Every production serving stack that compresses state under load is spending quality it cannot account for. A paper published August 16 by Fanzhe Wei and Li Liu (arXiv 2608.15810) quantifies the accounting gap, proposes a replacement, and validates it against 352,333 live admission calls.
The failure mode is specific. Existing certified admission controllers budget request-level risk using a union bound over a pre-declared event count. On long requests in production, the union budget exhausts on 100% of traffic. Every long request blows the bound. The system auto-degrades precision on load signals while the risk ledger declares bankruptcy on the first long call of the session. Engineers know quality is dropping but have no sound way to quantify it.
The replacement is an anytime-valid ledger: a physically accounted bound that holds at every admission decision, not just in expectation over a pre-counted horizon. In the held-out confirmatory round, switching to the new ledger halves the exact-fallback rate at matched risk — 0.30 drops to 0.14. Fallback rate is the fraction of requests the system must route to the exact path because it cannot certify the compressed path meets the quality target. Halving fallback means fewer expensive calls at the same risk tolerance.
| Metric | Union-Bound Ledger (baseline) | Anytime-Valid Ledger (new) |
|---|---|---|
| Exact-fallback rate | 0.30 | 0.14 |
| Relative fallback reduction | — | ~53 % |
| Risk tolerance | matched | matched |
| Live admission calls validated | 352,333 | 352,333 |
Certification at admission is one third of the problem. The paper then prices the gap between what the certified witness guarantees and what the user receives. A machine-checked design law, TV ≤ tanh(a_q · w_thr), converts the served total-variation target directly into a threshold knob—one number an operator can read and set. A three-layer audit traces the slack: the operator-norm query envelope sits 1.5× from tight; a measured-ellipsoid replacement for the Cauchy-Schwarz ball recovers 0.89× (held-out sound, meaning it tightens the bound in production); the gate's operating point contributes the bulk of remaining looseness at roughly 700×. The entire 1064× gap between certified bound and observed behavior is now localized and stated explicitly rather than left unknown.
| Audit Layer | Factor | Direction | Notes |
|---|---|---|---|
| Operator-norm query envelope | 1.5× | Loose | Distance from tight bound |
| Measured-ellipsoid vs. Cauchy-Schwarz ball | 0.89× | Tightens | Held-out sound; replaces Cauchy-Schwarz |
| Gate operating point | ~700× | Loose | Bulk of remaining looseness |
| Total certified-to-observed gap | 1064× | Now fully localized | Explicitly stated rather than unknown |
The third component addresses extrapolation: a certified bound on a request you have seen is worth little without guarantees on the next. The paper replaces binary conformal prediction—which issues vacuous certificates—with exchangeable extrapolation across 80 serving histories, producing order-statistic bounds that discriminate at calibration risk 0.41 versus 0.51 for the conformal baseline. All probabilistic kernels are formally verified in Lean 4: 228 exported theorems, zero `sorry` axioms.
| Method | Calibration Risk | Certificate Type | Serving Histories Used |
|---|---|---|---|
| Binary conformal prediction (baseline) | 0.51 | Vacuous (binary) | — |
| Exchangeable extrapolation (new) | 0.41 | Order-statistic bounds | 80 |
| Formal verification | — | Lean 4, 228 theorems, 0 sorry axioms | — |
One architectural decision buried in the abstract matters: the companion paper rejects certifying routing as the natural alternative. Serving teams pursuing certified routing to solve quality accounting are solving the wrong problem. The paper argues admission is where the guarantee must live, not routing.
For architects managing SLA trade-offs: if your stack auto-degrades precision under load and uses a union bound for risk accounting, that bound is exhausted on every long request in your queue. The anytime-valid ledger framework gives you a number you can actually spend—a fallback rate you can trade against risk tolerance, a gap you can read from a single law, and a bound that holds on unseen traffic.