) − m e 0z (e a, c− )| + rm , − r,c ,e a

eν (z; v, w) = ∥e νz,v − νez,w ∥1 + 2Jrp .

(44)

Here ge, m, e and νe are independent audit estimates. For context shift across source configurations, also set eshift (z) = max (∥e νzr ,ηr − νez,0 ∥1 + 2Jrp ) , ν r

where the maximum is over the audited source regimes in the prefix. Clip fitted response regressions to [−Bu , Bu ]. If eb ≤ β/2 and πmin ≤ β/2, the fitted denominator is at least β/2, and the clipped-ratio error obeys 2eg (z) 2eb ∥w bz,r − w̄z,r ∥∞ ≤ + 2 =: ew (z), (45) β β where w̄z,r = min{gz,0 /gb,r , wmax }. This follows by adding and subtracting gz,0 /b gb,r , using the lower bounds on the true and fitted denominators, and applying the 1-Lipschitz clipping map. The following bounds then hold simultaneously on the audit event: ϵ̄target (z) = Bu eg (z), ϵ̄mπ (z) = em (z)ew (z),   min{1, gbz,0,r (e a | c− ) + eg (z)} ϵ̄clip (z) = 2Bu max − w , max β r,c− ,e a + ϵ̄shift (z) = Bu eshift (z), ν ϵ̄cfg (z) = Bψ eν (z; tr, 0).

(46)

Here [x]+ = max{x, 0}, and src(r) denotes the context law of source regime r. The clipping bound is conservative because gz,0 /gb,r ≤ (b gz,0 + eg )/β on the audited cells. The shift and configuration bounds use |Eν f −Eν ′ f | ≤ ∥f ∥∞ ∥ν −ν ′ ∥1 for the respective bounded context-level function classes. The configuration term is a context-marginal nuisance-transfer allowance; it does not replace the joint-law or response-nuisance calibrations above.

33

Joint response-transport audit. To cover the exact proof telescope, audit both the target-context response discrepancy and the score-level response residual. Define X etarget (z) = max E gbz,0,r (e a | c− ) m e 0z (e a, c− ) − m e b,r (e a, c− ) , − r,c

e a

X   − − − − 0 − escore (z) = max E g e a | c ) w b a , c ) − g e a | c ) m e a , c ) − m e (e a , c ) . b,r (e z,r (e z,0 (e b,r (e z − r,c

e a

(47)

etarget (z) + 2Bu eg (z) + 2rm . The score-level residual is The target-law discrepancy is bounded by E bounded by escore (z) + 2Bu {wmax Krp + Krp } + 2rm (wmax + 1). Ēscore (z) = E

(48)

Indeed, the audited behavior and target joint probabilities have coordinatewise error at most rp , so the ℓ1 coefficient error in gb,r w b − gz,0 is at most wmax Krp + Krp . The conditional response-difference error is at most 2rm , and the ℓ1 norm of the true coefficient vector is at most wmax + 1. Consequently, a sufficient main-text exposure/response budget for this finite-state audit is etarget (z) + 2Bu eg (z) + 2rm + Ēscore (z). ϵ̄exp (z) = E

(49)

This budget covers both response terms required by Appendix D.3; it is not merely a bound on the target-context response difference. If the exposure representation itself has an additional approximation error not captured by the interventional response audit, that error must also be added to ϵ̄exp (z). The target-response audit requires appropriate interventional identification; comparing two coarsened observational exposure regressors does not produce this bound. When a required audit cell or source regime is unavailable, the corresponding component is uncertified, not zero. Finally, assume the expected bounded score in each evaluation window is at total variation distance at most dj,z from the corresponding reference score law, where dj,z has a known simultaneous upper bound. Then n 2Bψ X κ̄t (z) = dj,z (50) n j=1 is a valid drift allowance. For example, a proved uniform post-burn-in total-variation contraction dj,z ≤ Cmix e−(Tburn +sj )/τ provides explicit dj,z . An adjacent-block empirical difference alone does not imply this contraction or certify its constants. Proposition 4 (Finite-audit value certificate). Suppose all finite-state audit and conditional-response identification assumptions above hold, the predictable network-window scoring condition of Lemma 2 holds, and the target value has the decomposition in Eq. (60). Replace the bias budgets in Theorem 1 by the componentwise upper bounds in Eqs. (46), (49), and (50). Set the audit level to α = δ/2 and allocate the remaining δ/2 to the centered-score event. Then the resulting simultaneous value certificate holds with probability at least 1 − δ for all M configurations at that evaluation time. For an adaptive run, the failure allocation must be repeated with roundwise levels whose sum is at most the global δ. Proof. The audit concentration event and the majorants in Eqs. (45)–(49) control the target joint-law, response nuisance, induced ratio, clipping, context-shift, configuration, and score-level responsetransport contributions simultaneously. The stated total-variation envelope bounds the remaining predictable post-burn-in drift by Eq. (50). Substituting these bounds into the exact telescope in Eq. (60) verifies the pathwise bias condition in Eq. (40). The centered-score concentration result then supplies the sampling part of the certificate. For a full adaptive run, allocate the failure budget across rounds so that the total remains at most δ. Calibration interfaces and implementation. This finite-state construction is deliberately strong: it requires independent audits of the full joint action/exposure cells, source-regime responses, target responses, and context laws. It does not derive a joint propensity from marginal local-action propensities. If these audits or structural restrictions are unavailable, the corresponding error budget is uncertified rather than zero. 34

C.2.3

Selected-configuration information growth

Let Nz (t − 1) count qualifying post-initialization visits to z strictly before decision t. Merely defining an empirical or conservative-looking neff,t−1 (z) does not force it to grow on such visits. Lemma 4 (Per-visit lower information bound). Suppose there are M < ∞ configurations. After at most H initialization decisions, every selected configuration receives a predictable, valid score, and its certified predecision information count satisfies
neff,t−1 (zt ) ≥ λ 1 + Nzt (t − 1) , λ > 0, (51) for each noninitialization decision t. Then for any adaptive sequence of configuration selections, r X MT 1 q . (52) ≤2 λ n (z ) t noninitialization

eff,t−1

t

In particular, when each eligible visit contributes at least s ≥ 1 new nonreused network windows and the martingale information certificate is constructed as neff = n/4, the condition follows with λ = s/4 after providing one certified pilot score per configuration and preserving all subsequent evaluated windows. Proof. For a given configuration,√index its qualifying selections by k = 1, . . . , Nz (T ). By Eq. (51), its kth contribution is at most 1/ λk. Thus Nz (T )

1 2 p √ Nz (T ). ≤√ λk λ k=1 X

P p Summing over configurations and applying Cauchy–Schwarz yields Nz (T ) ≤ z √ p P M z Nz (T ) ≤ M T . This proof permits fully adaptive configuration selection; it does not require a uniform lower bound on the number of times each arm is chosen. Corollary 2 (An explicit conditional regret bound). Under the simultaneous certified-value event of Theorem 1 and the information-growth assumption (51), write LT = comp(Z) + log(2T /δ) and Et (z) = ϵ̄tot,t (z) + κ bt (z). Then r X M T LT +2 RegT ≤ 2Bu H + 8Bψ Et−1 (zt ). (53) λ t noninitialization

√ √ e T ). When M varies, the dependence M cannot be For fixed M and λ, the stochastic term is O( dropped from this counting argument. Proof. Every initial decision loses at most 2Bu . On the joint confidence event, optimism as in Appendix D.5 gives instantaneous regret q at most twice the predecision radius. For every noninitialization decision this is at most 4Bψ LT /neff,t−1 (zt ) + 2Et−1 (zt ). Apply Lemma 4 and add the initialization regret. Proposition 5 (Growth does not follow from OFU alone). Algorithm 1, without a condition ensuring at least one newly usable, certified scoring window per eligible deployment, does not imply Eq. (51) or its summability conclusion. Proof. Consider a configuration repeatedly deployed under a law that never provides the support required to fit its target-policy or response nuisance. Its post-burn-in window count grows, but its number of certifiable evaluation windows may remain zero. More generally, neff,t (z) ≡ 1 is a conservative lower-information number for an increasing amount of independent data, and nothing in the original OFU selection rule rules out retaining that constant certificate.√ If such an arm is e T ). OFU controls repeatedly chosen, the predecision reciprocal-square-root sum is Θ(T ), not O( selection given confidence radii; it does not create valid statistical information by itself.

35

Implementation of information-growth checks. The implementation records scored network windows and predecision information counts. The quantity n/4 serves as a sampling-information proxy; to apply the counting lemma, each eligible visit is checked for positive score production and the certified lower-information condition. This diagnostic connects the observed evaluation stream with the information-growth condition used in the regret analysis. C.3

Identification, Calibration Sources, and Information-Growth Scope

This appendix collects the interpretation of assumptions already used in Theorems 1–3. It is a scope and implementation clarification, not an additional general certification theorem. The finite-state independent-audit construction and the per-visit counting argument already appear in the existing technical appendices; neither should be confused with a guarantee based solely on uncalibrated exploratory telemetry. C.3.1

Why correcting the local-action propensity is insufficient

Fix z and an exploratory regime η > 0. Write bz,η (a | c− ) for the observed conditional law of the focal local action and pz (a | c− ) = πz,0 (a | c− ) for its target marginal law. Under the stated known local-action mixture, bz,η (a | c− ) = (1 − η)pz (a | c− ) + ηξ(a | c− ). When η < 1, ξ is known, and the mixture identity is valid at the conditioned contexts, the marginal action law can be recovered by pz (a | c− ) =

bz,η (a | c− ) − ηξ(a | c− ) . 1−η

Estimation error in bz,η is amplified by 1/(1 − η), and the identity becomes nonidentifying at η = 1. This inversion does not recover the no-exploration steady-state context law νz,0 . More importantly for the main theorem, it does not in general recover the target joint action/exposure law gz,0 (e a | c− ). The latter depends on the actual joint action-generation mechanism, including dependencies among contemporaneous neighboring actions and the exposure mapping. It must be identified or calibrated from that mechanism or from an independent joint-cell audit; it cannot be inferred from the marginal local-action mixture alone. To display the two transport issues in the general notation, let mb,r (e a, c− ) denote the conditional − response under a historical source regime and mz (e a, c ) the target-regime response. Define the joint-action-corrected source value Z joint corrected Vz,r := EC − ∼νzr ,ηr gz,0 (de a | C − )mb,r (e a, C − ). e A

Even if joint-treatment weighting is exact, the source and target responses may differ. For bounded |mb,r |, |mz | ≤ Bu , a useful upper bound is joint corrected Vz,r − W∞ (z; 0) ≤ Bu ∥νzr ,ηr − νz,0 ∥1 Z + EC − ∼νz,0 gz,0 (de a | C − )|mb,r (e a, C − ) − mz (e a, C − )|, e A

(54)

where ∥ · ∥1 denotes the ℓ1 distance between context probability vectors. The first term is context transport, and the second is conditional-response transport. Both require an identifying restriction or an independently supported bound; neither follows from improved marginal action overlap. C.3.2

Data sources and audit cost for Theorem 1

A valid application of the general certificate must supply joint, predecision error bounds, rather than substitute an empirical proxy for a high-probability upper bound. Examples of sufficient sources are:

36

Certificate component

Sufficient source or restriction

Target joint-treatment law gz,0

Independent joint action/exposure-cell audit, or a verified joint action-generation model. A marginal local-action mixture is sufficient only when the induced jointlaw identity is separately proved. Target-regime context audit, or a proven structural transport bound. Exploratory propensity overlap alone is insufficient. Identified interventional audit of the target response, or an explicit regimeinvariance/exposure-sufficiency assumption with a certified approximation allowance. Joint-support bounds and fitted-model validation on independent or appropriately buffered evaluation data, including a bound on the induced clipped joint-ratio error. Predictable-score martingale conditions, independently validated mixing or blockcoupling constants, and a justified drift envelope; an empirical autocorrelation is not by itself a certificate.

No-exploration context νz,0 Target-regime conditional response mz (e a, c− ) Clipping and nuisance error Network dependence and drift

The finite-state audit constructions provide examples of these sources under strong sampling and identification assumptions. When a required joint-treatment audit cell or structural restriction is unavailable, the corresponding budget is uncertified, not zero; Theorem 1 then does not supply an operational finite-sample coverage claim. Any operator-collected pilot or audit windows used to learn νz,0 or the target-regime response must be counted in the operational measurement budget. For audit deployments A, one can record separately their measurement-induced loss and any configuration-selection loss as X Daudit = {W∞ (zr ; 0) − W∞ (zr ; ηr )}, (55) r∈A

Raudit =

X

{W∞ (z ⋆ ; 0) − W∞ (zr ; 0)}.

(56)

r∈A

These expressions are accounting definitions, not additional lower bounds. If independent targetregime audits are supplied externally, their data-collection cost must instead be disclosed separately. In the paper’s restricted matched-reward construction, such target-regime audits are not required because the relevant target value has a known identifiable form. C.3.3

Anytime validity and a concrete sufficient growth condition

P For a finite evaluation horizon, allocate failure probabilities δt > 0 such that t δt ≤ δ and divide each δt across the centered-score event, calibration, coupling, and drift conditions actually invoked. A fixed-round certificate at level 1 − δ cannot simply be reused without adjustment after data-dependent online selection. For the finite candidate set, write Nz (t − 1) for the number of qualifying past deployments of configuration z. One sufficient condition, already established through the counting argument in the existing information-growth appendix, is that outside at most H initialization rounds there exists a fixed λ > 0 such that neff,t−1 (zt ) ≥ λ{1 + Nzt (t − 1)} for each eligible t. (57) Then a pathwise counting argument gives r X 1 |Z|T q ≤2 . λ neff,t−1 (zt ) t eligible Combined with a valid simultaneous confidence event and certified bias budgets et−1 (zt ), the standard OFU argument yields a conditional bound of the form ! r X |Z|T [comp(Z) + log(T /δ)] RegT ≤ 2Bu H + O Bψ +2 et−1 (zt ). λ t eligible

This repeats the logical implication already present in the information-growth appendix. OFU does not imply (57): it must be supported by certified scoring-window production, overlap, and the dependence model. A measurement schedule can enforce overlap only when its action and context-support assumptions have been verified. Without such a route, regret convergence remains a conditional guarantee. 37

Relation to the identification–deployment lower bound. Theorem 2 is a minimax lower-bound construction with potentially horizon-dependent mixing time, whereas Theorem 3 is an upper-bound implication under calibration and selected-information growth. Their assumptions and loss criteria do not currently supply a matched Pareto lower/upper bound on one common model class. Such a matching result would require additional algorithmic and theoretical analysis; it is not claimed here.

D

Full Proofs and Decision-Theoretic Guarantees

D.1

Fixed-Configuration Concentration

Fix a candidate configuration z and an evaluation round t. Use the network-window score sequence Yj,z and count Jt = T0 t defined in Appendix B.4. Each Yj,z is the within-window average of the node-level clipped DR scores, so |Yj,z | ≤ Bψ without assuming independence among nodes in the same window. The stored score rule is predictable with respect to the pre-window filtration Fj−1 . Define the predictable-score average J

Ȳtpred (z) =

t 1 X E[Yj,z | Fj−1 ]. Jt j=1

The martingale-difference route gives, for every α ∈ (0, 1),   s ct (z; 0) − Ȳtpred (z) > 2Bψ 2 log(2/α)  ≤ α. P W Jt

(58)

No independence or mixing assumption across network windows is needed for this centered martingale statement. It does not, however, bound the predictable-mean discrepancy |Ȳtpred (z) − W∞ (z; 0)|. That discrepancy is controlled separately by the calibrated identification, nuisance, transport, and drift budgets in Appendices D.3 and C.1. For compatibility with the main-text radius, suppose the certified information count satisfies 0 < neff,t (z) ≤ Jt /4. Then Eq. (58) implies the conservative bound s P

ct (z; 0) − Ȳtpred (z) W

> 2Bψ

log(2/α) neff,t (z)

! ≤ α.

(59)

The inequality follows because neff,t (z) ≤ Jt /4 makes the displayed radius at least as large as the Azuma–Hoeffding radius. A valid bound on the predictable-mean discrepancy must then be added to obtain a value certificate. The operational ESS shrinkage proxy in Appendix B.4 is diagnostic only; it cannot replace the certified lower-information count. An alternative block-coupling route is available when the score sequence is stationary conditional on a separate fitting field and a valid absolute-regularity envelope is supplied. In that case, use the explicit block-coupled inequality in Lemma 3 of Appendix C.1. A block-coupling radius is not implied by an empirical autocorrelation estimate alone. D.2

Uniformization over the Configuration Space

Let Cε be a finite ε-cover of the configuration space Z, with cardinality N (ε, Z). At every net point, apply the fixed-configuration certificate with failure probability δ/N (ε, Z), allocating that probability among the centered-score and calibration events actually used. A union bound gives a simultaneous event on which s ( ) log(2N (ε, Z)/δ) ct (z ′ ; 0) − W∞ (z ′ ; 0)| ≤ max 2Bψ max |W + ϵ̄tot,t (z ′ ) + κ bt (z ′ ) , z ′ ∈Cε z ′ ∈Cε neff,t (z ′ ) provided the componentwise calibration conditions of Theorem 1 hold at all net points. 38

ct (·; 0) and W∞ (·; 0) are uniformly LZ -Lipschitz on the relevant confidence event, every If both W z ∈ Z has a net point z ′ with d(z, z ′ ) ≤ ε, and ct (z; 0) − W∞ (z; 0)| ≤ |W ct (z ′ ; 0) − W∞ (z ′ ; 0)| + 2LZ ε. |W Thus the cover adds the explicit remainder 2LZ ε, which must be included in the approximation/error budget. Neither the union bound nor a finite cover establishes the Lipschitz condition or the identification and transport budgets. For this argument, comp(Z) may be taken as log N (ε, Z), with the covering remainder reported separately. D.3

Proof of Theorem 1: Conditional Certificate

Fix a predecision round t ≥ 2 and a candidate configuration z. Flatten the historical post-burn-in network windows available before round t into a time-ordered sequence j = 1, . . . , Jt−1 , where Jt−1 = (t − 1)T0 . Let (r(j), s(j)) denote the deployment round and within-round window corresponding to index j, and write
ei,j = A ei,j , C − , Ri,j , ei,j = (Ai,j , Ei,j ). O A i,j − ei,j denotes the Here Ci,j contains only information available strictly before the focal action, while A observed joint action/exposure treatment unit. Let Fj−1 denote the information available before scoring window j. The nuisance predictions, fitted behavior joint law, and scoring rule used for that window are Fj−1 -measurable. This predictable, prequential convention is required for the filtration-based concentration argument below. Define the network-window score N 1 Xb ei,j ), ψj,z (O Yj,z = N i=1

ct−1 (z; 0) = W

1

Jt−1

X

Jt−1 j=1

Yj,z .

The score ψbj,z is the stored prequential score rule for this window. The target-law and response fits used inside it are frozen before the window is scored, and the behavior joint law is the fit for source round r(j). The fitting-cutoff indices are suppressed inside the main-text notation ψbz,r . This is exactly the main-text normalization: ct−1 (z; 0) = W

T0 X N t−1 X X 1 e (r) ). ψbz,r (O i,s N T0 (t − 1) r=1 s=1 i=1

Thus Jt−1 counts network windows, whereas N Jt−1 counts node-level records. The concentration argument treats the aggregated network-window scores as its time-ordered units and does not assume independence among nodes within a window. eval Reference laws and transported responses. For each historical window j, let Pz,j denote the corresponding post-burn-in reference evaluation law for the stored score of candidate z. Its source context marginal is νzr(j) ,ηr(j) , and its conditional joint action/exposure law is denoted by gb,r(j) (· | C − ). Expectations under this law hold the fitted scoring rule fixed. The difference between the actual conditional score mean and this reference-law mean is handled separately as predictable-window drift.

Let mb,r(j) (e a, c− ) be the source-regime conditional response mean, and define Z log − Vj,z (c ) = mb,r(j) (e a, c− )gz,0 (de a | c− ), e A

where gz,0 is the target joint action/exposure law without measurement exploration. This definition presumes that the source response is meaningful on the relevant target support and that the corresponding transport conditions are satisfied. The deviation admits the following exact decomposition: ct−1 (z; 0) − W∞ (z; 0) = W

1

Jt−1

X

Jt−1 j=1

[Yj,z − E[Yj,z | Fj−1 ]]

39

+

+

+

+

1

Jt−1 h

X

Jt−1 j=1 1

Jt−1 h

X

Jt−1 j=1 1

Jt−1 h

X

Jt−1 j=1 1

Jt−1 h

X

Jt−1 j=1

b E[Yj,z | Fj−1 ] − EPz,j eval ψj,z

i

i log − b (C ) EPz,j eval ψj,z − EP eval V j,z z,j log log − − EPz,j eval V j,z (C ) − EC − ∼νz,0 Vj,z (C )

i log (C − ) − W∞ (z; 0) . EC − ∼νz,0 Vj,z

i

(60)

First term: stochastic fluctuation. The first term is the centered fluctuation of the historical network-window scores. It is controlled by the validated conditional concentration inequality under the dependence assumptions of Appendix D.1, using the effective sample size calibrated for the sequence {Yj,z }. The bound must apply to the actual predictably fitted score sequence; empirical autocorrelation alone does not establish the required concentration event. Second term: predictable-window drift. The second term accounts for discrepancies between the conditional score means and their reference evaluation-law counterparts. Define the signed predictable discrepancy b dj,z = E[Yj,z | Fj−1 ] − EPz,j eval ψj,z . Its contribution must be bounded by the independently justified drift allowance. In particular, the required pathwise calibration is 1

Jt−1

X

Jt−1 j=1

dj,z ≤ κ bt−1 (z)

on the stated calibration event. An empirical inter-block mean difference is a diagnostic unless its relation to this predictable discrepancy has been validated. Third term: nuisance error and score-level response transport. For a given source round r = r(j), write pz (e a | c− ) = gz,0 (e a | c− ), br (e a | c− ) = gb,r (e a | c− ), and let ∆b,r,z (e a, c− ) = mb,r (e a, c− ) − mz (e a, c− ). For the stored score in source round r, write pbz,r = gbz,0,r and m b z,r for the fitted target joint law and response regression; the main text suppresses these fitting-cutoff indices. Let wz,r = pz /br be the oracle joint ratio, w bz,r the fitted clipped joint ratio, and w̄z,r = min{wz,r , wmax } the clipped oracle ratio. Ratios are interpreted relative to a common dominating measure. Under the exact nuisance decomposition in Appendix B.8, the third term has the following conditional algebra. Let νj = νzr(j) ,ηr(j) , pz = gz,0 , br(j) = gb,r(j) , δm,j = m b z,r(j) − mz , δw,j = w bz,r(j) − w̄z,r(j) , and ∆b,r(j),z = mb,r(j) − mz . With expectations taken under the source-window reference law and fitted quantities held fixed, log − b EPz,j eval ψj,z − EP eval V j,z (C ) z,j "Z = EC − ∼νj (b pz,r(j) − pz )(e a | C − )m b z,r(j) (e a, C − ) de a e A

Z +

(pz − br(j) w̄z,r(j) )(e a | C − )δm,j (e a, C − ) de a

e A

Z −

br(j) (e a | C − )δw,j (e a, C − )δm,j (e a, C − ) de a

e A

40

Z + e A

#   − − br(j) w bz,r(j) − pz (e a | C )∆b,r(j),z (e a, C ) de a .

(61)

For discrete joint treatments, the integrals are sums. The first three terms are bounded by the targetjoint-law, clipping, and nuisance-product budgets. The last term is the score-level response-transport residual Z   ϵscore−resp,j (z) = EC − ∼νj br(j) (e a | C − )w bz,r(j) (e a, C − ) − pz (e a | C − ) ∆b,r(j),z (e a, C − ) de a . e A

(62)

This term is distinct from the target-context response discrepancy ϵtarget exp,r(j) (z) in Appendix B.9: the former is evaluated under the source context law and uses the fitted clipped ratio, whereas the latter is evaluated under the target context law and the target joint law. If |∆b,r,z | ≤ 2Bu , a conservative bound is ϵscore−resp,j (z) ≤ 2Bu ∥w bz,r(j) − w̄z,r(j) ∥L1 (νj ,br(j) ) + ϵclip,j (z), (63) where ϵclip,j (z) = 2Bu EC − ∼νj EA∼b e r(j) (·|C − ) [(wz,r(j) − wmax )+ ]. This follows from pz − br(j) w̄z,r(j) = br(j) (wz,r(j) − wmax )+ and does not assume that correcting the joint treatment law eliminates response transport. Accordingly, the third term is bounded by the calibrated target-joint-law, clipping, and nuisanceproduct errors, plus ϵscore−resp,j (z) and any nuisance-distribution transfer allowance required to move the nuisance bounds to the reference evaluation law. The response discrepancy vanishes only under the relevant conditional response-invariance condition or an equivalent justified transport guarantee. Correcting the joint action/exposure distribution alone does not establish that condition. Fourth term: context shift. The fourth term compares expectations of the same source-response functional under the source context law and the target context law. It is controlled by the calibrated context-shift allowance in Appendix B.10. The calibration must apply to the relevant source round and historical averaging scheme; a context-distribution discrepancy without a justified function-class bound does not establish the required expectation bound. Fifth term: target-law response transport. The fifth term is controlled by the target-law exposure/response discrepancy in Appendix B.9. In particular, log (C − ) − W∞ (z; 0) ≤ ϵtarget EC − ∼νz,0 Vj,z exp,r(j) (z)

when the target value and source-response functional satisfy the definitions and identification conditions in that appendix. The score-level discrepancy in Eq. (62) and the target-law discrepancy above are distinct contributions in this particular telescope. The single main-text budget ϵexp (z) must be calibrated to dominate their historical average, as well as any exposure-representation error: 1

Jt−1 h

X

Jt−1 j=1

i ϵscore−resp,j (z) + ϵtarget (z) . exp,r(j)

Alternatively, an independently justified tighter bound on the combined contribution may be used. If the existing ϵexp (z) calibration controls only the target-law discrepancy, it must be extended to cover the score-level term as well. The component bounds are folded into the single ϵexp (z) allowance; they are not then added again as separate response terms. The clipping allowance must also cover every clipping contribution actually retained in the exact nuisance decomposition. This is a clarification of the existing error budget, not a change to the main theorem’s core expression. Combining the bounds. Combining the stochastic fluctuation bound with the predictable-drift, nuisance, context-shift, and exposure/response-transport bounds yields the deviation inequality in Theorem 1, provided that the averaged non-statistical contributions are bounded by ϵ̄tot,t−1 (z) and the predictable drift is bounded by κ bt−1 (z) under the stated calibration. 41

The target-joint-law, clipping, and nuisance-product contributions must be calibrated for the actual source rounds and reference laws used in the estimator. The configuration-mismatch allowance is included only when needed to transfer nuisance guarantees across training and evaluation distributions; a response discrepancy already covered by the exposure/response budget must not be counted again. All component bounds must apply to the corresponding historical windows and their averaged contributions. A bound for a single evaluation round does not by itself bound the historical average. A simultaneous guarantee over configurations requires a valid union or covering event, with the allocated failure probabilities included in the overall confidence budget. For a continuous configuration space, the covering argument must additionally account for an explicit Lipschitz covering remainder in the approximation/error budget; it does not follow from the union bound alone. Empirical autocorrelation estimates and empirical inter-block mean differences are diagnostics only. They do not independently establish the required high-probability concentration, drift, identification, or transport events. The certificate therefore holds only when each component bound and the corresponding dependence and calibration conditions are justified. D.4

Identification–Deployment Frontier: A Slow-Mixing Steady-State Hard Family

We construct a two-configuration, two-action, two-node steady-state family in which the parameter changes the no-exploration configuration value itself, normal deployment of either configuration PT is permitted, and the full adaptively collected log has information of order only 1 + t=1 ηt . The crucial mechanism is that ordinary deployment can repeatedly reveal the same latent state, whereas measurement exploration can refresh that state. This construction is valid as a horizon-indexed hard family when the model class does not impose a horizon-uniform bound on the mixing time. The latter qualification is mathematically essential and is discussed below. Instance and steady-state target. Fix a horizon T ≥ 1 and a predetermined exploration schedule PT η1 , . . . , ηT ∈ [0, 1], and set ET = t=1 ηt . Let θ ∈ {−1, +1} index the two environments, and define 1 qθ = 12 + θ∆, ∆= √ , εT = T −2 . 32 1 + ET There are two configurations Z = {z0 , z1 }, two actions A = {a0 , a1 }, and two network nodes sharing a latent state Ut ∈ {0, 1}. The graph contains an edge between the nodes; the exposure of either node may be taken to be the realized action of its neighbor. This exposure and the static observed context are functions of the logged actions and do not reveal additional latent randomness. The latent state starts in its stationary law U0 ∼ Ber(qθ ). We take one post-burn-in observation window per slow round (T0 = 1). Any prescribed fixed number of burn-in steps can be inserted as identity updates before this window: the controller is already in stationarity, and these steps reveal no extra observations. This is a legitimate (trivial) burn-in subcase of the black-box adaptation model. Under either configuration, the no-exploration controller always chooses a0 . At slow round t, each node independently selects a1 with probability ηt /2 and a0 otherwise. Thus its action law is exactly obs πz,η = (1 − ηt )δa0 + ηt ξ, ξ(a0 ) = ξ(a1 ) = 21 > 0, t independently of which configuration zt was adaptively selected. Draw an unobserved spontaneous refresh marker Bt ∼ Ber(εT ) independently of all prior randomness. Define Jt = 1{Bt = 1 or A1,t = a1 or A2,t = a1 }. If Jt = 1, refresh Ut as an independent Ber(qθ ) draw; otherwise set Ut = Ut−1 . The observed normalized per-node reward is Ri,t = gzt (Ut ) − 14 1{Ai,t = a1 }, gz0 (u) = 21 , gz1 (u) = u. In particular, |Ri,t | ≤ 1 and the observed logs contain the realized configuration, actions, graph/exposure context, and these rewards. The latent-state transition is not supplied to the operator. Each node’s exploratory action can refresh a shared state, and therefore affects future rewards of both nodes.

For any fixed configuration and fixed η, the hidden-state chain is aperiodic and has the unique stationary distribution Ber(qθ ), since a spontaneous refresh occurs with positive probability εT . A refresh draws from this same law, so the stationary distribution does not change with η. Writing network utility as the average of the two node rewards, the no-exploration target values are exactly θ W∞ (z0 ; 0) = 12 ,

θ W∞ (z1 ; 0) = 12 + θ∆.

42

(64)

The better configuration therefore depends on θ, and the target value separation at z1 is 2∆. This separation concerns the paper’s actual W∞ (z; 0), not the reward of an action absent from the noexploration target. KL bound for every adaptive configuration-selection rule. Let PθT be the complete observed history under environment θ, including any randomized configuration decisions. It suffices, by data processing, to upper-bound the KL of a more informative augmented experiment exposing U0 and every action, spontaneous refresh marker, and refreshed latent draw. Conditional on any augmented history, the algorithm’s configuration-selection kernel is the same function under the two environments, the action and spontaneous-marker kernels are identical, and only a newly sampled Ber(qθ ) state contributes a likelihood difference. The chain rule hence gives   T X
T T DKL (P+ ∥P− ) ≤ d(∆) 1 + E+ [Jt ] , d(∆) = kl Ber( 12 + ∆), Ber( 21 − ∆) . (65) t=1

Here

P(Jt = 1) = 1 − (1 − εT )(1 − ηt /2)2 ≤ εT + ηt

1/2+∆ by the union bound. For 0 < ∆ ≤ 1/32, d(∆) = 2∆ log 1/2−∆ ≤ 16∆2 . Because T εT = 1/T ≤ 1, 1 DKL (P+T ∥P−T ) ≤ 16∆2 (2 + ET ) ≤ 32∆2 (1 + ET ) ≤ 32 .

This upper bound accounts for all ordinary deployment observations, including repeated deployments of z1 with ηt = 0; they are potentially numerous but mostly repeat the same hidden Bernoulli state. p Value-identification lower bound. By Pinsker’s inequality, TV(P+T , P−T ) ≤ (1/32)/2 = 1/8. c of W∞ (z1 ; 0), choose the sign corresponding to the closer target value in Eq. (64). For any estimate W θ c − W∞ A sign error forces |W (z1 ; 0)| ≥ ∆. The two-point testing inequality therefore yields inf

max

c θ∈{−1,+1} W

∆ 1 − TV(P+T , P−T ) 2 1 7∆ √ ≥ ≥ . 16 100 1 + ET

c − W θ (z1 ; 0)| ≥ Eθ |W ∞

(66) (67)

The infimum includes estimators using all logs and all adaptive configuration deployments. Thus the original cumulative-exploration rate holds for this horizon-indexed family. Deployment loss on the same instance. For every fixed configuration z and exploration level η, the stationary latent distribution is unchanged. Each node selects a1 with probability η/2 and pays utility cost 1/4 on that action. Therefore θ θ W∞ (z; 0) − W∞ (z; η) = η/8.

For arbitrary adaptive configuration decisions and the fixed schedule, DeploymentGapT =

T T X  θ  1X θ W∞ (zt ; 0) − W∞ (zt ; ηt ) = ηt . 8 t=1 t=1

(68)

Consequently the two original-rate lower bounds hold simultaneously on one constructed family with universal constants c1 = 1/100 and c2 = 1/8. Essential mixing-time qualification. Under η = 0 the latent transition kernel is Kθ (u, ·) = (1 − εT )δu + εT Ber(qθ ). It is geometrically mixing for every fixed horizon T , with a decay factor (1−εT )k , but its mixing time is of order T 2 . The horizon-dependent mixing time is an explicit feature of the minimax class in Theorem 2: each fixed-T process mixes geometrically, with mixing times of order T 2 across the family. The bound therefore characterizes the stated predetermined exploration schedule and the associated horizon-dependent class. A horizon-uniform mixing restriction or an adaptively chosen measurement schedule defines a different lower-bound problem, with its own information budget and mixing assumptions.

43

D.5

CAUSAL-UCB Regret Proof

ft (z) = W c1:t−1 (z; 0) and let bt (z) be the corresponding radius computed For each round t ≥ 2, put W from the same past information, as specified in Algorithm 1. Let E denote the simultaneously valid ft (z) − W∞ (z; 0)| ≤ bt (z) for every candidate and calibration/concentration event on which |W round. The event requires valid failure-probability allocation across rounds, configurations, and all calibration subevents in Appendix C.1. ft (z) + bt (z)} gives On E, the optimism step zt ∈ arg maxz {W ft (z ⋆ ) + bt (z ⋆ ) W∞ (z ⋆ ; 0) ≤ W ft (zt ) + bt (zt ), ≤W

(69) (70)

and therefore ft (zt ) + bt (zt ) − W∞ (zt ; 0) ≤ 2bt (zt ). W∞ (z ⋆ ; 0) − W∞ (zt ; 0) ≤ W For the first, uninitialized deployment t = 1, bounded rewards give a constant regret contribution (at most 2Bu ); the algorithm may use an arbitrary fixed tie-breaking rule when all initial radii are infinite. With s comp(Z) + log(2T /δ) + ϵ̄tot,t−1 (z) + κ bt−1 (z), bt (z) = 2Bψ neff,t−1 (z) valid for t ≥ 2, summing produces RegT ≤ 2Bu + 2

T X

bt (zt ).

t=2

p e ψ T comp(Z)) stochastic term requires the selected-arm, preThe simplification to the stated O(B √ PT e T ). It does not follow from optimism deployment summability bound t=2 neff,t−1 (zt )−1/2 = O( alone and need not hold under insufficient exploration. The additive deterministic terms then produce the conditional form in Theorem 3 (up to the harmless one-step index shift). D.6

Deployment-Gap Corollary

If W∞ (z; η) is LW -Lipschitz in η uniformly over z, then W∞ (zt ; 0) − W∞ (zt ; ηt ) ≤ |W∞ (zt ; 0) − W∞ (zt ; ηt )| ≤ LW ηt . Summing gives T X

{W∞ (zt ; 0) − W∞ (zt ; ηt )} ≤ LW

t=1

T X

ηt .

t=1

This is separate from target regret: regret evaluates no-exploration configuration quality, while deployment gap evaluates the cost of collecting identifiable logs. D.7

Proofs for the Restricted Local-Interference Certificate

This appendix proves Proposition 1 and Corollary 1. The claims are restricted to the specified homogeneous local-interference model; they do not assert that unknown target context laws or dependent black-box controllers can be certified from exploratory logs alone. D.7.1

A simultaneous event for matched rewards

For each z ∈ Z, expose the matched rewards in their order of observation, breaking ties within one network window by a fixed node order. Denote this sequence by Gz,1 , Gz,2 , . . .. The assumptions in the restricted model allow us to couple these observations to an independent, pre-generated sequence of draws distributed as clip(µz + σZ, 0, 1). Adaptive selection of z only reveals a prefix of this sequence; the matched-reward distribution is unaffected by past configuration choices or by the indicator array. 44

The clipping map x 7→ clip(x, 0, 1) is 1-Lipschitz. By Gaussian concentration, every matched reward is σ-sub-Gaussian around its mean Wz (the same statement holds when σ is a conservative sub-Gaussian scale bound). For every fixed m ≥ 1, r ! m 2K(M + 1) 1 X 2L ≤ 2e−L , L = log Pr Gz,ℓ − Wz > σ . (71) m m δ ℓ=1

Here M = N T T0 is an upper bound on the total number of node-window reward slots in the entire experiment, and K = |Z|. All means of observations in [0, 1] differ by at most 1, so the radius may be truncated at 1. A union bound over the K candidates and all nonempty prefix lengths 1 ≤ m ≤ M shows that the event ( ) M m \ \ 1 X Ematch = (72) Gz,ℓ − Wz ≤ ϵ(m) m m=1 z∈Z

ℓ=1

has probability at least 1 − δ, because 2KM e−L ≤ δ. The event is defined on pre-generated streams and therefore also holds at all adaptively selected stopping and examination times. No sample splitting across examination times is required. At matched count m = 0, the prescribed predictor is 1/2, so |1/2 − Wz | ≤ 1/2 = ϵ(0) deterministically. D.7.2

Proof of Proposition 1

Proof. Fix any configuration z and any nonempty prefix of n network windows collected at its selected deployments. Put ej− = m b j− (z) − Wz and hj = Kj /(N q). For every scored window, an exact algebraic rearrangement gives N

Yj,z − Wz = (1 − hj )ej− +

1 X Ij,i (Rj,i − Wz ). N q i=1

(73)

Summing over windows and taking absolute values yields n

cz,n − Wz | ≤ |W

1X mn Gz,mn − Wz , |1 − hj | |ej− | + n j=1 nN q

(74)

where the second term is interpreted as zero when mn = 0. Because the nuisance mean is computed from matched rewards strictly before the deployment round being scored, it is either the constant 1/2 or the mean of a prefix of length mj− of the same pre-generated matched-reward stream. On Ematch , for every scored window, simultaneously, |ej− | ≤ ϵ(mj− ),

|Gz,mn − Wz | ≤ ϵ(mn )

when mn ≥ 1.

Substitution into (74) gives n

cz,n − Wz | ≤ |W

1X mn |1 − hj |ϵ(mj− ) + ϵ(mn ) = bz,n . n j=1 nN q

Since Wz ∈ [0, 1], Euclidean projection onto [0, 1] cannot increase the distance to Wz , and therefore fz,n − Wz | ≤ bz,n . The reasoning holds for every z and every prefix on the single event (72). For |W an unvisited configuration, |1/2 − Wz | ≤ 1/2 supplies the stated trivial interval. Finally, m b j− , Kj , mj− , mn , q, and ϵ(·) are functions only of past observed actions, matched rewards, and pre-specified constants. When used at decision round t, the interval is computed from deployments completed strictly before round t; it is thus a predecision certificate, not a post-hoc interval. D.7.3

Proof of Corollary 1

fz,t−1 , bz,t−1 for the Proof. Work on the simultaneous event of Proposition 1. Write cz,t−1 = W radius available immediately before decision t, and Uz,t−1 = min{1, cz,t−1 +bz,t−1 }. The certificate and Wz ∈ [0, 1] imply Uz,t−1 ≥ Wz for every z. Hence, for every noninitialization choice zt ∈ arg maxz Uz,t−1 , Wz⋆ − Wzt ≤ Uz⋆ ,t−1 − Wzt ≤ Uzt ,t−1 − Wzt 45

≤ czt ,t−1 + bzt ,t−1 − Wzt ≤ 2bzt ,t−1 . If upper bounds are used without clipping at 1, the same argument applies with Uz,t−1 = cz,t−1 + bz,t−1 . Every initialization round has regret at most 1 because Wz ∈ [0, 1]. Adding at most H such rounds proves T X RegT ≤ H + 2 bzt ,t−1 . t=H+1

Scope of the result. The confidence event above uses known q, independent matched rewards, and a common target-law matched-reward mean. It does not require an independent target-context audit within this restricted model. In contrast, the general Theorem 1 requires separately valid target-action, context-transport, exposure, and dependence budgets. In particular, this restricted model does not establish matching optimal regret–inference or identification–deployment bounds for the general slow-mixing class of Theorem 2.

E

Algorithms and Operational Diagnostics

E.1

Diagnostic Algorithms

Algorithm 2 Runtime diagnostics and certificate validation for candidate configuration z Require: Post-burn-in score windows; a dependence-calibration procedure; target-law reference data or independent audit bounds; and the identification, exposure, transport, and drift bounds required by Theorem 1. bz (Or ) on post-burn-in windows. 1: Compute clipped scores Yr (z) = ψ 2: Estimate autocorrelations ρ bℓ,t (z) up to lag Lt . 3: Compute the plug-in effective sample size n beff,t (z) using Eq. (19). 4: Compute the operational shrinkage proxy n eeff,t (z) using Eq. (20); obtain neff,t (z) only from a validated lower-information calibration. 5: Partition windows into adjacent blocks and compute block means ψ̄g,t (z). 6: Compute the empirical excess block-drift diagnostic κ bt (z) using Eq. (21); validate it as an upper bound on residual mean drift before using it in the radius. 7: Estimate context discrepancies only against an independently calibrated target-law reference, when such a reference is available. b exp,t (z) and the cross-configuration discrepancy 8: Compute the exposure-enrichment sensitivity ∆ diagnostics. 9: Obtain calibrated upper bounds for target-action error, nuisance-product error, clipping, exposure, context transport, and configuration mismatch. Empirical discrepancies alone are not certified upper bounds. 10: if all components required by Theorem 1 are certified then 11: Assemble the confidence radius bt (z) from the certified quantities. 12: else 13: Mark the candidate’s radius as uncertified. Trigger the applicable refitting or independent-calibration procedure; do not report theorem14: backed coverage until the missing condition is established. 15: end if E.2

Conceptual schematics

The schematic contrasts raw-reward and certified causal-value selection; it is not an empirical result.

46

Optimism over Causal Value Certificates CAUSAL-UCB choice zt

Value / normalized utility

Raw-reward peak

0.8

0.6

0.4

0.2

c 0) Causal estimate W(z;

Raw logged reward (exploratory)

0.0

0.2

0.4

0.6

Configuration z

c 0) + b(z) Illustrative UCB W(z;

0.8

1.0

Figure 8: Conceptual comparison of raw-reward and certified causal-value maximizers.

F

Experimental Protocol, Data Provenance, and Metrics

F.1

Code and Evaluation Protocol

Exact source and commands. The main controlled evaluation scripts are located in experiments/dependencies/certified_replication in the accompanying code archive. Install dependencies from requirements.txt, then execute the following commands from that directory: python -m unittest discover -s tests -v OPENBLAS_NUM_THREADS=1 python fast_compare.py --out results_final \ --seeds 24 --T 200 --scenarios high_mismatch,low_mismatch python audit_and_figures.py The archive includes individual method–seed measurements, certified decision-round logs, seedpairing metadata, protocol JSON, and a SHA-256 manifest. To reproduce the main tables and figures, run the commands above without modifying the declared protocol, reference files, or seed list. Separation of three statistical objects. For a deployed configuration zt , target regret is computed with the oracle no-exploration target; deployment cost is the expected reward difference under the fixed exploration rate; uncertainty width is the worst-pair contrast diameter built from the valid predecision intervals. The evaluator never uses oracle values for nuisance fitting or selecting an action. The reported decision certificate uses the predecision radius throughout the evaluation. Statistical setting. The local-interference certificate uses known exposure neighborhoods, fixed exploration, independent matched rewards with specified noise scale, homogeneous targets, and untruncated weights. Its confidence guarantee is simultaneous over the finite evaluation horizon. Broader network models can be analyzed through the calibrated target-action, transport, and dependence budgets of Theorem 1. The trace-driven study uses its own semi-synthetic counterfactual construction, as described in Section 5.4. F.2

Experimental Data Sources and Evaluation Scope

The controlled ring benchmark evaluates the predecision finite-sample certificate under known local interference. METR-LA and FlockLab supply trace-derived network structure and context observations, with model-generated counterfactuals and seed-level uncertainty. Each study is presented with its corresponding outcome and calibration model. Supplementary mechanism studies use separate sampling protocols and data sources; their results are reported separately from the primary benchmark. Third-party data provenance. The METR-LA input, metr-la.h5, is distributed through the DCRNN project [32] (https://github.com/liyaguang/DCRNN). Our FlockLab input, 2019-07_FlockLab_sky.csv, comes from the July 2019 wireless-link traces associated with Jacob et al. [33] (https://zenodo.org/records/3727526, Zenodo record v1.4.0). Both sources are used only as network-derived context and topology inputs for offline semi-synthetic experiments; outcomes are model-generated. Neither the source files nor derived trace arrays 47

Table 6: Low-mismatch controlled comparison. Means over 24 paired seeds and 200 rounds; smaller is better in every numeric column. Method

Regret Gap ATE error Width W

CAUSAL-UCB (ours) Certified IPS-UCB Legacy DR-UCB Legacy IPS-UCB Raw-UCB Greedy-Raw Switchback-OED

1.018 1.052 11.984 11.984 15.098 1.000 20.000

.000 .000 .027 .027 .071 .000 .110

.0176 .0597 .0057 .0197 .0235 .0291 .0231

.323 .644 1.105 1.105 .968 2.000 .775

Dep. gap 4.622 4.615 2.545 2.545 1.993 4.626 1.344

Bold indicates the column minimum (ties included), not statistical significance. Width W is decision-active only for certified methods; other widths are diagnostic. Dep. gap is simulator-based.

are redistributed in the code supplement. Input filenames, archived hashes, and access links are documented in the supplement’s DATA_PROVENANCE.md. F.3

Metric Definitions, Paired Comparisons, and Regret–Deployment Pareto Analysis

Metric inventory and interpretation. The frozen controlled benchmark contains 336 method– seed records: two mismatch regimes, seven methods, and 24 paired seeds per regime. Each record includes cumulative target regret, terminal target-value gap, maximum pairwise ATE error, local audit width, and cumulative deployment gap. The field width_decision_certificate is populated as a decision-active radius only for Certified CAUSAL-UCB and Certified IPS-UCB. Widths for other methods are local diagnostic widths and do not imply simultaneous target coverage. Paired-seed comparisons.

For a metric M and a baseline b, define the paired difference Ds = MsCAUSAL-UCB − Msb .

For n matched seeds, we report the mean difference and the paired Student-t interval sD D̄ ± t0.975,n−1 √ , n where sD is the sample standard deviation of the seed-level paired differences. A paired interval is not obtained by subtracting two marginal confidence intervals. Wilson intervals are used for binary full-path coverage outcomes. Zero-width empirical intervals in degenerate finite samples are not interpreted as zero population uncertainty. Regret–deployment Pareto order. We report cumulative target regret and cumulative expected deployment gap as separate objectives, both minimized. Method a weakly dominates method b on a given regime’s sample means if Regreta ≤ Regretb ,

DeploymentGapa ≤ DeploymentGapb ,

with at least one strict inequality for strict dominance. The empirical Pareto set contains methods not dominated by another method on these two sample means. This set is descriptive: mean nondominance is not a significance test, and the expected deployment gap is calculated by the simulator rather than directly observed in a real deployment. The high-mismatch sample-mean Pareto frontier is shown in main-text Figure 7(b); the low-mismatch counterpart is shown in Figure 9(c). These frontiers compare sample means and do not constitute significance tests. Interpretation of the controlled comparison. Under high mismatch, Certified CAUSAL-UCB, Certified IPS-UCB, and Greedy-Raw represent distinct non-dominated mean trade-offs: the certified DR method has the lowest regret but higher deployment cost, while Greedy-Raw has lower deployment cost but substantially higher regret. The reference methods with worse regret and higher deployment cost are dominated by at least one of these points in the reported means. Under low mismatch, the frontier is less discriminating because several methods trade small regret differences against small deployment-gap differences. The figure therefore complements the five-metric main table without ranking methods through an arbitrary weighted score. 48

(b) Cost--regret mechanism map

No OFU

No DR

No exploration

(c) Low-mismatch Pareto frontier

Target regret (lower is better)

(a) Deployment cost CAUSAL-UCB (ours)

30

Target regret

Deployment gap

No exposure

20 10 0

20 10 0

1 2 3 4 5 Ablation variant (legend order)

0

10 20 Deployment gap

30

CAUSAL-UCB (ours) Certified IPS-UCB Legacy DR-UCB Legacy IPS-UCB

Raw-UCB Greedy-Raw Switchback-OED

20 10 0

0 2 4 6 Deployment gap (lower is better)

Figure 9: Supplementary deployment-cost and Pareto diagnostics. (a) Deployment gap by ablation variant; (b) cost–regret map for the same variants; (c) low-mismatch sample-mean Pareto frontier. Panels (a)–(b) use the controlled ablation protocol described in the main text and are not pooled with the five-metric benchmark table. Panel (c) reports the low-mismatch counterpart of the high-mismatch frontier in main-text Figure 7(b). Regret and simulator-based deployment gap are separate minimized objectives. The cost–regret and Pareto comparisons are descriptive and do not establish statistically significant dominance. Coverage and certificate width. The audit-width column must be read with its provenance. For the two certified methods, the predecision radius enters the selection rule and has the stated finite-sample interpretation under the model conditions. For other methods, the recorded width is diagnostic only. Full-path certificate coverage is evaluated separately in Appendix H.1 and under hidden misspecification in Appendix H.2; these experiments use different protocols and are not pooled.

G

Additional Experiments, Robustness, and Mechanism Studies

G.1

Robustness and Parameter Sweeps (a) Target regret CAUSAL-UCB (ours) Certified IPS-UCB Legacy DR-UCB

0.1

Terminal gap

Cumulative regret

20 15 10 5

0.08 0.06 0.04 0.02 0

0 0.2

0.4

0.6

0.8

1

Interference strength ;

1.2

-0.02

1.4

(c) Pairwise ATE error

0.25

0.4

0.6

0.8

1

Interference strength ;

1.2

1.4

1.2

1.4

(d) Certified width

1.4

Certificate diameter

0.15 0.1 0.05 0 0.2

0.2

1.6

0.2

Max ATE error

(b) Terminal target gap

0.12

Legacy IPS-UCB Greedy-Raw

1.2 1 0.8 0.6

0.4

0.6

0.8

1

Interference strength ;

1.2

0.4 0.2

1.4

0.4

0.6

0.8

1

Interference strength ;

Figure 10: Supplementary interference sensitivity across the seven levels shown in the panels. The four outcomes are cumulative target regret, terminal target-value gap, maximum pairwise ATE error, and decision-active certificate width. Widths for non-certified methods remain diagnostic and do not imply simultaneous target coverage.

49

(a) Fixed exploration: Target regret CAUSAL-UCB (ours) Certified IPS-UCB Legacy DR-UCB

1.4

Certified width

Target regret

20 15 10 5 0

1.2 1 0.8 0.6 0.4

0

0.1

0.2

0.3

0.4

0.5

Fixed exploration rate 2

0.2

0.6

(c) Drift stress: Regret (diagnostic) CAUSAL-UCB Greedy-Raw

Empirical path coverage

Regret (diagnostic)

15 10 5

0

0.05

0.1

0.1

0.2

0.3

0.4

Fixed exploration rate 2

0.5

0.6

(d) Drift stress: Empirical path coverage

0.8 0.6 0.4 0.2 0

0.15

Uncalibrated drift strength

0

1

CERT-DR (invalid drift budget)

20

0

(b) Fixed exploration: Certified width

1.6

Legacy IPS-UCB Greedy-Raw

0

0.05

0.1

0.15

Uncalibrated drift strength

Figure 11: Exploration-rate and uncalibrated-drift stress diagnostics. Panels (a)–(b) report target regret and certificate width across the fixed exploration rates shown. Panels (c)–(d) report regret and empirical path coverage under deliberately uncalibrated post-burn-in drift. The drift panels violate the calibrated-drift condition and are descriptive diagnostics, not theorem-certified coverage evidence. Detailed robustness evidence. The main table reports regret, terminal gap, causal-estimation error, audit width, and deployment gap as separate quantities. This appendix provides the full interference sensitivity panels and the complementary fixed-exploration and uncalibrated-drift stress diagnostics. The latter deliberately leave the validated drift regime and are interpreted as failure-boundary evidence, not theorem-certified coverage results. Exploration-rate and deployment-cost diagnostics. Figure 12 expands the measurement-cost comparison accompanying main-text Figure 7(a) and Figure 7(b). The exploratory logging rate is varied in a separate controlled sweep; deployment gap denotes measurement-induced utility loss and is distinct from target regret. Legacy IPS-UCB Greedy-Raw

30

20

10

0

0

0.1

0.2

0.3

0.4

Exploration rate 2

0.5

(b) CAUSAL-UCB: cost and regret

35

Deployment gap (bars)

Cumulative deployment gap

CAUSAL-UCB (ours) Certified IPS-UCB Legacy DR-UCB

0.6

30 1.6

25 20

1.4

15 10

1.2

5 0

0

0.1

0.2 0.3 0.4 Exploration rate 2

0.5

0.6

1

(c) Decision-active certificate width

1.6

1.8

Certified interval diameter

(a) Deployment cost across exploration rates

1.4 1.2 1 0.8 0.6 0.4 0.2

0

0.1

0.2 0.3 0.4 Exploration rate 2

0.5

0.6

Figure 12: Measurement-exploration cost and certificate width. (a) Cumulative deployment gap across exploration rates and methods; (b) Certified DR deployment gap (bars) and regret (line) on separate axes; (c) Decision-active certificate width across fixed exploration rates. Panels (a)–(b) correspond to the controlled fixed-rate sweep, not the minimax lower-bound construction. Panel (c) reports a radius diagnostic for the displayed certified methods; width alone does not establish coverage, which remains conditional on the calibration requirements of Theorem 1.

50

G.2

Trace-Driven Semi-Synthetic Comparisons

Protocol and comparison. Figure 13 extends Table 3 by reporting cumulative target regret under both high- and low-mismatch regimes. The semi-synthetic replays use METR-LA and FlockLab topology/context traces with model-generated counterfactual outcomes, spanning 180 decision rounds and eight independent seeds per condition. The four panels separate dataset-specific effects from the influence of logging–target mismatch, while the 95% Student-t intervals quantify seed-level variability. Regime-dependent behavior. Under high mismatch, CAUSAL-UCB achieves lower target regret than IPS-UCB on both METR-LA and FlockLab, consistent with the benefit of correcting exploratory measurements toward the deployment target. Under low mismatch, however, Greedy-Raw achieves lower regret on both traces, showing that the advantage of causal correction is not uniform across measurement regimes. These comparisons characterize empirical transfer and its limitations; they neither establish identification under arbitrary network interference nor extend the restricted ringmodel certificate to trace-driven environments. (a) METR-LA / high mismatch

8 6 4 2 0

8 6 4 2 0

CB

-U AL US

CA

CB

-U

IPS

Ra

B

UC

w-

aw

-R dy

ee Gr

ED

k-O

ac chb wit

CB

L-U

SA

U CA

S

(c) FlockLab / high mismatch

CB

-U

IPS

8 6 4 2 0

B

UC

w-

Ra

eed

Gr

aw

y-R

ch wit

ED

k-O

bac

S

(d) FlockLab / low mismatch

10

Mean target regret (95% CI)

10

Mean target regret (95% CI)

(b) METR-LA / low mismatch

10

Mean target regret (95% CI)

Mean target regret (95% CI)

10

8 6 4 2 0

CB

-U AL US

CA

CB

-U

IPS

CB

w

-Ra

-U

w Ra

G

dy ree

Sw

itch

k bac

ED

-O

CB

-U

AL

US

CA

CB

-U

IPS

B

UC

w-

Ra

eed

Gr

aw

y-R

itch

Sw

ED

k-O

bac

Figure 13: Trace-driven semi-synthetic comparisons by dataset and mismatch regime. Panels (a)–(d) show METR-LA/high mismatch, METR-LA/low mismatch, FlockLab/high mismatch, and FlockLab/low mismatch, respectively. Whiskers are 95% Student-t intervals across eight independent seeds. The high-mismatch cells are also summarized in Table 3; this figure adds the low-mismatch cells. These runs are not live deployments and are not certified by the homogeneous ring-model confidence theorem. G.3

Seed-Level Outcomes and Sensitivity Summaries

The high-mismatch sample-mean Pareto frontier is shown in main-text Figure 7(b). Its low-mismatch counterpart is reported in Figure 9(c) in Appendix F.3; neither sample-mean frontier is a significance test. Only the two certified methods have a decision-active audit radius. These known-local-exposure sensitivity studies use 24 independent paired seeds per setting and T = 200. The number and values of sweep levels are metric-specific and are shown in each panel; they are not forced to a common grid. Regret, ATE error, and deployment gap are summarized separately, with seed-level Student-t intervals where shown. Scope of context-shift and annealing diagnostics. When the generator adds uncalibrated drift or changes η over time, the fixed-exploration stationary proposition is inapplicable; measured coverage under these modifications is descriptive, not a valid extension of Theorem 1. These diagnostics are reported separately from the certified main benchmark and do not alter its theorem assumptions. 51

(a) Seed-level cumulative regret CAUSAL-UCB (ours) Certified IPS-UCB

20

Number of seeds

Number of seeds

25 20 15 10

0

5

10 regret

15

10

0

20

(c) Terminal target-value gap

25

0.6

0.8

1 1.2 1.4 1.6 width common local audit

1.8

1 2 3 Selected configuration

4

(d) Terminal configuration frequencies

25 20

Number of seeds

20

Number of seeds

15

5

5

15 10 5 0

(b) Seed-level audit width

25

Legacy DR-UCB Greedy-Raw

15 10 5 0

0.02 0.04 0.06 0.08 0.1 0.12 0.14 0.16 gap

0

Figure 14: Seed-level outcomes under high mismatch. Panels (a)–(d) report cumulative target regret, local audit width, terminal target-value gap, and final selected-configuration frequency. All panels use the frozen 24 paired seeds. Widths for non-certified methods are diagnostic only, and the final panel reports configuration IDs rather than unobserved true-value ranks. (a) Exploration sensitivity

15 10 5

0

0.1

0.2

0.3

0.4

Exploration rate 2

0.5

15

10

5

0

0.6

2

4

6

8

Weight cap

10

(c) Window-budget sensitivity

20

Cumulative target regret

20

0

(b) Clipping-cap sensitivity

20

Legacy IPS-UCB Greedy-Raw

Cumulative target regret

Cumulative target regret

CAUSAL-UCB (ours) Certified IPS-UCB Legacy DR-UCB

15

10

5

0

12

1

2

3

4

Retained windows per round

5

6

Figure 15: Fixed-rate sensitivity sweeps: (a) exploration rate, (b) importance-weight clipping cap, and (c) retained-window budget. A nonzero clipping bias must be accounted for before an interval is treated as certified. (a) Network size: regret

30

Max ATE error

Regret

15 10

0.15 0.1

5

0.05

0

0

20

40

60

Number of nodes

80

(c) Network size: cost

35

0.2

20

0

(b) Network size: ATE

0.25

Legacy IPS-UCB Greedy-Raw

100

Deployment gap

CAUSAL-UCB (ours) Certified IPS-UCB Legacy DR-UCB

25 20 15 10 5

0

20

40

60

Number of nodes

80

100

0

0

20

40

60

Number of nodes

80

100

Figure 16: Network-size sensitivity across the displayed node counts. Panels report target regret, maximum pairwise ATE error, and deployment gap, respectively.

52

(a) Radius 1: Cumulative regret

30

Max ATE error

10

0.1

5

0.05

0

0

40

60

Number of nodes

80

100

(d) Radius 2: Cumulative regret

20

0

20

40

60

Number of nodes

80

10

5

(e) Radius 2: Max ATE error

0

20

40

60

Number of nodes

80

100

10

0

20

40

60

Number of nodes

80

100

(f) Radius 2: Deployment gap

30

0.4 0.3 0.2

0

15

35

0.1

0

20

0

100

0.5

15

25

5

0.6

Max ATE error

Cumulative regret

0.15

Deployment gap

Cumulative regret

15

20

(c) Radius 1: Deployment gap

35

0.2

20

0

(b) Radius 1: Max ATE error

0.25

Legacy IPS-UCB Greedy-Raw

Deployment gap

CAUSAL-UCB (ours) Certified IPS-UCB Legacy DR-UCB

25 20 15 10 5

0

20

40

60

Number of nodes

80

0

100

0

20

40

60

Number of nodes

80

100

Figure 17: Known-radius scalability sweep. Panels (a)–(c) report target regret, maximum pairwise ATE error, and deployment gap for radius r = 1; panels (d)–(f) report the same metrics for radius r = 2.

(a) Clipping: regret

Max ATE error

Regret

15 10 5

2

4

6

8

Weight cap

10

(c) Clipping: certificate width

1.6 1.4

20

0

(b) Clipping: ATE

0.2

Legacy IPS-UCB Greedy-Raw

0.15

0.1

0.05

0

12

Interval diameter

CAUSAL-UCB (ours) Certified IPS-UCB Legacy DR-UCB

1.2 1 0.8 0.6

2

4

6

8

Weight cap

10

0.4

12

2

4

6

8

Weight cap

10

12

Figure 18: Clipping-cap sensitivity across the displayed cap values. Panels report target regret, maximum pairwise ATE error, and certificate width. Clipping without a valid bias allowance is a stress diagnostic, not a certified guarantee.

(a) Windows: regret

30

Max ATE error

Regret

15 10

0.15 0.1

5

0.05

0

0

2

3

4

Retained windows per round

5

(c) Windows: cost

35

0.2

20

1

(b) Windows: ATE

0.25

Legacy IPS-UCB Greedy-Raw

6

Deployment gap

CAUSAL-UCB (ours) Certified IPS-UCB Legacy DR-UCB

25 20 15 10 5

1

2

3

4

Retained windows per round

5

6

0

1

2

3

4

Retained windows per round

5

6

Figure 19: Retained-window-budget sensitivity. Panels report target regret, maximum pairwise ATE error, and deployment gap across the window counts shown.

53

G.3.1

Auditable Contextual Support Extension Descriptive node-level ESS (thousands)

(a) Joint clean-neighborhood match Joint clean match Conditional match, 10th pct.

1

Probability

0.8 0.6 0.4 0.2 0

Low

Moderate

High

12

(b) Descriptive retained-match index 10.3k

10 8

7.0k

6 4

4.2k

2 0

Low

Moderate

High

Figure 20: Supplementary overlap quantification for Figure 5. Panel (a) reports empirical joint clean-neighborhood match probability and the conditional 10th-percentile match probability; panel (b) reports descriptive node-level IPW effective counts across overlap regimes. These counts are not the dependence-calibrated effective sample size used in Theorem 1. Figure 5 is a new, separate mechanism experiment, not an unchanged instance of the certified homogeneous ring generator. We preserve the fixed 24-node radius-one ring, the five-configuration setup, 24 seeds and paired target/logging sampling, but add context-dependent measurement flip probabilities and an explicit logging-induced context response. Let Xi = (X1i , X2i ) denote the stationary pre-exploration latent context, generated from seeded, spatially smoothed Gaussian covariates. Conditional on X, measurement flips are independent: pi = η σ(0.95X1i − 0.65X2i ), Ai ∼ Ber(pi ), Ei = 0.6Ai + 0.2Ai−1 + 0.2Ai+1 . 0 The unperturbed target has Ai = Ei = 0 and Ci = Xi . Logging operates with η η C1i = X1i + 0.90Ei + 0.16ηX2,i−1 , C2i = X2i − 0.62Ei + 0.26ηX1,i+1 . Rewards are generated by clipping 0.62 − 0.60Ei + 0.075C1i − 0.060C2i + ζi to [0, 1], with the same independent noise realization in target and logging simulator modes. The full-neighborhood conditional clean event probability is Y qi (X) = (1 − pj ), Ii = ⊮{Ai−1 = Ai = Ai+1 = 0}. j∈{i−1,i,i+1}

For each η ∈ {0.55, 0.30, 0.08} we sample 24 seeds, 20 spaced rounds and all P24 nodes, yielding 11,520 logging and 11,520 paired target records. The empirical clean rate is Ii /n; the reported q10% is the tenth percentile of the true conditional qi ; the displayed IPW information Pempirical P index is ( Ii /qi )2 /( (Ii /qi )2 ). This index is descriptive across dependent ring nodes, not the certified network-window effective sample size of Theorem 1. The paired target mode is available solely inside the simulator; no deployment algorithm observes its counterfactual data. Because these conditional propensities and context shifts violate assumptions of the previous certified fixed-η submodel, no valid Theorem 1 certificate or regret conclusion is asserted for this extension. The figure is a mechanistic visualization of why context transport must be independently controlled even with positive conditional action support. G.4

Matched-Log Mechanism Studies

Supplementary mechanism evidence comprises a 60-seed, 1,000-round factorial study and a matchedlog DR-by-exposure study, alongside the primary controlled benchmark. Their sampling protocols and data sources are documented separately; results from distinct protocols are not pooled. Study provenance. The separate matched-log study reported DR/exposure ATE RMSE 0.0312 and coverage 97.2%, while its online comparison reported DR-UCB/local regret 18.963 and CAUSALUCB regret 21.723. That study used a distinct measurement design. The primary 24×200 benchmark uses the controlled protocols and seed records described in Appendix F.1; the two sets of results are interpreted within their respective experimental settings. 54

(a) Maximum ATE error

ATE RMSE

Maximum ATE error

0.08 0.06 0.04

0.04 0.03 0.02 0.01

0.02 0

0.2

0.4 0.6 0.8 1 Interference strength ;

1.2

0

1.4

0

0.2

(c) Diagnostic pairwise ATE coverage

1.2

0.05

0.1

0

(b) ATE RMSE

0.06

IPS / exposure IPS / local

Diagnostic pairwise ATE coverage

DR / exposure DR / local

0.4 0.6 0.8 1 Interference strength ;

1.2

1 0.8 0.6 0.4 0.2 0

1.4

0

0.2

0.4 0.6 0.8 1 Interference strength ;

1.2

1.4

Figure 21: Matched-log DR/IPS-by-exposure comparison across the interference levels shown. Panels report maximum pairwise ATE error, ATE RMSE, and diagnostic pairwise ATE coverage. The local representation omits neighboring actions; the displayed coverage is a diagnostic and is not the general Theorem 1 guarantee. (a) Online exposure stress

(b) Online exposure stress

DR / local (heuristic)

1

Observed all-time coverage

Certified DR / exposure

Target regret

12 10 8 6 4 2 0

0.8 0.6 0.4 0.2 0

0

0.2

0.4

0.6

0.8

1

1.2

Interference strength ;

1.4

0

0.2

0.4

0.6

0.8

1

Interference strength ;

1.2

1.4

Figure 22: Online exposure-versus-local stress test across the interference levels shown. Panel (a) reports target regret; panel (b) reports observed all-time coverage. The local estimator is heuristic and the coverage curve is diagnostic, not a certificate under the general theorem. (a) Logging--target value error

(b) Logging--target interval coverage

Absolute target-value error

0.2 0.15 0.1 0.05 0

(c) Naive versus joint-match interval width Aligned / action mismatch (identical widths) Action + context shift Correct joint-match certificate

1 0.016

0.8

Reported interval width

Action + context shift Correct joint-match certificate

Observed interval coverage

Aligned Action mismatch

0.6 0.4 0.2

0.014 0.012 0.01 0.008 0.006

0 0.1

0.2

0.3 0.4 Measurement exploration rate 2

0.5

0.6

0.1

0.2

0.3 0.4 Measurement exploration rate 2

0.5

0.6

0.1

0.2

0.3 0.4 Measurement exploration rate 2

0.5

0.6

Figure 23: Logging–target alignment and mismatch sensitivity across the exploration rates shown. The panels report absolute value error, naive interval coverage, and interval width. The sampling-only intervals are diagnostic: high coverage or narrow width does not establish target identification under context shift. G.4.1

Finite-state calibration under independent audit observations

Let Z, C, A be finite with cardinalities M, J, K. Assume R ∈ [0, 1]. For each z, the logging law has context distribution νbz (c), conditional action law bz (a | c), and response mean mzlog (a, c). The no-exploration target is X X Wz0 = ν0z (c) pz (a | c)mz0 (a, c). c a z z z z The operators pz , bz , mlog , m0 , νb , ν0 are not given to the learning algorithm. Their estimation is conditional on independently identified calibration observations. In particular, mz0 (a, c) must be

identified from a valid target-regime response audit; observational exposure features alone do not ensure this.

55

Independent calibration. Freeze the fitted nuisances pb, bb, m b before the evaluated online trajectory. At every indicated action/context cell, collect at least nmin independent conditional audit observations for p, b, mlog , m0 . Independently collect context-law audit samples for ν0 , νb , νtr . These audits are independent of nuisance fitting and online evaluation. Denote audit means by tildes. Take D = M (4JK + 3J), audit failure allocation α > 0, and s log(2D/α) r= . 2nmin Hoeffding and the union bound imply that every scalar audit error is at most r jointly with probability at least 1 − α. Let p− = (e p − r)+ , p+ = min(1, pe + r), b− = (eb − r)+ , and b+ = min(1, eb + r), all cellwise. The certificate refuses to issue if any b− = 0 or the propensity floor exceeds min b− /2. For w b = min{b p/ max(bb, πmin ), wmax }, define audit bounds (with maxima taken over c, a or c as indicated) X ep (z) = max (|b pz − pez | + r), (75) c

a

em (z) = max(|m bz − m e zlog | + r),

(76)

c,a

w− = min(p− /b+ , wmax ), −

w+ = min(p+ /b− , wmax ), +

ew (z) = max max{|w b − w |, |w b − w |}, c,a X eclip (z) = max [p+ − wmax b− ]+ , c

(78) (79)

a

eν (z; v, 0) = ∥e νvz − νe0z ∥1 + 2Jr, X X eexp (z) = E νe0z (c) pbz (a | c)|m e z0 (a, c) − m e zlog (a, c)|. c

(77)

(80) (81)

a

Under the scalar audit event, an explicit conservative seven-part bias budget is ϵtarget = ep , ϵclip = eclip ,

ϵmπ = em ew , eexp + Jr + ep + 2r, ϵexp = E

(83)

ϵshift = 21 eν (z; b, 0),

ϵcfg = em eν (z; tr, 0),

(84)

ϵdrift = 2(1 + 2wmax )dz .

(82)

(85)

Here dz is an externally verified total-variation envelope for the residual deviation of a retained network-window score law from its stationary counterpart. All components are nonnegative and may be capped by crude support bounds if desired. The configuration term is a conservative, optional allowance: the cellwise regression audit already controls training-to-target transport in this finite-state construction. This does not establish such transport for an arbitrary unobserved latent confounder or unmatched outcome semantics. Dependent network-window evaluations. Define the frozen score X ψz (C, A, R) = pbz (a | C)m b z (a, C) + w bz (A, C){R − m b z (A, C)}. a

With m b z ∈ [0, 1], this score lies in [−wmax , 1 + wmax ], an interval of length S = 1 + 2wmax . Treat each retained network window as one observation, regardless of the number of correlated nodes in it. Assume the per-configuration infinite stream of retained windows is stationary, or has the above independently certified drift envelope, and obeys a verified conditional block-coupling bound: for separation g, the total coupling failure over all candidate streams and at most nmax retained windows per stream is at most δmix ≥ M nmax β(g). For example, an independently established Markov TV contraction β(g) ≤ ρg suffices. An empirical autocorrelation estimate by itself does not prove this assumption. Nuisances are frozen before scoring; arbitrary adaptive cross-fitting requires an additional predictability/buffering proof. 56

Proposition 6 (Operational finite-audit certificate). Under all the independent-audit, identification, common conditional- response meaning, support, mixing, and drift assumptions above, allocate α to calibration, δs to the centered-score event, and δmix to coupling, with α + δs + δmix ≤ δ. Then, simultaneously for every z and every scored prefix 1 ≤ n ≤ nmax , with probability at least 1 − δ, r X log(2M (nmax + 1)/δs ) DR 0 c + ϵv (z). |Wz,n − Wz | ≤ S {z2n } v∈{target,mπ,clip,exp,shift,cfg,drift} | centered network-window score

Unvisited configurations are assigned the trivial [0, 1] interval. The radius depends only on frozen fitted nuisances, independent calibration data, retained scoring observations, and certified coupling/drift envelopes; no true target values enter online selection. Proof. The calibration P event follows from Hoeffding over D bounded scalar quantities. For each context, let µlog (c) = a p(a | c)mlog (a, c). The conditional score expectation obeys the exact identity X X Eb [ψ | c] − µlog (c) = (b p − p)m b+ (p − bw)( b m b − mlog ). a

a

The first term is bounded by ep ; the second by em {ew + eclip }, and the looser displayed ledger em ew + eclip is valid because em ≤ 1. Transporting the context law from νb to ν0 costs at most the total variation bound ϵshift for a function in [0, 1]. Transporting the conditional response from mlog to m0 is bounded by ϵexp , using r for each target/logging conditional mean and audited target weights. ϵcfg and ϵdrift are conservative further upper bounds on the indicated residual terms. Conditional on successful block coupling, the centered frozen score is a bounded independent sequence; a Hoeffding union bound across all M candidates and all nmax prefixes gives the displayed sampling term. Adding the calibration and coupling failure budgets proves the simultaneous bound. Adaptivity of the arm order is allowed because the event covers every prefix of every presampled arm stream. Corollary 3 (Use of the same radius in online decisions). If the algorithm chooses zt ∈ cz,t−1 + bz,t−1 } from the predecision certified radii above, then outside H pilot arg maxz min{1, W P rounds the same joint event gives W 0 (z ⋆ )−W 0 (zt ) ≤ 2bzt ,t−1 , hence RegT ≤ H +2 t>H bzt ,t−1 . Information requirements and calibration cost. The finite-state certificate combines independent observations of target context and action laws, target-regime response calibration, and a specified conditional mixing envelope. These quantities define the auditable black-box class in which the stated confidence event holds. Their measurement cost is included when interpreting the identification– deployment trade-off. The construction complements the local-interference certificate with a finitestate route to calibrating the general error decomposition. G.5

Certified Optimism under Heterogeneous Initial Information

Question and controlled design. We investigate when the confidence upper bounds constructed from the seven-term causal value certificate provide a useful configuration-level information acquisition mechanism, beyond the point estimates alone. The experiment uses the independently audited, finite-state black-box response model underlying our operational certificate test. There are three global configurations, two context states, and two possible local actions. In addition to logged rewards, external action/intervention and context audits are available; a known retained-block transition envelope controls dependence. These assumptions are sufficient for the audit construction, but are not implied by arbitrary black-box exploratory logs. c (z; 0) + bz } (with target-value truncation), We compare Certified-OFU, selecting arg maxz {W c Certified-Greedy, selecting arg maxz W (z; 0), and a pre-specified decaying forced-exploration Greedy policy. All policies share identical nuisance fits, independent audits, initial scored windows, and configuration-specific potential score streams; only the choice rule differs. For a visited configuration, the certificate radius takes the form r 7 log(2KNmax /δs ) X bz (n) = 3.2 + βz,j , δs = 0.03, δaudit = 0.02. (86) 2n j=1 57

The seven nonnegative, independently audited buckets cover target action, nuisance product, clipping, exposure/response transport, context shift, cross-configuration transfer, and retained-block dependence/drift. The final bucket includes the explicit predictable-mean allowance 3.2(0.45)6 for ⊤ the known retained-block kernel Pz = λI + (1 − λ)1νz,log , λ = (0.45)6 . The finite audit and martingale-score failure budgets sum to 0.05 for each independent run. Initial-information regimes. We fix five regimes before evaluating outcomes. The primary starved-optimal regime has target values (0.506, 0.511, 0.527) and pilot scored-window allocations (1500, 1500, 120); thus the truly optimal third configuration is initially least observed. Balanced-easy and balanced-ambiguous regimes use equal (900, 900, 900) pilots; two further regimes assign the 120-window pilot to a suboptimal configuration instead. In each regime we evaluate 96 paired seeds, 80 online rounds, and 400 new scored retained blocks per round, with the same exploration mixture η = 0.46, independent 200,000-sample audits per calibrated cell, and 10,000 fitted observations per cell. Exact simulator target values are used only to assess regret and coverage, never by the learner. Table 7: Certified OFU versus Greedy under five fixed initial-information regimes. Mean cumulative target regret across 96 paired seeds; nmis is the number of seeds whose initial point estimates rank the true best configuration incorrectly. Lower regret is better. All regimes are reported. Regime

nmis

Certified-OFU

Certified-Greedy

Decaying-Forced

0 17 33 24 30

0.327 0.330 0.241 0.297 0.314

0.000 0.051 0.467 0.019 0.024

1.728 0.299 0.268 0.238 0.241

Easy, balanced Ambiguous, balanced Starved optimal Starved middle Starved low

Correction of an initial misranking. In the starved-optimal regime, 33 of 96 independent seeds exhibit an initial point-estimate misranking. On these 33 paths, mean cumulative regret is 0.232 for Certified-OFU and 1.077 for Certified-Greedy; the paired mean difference (Greedy minus OFU) is 0.845, with a seed-level descriptive 95% confidence interval [0.621, 1.068]. The initial misranking persists in the point-estimate ordering for 22/33 Greedy paths at the final round. The full-sample difference across all 96 seeds remains positive, 0.226 (95% CI [0.091, 0.362]). These outcomes reveal a configuration-information bottleneck: a policy that never visits an underestimated candidate cannot shrink that candidate’s estimation uncertainty through selected-arm feedback. (b) Information accrued on optimal configuration Scoring windows for the optimal configuration

(a) Cumulative target regret Certified-OFU Certified-Greedy Greedy+Decaying-Forced

Cumulative target regret

1.5

1

0.5

0

0

10

20

30 40 50 Online configuration round

60

70

80

3

Certified-OFU Certified-Greedy Greedy+Decaying-Forced

#10 4

2

1

0

0

10

20

30 40 50 Online configuration round

60

70

80

Figure 24: Correction under initially insufficient optimal-configuration information. Mean trajectories and pointwise 95% seed-level intervals on the 33 initial-misranking paths. Left: cumulative target regret. Right: number of certified scoring windows accrued on the truly optimal configuration. All policies start from the same pilot counts and receive 400 new scored blocks per online round. The role of certificate tightness. To test whether the advantage arises exclusively from the optimal configuration having a larger fixed seven-term budget, we repeat the starved-optimal regime after enlarging each of the seven arm-specific bias bounds to the maximum across all arms. This is still a valid, more conservative certificate and makes the fixed bias terms identical. On the 33 initial-misranking paths, equal-budget OFU obtains mean cumulative regret 0.724 versus Greedy’s 58

1.077; the paired difference is 0.353 (95% CI [0.130, 0.576]). Across all 96 paths, however, equalbudget OFU incurs 0.724 regret versus Greedy’s 0.467: conservative uncertainty induces unnecessary exploration when the point estimates are already adequate. The original arm-specific seven-term OFU achieves 0.241 on these 96 paths, emphasizing the importance of certificate tightness as well as coverage validity. (b) Equalized seven-term budget: initially misranked paths (a) All five initial-information regimes

Certified-OFU Certified-OFU-UniformBudget Certified-Greedy

easy balanced

1.5

Cumulative target regret

ambiguous balanced starved optimal starved middle starved low

1

0.5

0 -0.4

-0.3 -0.2 -0.1 0 0.1 0.2 0.3 Greedy minus OFU target regret (positive favors OFU)

0.4

0

10

20

30 40 50 Online configuration round

60

70

80

Figure 25: Decision value is conditional on the information structure. Left: paired Greedy-minusOFU target regret, with 95% seed-level intervals, in all five fixed regimes (positive favors OFU). Right: a valid conservative uniform seven-term bias envelope preserves OFU’s advantage on initially misranked paths but incurs additional exploration cost. Audit cost and interpretation. All three policies spend 32,000 additional scored blocks per seed; independent intervention audits are a separate, substantial prerequisite. In Pthe starved-optimal scenario, the model-based expected measurement-induced utility displacement t [W∞ (zt ; 0) − W∞ (zt ; η)] is approximately 3.319 for Certified-OFU versus 3.137 for Greedy (oracle-computed diagnostic, never used in selection). Thus improved target-regret control can coincide with greater measurementinduced utility displacement. The case study identifies when the OFU mechanism can correct point-estimation lock-in under valid audit assumptions; it does not imply OFU is uniformly optimal, nor does it extend the finite-state certificate automatically to unaudited networks. Tight certificates and meaningful information-growth conditions are both necessary ingredients when interpreting the regret result. G.6

Gap–Noise–Budget Stress Test of Certified Optimism

To characterize when optimism helps and when it does not, we ran a predeclared 3 × 3 × 2 stress grid over target-value gap, response-noise level, and online scoring budget. The top-versus-middle target gap is ∆ ∈ {0.005, 0.016, 0.030}, the bounded-noise amplitude is σ ∈ {0.2, 0.6, 1.0}, and the budget is 200 or 400 scored windows per decision. For response mean m(c, a), the generated response is R = m(c, a)+σ min{m(c, a), 1−m(c, a)}(2U −1) with U ∼ Unif[0, 1], preserving the conditional mean and the [0, 1] bound. We use 24 paired seeds per cell, 80 online decisions, 10,000 fitting samples per cell, and 200,000 independent audit samples per cell. The paired comparison is Ds = RegretOFU − RegretGreedy ; negative values favor OFU. s s Across the 18 cells, OFU has lower mean regret in 12 cells and Greedy has lower mean regret in 6. The unweighted mean of the 18 cell-level paired differences is −0.0426, but this average is descriptive because the cells represent different operating regimes. Only four cell-wise 95% paired-t intervals lie entirely below zero, while two lie entirely above zero; the remaining intervals include zero. The results therefore support a conditional mechanism claim, not universal dominance by either policy. Figure 26 summarizes the sensitivity patterns: OFU has lower mean regret in every smallest-gap cell, whereas Greedy performs better in the largest-gap, lowest-noise cells. The cell-wise values and paired intervals are given in Table 8 and Figure 27. The seed count per cell is 24; it is a supplementary sensitivity analysis, while the 96-seed five-scenario experiment remains the primary mechanism study.

59

(b) Target gap = 0.005 200 windows

(a) Signed mean differences across 18 cells +0.31

-0.05

+0.01

-0.05

+0.03

0.2 0.1

gap 0.016

+0.07

+0.10

-0.26

-0.19

-0.19

-0.06

0 -0.1

gap 0.005

-0.04

-0.01

-0.25

-0.17

-0.17

Paired regret: OFU - Greedy

+0.31

-0.2

-0.16

-0.3

0

20 n.2/B

0

40 n.2/B

0

40 n.6/B

0

20 n1/B

Noise and scored-window budget

400 n1/B

-0.1 -0.2 -0.3 -0.4

Paired regret: OFU - Greedy

0 -0.2 -0.4

0

0.2

0.4 0.6 0.8 Noise amplitude

0

0.2

1

1.2

0.4 0.6 0.8 Noise amplitude

1

1.2

1

1.2

(d) Target gap = 0.030

0.4

0.2

-0.6

0

(c) Target gap = 0.016

0.4

Paired regret: OFU - Greedy

0

20 n.6/B

0.1

0.3

OFU minus Greedy regret

gap 0.030

400 windows

0.2 0 -0.2 -0.4 -0.6

0

0.2

0.4 0.6 0.8 Noise amplitude

Figure 26: Gap–noise–budget sensitivity of certified optimism. (a) Mean paired regret differences across the 3 × 3 × 2 stress grid, n.2/B200 denotes noise amplitude σ = 0.2 and a budget of 200 scored windows per decision; the remaining labels follow the same convention; (b)–(d) paired regret differences across noise amplitudes at target gaps 0.005, 0.016, and 0.030, respectively, under 200 and 400 scored windows. Differences are OFU minus Greedy; negative values favor OFU. Each cell uses 24 paired seeds and 80 online rounds. Error bars denote 95% paired Student-t intervals; the heatmap reports cell means.

Table 8: Cell-wise means and paired regret differences in the gap– noise–budget grid. D = RegretOFU − RegretGreedy ; negative D favors OFU. Gap σ Windows OFU regret Greedy regret D̄ Paired 95% CI 0.005 0.20 200 0.104 0.146 -0.042 [-0.138, 0.054] 0.005 0.20 400 0.099 0.106 -0.008 [-0.097, 0.082] 0.005 0.60 200 0.104 0.351 -0.247 [-0.393, -0.101] 0.005 0.60 400 0.102 0.270 -0.168 [-0.260, -0.076] 0.005 1.00 200 0.101 0.274 -0.173 [-0.296, -0.049] 0.005 1.00 400 0.101 0.261 -0.160 [-0.279, -0.042] 0.016 0.20 200 0.238 0.166 0.072 [-0.106, 0.250] 0.016 0.20 400 0.228 0.124 0.104 [-0.085, 0.293] 0.016 0.60 200 0.236 0.493 -0.257 [-0.571, 0.057] 0.016 0.60 400 0.231 0.418 -0.187 [-0.435, 0.061] 0.016 1.00 200 0.227 0.418 -0.191 [-0.466, 0.085] 0.016 1.00 400 0.229 0.287 -0.057 [-0.264, 0.149] 0.030 0.20 200 0.309 0.001 0.308 [0.240, 0.376] 0.030 0.20 400 0.307 0.000 0.307 [0.249, 0.364] 0.030 0.60 200 0.300 0.355 -0.055 [-0.449, 0.340] 0.030 0.60 400 0.314 0.304 0.010 [-0.338, 0.359] 0.030 1.00 200 0.296 0.350 -0.054 [-0.438, 0.330] 0.030 1.00 400 0.308 0.276 0.031 [-0.285, 0.347]

60

18 predeclared cells (95% paired seed intervals) gap=0.005, noise=0.2, B=200 gap=0.005, noise=0.2, B=400 gap=0.005, noise=0.6, B=200 gap=0.005, noise=0.6, B=400 gap=0.005, noise=1.0, B=200 gap=0.005, noise=1.0, B=400 gap=0.016, noise=0.2, B=200 gap=0.016, noise=0.2, B=400 gap=0.016, noise=0.6, B=200 gap=0.016, noise=0.6, B=400 gap=0.016, noise=1.0, B=200 gap=0.016, noise=1.0, B=400 gap=0.030, noise=0.2, B=200 gap=0.030, noise=0.2, B=400 gap=0.030, noise=0.6, B=200 gap=0.030, noise=0.6, B=400 gap=0.030, noise=1.0, B=200 gap=0.030, noise=1.0, B=400 -0.6

-0.4 -0.2 0 0.2 Mean paired regret difference (OFU minus Greedy)

0.4

Figure 27: Paired regret differences across the 18 gap– noise–budget cells. The vertical zero line denotes equal mean regret; negative differences favor certified OFU. Error bars are 95% paired Student-t intervals across 24 seeds per cell. B denotes the observation budget.

H

Certificate Audits, Misspecification, and Failure Boundaries

H.1

Empirical Full-Path Validation of the Seven-Component Certificate

Fraction of complete paths

We evaluate the operational seven-component certifi300 seeds, 160 rounds: simultaneous-path validation cate under the finite-state, independently audited pro1 tocol specified in the finite-state audit construction in 0.995 Appendix G.4.1. The experiment uses 300 indepen0.99 300/300 covered 300/300 covered dently seeded runs, 160 online rounds per run, and 0.985 2,000 scored windows per decision. Each run uses 0.98 10,000 frozen fitting observations and 200,000 indepen- 0.975 dent observations per calibration cell. The seven-term 0.97 0.965 attestation is constructed before online decisions; the 95% Wilson intervals; each seed counts once 0.96 simulator’s true target values are used only by the exAll-round target coverage OFU path inequality ternal evaluator and never by the policy. Figure 28: Full-path certificate coverage and the OFU A run is counted as covered only if every configura- path inequality over 300 independently seeded runs, tion’s target value lies inside its reported interval at each with 160 online rounds. Points show the empirical fractions and intervals show 95% Wilson uncerevery predecision time and at the terminal check. All tainty. 300 runs satisfy this full-path criterion (300/300; empirical rate 100%; Wilson 95% interval [0.9874, 1.0000]). The OFU path inequality is also satisfied in all 300 runs. Mean cumulative regret is 1.0298 and the mean total seven-term bias budget is 0.0975 under this particular generator. These results are an implementation-level check under the stated finite-state audit, target-intervention identification, and verified dependence-envelope assumptions. They are not a proof of 100% population coverage, and they do not establish that these assumptions can be inferred from exploratory logs alone. The additional audit observations are a substantive information cost and are not included in online regret. (a) Radius and uncertainty components

0.3 0.2

0.04

0.8 0.03

Fraction of runs

Mean calibrated allowance

0.4

Mean bound

(c) Upper confidence bound at utility cap

1

0.5

0.02 0.01

0.6 0.4 0.2

0.1 0

(b) Seven-term budget ledger

0.05

Mean predecision radius Mean seven-term bias budget Mean statistical component

0

0

20

40

60

80 100 Online round

120

140

160

t t e n duc ping ons shif ismatch -in drift ctio et a Clip re/resp ontext e pro n m st-burn C Targ uisanc osu ratio N Po Exp figu Con

0

0

20

40

60

80 100 Online round

120

140

160

Figure 29: Certificate informativeness under the 300-seed, 160-round audit. Panel (a) reports the seed-averaged predecision radius and its statistical and calibrated-bias components; panel (b) reports the seven-term budget ledger; panel (c) shows the fraction of runs whose selected upper confidence bound reaches the utility cap. The separate 24-seed pilot diagnostics are reported in Figure 30. (a) Radius and components (24-seed pilot)

(c) Capped optimism (24-seed pilot) 1

Statistical component

(b) Seven certified error budgets (300 seeds)

0.5

Target action Nuisance product Clipping

Mean bound

0.4 0.3

Exposure / transport Context shift Configuration mismatch

Post-burn-in drift

Configuration 1

21%

48%

30%

0.2

Configuration 2

21%

48%

30%

0.1

Configuration 3

21%

47%

31%

0

0

20

40 Online round

60

80

Fraction with UCB at cap

Predecision radius Seven-term bias budget

0.8 0.6 0.4 0.2 0

0

0.02

0.04 0.06 0.08 Mean certified bias budget

0.1

0

20

40 Online round

60

80

Figure 30: Supplementary certificate diagnostics from the panel-source archive. Panel (a) reports radius components in the 24-seed, 80-round pilot; panel (b) shows the configuration-specific biasbudget composition in the separate 300-seed audit; panel (c) reports capped-optimism frequency in the 24-seed pilot. The protocols are intentionally distinguished and their outcomes are not pooled. The 300-seed audit’s aggregate informativeness summary appears in Figure 29.

61

H.2

Coverage under Hidden Calibration Misspecification

We directly stress the finite-state seven-term certificate by violating one assumption at a time while leaving the corresponding provenance flag falsely asserted as valid. Each condition contains 200 seeds, 120 online rounds per seed, 1,200 scored windows per decision, 1,000 fitting samples per cell, and 50,000 samples per cell claimed by the audit interface. The six hidden violations are: (i) the target action law differs from the audited target law; (ii) the target context distribution shifts after audit; (iii) the target interventional response shifts after audit; (iv) a context-dependent target– logging response transport effect is omitted; (v) the actual retained-block persistence is larger than the declared dependence envelope; and (vi) training estimates are reused as if they were independent audit estimates while the larger audit sample count is still claimed. The perturbation magnitudes are fixed as follows: for the third configuration, the target action probability for action 0 is reduced by 0.26 (with the complementary action probability adjusted accordingly); the target context law is changed to (0.88, 0.12); the target response is shifted upward by 0.17 and clipped to [0, 1]; the transport stress shifts context-0 responses downward by 0.18 and context-1 responses upward by 0.18; the true persistence parameter is increased from the declared 0.45 to 0.92 with the same retained separation; and the audit-independence stress reuses 1,000 training estimates while falsely declaring 50,000 independent audit samples. The simulator’s true target values are used only for post-hoc coverage and regret evaluation. Table 9: Full-path coverage conditional on deliberately false certificates being issued. Each condition has 200 seeds. Violation Target action law Target context law Target response Exposure/transport Dependence envelope Audit independence

False issuance 200/200 200/200 200/200 200/200 200/200 200/200

Full-path covered 200/200 200/200 199/200 200/200 200/200 200/200

Mean final radius (95% t CI) 0.323 ([0.318, 0.328]) 0.324 ([0.319, 0.329]) 0.317 ([0.313, 0.321]) 0.324 ([0.320, 0.329]) 0.324 ([0.320, 0.329]) 0.239 ([0.238, 0.240])

Coverage (95% Wilson CI) 100.0% ([98.1, 100]) 100.0% ([98.1, 100]) 99.5% ([97.2, 99.9]) 100.0% ([98.1, 100]) 100.0% ([98.1, 100]) 100.0% ([98.1, 100])

The observed miss count is one out of 1,200 false certificate issuances, and it occurs in the targetresponse condition. This should not be interpreted as evidence that the certificate remains valid under misspecification: the theoretical guarantee does not apply when the stated assumptions are false. In this particular stress design, the reported intervals are wide (mean final average radius approximately 0.239–0.324), which often preserves empirical coverage despite invalid provenance. Thus the key failure is not necessarily immediate undercoverage; it is that the interface accepts a false attestation and cannot independently discover a concealed violation. The width result must be read alongside coverage rather than as a robustness guarantee. As a control, we separately declared each corresponding required provenance flag invalid. The implementation rejected all six disclosed-invalid controls (6/6). This tests the software gate behavior only: it does not show that the gate can detect a false assertion that remains marked valid. (a) Full-path coverage under false issuance

(b) Mean final certificate radius 0.35

0.99

Mean final average radius

Full-path coverage (200 seeds)

1

0.98

0.97

100.0%

100.0%

100.0%

100.0%

100.0%

99.5%

0.96

0.323

0.324

0.324

0.317

0.324

0.3 0.25

0.239

0.2 0.15 0.1 0.05

0.95 on

Acti

text

Con

se

pon

Res

e

osur

Exp

nce

ende

Dep

it Aud

0

e

reus

on

Acti

text Con

se

pon

Res

e

osur

Exp

nce ende

Dep

it Aud

e

reus

Figure 31: Certificate diagnostics under hidden assumption violations. (a) Full-path coverage conditional on false certificate issuance under six hidden assumption violations, with Wilson 95% confidence intervals. (b) Mean final average certificate radius under the same violations, with 95% Student-t intervals across seeds.

62

This experiment is a finite-simulation diagnostic, not a universal misspecification theorem. The severity and form of each perturbation are fixed as stated above; the observed coverage rates cannot be extrapolated to arbitrary violations. In particular, high empirical coverage under these perturbations is partly attributable to conservative, relatively wide intervals and does not validate the false assumptions. H.2.1

Severity of concealed target-law misspecification

We further examine how the empirical validity of a previously issued seven-component certificate responds to the magnitude of an unreported target-law change. We retain the finite-state certificate interface and the same frozen training, independent audit, and logged-score streams across severity levels. Only the simulator’s target-regime law is changed without updating the attestation. For each of 64 paired seeds, the online algorithm evaluates three configurations for 120 rounds with 1,200 scoring windows per round. We prespecify magnitudes ξ ∈ {0, 0.10, 0.20, 0.35, 0.50} and test four target-law mechanisms: target-response means, target-action assignment probabilities, target-context mixture probabilities, and the action-specific target/logging response transport. The same online ξ trajectory is tested against the resulting target value W∞ (z; 0), so the comparisons isolate a hidden identification failure rather than algorithmic random-seed changes. Severity of incorrect calibration claims

Table 10: Full-path simultaneous target-value coverage for concealed misspecification; 64 paired seeds per scenario (each row uses the same 64 seeds, so the rows are not independent replications). All incorrect assumptions at positive severity are deliberately asserted valid by the attestation. Values in parentheses are the maximum population target-value shifts induced by the mechanism. Hidden target-law change

ξ = 0.20

ξ = 0.35

ξ = 0.50

Target response Target action Target context Exposure/transport

54/64 (.200) 1/64 (.346) 0/64 (.453) 64/64 (.034) 64/64 (.059) 64/64 (.084) 64/64 (.001) 64/64 (.002) 64/64 (.003) 64/64 (.098) 63/64 (.171) 15/64 (.244)

Full-path simultaneous coverage

Target response Target action

Target context Exposure / transport

1 0.8 0.6 0.4 0.2 0 0

0.1 0.2 0.3 0.4 Concealed misspecification magnitude

0.5

Figure 32: Sensitivity of the issued seven-component certificates to concealed, predeclared target-law shifts. Bands are Wilson 95% intervals across 64 paired seeds; the same seeds are reused across severity levels. Fullpath coverage is simultaneous over all configurations and examined rounds. The curve does not represent a validity guarantee under misspecification.

At the largest target-response shift, none of the 64 paths remains covered, whereas the same certificate covers all paths with shifts at most 0.10. For exposure/transport shifts of magnitude 0.50, coverage is 15/64. The target-context perturbation leaves the target value almost unchanged (maximum shift 0.0031), and its high coverage must not be interpreted as robustness to a comparably large targetvalue error. The mean final certificate radius is 0.326 and is unchanged across severity because it is computed from the unmodified attested evidence. The stress test therefore characterizes the failure boundary of an incorrectly attested certificate; it does not weaken the conditional coverage guarantee under correctly verified assumptions in Theorem 1.

I

Limitations and Societal Implications

I.1

Limitations

Conditional validity of causal certificates. The general value certificate depends on correctly specified and independently justified allowances for joint action–exposure overlap, target-law estimation, exposure and response transport, context shift, clipping, and temporal dependence. Observable discrepancy statistics and fitted effective sample sizes are diagnostics, not substitutes for validated bounds. If any required allowance cannot be calibrated, the resulting interval should not be interpreted as an operational coverage guarantee. The anytime finite-sample certificate in Proposition 1 applies only to its stated known-local-interference model; it does not certify the general black-box setting.

63

Scope and computational burden. An incomplete exposure map can omit influential neighboring actions, and action-law correction alone cannot identify the no-exploration steady-state context distribution. Broad interference or weak joint overlap may therefore leave target values insufficiently identified. Evaluating multiple configurations also requires nuisance fitting, joint-exposure weighting, and calibration or auditing; these costs can increase with configuration count, exposure complexity, and dependence. We do not establish a general bound on wall-clock, memory, or audit cost for large production networks. Limits of empirical generalization. The controlled ring comparisons use 24 paired seeds over 200 rounds; the independent coverage audit is a separate protocol; and METR-LA/FlockLab experiments are 180-round semi-synthetic replays with eight seeds per condition and model-generated counterfactual outcomes. They are not live deployment tests or evidence that the general certificate is calibrated on either trace. Under low mismatch, Greedy-Raw can outperform CAUSAL-UCB in target regret; under high mismatch, lower target regret can come with greater measurement-induced deployment loss. Hence neither uniform superiority nor deployment safety follows from these experiments. I.2

Potential Societal Impacts and Responsible Deployment

Correcting the discrepancy between logged exploratory rewards and no-exploration target values could improve the auditability of network-wide configuration choices and make measurement costs more visible. However, in operational networks, exploration itself may degrade service, and optimizing an aggregate utility can conceal disproportionate effects on individual nodes, users, or regions. Misspecified exposure representations or unverified transport assumptions could also produce overconfident decisions. Depending on the application, fine-grained network telemetry may create privacy or security risks. Before any real-world use, system operators should assess application-specific safety constraints, impose exploration budgets and fallback or rollback rules, examine disaggregated service-quality outcomes, minimize access to sensitive telemetry, and independently validate the certificate’s required assumptions and error allowances. These are proposed deployment precautions, not safeguards experimentally implemented or certified in the present study.

64

Related documents

• Scalable Clustered Network Connectedness with Control Variables: Theory and Application to Global Banking#973422
• PAC-Causal Learnability: From Identification to Finite-Sample Guarantees#1355914
• Network threats to causal inference: Variations in network position by participation in randomized controlled trials.#143309
• Minimum Specification Perturbation: Robustness as Distance-to-Falsification in Causal Inference#1141528
• Causal Foundation Models#925376