feat(variation): validate Morris reports in TypeScript

AGENT_HANDOFF.md

@@ -3,6 +3,76 @@
 > **Update this file with every PR and every push to main.**
 > Last updated: 2026-08-12
 
+## 2026-08-12 Exact Morris serialized-clamp contract (#4142 R13.4)
+
+- The producer maps `sigma` and `mu*` standard error at or below
+  `64*epsilon*max(1,mu_star)` to exact zero. The consumer now rejects positive
+  values inside that interval; the prior `1e-14` perturbation allowance is
+  removed. Clamp uncertainty contributes to the squared identity only when the
+  corresponding serialized metric is exactly zero.
+- Identity arithmetic is normalized before squaring. Nonzero metrics receive
+  only ordinary scale-aware rounding allowance; huge finite values that cannot
+  be squared safely fail closed rather than producing `Infinity`/`NaN` that can
+  evade comparisons.
+- Cohesive numerical checks moved to `morrisMetricValidation.ts`, keeping the
+  primary strict parser below 400 lines. Tests retain normal `n=4`/`n=12` and
+  `10^6`-scale cases and add clamp-boundary and near-`1e308` adversarial cases.
+- Producer calculations, UI/export/execution, and UpstreamDrift remain open and
+  unchanged.
+
+## 2026-08-12 Morris clamp-scale tolerance correction (#4142 R13.4)
+
+- The earlier squared-space unit floor was too permissive near
+  `mu_star = abs(mu)` and zero standard error. The consumer now mirrors the
+  producer clamp exactly as `delta = 64*epsilon*max(1, mu_star)` and propagates
+  `2*abs(metric)*delta + delta^2` through `sigma^2`, `n*SE^2`, both mean-square
+  terms, and the `n/(n-1)` correction.
+- A metric-level degeneracy invariant rejects `sigma` above `delta` when the
+  mean-magnitude difference and standard error are within `delta`. Mutation
+  tests reject `sigma=1e-8`, accept a serializer-scale `1e-14` perturbation,
+  and pin realizable identities for `n=4`, `n=12`, and scale `10^6`.
+- No producer, UI, export, execution, or UpstreamDrift behavior changed.
+
+## 2026-08-12 Morris TypeScript review hardening (#4142 R13.4)
+
+- Review mutation tests now prove the four reported statistics are jointly
+  realizable for `valid_pairs`: for `n > 1`, the parser checks
+  `sigma^2 - n*SE^2 = n/(n-1)*(mu_star^2-mu^2)` with a documented tolerance
+  of 256 IEEE-754 epsilons scaled to the squared metrics.
+- Exact zero `mu_star` requires zero `mu`, `sigma`, and standard error plus
+  `constant-output`; exact zero `sigma` requires zero standard error and
+  `mu_star` equal to `abs(mu)` within that tolerance. An all-zero tuple labeled
+  `available` fails closed. Explicit insufficient estimates remain all-null and
+  bypass finite-metric algebra without weakening denominator/adequacy checks.
+- The parser accepts only ordinary or null-prototype records, rejects all C0
+  and C1 control characters, and uses nested source/target sets instead of a
+  delimiter-composite identity. Tests pin former NUL collisions, class/custom
+  prototypes, nested missing/excess fields, stable source/target provenance,
+  complete matrices, duplicate pairs, and deep immutability.
+- No Python producer behavior, UI/export/execution adapter, or UpstreamDrift
+  integration changes in this review fix. Later R13-R15 scope remains open.
+
+## 2026-08-12 Strict Morris TypeScript parity contract (#4142 R13.4)
+
+- Branch `codex/4142-morris-typescript-parity` fast-forwarded normally from
+  published parent exact head `f08494f3a2698ddd69f7452dfdb1e70765388ef8`;
+  no history, configured base, or parent branch was rewritten.
+- The Python report now emits stable schema identity
+  `swing-sim/morris-global-sensitivity-report` at `schema_version: 1` while
+  `morris-elementary-effects` remains the independent scientific method value.
+- A UI-neutral TypeScript parser consumes the golden fixture into immutable
+  typed source/target/effect/denominator objects. It rejects unknown fields,
+  coercive or non-finite values, unsupported vocabulary, broken source loci,
+  units/frames/bounds, invalid Morris seed/grid/sample provenance, duplicate or
+  inconsistent factors and estimate pairs, and invalid denominator cohorts.
+- Unavailable effects must be four JSON `null` values paired with
+  `insufficient-data`/`insufficient`; available and constant effects must be
+  finite. Typed no-impact totals retain their intentional overlap with valid
+  state outputs while unavailable misses, failures, and non-finite pairs remain
+  mutually exclusive denominator cohorts.
+- This slice deliberately does not add UI, export, simulation execution, or
+  UpstreamDrift wiring owned by later R13-R15 work and PR #4280.
+
 ## 2026-08-12 Bounded Morris global-sensitivity core (#4142 R13.2-R13.4)
 
 - Exact-head CI follow-up: the hosted changed-file MyPy gate exposed five

SPEC.md

@@ -26,8 +26,8 @@
 | **Owner**               | D-sorganization                            |
 | **Primary Language(s)** | Python 3.11+, Rust, JavaScript, TypeScript |
 | **License**             | MIT                                        |
-| **Current Version**     | 1.16.21                                    |
-| **Spec Version**        | 1.16.21                                    |
+| **Current Version**     | 1.16.25                                    |
+| **Spec Version**        | 1.16.25                                    |
 | **Last Spec Update**    | 2026-08-12                                 |
 
 ## 2. Purpose & Mission
@@ -2922,6 +2922,10 @@ Active development with stable core, continuous tool expansion, and web API in p
 
 | Date | Version | Changes |
 | ---- | ------- | ------- |
+| 2026-08-12 | 1.16.25 | fix(rate-of-closure, #4142 R13.4): mirror the Morris producer's serialized clamp exactly by requiring `sigma` and `mu*` standard error to be either zero or strictly above `64*epsilon*max(1,mu*)`; apply clamp uncertainty only to zero-valued squared terms, use scale-normalized identity arithmetic with ordinary floating tolerance for nonzero metrics, reject finite magnitudes that cannot be squared safely, and move cohesive metric validation to a dedicated bounded module. |
+| 2026-08-12 | 1.16.24 | fix(rate-of-closure, #4142 R13.4): replace the Morris squared-identity unit-floor tolerance with the Python producer's exact metric clamp `64*epsilon*max(1, mu*)`, propagate that delta through every squared statistic and `n/(n-1)` term, and add a clamp-scale degeneracy check so an impossible `sigma=1e-8` is rejected when `mu*=abs(mu)` and standard error is zero while serializer-scale perturbations near `1e-14` remain accepted; pin valid identities at `n=4`, `n=12`, and metric scale `10^6`. |
+| 2026-08-12 | 1.16.23 | fix(rate-of-closure, #4142 R13.4): harden the strict Morris report consumer to accept only plain/null-prototype records, reject C0/C1 controls and composite-identity ambiguity, require complete unique source-target matrices with stable provenance, and verify `mu`, `mu*`, `mu*` standard error, and `sigma` are jointly possible for the declared valid-pair count using the sample-moment identity and a bounded scale-aware tolerance of 256 IEEE-754 epsilons; require zero `mu*` to mean an exact all-zero `constant-output` estimate and enforce zero-sigma implications without weakening explicit null unavailable states. |
+| 2026-08-12 | 1.16.22 | feat(rate-of-closure, #4142 R13.4): add the strict UI-neutral TypeScript consumer for the Morris global-sensitivity report, give the cross-runtime wire contract the stable `swing-sim/morris-global-sensitivity-report` identity independent of its method vocabulary, and fail closed on unknown/malformed/non-finite payloads, grid/sample provenance errors, invalid units/frames/loci/bounds, unavailable-estimate encoding, typed availability/adequacy states, and denominator inconsistencies; retain UI/export/execution and UpstreamDrift integration as follow-up scope. |
 | 2026-08-12 | 1.16.21 | feat(swing-sim, #4142 R13.2-R13.4): add deterministic validated Morris elementary-effects design/analysis contracts with registered units and finite bounds, source-locus and downstream target attribution, canonical typed hit/no-impact/failure handling, per-output availability, total typed-miss plus unavailable-miss denominators, sample-adequacy and unavailable states, uncertainty/interaction caveats, exact design provenance, JSON-safe report serialization, and a versioned cross-runtime golden fixture; retain finite no-impact state metrics without fabricating impact/shot outputs, while deferring execution adapters, UI/export, and UpstreamDrift consumption. |
 | 2026-08-11 | 1.16.20 | merge(rate-of-closure, #4279 #4280): normally merge exact variation-export child `9b45bd5beca38370c1d541f8c488ef0edad08517` first with exact workspace/toolstrip parent `983805d799b76e5e1ad1dbdc7a5ab28957d805c8` second; preserve the configured base, variation export/continuation behavior, workspace/plot/toolstrip contracts, both append-only histories, and the explicit pre-manifest boundary. |
 | 2026-08-11 | 1.16.19 | merge(rate-of-closure, #4279 #4280): normally merge exact published variation-export child `e6c7460a01082631565fb9ed48aa32538bd7772c` first with exact reconciled workspace/toolstrip parent `89af587c8f4141680bb923fc4295e261829f5c75` second while preserving PR #4280's `feat/4218-toolstrip-workspace` base and both histories; retain variation export, selected-scatter parity, linked selection, accessible evidence, and workspace behavior while inheriting the parent's exact D-plane format-repair ancestry; preserve both append-only handoffs, use one new monotonic unique SPEC version, and keep publication, protected CI, review, unresolved-thread, dependency, and release gates open. |

docs/development/RATE_OF_CLOSURE_CAMPAIGN_HANDOFF.md

@@ -1,5 +1,62 @@
 # Rate of Closure Campaign Handoff
 
+## 2026-08-12 exact Morris serialized-clamp contract (#4142 R13.4)
+
+- Serialized `sigma` and `mu*` standard error are now accepted only as exact
+  zero or strictly above the producer's 64-epsilon clamp; positive values at or
+  below it fail closed.
+- Clamp uncertainty is propagated only for exact zero metrics. Nonzero metrics
+  use ordinary scaled rounding, the identity is normalized before squaring,
+  and huge finite values that cannot be squared safely are rejected.
+- Numerical validation moved into a bounded helper module; regression tests pin
+  normal counts/scales, clamp boundaries, and near-`1e308` input. Python
+  calculations and later UI/export/execution/UpstreamDrift scope are unchanged.
+
+## 2026-08-12 Morris clamp-scale tolerance correction (#4142 R13.4)
+
+- The strict consumer now derives tolerance from the producer's exact
+  `64*epsilon*max(1, mu_star)` metric clamp and propagates its squared error
+  through every term and sample-count multiplier in the Morris identity.
+- A complementary clamp-scale degeneracy invariant rejects impossible
+  `sigma=1e-8` near `mu*=abs(mu)`/zero standard error, while accepting only
+  serializer-scale perturbations near `1e-14`.
+- Tests pin the relationship at `n=4`, `n=12`, unit scale, and `10^6` scale.
+  Python output, UI/export/execution, and UpstreamDrift scope are unchanged.
+
+## 2026-08-12 Morris TypeScript review hardening (#4142 R13.4)
+
+- Finite estimates now satisfy the exact Morris sample-moment relationship
+  among `mu`, `mu*`, `mu*` standard error, `sigma`, and `valid_pairs`, allowing
+  only a documented 256-epsilon scale-aware IEEE-754 tolerance.
+- Zero `mu*` is exclusively an all-zero `constant-output` state; zero `sigma`
+  also requires zero standard error and `mu* = abs(mu)`. Unavailable estimates
+  remain explicitly all-null and retain their complete typed denominator.
+- Only plain/null-prototype objects cross the parser boundary. C0/C1 controls
+  are rejected and nested pair maps eliminate delimiter-composite collisions.
+  Tests also pin nested exact fields, deep freeze, stable repeated provenance,
+  duplicate rejection, and a complete source-by-target result matrix.
+- This is a strict-consumer review fix only. Python scientific calculations,
+  UI/export/execution adapters, UpstreamDrift consumption, and later R13-R15
+  acceptance/release work remain unchanged and open.
+
+## 2026-08-12 strict TypeScript Morris report parity (#4142 R13.4)
+
+- The report wire format now has stable identity
+  `swing-sim/morris-global-sensitivity-report`, integer version `1`, and a
+  separately validated `morris-elementary-effects` method value.
+- The TypeScript model layer consumes the shared Python golden report into
+  immutable typed data and rejects unknown fields, unsupported vocabularies,
+  non-finite/coercive values, broken availability/nullability relationships,
+  incomplete denominators, invalid grid/sample/seed provenance, and invalid
+  units, frames, point/time loci, or factor bounds.
+- Denominator validation preserves the scientific distinction that typed
+  no-impact pairs may still supply finite state metrics; unavailable misses,
+  failures, and ordinary non-finite pairs remain exclusive cohorts.
+- This branch normally retains published parent exact head
+  `f08494f3a2698ddd69f7452dfdb1e70765388ef8`. UI/export/execution adapters and
+  UpstreamDrift consumption remain explicit later R13-R15 work; #4142 is not
+  complete and PR #4280-owned presentation/export scope is untouched.
+
 ## 2026-08-12 bounded global-sensitivity analysis slice (#4142)
 
 - Exact-head CI repair adds explicit NumPy array/status annotations required by

src/rate_of_closure/AGENT_HANDOFF.md

@@ -3,6 +3,64 @@
 > **Update this file with every PR and every push to main.**
 > Last updated: 2026-08-12
 
+## 2026-08-12 Exact Morris serialized-clamp contract (#4142 R13.4)
+
+The consumer now matches the Python wire behavior exactly: `sigma` and `mu*`
+standard error must be zero or strictly above the producer's 64-epsilon clamp.
+Only exact serialized zeros receive propagated clamp uncertainty; nonzero
+metrics use ordinary scale-aware floating tolerance. The moment identity is
+evaluated after magnitude normalization, and un-squareable huge finite metrics
+fail closed. Numerical logic now lives in the focused
+`morrisMetricValidation.ts` module so the parser remains below 400 lines.
+Tests cover clamp boundaries, a valid zero-SE/nonzero-sigma case, normal sample
+counts/scales, and near-`1e308` adversarial input. Other scopes are unchanged.
+
+## 2026-08-12 Morris clamp-scale tolerance correction (#4142 R13.4)
+
+The squared moment check no longer uses a unit-floor tolerance. It derives the
+same metric delta as the Python producer (`64*epsilon*max(1, mu_star)`),
+propagates it through every squared statistic and sample-count coefficient, and
+adds a metric-level near-degenerate check. Therefore `sigma=1e-8` cannot hide
+behind cancellation when `mu*=abs(mu)` and standard error is zero, while a
+`1e-14` serializer-scale perturbation remains admissible. Tests cover valid
+`n=4`/`n=12` identities and a `10^6` metric scale. Other scopes are unchanged.
+
+## 2026-08-12 Morris TypeScript review hardening (#4142 R13.4)
+
+The strict consumer now rejects statistically impossible combinations of
+Morris `mu`, `mu*`, `mu*` standard error, and sample `sigma`. For finite
+estimates with `n = valid_pairs > 1`, it enforces the shared-second-moment
+identity with a bounded 256-epsilon scaled floating tolerance, plus explicit
+zero-`mu*`, zero-`sigma`, and constant-output implications. All-null
+`insufficient-data` estimates remain valid for zero/one usable pairs and do not
+enter finite-metric algebra.
+
+Parser records must have `Object.prototype` or a null prototype. C0/C1 control
+characters are prohibited, and source/target uniqueness uses nested maps rather
+than delimiter-concatenated IDs. Mutation tests cover prototype attacks, the
+former NUL collision, nested shape drift, incomplete/duplicate matrices,
+provenance disagreement, deep freeze, and metric-identity violations. UI,
+export, execution, Python calculations, and UpstreamDrift wiring are unchanged.
+
+## 2026-08-12 Strict Morris TypeScript parity contract (#4142 R13.4)
+
+The shared Morris report and its React-side consumer now use stable identity
+`swing-sim/morris-global-sensitivity-report` with independent integer version
+`1`; `morris-elementary-effects` remains the method rather than being
+overloaded as a schema identifier. The exact parent typing repair at
+`f08494f3a2698ddd69f7452dfdb1e70765388ef8` is retained normally.
+
+`web/src/model/morrisGlobalSensitivityContract.ts` parses the Python golden
+payload into frozen typed data. It fails closed for unknown fields, malformed
+or non-finite values, invalid availability/adequacy states, non-null unavailable
+effects, inconsistent complete denominators, bad Morris grid/sample/seed
+provenance, and invalid units, coordinate frames, points, time windows, or
+bounds. Finite no-impact state metrics remain valid while unavailable miss
+pairs retain a separate exclusive cohort.
+
+This remains a model-contract parity slice. It does not modify the React/PyQt6
+views, #4280 exports, simulation adapters, or UpstreamDrift consumption.
+
 ## 2026-08-12 Shared Morris screening foundation (#4142 R13.2-R13.4)
 
 Hosted exact-head MyPy identified five missing NumPy inference annotations.

src/rate_of_closure/web/src/model/__fixtures__/morris_global_sensitivity_golden_v1.json

@@ -1,4 +1,5 @@
 {
+  "schema_id": "swing-sim/morris-global-sensitivity-report",
   "schema_version": 1,
   "method": "morris-elementary-effects",
   "design": {