arXiv CSopen access

NOETHER: A Constructive Framework for Metamorphic Pattern Discovery from Operator Algebras

NOETHER: A Constructive Framework for Metamorphic Pattern Discovery from Operator Algebras

arXiv:2605.17390v1 [cs.SE] 17 May 2026

MENG LI∗ , School of Computing, University of South China, China, Hunan Engineering Research Center of Software Evaluation and Testing for Intellectual Equipment, China, and CNNC Key Laboratory on High Trusted Computing, China XIAOHUA YANG, School of Computing, University of South China, China, Hunan Engineering Research Center of Software Evaluation and Testing for Intellectual Equipment, China, and CNNC Key Laboratory on High Trusted Computing, China JIE LIU, School of Computing, University of South China, China, Hunan Engineering Research Center of Software Evaluation and Testing for Intellectual Equipment, China, and CNNC Key Laboratory on High Trusted Computing, China SHIYU YAN, School of Computing, University of South China, China, Hunan Engineering Research Center of Software Evaluation and Testing for Intellectual Equipment, China, and CNNC Key Laboratory on High Trusted Computing, China Context. Metamorphic Testing is recognised in IEEE/ISO software-testing standards and increasingly recommended for AI systems, but its progress is bottlenecked by metamorphic relation (MR) identification: existing approaches (structured frameworks, mining and evolutionary pipelines, LLM-assisted methods, MetaPattern catalogues) share an inductive grounding that leaves three foundational questions open: origin, closure, and transferability. Objective. We propose a framework whose downstream step from program-induced operator algebra to MetaPattern set is mechanical and provable, while making the upstream curation of the algebra a stated empirical hypothesis with an explicit scope precondition. Method. We introduce NOETHER, a two-layer framework. The upstream layer is an eight-block decomposition over recurrent mathematical structures (symmetry, order, self-adjoint, time-reversal, limit, qualitative-dynamics, method-comparison, relational equivalence), curated as an empirical hypothesis. The downstream layer is the CONSTRUCT-MP algorithm: given the decomposition, it produces a MetaPattern set with an algebraic-closure guarantee under the Translate operator (Theorem 1) and polynomial-time decidability under a finite generating set (Theorem 2). Theorem 1 converts an empirical-adequacy claim into a structural-adequacy obligation within an explicitly bounded scope. We test the framework on three operatoralgebraic domains and an empirical head-to-head against an automated SOTA baseline. Results. On Boltzmann reactor physics the framework systematises a prior inductive catalogue and reclassifies further equivalence classes; on equivariant ML it derives executable MRs for rotation invariance, ∗ Corresponding author.

Authors’ Contact Information: Meng Li, [email protected], School of Computing, University of South China, Hengyang, China and Hunan Engineering Research Center of Software Evaluation and Testing for Intellectual Equipment, Hengyang, China and CNNC Key Laboratory on High Trusted Computing, Hengyang, China; Xiaohua Yang, School of Computing, University of South China, Hengyang, China and Hunan Engineering Research Center of Software Evaluation and Testing for Intellectual Equipment, Hengyang, China and CNNC Key Laboratory on High Trusted Computing, Hengyang, China; Jie Liu, School of Computing, University of South China, Hengyang, China and Hunan Engineering Research Center of Software Evaluation and Testing for Intellectual Equipment, Hengyang, China and CNNC Key Laboratory on High Trusted Computing, Hengyang, China; Shiyu Yan, School of Computing, University of South China, Hengyang, China and Hunan Engineering Research Center of Software Evaluation and Testing for Intellectual Equipment, Hengyang, China and CNNC Key Laboratory on High Trusted Computing, Hengyang, China. arXiv preprint, 2026. ACM ISBN 978-x-xxxx-xxxx-x/YYYY/MM https://doi.org/10.1145/nnnnnnn.nnnnnnn

ACM Trans. Softw. Eng. Methodol., Vol. 0, No. 0, Article 0. Publication date: 2026.

0:2

Meng Li, Xiaohua Yang, Jie Liu, and Shiyu Yan

adjoint duality, and training-trajectory reversibility; on relational query optimisers it exercises the relationalequivalence block. The central falsifiable prediction — L ∗ -blindness on homogeneity-preserving mutators, derivable ex-ante from the algebra and the mutator specification — holds on the in-scope substrate. The empirical head-to-head against a GP-evolved baseline reports Set N dominated on the scope-matched D1 stratum; the framework’s contribution is read as algebraic derivability, per-block complementarity, and an outof-scope D2-stratum boundary no inductive baseline can derive. The absolute-completeness conjecture (Theorem 1′ ) is falsified on APWR via two independent counterexamples that identify five Translate-extension dimensions, with five further candidate dimensions on the equivariant-ML and relational-query algebras as the principal locus of follow-up work. Conclusion. NOETHER lifts induction from per-program MR sampling to a stable per-domain algebraic layer; the downstream step is deductive and mechanical, while the upstream empirical layer is stated as an explicit hypothesis with documented out-of-scope cases (web applications, RLHF reward models, distributedconsensus protocols, compiler-internal optimisations). CCS Concepts: • Software and its engineering → Software testing and debugging; Software verification and validation; • Theory of computation → Algebraic semantics. Additional Key Words and Phrases: metamorphic testing, metamorphic relation identification, MetaPattern, operator algebra, algebraic closure, equivariance, mutation testing, software testing foundations

1

Introduction

Noether’s first theorem replaced an empirically curated catalogue of conservation laws with a derivation from the structure of an action functional.1 A catalogue of observed invariants can sometimes be replaced by a derivation procedure grounded in the underlying structure. The replacement does not eliminate empirical work; it lifts the empirical step from per-instance enumeration to per-domain structural identification, one cycle of induction per stable domain rather than per program. Software testing faces a related problem. Metamorphic Testing (MT), introduced by Chen et al. in 1998 [1], was admitted into the IEEE/ISO/IEC software-testing standards in 2022 [2] and has been increasingly endorsed as a technique for testing AI and machine-learning systems [3, 4]. Its central artefact is the metamorphic relation (MR): a property that constrains how a program’s outputs must covary across multiple executions, thereby substituting for an explicit oracle in domains where one cannot exist. Despite MT’s maturity, MR identification, the task of deciding which properties hold for a program under test, remains its binding constraint. Practitioners report three recurring difficulties: high dependence on tester domain knowledge, mutually incompatible MR formulations for the same program, and low reuse of MR sets across teams or projects [3, 4]. Recent work has responded at the application layer, by mining MRs for particular domains, and at the integration layer, by automating search through evolutionary, mining-based, or LLM-assisted pipelines [5–7]. The foundational layer has not advanced at the same pace. The principal artefact at that foundational layer is the MetaPattern (MP): an equivalence class over MRs that captures a recurrent structural strategy a tester invokes when reasoning about program properties. MetaPatterns organise the otherwise unbounded MR design space into a small, interpretable scaffold; methods that exploit them, including the structured MR identification approaches METRIC [8] and METRIC+ [9], and the recent wave of LLM-prompted MR generators, depend on the scaffold’s quality. Yet across the literature, MetaPattern catalogues continue to be assembled in the same way conservation laws were assembled before 1918: by induction over 1 The theorem appeared in Noether’s 1918 paper Invariante Variationsprobleme, addressing a question Hilbert and Klein

had raised about energy conservation in general relativity. We do not invoke it as a theorem about programs: program semantics and metamorphic relations do not provide an action functional. The analogy is methodological only.

ACM Trans. Softw. Eng. Methodol., Vol. 0, No. 0, Article 0. Publication date: 2026.

NOETHER: A Constructive Framework for Metamorphic Pattern Discovery from Operator Algebras

0:3

observed examples. A typical proposal lists 𝑘 patterns drawn from cluster analysis or expert codification, demonstrates that the patterns “cover” some corpus of MRs to a target threshold, and stops. None of the existing MP proposals, including the authors’ own prior work on five reactorphysics patterns, answers the three questions that any foundational theory of MetaPatterns should answer: (1) Origin. Why exactly these MetaPatterns and not others? What is the structural source of an MP, as distinct from an empirical regularity in the corpus on which it was induced? (2) Closure. Under what mathematical conditions is a discovered MP set closed under a stated derivation operator, in the sense that it is guaranteed not to miss patterns reachable through the operator from a structurally fixed input? Absolute completeness over all properties one might write over the underlying structure is a strictly stronger demand and remains open in general. (3) Transferability. When the program family changes (from reactor physics to naturallanguage inference, from numerical libraries to recommender systems), how does the MP set change, and can the new set be obtained without re-running the entire empirical induction in the new domain? We call this the origin–closure–transferability gap. The gap matters because it explains why MR sets continue to grow as one-off artefacts. Without a structural source, there is no clear boundary on what the pattern space contains. Without a transfer rule, a relation written for one program rarely moves cleanly to another, even when both programs share a deep structural template. These are not only tooling limitations; they follow from grounding MetaPatterns in observed examples rather than in the structure that makes the relations hold. This paper proposes such a structural source. We introduce NOETHER, a constructive framework that derives MetaPatterns from the operator-algebraic structure of the program family under test. The framework extracts MetaPatterns from invariants of an operator algebra A𝑃 (formally defined in Section 3.1) that captures the program family’s mathematical scaffolding. Given A𝑃 , NOETHER produces a MetaPattern set M(A𝑃 ) (constructed by the algorithm of Section 3.2) together with a closure guarantee over the algebra-induced MR space. Given a different program family with a different algebra A𝑃 ′ , the same construction produces M(A𝑃 ′ ) without re-running empirical induction. The framework does not abolish induction: domain experts must still distil A𝑃 from program semantics, and Section 5 states this limitation explicitly. What becomes algebraic is the downstream step from A𝑃 to the MetaPattern set. Figure 1 summarises the two-layer architecture. We make four contributions. • C1. We introduce NOETHER, a two-layer framework for MetaPattern discovery that combines an empirically curated eight-block decomposition (Hypothesis 1; upstream layer, itself partly distilled from the present authors’ prior 84-MR PWR catalogue, see §3.3.3 for provenance) with a constructive algorithm for deriving MetaPatterns from a program-induced operator algebra (downstream layer). • C2a (positive theory). Given the eight-block decomposition, we prove an Algebraic Closure Theorem (Theorem 1): the constructed MetaPattern set is closed under the framework’s Translate operator over the algebra-induced MR space MR(A𝑃 ). Theorem 1 converts an empirical-adequacy claim (“our pattern grid covers 𝑋 % of observed MRs”) into a structuraladequacy obligation (“every Translate-reachable MR is assigned to a unique block under the canonical-block ordering of Definition 14”); we acknowledge in Section 3.2.3 that the closure is by-construction within the explicit scope of Definition 13, and document the three classes ACM Trans. Softw. Eng. Methodol., Vol. 0, No. 0, Article 0. Publication date: 2026.

0:4

Meng Li, Xiaohua Yang, Jie Liu, and Shiyu Yan UPSTREAM (empirical hypothesis) expert + LLM grid

Program family 𝑃

Hypothesis 1

Operator algebra A𝑃

Block decomposition D (A𝑃 ) ∗ , L ∗, D ∗, E ∗, B ∗ } {𝐺, 𝑂 ≤ ,𝑇 ∗ , Trev rel

CONSTRUCT-MP

Boltzmann reactor physics (§3.3)

MetaPattern set M(A𝑃 )

Translate

Algebra-induced MR space MR(A𝑃 ) Equivariant ML (§3.4)

Theorem 2 poly-time

Theorem 1 closure

Relational query optimisers (§3.5)

DOWNSTREAM (mechanical, provable)

Fig. 1. NOETHER framework architecture (two layers). The upstream layer curates the program family’s operator algebra A𝑃 and its eight-block decomposition as an empirical hypothesis (Hypothesis 1). The downstream layer mechanically derives the MetaPattern set M(A𝑃 ) via CONSTRUCT-MP, with closure under Translate over MR(A𝑃 ) (Theorem 1) and polynomial-time decidability under a finite generating set (Theorem 2). The framework is instantiated on three structurally distinct domains (§3.3, §3.4, §3.5) to test transferability at the algebra-skeleton level.

of MRs outside that scope (Remark 5). Polynomial-time decidability of CONSTRUCT-MP holds when the algebra admits a finite generating set (Theorem 2). • C2b (negative theory). The strictly stronger absolute-completeness conjecture (Theorem 1′ / Conjecture A), over arbitrary properties expressible in A𝑃 , is false on APWR : two MRs from the standard PWR safety-analysis literature (non-additivity of rod-bank reactivity worth; second-order mixed dependence of 𝑘 eff on moderator temperature and boron concentration) are formulable over APWR but not in MR(APWR ) (§3.6, Appendix A). The two MRs identify five structural obstructions in Translate’s signature, with pairwise independence established by per-block exhaustion. Companion surveys on Aequi and Arel (§3.5) identify five further candidate dimensions (two on Aequi specialising PWR-side dimensions; three net on Arel ), yielding ten Translate-extension dimensions across the three algebras; pairwise independence on the candidate five is asserted by inspection, with formal per-dimension exhaustion committed as follow-up. Scope statements are in Section 3.2.3. • C3. We instantiate NOETHER on a real-world program family and show how it systematises and re-classifies previously catalogued patterns. The framework reproduces three prior MetaPatterns, refines two on a sounder algebraic basis, and includes a deflationary correction direction (revealing that the inductive grid was over-counted on some sub-families and under-counted by the absence of 𝑚 adj and 𝑚 rev ). The two structurally distinct re-classified equivalence classes are not de novo discoveries; domain experts could have written them down. NOETHER’s contribution is the algebraic warrant for treating them as separate MetaPatterns within a uniform structure. The deflationary direction is non-circular relative to the prediction caveat of §3.3.3: §4.4 demonstrates it on three independent test cases (a sorting library; Murphy et al. 2008’s six-class ML categorisation [10] re-decoded against a feedforward classifier algebra; the prior reactor-physics catalogue itself), without invoking 𝑇 ∗ or T ∗ structure that was curated from reactor physics. • C4. We demonstrate structural transferability at the algebra-skeleton level (not crossdomain empirical superiority), within the framework’s scope precondition, by instantiating NOETHER on three structurally distinct operator-algebraic domains: Boltzmann reactorphysics transport, equivariant ML (Section 3.4), and relational query optimisers (Section 3.5); ACM Trans. Softw. Eng. Methodol., Vol. 0, No. 0, Article 0. Publication date: 2026.

NOETHER: A Constructive Framework for Metamorphic Pattern Discovery from Operator Algebras

0:5

the last exercises the relational-equivalence block, whose algebraic skeleton differs from the Lie-group / self-adjoint / time-reversal core. A small-scale comparative case study, a DeepCrime-style real-fault pilot (𝑛 = 5, underpowered for 𝛼 = 0.05), and a cross-codebase pilot replication on Apache Commons Math (𝑛 = 3 SUTs, 77 mutants) report data consistent with the structural-coverage prediction within case-study scope; the case study’s category-(iv) detection contrast exhibits construct validity rather than averaged superiority. A larger comparative evaluation against three SOTA representatives (GP-evolved, LLMassisted, mining-based) is reported as a pre-registered protocol. Scope of contribution. This is a theoretical paper, and its contribution is systematisation rather than deduction from first principles. The eight blocks are curated by inspecting mathematical structures that recur across the program families we have studied; they are not derived from an algebraic axiom. The framework therefore has two layers: an upstream layer (curating A𝑃 and its block decomposition) that remains empirical and human, and a downstream layer (mechanically deriving M(A𝑃 ) from A𝑃 ) that is algorithmic and provable. We do not claim to have eliminated induction from MetaPattern discovery. We move induction one level up, from “what MetaPatterns recur in observed MR samples?” to “what algebraic structures recur in the program families practitioners care about?”, and make the downstream step mechanical. The engineering payoff of this re-grounding awaits empirical follow-up work; comparative evaluation against existing automated MR-identification pipelines is reported as a protocol in Section 4.1 and constitutes part of the framework’s resubmission obligations. Boundary of contribution This paper establishes: (1) Algebraic closure of M(A𝑃 ) under Translate over the algebra-induced MR space MR(A𝑃 ) for the operator algebras stated, given a block decomposition (Theorem 1; closure is by-construction within the explicit scope of Definition 13, see Remark 5). Closure over the strictly larger space of arbitrary properties expressible in A𝑃 is Theorem 1′ , falsified on APWR (see item (a) below); (2) Polynomial-time decidability of CONSTRUCT-MP under explicit complexity assumptions (Theorem 2); (3) Three non-vacuous instantiations: Boltzmann reactor physics (§3.3), equivariant ML (§3.4), and ∗ extends the framework relational query optimisers (§3.5); the relational-equivalence block Brel beyond the Lie-group / self-adjoint / time-reversal mathematical core. It does not establish: (a) Absolute completeness over arbitrary properties expressible in A𝑃 . This is Theorem 1′ (Conjecture A, Appendix A); §3.6 establishes that it is false on the PWR core diffusion algebra APWR via two independent counterexamples (non-additivity of rod-bank reactivity worth, and secondorder mixed dependence of 𝑘 eff on moderator temperature and boron concentration), identifying five structural obstructions in Translate’s signature whose pairwise independence is proved by per-block exhaustion (Appendix A). Companion surveys on Aequi and Arel (§3.5, companion artefacts in theory/) identify five further candidate dimensions on those algebras (so the falsification is not PWR-specific). Pairwise independence on the candidate five is asserted by inspection rather than by formal exhaustion proof; full per-dimension exhaustion proofs on Aequi and Arel are committed as follow-up. The question of whether a Composite-Translate extension absorbs the ten Translate-extension dimensions identified across the three algebras while preserving Theorem 1’s closure and Theorem 2’s polynomial-time decidability remains open. (b) Sufficiency of the eight-block list. Hypothesis 1 is an empirical hypothesis with six enumerated out-of-scope program-family classes (Remark 2); each such class is a candidate ninth block.

ACM Trans. Softw. Eng. Methodol., Vol. 0, No. 0, Article 0. Publication date: 2026.

0:6

Meng Li, Xiaohua Yang, Jie Liu, and Shiyu Yan

(c) Superiority over existing automated MR-identification pipelines on average. The comparative evaluation in §4.1 establishes effects for specific defect categories on small benchmarks; it does not characterise the framework’s behaviour on arbitrary defect distributions. (d) Elimination of induction from MetaPattern discovery. Induction is relocated from MR-instance level to algebra-block level, not eliminated.

The remainder of the paper is organised as follows. Section 2 surveys the four lines of prior work; Section 3 presents the NOETHER framework, including operator-algebraic preliminaries (§3.1), the construction algorithm and two theorems (§3.2), three structurally distinct instantiations on Boltzmann reactor physics (§3.3), equivariant ML (§3.4), and relational query optimisers (§3.5), and the falsification of the absolute-completeness conjecture (§3.6); Section 4 reports the empirical evaluation against five research questions including the cross-domain case study (§4.1), the L ∗ -blindness prediction (§4.2), and head-to-head comparisons against GenMorph (§4.2.7) and METRIC+ (§4.3); Section 5 discusses threats and limitations; Section 6 concludes. Appendix A contains the proofs of Theorems 1, 2, 1′ (including the per-block exhaustion on APWR ). Supplementary S1–S9 carry illustrative material migrated for length, including NOETHER on the remaining reactor equations (S9, A), per-MR provenance (S9, B), the worked Boltzmann CONSTRUCT-MP enumeration (S9, C7), a Python reference implementation (S9, D), and the construct-trace consistency check (S9, E). 2

Background and related work

We organise prior work along four lines: MT/MR fundamentals and the long-standing identification bottleneck; structured MR identification through METRIC and METRIC+; automated MR identification, including MR-Scout, GenMorph, and LLM-assisted approaches; and MetaPattern catalogues, including our prior reactor-physics taxonomy. These lines differ in mechanism, but they share one limitation: their pattern structures are induced from observed MRs rather than derived from the mathematical structure that makes those MRs hold. 2.1

Metamorphic testing and the MR identification bottleneck

Metamorphic Testing was introduced by Chen, Cheung, and Yiu in 1998 to address the test-oracle problem [1]. An MR is a logical implication of the form 𝑅𝑖 (𝑥 1, . . . , 𝑥𝑛 ) ⇒ 𝑅𝑜 (𝑃 (𝑥 1 ), . . . , 𝑃 (𝑥𝑛 )), where 𝑃 is the program under test, 𝑅𝑖 is an input relation, and 𝑅𝑜 is an output relation. When 𝑅𝑖 holds but 𝑅𝑜 fails on actual executions, a fault is reported, without any need to know the absolute correct output of any single execution. Over two decades MT has become standard equipment for testing systems whose oracles are otherwise inaccessible: scientific computing, machine learning classifiers, autonomous vehicles, search engines, compilers, and large language models [3, 4]. The community has long acknowledged a single binding constraint on MT’s effectiveness: MR identification. Surveys spanning twenty years agree that identifying high-quality MRs requires (i) deep familiarity with the program’s functional semantics, (ii) substantive domain background (physical, mathematical, or linguistic, depending on the system), and (iii) the ability to convert that background into executable property assertions [3, 4]. Liu et al. [11] provide the canonical empirical evidence that even ad-hoc MRs detect a substantial fraction of mutants given modest tester training, while Murphy et al. [10] catalogued the structural properties of ML applications relevant to MR design and Xie et al. [12] demonstrated that MT scales effectively to supervised classifiers. Testers without sufficient domain background tend to identify only “trivial MRs”. A 2024 survey explicitly identifies AI assistance, especially via large language models, as the most promising open avenue for closing the identification gap [4]; Saha and Kanewala [13] report that, ACM Trans. Softw. Eng. Methodol., Vol. 0, No. 0, Article 0. Publication date: 2026.

NOETHER: A Constructive Framework for Metamorphic Pattern Discovery from Operator Algebras

0:7

on a 709-mutant benchmark for supervised classifiers, current MR sets detect only 14.8%, which exposes the gap. Beyond difficulty, the MR identification bottleneck has a more troubling structural feature: even when MRs are identified, the field has accumulated little consensus on how they are identified. Different authors confront the same program and produce dissimilar MR sets. Once written, an MR rarely migrates: a relation drafted for one ML classifier seldom transports to another, and a relation drafted for one numerical solver seldom transports across solver families. 2.2

Structured MR identification: METRIC and METRIC+

Structured MR identification has already moved the field away from ad hoc relation design. METRIC organises MR construction around an “input/output category” framework: the tester first identifies relevant categories of input transformations and output relations, then composes MRs from category pairs [8]. METRIC+ extends this scheme by enriching the category catalogue and providing systematic combination rules that reduce the human burden in category enumeration [9]. Both approaches are widely cited and remain the strongest existing attempt to give MR identification an explicit scaffold. Our disagreement is not with this direction but with its grounding. The categories are introduced through expert curation and validated by empirical coverage on benchmark programs. This leaves two of our three foundational questions unanswered. Origin: METRIC and METRIC+ do not derive their categories from program-level mathematical structure. Closure: neither framework provides a mathematical condition under which the category set is guaranteed to be complete; coverage is reported but not proved. The third question, transferability, is only partially addressed. The same category templates can be invoked across domains, but because the categories are not algebraically bound to specific program structures, transfer rests on an assumption of universality that remains open. 2.3

Automated MR identification

Automated MR identification attacks the bottleneck by searching for executable relations more directly. MR-Scout mines MRs from existing test suites by extracting input-transformation and output-assertion patterns from test-case pairs and abstracting them into reusable relations [5]. GenMorph evolves MR candidates through genetic programming, co-evolving input transformations with output assertions and using mutation-killing as the fitness signal [6]. Shin et al. derive executable MRs from natural-language requirements through few-shot prompting of a large language model, with validation through an industrial questionnaire study with Siemens [7]; further LLM-assisted variants, including ChatGPT-driven MR generation [14], domain-customised GPTs for autonomous-driving simulators [15], and multi-agent retrieval-augmented pipelines for trafficrule MRs [16], extend this template into safety-critical or rule-rich domains. Within ML-system testing, differential-testing approaches such as DeepXplore [17] use input-transformation invariance as a proxy oracle, complementary to the explicit MR formulation we adopt here. A second strand uses program-structure features rather than test-case mining. Kanewala et al. [18] predict MRs of scientific software via graph-kernel learning over control-flow and datadependency graphs, an early demonstration that program structure carries enough signal for automated MR discovery. Nolasco et al.’s MemoRIA [19] infers MRs by deriving an objectprotocol abstraction and validating candidates through fuzzing plus SAT-based reduction, then evaluates on 22 Java subjects. Tao et al.’s Mettoc [20] applied MT to compiler testing using equivalence-preservation as the canonical relation. Ying et al. [21] formalise relationships between metamorphic-relation patterns into family trees, and Altamimi et al. [22] provide a recent systematic literature review of MR-automation work that catalogues the structural-vs-empirical-search ACM Trans. Softw. Eng. Methodol., Vol. 0, No. 0, Article 0. Publication date: 2026.

0:8

Meng Li, Xiaohua Yang, Jie Liu, and Shiyu Yan

divide our framework targets. Earlier LLM-assisted attempts include Zhang et al. [14] on ChatGPTdriven MR generation. Each of these methods advances automation on a different axis, but all treat the MR space as an empirical search space. MR-Scout’s recall is bounded by the relations already latent in existing tests. GenMorph’s evolutionary search is shaped by the fitness landscape induced by mutation killing. LLM-prompted approaches are sensitive to prompt phrasing when no structural prior constrains the generation. None of these methods can state, before search begins, which MR types lie outside its reach, because none has an algebraic account of the space being searched.

2.4

MetaPattern catalogues and empirical adequacy

MetaPattern catalogues organise the post-hoc inventory of identified MRs into a smaller vocabulary of recurring strategies. Such catalogues typically result from clustering observed MRs, codifying expert intuitions about “kinds of properties testers reason about”, and validating the catalogue’s coverage on a benchmark MR corpus. Reactor-physics test suites have produced taxonomies of conservation, monotonicity, convergence, trajectory, and partial-order patterns [23, 24]; Zhou et al. [25] introduced an explicit symmetry metamorphic relation pattern as a reusable abstraction for deriving concrete MRs across applications; Ying et al. [21] formalises the relationships between MR patterns into family trees with explicit refinement and specialisation edges, and reports a SOTA pattern hierarchy that organises previously proposed patterns into a single classification structure. The most recent state-of-the-art survey of MR generation [4] maps the field’s twenty-year output across pattern catalogues, mining, evolutionary search, and LLM-prompted methods. Adequacy frameworks such as the Pattern–Matrix Coverage Metric assess how thoroughly a given MR set occupies the pattern space. Ying et al.’s family-tree formalism [21] is the closest published cousin to NOETHER’s MetaPattern equivalence-class structure: both organise MR patterns into a hierarchy with explicit relationships between patterns. The two formalisms differ in the relationship type. Ying et al.’s family tree is a refinement/specialisation tree rooted in informally-named pattern categories (symmetry, additive, multiplicative, etc.); NOETHER’s MetaPattern equivalence classes are quotients of the algebra-induced MR space MR(A𝑃 ) under structural equivalence (Definition 13), with each class derived from a specific block of D (A𝑃 ). A family-tree node in Ying et al. typically corresponds to one or more NOETHER MetaPatterns when the node admits an operator-algebraic specification (e.g. Ying et al.’s “symmetry” parent node decomposes into the 𝐺-block MetaPattern 𝑚 inv for finite-group symmetries plus the 𝑇 ∗ -block MetaPattern 𝑚 adj for self-adjoint dualities under ∗ MetaPattern has no direct NOETHER’s eight-block decomposition); conversely, NOETHER’s Brel counterpart in the family-tree formalism because relational-algebra equivalences were not in Ying et al.’s benchmark set. The two formalisms are complementary: Ying et al. catalogues patterns inductively at the MR-instance level; NOETHER provides an algebraic warrant for the existence of each pattern, given the operator algebra. A unified family-tree-plus-algebra-block reading of the literature would map each family-tree node to (at most) one NOETHER block when the node has an algebraic source, and would flag family-tree nodes without algebraic source as candidates for the ninth-block list of Remark 2. Four further pattern-catalogue or MR-grammar candidates raised in peer review (Hu et al. 2019; Mariani 2018; Liu et al. 2020; Lin 2020) could not be located through the standard fallback chain (CrossRef, OpenAlex, DBLP, Semantic Scholar, Google Scholar) under the citation profiles provided, and are therefore not cited; the closest verifiable cousins that this revision does add are Zhou et al. [25] and Ying et al. [21].

ACM Trans. Softw. Eng. Methodol., Vol. 0, No. 0, Article 0. Publication date: 2026.

NOETHER: A Constructive Framework for Metamorphic Pattern Discovery from Operator Algebras

0:9

Such catalogues are useful, but each is, by construction, an empirical artefact. None of the existing catalogues, including the present authors’ own, can answer the three foundational questions of Section 1. 2.5

Convergent diagnosis

Across all four lines of work, two problems recur. Unbounded MR emergence: every new domain or new program produces fresh MR formulations. Poor MR reusability: identified MRs do not transport readily across programs that share deep structural similarities. Both problems follow from grounding MetaPatterns inductively. NOETHER replaces that inductive grounding with operatoralgebraic grounding. Comparators in the head-to-head: what is compared and why. The empirical comparison in §4.2 runs Set N against a single executable baseline: Set G (GenMorph’s GP-evolved MRs at the published 30-min GAssert budget, [6]). The other three SOTA categories enumerated in the relatedwork survey contribute differently: METRIC+ [9] is contrasted as a category-enumeration scaffold (§4.3, §4.3) rather than as an executable fault-detection pipeline, because no public METRIC+ implementation auto-generates MRs from a A𝑃 specification — a full PIT-based METRIC+ vs Set N comparison is committed as supplementary S4 (future_work.md) item (i); MR-Scout [5] is omitted from the executable head-to-head because its mining input (a pre-existing test corpus) is structurally absent on the algebra-rich Java substrate of §4.2.3 (the SUTs are stand-alone mathematical methods with synthesised test inputs, not codebases with developer-written tests latent in test files); AutoMT [16] and GPTMR [15] target safety-critical / traffic-rule autonomous driving domains rather than the operator-algebraic substrate, so an in-scope comparator selection from the LLM-assisted line uses an unprompted-by-NOETHER LLM ensemble (Set L; §4.1, §4.2.7) rather than these domain-specialised pipelines. Set B is a literature-MR baseline drawn from MT-for-ML references [3, 7, 16], restricted to point-cloud-classifier-applicable MRs. The single executable headto-head against Set G is therefore the GP-evolved-baseline arm of a three-SOTA-category protocol; the LLM-assisted and mining-based arms are reported with their proper comparator (Set L ensemble at 2 vendors × 5 temperatures, §4.2.7, and the MR-Scout structural-absence rationale above), so the protocol’s three-category framing is preserved at the price of using different arms in different sections. 3

The NOETHER framework

This section presents NOETHER as a self-contained theoretical contribution. Operator-algebraic preliminaries and the eight-block decomposition appear in §3.1; the algebra-induced metamorphic relation space, the CONSTRUCT-MP construction, the algebraic closure theorem (Theorem 1), and the polynomial-time decidability theorem (Theorem 2) in §3.2. The framework is then instantiated on three structurally distinct operator algebras: Boltzmann reactor physics in §3.3, equivariant machine learning in §3.4, and relational query optimisers in §3.5. The section concludes by falsifying the strictly stronger absolute-completeness conjecture, Theorem 1′ , on a fourth program family (PWR core diffusion) via two pairwise-independent counterexamples (§3.6). 3.1

Operator-algebraic preliminaries

This section introduces the algebraic apparatus used by NOETHER. We assume basic familiarity with group actions, equivalence classes, and quotient sets, but not with functional analysis. Each construct is defined at the level needed for the framework and later instantiated in reactor physics and equivariant machine learning. ACM Trans. Softw. Eng. Methodol., Vol. 0, No. 0, Article 0. Publication date: 2026.

0:10

Meng Li, Xiaohua Yang, Jie Liu, and Shiyu Yan

3.1.1 Programs and program-induced operator algebras. Throughout the paper we treat a program 𝑃 as a (possibly partial) computable function 𝑃 : X → Y. The class of programs of interest belongs to a program family F whose members share an underlying mathematical scaffolding. Definition 1 (Program-induced operator algebra). Let 𝑃 belong to a program family F . A program-induced operator algebra of F is a tuple
A F = O, ◦, ∼ F , where O is a set of operators acting on X, Y, or both; ◦ is an operator composition; and ∼ F is an equivalence relation declaring two operator expressions equal whenever they agree on every program of F . 3.1.2

Symmetry groups (building block B1).

Definition 2 (Symmetry group of A𝑃 ). A symmetry group of A𝑃 is a subgroup 𝐺 ≤ A𝑃 whose elements act on X such that, for all 𝑃 ∈ F and all 𝑔 ∈ 𝐺, 𝑃 (𝑔 · 𝑥) = 𝜌 (𝑔) · 𝑃 (𝑥)

∀𝑥 ∈ X,

where 𝜌 : 𝐺 → End(Y) is a (possibly trivial) representation of 𝐺 on Y. 3.1.3

Order operators: monotonicity and linearity (building block B2).

Definition 3 (Monotone operator). 𝑃 is monotone with respect to 𝜃 if 𝜃 1 ≤ 𝜃 2 ⇒ 𝑃 (𝜃 1 ) ≤ Y 𝑃 (𝜃 2 ) (or the reversed inequality, in which case 𝑃 is anti-monotone). Definition 4 (Linear operator). 𝑃 is linear on X0 ⊆ X when 𝑃 (𝛼𝑥 1 + 𝛽𝑥 2 ) = 𝛼𝑃 (𝑥 1 ) + 𝛽𝑃 (𝑥 2 ) for all 𝑥 1, 𝑥 2 ∈ X0 and scalars 𝛼, 𝛽. 3.1.4

Self-adjoint operators (building block B3).

Definition 5 (Self-adjoint operator). Given an inner product ⟨·, ·⟩ on X, an operator 𝐿 ∈ O is self-adjoint if ⟨𝐿𝑥, 𝑦⟩ = ⟨𝑥, 𝐿𝑦⟩ for all 𝑥, 𝑦 in the domain of 𝐿. Self-adjointness encodes a duality between the two arguments of an inner product. Reciprocity theorems in physics, transposed-graph identities in algorithms, and detailed-balance conditions in stochastic processes are all instances. In reactor physics, the adjoint transport formulation is self-adjoint under the appropriate inner product, yielding source-detector reciprocity. 3.1.5

Time-reversal operators (building block B4).

Definition 6 (Time-reversal operator). When X admits a time coordinate, a time-reversal operator T acts on inputs by reversing the time variable, T (𝑥 (𝑡)) = 𝑥 (−𝑡). A program 𝑃 is timereversal symmetric on a sub-family of inputs when 𝑃 (T 𝑥) is determined by 𝑃 (𝑥) through a fixed bijection on Y. Time-reversal applies only where the underlying dynamics admit a reversible sub-family. Dissipative dynamics break this symmetry, so the corresponding MetaPattern is empty for those systems. 3.1.6

Limit operators (building block B5).

Definition 7 (Limit operator). A parametrised limit operator L𝜃 is a family of operators indexed by a parameter 𝜃 such that there exists a limit element L∗ with L𝜃 → L∗ as 𝜃 → 𝜃 ∗ in an appropriate operator topology. ACM Trans. Softw. Eng. Methodol., Vol. 0, No. 0, Article 0. Publication date: 2026.

NOETHER: A Constructive Framework for Metamorphic Pattern Discovery from Operator Algebras

3.1.7

0:11

Qualitative-dynamics operators (building block B6).

Definition 8 (Qualitative-dynamics operator). A qualitative-dynamics operator D is an operator on solution trajectories of an underlying ODE/PDE that extracts qualitative features — extrema, inflection points, monotonic phases, overshoot magnitudes, S-curve transitions, phase-portrait orbits — that are invariant under perturbations preserving the underlying dynamical structure (Sturm-type comparison theorems, dynamical-systems classification). Some MR-relevant invariants are not point-wise but shape-wise: a solution curve may have an overshoot, a single extremum, or a monotone-then-saturating profile. B6 gives these qualitativedynamics MRs their own algebraic root. 3.1.8

Method-comparison operators (building block B7).

Definition 9 (Method-comparison operator). A method-comparison operator E encodes a partial order ⪯ E on numerical or algorithmic methods, where 𝑀1 ⪯ E 𝑀2 asserts that method 𝑀1 produces an approximation no worse than method 𝑀2 in a specified error norm, under specified conditions. 3.1.9 Decomposition of an operator algebra. Given A𝑃 = (O, ◦, ∼ F ), we decompose O along the eight building blocks introduced above: ∗
D (A𝑃 ) = 𝐺, 𝑂 ≤ , 𝑇 ∗, T ∗, L ∗, D ∗, E ∗, Brel , where 𝐺 collects symmetry subgroups, 𝑂 ≤ monotone and linear operators, 𝑇 ∗ self-adjoint operators, T ∗ time-reversal operators, L ∗ limit operators, D ∗ qualitative-dynamics operators, E ∗ ∗ relational-equivalence operators. method-comparison operators, and Brel Definition 10 (Relational-eqivalence block). A relational-equivalence operator is a binary relation ≡ R on expressions over an idempotent semiring (S, ⊕, ⊗, 0, 1) such that 𝐸 ≡ R 𝐸 ′ iff 𝐸 and 𝐸 ′ are equal under all valid evaluation contexts of S, generated by a finite set R rel = {R 1, . . . , R𝐾 } of identity-preserving rewriting rules, each R𝑖 an ordered pair (lhs𝑖 , rhs𝑖 ) of semiring expressions with ∗ collects all such the property eval(lhs𝑖 , 𝐷) =bag eval(rhs𝑖 , 𝐷) on every valid input 𝐷. The block Brel operators. It is empty for program families without idempotent-semiring rewriting structure (Boltzmann reactor physics, equivariant ML) and non-empty for those with it (relational query optimisers, §3.5). Necessity, sufficiency, and the empirical status of the decomposition. We do not claim that the eight blocks are necessary in an absolute sense, that they exhaust all algebraic structures relevant to software testing, or that they follow from first principles. They are an empirical curation: a by-inspection enumeration of mathematical structures that recur across the program families we have studied. The claim is therefore scoped: the eight blocks are currently sufficient for these families, not provably necessary in general. This upstream empirical status is NOETHER’s main limitation as a theoretical framework. Induction has not been eliminated from MetaPattern discovery; it has been moved one level up, from “what MetaPatterns recur in observed MR samples?” to “what algebraic structures recur across program families?” Given such a curated decomposition, the downstream derivation of M(A𝑃 ) becomes mechanical and provably closed in the sense of Theorem 1. We state the eight-block sufficiency as an explicit empirical hypothesis with a documented out-of-scope catalogue. Hypothesis 1 (Eight-block sufficiency). Let 𝑃 be a program belonging to a program family F whose semantics admit an operator-algebraic representation A𝑃 over (i) finite or finite-dimensional symmetry groups, (ii) partial orders with monotone or linear operators, (iii) self-adjoint operators ACM Trans. Softw. Eng. Methodol., Vol. 0, No. 0, Article 0. Publication date: 2026.

0:12

Meng Li, Xiaohua Yang, Jie Liu, and Shiyu Yan

with respect to a fixed inner product, (iv) anti-unitary involutions of a time coordinate, (v) limit operations of analytical (mesh-refinement, parameter-perturbation, or asymptotic) type, (vi) qualitativedynamics attractors of an underlying ODE/PDE, (vii) inter-method comparison partial orders, and (viii) identity-preserving rewriting rule sets on an idempotent semiring. For such families the eightblock decomposition ∗ ¤ ∗ ∪¤ T ∗ ∪¤ L ∗ ∪¤ D ∗ ∪¤ E ∗ ∪¤ Brel D (A𝑃 ) = 𝐺 ∪¤ 𝑂 ≤ ∪𝑇 is sufficient: every operator in A𝑃 relevant to MR derivation is assigned to at least one block. Hypothesis 1 is an empirical hypothesis open to refutation. Remark 1 (Block sufficiency vs. Translate sufficiency). Hypothesis 1 asserts that the eight blocks suffice to assign every operator in A𝑃 relevant to MR derivation. It does not assert that every MR formulable over A𝑃 ’s operators is reachable through the framework’s Translate operator from a single block invariant. Section 3.6 exhibits, on the PWR core diffusion algebra APWR , two MRs whose constituent operators are individually assigned to blocks of D (APWR ) (rod-insertion semigroup; boration and moderator-temperature scaling), yet whose MR content is not in MR(APWR ) in the sense of Definition 13. The block decomposition is therefore a necessary but not sufficient input to MetaPattern construction: Translate’s expressive form (single-block invariants, first-order 𝜋-template, single partial-order direction, operating on 𝑃 (𝑥) tuples rather than on operator-spectrum quantities) is a second, independent constraint on the framework’s reach. This distinction between “block sufficiency” (Hypothesis 1) and “ Translate sufficiency” (open) is made explicit in §3.6. Remark 2 (Known and conjectured out-of-scope program families). The hypothesis is open to refutation. Six families are known or conjectured to fall outside its image and to require an additional block: (1) Symplectic systems. Hamiltonian dynamics whose volume-preserving structure is captured by a symplectic 2-form rather than self-adjointness (𝑁 -body simulators, celestial-mechanics integrators). (2) Sheaf-theoretic / categorical constructions. Programs whose semantics are captured by functors and natural transformations between categories (certified compilers, type-driven program transformations); MRs of the form “commutativity of a square in the underlying category” do not reduce to single-block invariants under the present Translate. (3) Probabilistic / martingale invariants. MRs of the form “E[𝑓 (x𝑡 ) | F𝑠 ] = 𝑓 (x𝑠 ) on a stoppingtime domain” arise in MCMC samplers and stochastic gradient analyses. (4) Topological invariants. MRs of the form “𝑓 ’s level sets have a fixed Betti-number signature” (topological data analysis, shape classifiers) require homological structure absent from the present blocks. (5) Label-consistency for supervised learning. MRs that constrain a model’s predictions against ground-truth labels (e.g. wrong-sign-loss detection on classifiers); the absence of a labelconsistency operator is one reason the §4.1 case study reports zero detection on category-(i) wrong-sign mutations. (6) Empirical parameter-distribution divergence. A probability-distribution divergence operator on parameter-space measures, motivated by the §4.1.1 pilot’s category-v-02/04/05 (activation change, bias removal, weight re-init) which the eight blocks do not detect. An MR of the form 𝐷 KL (𝑝𝜃 ∥𝑝𝜃 +Δ𝜃 ) ≤ 𝜏 for ∥Δ𝜃 ∥ ≤ 𝜖 would lie in such a block. Empirical witness: §4.1.1’s cat-v02/04/05 mutations are not detected by any MR set including Set N; this is that pilot’s principal negative finding for Hypothesis 1. Each family signals a candidate ninth block. The framework’s intended response is to admit the ad∗ ’s scope or to absorb ditional block when the program family demands it, rather than to extend Brel ACM Trans. Softw. Eng. Methodol., Vol. 0, No. 0, Article 0. Publication date: 2026.

NOETHER: A Constructive Framework for Metamorphic Pattern Discovery from Operator Algebras

0:13

the case as “out of scope for MR testing” in some over-broad sense. Concrete examples of MRs that lie outside Theorem 1’s scope are catalogued in Appendix A; one candidate ninth block (metric-stability 𝑀lip ) has an explicit Translate-template design (Remark 4 below). Remark 3 (Domain-level out-of-scope). Beyond the candidate-ninth-block families of Remark 2 (which signal extensions within the framework’s general programme), the following programfamily classes are out of scope for NOETHER in the present form because they admit no operatoralgebraic representation at all: • General web applications (HTTP request/response programs, business-rule engines, contentmanagement systems) whose semantics are state-machine or rule-driven rather than equational. • RLHF reward models and large-language-model agents whose relevant invariants are statistical/measure-theoretic rather than algebraic (calibration, refusal consistency, sycophancy). • Distributed-consensus protocols (Paxos / Raft / Byzantine variants) whose semantics are CRDT- or message-trace-based; the relevant invariants are linearisability and convergence rather than operator-algebraic. • Compiler-internal optimisations (loop transformations, register allocation, instruction scheduling) whose correctness is expressed as a refinement relation on an operational semantics rather than as a property over a fixed input/output algebra. These classes are not candidate ninth blocks; they are domains where the framework’s scope precondition (program family admits an explicit operator-algebraic description) is structurally absent. NOETHER’s reach is therefore consistent with what its scope precondition explicitly requires: SUTs from textbook-codified mathematical, physical, or relational-algebra domains are within reach, and SUTs from general software-engineering domains without such codification are not. Remark 4 (Metric-stability candidate ninth block, 𝑀lip ). Among the candidate ninth blocks of Remark 2, the metric-stability block has the most concrete Translate-template proposal. Define 𝑀lip = (X, 𝑑 X ) → (Y, 𝑑 Y ) as the family of 𝐾-Lipschitz maps between two metric spaces; the induced MetaPattern 𝑚 lip is the equivalence class of pointwise stability inequalities 𝑑 Y (𝑃 (𝑥 ′ ), 𝑃 (𝑥)) ≤ 𝐾 · 𝑑 X (𝑥 ′, 𝑥). The corresponding Translate template constructs a follow-up by metric perturbation 𝑥 ′ = 𝑥 + 𝜀𝑢 (∥𝑢 ∥ = 1, |𝜀 | < 𝛿) and predicates a 𝐾-Lipschitz output bound. Canonical-block ordering would ∗ since metric structure is independent of the eight existing block invariants (no place 𝑀lip after Brel group action on the perturbation set, no partial order on inputs, no self-adjoint operator, no parametric refinement family, no idempotent-semiring rewriting). Theorem 1’s closure proof transfers without modification because 𝑚 lip is single-block algebraically derived. We do not commit to 𝑀lip as part of the canonical decomposition in this paper; we record it in Appendix A as the most concrete sub-instance of Remark 2 item (iv) (topological invariants) that admits an immediate Translate template, and as the empirical orphan in the audit of §3.3.3. 3.2

The NOETHER framework

3.2.1 Algebra-induced metamorphic relations. Before defining algebra-induced MRs we make explicit the Translate operator that converts a single block invariant into an executable MR. Without this definition, the closure result of Theorem 1 would quantify over an undefined construct. Definition 11 (Block invariant). Let 𝑠 ∈ D (A𝑃 ) be one of the eight blocks. A block invariant of A𝑃 under 𝑠 is a pair 𝜄 = (Φ, 𝜋) where Φ is a finite set of operators drawn from 𝑠, and 𝜋 is a relation 𝜋 ⊆ (X × Y)𝑘 for some arity 𝑘 ≥ 1 such that for every 𝑃 ∈ F and every choice of operators
𝑘 𝜙 1, . . . , 𝜙𝑛 ∈ Φ, the tuple (𝑥𝑖 , 𝑃 (𝑥𝑖 )) 𝑖=1 obtained by applying 𝜙 1, . . . , 𝜙𝑛 to a base input 𝑥 ∈ X in the canonical order specified by 𝑠 satisfies 𝜋. We write I𝑠 for the set of block invariants under 𝑠 and ∼𝑠 ACM Trans. Softw. Eng. Methodol., Vol. 0, No. 0, Article 0. Publication date: 2026.

0:14

Meng Li, Xiaohua Yang, Jie Liu, and Shiyu Yan

for the equivalence relation 𝜄 ∼𝑠 𝜄 ′ iff Φ = Φ′ and 𝜋, 𝜋 ′ define the same constraint up to relabelling of input/output coordinates. The relation ∼𝑠 is reflexive, symmetric, and transitive by construction (set equality and constraint equality are equivalence relations); hence ∼𝑠 is a genuine equivalence relation on I𝑠 , justifying the quotient in Step 3 of CONSTRUCT-MP below. Definition 12 (Translate). The Translate operator is the function Translate : I𝑠 × {𝑠} −→ MR(𝑃) that maps a block invariant 𝜄 = (Φ, 𝜋) under block 𝑠 to the metamorphic relation 𝑘
𝜌𝜄,𝑠 : ∀𝑥 ∈ X, ∀𝜙 1, . . . , 𝜙𝑛 ∈ Φ : 𝜋 (𝑥𝑖 , 𝑃 (𝑥𝑖 ))𝑖=1 holds, 𝑘 is generated by applying the 𝜙 in the canonical order specified by 𝑠 where the input tuple (𝑥𝑖 )𝑖=1 𝑗 (the convention is fixed per block: e.g., for 𝑠 = 𝐺, 𝑥𝑖 = 𝑔𝑖 · 𝑥 0 with 𝑔𝑖 enumerated by group orbit; for 𝑠 = 𝑇 ∗ , the tuple ranges over the two arguments of the inner product). Translate is well-defined because (i) the per-block canonical order resolves any ambiguity in tuple generation, and (ii) ∼𝑠 equivalent invariants are mapped to MRs that are ∼-equivalent as logical statements over 𝑃. Per-block instantiations of Translate are tabulated in Appendix A.

Definition 13 (Algebra-induced MR). Let A𝑃 be a program-induced operator algebra and let 𝜌 be an MR over a program 𝑃. We say 𝜌 is induced by A𝑃 — written 𝜌 ∈ MR(A𝑃 ) — when there exist (i) a block 𝑠 ∈ D (A𝑃 ), (ii) a block invariant 𝜄 ∈ I𝑠 , and (iii) the equality 𝜌 = Translate(𝜄, 𝑠) holds in the sense of Definition 12. Properties of 𝑃 that constrain executions but cannot be obtained as Translate(𝜄, 𝑠) for any single block 𝑠 and any invariant 𝜄 ∈ I𝑠 are not algebra-induced in this sense; concrete examples are catalogued in Appendix A. 3.2.2 Construction of the MetaPattern set. We present the deductive procedure CONSTRUCT-MP that maps an algebra-decomposition to a MetaPattern set. Step 1 — Invariant extraction. For each block 𝑠 in D (A𝑃 ), compute the set of invariants I𝑠 of A𝑃 under 𝑠. Step 2 — MR derivation. For each invariant 𝜄 ∈ I𝑠 , derive the MR family R (𝜄) = { 𝜌 ∈ MR(A𝑃 ) | 𝜌 = Translate(𝜄 ′, 𝑠), 𝜄 ′ ∼𝑠 𝜄 }. Step 3 — Quotient. Form the MetaPattern 𝑚𝑠 = R (𝜄)/∼𝑠 . Step 4 — Aggregation. Return M(A𝑃 ) = { 𝑚𝑠 : 𝑠 ∈ D (A𝑃 ) }. 3.2.3

Algebraic closure under Translate, the canonical-block ordering, and out-of-scope MRs.

Definition 14 (Canonical-block ordering). We adopt the strict total order on blocks ∗ 𝐺 > 𝑂 ≤ > 𝑇 ∗ > T ∗ > L ∗ > D ∗ > E ∗ > Brel .

An MR derivable through multiple blocks is assigned to the highest-priority block in this order. The ∗ at the bottom reflects its semiring-rewriting nature, which sits algebraically downplacement of Brel stream of the seven physical-mathematical blocks: rewriting equivalences typically depend on the program family’s input-perturbation, order, and method-comparison structure rather than the converse. Theorem 1 (Algebraic Closure under Translate). Let A𝑃 be a program-induced operator algebra with decomposition D (A𝑃 ) as in Section 3.1.9, and let M(A𝑃 ) = CONSTRUCT-MP(D (A𝑃 )). Then for every 𝜌 ∈ MR(A𝑃 ) in the sense of Definition 13, there exists a unique 𝑚 ∈ M(A𝑃 ) such that 𝜌 ∈ 𝑚, where uniqueness is determined under the canonical-block ordering. ACM Trans. Softw. Eng. Methodol., Vol. 0, No. 0, Article 0. Publication date: 2026.

NOETHER: A Constructive Framework for Metamorphic Pattern Discovery from Operator Algebras

0:15

Remark 5 (Scope of Theorem 1). Theorem 1 is a closure statement, not a completeness claim over arbitrary properties one might assert about 𝑃’s executions. It quantifies over MR(A𝑃 ) as defined by Definition 13 — the algebra-induced MRs reachable through the Translate operator from a single block invariant. Three concrete classes of MRs lie outside this scope and are not covered by the theorem; they are documented in Appendix A: (1) Probabilistic MRs without operator-algebraic representation — e.g. MRs that constrain output distributions (such as “the entropy of 𝑓 (x) should not decrease under input augmentation 𝐴”) when the augmentation is not expressible as an operator in O. (2) Input-distribution MRs not expressible over A𝑃 operators — e.g. adversarial-perturbation MRs “∥𝛿 ∥ 𝑝 ≤ 𝜖 ⇒ 𝑓 (x + 𝛿) = 𝑓 (x)” whose perturbation set is not a group action on X. (3) Compositional MRs spanning multiple blocks under non-Translate derivations — MRs requiring simultaneous use of two block invariants in a way that is not the canonical-blockordering reduction of Definition 14. The strictly stronger statement that every MR formulable as a property over A𝑃 ’s operators (without restricting to Translate-reachable derivations) is contained in some 𝑚 ∈ M(A𝑃 ) is identified as Theorem 1′ in Appendix A. Section 3.6 and Appendix A establish that this stronger statement is false on the PWR core diffusion algebra APWR , by exhibiting two concrete counterexamples (𝜌 nonadd, 𝜌 MTC-bor ) whose obstructions identify five structurally independent extensions of Translate’s signature. The combined open problem (whether such an extended Translate preserves Theorem 1’s closure and Theorem 2’s polynomial-time decidability) is the principal open question for follow-up work. A sceptical reading might object that the by-construction status of Theorem 1 makes it neartautological. We acknowledge that the closure result is by-construction within the explicit scope of Definition 13 (which fixes MR(A𝑃 ) as the Translate-image of A𝑃 ). The substantive value lies in what the theorem then enables: Theorem 1 converts an empirical-adequacy claim (“our pattern grid covers 𝑋 % of observed MRs”) into a structural-adequacy claim (“our pattern grid is exhaustive of the algebra-induced MR space, modulo the explicit out-of-scope classes of Remark 5”). Empirical adequacy frameworks built on inductive pattern grids do not guarantee algebraic closure even in this bounded sense; NOETHER guarantees it, and the obligation imposed on any user of the framework is then to verify that no Translate-reachable MR is dropped by CONSTRUCT-MP, a verification that is mechanical once the algebraic input has been fixed. The theorem still imposes a checkable obligation on the framework. If an MR is induced by an invariant in D (A𝑃 ) but cannot be assigned by CONSTRUCT-MP, then at least one component (invariant extraction, Translate, structural equivalence, or the canonical ordering) is underspecified. Thus the result is not an empirical coverage claim; it is a well-formedness and closure guarantee for the downstream construction once the algebraic input has been fixed. The framework’s additional theoretical results complement Theorem 1: Theorem 2 bounds the construction’s polynomial-time decidability under a finite generating set; Theorem 1′ (Conjecture A), which makes the stronger claim of absolute completeness over arbitrary properties expressible in A𝑃 , is falsified on APWR (§3.6); the falsification identifies five structural obstructions in Translate’s signature (Appendix A), with five further candidate dimensions surveyed on Aequi and Arel (§3.5). ∗ block). The closure result extends to B ∗ proRemark 6 (Scope of Theorem 1 for the Brel rel vided the rewriting rule set R rel is finite. For the relational-algebra fragment of TPC-H-class queries the rule set is finite by the standard heuristic-rewrite normal forms (selection-pushdown, projectionpushdown, join-reordering, distinct-elimination) [26, 27], and Theorem 1 therefore covers algebrainduced MRs of this fragment. Query languages with unbounded recursive rewriting (e.g. Datalog with non-terminating rule sets) lie outside this scope and are catalogued as out-of-scope under Remark 2.

ACM Trans. Softw. Eng. Methodol., Vol. 0, No. 0, Article 0. Publication date: 2026.

0:16

3.2.4

Meng Li, Xiaohua Yang, Jie Liu, and Shiyu Yan

Decidability and complexity.

Theorem 2 (Decidability). Suppose A𝑃 admits a finite generating set gen(A𝑃 ) of cardinality 𝑛, with each generator’s invariant computation taking time 𝑡𝑖 . Then M(A𝑃 ) is computable in time
𝑂 𝑛 · max𝑖 𝑡𝑖 · log 𝑛 . ∗ block). The polynomial-time bound holds for B ∗ Remark 7 (Scope of Theorem 2 for the Brel rel when the rewriting rule set R rel is finite. For first-order SQL with bag semantics, query equivalence is undecidable in general, but query equivalence under a fixed rule set R rel is decidable: practical SMTbased solvers verify equivalence on substantial benchmark fractions in the published literature [26, 27]. Theorem 2 therefore covers the rule-set-bounded fragment of relational algebra; outside this fragment, decidability is governed by the underlying first-order theory and is not the framework’s responsibility.

Table 1. Per-generator cost of invariant extraction in each block. The symmetry block (𝐺) is split by group regime: finite, finite-dimensional Lie, and finitely generated infinite-discrete (with user-supplied truncation 𝐾). For Lie groups (e.g. SO(3), 𝑑𝐺 = 3) the bound 𝑂 (|𝐺 | 2 ) does not apply because |𝐺 | is uncountable; the relevant bound is 𝑂 (𝑑𝐺2 ) over the Lie-algebra basis. See §3.2.4 for the truncation discussion. Block

Regime

𝑡𝑖 for one generator

𝐺 (symmetry)

finite group finite-dim. Lie group infinite discrete (truncated)

𝑂 (|𝐺 | 2 ) (group-orbit fixed-point) 𝑂 (𝑑𝐺2 ), 𝑑𝐺 = dimR 𝔤 𝑂 (𝐾 2 ) at truncation |𝐺 | ≤ 𝐾

𝑂 ≤ (order) 𝑇 ∗ (self-adjoint) T ∗ (time-reversal) L ∗ (limit) D ∗ (qualitative-dynamics) E ∗ (method-comparison)

— — — — — —

𝑂 (𝑛 2 ) (poset comparison) 𝑂 (𝑑) (inner-product symmetry check) 𝑂 (1) 𝑂 (log 𝜖1 ) 𝑂 (𝑑) 𝑂 (𝐾 2 ) (over 𝐾 methods)

Per-block invariant-extraction cost. On infinite groups. The first row of Table 1, 𝑂 (|𝐺 | 2 ), is the natural bound for finite symmetry groups and is the regime under which Theorem 2 was originally stated. For a Lie group 𝐺 such as SO(3), |𝐺 | is uncountable and the bound is replaced by 𝑂 (𝑑𝐺2 ), where 𝑑𝐺 = dimR 𝔤 is the real dimension of 𝐺’s Lie algebra. In the equivariant-ML instantiation of Section 3.4, 𝑑 SO(3) = 3; the symmetry-block invariant is computed once over a basis of three infinitesimal generators, and orbit closure is obtained through finite-dimensional linear algebra. For finitely generated infinite discrete groups (e.g. Z, the integer-translation group of an unbounded grid solver), CONSTRUCTMP requires a separate truncation parameter 𝐾 at which orbits are enumerated; the cost is 𝑂 (𝐾 2 ) per generator, and the framework’s user is responsible for justifying that the truncated set captures the program family’s structurally relevant invariants. We do not claim Theorem 1’s closure result is preserved across truncation: closure is over MR(A𝑃 ) defined relative to the truncated group, and the user must inherit responsibility for whether this is the intended algebra. For the Boltzmann instantiation the relevant generators are finite (𝑛 ≤ 14, geometric quarterrotations and energy-group permutations); for the equivariant-ML instantiation the relevant generators are finite-dimensional Lie (𝑑 SO(3) = 3, |𝔖𝑛 | = 𝑛! truncated to a single generator class, 𝑛 ≤ 10 training-size, depth, and dimension limits). The asymptotic bound is therefore not the binding constraint in either instantiation. ACM Trans. Softw. Eng. Methodol., Vol. 0, No. 0, Article 0. Publication date: 2026.

NOETHER: A Constructive Framework for Metamorphic Pattern Discovery from Operator Algebras

0:17

3.2.5 The principal limitation. NOETHER replaces inductive grounding with algebraic grounding downstream of A𝑃 . Upstream, the distillation of A𝑃 from a program family remains a human task. This limitation is central to the framework’s scope: NOETHER does not automate domain modelling, but it turns the step after domain modelling into a well-defined construction. A second limitation, made explicit in §3.6 and Appendix A, is that even when A𝑃 is fully specified, Translate’s present signature (single-block, first-order 𝜋-template, single partial-order direction, operating on 𝑃 (𝑥) tuples rather than on operator-spectrum quantities) systematically excludes a class of MRs that engineering practice treats as standard: non-additivity of operator-composition functionals and higher-order mixed parametric dependences. The principal limitation is therefore twofold: the upstream distillation of A𝑃 , and the present signature of Translate. Boundary of contribution (Section 3.2 restatement) The downstream layer is mechanical: Theorem 1 (algebraic closure under Translate) and Theorem 2 (polynomial-time decidability) operate on a given block decomposition. The upstream layer remains empirical: the eight-block decomposition is Hypothesis 1, an open empirical hypothesis with six documented out-of-scope program-family classes (Remark 2). Theorem 1′ (absolute completeness) is open. Sections 3.3, 3.4, and 3.5 instantiate NOETHER on three structurally distinct program families.

3.3

Boltzmann instantiation: from transport to diffusion to burnup

This section instantiates NOETHER on the Boltzmann transport equation and traces the construction through neutron transport, diffusion, and burnup. 3.3.1 The Boltzmann program family and its operator algebra. The Boltzmann transport equation governs the distribution of neutral particles. In its time-independent eigenvalue form for fission systems: Ω̂·∇𝜓 (® 𝑟 , Ω̂, 𝐸) + Σ𝑡 (® 𝑟 , 𝐸)𝜓 ∫∫ ∫ ′ ′ ′ ′ 1 = Σ𝑠 (® 𝑟 , 𝐸 → 𝐸, Ω̂ → Ω̂) 𝜓 𝑑𝐸 𝑑 Ω̂ + 𝑘 𝜒 (𝐸) 𝜈 Σ 𝑓 (® 𝑟 , 𝐸 ′ )𝜓 𝑑𝐸 ′ . (1) The program-induced operator algebra ABoltz contains {𝐺 geom, ℜ𝐸 , L Σ, L 𝜈 , L ∗, T , Lℎ , DBate, Ecmp }. Decomposed along the eight blocks of Section 3.1.9, ABoltz yields entries in seven blocks (with ∗ empty under the absence of idempotent-semiring rewriting structure). Every operator listed Brel has an unambiguous status in the established theory of neutral-particle transport [23, 24]. 3.3.2 Running CONSTRUCT-MP on ABoltz . Steps 1–4 of CONSTRUCT-MP yield seven MetaPatterns: 𝑚 inv (invariance/equivariance), 𝑚 mono (parameter-monotonicity), 𝑚 adj (self-adjoint duality / adjoint reciprocity), 𝑚 rev (time-reversal compatibility), 𝑚 conv (discretisation convergence), 𝑚 dyn (qualitative-dynamics shape invariants), and 𝑚 cmp (method-comparison error-bound partial orders). 3.3.3

Relationship to the prior inductive catalogue: refinement plus prediction.

Provenance and scope of the inductive catalogue. The reactor-physics MetaPattern catalogue compared against here was distilled by the present authors from the standard PWR-physics literature [23, 24] as their own prior inductive work; the underlying 84-MR PWR corpus (supplementary S2) is the authors’ own catalogue, not an external corpus drawn from an unrelated team. The relationship reported in this section is therefore best read as a test of internal vocabulary coherence: NOETHER’s eight-block decomposition is applied to a catalogue the same team produced inductively, and the question is whether the algebraic re-classification reproduces, refines, ACM Trans. Softw. Eng. Methodol., Vol. 0, No. 0, Article 0. Publication date: 2026.

0:18

Meng Li, Xiaohua Yang, Jie Liu, and Shiyu Yan

or predicts within that corpus. This is internal consistency under a uniform algebraic structure, not external transfer of tacit knowledge from an independent reactor-physics team into the framework. External-transfer evidence (applying NOETHER to a reactor-physics MR corpus authored by an independent team—a PARCS V&V suite or IAEA-TECDOC-class catalogue) is committed as follow-up work in supplementary S4 (future_work.md) (item (j)). The cross-codebase commonsmath pilot of §4.2.8 (item (b.cm)) is the analogous external-transfer test on the Java head-to-head side, at 𝑛 = 3 SUTs and 𝑛 = 77 mutants; the reactor-side analogue remains future work. A reactor-physics MetaPattern catalogue distilled from the standard PWR-physics literature [23, 24] identifies five MetaPatterns (P1–P5) inductively. The relationship with M(ABoltz ) is more structured than a simple bijection. NOETHER reproduces three of the prior patterns, refines two on a sounder algebraic basis, and predicts two structurally distinct classes that the inductive catalogue did not isolate: Table 2. Relationship between prior inductive catalogue and NOETHER deductive output. Prior catalogue

NOETHER

Relationship

P1 conservation/invariance P2 monotonicity P3 convergence P4 trajectory

𝑚 inv

Reproduced — 𝐺-symmetry invariants project to the same MRs.

𝑚 mono 𝑚 conv 𝑚 dyn

Reproduced. Reproduced. Refined — inductive P4 conflated qualitative-dynamics with timereversal. NOETHER places trajectory phenomena in 𝑚 dyn (Sturmtype comparison theorems) and exposes the conflation. Refined — inductive P5 grouped method-accuracy partial orders with adjoint reciprocity. NOETHER places the former in 𝑚 cmp (approximation-theory error bounds) and exposes the distinction. Predicted — adjoint-reciprocity MRs derived as a structurally distinct equivalence class. Predicted — collisionless-trajectory-reversal MRs derived for the corresponding sub-formulations.

P5 partial- 𝑚 cmp order/bounding (none)

𝑚 adj

(none)

𝑚 rev

This is not the structure of a re-coding. NOETHER’s output structurally refines two prior patterns and predicts two additional patterns the inductive method missed. The gain is canonical placement: two previously conflated inductive labels are separated by algebraic source, and two textbook phenomena become mandatory MetaPattern classes once their blocks appear in D (ABoltz ). A note on prediction (and an interpretive caveat). We do not claim that 𝑚 adj (adjoint reciprocity) and 𝑚 rev (collisionless time-reversal compatibility) are de novo physical discoveries. Adjoint-flux reciprocity is standard textbook material in transport theory [23, 24], and time-reversal MRs in collisionless transport have been understood in physics for decades. The MT-community-level absence of these MetaPatterns from the prior inductive catalogue reflects which phenomena happened to be canonically encoded in the 84-MR corpus, not the absence of the underlying physics from the literature. We must also acknowledge an interpretive caveat about what this “prediction” is and is not. The blocks 𝑇 ∗ (self-adjoint) and T ∗ (time-reversal) of Section 3.1.9 were themselves curated by inspection of program families that include reactor physics; the operators Tgeom and T in ABoltz were the leading examples motivating the inclusion of those blocks. There is therefore a circularity in the strong reading of “prediction”: 𝑇 ∗ and T ∗ were partly induced from reactor-physics structures, and 𝑚 adj and 𝑚 rev are then derived from those blocks. The framework does not discover these ACM Trans. Softw. Eng. Methodol., Vol. 0, No. 0, Article 0. Publication date: 2026.

NOETHER: A Constructive Framework for Metamorphic Pattern Discovery from Operator Algebras

0:19

MetaPatterns de novo. What it does is closer to a uniform re-projection: given the eight-block decomposition (whatever its empirical provenance), CONSTRUCT-MP places adjoint-reciprocity and time-reversal phenomena into structurally distinct equivalence classes that the inductive 84-MR catalogue had not isolated as such, even though their underlying physics had been individually known to domain experts. The substantive contribution is the re-classification under a uniform algebraic structure, which gives a future testing toolchain a principled reason to enumerate 𝑚 adj and 𝑚 rev alongside 𝑚 inv , 𝑚 mono , 𝑚 conv , 𝑚 dyn , and 𝑚 cmp rather than treating them as ad-hoc additions. Where NOETHER’s predictive power is genuine and non-circular is in the deflationary direction (Section 4.4): the framework can also reveal that an existing inductive catalogue over-counts structurally distinct patterns. Both directions, re-classification and de-duplication, are systematisation, not discovery. Element-wise correspondence. Table 3 traces seven representative MRs distilled from the standard reactor-physics literature [23, 24] to their NOETHER placement: one per non-empty block (𝐺, 𝑂 ≤ , L ∗ , D ∗ , E ∗ , selected as the most canonical literature form within each block) plus the two predicted MetaPatterns 𝑚 adj and 𝑚 rev for which no MR was previously catalogued in this form. The full 12MR enumeration with sub-category coverage (geometric vs. energy-group symmetry within 𝐺, etc.), source equations, and Translate templates is in supplementary S2 (elementwise_12.md). A larger 84-MR corpus underlying the selection protocol is provided as supplementary material S2. An independent audit on the 18-MR engineering catalogue. The 12-row table is structurally curated. As a coarser breadth check, an independent 18-MR engineering catalogue distilled from production reactor-physics codes (orthogonal to the 84-MR inductive corpus underlying Section 3.3.3) was labelled by three independent large language models against the seven canonical MetaPatterns plus the relational extension of Section 3.1.9, with a fourth label orphan reserved for MRs that fit none of the eight classes; the labelling protocol, raw labels, and majority-vote tabulation are released in supplementary material S2 (18mr_audit/). Inter-rater agreement on the four-way classification is almost-perfect (Fleiss’ 𝜅 = 0.857, 𝑛 = 18 items, 𝑟 = 3 raters, 𝑐 = 4 categories), and 17 of the 18 MRs are placed by majority vote into one of the seven canonical MetaPatterns or 𝑚 rel (subsumption 94.4%, Wilson 95% CI [74.2%, 99.0%] on the binary subsumption proportion). The single orphan is the Lipschitz / metric-stability MR, which we treat structurally in Appendix C.5.2 as a candidate ninth block rather than as a counter-example to Theorem 1’s scope. The independence of the three labellers is bounded by the LLM-shared-training-data caveat (the three models share substantial pre-training corpora, so 𝜅 should be read as agreement among similarly-trained but non-coordinated raters rather than among rigorously independent oracles); we report the audit as external corroboration of breadth rather than as an independent verification of correctness. Table 3. Seven representative MRs from the prior PWR corpus (one canonical MR per non-empty block plus two predicted MetaPatterns), with NOETHER placement; the full 12-MR enumeration with per-block subcategory coverage is in supplementary S2 (elementwise_12.md). MR ID

Plain-text MR

P#

Block

NOETHER MP

Bur-Phy-01 Bol-Phy-11 Dif-Alg-01 Bur-Phy-08 Bur-Alg-04 (predicted) (predicted)

Step-splitting invariance Σ𝑎 ↑⇒ 𝑘 eff ↓ Diamond-difference ℎ 2 convergence Iodine pit qualitative shape CRAM no-worse-than TTA Adjoint reciprocity Collisionless reversibility

P1 P2 P3 P4 P5 — —

𝐺 𝑂≤ L∗ D∗ E∗ 𝑇∗ T∗

𝑚 inv 𝑚 mono 𝑚 conv 𝑚 dyn 𝑚 cmp 𝑚 adj 𝑚 rev

ACM Trans. Softw. Eng. Methodol., Vol. 0, No. 0, Article 0. Publication date: 2026.

0:20

Meng Li, Xiaohua Yang, Jie Liu, and Shiyu Yan

3.3.4 A Noether-style derivation of 𝑚 adj . The framework’s name is methodological. Noether’s first theorem replaces an empirically curated catalogue of conservation laws with a derivation from the symmetry structure of an action functional [28]. We do not invoke Noether’s theorem as a theorem about programs (programs do not, in general, possess an action functional in the variationalcalculus sense). What the framework does mirror is the methodological move: instead of cataloguing observed invariants, derive them from a structural source. We illustrate the move on 𝑚 adj . Consider the bilinear form on solution-adjoint pairs F [𝜙, 𝜙 † ] = ⟨𝜙 †, 𝐵𝜙⟩ − ⟨𝜙, 𝐵 †𝜙 † ⟩,

(2)

where 𝐵 is the Boltzmann operator and 𝐵 † its formal adjoint under the inner product ⟨𝑓 , 𝑔⟩

= 𝑓 𝑔 𝑑 Ω 𝑑𝐸 𝑑r. The bilinear form F is identically zero on solutions of the forward and adjoint equations: 𝐵𝜙 = 𝑆, 𝐵 †𝜙 † = 𝑆 † with appropriate boundary conditions imply F [𝜙, 𝜙 † ] = ⟨𝜙 †, 𝑆⟩ − ⟨𝜙, 𝑆 † ⟩, and the standard reciprocity identity makes the right-hand side zero. The vanishing of F is a conserved current in the Noether sense: it is annihilated by the dual symmetry 𝜙 ↔ 𝜙 †, 𝐵 ↔ 𝐵 † . CONSTRUCT-MP’s Step 1 extracts F = 0 as the 𝑇 ∗ -block invariant; Translate converts it into the executable MR 𝜌 adj : ⟨𝜙 †, 𝑆⟩ − ⟨𝜙, 𝑆 † ⟩ ≤ 𝜏, (3) ∫

which the testing harness checks on a forward and an adjoint solver run with externally specified sources 𝑆, 𝑆 † . The MR is therefore a Noether-style consequence of the duality symmetry rather than a manually catalogued reactor-physics property: the symmetry 𝜙 ↔ 𝜙 † is the structural source, the bilinear form is the conserved current, and the MR is the conservation law in testable form. The same template applies to 𝑚 rev with the involution T : 𝜙 (r, 𝛀, 𝐸, 𝑡) ↦→ 𝜙 (r, −𝛀, 𝐸, −𝑡) as the symmetry. The template’s general statement is: given a symmetry of the program family’s operator algebra, CONSTRUCT-MP extracts the invariant of the symmetry and Translate converts it into an executable MR. 3.3.5 Specialisation to neutron transport, diffusion, and burnup. The Boltzmann formulation is the most general; specialised solvers are obtained by truncating or projecting ABoltz . Neutron transport solvers retain the full angular dependence; the same seven MetaPatterns apply. Neutron diffusion solvers truncate angular dependence to its 𝑃 1 approximation: the time-reversal block contracts (diffusion is dissipative), removing 𝑚 rev . Burnup-coupled solvers introduce the Bateman ODEs; the Bateman operator 𝑒 𝐴𝑡 enriches multiple blocks (𝐺 semi-group, 𝑂 ≤ linearity, D ∗ overshoot/Scurve, E ∗ CRAM-vs-TTA bounds). The MetaPattern set is compositional with respect to the underlying algebra: add a block, gain MetaPatterns; remove a block, lose them. The framework supports both construction and prediction of which patterns a new specialisation will exhibit, before any MR is identified empirically. 3.3.6 Summary. NOETHER, applied to ABoltz , deductively produces a seven-MetaPattern set that refines the prior inductive catalogue and predicts two additional MetaPatterns (𝑚 adj , 𝑚 rev ). The seven MetaPatterns correspond to invariants that have been independently validated in the standard reactor-physics literature: 𝑚 inv via Bell & Glasstone’s symmetry-of-criticality analysis [23], 𝑚 mono via Lewis & Miller’s monotonicity arguments for cross-section perturbations [24], 𝑚 conv via mesh-convergence theorems standard in computational neutron transport, 𝑚 adj via Bell & Glasstone §6.3 adjoint-perturbation theory and Stamm’ler & Abbate’s adjoint flux treatment [29], and 𝑚 rev via the collisionless time-reversal symmetry of the transport operator [24]. The contribution of NOETHER on this domain is therefore not de-novo MR discovery (these invariants are textbookcanonical) but the algebraic warrant for treating them as a uniform MetaPattern grid; the citation chain above is the published cross-corroboration that the seven NOETHER-derived MetaPatterns ACM Trans. Softw. Eng. Methodol., Vol. 0, No. 0, Article 0. Publication date: 2026.

NOETHER: A Constructive Framework for Metamorphic Pattern Discovery from Operator Algebras

0:21

are physically real properties of the Boltzmann program family, independent of NOETHER’s framework. The next section turns to a more demanding case: a domain in which the inductive catalogue does not yet exist. 3.4

Cross-domain demonstration: equivariant machine learning

3.4.1 The equivariant-ML program family and its operator algebra. Equivariant neural networks impose by architectural construction that certain symmetries of the input induce predictable transformations of the output [30–33]. The program family Fequi comprises classifiers satisfying 𝑓 (𝑔 · x) = 𝜌 (𝑔) · 𝑓 (x) for 𝑔 ∈ 𝐺 = SO(3) × 𝔖𝑛 . Decomposed along the eight blocks: 𝐺 = {𝐺 equi }, ∗ ∗ ∗ ∗ ∗ 𝑂 ≤ = {𝑂 train ≤ }, 𝑇 = {𝑇att }, T = {Tseq }, L = {Ltrain, Ldepth, Ldim }, D = ∅ (for feedforward ∗ ∗ classifiers), E = ∅ within a single architecture, Brel = ∅ (no idempotent-semiring rewriting on equivariant-classifier outputs). 3.4.2

Running CONSTRUCT-MP on Aequi . CONSTRUCT-MP returns  eq eq eq eq eq M(Aequi ) = 𝑚 inv, 𝑚 mono, 𝑚 adj, 𝑚 rev, 𝑚 conv .

The labels mirror those of M(ABoltz ) but the content is domain-specific. This section does not claim empirical validation in machine learning. It checks a narrower transfer claim: once Aequi is specified, the same downstream construction yields domain-specific MR families without using a reactor-physics corpus. Cross-corroboration from the published equivariant-ML literature. The five MetaPatterns derived above correspond to invariants that have been independently validated in the equivariant-ML literature, providing a citation-based corroboration channel that does not depend on this paper’s case eq study: 𝑚 inv (SO(3)/𝔖𝑛 symmetry invariance) is the central design principle of Cohen & Welling’s Geq CNN [30], Satorras et al.’s EGNN [34], and the Tensor-Field-Network family [31]; 𝑚 adj (self-adjoint attention duality) is the kernel-symmetry property exploited by SE(3)-Transformer’s Clebsch– eq Gordan attention [35]; 𝑚 rev (training-trajectory time-reversal) is closely related to the reversibleeq network construction of Gomez et al. [36]; 𝑚 conv (training-size convergence) is the implicit invariant tested by training-curve mesh-refinement studies in the broader geometric-deep-learning literature [33]; gauge-equivariant extensions are catalogued in Cohen et al. [37]. NOETHER’s contribution on Aequi is the uniform algebraic warrant: the same downstream construction that derives reactor-physics MetaPatterns also derives equivariant-ML MetaPatterns from Aequi ’s eight-block decomposition, without re-running the empirical induction that produced the individual results above. 3.4.3 End-to-end derivation: a concrete MR for SE(3)-equivariant point-cloud classification. To illustrate the framework’s generative use, we trace a complete derivation from algebra to executable MR. Step 1. System under test. Let 𝑓 : R𝑛×3 → Δ𝐶 −1 be a point-cloud classifier mapping 𝑛 threedimensional points to a probability distribution over 𝐶 classes. Step 2. Distil Aequi . The relevant blocks are 𝐺 = SO(3) × 𝔖𝑛 and L ∗ for training-size and depth limits. Step 3. Run CONSTRUCT-MP, select an invariant. Within 𝐺’s symmetry block, fix attention on the rotation invariant: 𝑓 (𝑅 · x) = 𝑓 (x) for all x and 𝑅 ∈ SO(3). Step 4. Translate the invariant into an executable MR.. 𝜌 rot :

∀𝑅 ∈ SO(3),

𝑓 (𝑅 · x) − 𝑓 (x) ∞ ≤ 𝜏,

(4)

ACM Trans. Softw. Eng. Methodol., Vol. 0, No. 0, Article 0. Publication date: 2026.

0:22

Meng Li, Xiaohua Yang, Jie Liu, and Shiyu Yan

with 𝜏 = 10−4 for fp32 architectures.

Listing 1. Executable MR 𝜌 rot for SE(3)-equivariant classifier.

Step 5. Generate an executable test. 1 import numpy as np 2 from scipy . spatial . transform import Rotation 3

def test_rotation_invariance ( model , point_cloud , num_samples =100 , tau =1 e -4) : " " " Executable MR rho_rot for SE (3) - equivariant classifier . " " " 6 p_original = model . predict ( point_cloud ) 7 failures = [] 8 for _ in range ( num_samples ) : 9 R = Rotation . random () . as_matrix () 10 rotated = point_cloud @ R . T 11 p_rotated = model . predict ( rotated ) 12 deviation = np . max ( np . abs ( p_original - p_rotated ) ) 13 if deviation > tau : 14 failures . append (( R , deviation ) ) 15 return failures 4 5

Step 5b. A Noether-style reading of 𝜌 rot . The same methodological move that produced 𝑚 adj in §3.3.4 produces 𝜌 rot here in non-rhetorical form. The classifier 𝑓 is, in equivariant-network architectures by construction, invariant under the action of 𝐺 = SO(3) on its input: 𝑓 (𝑅·x) = 𝑓 (x) for all 𝑅 ∈ 𝐺. The Lie algebra 𝔤 = 𝔰𝔬(3) = span{𝐿𝑥 , 𝐿𝑦 , 𝐿𝑧 } is the infinitesimal generator of this symmetry. The associated Noether-style invariant is the constancy of the classifier output along orbits of 𝐺: 𝑑 𝑑𝜃 𝑓 (exp(𝜃𝐿𝑎 ) · x) = 0 for each generator 𝐿𝑎 , 𝑎 ∈ {𝑥, 𝑦, 𝑧}, which is the Lie-algebraic statement that the directional derivative of 𝑓 along every orbit-tangent direction vanishes. CONSTRUCT-MP’s Step 1 extracts this invariant from the 𝐺 block of Aequi ; Translate converts it into the executable MR of equation (4) above. The MR is therefore not an arbitrary catalogue entry: it is the Noetherstyle consequence of the SO(3) symmetry that the architecture imposes by construction. Step 6. Pattern coverage status. The MR 𝜌 rot above, together with 𝜌 perm and 𝜌 train derived in supplementary S9 (Appendix D), populates three of the five non-empty MetaPatterns of M(Aequi ). We refrain from reporting a percentage coverage figure: with so few non-empty blocks and a denominator subject to the eight-block sufficiency hypothesis (Hypothesis 1), a percentage is more rhetorical than informative. We instead derive in the following two subsections two MRs from the remaining non-empty blocks, 𝑇 ∗ (self-adjoint) and T ∗ (time-reversal), chosen specifically because they are not standard practice in equivariant-ML testing and therefore probe whether NOETHER’s transfer claim extends beyond well-known invariances such as 𝜌 rot . 3.4.4 An adjoint-attention duality MR (𝜌 adj ). The self-adjoint block 𝑇 ∗ in Aequi contains the ∗ . We give two formulations, distinguished by whether the MR attention-kernel symmetriser 𝑇att runs at CI-time (production-suitable) or at debug-time (one-off scaffolding). Scope: forward-pass-only, CI-time formulation. For architectures whose attention layer exposes a bilinear form 𝐴(x (1) , x (2) ) readable through a forward hook, 𝜌 adj as defined below is a CI-time MR: it consumes only the model’s native forward pass, requires no parameter mutation, and respects the model’s standard inference contract. Mainstream equivariant transformers, including SE(3)-Transformer [35] and the Tensor-Field-Network family [31], compute attention via Clebsch– Gordan tensor products of irrep features. The bilinear form 𝐴(x (1) , x (2) ) = ⟨𝑄 (x (1) ), 𝐾 (x (2) )⟩ is ACM Trans. Softw. Eng. Methodol., Vol. 0, No. 0, Article 0. Publication date: 2026.

NOETHER: A Constructive Framework for Metamorphic Pattern Discovery from Operator Algebras

0:23

generically not Hermitian, but its Hermitian part 21 (𝐴 + 𝐴† ) has a trace-cyclic invariant under input role-swap that 𝜌 adj tests. The CI-time formulation reads only the layer’s existing 𝑄, 𝐾 outputs through a frozen forward pass; no probe is injected. Alternative harness-time formulation. A debug-time formulation, available in supplementary S1, instruments a symmetric Gram-matrix probe ( 12 (𝑄𝐾 + (𝑄𝐾) ⊤ )). This is a debug-time scaffold; it is not part of the CI-time MR set and is not used in the §4.1 comparative evaluation. ∗ , fix the attention-trace invariant Invariant. Within 𝑇att

𝜄 att = Tr 𝐴(·, ·) ∈ R, which equals 𝐴† ’s trace by the cyclic property of trace and the Hermiticity of 𝐾. Translate carries 𝜄 att to an executable MR over a forward pass: 𝜌 adj :

Tr 𝐴(x (1) , x (2) ) − Tr 𝐴(x (2) , x (1) ) ≤ 𝜏adj,

(5)

for two input clouds x (1) , x (2) presented to the network in opposite query/key roles. With 𝜏

adj = 10−4 for fp32 architectures, this MR is executable on any equivariant transformer whose attention layer exposes the bilinear form (or can be probed through a forward-hook). To the best of our knowledge 𝜌 adj has not been catalogued as a standard MR for equivariant attention testing in the existing literature [3, 5, 6], although Hermitian-attention diagnostics have appeared in the architecture-design literature in non-MR form. NOETHER’s contribution here is the algebraic wareq rant for treating it as a MetaPattern member structurally distinct from 𝑚 inv .

3.4.5 A training-trajectory time-reversal MR (𝜌 train-rev ). The time-reversal block T ∗ in Aequi is nonempty for SGD trajectories under the Hamiltonian-Monte-Carlo / continuous-time-flow view of stochastic optimisation [38]. The discretised SGD update 𝜃 𝑡 +1 = 𝜃 𝑡 − 𝜂 ∇L (𝜃 𝑡 ; 𝜉𝑡 ) is, to leading order in the learning rate 𝜂 and in the absence of momentum or noise, time-reversible: applying the inverse update 𝜃 𝑡 +1 ↦→ 𝜃 𝑡 +1 + 𝜂 ∇L (𝜃 𝑡 +1 ; 𝜉𝑡 ) recovers 𝜃 𝑡 up to 𝑂 (𝜂 2 ). The operator Tseq ∈ T ∗ encodes this involution. Invariant. The relevant invariant is the round-trip identity:
−1 𝜄 rev : Tseq ◦ 𝑈𝜂 ◦ Tseq ◦ 𝑈𝜂 (𝜃 ) = 𝜃 + 𝑂 (𝜂 2 ), where 𝑈𝜂 denotes one SGD step. Debug-time MR (not CI). We label 𝜌 train-rev explicitly as a debug-time MR: it requires parameter rollback, mini-batch reordering, and a deliberately constructed vanilla-SGD fixture. Production equivariant pipelines (Allegro, NequIP, MACE, e3nn examples) almost universally use Adam or AdamW, whose update is not in T ∗ in the strict sense; the MR fails by construction on those optimisers, which is the framework’s correct prediction. 𝜌 train-rev should be invoked once per trainingscript change at debug time, on a vanilla-SGD fixture, not as part of CI for production pipelines. The debug-time reading aligns with the wider reversible-network literature [36] where exact-orapproximate inversion is a deliberate test scaffold. Translate carries the invariant into: 𝜌 train-rev :

(round−trip) 𝜃𝑇 − 𝜃˜𝑇 ≤ 𝑐 𝜂2 𝑇 , 2

(6)

(round−trip) where 𝜃𝑇 is the parameter vector after 𝑇 vanilla SGD steps starting from 𝜃 0 , and 𝜃˜𝑇 is the vector obtained by applying 𝑇 vanilla SGD steps from 𝜃 0 followed by 𝑇 inverse-SGD steps

using the same mini-batch sequence in reversed order, then 𝑇 forward steps again. The constant 𝑐 depends on the loss landscape’s local Lipschitz structure and is determined empirically per model. This MR fails by construction for momentum-based optimisers (Adam, Lion, etc.) whose update is ACM Trans. Softw. Eng. Methodol., Vol. 0, No. 0, Article 0. Publication date: 2026.

0:24

Meng Li, Xiaohua Yang, Jie Liu, and Shiyu Yan

not in T ∗ ; that is, the framework correctly predicts which architecture-optimiser pairs admit the MR and which do not. The MR is non-trivial in the sense that detecting an implementation defect in the gradient-reversal direction (e.g. wrong sign on a custom loss term) is exactly what 𝜌 train-rev surfaces. To our knowledge it has not been catalogued as an MR for training-pipeline testing. Coverage status, revised. The full Set N consists of five MRs, one per non-empty MetaPattern of M(Aequi ):  Set N = 𝜌 rot (𝐺), 𝜌 mono (𝑂 ≤ ), 𝜌 train (L ∗ ), 𝜌 adj (𝑇 ∗ ), 𝜌 train-rev (T ∗ ) . 𝜌 rot is the rotation-invariance MR of Section 3.4.3; 𝜌 adj and 𝜌 train-rev are the non-trivial MRs of Sections 3.4.4–3.4.5; 𝜌 mono is the point-density-monotonicity MR for the 𝑂 ≤ block (top-1 stability under removal of a small fraction of redundant input points), derived from the 𝑂 train operator re≤ stricted to inference-time input perturbations; 𝜌 train is the inference-idempotency MR for the L ∗ block. With all five blocks populated, coverageNOETHER (Set N) = 1.0 by construction, this is what Theorem 1 predicts for a Aequi -derived MR set. The permutation-invariance MR 𝜌 perm (supplementary S9 (Appendix D)) is an auxiliary 𝐺-block MR retained as a redundant probe and is excluded from Set N to keep the comparison budget |𝑁 | = |𝐿| = |𝐵| = 5. The non-trivial nature of 𝜌 adj and 𝜌 train-rev , both absent from the equivariant-ML MR-testing literature we surveyed, substantiates the claim that NOETHER’s transfer is generative rather than nominal. 3.5

A third domain: relational query optimisers

Both the Boltzmann (§3.3) and the equivariant-ML (§3.4) instantiations share a common mathematical core: Lie-group symmetry, self-adjoint duality, and time-reversal involution. This is precisely the core that motivated the curation of Hypothesis 1 in the first place. To test transferability beyond this core, this subsection instantiates NOETHER on a domain whose algebraic skeleton is structurally distinct: the relational query optimiser. Relational algebra is built from operators (selection 𝜎, projection 𝜋, join ⊲⊳, union ∪, set/bag-difference) whose equivalence classes are governed by an idempotent semiring with a partial order under containment, not by a Lie group. There is no obvious self-adjoint operator and no time-reversal involution. The third instantiation therefore tests whether the framework yields useful MetaPatterns outside its training image. The query-optimiser program family and Arel . Let Frel be the family of programs that take a SQL query 𝑞 and a database state 𝐷 and return a relation eval(𝑞, 𝐷); two queries are equivalent if ∀𝐷. eval(𝑞, 𝐷) = eval(𝑞 ′, 𝐷). The operator algebra Arel activates 𝐺 (join / union permutation), 𝑂 ≤ (selection-strengthening + projection-coarsening monotonicity), E ∗ (hash- / merge- / nested-loop ∗ (Definition 10: selection-pushdown plan equivalence under stated cost models [26, 39]), and Brel 𝜎𝑝 (𝑅 ⊲⊳ 𝑆) = 𝜎𝑝 (𝑅) ⊲⊳ 𝑆 when attr(𝑝) ⊆ attr(𝑅); idempotent 𝜎𝑝 ◦ 𝜎𝑝 = 𝜎𝑝 ; constant-folding 𝜎1=1 (𝑅) = 𝑅, 𝑅 ⊲⊳ ∅ = ∅). Blocks 𝑇 ∗, T ∗, D ∗, L ∗ are empty under Arel in their canonical forms (no inner-product self-adjointness; no time-reversal involution; no qualitative dynamics; no 𝜖-limit operator on exact-relational semantics). The full per-block enumeration of Arel operators is in supplementary S6 query_optimiser/algebra_breakdown.md. Running CONSTRUCT-MP on Arel . Steps 1–4 yield three MetaPatterns from the seven-block rel subset: 𝑚 rel inv (input-permutation invariance under set semantics), 𝑚 mono (selection-strengthening rel monotonicity), and 𝑚 cmp (plan-equivalence under cost-model bounds). The relational query opti∗ is non-empty: it activates the eighth block that miser is the canonical instantiation in which Brel neither Boltzmann reactor physics nor equivariant ML exercises. ACM Trans. Softw. Eng. Methodol., Vol. 0, No. 0, Article 0. Publication date: 2026.

NOETHER: A Constructive Framework for Metamorphic Pattern Discovery from Operator Algebras

0:25

Four MRs derived for Arel . (1) 𝜌 join-comm (from 𝐺): eval(𝑞 1 ⊲⊳ 𝑞 2, 𝐷) = eval(𝑞 2 ⊲⊳ 𝑞 1, 𝐷) on bag semantics. ∗ ): eval(𝜎 (𝑅 ⊲⊳ 𝑆), 𝐷) = eval(𝜎 (𝑅) ⊲⊳ 𝑆, 𝐷) when attr(𝑝) ⊆ attr(𝑅). (2) 𝜌 select-push (from Brel 𝑝 𝑝 ∗ ): 𝜎 ◦ 𝜎 = 𝜎 as a query-rewrite identity, checkable through plan-tree (3) 𝜌 distinct-idem (from Brel 𝑝 𝑝 𝑝 comparison. (4) 𝜌 plan-equiv (from E ∗ ): two execution plans for the same query produce identical relations within stated NULL-propagation rules [26]. ∗ instantiation is Position relative to existing automated database-testing work. NOETHER’s Brel complementary to four prior lines: random SQL generation [40, 41], automated MR generation for query systems [42], formal query-equivalence solvers [26, 27, 43], and differential / mutation testing [44–46]; NOETHER provides an algebraically grounded MetaPattern enumeration whose closure under Translate (Theorem 1) is a property none of the four lines establishes. A pre-registered protocol comparison on Segura et al.’s IMDb subset [42] is in supplementary S6.

Cross-corroboration from the published query-equivalence literature. The four MRs derived above (𝜌 join-comm , 𝜌 select-push , 𝜌 distinct-idem , 𝜌 plan-equiv ) correspond to query-equivalence identities that have been independently validated by formal solvers in the published query-equivalence literature: 𝜌 join-comm is a canonical bag-semantics commutativity identity exercised by SPES and QED on their benchmark suites [26, 27]; 𝜌 select-push is the standard selection-pushdown rewrite of Calcite’s optimiser, verified equivalence-checkable by SPES; 𝜌 distinct-idem corresponds to a class of idempotent rewrites that Mohamed et al.’s tables-and-relations SMT theory [43] can certify; 𝜌 plan-equiv is the central object of QED’s 299/444 Calcite verification result [26]. As with the Boltzmann and equivariant-ML cases, NOETHER’s contribution on Arel is not de-novo MR discovery (these identities are already in the published optimiser-equivalence literature) but the uniform algebraic warrant: the same eight-block downstream construction that produces reactor-physics and equivariant-ML MetaPatterns also produces relational MetaPatterns, exercising the relational∗ that the other two domains do not activate. The structural-extension claim — equivalence block Brel that the framework reaches outside the Lie-group / self-adjoint / time-reversal core — is supported at the algebra-skeleton level by this MR-to-published-identity correspondence, independently of ∗ MRs outperform any specific automated baseline. whether NOETHER’s Brel What this third domain establishes, and the Theorem 1′ verdict on Aequi and Arel . The instantiation establishes that NOETHER applies outside the Lie-group / self-adjoint / time-reversal ∗ where the first two domains do not. The counterexamplecore: relational optimisers exercise Brel search protocol applied to both Aequi and Arel (mirroring §3.6) yields the following verdict. On Aequi : Theorem 1′ is falsified by two pairwise-independent candidates — 𝜌 compose (joint SO(3) × 𝔖𝑛 action on point sets [34], requiring a product-group 𝜋-template) and 𝜌 gauge (gaugeequivariance on manifolds [37], requiring a bundle-section 𝜋-template parametrised by g ∈ C(𝑀, 𝐻 )). The two extensions are independent (a product-group 𝜋 does not absorb a gaugebundle section); the SO(3) Lie-algebra structure alone does not force closure on Aequi . On Arel : a survey of ≥ 10 unverified cases from [26]’s residue (Aggregate×Project, constant-key, Decorrelate, NULL three-valued logic) yields five Theorem 1′ candidates; the primary wit∗ plus an aggregation-asness 𝜌 agg-proj (Calcite’s AggregateExtractProjectRule) requires Brel algebra ninth block. Combined with the five APWR obstructions of Table 4, the three algebrasurvey artefacts (theory/equi_thm1prime_search.md, theory/rel_thm1prime_search.md, theory/translate_extensions.md) identify ten Translate-extension dimensions. Pairwise independence is proved by per-block exhaustion on the five PWR obstructions (Appendix A); the five ACM Trans. Softw. Eng. Methodol., Vol. 0, No. 0, Article 0. Publication date: 2026.

0:26

Meng Li, Xiaohua Yang, Jie Liu, and Shiyu Yan

candidate Aequi + Arel dimensions (two specialising PWR-side dimensions to type-distinct primitives, three net relational-side) are asserted independent by inspection, with formal per-dimension exhaustion as follow-up. Remark 2 catalogues six further out-of-decomposition program-family classes. 3.6

A negative instantiation: irreducibly compositional MRs in PWR core simulators

Sections 3.3, 3.4, and 3.5 instantiated NOETHER on three program families (Boltzmann reactor physics, equivariant ML, and relational query optimisers) for which the framework’s downstream construction was non-vacuous and produced executable MRs. This subsection instantiates NOETHER on a fourth program family, the PWR core diffusion solver family, with an inverted purpose: rather than demonstrating coverage, we exhibit two specific MRs from the standard PWR safety-analysis literature that the framework’s Translate operator cannot reach under any singleblock derivation. The two MRs together identify five pairwise-independent structural obstructions in Translate’s present signature, jointly recasting Theorem 1′ (Conjecture A, Appendix A) from an open conjecture to a falsified statement on a structurally significant operator algebra. The MRs chosen are not pathological cases. They are core safety-analysis MRs that PWR core simulators are required by regulatory practice and engineering convention to reproduce: nonadditivity of control-bank reactivity worth (the algebraic root of rod-bank shadowing and antishadowing phenomena) and second-order mixed dependence of 𝑘 eff on moderator temperature and boron concentration (the standard MTC-vs-boron design curve). The negative instantiation thus uses NOETHER’s principal application domain (reactor physics) to test the framework’s most ambitious stated claim (algebraic closure over arbitrary single-block-derivable MRs). Why PWR rather than ML or DB as the negative-instantiation domain. We choose the PWR core diffusion algebra rather than Aequi or Arel as the negative-instantiation testbed for two reasons. First, regulatory essentiality: 10 CFR 50 and NRC Regulatory Guide 1.77 require PWR core simulators to reproduce the two MRs in the definitions below for safety-analysis qualification, so the counterexamples are not contrived edge cases. Second, engineering documentability: the PWR core diffusion algebra has a published canonical form (Bell & Glasstone [23] §6.1, Lewis & Miller [24] §4.2) against which the counterexample’s structural obstructions can be precisely located in A𝑃 ’s signature, which Aequi (a domain of recent literature without a unified canonical algebra) and Arel (canonical but under-equipped with non-rewrite operators) do not yet support. Whether Aequi or Arel admit analogous Theorem 1′ counterexamples is open and committed as follow-up in §3.5’s open-question paragraph. The PWR core diffusion algebra. Let FPWR be the program family of PWR core diffusion solvers (canonical examples: PARCS, SIMULATE-3/5, ANC, SMART). Its operator algebra APWR contains, in addition to the operators of ABoltz (Section 3.3.3), the following PWR-specific generators: • Orod : discrete control-rod insertion operators, parametrised by rod-bank label 𝑔 and insertion depth 𝑑, generating an additive-on-geometry semigroup under composition. In the steady-state 𝐴 · O 𝐵 and O 𝐵 · O 𝐴 act identically on the input space (both setting we adopt throughout, Orod rod rod rod produce the same total inserted geometry), so Orod is commutative on geometry. The reactivityworth functional on Orod , however, is not a semigroup homomorphism: 𝑑𝜌 (𝐴 ∪ 𝐵) ≠ 𝑑𝜌 (𝐴) + 𝑑𝜌 (𝐵) in general. This non-additivity, not non-commutativity, is what the present subsection exploits. • M𝐶𝐵 : continuous boration operators acting on the moderator material composition through the soluble-boron concentration 𝐶𝐵 (typical PWR operating range: 0–2000 ppm). • M𝑇mod : continuous moderator-temperature operators acting on the cross-section library through the parametric dependence Σ(𝑇mod ) (typical PWR operating range: 290–320°C). ACM Trans. Softw. Eng. Methodol., Vol. 0, No. 0, Article 0. Publication date: 2026.

NOETHER: A Constructive Framework for Metamorphic Pattern Discovery from Operator Algebras

0:27

Decomposed along the eight-block decomposition of Section 3.1.9: • 𝐺 ⊇ {Orod } (treated tentatively as a commutative semigroup; the assignment will be shown below to fail); • 𝑂 ≤ ⊇ {M𝐶𝐵 , M𝑇mod } (parameter-monotonicity operators); • 𝑇 ∗ ⊇ {−∇ · 𝐷∇ + Σ𝑎 } (the self-adjoint diffusion operator under isotropic scattering; Bell & Glasstone [23] §6.1, Lewis & Miller [24] §4.2); ∗ = ∅ (PWR diffusion is dissipative); • Trev ∗ • L , D ∗, E ∗ as in ABoltz with appropriate restrictions to the diffusion regime; ∗ = ∅ (no idempotent-semiring structure on PWR core states). • Brel We will show that despite this rich block structure, two specific PWR-safety MRs cannot be derived through Translate from any single block. Main proposition: non-additivity of rod-bank reactivity worth. Definition 15 (Differential rod-bank reactivity worth, exact form). For a base input 𝑥 0 ∈ X and a rod-bank operator 𝐴 ∈ Orod , the (positive-convention) reactivity worth of 𝐴 is 1 1 > 0, − 𝑑𝜌 (𝐴; 𝑥 0 ) := 𝐴 · 𝑥 )) 𝑘 eff (𝑃 (𝑥 0 )) 𝑘 eff (𝑃 (Orod 0 where 𝑘 eff (𝑃 (𝑥)) denotes the dominant eigenvalue of the diffusion operator at configuration 𝑥. We write 𝑑𝜌 (𝐴 ∪ 𝐵; 𝑥 0 ) when both banks 𝐴 and 𝐵 are inserted simultaneously. Equivalently, in con𝐴 · 𝑥 ) where 𝜌 = 1 − 1/𝑘 ventional reactor-physics notation, 𝑑𝜌 (𝐴; 𝑥 0 ) = 𝜌 (𝑥 0 ) − 𝜌 (Orod 0 eff is the static reactivity. The exact form avoids first-order perturbation-theoretic approximation; the standard adjoint-perturbation reading appears below. Definition 16 (Non-additivity of rod-bank reactivity worth, 𝜌 nonadd ). For two control-rod banks 𝐴, 𝐵 ∈ Orod with disjoint geometric supports and a base input 𝑥 0 , define the mixed-difference functional Δ𝐴𝐵 (𝑥 0 ) := 𝑑𝜌 (𝐴 ∪ 𝐵; 𝑥 0 ) − 𝑑𝜌 (𝐴; 𝑥 0 ) − 𝑑𝜌 (𝐵; 𝑥 0 ). The non-additivity metamorphic relation asserts: there exist disjoint-support banks 𝐴, 𝐵 and base input 𝑥 0 ∈ X in the standard PWR operating envelope (typical multi-bank insertion patterns of D, C, B, A control banks at partial insertions) such that 𝜌 nonadd :

|Δ𝐴𝐵 (𝑥 0 )| > 𝜏nonadd,

with 𝜏nonadd = 5 pcm. The tolerance is calibrated to PWR engineering practice: empirical |Δ𝐴𝐵 | for adjacent rod banks ranges over 101 –102 pcm [29]; the tolerance 𝜏nonadd = 5 pcm lies safely above PWR core-simulator iterative convergence tolerances (typically 0.1–1 pcm for 𝑘 eff ) and below the physical signal magnitude. Selection of test bank configurations (𝐴, 𝐵) is the user’s responsibility; the framework’s failure to derive 𝜌 nonadd is independent of the specific tolerance choice. Two physical regimes of Δ𝐴𝐵 . When Δ𝐴𝐵 (𝑥 0 ) > 0 for adjacent or geometrically overlapping rod banks, the standard PWR designation is positive shadowing (the worth of the second bank is reduced because the adjoint flux 𝜙 † is depressed in 𝐴’s geometric support). Positive shadowing is the dominant regime in conventional PWR analyses; it is the phenomenon explicitly addressed in NRC SER reviews of SIMULATE-3/5, ANC, and PARCS, with typical magnitudes of 50–500 pcm for adjacent bank pairs. When Δ𝐴𝐵 (𝑥 0 ) < 0 for distant banks under asymmetric insertion patterns, the designation is anti-shadowing; this is a secondary but routinely measurable regime in standard commercial PWRs (typical magnitudes 5–20 pcm for distant bank pairs in 4-loop Westinghouse and EPR configurations), and is more pronounced in small-core or strongly asymmetric insertion patterns. Both regimes are routinely measured in PWR startup physics testing and are documented ACM Trans. Softw. Eng. Methodol., Vol. 0, No. 0, Article 0. Publication date: 2026.

0:28

Meng Li, Xiaohua Yang, Jie Liu, and Shiyu Yan

in Stamm’ler & Abbate [29] as second-order but non-negligible phenomena that core simulators must reproduce. The MR 𝜌 nonadd is direction-agnostic and covers both; the test only requires that |Δ𝐴𝐵 | exceed the tolerance, irrespective of sign. Both regimes are accessible to a verifying core simulator regardless of whether the engineering analysis is concerned primarily with one or the other. Standard adjoint-perturbation reading (informative, not load-bearing for the proof). Under firstorder perturbation theory [23, §6.3], [24, §4.4], the worth of bank 𝐵 in the configuration with bank 𝐴 already inserted is 𝑑𝜌 (𝐵; 𝐴, 𝑥 0 ) ≈ −

⟨𝜙𝐴† , 𝛿𝐻𝐵 𝜙𝐴 ⟩ ⟨𝜙𝐴† , 𝐹𝐴 𝜙𝐴 ⟩

,

where (𝜙𝐴 , 𝜙𝐴† ) are the forward and adjoint principal eigenfunctions of the 𝐴-rodded but 𝐵unrodded core, 𝐹𝐴 = 𝜒𝜈 Σ 𝑓 is the fission source operator at that configuration, and 𝛿𝐻𝐵 is the operator perturbation produced by inserting 𝐵 (which generally affects Σ𝑎 , Σ𝑡 , and the scattering kernel). The adjoint flux 𝜙𝐴† is the principal eigenfunction of a structurally different adjoint operator 𝐻𝐴† from 𝜙 ∅† (the unrodded adjoint): in particular, 𝜙𝐴† is locally depressed in 𝐴’s geometric support and globally redistributed elsewhere. The non-additivity Δ𝐴𝐵 ≠ 0 thus follows from 𝜙𝐴† ≠ 𝜙 ∅† , which is a consequence of 𝐻𝐴† ≠ 𝐻 ∅† . The exact form (Definition 15) does not require this perturbation-theoretic reading; the proof below uses only the eigenvalue definitions. Proposition 1 (Non-additivity is not Translate-reachable on APWR ). Let APWR be the PWR core diffusion algebra above, with eight-block decomposition D (APWR ). For every block 𝑠 ∈ D (APWR ) and every invariant 𝜄 ∈ I𝑠 , Translate(𝜄, 𝑠) ≠ 𝜌 nonadd . Equivalently, 𝜌 nonadd ∉ MR(APWR ) in the sense of Definition 13. The proof, by exhausting the eight blocks against the per-block Translate templates of Table 18, is given in Appendix A. Engineering significance. Non-additivity of control-bank reactivity worth is a textbook PWR safety phenomenon. Bell & Glasstone [23, §10.4] and Lewis & Miller [24, §4.4] treat the underlying adjoint-perturbation mechanism; Stamm’ler & Abbate [29] document its operational consequences in PWR rod-worth measurements. Non-additivity is observed in both critical and sub-critical PWR core configurations, with the sub-critical regime exhibiting larger adjoint-flux distortions and correspondingly larger |Δ𝐴𝐵 |. PWR core simulators are required by regulatory practice (e.g. NRC SER for SIMULATE-3/5, ANC, PARCS; cf. NRC Regulatory Guide 1.77 [47] on rod-ejection accident analysis, with rod-worth modelling accuracy as a critical input) to reproduce the worth functional with sub-percent accuracy across multi-bank insertion patterns. A framework that cannot, in principle, derive this MR from its algebraic input is missing structural content that PWR engineers routinely test for. Supporting proposition: second-order mixed dependence of 𝑘 eff on 𝑇mod and 𝐶𝐵 . Definition 17 (MTC-vs-boron mixed-derivative MR, 𝜌 MTC-bor ). Let 𝑘 eff (𝑇mod, 𝐶𝐵 ; 𝜉 0 ) denote the dominant eigenvalue of the PWR core diffusion operator as a function of moderator temperature 𝑇mod and soluble-boron concentration 𝐶𝐵 , holding fixed the auxiliary state 𝜉 0 = (BU0, 𝑇fuel,0, geometry, loading pattern, rod-bank position). Define the static reactivity 𝜌 static (𝑇mod, 𝐶𝐵 ; 𝜉 0 ) := 1 −

1 , 𝑘 eff (𝑇mod, 𝐶𝐵 ; 𝜉 0 )

ACM Trans. Softw. Eng. Methodol., Vol. 0, No. 0, Article 0. Publication date: 2026.

NOETHER: A Constructive Framework for Metamorphic Pattern Discovery from Operator Algebras

0:29

expressed in pcm units (1 pcm = 10−5 ). The moderator temperature coefficient (MTC) at (𝑇mod, 𝐶𝐵 ; 𝜉 0 ) is the partial derivative of static reactivity with respect to moderator temperature, in standard PWR engineering convention [23, §10.3], [48, §3.4]: 𝛼 MTC (𝑇mod, 𝐶𝐵 ; 𝜉 0 ) :=

𝜕𝜌 static , 𝜕𝑇mod 𝐶𝐵 , 𝜉 0 fixed

(units: pcm/°F or pcm/°C).

The second-order mixed dependence MR asserts: for (𝑇mod, 𝐶𝐵 ; 𝜉 0 ) in the standard PWR operating envelope at hot-full-power (HFP), all-rods-out (ARO) reference conditions (typical: 𝑇mod ∈ [290, 320]°C, 𝐶𝐵 ∈ [0, 2000] ppm, BU0 ∈ [0, 50] GWd/tU, full-power 𝑇fuel,0 ), the mixed second partial derivative satisfies 𝜕 2 𝜌 static 𝜌 MTC-bor : > 𝜏MTC-bor, 𝜕𝑇mod 𝜕𝐶𝐵 with 𝜏MTC-bor = 0.01 pcm/°F/ppm (equivalently ∼ 1.8 × 10−2 pcm/°C/ppm). The tolerance is calibrated to PWR engineering practice: the empirical value of 𝜕𝛼 MTC /𝜕𝐶𝐵 in Westinghouse/Framatome PWR designs ranges over 0.02–0.04 pcm/°F/ppm at BOC-to-EOC cycle conditions [48, §3.4], [49, §8.3]; the tolerance 𝜏MTC-bor = 0.01 pcm/°F/ppm lies safely below this physical magnitude and well above PWR core-simulator differential-perturbation noise (typically ∼ 10−3 pcm/°F/ppm for converged eigenvalue calculations). Note on equivalent formulations. Since 𝜌 static = 1 − 1/𝑘 eff and 𝑘 eff ≈ 1 at critical PWR conditions, 2 ) 𝜕𝑘 /𝜕𝑇 −4 relative error. The MR may 𝜕𝜌 static /𝜕𝑇mod = (1/𝑘 eff eff mod ≈ 𝜕𝑘 eff /𝜕𝑇mod to within ∼ 10 2 equivalently be expressed in terms of |𝜕 𝑘 eff /(𝜕𝑇mod 𝜕𝐶𝐵 )| > 𝜏MTC-bor with the same tolerance, modulo this 𝑘-vs-𝜌 scaling factor; the algebraic argument of Appendix A (which depends only on 𝑘 eff being an operator-spectrum quantity) applies identically to either formulation. Equivalent formulation in terms of MTC.. Definition 17 is equivalent to asserting 𝜕𝛼 MTC (𝑇mod, 𝐶𝐵 ; 𝜉 0 ) > 𝜏MTC-bor 𝜕𝐶𝐵 at HFP, ARO conditions. Physically, this captures the well-established PWR design property that MTC becomes monotonically more negative as 𝐶𝐵 decreases from BOC values (∼1500 ppm) to EOC values (∼0 ppm). At HFP operating conditions, MTC is regulated to be ≤ 0 pcm/°F across the entire operating range per 10 CFR 50 Appendix A General Design Criterion 11 [50]; the slope 𝜕𝛼 MTC /𝜕𝐶𝐵 governs how rapidly MTC moves toward more negative values as boron is depleted over the cycle, with typical magnitudes ranging from near-zero (at BOC, high boron) to −30 to −50 pcm/°F (at EOC, near-zero boron). At hot-zero-power (HZP) conditions, BOC MTC may approach zero or be slightly positive within the analytical envelope (a regime relevant to startup physics testing but not to power-operation safety analysis); HZP MTC is bounded by separate Technical Specifications limits. The strength of 𝜕𝛼 MTC /𝜕𝐶𝐵 is the engineering target of MTC-vs-boron concentration curve calculations performed for every PWR cycle reload, and is governed by the competition between three physical mechanisms [48, §3.4]: (a) Reduced moderation: 𝑇mod ↑⇒ moderator density ↓⇒ neutron moderation reduced ⇒ thermal-flux fraction ↓⇒ fission rate ↓. Contributes a negative term to MTC. (b) Boron poison evacuation: at high 𝐶𝐵 , 𝑇mod ↑⇒ moderator density ↓⇒ boron number density ↓ (since boron is dissolved in the moderator) ⇒ boron absorption ↓. Contributes a positive term to MTC, partially cancelling (a). This term is proportional to 𝐶𝐵 and vanishes as 𝐶𝐵 → 0. (c) Spectrum hardening and 238 U resonance enhancement: 𝑇mod ↑⇒ reduced moderation ⇒ harder neutron spectrum ⇒ enhanced 238 U resonance absorption (Doppler-weighted by the ACM Trans. Softw. Eng. Methodol., Vol. 0, No. 0, Article 0. Publication date: 2026.

0:30

Meng Li, Xiaohua Yang, Jie Liu, and Shiyu Yan

fuel temperature) ⇒ neutron loss ↑. Contributes a further negative term to MTC. This term is small for low-enriched UO2 but becomes significant for MOX fuels and high-enrichment (> 5%) UO2 . At high 𝐶𝐵 the partial cancellation from (b) is strong; mechanisms (a) and (c) are partially offset and MTC magnitude is small. At low 𝐶𝐵 , mechanism (b) vanishes; mechanisms (a) and (c) dominate and MTC becomes strongly negative. The mixed second derivative 𝜕 2 𝜌 static /(𝜕𝑇mod 𝜕𝐶𝐵 ) measures the rate at which the boron-mediated cancellation is removed as 𝐶𝐵 decreases. Proposition 2 (MTC-vs-boron mixed dependence is not Translate-reachable). Let APWR be the PWR core diffusion algebra above. For every block 𝑠 ∈ D (APWR ) and every invariant 𝜄 ∈ I𝑠 , Translate(𝜄, 𝑠) ≠ 𝜌 MTC-bor . Equivalently, 𝜌 MTC-bor ∉ MR(APWR ) in the sense of Definition 13. The proof, by reducing the obstruction to the high-order-mixed-difference structure of 𝜌 MTC-bor and verifying that no per-block 𝜋 template captures such structure, is given in Appendix A. Engineering significance. The MTC vs. boron concentration curve is computed for every PWR cycle reload as part of the safety-analysis report submitted to regulators. The curve underlies the moderator temperature coefficient surveillance requirement at hot-full-power, all-rods-out conditions, under which MTC must satisfy a stated upper limit (≤ 0 pcm/°F per 10 CFR 50 Appendix A General Design Criterion 11 [50]; specific numerical limits are given in plant-specific Technical Specifications). The slope 𝜕𝛼 MTC /𝜕𝐶𝐵 is the key sensitivity parameter for projecting MTC behaviour across the cycle from a small number of measurement points (typically four-to-six points per cycle, measured at quarter-cycle intervals): it is computed by each cycle-reload core simulator run and reported to the operator. Measurement uncertainties and prediction protocols are documented in ANS 19.6.1 [51]. A core simulator that cannot reproduce the slope to within the tolerance of 𝜏MTC-bor would fail the cycle-reload qualification process. The MR is therefore not a textbook curiosity; it is a routine and regulatory-essential output of every PWR core simulator. Five independent structural obstructions. The two propositions are independent in the strong sense that no single extension of NOETHER’s Translate repairs both: Table 4. Five pairwise-independent structural obstructions in Translate’s present signature, identified by Propositions 1–2. Proposition

Failure mode

Required extension to Translate

1 (non-additivity)

Output is an algebraic-spectrum quantity (𝑘 eff as an eigenvalue, not in Y)

Operator-spectrum output relations on 𝜋 ’s codomain

1 (non-additivity)

Worth functional is non-additive (failure of semigroup homomorphism)

Homomorphism-failure 𝜋 -template alongside equivariance / monotonicity / selfadjointness

† Adjoint weighting function 𝜙𝑋 varies with operator history 𝑋

Configuration-indexed adjoint structure on 𝑇∗

2 (mixed derivative)

MR is a non-zero second-order mixed partial derivative, not a first-order relation

Higher-order mixed-difference 𝜋 -templates (currently all 𝜋 templates are first-order)

2 (mixed derivative)

MR involves two independent parameter directions (𝑇mod , 𝐶𝐵 ) jointly, not chained or single-direction

Two-direction joint parametric dependence beyond the single-𝜃 partial order of Definition 11

1 (non-additivity)

The five rows in this table identify five pairwise-independent structural features of Translate that are absent in Definition 12. Each row, considered alone, would require a specific extension of ACM Trans. Softw. Eng. Methodol., Vol. 0, No. 0, Article 0. Publication date: 2026.

NOETHER: A Constructive Framework for Metamorphic Pattern Discovery from Operator Algebras

0:31

Definition 12; no single extension covers any two rows simultaneously. The eight-block decomposition (Hypothesis 1) is therefore not the only constraint on the framework’s reach; the shape of Translate itself is. The two MRs 𝜌 nonadd and 𝜌 MTC-bor are also physically independent: they probe disjoint physical mechanisms (rod-induced adjoint distortion vs. moderator-poison density coupling), and a PWR core simulator could pass one MR while failing the other (and vice versa). They are therefore complementary verification targets, not duplicates of a single underlying property. What this subsection establishes and does not establish. Established. Theorem 1′ (Conjecture A) is false on APWR : there exist two specific MRs, each empirically realised on every conforming PWR core simulator and each documented in standard PWR safety-analysis literature and regulatory guidance, that are formulable over APWR ’s operators but not in MR(APWR ) in the sense of Definition 13. The two MRs identify five pairwise-independent structural obstructions in Translate’s present signature. Not established. That Theorem 1 itself fails. Theorem 1’s closure result is over MR(APWR ) as defined by Definition 13; the two MRs of this subsection lie outside that set, so they are out-ofscope for Theorem 1 and consistent with it. The proper characterisation is that Theorem 1 is a substantially weaker statement than Theorem 1′ pretended to be, and the gap is now exhibited concretely with two independent witness MRs. Not established. That a Composite-Translate extension of NOETHER would absorb these two MRs while preserving Theorem 1’s closure and Theorem 2’s polynomial-time decidability. This is the principal open problem the negative instantiation leaves to follow-up work. The five obstructions of Table 4 are pairwise independent, so any candidate extension must address them jointly rather than sequentially. 4

Empirical evaluation

This section validates the framework against five research questions. RQ1: does CONSTRUCTMP re-derive an existing inductive MR catalogue at the algebra-block level (addressed by §3.3.3 within the Boltzmann instantiation)? RQ2: do the derived MRs execute on real cross-domain systems under test (§4.1)? RQ3: does the pre-registered L ∗ -blindness prediction hold on independent substrates (§4.2)? RQ4: how does NOETHER compare against GenMorph, the closest evolutionary baseline, at GenMorph’s published budget (§4.2.7)? RQ5: how does NOETHER compare against METRIC+ on the corpus that METRIC+ itself published (§4.3)? 4.1

A small-scale comparative case study

The derivations in Sections 3.4.3–3.4.5 establish that NOETHER produces concrete, executable MRs in the equivariant-ML setting. They do not yet show that the MRs produced are useful for testing relative to MRs a tester could obtain by other means. This subsection reports a small-scale comparative case study designed to address that question while remaining within the conceptualtransfer scope declared in Section 3.4. The study is a case study in the strict sense: a single model, a small mutation set, and three MR sets. We do not generalise from it to claims about average-case fault detection across equivariant ML. Subject under test. We use an E(3)-equivariant graph neural network [34] (EGNN) as a deliberately compact minimal stand-in for a full SE(3)-Transformer [35] or a Vector-Neuron-based SO(3)-equivariant architecture [52]: two EGNN layers, hidden dimension 16, 5,189 parameters, trained on a procedural 5-class point-cloud dataset (sphere, cube surface, torus, cone, helix; 64 points per cloud; 400 training / 100 validation; rotation augmentation) for 25 epochs on Apple M1 Pro / MPS. Validation accuracy after training: 0.93. EGNN carries only invariant scalar ACM Trans. Softw. Eng. Methodol., Vol. 0, No. 0, Article 0. Publication date: 2026.

0:32

Meng Li, Xiaohua Yang, Jie Liu, and Shiyu Yan

and equivariant 3-vector features (type-0 ⊕ type-1 in the irrep classification), not the full type-ℓ steerable representation of an SE(3)-Transformer; the 𝑇 ∗ block instantiation in this case study is therefore an explicitly added symmetrised QK probe (equivariant_classifier.py:qk = nn.Parameter(torch.eye(d)) with the symmetrising operation at use-time), not a property of the EGNN architecture itself. The manuscript’s transfer claim is at the operator-algebra level (Section 3.4) and is independent of which equivariant architecture instantiates Aequi ; it is the algebraic skeleton that transfers, not architecture-specific empirical numbers. Architecture, training script, dataset generator, frozen checkpoint, and the SHA-256 of the supplementary archive are recorded under S3. Three MR sets, controlled for the same prompt and budget. Three MR sets are compared, each of size five (matching |M(Aequi )non-empty |): • Set N (NOETHER-derived): {𝜌 rot, 𝜌 mono, 𝜌 train, 𝜌 adj, 𝜌 train-rev }, one per non-empty block of Aequi , as itemised in the “Coverage status, revised” paragraph of Section 3.4.5. • Set L (LLM-prompt baseline): five MRs generated by prompting GPT-4 with the task description “produce five metamorphic relations for testing an SE(3)-equivariant point-cloud classifier”, with no further structural cue. The prompt and full output are reproduced in supplementary material S3. • Set B (literature baseline): five MRs synthesised from MRs reported in the metamorphictesting-for-ML literature [3, 7, 16], restricted to MRs applicable to point-cloud classifiers. Where the literature provides more than five candidates we select the most-cited. Mutation set. We construct a mutation set of 𝑁 mut = 20 defects in the model under test, drawn from four categories of fault commonly reported in equivariant-ML implementations [31]: (i) wrong sign on a custom loss term (𝑛 1 = 5); (ii) accidental break of equivariance through a nonequivariant intermediate layer (𝑛 2 = 5); (iii) numerical-precision degradation, e.g. truncation in the spherical-harmonics computation (𝑛 3 = 5); (iv) gradient-reversal sign error in the training script (𝑛 4 = 5). Each mutation is implemented as a code-level diff against the reference checkpoint and its hash recorded in S3. Metrics. For each MR set 𝑆 ∈ {𝑁 , 𝐿, 𝐵} and each mutation 𝜇, we record (i) whether at least one MR in 𝑆 flags 𝜇 as a fault (detection), and (ii) the structural-coverage status of 𝑆 over M(Aequi ). We report: • detection(𝑆) = |{𝜇 : ∃𝜌 ∈ 𝑆, 𝜌 flags 𝜇}|/𝑁 mut ; • coverageNOETHER (𝑆, Fequi ) from Section 4.4; • the unique-detection count |{𝜇 : 𝑆 detects 𝜇 and no other set does}|. Pre-registered hypotheses. We pre-register two hypotheses before running the mutation experiments, to make the falsifiability of the case study explicit: H1 (coverage): coverageNOETHER (𝑁 ) = 1.0 by construction; coverageNOETHER (𝐿) and coverageNOETHER (𝐵) are strictly less than 1.0. H2 (unique detection): Set 𝑁 has at least one mutation it uniquely detects, namely a mutation in category (iv) (gradient-reversal sign error), via 𝜌 train-rev . H1 is a structural prediction of Theorem 1 and the case study can falsify it only if NOETHER’s derivation is incorrect. H2 is a non-trivial empirical prediction: it would be falsified if 𝐿 or 𝐵 generated an equivalent training-time-reversal MR, or if the mutation was visible to an invariance MR for some unrelated reason. ACM Trans. Softw. Eng. Methodol., Vol. 0, No. 0, Article 0. Publication date: 2026.

NOETHER: A Constructive Framework for Metamorphic Pattern Discovery from Operator Algebras

0:33

Results. Table 5 reports the case-study numbers. The full row-level outcome matrix (one row per (mr, mutation) pair, 300 rows in total) is provided as supplementary material S3, together with the runner script (runner.py) and the analysis script (analysis.py) that produce these numbers deterministically from the trained checkpoint. The model under test is an E(3)-equivariant graph neural network [34] (5-class procedural point-cloud classifier; 5,189 parameters; trained on Apple M1 Pro / MPS; validation accuracy 0.93 after 25 epochs). Table 5. Results of the small-scale comparative case study (Section 4.1). Trained E(3)-equivariant point-cloud classifier; eight 128-point random test clouds per (MR, mutation) pair. The cat-(iv) row is construct-validitycontrolled: the mutation category was constructed so that 𝜌 train-rev alone covers it (one defect category per non-empty block of Aequi ), and the 5/5 unique-detection figure therefore exhibits construct validity of 𝜌 train-rev rather than averaged superiority. Detection numbers for 𝜌 adj in Set N use the CI-time forwardpass-only formulation of §3.4.4; the alternative debug-time harness-time formulation is available in supplementary S1 but is not used here.

Detection rate Structural coverage (coverageNOETHER ) Unique detections Detected cat. (i) wrong-sign loss Detected cat. (ii) equivariance break Detected cat. (iii) precision degradation Detected cat. (iv) gradient-reversal sign

Set N (NOETHER)

Set L (LLM)

Set B (Lit.)

7/20 1.00 5 0/5 2/5 0/5 5/5

2/20 0.40 0 0/5 2/5 0/5 0/5

0/20 0.20 0 0/5 0/5 0/5 0/5

Hypothesis verdicts. H1 is retained as a structural sanity check rather than as a falsifiable hypothesis test. By the framework’s construction, coverageNOETHER (𝑁 ) = 1.00 holds before any experiment is run; H1’s failure can occur only if one of the derivations in Sections 3.4.3–3.4.5 is itself in error. We accordingly use the coverageNOETHER values, 1.00 for Set N, 0.40 for Set L (the 𝐺 and L ∗ blocks are reached by an LLM-prompted MR), and 0.20 for Set B (only L ∗ via Shin et al.’s idempotency MR; the other four literature MRs are out-of-scope under Aequi ), as a structural-prior diagnostic, not as a fault-detection metric: the gap quantifies what the algebraic prior contributes that prompt-based and literature-derived MR sets lack on this particular algebra. The load-bearing comparative result of the case study is H2. H2 is consistent with the data, but its verdict is construct-validity-controlled: Set N uniquely detects all five category-(iv) mutations, and in every case the detector is 𝜌 train-rev . Sets L and B detect zero cat-(iv) mutations: neither corpus contains an MR exercising the SGD-trajectory time-reversal property, which is exactly what NOETHER’s T ∗ block predicts they would miss without an algebraic warrant. This contrast exhibits construct validity of 𝜌 train-rev as a gradient-reversal probe, not NOETHER’s superiority on a defect distribution sampled neutrally from real-world bug reports (the mutation set was constructed to cover one defect category per non-empty block of Aequi , so cat-(iv)’s category was selected because 𝜌 train-rev alone covers it). The unique-detection asymmetry between Set N and Set B is statistically significant at 𝛼 = 0.05 on the case study’s mutation set (paired McNemar exact two-sided 𝑝 = 0.016; unpaired Fisher exact 𝑝 = 0.008); between Set N and Set L it is borderline (𝑝 McNemar = 0.063, 𝑝 Fisher = 0.13) given Set L’s two-mutation cat-(ii) overlap with Set N. Wilson 95% confidence intervals on detection rates are [0.18, 0.57] for Set N, [0.03, 0.30] for Set L, and [0.00, 0.16] for Set B; the intervals N vs B are non-overlapping. The full pairwise comparison matrix (McNemar 𝑏/𝑐 counts, Fisher 2×2 tables, Wilson CIs) is in supplementary material S3 (table4.json::pairwise_stats). ACM Trans. Softw. Eng. Methodol., Vol. 0, No. 0, Article 0. Publication date: 2026.

0:34

Meng Li, Xiaohua Yang, Jie Liu, and Shiyu Yan

Construct-validity caveat for H2. The mutation set was constructed to cover one defect category per non-empty block of Aequi ; in particular, cat-(iv) was selected because it targets the T ∗ block that 𝜌 train-rev alone covers. The 5/5 unique-detection result therefore exhibits construct validity of 𝜌 train-rev as a gradient-reversal probe rather than NOETHER’s superiority on a defect distribution sampled neutrally from real-world bug reports. That weaker reading is still informative: it shows that the framework’s T ∗ -derived MR is non-redundant relative to LLM-prompted and literaturederived MRs. What is and is not detected: a framework boundary, not an edge case. The result that no MR set detects category-(i) wrong-sign mutations is the most informative cell of Table 5 and we choose to foreground it as a framework boundary rather than an edge case. A sign-flipped classification head still satisfies SO(3)-rotation invariance and permutation invariance (the equivariance contract is intact), still passes inference idempotency, satisfies the symmetrised adjoint identity, and is monotone under point-density sub-sampling. The eight blocks of Hypothesis 1 contain no labelconsistency block, and the wrong-sign-loss fault class is precisely the kind a label-consistency MR would catch. This is the label-consistency out-of-scope class enumerated in Remark 2: ML program families that ship with labelled training data are a candidate ninth block. We do not absorb this case into “out-of-scope for MR testing” in some over-broad sense; the original motivation for MR testing is precisely the absence of an oracle, so framing label-consistency MRs as fundamentally out-of-scope would over-claim the framework’s boundary. Similarly, cat-(iii) precision-degradation mutations on a 16-dim hidden state are not detectable at our chosen tolerances; tighter 𝜏 would surface them at the cost of more baseline false positives. A tolerance-sensitivity sweep over 𝜏 ∈ {10−3, 10−4, 10−5 } is reported in supplementary S3 (tau_sweep.json) and shows monotone increase in detection at the cost of monotone increase in baseline false-positive rate. Cat-(ii) equivariance-break mutations are detected by both Set N and Set L through 𝜌 rot / 𝐿rot (parity is expected: rotation-invariance is the structural property the LLM is most likely to rediscover from the system description; the case study’s discriminating cell is cat-(iv)). Interpretation conditions, stated in advance. We commit in advance to the following readings of the eventual numerical outcomes: • If H1 fails (i.e. coverageNOETHER (𝑁 ) < 1.0): one of the derivations in Sections 3.4.3–3.4.5 is incorrect and must be revised; the framework’s transfer claim does not stand on this benchmark. • If H1 holds and H2 fails (i.e. no unique detection in cat. iv): the framework’s coverage prediction is correct but the unique-MR claim is not differentiated by this mutation set; the LLM or literature baseline produced an equivalent gradient-reversal probe. • If H1 and H2 both hold: the case study is consistent with NOETHER’s transfer claim. We do not claim this would establish superior fault-detection on average; the comparison’s denominator (20 mutations, one model) is too small. • If detection(𝑁 ) < detection(𝐿): this is consistent with the framework’s design (NOETHER prioritises structural coverage, not raw detection on a particular mutation set) and is reported transparently rather than concealed. 4.1.1 A small DeepCrime-style real-fault pilot. To begin closing the gap between protocol and result, we executed a 𝑛 = 5 pilot extension of the case study with five mutation operators systematically derived from the DeepCrime taxonomy [53] (which extracts 35 mutation operators from real DL fault studies). The pilot operators are post-training mutations on the trained EGNN checkpoint and address category labels analogous to DeepCrime’s: cat-v-01 loss-reduction-like ACM Trans. Softw. Eng. Methodol., Vol. 0, No. 0, Article 0. Publication date: 2026.

NOETHER: A Constructive Framework for Metamorphic Pattern Discovery from Operator Algebras

0:35

(head-weight scaled by 1/𝑁 classes ), cat-v-02 activation change (tanh saturation), cat-v-03 layer removal (head zeroed), cat-v-04 bias removal, cat-v-05 weight re-init (Glorot). The pilot was run with runner_pilot.py against the same N/L/B MR sets, the same eight-cloud test set, and the same tolerance as the main case study. Results are deterministic given the seeds in supplementary S3. Table 6. DeepCrime-style real-fault pilot, 𝑛 = 5 mutations on the trained EGNN checkpoint. Wilson 95% CIs are given for context; pairwise Fisher-exact 𝑝-values are reported in supplementary S3 (deepcrime_pilot_stats.json). Set N (NOETHER) L (LLM) B (Lit.)

Detected / 5

Wilson 95% CI

2/5 (cat-v-01, cat-v-03 via 𝜌 train ) 0/5 0/5

[0.12, 0.77] [0.00, 0.43] [0.00, 0.43]

Table 7. Paired contingency for Set N vs Set L on the 𝑛 = 5 DeepCrime pilot. The Set N vs Set B contingency is identical because Set B also detected 0/5. The appropriate paired-binary test is McNemar’s exact test on the (𝑏, 𝑐) = (2, 0) discordant counts: two-sided exact 𝑝 = 0.500 (binomial 𝑋 = 0 in 𝑛 = 2 trials with 𝑝 0 = 0.5 under 𝐻 0 of equal Set N / Set L performance); equivalently, an unpaired Fisher exact 2 × 2 on rows = Sets, columns = (detected, missed) yields two-sided 𝑝 = 0.444. Both numbers fail to reject 𝐻 0 at 𝛼 = 0.05 because 𝑛 = 5 is below the threshold at which a 2/5 vs 0/5 contrast is inferentially decisive; per-pair statistics in supplementary S3 deepcrime_pilot_stats.json. Set L detected

Set L missed

Total

Set N detected Set N missed

0 0

2 3

2 3

Total

0

5

5

Reading the pilot (inferential verdict). At 𝑛 = 5 the appropriate paired-binary test is McNemar’s exact on the discordant counts (𝑏, 𝑐) = (2, 0) for both Set N vs Set L and Set N vs Set B: two-sided exact 𝑝 = 0.500 (and the unpaired-Fisher analogue yields two-sided 𝑝 = 0.444 on the same contingency); the pilot is therefore underpowered for an inferential conclusion at 𝛼 = 0.05. The 2/5 vs 0/5 vs 0/5 detection contrast is reported as descriptive evidence consistent with the direction of the framework’s L ∗ -block prediction, not as a hypothesis confirmation. The pilot’s load-bearing claim is that the comparative-evaluation infrastructure runs end-to-end against real-fault-style mutations on the trained checkpoint; non-vacuousness of the L ∗ -block prediction and the parameterdistribution candidate-ninth-block reading are candidate evidence requiring a larger 𝑛. Interpretation of the two detection events (mechanism, not inference). For descriptive context only, the detection mechanism on the two events: 𝜌 train tests training-size limit invariance — for inputs the model classifies confidently at full training, the prediction should remain stable when the head is exposed to a fresh small-batch fine-tuning step. cat-v-01 (head weight scaled by 1/𝑁 classes = 1/5) collapses head-output magnitudes uniformly toward zero, softens the softmax, and changes the argmax on inputs near classification boundaries; post-fine-tune predictions drift away from pre-fine-tune predictions and the inference-stability invariant fails. cat-v-03 (head weight zeroed) makes every output identically zero pre-softmax, again breaking inference stability. cat-v-02 (tanh saturation), cat-v-04 (bias removal), and cat-v-05 (Glorot re-init) preserve enough ACM Trans. Softw. Eng. Methodol., Vol. 0, No. 0, Article 0. Publication date: 2026.

0:36

Meng Li, Xiaohua Yang, Jie Liu, and Shiyu Yan

head signal for the inference-stability check to pass on the eight test clouds within the chosen tolerance, so 𝜌 train does not fire on them. The mechanism is therefore “𝜌 train ’s inference-stability check fails when head magnitude is perturbed past a margin-of-error threshold for boundary inputs” — a mechanism-level statement independent of the underpowered sample size. The pilot is the first empirical handhold beyond the constructed mutation set; the larger comparative-evaluation protocol below remains as committed work for follow-up. The three undetected mutations (cat-v-02 activation change, cat-v-04 bias removal, cat-v-05 weight re-init) are consistent with, but do not establish, the parameter-distribution candidate ninth block of Remark 2 item (vi); a panel of 𝑛 ≥ 20 mutations on more than one architecture is required to establish the block-extension claim. The pilot’s role here is to motivate the candidate, not to confirm it; we report it alongside the metric-stability candidate of Remark 4 as the two most actionable extension targets. Threats specific to this case study. The most material threats are: (a) MR-budget asymmetry: GPT-4 might generate more than five MR candidates given a different prompt and a larger budget; (b) baseline selection: the literature MR set is restricted by the rule “applicable to point-cloud classifiers”, which may exclude relevant MRs; (c) the mutation set is hand-constructed rather than mined from real defect logs, and importantly, constructed to cover one defect category per nonempty block of Aequi , with cat-(iv) selected because it targets the T ∗ -block MR 𝜌 train-rev . The 5/5 unique-detection result for cat-(iv) therefore exhibits construct validity of 𝜌 train-rev as a gradientreversal probe, not NOETHER’s superiority on a defect distribution sampled neutrally from realworld bug reports; (d) the case study uses a compact EGNN stand-in for a full SE(3)-Transformer, so architecture-specific empirical numbers do not generalise; and (e) Set L is a single GPT-4 sample at temperature 0 with a fixed seed (the prompt and raw output are recorded in supplementary S3 prompt_log.md); a different LLM, prompt, or temperature would yield different MRs and the case study does not characterise that variability. Section 4.1 does not generalise beyond this case-study scope; the comparative evaluation and real-bug protocols below describe the empirical extensions that address threats (a)–(c) directly. Comparative evaluation against published baselines (protocol). The single hand-constructed mutation set above is supplemented by a comparative protocol that runs Set N alongside two independent automated pipelines on a shared subject set. The protocol fixes the following measurable quantities, leaving only the result population to subsequent revisions of this paper. Subjects. (i) GenMorph’s published 23 Java-method benchmark [6] restricted to subjects whose induced operator algebra is non-trivial under the eight-block decomposition (we expect ≈ 14 subjects after filtering on whether A𝑃 has at least one non-empty block beyond 𝐺); (ii) two ML benchmarks built on DeepCrime real-fault mutation operators [53]: an MNIST classifier and a CIFAR-10 classifier under DeepCrime’s 24 mutation operators systematically extracted from real DL fault taxonomies. Replacing the hand-constructed 20 mutations with DeepCrime’s published real-fault operators directly addresses the construction-bias threat (c) above. Compared methods. Set N (NOETHER, derived from A𝑃 ); Set M (MR-Scout-mined [5] from existing test suites); Set G (GenMorph-evolved via genetic programming [6]); Set L (LLMprompted with the same prompt template as in the §4.1 case study); Set B (literature MRs). Metrics. Per-subject mutation-detection rate (Set ∩ killed mutants / total killed); real-bugdetection rate (where bug logs are available); false-positive rate on baseline (un-mutated) inputs; coverage with respect to the algebraic block decomposition coverageNOETHER . ACM Trans. Softw. Eng. Methodol., Vol. 0, No. 0, Article 0. Publication date: 2026.

NOETHER: A Constructive Framework for Metamorphic Pattern Discovery from Operator Algebras

0:37

Statistical tests. Wilson 95% CI on per-set detection rates; pairwise McNemar exact tests for paired Set-vs-Set comparisons; pairwise Fisher exact tests for unpaired comparisons; Bonferroni correction for the 10 pairwise tests across 5 sets. Pre-registered hypothesis (H3a, vs GP-evolved baseline). Three sub-claims: H3a.1 (Detection on D1, per-block). On the algebra-disrupting stratum (D1, Definition in §4.2.2), Set N’s per-block kill rate is competitive with or superior to Set G’s on at least one operative block within scope (per-block comparison; aggregate D1 dominance is not pre-registered as the load-bearing reading, see §4.2.7). H3a.2 (Complementarity). Set N and Set G exhibit non-trivial complementarity in mutant coverage on the D1 stratum (each set kills mutants the other misses); a non-zero 𝑁 -only kill count on at least one operative block is the operational test. H3a.3 (Cost-axis). Set N’s MR-generation cost is asymptotically lower than Set G’s (Theorem 2 polynomial-time decidability versus Set G’s ≈ 30-min stochastic GP search per SUT, detailed in Table 14). The cost-axis claim is independent of the detection-axis claims and is read on the cost-axis only. Pre-registered hypothesis (H3b, vs LLM-assisted baseline). On the structural-coverage diagnostic, coverageNOETHER (𝑁 ) > coverageNOETHER (𝐿ensemble ), where Set 𝐿ensemble is the LLM-assisted representative drawn from a multi-vendor × multi-temperature LLM-MRgeneration protocol that subsumes the single-sample probes of Shin [7] and Zhang et al. [14]. The diagnostic is interpreted as a structural-prior signal (NOETHER’s algebraic prior contributes block coverage that prompt-based LLMs lack on A𝑃 ), not as a fault-detectionsuperiority metric. Verdict (tested, borderline-PASS at the structural reading): a 2vendor (DeepSeek, ChatGPT) × 5-temperature ensemble harvested 487 LLM-proposed MRs across the 10 §4.2.3 SUTs (100 samples); 43.5% (212/487) of the proposals match a Set N block-template under deterministic translation, and the matchable subset reproduces Set N’s kill rate on the aligned-mutant substrate (34/70 = 0.486 for the ensemble union, identical to Set N on the same 70 mutants). The remaining 56.5% explore invariants outside the 8-block frame (associativity, identity / inverse element, monotonicity on SUTs lacking an Ole -block representative); these have no in-protocol kill measurement here and constitute the structural-coverage gap. NOETHER’s coverageNOETHER remains 1.00 by construction; the LLM ensemble’s block-template coverage of Set N’s catalogue is 43.5% on the matchable subset. A third-vendor (Anthropic Claude) replication is committed in follow-up (d.set-l-claude) of supplementary S4 (future_work.md). Pre-registered hypothesis (H3c, vs mining-based baseline). At cold start (no seed test corpus), Set N is operationally derivable from A𝑃 alone, while MR-Scout [5]’s reach is upperbounded by the seed-suite’s induced relations; an adapted-from-published-artifact estimate of MR-Scout’s reach on the §4.2.3 substrate is reported in Table 14 and contextualised in §4.2.7. Pre-registered hypothesis (continuous). H4 (detection-rate non-inferiority on real faults): on DeepCrime real-fault mutants, Set N’s detection rate is within Δ = 0.10 of the best nonNOETHER set’s detection rate, with Δ fixed in advance. The harness for this protocol is provided as supplementary S3 comparative_baseline/ with adapter scripts for each baseline; replication of the protocol on a different subject set requires only swapping the subject directory. Real-bug evaluation (protocol). To address threat (c) directly, we mine cat-(i)–(iv) faults from public bug reports of e3nn [54] and PyTorch Geometric [55], the two reference SE(3)-equivariant ACM Trans. Softw. Eng. Methodol., Vol. 0, No. 0, Article 0. Publication date: 2026.

0:38

Meng Li, Xiaohua Yang, Jie Liu, and Shiyu Yan

libraries. Target: 10 confirmed real-bug commits with associated test cases, one per cat-(i)–(iv) where available. For each bug: (1) the pre-fix source code is checked out into a frozen reference checkpoint; (2) all five MR sets (N, M, G, L, B) are run against the buggy code on the test inputs from the bug report; (3) detection is recorded as “MR fired = True” iff at least one MR in the set surfaces the buggy behaviour at the published tolerance. The construct-validity caveat at the start of this subsection then naturally resolves: defects are no longer “selected to cover one block per defect category”; they are mined from a fixed, preexisting defect distribution that the framework was not designed against. The protocol is provided as supplementary S5 real_bugs/ with one folder per bug containing the issue link, fix commit, test fixture, and per-MR detection outcome. 4.2

An empirical test of the eight-block decomposition: L ∗ -block blindness on homogeneity-preserving mutators

A generative framework that cannot make falsifiable quantitative predictions is rhetoric, not science. The previous two sections establish that NOETHER generates MRs in two domains with structurally distinct operator algebras (§3.3, §3.4); generation alone does not test the framework’s central methodological claim, that the eight-block decomposition (§3.1.9) is empirically operative as a mechanism rather than a derivation-bookkeeping device. This section reports an empirical test of one quantitative consequence of that claim. NOETHER predicts that an MR derived from the linearity-and-scaling block (L ∗ ) is necessarily silent on any mutator that preserves homogeneity of degree 1. PIT’s default mutator set has this property by direct calculation. The prediction is therefore that the L ∗ -block MRs in our SUT set will kill near-zero PIT mutants. We refer to this prediction as L ∗ -block blindness. The prediction is sharp, quantitative, and derivable from public information without consulting any data. The test of the prediction is the central content of this section. Pooled head-to-head numbers against an automated SOTA baseline (GenMorph [6]), structural coverage extension, and cross-pipeline MR rediscovery are reported as corroborating evidence; the section’s central claim does not depend on them. 4.2.1

The prediction: L ∗ -block blindness.

The MR shape. The L ∗ block of A𝑃 under Hypothesis 1 contains scaling and linearity operators. CONSTRUCT-MP’s Translate step (Definition 13) carries scaling-block invariants to MRs of the form 𝐿scale : 𝑓 (𝜆x) = 𝜆 · 𝑓 (x), 𝜆 > 0, (7) on positively-homogeneous-of-degree-1 programs. The shape is fixed by A𝑃 structure; it is not chosen with mutation testing in mind. The mutator semantics. PIT 1.7.4 [56] ships a default mutator set comprising seven canonical operator classes: arithmetic-operator swap (AOR; + ↔ −, × ↔ ÷), conditional boundary mutation, increment mutation, return-value swap (return zero, return one, return null), conditional negation (NCM), constant replacement, and member-call removal. Each AOR mutation that preserves the program’s domain of definition transforms a homogeneous-of-degree-1 function 𝑓 into another homogeneous-of-degree-1 function 𝑓 ′ , by the elementary fact that the four arithmetic operators in question commute with positive scalar multiplication of all inputs in the relevant homogeneous case (addition and subtraction are degree-1 homogeneous; multiplication and division shift degrees by ±1, but the swap × ↔ ÷ on a properly typed expression returns a degree-preserving result on the homogeneous-of-degree-1 sub-grammar). ACM Trans. Softw. Eng. Methodol., Vol. 0, No. 0, Article 0. Publication date: 2026.

NOETHER: A Constructive Framework for Metamorphic Pattern Discovery from Operator Algebras

0:39

The prediction. A composite of these two facts gives the central prediction. If 𝑓 satisfies 𝐿scale and the mutator 𝜇 preserves homogeneity of degree 1, then 𝜇 (𝑓 ) also satisfies 𝐿scale . Therefore the paired-MR test 𝑓 (𝜆x) − 𝜆𝑓 (x) ≤ 𝜏 vs. 𝜇 (𝑓 ) (𝜆x) − 𝜆𝜇 (𝑓 ) (x) ≤ 𝜏 returns the same verdict on 𝑓 and on 𝜇 (𝑓 ) for any x, 𝜆. The kill rate of 𝐿scale against the homogeneity-preserving subset of PIT’s mutators is identically zero by direct calculation, and against the full default mutator set is approximately zero up to a small fraction contributed by mutators that break homogeneity (return-value swap to zero or one; conditional-negation when the conditional carries a constant offset; constant replacement when the constant participates additively). Falsifiability. The prediction is falsified if the observed 𝐿scale kill rate is materially above zero on a substrate where the prediction’s homogeneity precondition is met. We define “materially above zero” in advance as a single 𝐿scale MR killing a third or more of its PIT mutants on more than one of the SUTs in the substrate. The prediction passes if the observed kill rate is ≤ 1/3 on at least five of the six SUTs admitting an 𝐿scale MR. The 1/3 threshold and the “more than one SUT” quantifier were committed to git (configs/d4j_algebra_rich_criterion.json) before the perMR kill-count files; under threshold sensitivity in the grid {1/4, 1/3, 1/2} × {more than zero, more than one, more than two}, the verdict remains Confirmed on 5/6 SUTs at all 9 grid cells, with hypotSig as the single SUT crossing every threshold; the result is therefore robust to plausible threshold variation. Outlier-handling rule. An outlier SUT (kill rate > 1/3) is rescued from falsification only if all of its killed mutants are independently classified as homogeneity-breaking under the framework’s mutator-semantics taxonomy √︁ (MATH-swap of × ↔ ÷ on bivariate degree-1 inputs ⇒ degree-changing; RC-replacement of 𝑥 2 + 𝑦 2 with a constant ⇒ fixed-output breaking scale-invariance; VR-unconditional-zero return ⇒ fixed-output sub-rule). Per-mutant classification must be logged alongside the kill data, and the classification must precede inspection of which mutants the outlier’s rescue depends on. The rule was codified in the pre-registration config on 2026-05-15 in response to a Round 2 review observation that the §4.2.4 hypotSig analysis had relied on a rule that was implicit rather than written. Under the codified rule, hypotSig’s two killed mutants (return_zero_doubles_VR and Math.sqrt_replaced_with_one_RC) both classify as homogeneity-breaking, so the original 5/6 verdict stands; future cross-codebase substrates inherit the rule as a written test. Public-information argument. Equation (7) is a consequence of A𝑃 structure and CONSTRUCTMP’s Translate step, both fully specified in §3.2. PIT’s default mutator set is public [56]. The composition of the two is a mathematical consequence requiring no experimental input. The prediction is therefore ex-ante in the strong sense that it is derivable from public information without consulting any data this paper produces. We track the prediction’s commitment to git in supplementary S7 (d4j/) alongside the SUT-selection criterion of §4.2.3. 4.2.2 PIT mutator and 8-block invariant compatibility. The L ∗ -blindness prediction generalises: each PIT default mutator either preserves or breaks the invariant of each NOETHER block, and an MR derived from a block fires on a mutant only if that mutant breaks the block’s invariant. Table 8 maps the seven PIT default mutator categories [56] against the eight NOETHER blocks and gives the typical-case verdict (“◦” = preserves the block invariant, the block’s MR is typically blind to the mutant; “×” = breaks the block invariant, the block’s MR can typically detect the mutant; “∼” = case-dependent on the SUT-specific block instantiation). The matrix stratifies mutants binary: algebra-disrupting (D1, at least one × in a populated column) vs algebra-preserving (D2, all ◦ in populated columns; ∼ resolved by SUT-specific overrides). ACM Trans. Softw. Eng. Methodol., Vol. 0, No. 0, Article 0. Publication date: 2026.

0:40

Meng Li, Xiaohua Yang, Jie Liu, and Shiyu Yan

Table 8. Typical-case compatibility of PIT default mutator categories with the eight NOETHER blocks. Cells reflect the dominant case for mutators in the category as applied to a generic algebra-rich SUT; SUT-specific exceptions are catalogued in supplementary S7 (d4j/). The cells ⟨MATH, L ∗ ⟩ and ⟨RETURN_VALS, L ∗ ⟩ are both “◦” (homogeneity-preserving), and the L ∗ -blindness result of §4.2.4 is the empirical specialisation of these two cells. PIT mutator category

𝐺

𝑂≤

𝑇∗

∗ Trev

L∗

D∗

E∗

∗ Brel

CONDITIONALS_BOUNDARY INCREMENTS INVERT_NEGS MATH (op swap) NEGATE_CONDITIONALS RETURN_VALS (zero/one) VOID_METHOD_CALLS

◦ × ∼ × × ◦ ◦

× × × ∼ × ◦ ◦

◦ × ∼ × ∼ × ◦

◦ × × × × × ◦

◦ × ∼ ◦ ∼ ◦ ◦

∼ ∼ ∼ × × ◦ ×

◦ ◦ ◦ ∼ ∼ ∼ ∼

◦ ◦ ◦ ◦ × ◦ ◦

The framework predicts Set N’s D2 kill rate is near zero by construction — a mutant that preserves all invariants is structurally invisible to algebraic MRs. D1 is therefore Set N’s appropriate fault-detection denominator; D2 is the territory of complementary techniques (random / GP / LLMprompted MRs). The L ∗ -blindness result of §4.2.4 is the corresponding D2-cell specialisation on the wider 23-SUT substrate. Kill-set overlap on the head-to-head substrate. On the 𝑛 = 62 PIT mutants pooled across the eight head-to-head SUTs, 22 are killed by both Set N and Set G, 4 are killed by Set N only, 18 are killed by Set G only, and 18 are killed by neither. The 18 G-only kills constitute a candidate scope-mismatch pool (mutants reachable by Set G’s GP-evolved oracle but missed by the algebraic Set N construction), and the 18 jointly-missed mutants further partition into D2 mutants outside Set N’s algebraic reach and D1 mutants both sets miss for input-coverage reasons. The L ∗ -only specialisation (Table 9) is the cleanest D2-cell estimate on the wider 23-SUT substrate, since the ⟨MATH, L ∗ ⟩ and ⟨RETURN_VALS, L ∗ ⟩ cells of Table 8 are both “◦”. Per-mutant D1 / D2 classification with SUT-specific overrides. Per-mutant classification applies Table 8 with SUT-specific overrides (in configs/sut_block_decomposition.json + configs/sut_block_overrides.json) resolving the “∼” cells. After the multi-LLM equivalentmutant exclusion of §4.2.7 (p. 47), the 𝑛 = 62 head-to-head pool drops to 𝑛 = 57 (52 D1 + 5 D2; all 5 excluded mutants were originally in the 10-mutant D2 stratum, so the D1 stratum is unchanged). Stratified kill rates: Set N D1 26/52 = 0.500 Wilson 95% [0.369, 0.631]; Set G D1 37/52 = 0.712 [0.577, 0.817]; Set N D2 0/5 = 0.000 [0.000, 0.434]; Set G D2 3/5 = 0.600 [0.231, 0.882]. The D2 point estimate (0.000) is consistent with the prediction ≤ 10%, but the Wilson upper bound does not exclude the 10% ceiling at 𝛼 = 0.05; the cross-codebase commons-math pilot (§4.2.8 (b.cm)) corroborates the direction at 2/29 = 6.9%. Set G’s 0.600 on D2 confirms that D2 is a Set N-specific scope boundary, not a substrate-wide ceiling — a GP-evolved generic baseline is unconstrained by the algebra. On D1, the cross-block aggregate gap (McNemar exact two-sided 𝑝 = 0.019) decomposes per-block in §4.2.7 (gap concentrated on 𝐺 and L ∗ ; partially offset by Set N’s T ∗ edge 10/17 vs 8/17); the per-block decomposition is the appropriate substrate-level reading. 4.2.3

Test design.

Substrate. PIT 1.7.4 with the default mutator configuration serves as the shared substrate. Each (subject, MR) pair is evaluated through (i) JUnit test-class codegen, (ii) a 2-pass surefire green-suite ACM Trans. Softw. Eng. Methodol., Vol. 0, No. 0, Article 0. Publication date: 2026.

NOETHER: A Constructive Framework for Metamorphic Pattern Discovery from Operator Algebras

0:41

filter that drops MR instances flaky on the unmutated SUT, and (iii) PIT mutation testing parsed to a per-mutant kill vector. Pre-registered SUT criterion. The selection rule is committed in configs/d4j_algebra_rich_ criterion.json on branch feat/d4j-algebra-rich of the experiment repository before any new evaluation data existed. The criterion references package roots (under org.apache.commons. math3.*, covering subpackages ode, linear, transform, analysis.solvers, distribution, optim, fitting, stat.regression, complex, geometry, fraction, plus their math.* legacy counterparts), per-package block-coverage hypotheses, and method-signature constraints; it contains no bug-id and no kill-rate references and cannot be tuned by evaluation outcomes. The git timestamp chain (criterion → inscope filter → Set N derivation → Set G GP rerun → pooled M1) is the auditable proof of pre-registration. To strengthen the third-party verifiability of the preregistration, the SHA-256 hash of configs/d4j_algebra_rich_criterion.json together with the matching commit hash is deposited in supplementary S7 (d4j/) alongside the experiment artifact; reviewers may verify the deposit against the criterion file directly. Subjects and MR yield. Ten SUTs admit at least one non-trivial NOETHER block beyond 𝐺: midpoint, exactLog2, isSequence (boolean predicate), clamp, signum, ComplexSignal.add (instance method), gcdSig, lcmSig, hypotSig, powerSig. Six of these admit an 𝐿scale MR (those whose induced algebra populates the L ∗ block under positive-scalar homogeneity): midpoint, clamp, signum, gcdSig, lcmSig, hypotSig. The remaining four do not admit a degree-1 scaling MR by their algebraic structure (exactLog2 carries no positive-degree scaling; isSequence is a boolean predicate; ComplexSignal.add is a complex-arithmetic instance method whose scaling block is distinct in formulation; powerSig populates 𝑇2∗ rather than L ∗ ). The prediction is tested on the six SUTs admitting 𝐿scale . Set N contains 30 hand-derived NOETHER MRs, two to four per SUT, one or more per non-empty block of each SUT’s induced algebra. Set G is harvested by rerunning GenMorph’s genmorph.py gen mode at seed = 11 on the 10 SUTs; Set G is used in §4.2.7 as the head-to-head comparator and plays no role in the central prediction test of §4.2.4. Metrics. Per-MR kill counts on PIT mutants are the primary measurement for the central prediction test. Pooled M1 and McNemar exact paired tests are reported in §4.2.7 as corroborating context. 4.2.4 Central result: L ∗ -block blindness, confirmed. The 𝐿scale MR’s per-SUT kill rate on PIT mutants of the six L ∗ -admitting SUTs is reported in Table 9. The total denominator is 44 mutants. The total kill count is 2. Reading. On 5 of 6 SUTs the prediction is confirmed at the strongest reading (zero 𝐿scale kills). On the sixth SUT (hypotSig) the kill rate is 2/4, above the per-SUT falsification threshold. The pooled rate 2/44 ≈ 4.5% remains an order of magnitude below the average Set N M1 of 0.486 (the average kill rate across all Set N MRs on the same substrate; see §4.2.7), and the per-SUT failure pattern is isolated to one SUT. The hypotSig outlier. The two-mutant kill on hypotSig is consistent with the prediction’s caveat in §4.2.1, that the small fraction of homogeneity-breaking mutators (return-value swap to a constant; constant-replacement that participates additively in the expression) is the residual non-zero contribution. Inspection of mutants_killed_set_n.csv for hypotSig (path in supplementary S7 (d4j/)) identifies the two killed mutants as KILLED return_zero_doubles_VR and ACM Trans. Softw. Eng. Methodol., Vol. 0, No. 0, Article 0. Publication date: 2026.

0:42

Meng Li, Xiaohua Yang, Jie Liu, and Shiyu Yan

Table 9. Per-SUT kill rate of the 𝐿scale MR on PIT mutants of the six SUTs admitting an L ∗ -block scaling MR. The prediction of §4.2.1 is that the kill rate is near-zero by composition of the homogeneity-preserving property of PIT’s default mutators with the scaling structure of 𝐿scale . Pooled across the six SUTs: 2/44 ≈ 4.5%, well below the 1/3 falsification threshold on each SUT and below it on 5/6 SUTs (hypotSig alone reaches 2/4 = 50%, explained in the text). 𝐿scale kill / mutants

Verdict

midpoint clamp signum gcdSig lcmSig hypotSig

0/3 0/7 0 / 6† 0/9 0 / 11 2/4

Confirmed Confirmed Confirmed (no 𝐿scale kill) Confirmed Confirmed Outlier; explained below

pooled (all six)

2 / 44

4.5%

SUT

† For signum the L ∗ -block MR is positive-scalar invariance (signum(𝜆𝑥 ) = signum(𝑥 ) for 𝜆 > 0) rather than degree-1

homogeneity; the prediction applies to this MR shape a fortiori since the right-hand side does not depend on 𝜆.

KILLED Math.sqrt_replaced_with_one_RC: the first replaces the entire return path with the constant zero, the second replaces the inner Math.sqrt call with the constant 1.0. Both mutators violate degree-1 homogeneity directly. The two detection events are therefore consistent with the prediction’s quantitative tail rather than evidence against it. Falsification verdict. By the criterion stated in §4.2.1, the prediction is falsified if a single 𝐿scale MR kills ≥ 1/3 of its PIT mutants on more than one SUT. Observed: one SUT (hypotSig, 2/4) above the per-SUT threshold; five SUTs (midpoint, clamp, signum, gcdSig, lcmSig) at zero. The prediction passes. We read this as direct empirical witness for the operative-mechanism reading of the eight-block decomposition: a block whose generator is a continuous symmetry of the mutator set contributes MRs that are quantitatively silent on mutator-induced defects, and the silence is observed in the data. 4.2.5 Corroborating per-block patterns. The prediction-test of §4.2.4 establishes the L ∗ -block result as the section’s central claim. The remaining three populated NOETHER blocks (𝑇 ∗ , 𝐺, I ∗ ) carry weaker, qualitative predictions that the data also confirms; they corroborate the operativemechanism reading without providing a falsifiable quantitative test. 𝑇 ∗ block (translation, period). Translation MRs carry the highest single-MR kill rates on the numeric SUTs: midpoint T_shift 3/3, powerSig T_exp_step 8/12, exactLog2 T_double 4/10, clamp T_shift 3/7. Translation invariance is the property most directly perturbed by PIT’s arithmeticoperator swaps; 𝑇 ∗ -derived MRs detect this perturbation reliably. The qualitative prediction (high single-MR rate on numeric SUTs) holds. 𝐺 block (group, symmetry). Symmetry MRs are moderately to highly effective when the SUT exposes the appropriate symmetry: signum G_negate 4/6, midpoint G_swap 1/3, ComplexSignal.add G_swap 2/3. The qualitative prediction (kill rate correlates with SUT-side symmetry exposure) holds. 𝐺-block framework boundary on recursive-normalising SUTs. The two Euclidean-style SUTs gcdSig and lcmSig exhibit Set N 0/7 on the 𝐺 block (Table 12); Set G achieves 7/7 on the same ACM Trans. Softw. Eng. Methodol., Vol. 0, No. 0, Article 0. Publication date: 2026.

NOETHER: A Constructive Framework for Metamorphic Pattern Discovery from Operator Algebras

0:43

mutants, confirming the mutants are detectable by some MR set and that the gap is therefore Set Nspecific. Reading the SUT source clarifies why this is not an MR-design defect but a frameworkboundary case: gcdSig and lcmSig both open with a sign-correcting prologue (a = a < 0 ? -a : a; on lines 67–68 and 81–82 respectively) that absorbs the 𝐺-block sign-flip identity before the recursive Euclidean reduction fires. The grid-synthesised 𝐺-block MR (gcdSig(a, b) = gcdSig(-a, -b), encoding the canonical 𝜎 = sign-flip involution) is therefore vacuously satisfied on the SUT’s normalised input domain, independent of any downstream mutation. The framework’s scope precondition (Definition 13) requires that the SUT’s input domain expose the algebraic action under test; for these two SUTs the 𝐺-action is structurally absorbed by the SUT’s own normalisation prologue, so 𝐺-block reasoning is orthogonal to the recursive Euclidean algorithm’s algebraic core (which is closer to a divisibility lattice D-block / reversibility R-block than to a pre-normalisation symmetry 𝐺). The 0/7 Set N kill rate is the correct 𝐺-block reading on these SUTs under the framework’s scope precondition, not a missed opportunity for MR refinement. I ∗ block (idempotence, identity). Idempotence MRs kill few mutants under the paired-MR DSL: I_idem ≈ 0 across most SUTs; powerSig I_zero_exp 2/12 is a degenerate single-input case. This reflects an expressivity limit of the JIR/JOR shape, not an absence of I ∗ structure in the SUTs. The qualitative prediction (low kill rate under paired-MR DSL) holds. The four block predictions taken together, including the central L ∗ falsification test of §4.2.4, are consistent with the operative-mechanism reading of the eight-block decomposition. 4.2.6 Two convergent witnesses. Two further observations from the same SUT set are independently informative. Neither is a statistical hypothesis test; both are non-rate evidence that the algebraic-decomposition thesis predicts and that the head-to-head Set G run incidentally reveals. Witness 1: cross-pipeline MR rediscovery. On midpoint, GenMorph’s GP independently evolves three MRs that map onto Set N’s blocks (Table 10). Set N is derived a-priori from the operator algebra of midpoint; Set G is searched by mutation-killing fitness with no algebraic structure as input. The two pipelines converge on the same algebraic primitives. Convergence under independent epistemic processes is direct corroboration of the operative-generator reading. Table 10. Cross-pipeline rediscovery on midpoint: GP-evolved MRs (Set G) and their algebra-derived counterparts (Set N). GP-evolved MR (Set G)

Set N counterpart

Block

SwitchParams??1@2 NumericAddition?1.000000?1 NumericMultiplication?0.500000?2

G_swap (commutativity) T_shift (translation by 1) L_scale (scaling, approx.)

𝐺 𝑇∗ L∗

Witness 2: structural coverage extension. GenMorph’s GP pipeline fails on two of the ten SUTs for plumbing reasons: ComplexSignal.add (instance method) hits an XStream NullPointerException on receiver deserialisation; isSequence (boolean predicate) yields ungrammatical JOR strings. Both SUTs admit Set N MRs derived directly from the SUT signature (commutativity for ComplexSignal.add; monotonic-window translation for isSequence) and run to completion, covering 8 of 70 PIT mutants on which only Set N is defined. Set N’s algebraicderivation route operates on the SUT signature, independent of the SUT-deserialisation and JORgrammar infrastructure GenMorph depends on; the structural-coverage extension is an architectural property of the derivation, not an empirical accident. ACM Trans. Softw. Eng. Methodol., Vol. 0, No. 0, Article 0. Publication date: 2026.

0:44

Meng Li, Xiaohua Yang, Jie Liu, and Shiyu Yan

4.2.7 Head-to-head at GenMorph’s published budget. This subsection decomposes an aggregate Set G dominance per algebraic block, with cost-axis and D2-stratum framework prediction layered alongside. Boundary of contribution (head-to-head restatement) What this subsection claims, and what it does not. (1) Aggregate verdict: Set N is dominated by Set G on the D1 stratum (McNemar 𝑝 = 0.0043 pooled, 𝑝 = 0.019 on D1 only). (2) Per-block reading: the gap concentrates on the 𝐺 block (Set G 7/7 vs Set N 0/7 on commutativity-targeting mutants); on the T ∗ block Set N dominates (10/17 vs Set G’s T ∗ kills). (3) Cost-axis: independently of detectionrate, Set N is derivable in polynomial time from A𝑃 (Theorem 2) while Set G requires a ≈ 30-min stochastic GP search per SUT. (4) D2-stratum framework prediction: Set N’s ≤ 10% D2 kill-rate prediction (operative invariant preserved under structurally-non-disrupting mutants) is an ex-ante framework signal that no inductive baseline can derive; pre-registered cap holds at 2/29 = 6.9% on the cross-codebase Commons-Math substrate. The head-to-head is not the framework’s load-bearing claim — per-block algebraic derivability, structural coverage extension (two SUTs only Set N reaches), and the D2 prediction are.

On the algebra-disrupting D1 stratum at GenMorph’s published 30-min GAssert budget, Set N is dominated by Set G in the aggregate (McNemar exact two-sided 𝑝 = 0.0043 pooled and 𝑝 = 0.019 on D1 only, 𝑛 = 62 post-equivalent-mutant exclusion). The paper does not assert head-to-head superiority on D1. The framework’s contribution on the head-to-head substrate is read as (i) algebraic derivability, (ii) per-block complementarity (Set G alone kills 15 D1 mutants Set N misses, Set N alone kills 4 D1 mutants Set G misses), and (iii) an out-of-scope D2-stratum framework prediction (≤ 10% kill rate) that no inductive baseline can derive ex-ante. The D1 pooled comparison is reported below for protocol-completeness rather than as the framework’s verdict. The central empirical claim of the section is established at §4.2.4 (the L ∗ -blindness falsifiable prediction confirmed on 5/6 SUTs) and does not depend on the head-to-head outcome. The head-to-head is run at GenMorph’s published 30-min GAssert budget; a prior 1-min run is retained as a sensitivity reference. Per-SUT entries are reported as directional only; no per-SUT statistical-significance claim is asserted, since 8×2 = 16 paired comparisons across the two budgets exceed the family-wise control of an uncorrected 𝛼 = 0.05 (Holm–Bonferroni-adjusted threshold 𝛼/16 ≈ 0.003; no per-SUT contrast meets this threshold). Per-block head-to-head and complementarity (Primary, PIT arm). Each Set N MR derives from exactly one NOETHER block, so the natural head-to-head denominator is per-block rather than the operative-block union. Across the eight head-to-head SUTs, PIT’s stock mutator catalogue exercises three operative blocks: 𝐺 (group / swap / negate), L ∗ (scale / homogeneity), and T ∗ (translation / self-adjoint). For each block 𝑏, 𝑛𝑏 counts mutants whose (SUT, mutator) entry in configs/sut_block_overrides.json marks block 𝑏 as broken (“×”). Per-block kill counts and the complementarity partition (both / 𝑁 -only / 𝐺-only / neither) appear in Table 12. The unmapped auxiliary row counts 25 PIT mutants from cells whose D1/D2 override table does not specify broken blocks; it is a lower-bound caveat on per-block denominators (each unmapped mutant is D1-classified but its block membership is unknown), not an additional denominator added to the 𝐺 + L ∗ + T ∗ union. The D1 pool is 𝑛 = 52 pre and post equivalent-mutant exclusion (Table 13 row 1). The per-block reading distinguishes three regimes: • 𝐺 block: Set G dominates. Set N kills 0/7 of the mutants Set G exclusively reaches; the Set N hits concentrate on signum (2/4), while gcdSig and lcmSig contribute 0/7 for Set N. ACM Trans. Softw. Eng. Methodol., Vol. 0, No. 0, Article 0. Publication date: 2026.

NOETHER: A Constructive Framework for Metamorphic Pattern Discovery from Operator Algebras

0:45

Table 11. Per-SUT PIT mutation kill counts, Set N versus GenMorph-evolved Set G at GenMorph’s published 30-min GAssert budget (primary) and at a 1-min GAssert sensitivity rerun, on the 10 algebra-rich Java SUTs of §4.2.3. Set G is structurally absent on ComplexSignal.add (instance-method deserialisation) and isSequence (boolean-predicate JOR grammar) under both budgets (§4.2.6). Set N’s kill vector is held fixed across budgets. Pooled across the 8 head-to-head SUTs (𝑛 = 62 mutants), 30-min budget primary: Set N = 26, Set G = 40, McNemar exact two-sided 𝑝 = 0.0043. The Δ (30-min) column reports Set N − Set G at the 30-min budget; note labels are directional descriptors only and do not assert per-SUT statistical significance (see prose). 𝑛 = 62 is underpowered for a paired hypothesis test at 𝛼 = 0.05 in two-sided form. SUT ComplexSignal.add midpoint exactLog2 isSequence clamp signum gcdSig hypotSig lcmSig powerSig

Δ (30-min)

mutants

Set N

Set G (30-min)

Set G (1-min)

3 3 10 5 7 6 9 4 11 12

2 3 4 0 5 4 1 2 0 7

N/A 3 0 N/A 5 4 6 4 8 10

N/A 3 0 N/A 5 4 5 4 8 10

0 0 −5 −2 −8 −3

instance method (Set G N/A) tie directional only boolean predicate (Set G N/A) tie tie directional only directional only directional only directional only (2 Set N MRs ineligible, see footnote)

26

40

39

−14

McNemar two-sided 𝑝 = 0.0043 (30-min)

pooled (head-to-head, n=62)

0 +4

note

Table 12. Per-block head-to-head on the three operative blocks exercised by PIT 1.7.4 across the eight inscope SUTs of §4.2.3. Each row’s denominator 𝑛𝑏 counts mutants violating block 𝑏’s invariant; complementarity cells “both” / “𝑁 -only” / “𝐺-only” / “neither” partition 𝑛𝑏 . Wilson 95% intervals are reported alongside ∗ , D ∗ , E ∗ , B ∗ ) are addressed by the point rates. The five operative blocks PIT 1.7.4 does not exercise (𝑂 ≤ , Trev rel construct-trace consistency check on hand-crafted block-targeted mutants (now in supplementary S9, item “D_E_implementation_consistency”); those results are design-implied and not used as independent faultdetection evidence. Auxiliary rows report the D1 aggregate and the unmapped bucket (PIT mutants from cells without an override entry, principally RETURN_VALS and MATH on SUTs where the table-5-reconstruction fallback assigns D1 but does not specify broken blocks; lower-bound caveat, not a participating row). Block

𝑛𝑏

Set N kills

both

𝑁 -only

𝐺-only

neither

𝐺 L∗ T∗

11 24 17

2 10 10

rate (95% CI) 0.182 [0.051, 0.477] 0.417 [0.245, 0.612] 0.588 [0.360, 0.784]

Set G kills 9 16 8

rate (95% CI) 0.818 [0.523, 0.949] 0.667 [0.467, 0.820] 0.471 [0.262, 0.690]

2 8 7

0 2 3

7 8 1

2 6 6

D1 aggregate, PIT-covered blocks (secondary) unmapped (lower-bound caveat)

52 25

26 —

0.500 [0.369, 0.631] —

37 —

0.712 [0.577, 0.817] —

22 —

4 —

15 —

11 —

The Euclidean-style SUTs are structurally unreachable by NOETHER’s 𝐺-block construction on this grid-synthesised catalogue: gcdSig normalises its inputs via a < 0 ? -a : a before the recursive gcd(a,b)=gcd(b, a mod b) fires, absorbing the sign-flip invariant; lcmSig inherits the same prologue. Whether this calls for an R-block re-synthesis or for documenting recursivenormalising SUTs as 𝐺-orthogonal is committed as follow-up (e.4). • L ∗ block: complementary coverage. Both Sets kill 8 mutants in common, 2 are 𝑁 -only (exactLog2), 8 are 𝐺-only, 6 are jointly missed; the union covers 18/24 = 75%, above either Set’s individual rate. Set N’s exclusive reach on exactLog2 quantifies the coverage-extension witness of §4.2.6 per-block; Set G’s exclusive reach on gcdSig+lcmSig compensates for the 𝐺block gap. • T ∗ block: Set N edge (underpowered). Of 17 T ∗ -violating mutants, Set N kills 10 and Set G kills 8 (𝑁 -only 3, 𝐺-only 1, both 7, neither 6); union 11/17 = 64.7%. Set N is +11.7 pp in rate and +2 in exclusive count on its own block, but the Wilson intervals [0.360, 0.784] and [0.262, 0.690] ACM Trans. Softw. Eng. Methodol., Vol. 0, No. 0, Article 0. Publication date: 2026.

0:46

Meng Li, Xiaohua Yang, Jie Liu, and Shiyu Yan

overlap substantially. We report the per-block edge as directional, consistent with the T ∗ design prediction rather than inferential at 𝛼 = 0.05. Coverage of the remaining five operative blocks. PIT 1.7.4’s stock mutator catalogue does not exer∗ , D ∗ , E ∗ , B ∗ ) on the §4.2.3 substrate. To exercise cise the remaining five operative blocks (𝑂 ≤ , Trev rel the pipeline end-to-end on these blocks, we hand-crafted 5 mutants per uncovered block (25 total) that violate the targeted invariant of a specific known Set N MR for each block. These mutants are construct-trace probes (each one is by design within the reach of the Set N MR it targets); the resulting kill counts are reported in supplementary S9 (Appendix E) for pipeline-correctness verification and Set G incidental-reach quantification, but they are not used as evidence for H3a.1 in this section, since construct-trace circularity precludes treating them as independent fault-detection measurements. What the per-block reading supports, and what it does not. The framework’s empirical contribution on the present substrate is block-dependent. On the three PIT-covered operative blocks the reading is targeted per-block: T ∗ shows the design’s directional advantage and complementarity; L ∗ shows complementarity in both directions (Set N reaches what Set G misses on exactLog2; Set G reaches what Set N misses on gcdSig / lcmSig); 𝐺 shows the design’s current limit on the substrate’s two Euclidean-style SUTs. The appropriate reading is therefore block-targeted precision plus complementarity, with documented per-block design gaps on the PIT-covered substrate, rather than a single “head-to-head winner” metric. The aggregate D1 head-to-head is dominated by Set G (McNemar 𝑝 = 0.019, see paragraph below), but the dominance collapses into the per-block profile: it is driven primarily by the 𝐺-block reading on gcdSig + lcmSig and by Set G’s denser L ∗ coverage on those same SUTs. Aggregate D1 head-to-head (Secondary, cross-block, 𝑛 = 52). For continuity with prior reporting conventions, the cross-block aggregate D1 head-to-head is: Set N M1D1 = 26/52 = 0.500 (Wilson 95% CI [0.369, 0.631]), Set G M1D1 = 37/52 = 0.712 ([0.577, 0.817]); exact McNemar two-sided 𝑝 = 0.019 on the D1 stratum with discordant pairs (𝑏, 𝑐) = (15, 4), paired risk difference RDpaired = (𝑏 − 𝑐)/𝑛 = (15 − 4)/52 = +0.212 favouring Set G, and odds ratio OR = 𝑏/𝑐 = 15/4 = 3.75. The aggregate gap (which favours Set G) collapses into the per-block profile above: it is driven primarily by Set G’s near-complete reach on 𝐺 (gcdSig + lcmSig) and by its denser L ∗ coverage; it is partially offset by Set N’s T ∗ edge but not enough to close the cross-block aggregate. The aggregate is presented as secondary because it averages over per-block strengths and weaknesses that the per-block table makes visible. Framework prediction on the D2 stratum (algebra-preserving, 𝑛 = 5). After equivalent-mutant exclusion (see footnote at §4.2.7 below), the 10 originally-classified D2 mutants reduce to 𝑛 = 5: five of the ten were LLM-ensemble-judged equivalent on the SUT’s declared input domain and are excluded from both Sets’ denominators by symmetric construction. On the remaining 𝑛 = 5 D2 mutants, Set N kill rate = 0/5 = 0.000 (Wilson 95% CI [0.000, 0.434]); the point estimate is consistent with the framework prediction kill rateD2 ≤ 10%, but the Wilson upper bound at 0.434 does not exclude the 10% ceiling at 𝛼 = 0.05; the cross-codebase commons-math pilot (§4.2.8 (b.cm)) corroborates the direction at 2/29 = 6.9% (Wilson 95% CI [0.012, 0.221]), and inferential confirmation of the ≤ 10% ceiling requires a pooled sample of 𝑛 ≥ 30. Set G kills 3/5 = 0.600 (Wilson 95% CI [0.231, 0.882]) on the surviving D2 stratum: the GP-evolved generic baseline is unconstrained by the algebra and incidentally detects D2 mutants through input-domain edge cases, confirming that D2 is a Set N-specific scope boundary rather than a substrate-wide structural ceiling. The framework’s prediction therefore separates Set N (algebra-bound) from Set G (generic) on the D2 ACM Trans. Softw. Eng. Methodol., Vol. 0, No. 0, Article 0. Publication date: 2026.

NOETHER: A Constructive Framework for Metamorphic Pattern Discovery from Operator Algebras

0:47

stratum; the D2 reading is the framework’s own falsifiability commitment (§4.2.4), not a head-tohead metric. Pooled M1 rates (auxiliary, scope-mismatched, 𝑛 = 57). For completeness against prior reporting conventions, the post-eq- exclusion pooled M1 rates over D1 ∪ D2 are: Set N = 26/57 = 0.456 (Wilson 95% CI [0.334, 0.584]), Set G = 40/57 = 0.702 ([0.573, 0.805]), McNemar two-sided 𝑝 = 0.00432 . We report this pooled comparison as scope-mismatched: the 5 D2 mutants in the denominator are not in Set N’s theoretical reach by construction, so the pooled gap overstates Set N’s effective miss rate within its declared scope. At the 1-min sensitivity budget, Set N is unchanged from the kill vector at the 30-min budget when Set G is the only variable; Set G’s pooled M1 is 0.557 ([0.441, 0.668]). The 30-min rerun changes Set G’s per-SUT counts on one of the eight head-to-head SUTs (gcdSig, 5 → 6); seven SUTs are unchanged, none regresses. A 30× budget increase therefore buys +1 Set G mutant on a single SUT under PIT mutation. LLM-assisted baseline (Set L ensemble, 𝑛 = 70 aligned). For the LLM-assisted comparator of §4.1.1’s H3b, we ran a 2-vendor (DeepSeek, ChatGPT) × 5-temperature (𝑡 ∈ {0.0, 0.3, 0.5, 0.7, 1.0}) ensemble on the same 10-SUT substrate, at a multi-LLM-sample scale that subsumes the singlesample probes of Shin et al. [7] and Zhang et al. [14]. The harvest is 100 LLM samples yielding 487 proposed MRs; deterministic template-matching against Set N’s per-SUT block catalogue translates 212 (43.5%) into executable JIR/JOR pairs (the remaining 56.5% are either compound multiinput properties or out-of-block algebra, e.g. associativity, identity / inverse elements, monotonicity on SUTs whose Set N catalogue lacks an Ole -block representative). On the aligned 𝑛 = 70 pooled mutant substrate (the full 10-SUT substrate including the two SUTs structurally N/A for Set G), per-LLM pooled kill rates are ChatGPT 34/70 = 0.486 Wilson 95% CI [0.372, 0.600], DeepSeek 33/70 = 0.471 [0.359, 0.587], ensemble union 34/70 = 0.486 [0.372, 0.600]. Set L’s union kill vector is a strict subset of Set N’s on this substrate (34/34 overlap; 0 Set-L-exclusive kills), as a structural consequence of the template-matching translator: every Set L MR is by construction a byte-identical copy of a Set N pair, so Set L can match but not exceed Set N’s per-MR kill power. The substantive finding is that the 2-vendor ensemble identifies enough of Set N’s catalogue to reproduce Set N’s reach on the matchable subset; on the unmatchable 56.5%, Set L explores invariants outside the 8-block frame that the framework’s coverageNOETHER diagnostic correctly identifies as structurally orphaned. A third-vendor (Anthropic Claude) extension is committed in follow-up (d.set-l-claude) of supplementary S4 (future_work.md); full per-(LLM, SUT, temperature) breakdowns in docs/set_l_phase2_results.md of the experiment repository. Equivalent-mutant denominator (resolved). The original PIT-SURVIVED denominator (𝑛 = 62) does not separate semantically distinct mutants from PIT false-positives. Every head-to-head mutant passed through a two-stage filter: the 44 mutants killed by at least one of Set N or Set G are auto-classified non-equivalent; the 18 jointly-missed mutants go through a progressive multi-LLM vote (DeepSeek + ChatGPT at temperature 0.0, with Anthropic Claude Opus tiebreaker when stage1 voters disagree). Outcome: 5 voted equivalent (all ConditionalsBoundaryMutator on gcdSig, lcmSig, powerSig where a < 0 ? -a : a prologues absorb the sign-flip), 13 non-equivalent. The 5 equivalents fall entirely within the algebra-preserving (D2) stratum, leaving the per-block D1 denominators unchanged. The eq-excluded total is 𝑛 = 57 (52 D1 + 5 D2 after the (e.1) v2 override 2 Pooled discordant pairs (𝑏, 𝑐 ) = (18, 4) on the 𝑛 = 57 paired denominator. The D1-only McNemar separates at (𝑏, 𝑐 ) =

(15, 4), 𝑝 = 0.019 (§4.2.7 Aggregate D1 paragraph); the additional 3 discordant pairs that the pooled comparison picks up come from the D2 stratum (Set G kills 3 of the 5 surviving D2 mutants, Set N kills 0 of 5; all 3 are 𝑏-cell discordances). The pooled McNemar is thus strengthened by including the D2 stratum, but at the cost of mixing the within-scope D1 comparison with the out-of-scope D2 stratum that Set N is not designed to detect.

ACM Trans. Softw. Eng. Methodol., Vol. 0, No. 0, Article 0. Publication date: 2026.

0:48

Meng Li, Xiaohua Yang, Jie Liu, and Shiyu Yan

reclassified 3 PrimitiveReturnsMutator mutants from D1 to D2). The 2+1 voting scheme was calibrated against the pilot’s manual analyst session (§4.2.4); the single pilot-vs-LLM disagreement case resolved in favor of the pilot verdict. Pooled rates exhibit the scope-discriminance pattern predicted by NOETHER’s scope declaration (Definition 13): on the wider 23-method utility-method baseline (supplementary S5; mixed in-scope and boundary), Set N’s pooled M1 is 0.288 vs Set G’s 0.363; on the in-scope algebra-rich substrate (eq-excluded 𝑛 = 57), Set N moves to 0.456 and Set G to 0.702 (D1 subset: 0.500 vs 0.712). Both methods benefit from the algebraically richer substrate; the scope declaration is empirically discriminating. Two-stratum head-to-head summary (Primary tabulation for H3a verdict). Table 13 reports the two strata (D1, D2) each with four metrics: total mutants, equivalents excluded, Set N kill / survive counts and rate (Wilson 95% CI), Set G kill / survive counts and rate, and the complementarity partition (𝑁 -only, 𝐺-only, both, neither). The headline reading is per-block (Table 12); the D1 aggregate (Table 13) and pooled (auxiliary, preceding paragraph) are reported for continuity with prior conventions. Table 13. Two-stratum head-to-head on the eight-SUT head-to-head substrate (post equivalent-mutant exclusion). D1 = algebra-disrupting, D2 = algebra-preserving. Complementarity cells report mutant counts; the operative test for H3a.2 is the 𝑁 -only column on D1. Stratum

𝑛 (post-exclusion)

equivalents excluded

Set N kill / surv.

Set N rate [Wilson 95%]

Set G kill / surv.

Set G rate [Wilson 95%]

both / 𝑁 -only / 𝐺-only / neither

McNemar 𝑝

D1 D2

52 5

0 5

26 / 26 0/5

0.500 [0.369, 0.631] 0.000 [0.000, 0.434]

37 / 15 3/2

0.712 [0.577, 0.817] 0.600 [0.231, 0.882]

22 / 4 / 15 / 11 0/0/3/2

0.019 0.25

pooled

57

5

26 / 31

0.456 [0.334, 0.584]

40 / 17

0.702 [0.573, 0.805]

22 / 4 / 18 / 13

0.0043

H3a verdict split into three sub-claims. H3a.1 (Detection on D1, per-block). Per Table 12 on the pre-registered PIT-covered three-block substrate: mixed. On the T ∗ block Set N achieves 10/17 = 0.588 versus Set G 8/17 = 0.471, with three 𝑁 -only exclusive kills, a directional edge consistent with the algebra-induced prediction; the 𝑛 = 17 block-level sample is underpowered for an inferential test at 𝛼 = 0.05 (Wilson intervals overlap). On the L ∗ block Set N achieves 10/24 = 0.417 versus Set G 16/24 = 0.667, with the complementarity partition 𝑁 -only = 2 and 𝐺-only = 8 identifying a coverage-extension witness on exactLog2 and a denser-coverage region on gcdSig / lcmSig respectively. On the 𝐺 block the substrate’s two Euclidean-style SUTs (gcdSig, lcmSig) absorb the 𝐺-action through their normalisation prologue before the recursive reduction (a documented framework boundary, see 𝐺-block framework boundary on recursive-normalising SUTs); the 𝐺-block 0/7 Set N reading on those two SUTs is the framework-correct boundary verdict rather than a missed-opportunity MR-design defect, but the block-level rate (2/11 Set N vs 9/11 Set G) favours Set G on the substrate as reported. The aggregate D1 head-to-head on the PIT-covered stratum is dominated by Set G (26/52 = 0.500 vs 37/52 = 0.712, McNemar 𝑝 = 0.019, Table 13); the per-block decomposition makes visible that the gap is concentrated on the 𝐺 block plus L ∗ , partially offset by Set N’s T ∗ edge. Coverage of the remaining five operative blocks (𝑂 ≤ , ∗ , D ∗ , E ∗ , B ∗ ) via hand-crafted block-targeted mutants is reported in supplementary S9 (ApTrev rel pendix E) as a construct-trace consistency check; per supplementary S9 (Appendix E), those results are design-implied and are not used as independent evidence for H3a.1 in this paragraph. H3a.2 (Complementarity). Supported on the PIT-covered substrate. The complementarity partition on the 52-mutant PIT-covered D1 stratum (Table 13, row 1) reports 4 𝑁 -only kills, 15 𝐺-only kills, 22 both-killed and 11 neither, distributed across the T ∗ and L ∗ blocks (per Table 12). Union ACM Trans. Softw. Eng. Methodol., Vol. 0, No. 0, Article 0. Publication date: 2026.

NOETHER: A Constructive Framework for Metamorphic Pattern Discovery from Operator Algebras

0:49

coverage on the PIT-covered substrate is 22 + 4 + 15 = 41/52 = 78.8% (both-killed plus exclusivelySet-N-killed plus exclusively-Set-G-killed), modestly above Set G alone’s 37/52 = 71.2% and materially above Set N alone’s 26/52 = 50.0%. The complementarity is asymmetric: Set G’s exclusive contribution (15 kills) is roughly four times Set N’s (4 kills), reflecting the substrate’s predominance of generic algebra-disrupting mutations that Set G’s GP-evolved generic MRs catch, with Set N’s exclusive reach concentrated on algebraically-distinctive structures (exactLog2’s L ∗ pattern) where the algebra-induced MR has no generic counterpart in Set G’s catalogue. H3a.3 (Cost-axis). Supported. See Approximate-parity-at-lower-cost reading (H3a.3 verdict) below for the detailed cost-axis analysis. D2 stratum (framework prediction; not part of H3a). Set N D2 kill rate = 0/5 = 0.000 (Wilson 95% CI [0.000, 0.434]); the framework’s ≤ 10% prediction is consistent with the direction observed, but 𝑛 = 5 is insufficient for 𝛼 = 0.05 confirmation (the Wilson upper bound 0.434 does not exclude the 10% ceiling). Set G achieves 3/5 = 0.600 on the same stratum, an out-of-scope contribution for Set N by construction (Set G is not algebra-bound) and a signal that D2 is a Set Nspecific scope boundary rather than a substrate-wide ceiling. The L ∗ -blindness result of §4.2.4 and the structural-extension witness on the two SUTs where Set G is N/A (§4.2.6) are unaffected. Comparator scope and three-SOTA-category coverage. The head-to-head reported here delivers the GP-evolved-baseline arm of a three-SOTA-category protocol against one representative per category. The GP-evolved representative is GenMorph (Ayerdi et al. [6]), the SOTA among geneticprogramming MR identification pipelines on Java SUTs at the time of submission, run at its published 30-min GAssert budget. The LLM-assisted representative is a multi-vendor × multitemperature LLM-MR-generation protocol (the same arm reported inline in §4.2.7 as Set 𝐿ensemble ); this section’s earlier Set L is a single-sample 𝑛 = 1 GPT-4 probe (§4.1) and is now superseded by the 2-vendor (DeepSeek, ChatGPT) × 5-temperature ensemble reported in §4.2.7. A third-vendor (Anthropic Claude) extension running alongside Shin [7], GPTMR [15], and AutoMT [16] is committed as post-acceptance follow-up in supplementary S4 (item (d.set-l-claude)). The mining-based representative is MR-Scout (Sun et al. [5]); on this section’s substrate, MR-Scout’s reach is reported as an estimate adapted from MR-Scout’s published-artifact reach figures rather than a full re-execution (see Table 14 for the cost-axis interpretation; full re-execution is follow-up (d)). NOETHER’s costaxis profile relative to all three categories is given in Table 14; the matrix-driven D1/D2 mutant stratification (Table 8) operationalises the detection-axis claim that NOETHER is appropriate to algebra-disrupting mutants and out-of-scope by design on algebra-preserving mutants. Per-SUT delta entries in Table 11 are directional descriptors only; under Holm-Bonferroni correction for the 8 × 2 = 16 paired comparisons across the two budgets, the per-SUT family-wise threshold is 𝛼/16 ≈ 0.003, which no per-SUT contrast meets. The two paired hypothesis tests reported on this substrate are the scope-matched D1 McNemar (𝑝 = 0.019 at the 30-min budget, exact two-sided, 𝑛 = 52 post eq-exclusion, discordant pairs (𝑏, 𝑐) = (15, 4)) and its auxiliary pooled counterpart (𝑝 = 0.0043 at 𝑛 = 57, discordant (𝑏, 𝑐) = (18, 4)). The pooled gap is strengthened by Set G’s 3/5 kills on the D2 stratum, an out-of-scope contribution for Set N by construction, which is why pooled and D1-stratified 𝑝 values now differ. 4.2.8

Threats to validity and committed future work.

(a) Prediction-commitment timestamp. The L ∗ -blindness prediction of §4.2.1 is derivable from public information without consulting data, and is committed to git in supplementary S7 (d4j/) alongside the SUT-selection criterion before the per-MR kill-count files; a reader who distrusts the timestamp chain can re-derive the prediction independently from §3.2 and [56]. ACM Trans. Softw. Eng. Methodol., Vol. 0, No. 0, Article 0. Publication date: 2026.

0:50

Meng Li, Xiaohua Yang, Jie Liu, and Shiyu Yan

(b) Set G budget asymmetry. GenMorph’s published 30-min GAssert configuration is reported alongside a 1-min sensitivity rerun (Table 11) that handicaps Set G conservatively; the 30-min budget leaves the L ∗ -blindness result and the structural-extension finding unchanged. (c) Sample size. 𝑛 = 70 across 10 SUTs is underpowered for a paired head-to-head verdict at 𝛼 = 0.05; the §4.2.7 reading is the honest disclosure that Set N is dominated by Set G in the aggregate D1 stratum (McNemar 𝑝 = 0.019 on D1; 𝑝 = 0.0043 pooled), with the framework’s contribution read at the per-block, cost-axis, and D2-prediction layers rather than aggregate faultdetection superiority. The L ∗ -blindness test on 𝑛 = 44 across 6 SUTs is per-SUT (one third or more on more than one SUT), not pooled. (d) Set G structural absence is upstream-snapshot-relative. The two N/A SUTs of §4.2.6 reflect the state of GenMorph upstream at our snapshot. An upstream patch would restore Set G coverage and weaken the structural framing of the coverage-extension witness, though the architectural point (algebra-derivation operates on the SUT signature, independent of GP plumbing) survives the patch. (e) Substrate selection. The evaluation restricts itself to programs with explicit mathematicalphysics equations, by NOETHER’s scope declaration (Definition 13); the kill-rate gain over the utility-method reference is reported as scope-discriminance evidence (claim D), not as a generalisable performance improvement on every Java SUT. (f) Three SOTA-category coverage with explicit baseline-strength caveats. The protocol of §4.1.1 commits Set N against one representative per SOTA category: a GP-evolved baseline (GenMorph [6]), an LLM-assisted baseline (subsuming the single-sample probes of [7, 14–16]), and a mining-based baseline (MR-Scout [5]). Baseline-strength asymmetry: (i) GP-evolved arm delivered in full at GenMorph’s published 30-min budget on a single seed; multi-seed replication committed as follow-up (a.budget-replication). (ii) LLM-assisted arm delivered as a 2-vendor (DeepSeek-V3, ChatGPT-4o-mini) × 5-temperature ensemble (100 samples); the third commercial closed-vendor frontier (Anthropic Claude) is committed as post-acceptance follow-up (d.set-l-claude), and the current Set L results are reported as a 2-vendor proxy rather than the SOTA-strongest configuration. (iii) Mining-based arm reported through an adapted estimate of MR-Scout’s reach derived from its published artifact figures; full re-execution committed as follow-up (d). METRIC+ [9] is not run head-to-head because no automated identification pipeline is publicly available; the qualitativeplus-quantitative coverage contrast appears in §4.1 (sorting worked example) and §4.2.3 (per-block coverage diagnostic). The cost-component breakdown of all four methods is in Table 14. 4.2.9 MR-generation cost. NOETHER’s cost profile differs qualitatively from each of the three SOTA-category representatives across four independent components (algorithmic time, human effort, LLM-token cost, seed-corpus dependency); Table 14 reports each separately, with full derivation methodology (token-cost protocol scale, per-SUT human-effort breakdown, MR-Scout seedsuite scope) in supplementary S4 (cost_breakdown.md). The table operationalises three structural advantages of NOETHER as distinct cost-axis arguments rather than as a single “best” verdict: (i) vs. GP, polynomial-time deterministic construction (Theorem 2) replaces a 30-min stochastic per-SUT search, with one-time human cost amortising across same-algebra SUTs; (ii) vs. LLM-assisted, the coverageNOETHER diagnostic on §4.1 (1.00 vs. 0.40) operationalises the algebraic-prior gap that prompt-based generation does not close, at zero token cost; (iii) vs. mining-based, NOETHER is operative at cold start (no seed test suite required), the regime in which most algebra-rich scientific-computing programs arrive on a tester’s desk. ACM Trans. Softw. Eng. Methodol., Vol. 0, No. 0, Article 0. Publication date: 2026.

NOETHER: A Constructive Framework for Metamorphic Pattern Discovery from Operator Algebras

0:51

Table 14. MR-generation cost components for the four methods compared in this section. “Cost dimension” rows are independent (an LLM-arm token cost does not amortise GP wall-time and vice versa); the NOETHER human-effort estimate aggregates Set N’s 30-MR derivation across 10 SUTs at ≈ 1 h per SUT under CONSTRUCT-MP’s four-step procedure, amortising across SUTs that share an operator algebra. Full methodology in supplementary S4 (cost_breakdown.md). Cost component Algorithmic time / SUT Human effort / family Token cost (USD) / family Seed-corpus dependency Determinism Cold-start capable

NOETHER

GP (GenMorph)

LLM (Xu 2024)

Mining (MR-Scout)

poly(|gen|) minutes (Thm. 2) ≈ 10 h A𝑃 distillation 0 none deterministic yes

30 min wall, stochastic none after harness setup 0 none seed-/budget-dependent yes (after harness)

seconds API latency none after prompt template $5–50 ($50–500 with CoT) none prompt-/temperature-dependent yes (after prompt)

minutes after corpus seed-suite assembly substantial 0 required (mining input) corpus-dependent no (needs corpus)

These are cost-profile and coverage-profile claims that hold within the framework’s scope precondition, not fault-detection-superiority claims. Approximate-parity-at-lower-cost reading (H3a.3 verdict). H3a.3’s cost-axis claim holds when detection is read on the per-block primary (Table 12). On T ∗ , Set N edges Set G with three 𝑁 -only kills at zero per-SUT generation cost beyond the one-time CONSTRUCT-MP derivation (≈ 1 h human, amortising across SUTs sharing A𝑃 ); Set G’s matching count costs a 30-min GAssert GPsearch per SUT (≈ 4 h wall for the eight SUTs in parallel-4) plus the Major + JaCoCo + Randoop pipeline assembly. On L ∗ , the sets are complementary (𝑁 -only 2, 𝐺-only 8 on 24); Set N’s reach is reproducible without re-running GP, whereas Set G requires re-tuning budget and seed when the SUT changes. Quantitative reading: a directional T ∗ edge (10/17 vs 8/17, 𝑛 = 17 underpowered) plus L ∗ complementarity, at ≈ 1 h amortised human cost versus ≈ 30 minutes per-SUT GP search; NOETHER’s cost amortises across new SUTs in the same algebra family while Set G’s restarts from scratch. The per-block edge does not overturn Set G’s D1 aggregate dominance (acknowledged at the head of §4.2.7); the 𝐺-block gap on the Euclidean SUTs (𝐺-block framework boundary on recursive-normalising SUTs) is a framework boundary, not a cost-axis trade-off. H3a.3 is therefore supported: comparable within-scope per-block detection at lower amortised generation cost. Committed future work (16 items). The full 16-entry committed-future-work table is in supplementary S4 (future_work.md); key items completed in this revision: (i) METRIC+ head-to-head on Sun 2021’s 4 subjects with PIT 1.7.4 + Major cross-tool replication (pooled McNemar 𝑝 = 0.625 / 0.211 both NS, 92.6% both-kill on the PIT substrate; details in supplementary S8); (b.cm) CommonsMath pilot (pooled Set N 10/77 = 13.0%, D2 prediction passes 2/29 = 6.9%); (d.set-l) 2-of-3vendor LLM-ensemble harvest (487 MRs, 212 executable, ensemble matches Set N on the matchable subset 34/34); (e), (e.2), (e.4), (g) the D1/D2 labelling pipeline, equivalent-mutant exclusion, 𝐺-block Euclidean-SUT documentation, and construct-trace consistency check. The remaining 8 pending items (multi-seed GP replication; full 38-D4J extension; MR-Scout re-execution; Anthropic third-vendor; generic-mutation independent test on the 5 PIT-unexercised blocks; externaltransfer reactor-physics corpus; two narrow grid-MR predicate tightenings) are the principal postpublication work programme. 4.2.10 Summary of evidence. The section’s central claim is a single quantitative falsifiable prediction confirmed: L ∗ -block blindness on homogeneity-preserving mutators (§4.2.4). The prediction is derivable ex-ante from §3.2 and from PIT’s public mutator specification; it is observed in the data on 5/6 SUTs admitting an 𝐿scale MR; the sixth SUT’s two-mutant exception is accounted for by the prediction’s quantitative tail. The operative-mechanism reading of the eight-block decomposition is, in this empirical sense, supported. ACM Trans. Softw. Eng. Methodol., Vol. 0, No. 0, Article 0. Publication date: 2026.

0:52

Meng Li, Xiaohua Yang, Jie Liu, and Shiyu Yan

The corroborating evidence is fourfold: • Other per-block patterns (𝑇 ∗ , 𝐺, I ∗ ; §4.2.5) are qualitatively consistent with the algebraic predictions. • Cross-pipeline MR rediscovery on midpoint (§4.2.6, witness 1) shows two independent epistemic processes converging on the same algebraic primitives. • Structural coverage extension on the two SUTs where Set G is structurally absent (§4.2.6, witness 2) is an architectural consequence of algebra-derivation that the head-to-head substrate incidentally reveals. • Head-to-head against GenMorph (§4.2.7) reads per-block, not as a single winner. On T ∗ Set N shows a directional edge (10/17 vs 8/17, three exclusive kills) consistent with its design prediction; on L ∗ Set N and Set G are complementary (union 18/24; Set N exclusively reaches exactLog2, Set G exclusively reaches denser regions of lcmSig / gcdSig); on 𝐺 Set G dominates (9/11 vs 2/11) because the substrate’s two Euclidean- style SUTs absorb the sign-flip invariant in their normalisation prologue (Table 12, Set N 0/7 on gcdSig + lcmSig, a 𝐺-block reading on D1 mutants, not the D2 prediction). The framework’s falsifiable D2 prediction (kill rate ≤ 10%) is consistent with the data (Set N D2 kill rate 0/5 = 0.000, Wilson 95% CI [0.000, 0.434]; 𝑛 = 5 is insufficient for 𝛼 = 0.05 confirmation, but the observed direction is on-prediction); the per-block reading is the appropriate substrate-level contribution metric. The full per-SUT outcome matrix, the per-block kill table for all 30 Set N MRs, the 𝐿scale -mutant attribution for hypotSig, the GP raw output and the .jir/.jor translation, the McNemar 𝑏/𝑐 counts, the prediction’s git timestamp, and the test-gate harness (tests/run.sh) are in supplementary S7 (d4j/). 4.3

Relationship with METRIC and METRIC+

METRIC and METRIC+ pioneered the categorical scaffolding that any structural theory of MR identification must respect; NOETHER’s MetaPatterns are descendants of that line of work. The point of departure is grounding. METRIC and METRIC+ derive their categories through expert curation and validate them by empirical coverage. NOETHER derives MetaPatterns through algebraic construction and proves closure over the algebra-induced MR space through Theorem 1. Worked example: METRIC+ categories for a sorting library, mapped onto NOETHER blocks. For a numerical comparison-sort library, METRIC+’s eleven input-domain × output-relation category pairs (the 9-category METRIC base extended by 2 output-domain pairs in METRIC+, per [9] Table II) collapse onto two NOETHER blocks: 𝐺 (comparator-permutation symmetry 𝔖𝑛 ) and 𝑂 ≤ (partial order). Table 15 records the mapping cell by cell: 9 of 11 category pairs map to 𝐺 or 𝑂 ≤ ; the remaining 2 (𝐷 5 additive shifts, 𝑅4 multiplicative scaling) are out-of-scope by construction for a comparison sort whose semantics ignore order-preserving univariate input transformations. The 11 → 2-block compression operationalises NOETHER’s deflationary direction: a NOETHER-aware METRIC+ user can prune the 9 category-pair enumerations to two algebraically distinct MetaPatterns (𝑚 inv via 𝐺, 𝑚 mono via 𝑂 ≤ ) without loss of MR coverage. This is a qualitativeplus-quantitative coverage contrast, not a head-to-head fault-detection comparison: METRIC+ is a category-enumeration scaffold without an automated identification pipeline, so kill-rate head-tohead requires re-implementing METRIC+ from prose (committed as follow-up (i) of supplementary S4). Small-scale manual METRIC+ derivation on three §4.2.3 SUTs. To strengthen the qualitative-plusquantitative reading above, we apply METRIC+’s 11 D×R category framework manually to three SUTs of the §4.2.3 substrate selected to span bivariate input arity and distinct algebraic structure: ACM Trans. Softw. Eng. Methodol., Vol. 0, No. 0, Article 0. Publication date: 2026.

NOETHER: A Constructive Framework for Metamorphic Pattern Discovery from Operator Algebras

0:53

Table 15. Mapping of 11 input-domain (𝐷) × output-relation (𝑅) METRIC+ category pairs [8, 9] onto NOETHER blocks for a deterministic comparison-sort library under Asort . The sort-specific specialisation is operationalised here; 9 pairs collapse onto two non-empty blocks (𝐺, 𝑂 ≤ ); 2 pairs (𝐷 5 , 𝑅4 ) are out-of-scope. METRIC+ category pair

NOETHER block

Comment

𝐷 1 (permutation of input list) 𝐷 2 (append element to input) 𝐷 3 (remove element from input) 𝐷 4 (replace element with permuted copy) 𝐷 5 (add constant to all inputs) 𝐷 6 (concatenate two sorted lists) 𝑅1 (output element-wise equality) 𝑅2 (output permutation equality) 𝑅3 (output prefix equality) 𝑅4 (multiplicative scaling of input) 𝑅5 (subset relation on output)

𝐺 (𝔖𝑛 ) 𝑂≤ 𝑂≤ 𝐺 (𝔖𝑛 ) out-of-scope 𝐺 (𝔖𝑛 ) 𝐺 𝐺 (𝔖𝑛 ) 𝑂≤ out-of-scope 𝑂≤

𝑚 inv : sort output invariant 𝑚 mono : sort respects added element 𝑚 mono : inverse of 𝐷 2 𝑚 inv : variant of 𝐷 1 no MR (sort semantics ignore additive shifts) 𝑚 inv : merge property identity oracle (degenerate MR) 𝑚 inv 𝑚 mono on prefixes no MR (sort semantics ignore multiplicative scaling) 𝑚 mono on subsets

Coverage summary

9 → 𝐺 ∪ 𝑂 ≤ , 2 out-of-scope

NOETHER block compression: 11 → 2 non-empty MetaPatterns

midpoint (bivariate linear), hypotSig (bivariate non-linear, scale-symmetric), and powerSig (bivariate non-linear, multiplicative). For each SUT we enumerate which METRIC+ category pairs yield a non-vacuous Set-MP MR; classify the algebra-block of each non-vacuous Set-MP MR under D (A𝑃 ); and identify which Set-N MR (if any) covers the same algebraic content. Table 16 records the analysis. The full PIT-based head-to-head kill-rate comparison is committed as supplementary S4 item (i); the present manual analysis is the algebra-block mapping component of that follow-up and is reported here to make the framework-vs-METRIC+ coverage relationship concrete on the head-to-head substrate. The structural finding from Table 16 is that METRIC+’s D×R framework, within Sun et al. 2021’s published 11-pair input–output category catalogue [9] as instantiated on these three SUTs, produces a strict subset of NOETHER’s block coverage on the bivariate-input subsample of the §4.2.3 substrate: every non-vacuous Set-MP MR maps to a NOETHER block already covered by Set-N’s algebra∗ , L ∗ at limits) have no METRIC+ counterpart at this derived MRs, and three Set-N blocks (𝑇 ∗ , Trev category-pair granularity. The implication for fault detection on these three SUTs is that Set-MP’s ∗ -violating mutants is zero by construction, whereas Set-N’s 𝜌 expected kill rate on T ∗ or Trev adj and 𝜌 train-rev MRs are by-construction sensitive to such mutants (cf. §4.2.7’s T ∗ block where SetN kills 10/17). The full PIT-based head-to-head against Set-MP (supplementary S4 item (i)) would convert this structural prediction into a measured kill-rate contrast; the present small-scale manual analysis establishes the algebra-block component of that contrast on three representative SUTs. Scope-precondition validation on the METRIC+ benchmark corpus. A complementary — and more directly comparator-side — analysis applies NOETHER’s eight-block decomposition to Sun et al.’s four benchmark subjects [9]: SPHONE (China Unicom phone-bill calculator, 107 LOC), SBAGGAGE (Air China baggage-billing service, 101 LOC), SEXPENSE (sales-department expense reimbursement, 117 LOC), and SMEAL (airline catering meal-ordering service, 150 LOC). All four are business-rule billing programs whose semantics are categorical+numeric rather than mathematical/physical. Applying NOETHER’s eight-block test to each subject’s category-choice specifications yields the perblock non-emptiness verdicts in Table 17. The analysis establishes three findings. First, NOETHER is in-scope on all four METRIC+ subjects, contradicting the worst-case reading that NOETHER applies only to mathematical or physical program families: business-rule billing programs admit at least the 𝑂 ≤ block (monotonicity in usage / weight / mileage / passenger count) and partial L ∗ (within linear pricing tiers), with 𝐺 also activating on SBAGGAGE and SMEAL where input-permutation invariance holds. Second, ACM Trans. Softw. Eng. Methodol., Vol. 0, No. 0, Article 0. Publication date: 2026.

0:54

Meng Li, Xiaohua Yang, Jie Liu, and Shiyu Yan

Table 16. Manual METRIC+ D×R framework applied to three SUTs of the §4.2.3 substrate (bivariate input arity). For each (SUT, METRIC+ pair) cell: “–” if vacuous on that SUT’s algebra; “→ block” identifies the NOETHER block of the non-vacuous Set-MP MR; the second column lists the Set-N MR (if any) covering the same algebraic content. Across the three SUTs, METRIC+ yields 6, 5, and 3 non-vacuous Set-MP MRs respectively (the remaining 5, 6, and 8 D×R pairs are vacuous because the SUT’s arity is fixed, the output is scalar, or the input-transformation is structurally out-of-scope for the SUT’s algebra); each non-vacuous Set-MP MR maps to a NOETHER block also covered by Set-N’s 5 algebra-derived MRs. Conversely, three Set-N MRs (𝑚 adj , 𝑚 train-rev , 𝑚 conv ) have no METRIC+ D×R counterpart. The structural reading: NOETHER’s 𝐺/𝑂 ≤ block coverage subsumes METRIC+’s 𝐷 1 –𝐷 6 /𝑅1 –𝑅5 output on bivariate-input SUTs in this substrate, while NOETHER’s 𝑇 ∗ /T ∗ /L ∗ blocks add MR templates the D×R framework does not enumerate. The kill-rate projection in the rightmost column anticipates that on these three SUTs Set-MP’s reach would be bounded above by Set-N’s 𝐺/𝑂 ≤ contribution; a full PIT execution to confirm this is committed as follow-up (i). METRIC+ pair

midpoint

hypotSig

powerSig

𝐷 1 (input swap) 𝐷 2 (append element) 𝐷 3 (remove element) 𝐷 4 (replace with permuted) 𝐷 5 (add constant to inputs) 𝐷 6 (scale inputs) 𝑅1 (output element equality) 𝑅2 (output permutation eq.) 𝑅3 (output prefix equality) 𝑅4 (output multiplicative) 𝑅5 (output subset)

→ 𝐺 (𝜌 swap via 𝑚 inv ) – (fixed arity) – (fixed arity) → 𝐺 (variant of 𝐷 1 ) → 𝑂 ≤ (𝜌 trans via 𝑚 mono ) → 𝑂 ≤ (𝜌 scale via 𝑚 mono ) → 𝐺 (identity oracle) – (scalar output) – (scalar) → 𝑂≤ – (scalar)

→ 𝐺 (𝜌 swap ) – (fixed arity) – (fixed arity) →𝐺 out-of-scope (non-linear) → L ∗ (𝜌 scale via 𝑚 conv /𝐿scale ) →𝐺 – (scalar) – (scalar) → L∗ – (scalar)

– (non-symmetric) – (fixed arity) – (fixed arity) – out-of-scope → L∗ →𝐺 – (scalar) – (scalar) → L∗ – (scalar)

Set-MP non-vacuous Set-MP → blocks Set-N coverage of those blocks Set-N MRs without Set-MP counterpart

6 / 11 {𝐺, 𝑂 ≤ } yes (𝑚 inv , 𝑚 mono ) 𝑚 adj , 𝑚 train-rev , 𝑚 conv (at limits)

5 / 11 {𝐺, L ∗ } yes (𝑚 inv , 𝐿scale ) same three blocks

3 / 11 {𝐺, L ∗ } yes (𝑚 inv , 𝐿scale ) same three blocks

Table 17. NOETHER eight-block scope analysis on Sun et al. 2021 METRIC+ benchmark subjects [9]. Perblock entries: Y non-empty (Y), P partial (P, block applies on a restricted regime such as linear-pricing tier or within-class permutation), − empty. Source-code-level instance MR cardinality (last column) is reported by Sun et al. 2021 Table 17; NOETHER’s MetaPattern cardinality (second-to-last column) is the equivalenceclass summary at the algebra-block level. The two cardinalities differ by 2–3 orders of magnitude because METRIC+’s output scales combinatorially with category-choice products while NOETHER’s output is an equivalence-class summary; the analysis below interprets this contrast as complementary rather than competitive. Subject

𝐺

𝑂≤

𝑇∗

∗ Trev

L∗

D∗

E∗

∗ Brel

NOETHER MPs

METRIC+ MRs

SPHONE SBAGGAGE SEXPENSE SMEAL

− P − P

Y Y Y Y

− − − −

− − − −

P P P Y

− − − −

− − − −

− − − −

2 3 2 3

142 735 1130 3152

Legend: Y = non-empty block; P = partial (restricted regime); − = empty. “NOETHER MPs” = Set N MetaPattern cardinality; “METRIC+ MRs” = instance-level MR cardinality reported by Sun et al. 2021 (Table 17), comparable only after either expanding NOETHER MetaPatterns to instance MRs (via the category-choice enumeration) or contracting METRIC+ MRs to algebra-block equivalence classes.

NOETHER’s reach is narrower on this corpus than on its three primary instantiation domains: ACM Trans. Softw. Eng. Methodol., Vol. 0, No. 0, Article 0. Publication date: 2026.

NOETHER: A Constructive Framework for Metamorphic Pattern Discovery from Operator Algebras

0:55

2–3 of 8 blocks per subject yields 2–3 MetaPatterns, contrasted with 5–7 of 8 blocks on Boltzmann reactor physics and equivariant ML. The scope precondition is therefore neither vacuously broad nor practically empty; it is a continuous gradient in the program family’s algebraic richness. Third, the cardinality contrast between NOETHER MetaPatterns (2–3) and METRIC+ instance MRs (142–3152) reflects different but complementary output types: METRIC+’s 11 D×R framework generates instance-level MRs by category-choice combinatorics; NOETHER’s eight-block decomposition produces equivalence-class summaries over the same MR space. A fair head-to-head comparison requires expanding NOETHER’s MetaPatterns to instance MRs at matching cardinality or contracting METRIC+’s MRs to equivalence classes at the algebra-block level; the present analysis establishes the algebra-block coverage condition that every NOETHER block on these subjects (𝐺, 𝑂 ≤ , L ∗ ) maps to a METRIC+ D×R category pair, while three NOETHER blocks that are active on its ∗ , D ∗ ) are structurally absent from Sun et al.’s business-rule primary instantiation domains (𝑇 ∗, Trev benchmark. Detailed per-subject derivation, including the regime restrictions for partial P blocks, is in supplementary S8 (scope_analysis.md). The pre-registered protocol for an instance-level head-to-head with matched cardinality (supplementary S8 protocol_path_a_headtohead.md) is executed at reduced scale in this revision and reported below; the full-scale execution (Sun’s Java + PIT 1.7.4 + multi-LLM equivalent-mutant vote) remains as supplementary S4 (future_work.md) item (i). Path A head-to-head: Java/PIT execution on Sun 2021’s corpus. The pre-registered Path A protocol (supplementary S8 protocol_path_a_headtohead.md) was executed in two substrates: a reduced-scale Python AST mutation engine (results_path_a.md; 𝑛 = 219 mutants) and the full Java + PIT 1.7.4 substrate matching this paper’s §4.2.3 tooling (results_path_a_full.md; 𝑛 = 120 PIT mutants). We report the Java/PIT results as the primary head-to-head; the Python reduced-scale run is the cross-substrate replication. Java re-implementations of SPHONE, SBAGGAGE, SEXPENSE, SMEAL from Sun 2021’s prose specification (Tables 7–14) were exercised under both Set N (NOETHER, {17, 12, 19, 10} JUnit MR tests via CONSTRUCT-MP + Translate enumeration) and Set MP (METRIC+, {61, 15, 19, 9} JUnit MR tests via automated D×R category enumeration); all 162 MR tests pass on the original code. PIT 1.7.4 with the stock mutator catalogue (DEFAULTS + fullMutationMatrix) generated 14 + 36 + 17 + 53 = 120 mutants. Pooled head-to-head: Set N 51/120 = 42.5% Wilson 95% CI [34.0%, 51.4%] vs Set MP 53/120 = 44.2% [35.6%, 53.1%]; McNemar exact two-sided 𝑝 = 0.625 (not rejecting HMP2 parity at 𝛼 = 0.05). Per-subject McNemar exact 𝑝 is 0.500 on SPHONE, 1.000 on the other three; with Bonferroni-correction at 𝛼 Bonf = 0.0125 no subject rejects parity. The complementarity 4-tuple pooled is (both, 𝑁 -only, 𝑀𝑃-only, neither) = (50, 1, 3, 66): of the 54 mutants killed by either set, 50/54 = 92.6% are killed by both, confirming the two frameworks reach near-identical fault-detection power on this corpus. HMP1 coverage-subsumption is not falsified at the Java/PIT scale; the Python reduced- scale SPHONE falsification (9 MP-only kills, 𝑝 = 0.0039) does not replicate under PIT 1.7.4’s bytecode mutators, indicating the prior result was a Python AST mutation artefact. The scope-precondition prediction of scope_analysis.md holds intact: only {𝐺, 𝑂 ≤ , L ∗ } are active on this corpus, with five ∗ , D ∗, E ∗, B ∗ ) structurally absent. H blocks (𝑇 ∗, Trev MP3 cost-axis asymmetry is directionally suprel ported (Set N 58 JUnit tests vs Set MP 104 at this enumeration scale; Sun’s published full cardinality 142–3152 would multiply METRIC+’s side by another 30–50× without altering NOETHER’s 8-block MetaPattern bound). Three remaining protocol deviations at Java/PIT scale (Java re-impl vs Sun’s original; MR enumeration below Sun’s full cardinality; multi-LLM equivalent-mutant vote not run) are recorded in results_path_a_full.md §6; all are data-blind and would not flip the verdict if resolved.

ACM Trans. Softw. Eng. Methodol., Vol. 0, No. 0, Article 0. Publication date: 2026.

0:56

Meng Li, Xiaohua Yang, Jie Liu, and Shiyu Yan

The Path A Java/PIT execution unambiguously strengthens this section’s complementarity reading: 92.6% both-kill rate, pooled McNemar 𝑝 = 0.625, no per-subject Bonferroni rejection, no falsified hypothesis at the Java/PIT scale. The two frameworks empirically achieve comparable reach on Sun 2021’s published corpus, with the framework’s contribution being the algebraic warrant for each MR plus the cost-axis advantage of polynomial-time derivation from A𝑃 rather than combinatorial category enumeration. A companion cross-tool replication on the Major mutation framework (supplementary S8 results_path_a_major_crosstool.md) extends the substrate from PIT 1.7.4’s 𝑛 = 120 mutants to Major’s 𝑛 = 555 mutants (Major’s ≈ 95-operator catalogue, vs PIT DEFAULTS’ ≈ 25, yields a 4.6× larger pool on the same Java sources and JUnit suite). Major’s verdict at the pooled level is concordant with PIT’s: Set N 222/555 = 40.0% Wilson 95% [36.0%, 44.1%] vs Set MP 231/555 = 41.6% [37.6%, 45.8%], McNemar exact 𝑝 = 0.211 (NS at 𝛼 = 0.05). Per-subject, Major’s larger pool exposes bidirectional reach asymmetries invisible to PIT: Set MP has 20 𝑀𝑃-only kills on SPHONE (McNemar 𝑝 = 0.0000, Set MP exclusive reach driven by (D1, R1) within-partition equivalence on the tier-pricing structure), while Set N has 16 𝑁 -only kills on SBAGGAGE (𝑝 = 0.0044, Set N exclusive reach driven by 𝐺-block special-status invariance + L ∗ overweight scaling). These asymmetries are directionally opposite and roughly cancel at the pooled level: HMP1 is falsified in both directions per-subject, which is the strongest possible evidence that neither framework subsumes the other. The pooled parity verdict (HMP2 ) is therefore not PIT-specific and not a statistical happenstance: it is the aggregation of substantive subject-specific complementary reaches that two independent mutation tools confirm. 4.4

Reassessing PMCM coverage claims: a worked example

NOETHER does not replace PMCM; it re-grounds it. Under inductive grounding, PMCM’s pattern grid is itself an empirical artefact: its rows are the inductive MetaPatterns of a particular catalogue, and “100% coverage” attests only that every row has at least one instance. Under NOETHER’s grounding, the grid becomes M(A𝑃 ), algebraically constructed and closed under the operator algebra in the sense of Theorem 1, and the coverage figure becomes a structural rather than nominal claim. This subsection works through the implication on two concrete cases. The deflationary direction is, in our view, NOETHER’s most concrete contribution to testing practice and the most resistant to the circularity caveat of Section 3.3.3: revealing that an inductive catalogue over-counts structurally distinct patterns does not require 𝑇 ∗ or T ∗ to have been derived independently from physics, since the over-counting is exposed by the canonical-block ordering itself. Case A: A comparison-sort library. Consider a numerical sorting library, and assume an inductive Pattern–Matrix Coverage catalogue with rows {P1 conservation/invariance, P2 monotonicity, P3 convergence, P4 trajectory, P5 partial-order/bounding} inherited from the reactor-physics MetaPattern taxonomy of §3.3.3. A user reports “100% coverage of the 5-row grid” on a particular MR set. NOETHER re-decomposition. The operator algebra Asort for a deterministic comparison sort has: a permutation-symmetry block 𝐺 ∋ 𝔖𝑛 (the input–output relation is permutation-equivariant in the comparator-permutation sense), a partial-order block 𝑂 ≤ (sorting respects the input order on already-sorted sub-arrays), an empty self-adjoint block 𝑇 ∗ (no reciprocity structure), an empty time-reversal block T ∗ (irreversible), an empty limit block L ∗ (sort is exact, not asymptotic), an empty qualitative-dynamics block D ∗ , and an empty method-comparison block E ∗ within a single algorithm (and non-empty if the user is comparing multiple sorting algorithms). Therefore M(Asort ) = { 𝑚 inv, 𝑚 mono }, of size 2. ACM Trans. Softw. Eng. Methodol., Vol. 0, No. 0, Article 0. Publication date: 2026.

NOETHER: A Constructive Framework for Metamorphic Pattern Discovery from Operator Algebras

0:57

Coverage correction. The 5-row PMCM grid carries three structurally empty rows under Asort : P3 (convergence) is vacuous because there is no L ∗ generator; P4 (trajectory) is vacuous because there is no D ∗ generator; P5 (partial-order/bounding) is vacuous because there is no E ∗ generator within a single-algorithm scope. The denominator should be 2, not 5. “100% coverage of the 5-row grid” is therefore not a claim about the user’s MR set; it is a claim about the inductive catalogue’s row count. The structurally meaningful coverage is “𝑘/2 of the algebraically required MetaPatterns covered”, where 𝑘 depends on the user’s actual MR set. Case A-bis: An external ML category set (Murphy et al. 2008) decoded against a feedforward classifier. To rule out the self-selection concern, we apply the same decoding to Murphy et al.’s six-class characterisation of MRs for ML applications [10, 12, 13], an independently published taxonomy (additive, multiplicative, permutative, invertive, inclusive, exclusive). For a generic feedforward image classifier 𝑓 : R𝑛 → {1, . . . , 𝐾 } with no inherent input symmetry, the induced algebra AFFN has only a single non-trivial generator under small additive noise (in 𝑂 ≤ or L ∗ ), so M(AFFN ) ⊆ {𝑚 stab }. Three of Murphy’s classes (multiplicative, permutative, invertive) are structurally vacuous on a vector image classifier without input symmetries; the remaining three (additive, inclusive, exclusive) collapse to the same 𝑚 stab MetaPattern. The structurally meaningful denominator for “coverage of Murphy’s six classes” on a generic vector image classifier is therefore 1, not 6; full per-class decoding (including the antipodal Z/2 exception, point-cloud / bag-of-features cases, and the bilinearity caveat) is in supplementary S9 (pmcm_case_abis_full.md). Murphy et al. explicitly intended their six classes as a checklist for selecting MRs, not as a coverage denominator; the target of this correction is subsequent papers that report Murphy-grid coverage figures on tasks lacking the relevant input symmetries [13]. The deflationary direction here is independent of 𝑇 ∗ and T ∗ , so does not inherit the prediction-circularity caveat of §3.3.3. Case B: A reactor-physics solver. The reactor-physics MetaPattern catalogue discussed in Section 3.3.3 provides a less obvious case. The catalogue has 5 rows (P1–P5). Under NOETHER’s re-grounding into M(ABoltz ) = {𝑚 inv, 𝑚 mono, 𝑚 adj, 𝑚 rev, 𝑚 conv, 𝑚 dyn, 𝑚 cmp }, the catalogue is in fact under-counted by two rows (𝑚 adj and 𝑚 rev are absent), even though for the Bateman-only subfamily it would be over-counted (P4 trajectory and P5 partial-order/bounding are absorbed differently into D ∗ and E ∗ ). The deflationary direction is thus not uniformly toward smaller grids; it is toward the algebraically determined grid for the algebra in question, which may be larger or smaller than the inductive grid. Quantification. For a fixed program family F with operator algebra A F , define coverageNOETHER (R, F ) =

|{ 𝑚 ∈ M(A F ) | 𝑚 ∩ R ≠ ∅ }| |M(A F )|

for an MR set R. This is the algebraically grounded analogue of PMCM’s empirical coverage. Where the inductive PMCM grid agrees with M(A F ), the two metrics coincide; where they disagree, the NOETHER metric is the structurally meaningful one. We note that coverageNOETHER inherits Theorem 1’s scope: it is a coverage measure over algebra-induced MRs, not over arbitrary properties; out-of-scope MRs (Appendix A) are by construction outside the denominator. Implication for empirical-adequacy practice. Reports of high pattern-grid coverage in published MR-evaluation studies should, where possible, be cross-checked against the algebraic decomposition of the program family under test. A report of “coverage = 𝑐” should be qualified with which row decomposition 𝑐 is computed against; reports of 𝑐 over inductive catalogues without such qualification are not directly comparable across papers. ACM Trans. Softw. Eng. Methodol., Vol. 0, No. 0, Article 0. Publication date: 2026.

0:58

5

Meng Li, Xiaohua Yang, Jie Liu, and Shiyu Yan

Threats to validity and limitations

We consolidate the construct, internal, external, and conclusion validity discussions from across the empirical chapter, together with practical engineering guidance for users of the framework, the artefact-availability statement, and a note on the partial automation of the upstream layer. 5.1

Four threats to validity

We organise threats following Wohlin et al.’s four-validity framework [57]: internal, external, construct, and conclusion. Internal validity. Theorem 1’s uniqueness depends on the canonical-block ordering of Definition 14. The proof in Appendix A catalogues every block-block interaction for the algebras instantiated. The closure result is over algebra-induced MRs in the sense of Definition 13; out-of-scope MRs that fall outside Definition 13 are catalogued in Appendix A, and two concrete counterexamples on the PWR core diffusion algebra are proved out-of-scope in Appendix A (corresponding to the negative instantiation of §3.6). The latter two jointly establish that Theorem 1′ (Conjecture A, absolute completeness) is false on APWR , and identify five independent extensions of Translate’s signature as the locus of follow-up theoretical work. Construct validity. The reactor-physics mapping (§3.3.3) provides preliminary evidence; nonphysics-domain evidence remains future work. The case study (§4.1) reports cat-(iv) detection 5/5 for Set N because the mutation set was constructed to cover one defect category per non-empty block of Aequi ; this exhibits construct validity of 𝜌 train-rev as a gradient-reversal probe rather than averaged superiority, with the DeepCrime [53] real-fault protocol committed as comparative addition. Set N’s 30 MRs were derived by a single author following CONSTRUCT-MP’s four-step procedure; an LRCA multi-LLM second-rater protocol (DeepSeek + ChatGPT + Anthropic Claude Opus) yields Fleiss’ 𝜅 = 1.000 across three LLMs on 𝑛 = 33 items in the almost-perfect Landis–Koch band, with full per-rater Cohen’s 𝜅 in supplementary S3 (lrca_audit.md). A human-pair 𝜅 replication is committed for follow-up work; the LLM-shared-training-data caveat (§3.3.3’s 18-MR audit) carries over. External validity. Two distinct external-validity questions are in scope: (i) whether the framework’s algebraic reach (Hypothesis 1) covers all program families admitting an operator algebra, and (ii) whether the §4.2.3 empirical substrate generalises across codebases within the framework’s scope precondition. On (i), Hypothesis 1 covers a wide swathe of mathematical structure but is not exhaustive; Remark 2 catalogues six candidate ninth-block program-family classes (symplectic, sheaf-theoretic, probabilistic / martingale, topological, label-consistency, empirical-parameterdistribution), of which two have explicit Translate-template designs already proposed (metricstability 𝑀lip at Remark 4, and empirical-parameter-distribution divergence motivated by the §4.1.1 pilot’s three undetected mutations) as the most actionable extension targets. On (ii), the 10 SUTs of §4.2.3 are concentrated on a single codebase (MathSignalClass + ComplexSignal) selected by the pre-registered scope criterion; they satisfy the framework’s scope precondition (each admits at least one non-empty NOETHER block beyond 𝐺), so the substrate confirms applicability within scope rather than tests the framework outside its design intent. A cross-codebase pilot on Apache Commons Math 3.6.1 (3 SUTs, 5 Set N MRs, 77 PIT 1.7.4 mutants) corroborates the within-scope generalisation direction: pooled Set N 10/77 = 13.0% Wilson 95% CI [7.2%, 22.3%]; 𝐺-block 6/21 = 28.6%; the framework’s D2 stratum prediction passes at 2/29 = 6.9%. The 𝑛 is underpowered for 𝛼 = 0.05 hypothesis testing; full numbers, per-mutant kill matrix, and the L ∗ orthogonality analysis on bilinear SUTs are in supplementary S4 (future_work.md item (b.cm)). ACM Trans. Softw. Eng. Methodol., Vol. 0, No. 0, Article 0. Publication date: 2026.

NOETHER: A Constructive Framework for Metamorphic Pattern Discovery from Operator Algebras

0:59

Full 38-D4J extension, SciPy Python-bridge solver suite, and Maven-resolved GenMorph headto-head are committed as follow-up (b). The replication tests scope-internal generalisation, not whether the framework should apply to programs lacking explicit operator-algebraic structure (such programs are out of scope by construction). Conclusion validity. The case study’s statistical inferences (§4.1) rest on a 20-mutation × 3-MRset cross-product on a single architecture. Wilson 95% confidence intervals on detection rates ([0.18, 0.57] for Set N, [0.03, 0.30] for Set L, [0.00, 0.16] for Set B) are reported; pairwise McNemar exact and Fisher exact tests are reported in supplementary S3 (table4.json::pairwise_stats). The denominator (20 mutations on one EGNN model) is sufficient to detect the observed Set-N-vsSet-B contrast at 𝛼 = 0.05 (Fisher 𝑝 = 0.008) but is not sufficient to characterise the framework’s performance distribution across architectures or defect distributions. The expanded comparativeevaluation protocol in §4.1 (MR-Scout [5], GenMorph [6], DeepCrime [53] subjects) raises the denominator and broadens the model coverage, addressing this threat directly. 5.2

Practical engineering guidance for users

This subsection collects practical recommendations for engineers applying NOETHER, particularly for the cases where Hypothesis 1’s assumptions are bordering or borderline. Audit guidance for infinite-group truncation. When the symmetry block 𝐺 is a finitely generated infinite discrete group under truncation parameter 𝐾 (e.g. Z𝑑 for an unbounded grid solver), Theorem 1’s closure result is over the truncated algebra rather than the full one. We recommend a 𝐾-sweep audit: compute 𝜌𝜄,𝐺 at three truncation levels 𝐾 ∈ {𝐾0, 2𝐾0, 4𝐾0 } and pass if detectionrate stability is within ±5% across the three values (the mesh-convergence stability margin of [24, §6.2]). The audit need not be re-run on every CI invocation; once per architectural change is sufficient. The reference implementation (supplementary S1) includes a k_sweep_audit() helper. When to check Hypothesis 1’s sufficiency at deployment time. For program families outside the three instantiated domains (Boltzmann reactor physics, equivariant ML, relational query optimisers), users should explicitly enumerate the candidate operators of A𝑃 and check whether each falls into one of the eight blocks. Operators that resist classification are signals that an additional block may be required and should be reported as candidates for an extension of the block taxonomy rather than absorbed into the existing taxonomy. Tolerance selection. Tolerances 𝜏 on continuous-valued MRs (e.g. 𝜌 rot , 𝜌 adj ) should be set as 𝜏 ≈ 102 𝜖fp where 𝜖fp is the floating-point unit roundoff (so 𝜏 = 10−4 for fp32, 𝜏 = 10−12 for fp64); the 102 factor is the forward-pass roundoff floor following Higham’s standard erroranalysis bound [58] for 𝑛 ≈ 103 scalar operations per output coordinate. The supplementary S3 tau_sweep.json documents the 𝜏/false-positive trade-off. 5.3

Artefact and supplementary-material availability

To support reviewer verification while preserving double-blind anonymity, we release a twostage artefact: a review-stage anonymised supplementary archive available at submission, and an acceptance-stage public release with permanent identifiers. Review-stage anonymised archive. The following supplementary materials are submitted alongside the manuscript and are available to reviewers through the conference submission system (or, equivalently, an anonymised OpenReview / Zenodo deposit) under SHA-256 content hash. The hash is computed over the concatenated tar-archive of the listed items and reported in the final manuscript at acceptance. ACM Trans. Softw. Eng. Methodol., Vol. 0, No. 0, Article 0. Publication date: 2026.

0:60

Meng Li, Xiaohua Yang, Jie Liu, and Shiyu Yan

• S1 Python reference implementation of CONSTRUCT-MP described in supplementary S9 (Appendix D), including the Boltzmann and equivariant-ML instantiations. • S2 The full 84-MR PWR corpus underlying Section 3.3.3, with each MR annotated by canonical block, NOETHER MetaPattern, and source equation. Table 3 corresponds to a 12-MR subset selected by the protocol stated there. • S3 The SE(3)-equivariant point-cloud testing harness from Section 3.4.3 and Section 4.1, including the mutation generators and MR sets used in the case study comparison. • S4 A reproducibility manifest documenting the random seeds, model checkpoints, and dataset versions referenced in the case study. Acceptance-stage public release. At acceptance the same archive will be deposited on Zenodo under a permanent DOI, and the SHA-256 hash anchored in the camera-ready version. We aim for the Available and Functional artefact-evaluation badges. 5.4

The remaining human role and partial automation of A𝑃 distillation

NOETHER mechanises the construction downstream of A𝑃 but assumes that A𝑃 has been distilled by a human. Three directions may partially automate that upstream step: LLM-assisted operator extraction, static-analysis-based extraction, and empirical-symmetry detection. None of them eliminates the human role for arbitrary programs. 6

Conclusion

The three foundational questions raised in Section 1, origin, closure, and transferability of MetaPattern sets, lacked a structural answer. NOETHER provides one within an explicit algebraic scope. Origin: MetaPatterns are equivalence classes of MRs derived from invariants of an operator algebra A𝑃 . Closure: Theorem 1 guarantees that the constructed MetaPattern set is closed over the algebrainduced MR space (Definition 13) under the framework’s Translate operator, with three concrete classes of out-of-scope MRs documented in Appendix A; absolute completeness over arbitrary properties remains open (Theorem 1′ ). Theorem 2 ensures the construction is computable. Transferability: the framework’s mechanism applies unchanged once a new program family’s algebra has been specified, tested within the framework’s scope precondition on three structurally distinct operator-algebraic skeletons (Boltzmann reactor physics, equivariant ML, relational query optimisers). Cross-domain empirical superiority and team adoption by PWR-simulator V&V groups, equivariant-ML testing teams, or database-optimiser test groups are open follow-up questions; the present paper establishes the structural transferability of the construction mechanism, not adoption outcomes on each domain. This grounding reframes several long-standing questions. Empirical adequacy frameworks gain an algebraic warrant for their pattern grid. Structured identification approaches gain an answer to why a given category set is closed under the chosen algebra. Automated pipelines can be constrained or initialised by the constructed MetaPattern set. LLM-prompted MR generation can be recast as algebra-conditioned generation rather than open-ended prompting. We have not solved the upstream problem of distilling A𝑃 from program semantics, nor have we eliminated induction from MetaPattern discovery. The eight-block decomposition that drives the construction is itself an empirical curation of mathematical structures recurrent across program families, stated as Hypothesis 1. The most important follow-up work is therefore upstream: combining LLM-assisted symbolic extraction, formal-methods-based static analysis, and empiricalsymmetry detection into a partially automated A𝑃 -distillation pipeline, and testing the eightblock decomposition on algebras outside its present image (Remark 2 catalogues six programfamily classes likely to require additional blocks). For the downstream layer, from A𝑃 to M(A𝑃 ), ACM Trans. Softw. Eng. Methodol., Vol. 0, No. 0, Article 0. Publication date: 2026.

NOETHER: A Constructive Framework for Metamorphic Pattern Discovery from Operator Algebras

0:61

the contribution is narrower and firmer: the construction is mechanical, algebraic closure under Translate is provable within the algebra-induced MR space (Theorem 1), and the construction transfers across domains once the algebra has been specified. Boundary of contribution (Conclusion restatement) Established. (i) Algebraic closure under Translate given a block decomposition (Theorem 1); (ii) polynomial-time decidability under finite generating-set assumption (Theorem 2); (iii) three nonvacuous instantiations across structurally distinct algebraic skeletons; (iv) a negative instantiation on the PWR core diffusion algebra APWR (§3.6, Appendix A), in which two MRs from the standard PWR safety-analysis literature (non-additivity of rod-bank reactivity worth, second-order mixed 𝑇mod -vs-𝐶𝐵 dependence of 𝑘 eff ) are proved not in MR(APWR ), falsifying Theorem 1′ (Conjecture A) on a structurally significant operator algebra and identifying five pairwise-independent extensions of Translate’s signature as the locus of repair. Open. (a) Whether a Composite-Translate extension covering the five obstructions of §3.6 and Appendix A preserves Theorem 1’s closure and Theorem 2’s polynomial-time decidability; (b) sufficiency of Hypothesis 1’s eight-block list (Remark 2’s six out-of-scope classes are candidate ninth blocks); (c) superiority over existing automated MR-identification pipelines on average defect distributions (the comparative-evaluation protocol in §4.1 establishes effects, not averages); (d) elimination of induction (relocated, not eliminated); (e) automation of upstream A𝑃 distillation (the framework treats A𝑃 as a given input from a domain expert; mechanising the extraction of operator algebras from program semantics remains an upstream task that NOETHER does not address; §5.4 sketches three partial-automation directions but commits to none). Both Hypothesis 1 (block sufficiency) and Translate’s signature (Translate sufficiency) are the loci where future induction-eliminating and completeness-establishing work should target.

ACM Trans. Softw. Eng. Methodol., Vol. 0, No. 0, Article 0. Publication date: 2026.

0:62

Meng Li, Xiaohua Yang, Jie Liu, and Shiyu Yan

Appendices A, B (worked-example material) Material running CONSTRUCT-MP on the heat / continuity / momentum / slowing-down reactor equations (Appendix A), per-MR source provenance for the representative MRs of Table 3 (Appendix B), and worked examples for multi-block-derivable MRs (originally introductory to Appendix C) is provided in supplementary S9_migrated_appendices/A_B_C_worked.tex; the body text’s claims do not depend on this material beyond the cross-references made in §3.3 and §3.3.3. A

Proofs

Lemma C.1 (Well-foundedness of canonical-block ordering) Lemma 1. The canonical-block ordering of Definition 14 is a strict total order on the eight blocks, and the assignment of any multi-block-derivable MR to its highest-priority block is unique. Proof. The ordering is a strict total order on a finite set by inspection. Given an MR 𝜌 with derivations {(𝑠𝑖 , 𝜄𝑖 )}𝑘𝑖=1 from blocks 𝑠 1, . . . , 𝑠𝑘 , the assignment selects 𝑠 ∗ = max> {𝑠 1, . . . , 𝑠𝑘 }. Since the strict order is total, 𝑠 ∗ is unique. □ Per-block instantiations of Translate Definition 12 fixes the signature of Translate but defers per-block specifics. Table 18 fills in the canonical input-tuple-generation rule and the resulting MR template for each of the eight blocks. Table 18. Per-block instantiations of Translate. Block 𝑠 𝐺 𝑂≤ 𝑇∗ T∗ L∗ D∗ E∗ ∗ Brel

Canonical tuple from base 𝑥 0

MR template 𝜌𝜄,𝑠

|𝐺 |−1 (𝑥𝑖 )𝑖=0 = (𝑔𝑖 · 𝑥 0 ) over group orbit (𝑥 1 , 𝑥 2 ) with 𝑥 1 ≤𝜃 𝑥 2 in the partial order

∀𝑥 0 , ∀𝑔 ∈ 𝐺 : 𝑃 (𝑔 · 𝑥 0 ) = 𝜌 (𝑔) · 𝑃 (𝑥 0 ) 𝑥 1 ≤𝜃 𝑥 2 ⇒ 𝑃 (𝑥 1 ) ≤Y 𝑃 (𝑥 2 ) ⟨𝐿 𝑃 (𝑥 1 ), 𝑃 (𝑥 2 ) ⟩ = ⟨𝑃 (𝑥 1 ), 𝐿 𝑃 (𝑥 2 ) ⟩

paired tuple ( (𝑥 1 , 𝑃 (𝑥 1 ) ), (𝑥 2 , 𝑃 (𝑥 2 ) ) ) in the inner product (𝑥, T𝑥 ) with T the time-reversal involution sequence (𝑥𝜃 ) with 𝜃 → 𝜃 ∗ solution trajectory (𝜉 (𝑡 ) )𝑡 ≥0 extracted by D method pair (𝑀1 , 𝑀2 ) in the partial order ⪯E rewrite pair (𝐸, 𝐸 ′ ) generated by an algebraic-rewriting rule R ∈ R rel on the idempotent semiring

𝑃 ( T𝑥 ) = T 𝑃 (𝑥 ) on the reversibility sub-domain ∥𝑃𝜃 − 𝑃𝜃 ∗ ∥ ∗ = 𝑂 ( 𝑓 (𝜃 ) ) at the prescribed rate qualitative-feature relation (extremum, monotonicity, Scurve) preserved on (𝜉 (𝑡 ) ) err(𝑀1 ) ≤ err(𝑀2 ) on the prescribed benchmark family ∀𝐷. eval(𝐸, 𝐷 ) =bag eval(𝐸 ′ , 𝐷 ) at the rewriting rule’s stated scope

The per-block rule together with the ∼𝑠 equivalence relation of Definition 11 fully determines Translate(𝜄, 𝑠) once the operator family Φ ⊆ 𝑠 is fixed. Implementations of these seven cases as Python callables ship in supplementary material S1 (construct_mp.py, function translate together with the seven default_extractor_* routines). Theorem 1 (Algebraic Closure under Translate), full proof Proof. Existence. Let 𝜌 ∈ MR(A𝑃 ) in the sense of Definition 13. There exist a block 𝑠, an invariant 𝜄 ∈ I𝑠 , and a derivation 𝜌 = Translate(𝜄, 𝑠). Step 1 of CONSTRUCT-MP places 𝜄 in I𝑠 ; step 2 places 𝜌 in R (𝜄); step 3 forms 𝑚𝑠 = R (𝜄)/∼𝑠 ; step 4 returns 𝑚𝑠 ∈ M(A𝑃 ). Uniqueness. Suppose 𝜌 admits derivations through multiple blocks: 𝜌 = Translate(𝜄 1, 𝑠 1 ) = Translate(𝜄 2, 𝑠 2 ) with 𝑠 1 ≠ 𝑠 2 . Definition 14’s canonical-block ordering selects 𝑠 ∗ = max> {𝑠 1, 𝑠 2 }. By Lemma C.1, 𝑠 ∗ is unique; the canonical assignment 𝜌 ↦→ 𝑚𝑠 ∗ is unique. □ ACM Trans. Softw. Eng. Methodol., Vol. 0, No. 0, Article 0. Publication date: 2026.

NOETHER: A Constructive Framework for Metamorphic Pattern Discovery from Operator Algebras

0:63

Theorem 2 (Decidability), full proof Proof. Step 1 cost. For each generator 𝑔𝑖 , compute 𝑔𝑖 ’s contribution to each I𝑠 . Cost: 𝑂 (𝑡𝑖 ) per generator, 𝑂 (𝑛 · max𝑖 𝑡𝑖 ) aggregated. Step 2 cost. ‘Translate‘ is 𝑂 (1) per invariant. Total: 𝑂 (𝑛). Step 3 cost. Union-find with path compression: amortised 𝑂 (𝛼 (𝑛)) per operation; we use 𝑂 (log 𝑛) for simpler analysis. Total: 𝑂 (𝑛 log 𝑛). Step 4 cost. 𝑂 (7) = 𝑂 (1). Total: 𝑂 (𝑛 · max𝑖 𝑡𝑖 · log 𝑛) when max𝑖 𝑡𝑖 ≥ 1. □ C.4 An open problem: absolute completeness Theorem 1’s scope is bounded by Definition 13: the closure is over MRs reachable through Translate from a single block invariant. We attempted a stronger statement: Conjecture (Theorem 1′ , absolute completeness). Every MR 𝜌 formulable as a property over A𝑃 ’s operators is contained in some 𝑚 ∈ M(A𝑃 ). A proof would require either (a) a normalisation theorem reducing every operator-algebra MR to a Translate-reachable form, or (b) an extension of Translate to compositional invariants spanning multiple blocks. We were unable to establish either without imposing additional structural assumptions on A𝑃 . A partial empirical step toward Theorem 1′ is available on a single domain through the 18-MR engineering audit reported in §3.3.3: 17 of 18 are placed by majority of three LLM labellers into one of the seven MetaPatterns or 𝑚 rel (subsumption 94.4%, Fleiss’ 𝜅 = 0.857, raw labels in supplementary S2 18mr_audit/); the single orphan localises to the metric-stability class discussed in Appendix 4 and Appendix C.5.2, for which a concrete candidate ninth block is sketched. This is a constructive partial support, not a proof: it is empirical, single-domain, bounded by the LLM-shared-training-data caveat noted in §3.3.3, and does not bound the gap in the absence of the candidate ninth block. The conjecture remains open. Section C.5 below documents three concrete classes of MRs that lie outside Theorem 1’s scope and would have to be addressed by any positive resolution of Theorem 1′ ; §3.6 and Appendix A additionally falsify Theorem 1′ on APWR . C.5 Out-of-scope MRs: three concrete classes We document three families of MRs that satisfy the informal description “a property of 𝑃’s executions over the operator algebra A𝑃 ” but are not algebra-induced under Definition 13, and therefore lie outside the scope of Theorem 1. These are not threats to the theorem; they delimit it. C.5.1 Probabilistic / distributional MRs without operator-algebraic representation. Consider the MR “the Shannon entropy 𝐻 (𝑓 (x)) of a classifier’s output distribution should not decrease when the input is augmented by Gaussian noise N (0, 𝜎 2 𝐼 )”. The augmentation is parametric in 𝜎 and is not a group action, a partial-order operator, a self-adjoint operator, a time-reversal involution, a methodcomparison operator, or (without further structure) a limit operator on X. The MR constrains a functional 𝐻 of the output distribution, not a point-wise relation between outputs. There is no 𝜄 ∈ I𝑠 for any 𝑠 from which Translate can reach this MR. Consequently the MR is not algebrainduced under Definition 13 and is not covered by Theorem 1. A positive resolution of Theorem 1′ would require either embedding stochastic perturbations into a probabilistic extension of A𝑃 , or extending Translate to functionals over output distributions. C.5.2 Adversarial / input-set MRs. The MR “∥𝛿 ∥ 𝑝 ≤ 𝜖 ⇒ 𝑓 (x+𝛿) = 𝑓 (x)” (adversarial robustness in ℓ𝑝 ball) constrains 𝑓 ’s behaviour on a set defined by a norm constraint, not by a group action. The set {𝛿 : ∥𝛿 ∥ 𝑝 ≤ 𝜖} does not in general carry a closed group structure on X, and the MR is not derivable as Translate(𝜄, 𝑠) for any 𝑠 in D (A𝑃 ) as currently defined. Any treatment of this MR within ACM Trans. Softw. Eng. Methodol., Vol. 0, No. 0, Article 0. Publication date: 2026.

0:64

Meng Li, Xiaohua Yang, Jie Liu, and Shiyu Yan

NOETHER’s scope would require an eighth block (e.g. a metric-ball block with bounded Lipschitz operators), or a relaxation of Translate to non-group input neighbourhoods. A concrete candidate for the eighth block alluded to above is a metric-stability block 𝑀lip = (X, 𝑑 X ) → (Y, 𝑑 Y ) whose operators are 𝐾-Lipschitz maps and whose induced MetaPattern 𝑚 lip is the equivalence class of pointwise stability inequalities 𝑑 Y (𝑃 (𝑥 ′ ), 𝑃 (𝑥)) ≤ 𝐾 · 𝑑 X (𝑥 ′, 𝑥). The corresponding Translate template constructs a follow-up input by metric perturbation 𝑥 ′ = 𝑥 + 𝜀𝑢 (norm ∥𝑢 ∥ = 1, |𝜀 | < 𝛿) ∗ and predicates a 𝐾-Lipschitz output bound; canonical-block ordering would place 𝑀lip after Brel since metric structure is independent of the seven existing block invariants (no group action on the perturbation set, no partial order on inputs, no self-adjoint operator, and no parametric refinement family). Theorem 1’s closure proof transfers without modification because 𝑚 lip is single-block algebraically derived. We do not commit to 𝑀lip as part of the canonical decomposition in this paper, but we record it as the most concrete sub-instance of Remark (iv) (topological invariants) that admits an immediate Translate template. C.5.3 Compositional MRs across multiple blocks under non-canonical derivations. The MR “rotating a point cloud by 𝑅 and simultaneously √ taking the training-size limit 𝑛 → ∞ should give an output that converges to 𝑓 (x) at rate 𝑂 (1/ 𝑛)” invokes both 𝐺 (rotation) and L ∗ (training-size limit) within a single MR. Definition 14’s canonical-block ordering assigns this to 𝐺, but the resulting MR “𝑓 (𝑅 · x) = 𝑓 (x)” loses the convergence-rate content. The compositional content is in M(A𝑃 ) if and only if it can be split into separate single-block invariants (one in 𝐺, one in L ∗ ); MRs whose semantic content is irreducibly compositional (in the sense that splitting destroys the property’s truth value) lie outside Theorem 1’s scope. This is the case Theorem 1′ option (b) is targeted at: an extended Translate that operates on tuples of block invariants. We have not constructed such an extension that preserves Theorem 1’s polynomial-time decidability (Theorem 2), and we leave this as the most concrete sub-problem under Theorem 1′ . The three classes of §C.5.1–§C.5.3 are abstract characterisations of MRs outside Theorem 1’s scope. Appendix A supplements them with two concrete instances drawn from the PWR core diffusion algebra APWR , each of which is empirically realised on every conforming PWR core simulator and documented in the standard reactor-physics literature. Together with §3.6, Appendix A establishes that Theorem 1′ (Conjecture A) is false on APWR , and identifies five structural obstructions in Translate’s signature (operator-spectrum output, homomorphism-failure 𝜋-template, configuration-indexed adjoint structure, higher-order mixed-difference templates, two-direction joint parametric dependence) that any positive resolution would have to repair. C.6 Proofs for the negative instantiation on APWR (§3.6) This appendix supplies the proofs for Propositions 1 and 2 of §3.6. The proof structure for both is the same: enumerate the eight blocks of D (APWR ), instantiate the per-block Translate template of Table 18, and verify by inspection that no invariant 𝜄 ∈ I𝑠 yields the target MR. The blockby-block exclusions in Proposition 1’s proof are the most detailed; Proposition 2 reuses the same exclusion pattern with the obstruction localised to the 𝑂 ≤ block. C.6.1 Proof of Proposition 1 (non-additivity is not Translate-reachable). Statement. For 𝜌 nonadd as in Definition 16 and every 𝑠 ∈ D (APWR ), every 𝜄 ∈ I𝑠 : Translate(𝜄, 𝑠) ≠ 𝜌 nonadd . Proof. We use the exact-form definition of 𝑑𝜌 (Definition 15) throughout, which depends only on dominant eigenvalues 𝑘 eff of operators in APWR . The adjoint-perturbation reading of §3.6 is the physical motivation but is not invoked in any case below. Case 𝑠 = 𝐺. By Definition 11, an invariant 𝜄 ∈ I𝐺 has the form (Φ, 𝜋) with Φ ⊆ 𝐺 a finite 𝑘 obtained by applying Φ to a base input 𝑥 . operator family and 𝜋 a relation on tuples (𝑥𝑖 , 𝑃 (𝑥𝑖 ))𝑖=1 0 ACM Trans. Softw. Eng. Methodol., Vol. 0, No. 0, Article 0. Publication date: 2026.

NOETHER: A Constructive Framework for Metamorphic Pattern Discovery from Operator Algebras

0:65

By Table 18, the canonical Translate template for 𝐺 is the equivariance schema Translate(𝜄, 𝐺) ≡ ∀𝑥 0 ∀𝑔 ∈ Φ : 𝑃 (𝑔 · 𝑥 0 ) = 𝜌 (𝑔) · 𝑃 (𝑥 0 ). Two structural mismatches with 𝜌 nonadd : (a) Operator-spectrum output, not 𝑃 output. 𝜌 nonadd is an inequality between sums of 1/𝑘 eff values, where each 𝑘 eff is the dominant eigenvalue of a configuration-specific diffusion operator 𝐻𝑋 ∈ APWR . The dominant eigenvalue is a spectral quantity of the operator, obtained as part of the simultaneous solution (𝑘 eff , 𝜙) of 𝐻𝜙 = (1/𝑘 eff ) 𝐹𝜙; it is not a function of 𝑃 (𝑥) alone but a property of the operator 𝐻 itself. Translate’s output relation 𝜋 in Definition 11 ranges over (X × Y)𝑘 , where Y is the program output space (flux distributions, in this case). Operatorspectrum quantities are not in Y; they are scalar invariants of operators in O, lying outside Translate’s signature by construction. (b) Non-additivity is not equivariance. Even granting a charitable extension to admit 𝑘 eff as a derived output, the 𝐺-template asserts equivariance of the output under the action of Φ: 𝑃 (𝑔 · 𝑥 0 ) is determined by 𝑔 and 𝑃 (𝑥 0 ) through the representation 𝜌 (𝑔). 𝜌 nonadd asserts that the worth functional 𝑑𝜌 : Orod → R>0 is not a semigroup homomorphism: 𝑑𝜌 (𝐴 ∪ 𝐵) ≠ 𝑑𝜌 (𝐴) + 𝑑𝜌 (𝐵). Failure of homomorphism is not equivariance failure; it is the absence of an additive structurepreserving map, which has no expression in the equivariance template 𝜋 for 𝐺. No 𝜄 ∈ I𝐺 yields 𝜌 nonadd . Case 𝑠 = 𝑂 ≤ . By Table 18, the 𝑂 ≤ template is the absolute-monotonicity schema Translate(𝜄, 𝑂 ≤ ) ≡ ∀𝑥 1, 𝑥 2 : 𝑥 1 ≤𝜃 𝑥 2 =⇒ 𝑃 (𝑥 1 ) ≤ Y 𝑃 (𝑥 2 ). 𝜌 nonadd is a quaternary relation on the four configurations (𝑥 0, O𝐴 𝑥 0, O 𝐵 𝑥 0, O𝐴∪𝐵 𝑥 0 ): it asserts a non-vanishing mixed second difference  −1  −1 Δ𝐴𝐵 (𝑥 0 ) = 𝑘 eff (𝑃 (𝑥 0 )) − 𝑘 eff (𝑃 (O𝐴∪𝐵 𝑥 0 ))  −1  −1 − 𝑘 eff (𝑃 (𝑥 0 )) − 𝑘 eff (𝑃 (O𝐴 𝑥 0 ))  −1  −1 − 𝑘 eff (𝑃 (𝑥 0 )) − 𝑘 eff (𝑃 (O 𝐵 𝑥 0 )) ≠ 0 (where the subtractions use Definition 15’s positive-worth convention). The 𝑂 ≤ template captures binary monotonicity between two points along a single partial order ≤𝜃 . The mixeddifference structure of 𝜌 nonadd requires comparison across four configurations forming a “rectangle” {𝑥 0, O𝐴 𝑥 0, O 𝐵 𝑥 0, O𝐴∪𝐵 𝑥 0 } with two independent perturbation directions (insertion of 𝐴 and insertion of 𝐵); no ≤𝜃 relates all four pairwise into a single chain. Furthermore, the assertion is non-vanishing of a difference, not a directional inequality; it is direction-agnostic, capturing both shadowing (Δ > 0) and anti-shadowing (Δ < 0). The 𝑂 ≤ template’s ≤ Y is a directional partial order, not a non-vanishing constraint. No 𝜄 ∈ I𝑂 ≤ yields 𝜌 nonadd . Case 𝑠 = 𝑇 ∗ . By Table 18, the 𝑇 ∗ template asserts ⟨𝐿 𝑃 (𝑥 1 ), 𝑃 (𝑥 2 )⟩ = ⟨𝑃 (𝑥 1 ), 𝐿 𝑃 (𝑥 2 )⟩ for a single self-adjoint operator 𝐿 in a fixed inner product. The structural mismatch with 𝜌 nonadd has two components: (i) Single operator 𝐿 vs. configuration-indexed family. The exact 𝑑𝜌 values entering 𝜌 nonadd are eigenvalues of four distinct diffusion operators 𝐻 ∅ , 𝐻𝐴 , 𝐻𝐵 , 𝐻𝐴∪𝐵 , each self-adjoint within its own configuration but pairwise distinct as operators. The 𝑇 ∗ template’s 𝐿 is fixed; it does not range over a configuration-indexed family {𝐻𝑋 }𝑋 ∈ Orod . The self-adjointness of any single 𝐻𝑋 does not imply or constrain a relation between eigenvalues of different 𝐻𝑋 ’s. ACM Trans. Softw. Eng. Methodol., Vol. 0, No. 0, Article 0. Publication date: 2026.

0:66

Meng Li, Xiaohua Yang, Jie Liu, and Shiyu Yan

(ii) Adjoint weighting function depends on configuration. Under the standard adjoint-perturbation reading, each 𝑑𝜌 (𝐵; 𝑋 ) for 𝑋 ∈ {∅, 𝐴} admits the first-order representation 𝑑𝜌 (𝐵; 𝑋 ) ≈ −

⟨𝜙𝑋† , 𝛿𝐻𝐵 𝜙𝑋 ⟩ ⟨𝜙𝑋† , 𝐹𝑋 𝜙𝑋 ⟩

,

with (𝜙∫𝑋 , 𝜙𝑋† ) the principal eigenfunctions of (𝐻𝑋 , 𝐻𝑋† ). The Hilbert-space inner product ⟨·, ·⟩ = (·) (·) 𝑑 Ω 𝑑𝐸 𝑑r is unchanged across 𝑋 . What changes across 𝑋 is the adjoint weighting function 𝜙𝑋† , which is the principal eigenfunction of a structurally different adjoint operator 𝐻𝑋† from 𝐻 ∅† (because 𝐻𝑋 contains 𝐴’s absorbing material whereas 𝐻 ∅ does not). 𝜙𝐴† is locally depressed in 𝐴’s geometric support and globally redistributed elsewhere; this is the adjointperturbation root cause of the non-additivity 𝑑𝜌 (𝐴 ∪ 𝐵) ≠ 𝑑𝜌 (𝐴) + 𝑑𝜌 (𝐵). The 𝑇 ∗ template’s structure (single 𝐿, fixed inner product, asserting ⟨𝐿𝑥 1, 𝑥 2 ⟩ = ⟨𝑥 1, 𝐿𝑥 2 ⟩) has no place to express “the weighting function 𝜙 † entering the inner product is itself the principal eigenfunction of a configuration-indexed adjoint operator and changes when configuration changes”. This is a configuration-dependent adjoint structure, not a self-adjointness identity on a single operator. No 𝜄 ∈ I𝑇 ∗ yields 𝜌 nonadd . ∗ . The PWR diffusion operator −∇ · 𝐷∇ + Σ is irreversible: it is parabolic (transient Case 𝑠 = Trev 𝑎 form) or elliptic (steady-state form), neither of which admits a time-reversal involution on the ∗ is empty for A ∗ . relevant solution sub-family. Hence Trev PWR , and vacuously no 𝜄 ∈ ITrev ∗ ∗ Case 𝑠 = L . By Table 18, the L template is a convergence statement ∥𝑃𝜃 − 𝑃𝜃 ∗ ∥ ∗ = 𝑂 (𝑓 (𝜃 )) at a parametric limit. 𝜌 nonadd contains no limit operation: it is a strict inequality at finite, fixed configurations (∅, 𝐴, 𝐵, 𝐴 ∪ 𝐵, 𝑥 0 ). No 𝜄 ∈ IL ∗ . Case 𝑠 = D ∗ . By Table 18, the D ∗ template asserts a qualitative-feature relation (extremum, monotonicity, S-curve) on a solution trajectory 𝜉 (𝑡). 𝜌 nonadd is a steady-state inequality between four reactivity values; it does not concern trajectory shapes. No 𝜄 ∈ ID ∗ . Case 𝑠 = E ∗ . By Table 18, the E ∗ template compares two methods 𝑀1, 𝑀2 on a benchmark family. 𝜌 nonadd compares four operator configurations on a single fixed method (the same diffusion solver 𝑃 in all four worth values). No 𝜄 ∈ IE ∗ . ∗ . Per §3.5, B ∗ is non-empty only on program families with idempotent-semiring Case 𝑠 = Brel rel rewriting structure. The PWR diffusion solution operator algebra does not carry such structure ∗ is empty (no rewriting rules between core states preserve evaluation under all valid inputs). Brel ∗ . for APWR . Vacuously no 𝜄 ∈ IBrel This exhausts D (APWR ). For every block 𝑠 and every 𝜄 ∈ I𝑠 , Translate(𝜄, 𝑠) ≠ 𝜌 nonadd . Hence 𝜌 nonadd ∉ MR(APWR ). □ C.6.2 Three obstructions identified by Proposition 1’s proof. The proof identifies three independent structural obstructions in Translate’s present definition: (O1) Operator-spectrum output is not in Y. 𝜌 nonadd asserts a relation between 1/𝑘 eff values, where each 𝑘 eff is a dominant eigenvalue of an operator 𝐻𝑋 . Translate’s 𝜋 in Definition 11 ranges over (X × Y)𝑘 ; eigenvalues of operators in O are scalar invariants of those operators, not elements of Y. (O2) Output relation is non-additivity (failure of homomorphism), not equivariance, partial order, or self-adjointness. The worth functional 𝑑𝜌 : Orod → R is not a semigroup homomorphism; this is a third type of algebraic relation distinct from the equivariance, monotonicity, and selfadjointness expressed by Translate’s per-block 𝜋 templates. (O3) Adjoint weighting function 𝜙𝑋† entering the 𝑇 ∗ block’s inner product is configuration-dependent. While the Hilbert-space measure 𝑑 Ω 𝑑𝐸 𝑑r is fixed, the eigenfunction 𝜙𝑋† varies with 𝑋 because ACM Trans. Softw. Eng. Methodol., Vol. 0, No. 0, Article 0. Publication date: 2026.

NOETHER: A Constructive Framework for Metamorphic Pattern Discovery from Operator Algebras

0:67

𝐻𝑋† varies with 𝑋 . Definition 11 fixes the self-adjoint operator 𝐿 once; it does not admit a configuration-indexed family {𝐿𝑋 } with 𝐿𝑋 ’s spectrum varying with 𝑋 . A constructive resolution of Proposition 1’s obstructions would require Translate to admit (i) operator-spectrum output relations (eigenvalues, integrals, ratios as the targets of 𝜋), (ii) homomorphism-failure relations as a 𝜋-template type alongside equivariance / monotonicity / self-adjointness, and (iii) configuration-dependent adjoint structure on 𝑇 ∗ . C.6.3 Proof of Proposition 2 (MTC-vs-boron mixed dependence is not Translate-reachable). Statement. For 𝜌 MTC-bor as in Definition 17 and every 𝑠 ∈ D (APWR ), every 𝜄 ∈ I𝑠 : Translate(𝜄, 𝑠) ≠ 𝜌 MTC-bor . Proof. The principal obstruction is in the 𝑂 ≤ block; we treat that case in detail and abbreviate the others. Case 𝑠 = 𝑂 ≤ . By Table 18, the 𝑂 ≤ template is the absolute-monotonicity schema Translate(𝜄, 𝑂 ≤ ) ≡ ∀𝑥 1, 𝑥 2 : 𝑥 1 ≤𝜃 𝑥 2 =⇒ 𝑃 (𝑥 1 ) ≤ Y 𝑃 (𝑥 2 ), a first-order statement asserting a binary relation between 𝑃 (𝑥 1 ) and 𝑃 (𝑥 2 ) at 𝜃 -comparable inputs along a single partial-order direction ≤𝜃 . 𝜌 MTC-bor asserts a non-zero second-order mixed partial derivative of 𝑘 eff with respect to two independent parameter directions 𝑇mod and 𝐶𝐵 : 𝜕 2𝑘 eff 𝜕𝑇mod 𝜕𝐶𝐵

> 𝜏MTC-bor .

Two independent obstructions in the 𝑂 ≤ template: (a) Order vs. mixed-derivative structure. The mixed second derivative is the limit of a four-point finite-difference quotient over a “rectangle” {(𝑇0, 𝐶 0 ), (𝑇0 + Δ𝑇 , 𝐶 0 ), (𝑇0, 𝐶 0 + Δ𝐶), (𝑇0 + Δ𝑇 , 𝐶 0 + Δ𝐶)}: 𝑘 (𝑇0 + Δ𝑇 , 𝐶 0 + Δ𝐶) − 𝑘 (𝑇0, 𝐶 0 + Δ𝐶) − 𝑘 (𝑇0 + Δ𝑇 , 𝐶 0 ) + 𝑘 (𝑇0, 𝐶 0 ) 𝜕 2𝑘 eff = lim Δ𝑇 ,Δ𝐶→0 𝜕𝑇mod 𝜕𝐶𝐵 Δ𝑇 · Δ𝐶 (writing 𝑘 for 𝑘 eff ). This is structurally a four-point relation, not a two-point relation. The 𝑂 ≤ template’s 𝜋 relates (𝑃 (𝑥 1 ), 𝑃 (𝑥 2 )) pairwise; it has no expression for a four-point combination weighted by 1/(Δ𝑇 · Δ𝐶). Equivalently, the canonical input-tuple-generation rule for 𝑂 ≤ in Table 18 produces tuples (𝑥 1, 𝑥 2 ) with 𝑥 1 ≤𝜃 𝑥 2 , not 2-by-2 perturbation rectangles. (b) Two independent parameter directions. The mixed derivative requires jointly varying 𝑇mod and 𝐶𝐵 along two independent directions. The 𝑂 ≤ template’s ≤𝜃 is a single partial order on X (or on a single coordinate of X). Even granting the construction of a product order ≤𝑇 × ≤𝐶 on a 2-D parameter slice of X, the 𝜋 relation still applies along the order chain as a directional inequality, not as a non-vanishing-second-difference statement. The two independent parameter directions are perpendicular, not chained; the ≤𝜃 formalism collapses them into one chain only by losing the non-vanishing-mixed-difference content. Furthermore, 𝜌 MTC-bor ’s output is again 𝑘 eff , an operator-spectrum quantity (cf. Proposition 1 Case 𝐺 obstruction (a)). This gives a third obstruction in 𝑂 ≤ : even if mixed-second-derivative structure could be embedded into 𝜋, the output value would not lie in Y. No 𝜄 ∈ I𝑂 ≤ yields 𝜌 MTC-bor . Other blocks. • Case 𝑠 = 𝐺. No group action in APWR relates (𝑇mod, 𝐶𝐵 ) pairs at different parameter values to each other through equivariance: 𝑇mod and 𝐶𝐵 are continuous parameters acting on the crosssection library, not group-action coordinates. Even if a charitable embedding in 𝐺 were attempted, the same operator-spectrum-output obstruction (Proposition 1 Case 𝐺 (a)) applies: 𝑘 eff is not in Y. ACM Trans. Softw. Eng. Methodol., Vol. 0, No. 0, Article 0. Publication date: 2026.

0:68

Meng Li, Xiaohua Yang, Jie Liu, and Shiyu Yan

• Case 𝑠 = 𝑇 ∗ . The MTC operator 𝜕/𝜕𝑇mod is not self-adjoint in any natural inner product on the diffusion-solution space (the parameter 𝑇mod enters the cross-section coefficients of 𝐻 rather than 𝐻 ’s acting space, so 𝜕𝐻 /𝜕𝑇mod has no self-adjointness structure analogous to 𝐻 itself). No 𝜄 ∈ I𝑇 ∗ . ∗ . Empty for PWR diffusion. No 𝜄 ∈ I ∗ . • Case 𝑠 = Trev Trev • Case 𝑠 = L ∗ . 𝜌 MTC-bor does not assert convergence at a parametric limit; it asserts a non-zero finite value of a mixed second derivative at a finite parameter point in the operating envelope. The mixed-derivative limit Δ𝑇 , Δ𝐶 → 0 is the definition of the derivative, not the MR’s claim; the MR’s claim is that the resulting derivative exceeds 𝜏MTC-bor , which is a non-vanishing condition at a finite parameter value, not a convergence rate. No 𝜄 ∈ IL ∗ . • Case 𝑠 = D ∗ . 𝜌 MTC-bor concerns 𝑘 eff as a function of two parameters at steady state; it does not involve a solution trajectory of an underlying ODE/PDE. No 𝜄 ∈ ID ∗ . • Case 𝑠 = E ∗ . The comparison is between two parameter regimes (𝑇0, 𝐶 0 ) and (𝑇0 + Δ𝑇 , 𝐶 0 + Δ𝐶) of a single fixed method (the same PWR core simulator 𝑃 in all four eigenvalues), not between two methods. No 𝜄 ∈ IE ∗ . ∗ . Empty for A ∗ . • Case 𝑠 = Brel PWR . No 𝜄 ∈ IBrel This exhausts D (APWR ). Hence 𝜌 MTC-bor ∉ MR(APWR ). □ C.6.4 Two further obstructions identified by Proposition 2’s proof. The proof identifies two further independent structural obstructions in Translate’s present definition, in addition to the three identified by Proposition 1: (O4) MR is a non-zero second-order mixed partial derivative, not a first-order relation. All per-block 𝜋 templates in Table 18 are first-order: equivariance is a first-order identity 𝑃 (𝑔𝑥 0 ) = 𝜌 (𝑔)𝑃 (𝑥 0 ); monotonicity is a first-order inequality 𝑃 (𝑥 1 ) ≤ 𝑃 (𝑥 2 ); self-adjointness is a first-order pairing ⟨𝐿𝑥 1, 𝑥 2 ⟩ = ⟨𝑥 1, 𝐿𝑥 2 ⟩. Mixed second differences (and a fortiori higher-order mixed differences) have no expression in any of these. (O5) MR involves two independent parameter directions, joined as a 2-by-2 perturbation rectangle, not as a chain. The 𝑂 ≤ block’s ≤𝜃 is a single partial-order direction; even with multiple independent partial orders in I𝑂 ≤ , the 𝜋 template relates pairwise inputs along a single chosen direction, not jointly across two perpendicular directions in a finite-difference rectangle. A constructive resolution of Proposition 2’s obstructions would require Translate to admit (iv) higher-order mixed-difference 𝜋-templates and (v) two-direction joint parametric dependence beyond the single-𝜃 partial order of Definition 11. C.6.5 Combined corollary. Corollary (Theorem 1′ is false on APWR , two-fold). The MRs 𝜌 nonadd, 𝜌 MTC-bor are each formulable over operators of APWR and each empirically realised on every conforming PWR core simulator. By Propositions 1 and 2, neither is in MR(APWR ). The structural obstructions O1–O5 identified by the two proofs are pairwise distinct: no single extension of Translate’s signature absorbs any two simultaneously, so the joint obstruction is irreducibly five-fold. Remark 8 (Open: Composite Translate). A natural follow-up is to define a Composite Ÿ : I𝑠 × · · · × I𝑠 → MR(𝑃) that combines invariants from multiple blocks Translate Translate 1 𝑘 under a generalised 𝜋 template admitting (i) operator-spectrum output, (ii) homomorphism-failure relations, (iii) configuration-indexed adjoint structure, (iv) higher-order mixed differences, and (v) twodirection joint parametric dependence. Whether such an extension preserves Theorem 1’s closure (now g 𝑃 )) and Theorem 2’s polynomial-time decidability is the principal open problem this subover MR(A section leaves to future work. Five independent extensions are needed; a single uniform Composite Translate covering all of them would be a substantive theoretical contribution. ACM Trans. Softw. Eng. Methodol., Vol. 0, No. 0, Article 0. Publication date: 2026.

NOETHER: A Constructive Framework for Metamorphic Pattern Discovery from Operator Algebras

0:69

C.7 Worked enumeration of CONSTRUCT-MP on the Boltzmann algebra (migrated) The line-by-line enumeration of CONSTRUCT-MP Steps 1–4 on ABoltz , originally Appendix C.7, is provided in supplementary S9_migrated_appendices/C7_boltzmann_worked.tex. Appendices D, E (implementation + consistency check) A reference implementation of CONSTRUCT-MP (Appendix D) and the constructtrace consistency check on hand-crafted block-targeted mutants (Appendix E, formerly demoted from the H3a.1 evidence base) are provided in supplementary S9_migrated_appendices/D_E_implementation_consistency.tex; both are confidencestrengthening illustrative material that does not carry inferential weight for the paper’s H3 verdicts. Data Availability Statement The companion artefact for this paper, including the CONSTRUCT-MP implementation, the 8-block decompositions for the three case-study algebras, the Set N MR catalogue (§4.2.3: 36 MRs on MathSignalClass + ComplexSignal; ISSUE-009: 5 MRs on Apache Commons Math), the Set G GenMorph rerun output, the LLM-ensemble Set L harvest with token-cost logs, the PIT 1.7.4 mutation traces, and the per-block + D1/D2 aggregation pipeline, will be released as open-source upon acceptance of the paper. Reproduction scripts (setup.sh, run_all.sh, tests/run.sh) and the experiment-side CLAUDE.md collaboration record are bundled. Authoring repository and Zenodo DOI to be added in the camera-ready version. Acknowledgments This work was supported by the National Natural Science Foundation of China (NSFC) General Program (grant no. 12575176), the Hunan Provincial Education Department Project, China (grant no. 202502000728), the Research Project on Degree and Graduate Education Reform of the University of South China (grant no. 2023JG030), the Natural Science Foundation of Hunan Province, China (grant no. 2025JJ70193), and an industry-funded research project (grant no. 230KHX060001). Author contributions (CRediT). Meng Li: Conceptualization, Methodology, Software, Writing—original draft. Xiaohua Yang: Supervision, Formal analysis, Writing—review & editing. Jie Liu: Investigation, Validation. Shiyu Yan: Data curation, Visualization. Declaration of competing interest. The authors declare no conflict of interest. References [1] Tsong Yueh Chen, Shing Chi Cheung, and Siu Ming Yiu. Metamorphic testing: A new approach for generating next test cases. Technical Report HKUST-CS98-01, Department of Computer Science, Hong Kong University of Science and Technology, Hong Kong, 1998. [2] ISO/IEC/IEEE. ISO/IEC/IEEE 29119-1:2022 software and systems engineering — software testing — part 1: General concepts. International Standard, 2022. URL https://www.iso.org/standard/81291.html. [3] Sergio Segura, Gordon Fraser, Ana B. Sanchez, and Antonio Ruiz-Cortés. A survey on metamorphic testing. IEEE Transactions on Software Engineering, 42(9):805–824, 2016. doi: 10.1109/TSE.2016.2532875. [4] Rui Li, Huai Liu, Pak-Lok Poon, Dave Towey, Chang-Ai Sun, Zheng Zheng, Zhi Quan Zhou, and Tsong Yueh Chen. Metamorphic relation generation: State of the art and research directions. ACM Transactions on Software Engineering and Methodology, 2025. doi: 10.1145/3708521. [5] Congying Xu, Valerio Terragni, Hengcheng Zhu, Jiarong Wu, and Shing-Chi Cheung. MR-Scout: Automated synthesis of metamorphic relations from existing test cases. ACM Transactions on Software Engineering and Methodology, 2024. doi: 10.1145/3656340. arXiv:2304.07548. [6] Jon Ayerdi, Valerio Terragni, Gunel Jahangirova, Aitor Arrieta, and Paolo Tonella. GenMorph: Automatically generating metamorphic relations via genetic programming. IEEE Transactions on Software Engineering, 2024. doi: 10.1109/TSE.2024.3407840. arXiv:2312.15302.

ACM Trans. Softw. Eng. Methodol., Vol. 0, No. 0, Article 0. Publication date: 2026.

0:70

Meng Li, Xiaohua Yang, Jie Liu, and Shiyu Yan

[7] Seung Yeob Shin, Fabrizio Pastore, Domenico Bianculli, and Alexandra Baicoianu. Towards generating executable metamorphic relations using large language models. In Quality of Information and Communications Technology — 17th International Conference, QUATIC 2024, volume 2178 of Communications in Computer and Information Science. Springer, 2024. doi: 10.1007/978-3-031-70245-7_9. [8] Tsong Yueh Chen, Pak-Lok Poon, and Xiaoyuan Xie. METRIC: METamorphic relation identification based on the category-choice framework. Journal of Systems and Software, 116:177–190, 2016. doi: 10.1016/j.jss.2015.07.037. [9] Chang-Ai Sun, An Fu, Pak-Lok Poon, Xiaoyuan Xie, Huai Liu, and Tsong Yueh Chen. METRIC+: A metamorphic relation identification technique based on input plus output domains. IEEE Transactions on Software Engineering, 2021. doi: 10.1109/TSE.2019.2934848. [10] Christian Murphy, Gail E. Kaiser, Lifeng Hu, and Leon Wu. Properties of machine learning applications for use in metamorphic testing. In Proceedings of the 20th International Conference on Software Engineering and Knowledge Engineering (SEKE), pages 867–872, San Francisco, CA, USA, 2008. [11] Huai Liu, Fei-Ching Kuo, Dave Towey, and Tsong Yueh Chen. How effectively does metamorphic testing alleviate the oracle problem? IEEE Transactions on Software Engineering, 40(1):4–22, 2014. [12] Xiaoyuan Xie, Joshua W. K. Ho, Christian Murphy, Gail Kaiser, Baowen Xu, and Tsong Yueh Chen. Testing and validating machine learning classifiers by metamorphic testing. Journal of Systems and Software, 84(4):544–558, 2011. doi: 10.1016/j.jss.2010.11.920. [13] Prashanta Saha and Upulee Kanewala. Fault detection effectiveness of metamorphic relations developed for testing supervised classifiers. In Proceedings of the 1st IEEE International Conference on Artificial Intelligence Testing (AITest 2019), 2019. [14] Yifan Zhang, Dave Towey, and Matthew Pike. Automated metamorphic-relation generation with ChatGPT: An experience report. In Proceedings of the 2023 IEEE 47th Annual Computers, Software, and Applications Conference (COMPSAC), pages 1780–1785, 2023. doi: 10.1109/COMPSAC57700.2023.00275. [15] Yifan Zhang, Tsong Yueh Chen, Matthew Pike, Dave Towey, Zhihao Ying, and Zhi Quan Zhou. Enhancing autonomous driving simulations: A hybrid metamorphic testing framework with metamorphic relations generated by GPT. Information and Software Technology, 187:107828, 2025. doi: 10.1016/j.infsof.2025.107828. [16] Linfeng Liang, Chenkai Tan, Yao Deng, Yingfeng Cai, T. Y. Chen, and Xi Zheng. AutoMT: A multi-agent LLM framework for automated metamorphic testing of autonomous driving systems, 2025. [17] Kexin Pei, Yinzhi Cao, Junfeng Yang, and Suman Jana. DeepXplore: Automated whitebox testing of deep learning systems. In Proceedings of the 26th Symposium on Operating Systems Principles (SOSP 2017), pages 1–18, 2017. [18] Upulee Kanewala, James M. Bieman, and Asa Ben-Hur. Predicting metamorphic relations for testing scientific software: A machine learning approach using graph kernels. Software Testing, Verification and Reliability, 26(3):245–269, 2016. [19] Agustín Nolasco, Facundo Molina, Renzo Degiovanni, Alessandra Gorla, Diego Garbervetsky, Mike Papadakis, Sebastián Uchitel, Nazareno Aguirre, and Marcelo F. Frias. Abstraction-aware inference of metamorphic relations. In Proceedings of the ACM on Software Engineering (FSE 2024), 2024. doi: 10.1145/3643747. [20] Qiuming Tao, Wei Wu, Chen Zhao, and Wuwei Shen. An automatic testing approach for compiler based on metamorphic testing technique. In Proceedings of the 17th Asia Pacific Software Engineering Conference (APSEC 2010), pages 270–279, 2010. [21] Zhihao Ying, Dave Towey, Anthony Bellotti, Caslon Chua, and Zhi Quan Zhou. Metamorphic relation patterns for metamorphic testing, exploration and robustness. Software Testing, Verification and Reliability, 35(2), 2025. doi: 10. 1002/stvr.70003. [22] Emran Altamimi, Abdullah Elkawakjy, and Cagatay Catal. Metamorphic relation automation: Rationale, challenges, and solution directions. Journal of Software: Evolution and Process, 35(1), 2022. doi: 10.1002/smr.2509. [23] George I. Bell and Samuel Glasstone. Nuclear Reactor Theory. Van Nostrand Reinhold, New York, 1970. ISBN 0-44220684-4. [24] Elmer E. Lewis and Jr. Miller, Warren F. Computational Methods of Neutron Transport. Wiley-Interscience and American Nuclear Society, La Grange Park, IL, 1993. ISBN 0-471-09245-2. [25] Zhi Quan Zhou, Liqun Sun, Tsong Yueh Chen, and Dave Towey. Metamorphic relations for enhancing system understanding and use. IEEE Transactions on Software Engineering, 46(10):1120–1154, 2020. doi: 10.1109/TSE.2018.2876433. [26] Shuxian Wang, Sicheng Pan, and Alvin Cheung. QED: A powerful query equivalence decider for SQL. Proceedings of the VLDB Endowment, 2024. doi: 10.14778/3681954.3682024. [27] Qi Zhou, Joy Arulraj, Shamkant B. Navathe, William Harris, and Jinpeng Wu. SPES: A symbolic approach to proving query equivalence under bag semantics. In Proceedings of the IEEE 38th International Conference on Data Engineering (ICDE 2022), 2022.

ACM Trans. Softw. Eng. Methodol., Vol. 0, No. 0, Article 0. Publication date: 2026.

NOETHER: A Constructive Framework for Metamorphic Pattern Discovery from Operator Algebras

0:71

[28] Emmy Noether. Invariante variationsprobleme. Nachrichten von der Gesellschaft der Wissenschaften zu Göttingen, Mathematisch-Physikalische Klasse, 1918:235–257, 1918. English translation by M. A. Tavel, “Invariant Variation Problems”, Transport Theory and Statistical Physics, vol. 1, no. 3, pp. 186–207, 1971; DOI: 10.1080/00411457108231446. Open-access reprint at https://arxiv.org/abs/physics/0503066. [29] Rudi J. J. Stamm’ler and Maximo J. Abbate. Methods of Steady-State Reactor Physics in Nuclear Design. Academic Press, London, 1983. ISBN 0-12-663320-7. [30] Taco S. Cohen and Max Welling. Group equivariant convolutional networks. In Proceedings of the 33rd International Conference on Machine Learning (ICML), volume 48 of Proceedings of Machine Learning Research, pages 2990–2999, 2016. URL http://proceedings.mlr.press/v48/cohenc16.html. arXiv:1602.07576. [31] Nathaniel Thomas, Tess Smidt, Steven Kearnes, Lusann Yang, Li Li, Kai Kohlhoff, and Patrick Riley. Tensor field networks: Rotation- and translation-equivariant neural networks for 3D point clouds, 2018. [32] Risi Kondor and Shubhendu Trivedi. On the generalization of equivariance and convolution in neural networks to the action of compact groups. In Proceedings of the 35th International Conference on Machine Learning (ICML 2018), pages 2747–2755. PMLR, 2018. [33] Michael M. Bronstein, Joan Bruna, Taco Cohen, and Petar Veličković. Geometric deep learning: Grids, groups, graphs, geodesics, and gauges, 2021. [34] Víctor Garcia Satorras, Emiel Hoogeboom, and Max Welling. E(n) equivariant graph neural networks. In Proceedings of the 38th International Conference on Machine Learning (ICML 2021), pages 9323–9332. PMLR, 2021. [35] Fabian B. Fuchs, Daniel E. Worrall, Volker Fischer, and Max Welling. SE(3)-transformers: 3D roto-translation equivariant attention networks. In Advances in Neural Information Processing Systems 33 (NeurIPS 2020), 2020. [36] Aidan N. Gomez, Mengye Ren, Raquel Urtasun, and Roger B. Grosse. The reversible residual network: Backpropagation without storing activations. In Advances in Neural Information Processing Systems 30 (NeurIPS 2017), 2017. [37] Taco S. Cohen, Maurice Weiler, Berkay Kicanaoglu, and Max Welling. Gauge equivariant convolutional networks and the icosahedral CNN. In Proceedings of the 36th International Conference on Machine Learning (ICML 2019), volume 97 of Proceedings of Machine Learning Research, pages 1321–1330, 2019. arXiv:1902.04615. [38] Tianqi Chen, Emily Fox, and Carlos Guestrin. Stochastic gradient Hamiltonian Monte Carlo. Proceedings of the 31st International Conference on Machine Learning (ICML 2014), pages 1683–1691, 2014. [39] Volker Markl. Making learned query optimization practical. ACM SIGMOD Record, 2022. [40] Donald R. Slutz. Massive stochastic testing of SQL. In Proceedings of the 24th International Conference on Very Large Data Bases (VLDB 1998), pages 618–622, 1998. [41] Hardik Bati, Leo Giakoumakis, Steve Herbert, and Aleksandras Surna. A genetic approach for random testing of database systems. In Proceedings of the 33rd International Conference on Very Large Data Bases (VLDB 2007), pages 1243–1251, 2007. [42] Sergio Segura, Juan Carlos Alonso, Alberto Martín-López, Amador Durán, Javier Troya, and Antonio Ruiz-Cortés. Automated generation of metamorphic relations for query-based systems. In Proceedings of the 7th International Workshop on Metamorphic Testing (MET 2022), 2022. doi: 10.1145/3524846.3527338. [43] Mudathir Mohamed, Andrew Reynolds, Cesare Tinelli, and Clark Barrett. Verifying SQL queries using theories of tables and relations. arXiv:2405.03057, 2024. [44] Jinsheng Ba and Manuel Rigger. Keep it simple: Testing databases via differential query plans. Proceedings of the ACM on Management of Data (SIGMOD 2024), 2024. [45] Ying Fu, Zhiyong Wu, Yuanliang Zhang, Jie Liang, Jingzhou Fu, Yu Jiang, Shanshan Li, and Xiangke Liao. Thanos: DBMS bug detection via storage engine rotation based differential testing. In Proceedings of the 47th IEEE/ACM International Conference on Software Engineering (ICSE 2025), pages 655–666. IEEE, 2025. doi: 10.1109/ICSE55347.2025. 00257. [46] Suyang Zhong and Manuel Rigger. Scaling automated database system testing. arXiv:2503.21424, 2025. [47] U.S. Nuclear Regulatory Commission. Assumptions used for evaluating a control rod ejection accident for pressurized water reactors. Regulatory Guide 1.77, Revision 1, 2020. [48] Weston M. Stacey. Nuclear Reactor Physics. Wiley-VCH, Weinheim, Germany, second edition, 2007. ISBN 978-3-52740679-1. [49] John R. Lamarsh and Anthony J. Baratta. Introduction to Nuclear Engineering. Prentice Hall, Upper Saddle River, NJ, third edition, 2001. ISBN 0-201-82498-1. [50] U.S. Nuclear Regulatory Commission. General design criteria for nuclear power plants. 10 CFR Part 50, Appendix A, General Design Criterion 11 (Reactor Inherent Protection), 2024. Code of Federal Regulations, Title 10, Part 50, Appendix A. [51] American Nuclear Society. Reload startup physics tests for pressurized water reactors. ANSI/ANS-19.6.1-2011 (R2016), 2011.

ACM Trans. Softw. Eng. Methodol., Vol. 0, No. 0, Article 0. Publication date: 2026.

0:72

Meng Li, Xiaohua Yang, Jie Liu, and Shiyu Yan

[52] Congyue Deng, Or Litany, Yueqi Duan, Adrien Poulenard, Andrea Tagliasacchi, and Leonidas J. Guibas. Vector neurons: A general framework for SO(3)-equivariant networks. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV 2021), 2021. [53] Nargiz Humbatova, Gunel Jahangirova, and Paolo Tonella. DeepCrime: Mutation testing of deep learning systems based on real faults. In Proceedings of the 30th ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA 2021), pages 67–78, 2021. [54] Mario Geiger, Tess Smidt, et al. e3nn: Euclidean neural networks. Software repository, https://github.com/e3nn/e3nn, 2022. Reference SE(3)-equivariant library. [55] Matthias Fey and Jan E. Lenssen. Fast graph representation learning with PyTorch Geometric. In ICLR Workshop on Representation Learning on Graphs and Manifolds, 2019. [56] Henry Coles, Thomas Laurent, Christopher Henard, Mike Papadakis, and Anthony Ventresque. PIT: A practical mutation testing tool for Java. In Proceedings of the 25th International Symposium on Software Testing and Analysis (ISSTA 2016), pages 449–452. ACM, 2016. doi: 10.1145/2931037.2948707. [57] Claes Wohlin, Per Runeson, Martin Höst, Magnus C. Ohlsson, Björn Regnell, and Anders Wesslén. Experimentation in Software Engineering. Springer, second edition, 2012. [58] Nicholas J. Higham. Accuracy and Stability of Numerical Algorithms. Society for Industrial and Applied Mathematics (SIAM), Philadelphia, second edition, 2002.

ACM Trans. Softw. Eng. Methodol., Vol. 0, No. 0, Article 0. Publication date: 2026.

Related documents

• Two's a Crowd: Human and AI-Based Copresence for Developers with ADHD#1006931
• License Compliance in Open Source Cybersecurity Projects#1006932
• Embedding Drift in Code Vulnerability Models Under Intended Behaviour-Preserving Transformations#1006933
• SWE-Proof: Can Language Models Resolve Real-World Issues with Machine-Checked Proofs?#1006934
• Helpful but Fallible: Developer Experiences of AI Tools Under a Coordinated Industrial Roll-out#1006935