Transition Certification with Composite Indices: The Acceptance Gap Between Compensatory and Noncompensatory Rules

1. Introduction

1.1. Compensability as an Acceptance Question

Whenever decision-makers assess a sustainability transition, they face a familiar question: can strength in one area make up for failure in another? Multi-attribute value theory builds trade-offs into its value structure (Keeney and Raiffa, 1976). Outranking methods, by contrast, limit compensation through concordance and veto conditions (Roy, 1996; Vincke, 1992); work on sustainable development has also emphasized the incommensurability of some criteria (Martinez-Alier et al., 1998; Munda, 2005).

The same question appears in environmental assessment as the distinction between weak and strong sustainability. Weak sustainability represents substitution among forms of capital through an aggregate that must not decline (Boos, 2015; Neumayer, 2013; World Bank, 2011). Strong sustainability treats selected stocks as separately binding (Daly, 1990; Ekins et al., 2003). Research on the indicator theory of these positions is well developed, as is the analysis of compensability in the multi-criteria methods used for sustainability assessment (Cairns and Martinet, 2014; Cinelli et al., 2014; Doyen and Gajardo, 2020; Hanley et al., 1999; Martinet, 2011; Schär et al., 2025; Usubiaga-Liaño, 2025).

Much of this work classifies aggregation at a fixed profile of criterion values—a snapshot. This paper asks a different question, about transitions: when a plan unfolds over time under declared disturbances, and several criteria must hold along the entire path, when can a compensatory aggregate certify a transition that a noncompensatory assessment rejects? The question is not how weights should be chosen; methods for eliciting them are well developed (Becker et al., 2017; Nardo et al., 2008). Nor is it the familiar static limitation of weighted sums in recovering nonconvex parts of a Pareto front (Das and Dennis, 1997). The focus is acceptance semantics: the rule that classifies a composite reading of a transition as accepted or rejected—the sorting problem of decision aiding (Roy, 1996).

1.2. Two Acceptance Semantics

To see where the two assessments can diverge, imagine the transition problem at state z. It tracks typed-margin coordinates $s_i$, each expressed after a declared positive reference scale has been chosen so that zero is its binding floor, and has a finite menu $\mathcal{A}$ of plans and a declared disturbance set D. The weights act on these normalized coordinates; they do not turn unlike physical quantities into a conservation law. Both assessments impose the same physical safe and destination sets $S^{\mathrm{phys}}$ and $G^{\mathrm{phys}}$. Exact-tube semantics checks the entire path, not just its endpoint: for every $d\in D$, a plan’s full tube must remain in $S^{\mathrm{phys}}$, and its successor set must lie in $G^{\mathrm{phys}}$.

Now consider the floor test. Write $s\left(p\right)=(s_1\left(p\right),\dots ,s_n\left(p\right))$ for the typed-margin vector at state p. For each weight w in the full nonnegative cone $W_{+}={\mathbb{R}}_{+}^n\setminus \left\{0\right\}$, let $E_w\left(z\right)$ be the menu plans that meet those shared requirements and also keep $w·s\left(p\right)\ge 0$ at every tube state and every successor state, for every $d\in D$. Let $E_{\mathrm{typ}}\left(z\right)$ be the menu plans that meet the same physical, destination, and disturbance requirements but keep each typed floor $s_i\left(p\right)\ge 0$ at those same states. Thus the two assessments share physical feasibility, destination attainment, and disturbance coverage; only the test applied to the typed margins differs.

The key choice is simple: must one plan work for every weighting, or may each weighting have its own plan? Formally, the two acceptance rules differ only in the order of the quantifiers:

•  Common-plan acceptance: $\exists a\in \mathcal{A}\forall w\in W_{+}:a\in E_w\left(z\right)$. One plan must work for every weighting.
•  Weight-adaptive acceptance: $\forall w\in W_{+}\exists a_w\in \mathcal{A}:a_w\in E_w\left(z\right)$. For each weighting, some plan works; it may be a different one.

The first rule implies the second, but the converse need not hold. Because $W_{+}$ contains every coordinate weight, the full-cone identity is $E_{\mathrm{typ}}\left(z\right)={\bigcap }_{w\in W_{+}}{E}_w\left(z\right)$. Among plans meeting the shared requirements, a single plan passes every weight exactly when it satisfies each typed floor; equivalently, common-plan acceptance is $\exists a\in E_{\mathrm{typ}}\left(z\right)$. The gap, when it occurs, comes from the weight-adaptive rule’s ability to use different plans for different weights. This quantifier gap can occur even for static alternative margin vectors; here the tubes and disturbances supply its transition-assessment setting. Table 1 places these two rules among the four protocols considered in the paper.

An analogous split appears in adjustable robust optimisation: a here-and-now decision is fixed before the relevant parameter is known, while a wait-and-see decision may depend on it. Here the assessment weight plays the role of that parameter (Ben-Tal et al., 2004). This is an analogy for the order of the acceptance rule, not a claim about how real auditors or policymakers behave. The result concerns a certification protocol applied to a composite index, not the suitability of composite indices as descriptive summaries.

The witness makes the split concrete. fast risks the first floor, slow the second. staged protects both only when the reserve covers its bridge; no-switch misses the destination. At the action-indexed canonical point $(x,s_1,s_2)=(\frac{1}{2},\frac{6}{5},\frac{6}{5})$, $s_1+s_2=\frac{12}{5}\ge 2$, so every $w\in W_{+}$ licenses fast or slow, yet none of the four plans is typed-admissible. This verdict is specific to the stated menu and disturbance class.

1.3. Contributions

The paper makes five contributions, stated in the order of the text.

(i)

 Localisation and hierarchy (Section 3). On the full cone the typed operator is exactly the common-plan intersection, $E_{\mathrm{typ}}\left(z\right)={\bigcap }_{w\in W_{+}}{E}_w\left(z\right)$, and at any fixed trajectory the aggregate is lossless (Lemma 2); the chain typed ⊆ scalarized ⊆ physical ⊆ endpoint holds for every weight, and restricting a nonempty weight family can only enlarge the compensatory accepted set (Propositions 1–2). The quantifier separation itself is a plan-selection phenomenon and can occur for static alternatives; the finite-horizon paths specify how the margins are generated in the transition application.

(ii)

 A finite-menu geometric characterisation (Theorem 1). Under the explicit margin-first hypothesis $m_a\left(w\right)=w·d_a$, weight-adaptive acceptance is $\mathrm{conv}\left(\mathcal{D}\right)+{\mathbb{R}}_{+}^n$ and common-plan acceptance is ${\bigcup }_a(d_a+{\mathbb{R}}_{+}^n)$. Convexifying required-margin vectors closes this abstract gap; physical convexification of controls is a separate implementability assumption. Lemma 3 identifies when the margin-first path requirement agrees exactly with scalarizing after the within-path maximum.

(iii)

 An explicit rational witness (Theorem 2). On a four-plan datum the gap is a region with nonempty interior, equal to the impossibility region I; the aggregate-versus-floor discrepancy region splits at the reserve level $x=1$ into I and a rescue setR that a reserve-financed staged plan already serves; exact thresholds ${\rho }_1=(2-s_1)/s_2$ and ${\rho }_2=s_1/(2-s_2)$ locate the licensing regions of the two principal plans, with coordinate-axis weights classified separately; and the minimal reserve increment that converts impossibility into rescue is ${\kappa }^{*}\left(z\right)=(1-x)\mathbf{1}[z\notin {\mathcal{V}}_{\mathrm{typ}}]$ (Proposition 5). The separation persists under hold-prefix extension of the horizon; a separate two-stage construction shows one way a repair stage can erase it by enlarging the next-stage accepted sets while retaining the same final terminal rules (Proposition 3). The quantifier gap is sufficient but not necessary for false acceptance: at the canonical point $(x,s_1,s_2)=(1/2,6/5,6/5)$ the single fixed weight $(1,1)$ already accepts a primitive plan, because $12/5\ge 2$, while no primitive plan meets both typed floors (Remark 1).

(iv)

 What closes the gap and what does not (Theorem 3, Proposition 4). Fractional blending of the primitive plans – menu convexification at the level of control flows – makes the typed accepted set of the action-indexed margin class coincide exactly with the compensatory region, so that gap is a property of the finite deterministic menu, not of either doctrine. The statement is class-specific: under the shared-shock class the blend window is empty at the canonical point ($12/5<5/2$), so blending does not close that gap (Proposition 6). The complete-excursion result is conditional on a policy whose visited set is the union of both full primitive tubes; it does not characterize ordinary finite-rate switching. A distinct three-switch implementation keeps both canonical margins positive, so no general failure of finite switching is claimed.

(v)

 Robustness of the separation to the aggregator and to the disturbance class (Theorem 4, Proposition 6). Replacing the linear index by a constant-elasticity-of-substitution (CES) aggregator with elasticity $\sigma$ changes the gap but does not remove it: the accepted rungs are nested, on the witness-defined diagonal gap slice, each positive-elasticity member falsely certifies an exact interval with critical floors $1<5/4<\sqrt{2}<\phi <\sqrt{3}<\dots \to 2$; therefore no positive elasticity is uniformly safe over the full gap, while the Leontief member ($\sigma =0$), which is the typed operator, is uniformly safe. Under a shared environmental shock striking every plan the gap survives, reduced by an exact $1/2$-cut, with the licensing thresholds unshifted on the surviving region; the reserve route then fails on an exact band of states.

The analytic results are proved in Appendices Appendix A–Appendix B and SI S2–S4. Finite checks support only the enumerated cases and do not establish continuum claims. The Lean formalization covers selected algebraic witness identities and CES rungs; the broader real-exponent, continuity, and topological arguments are supported by the written proofs, not claimed as machine-checked. Section 5 gives a synthetic Schaefer-style biomass illustration with an optional historical scale mapping, not an empirically calibrated fishery realization.

 What is not claimed. No ranking of weak and strong sustainability as doctrines; no proof that any particular set of boundaries ought to be treated noncompensatorily; no empirical fit, forecast, validation, or performance result for a resource system (published DFO values are a limited scale/context anchor only); no infinite-horizon, stochastic or partially observed extension. The impossibility region is a negative certificate relative to the specified plan menu, and the separation is exhibited for a declared disturbance class.

1.4. Position in the Literature

The backward constructions used here are typed instances of robust-predecessor, capture-basin and reach–avoid constructions (Aubin and Catté, 2002; Aubin et al., 2011; Aubin, 1991; Lygeros et al., 1999; Saint-Pierre, 1994); the hierarchy of Proposition 1(i) is constraint-set monotonicity of viability kernels (Aubin, 1991; Frankowska, 1989); viability methods are established in natural-resource management (De Lara and Doyen, 2008; Doyen et al., 2012). The plan/weight quantifier order is analogous to here-and-now versus wait-and-see decisions, but the assessment weight is not a realized disturbance and fractional physical control is not a randomization over plans. In composite-indicator practice the critique of weights as value judgements presented as measurement (Fischer et al., 2022; Hickel, 2020) and the construction of indices without weights from Pareto fronts (Gao et al., 2023) both concern the index; the result here concerns acceptance under a declared menu and rule. We do not assert priority over the elementary fact $\exists a\forall w\ne \forall w\exists a_w$, nor over the convex-hull geometry of multi-objective optimisation; Section 6 states how those shared ingredients differ from the transition-certification question addressed here.

2. Setting: Typed Transition Data and Assessment Operators

2.1. Typed Transition Data and Exact-Tube Semantics

A typed transition datum consists of a state space Z whose coordinates carry types (a conserved stock with a unit, a service margin, an institutional label), a finite menu$\mathcal{A}$ of plans, a disturbance classD, and, for each plan a and disturbance d, a tube$\mathrm{Tube}(a,d)\subseteq Z$ – the full set of states visited during one review interval – together with its endpoint set$\mathrm{End}(a,d)\subseteq \mathrm{Tube}(a,d)$ and its successor set$\mathrm{Succ}(a,d)$, the states reached after any end-of-interval reset. Among the coordinates are ntyped floors$s=(s_1,\dots ,s_n)$. Each raw margin $m_i$ is divided by a declared positive reference scale $q_i$, so $s_i=m_i/q_i$ is dimensionless and $s_i\ge 0$ is the binding constraint; each floor retains its provenance (physical, contractual or normative). Typing records which quantities may be added: conservation statements are per type, and the framework does not itself authorize adding biomass, money and biodiversity into one conserved scalar. The weights act on these normalized coordinates as an assessment convention, not as a physical identity or automatic calibration.

Two constraint sets complete the datum: a physical safe set $S^{\mathrm{phys}}$ and a physical destination set$G^{\mathrm{phys}}$, which encode constraints that no assessment doctrine disputes (for instance that a reserve stock cannot be negative). The typed sets add the floors,

$$S=S^{\mathrm{phys}}\cap \{s_i\ge 0,i=1,\dots ,n\},G=G^{\mathrm{phys}}\cap \{s\ge 0\},$$

and the scalarized sets at a weight w add only the aggregate floor,

$$S^w=S^{\mathrm{phys}}\cap \{w·s\ge 0\},G^w=G^{\mathrm{phys}}\cap \{w·s\ge 0\}.$$

Throughout, w ranges over the full nonnegative cone $W_{+}={\mathbb{R}}_{+}^n\setminus \left\{0\right\}$ unless a subfamily $W\subseteq W_{+}$ is named. The semantics is exact-tube: a plan is admissible only if every visited state, not merely the endpoint, lies in the relevant safe set. The disturbance quantifier is always innermost – admissibility requires safety for every $d\in D$ – and the separation studied here concerns a second quantifier, over weights, placed outside it.

2.2. Assessment Operators

For a state z, four operators return the set of plans that an assessment doctrine accepts at z:

$$\begin{array}{cc}\hfill E_{\mathrm{typ}}\left(z\right)& =\{a:\forall d\in D,\mathrm{Tube}(a,d)\subseteq S,\mathrm{Succ}(a,d)\subseteq G\},\hfill \\ \hfill E_w\left(z\right)& =\{a:\forall d\in D,\mathrm{Tube}(a,d)\subseteq S^w,\hfill \end{array}$$

(1)

$$\begin{array}{cc}\hfill & \mathrm{Succ}(a,d)\subseteq G^w\},w\in W_{+},\hfill \\ \hfill E_{\mathrm{tube},\mathrm{phys}}\left(z\right)& =\{a:\forall d\in D,\mathrm{Tube}(a,d)\subseteq S^{\mathrm{phys}},\hfill \end{array}$$

(2)

$$\begin{array}{cc}\hfill & \mathrm{Succ}(a,d)\subseteq G^{\mathrm{phys}}\},\hfill \\ \hfill E_{\mathrm{end}}\left(z\right)& =\{a:\forall d\in D,\mathrm{End}(a,d)\subseteq S^{\mathrm{phys}},\hfill \end{array}$$

(3)

$$\begin{array}{cc}\hfill & \mathrm{Succ}(a,d)\subseteq G^{\mathrm{phys}}\}.\hfill \end{array}$$

(4)

$E_{\mathrm{typ}}$ is the noncompensatory typed operator (each floor separately binding along the path); $E_w$ the scalarized operator at weight w (the dashboard reading $w·s$ must stay nonnegative along the path); $E_{\mathrm{tube},\mathrm{phys}}$ the physical operator (no floors at all); and $E_{\mathrm{end}}$ the endpoint operator, which represents any assessment architecture that evaluates constraints only at sampled or audited endpoints. The two axes along which they differ – what is constrained and where it is evaluated – are set out in Table 2; the typed-endpoint operator $E_{\mathrm{end},\mathrm{typ}}$, which applies the floors at endpoints only, is the remaining cell and is used once, in Section 7.3.

2.3. Accepted-State Sets and the Central Inclusion

For any operator E write $\mathcal{V}\left[E\right]=\{z:E(z)\ne ⌀\}$ for its accepted-state set, the states at which the doctrine admits at least one plan. Thus ${\mathcal{V}}_{\mathrm{typ}}=\mathcal{V}\left[E_{\mathrm{typ}}\right]$, ${\mathcal{V}}_w=\mathcal{V}\left[E_w\right]$, ${\mathcal{V}}_{\mathrm{phys}}=\mathcal{V}\left[E_{\mathrm{tube},\mathrm{phys}}\right]$, ${\mathcal{V}}_{\mathrm{end}}=\mathcal{V}\left[E_{\mathrm{end}}\right]$, and the compensatory accepted set is the per-weight intersection

$${\mathcal{V}}_{\mathrm{weak}}=\bigcap _{w\in W_{+}}{\mathcal{V}}_w=\{z:\forall w\exists a_w\in E_w\left(z\right)\}.$$

(5)

The object of the paper is the inclusion

$$\underset{\mathrm{common}\mathrm{plan}}{\underbrace{\{z:{\bigcap }_w{E}_w\left(z\right)\ne ⌀\}}}\subseteq \underset{\mathrm{per}\mathrm{weight}={\mathcal{V}}_{\mathrm{weak}}}{\underbrace{{\bigcap }_w\{z:E_w\left(z\right)\ne ⌀\}}},$$

(6)

whose left-hand side will turn out to be exactly ${\mathcal{V}}_{\mathrm{typ}}$ (Proposition 1(ii)), and the set ${\mathrm{FP}}_{\mathrm{agg}}={\mathcal{V}}_{\mathrm{weak}}\setminus {\mathcal{V}}_{\mathrm{typ}}$ on which it is strict – the acceptance gap. Table 3 collects the symbols.

3. General Results: Localisation, Hierarchy and the Finite-Menu Geometry

3.1. Two Lemmas on Quantifier Order

The first lemma is the abstract form of the separation; the second identifies what aggregation can and cannot lose at a fixed trajectory. The plan-selection gap itself can already occur for static alternative margin vectors.

Lemma 1.

(quantifier inclusion). Let ${\left\{E_{\lambda }\left(z\right)\right\}}_{\lambda \in \mathsf{\Lambda }}$ be any family of plan sets. Then

$$\left\{z:{\bigcap }_{\lambda }{E}_{\lambda }\left(z\right)\ne ⌀\right\}\subseteq {\bigcap }_{\lambda }\left\{z:E_{\lambda }\left(z\right)\ne ⌀\right\},$$

 with equality exactly when, for every z in the right-hand set, the family ${\left\{E_{\lambda }\left(z\right)\right\}}_{\lambda }$ admits a common selector. No topology on the plan space is needed; for a finite menu the check is a finite enumeration.

Lemma 2.

(the full cone is lossless at a fixed trajectory). For $v\in {\mathbb{R}}^n$: $v\ge 0$ componentwise if and only if $w·v\ge 0$ for every $w\in W_{+}$.

Proofs are in Appendix A. Lemma 2 says that an assessor who checks the aggregate floor $w·s\ge 0$ at every nonnegative weighting, along a fixed trajectory, detects exactly the same violations as an assessor who checks each floor separately. Whatever separates the two doctrines must therefore enter through the quantifier over plans in (6), not through any blindness of scalarization at a profile.

3.2. Hierarchy, Localisation and Weight-Family Monotonicity

Proposition 1.

(hierarchy and localisation). (i) For every $w\in W_{+}$ and every z,

$$E_{\mathrm{typ}}\left(z\right)\subseteq E_w\left(z\right)\subseteq E_{\mathrm{tube},\mathrm{phys}}\left(z\right)\subseteq E_{\mathrm{end}}\left(z\right).$$

(ii) For every z, $E_{\mathrm{typ}}\left(z\right)={\bigcap }_{w\in W_{+}}{E}_w\left(z\right)$; hence ${\mathcal{V}}_{\mathrm{typ}}=\{z:{\bigcap }_w{E}_w\left(z\right)\ne ⌀\}$, and the central inclusion (6) reads ${\mathcal{V}}_{\mathrm{typ}}\subseteq {\mathcal{V}}_{\mathrm{weak}}$.

Part (i) is constraint-set monotonicity under nested safe sets, the standard monotonicity of viability kernels (Aubin, 1991; Frankowska, 1989). Part (ii) is the localisation that gives the paper its subject: the noncompensatory doctrine is common-plan robustness over the full cone (Protocols 3 and 4 of Table 1 coincide), so the only difference between the doctrines is the order of the two quantifiers.

Proposition 2.

(weight-family monotonicity). For a nonempty weight family $⌀\ne W\subseteq W_{+}$ let ${\mathcal{V}}_W={\bigcap }_{w\in W}{\mathcal{V}}_w$. Then ${\mathcal{V}}_{\mathrm{typ}}\subseteq {\mathcal{V}}_W\subseteq {\mathcal{V}}_{\mathrm{phys}}$, and $W_1\subseteq W_2$ with both families nonempty implies ${\mathcal{V}}_{W_2}\subseteq {\mathcal{V}}_{W_1}$.

Restricting a nonempty weight family – eliciting a narrower set of admissible weightings – can only enlarge the compensatory accepted set. The nonemptiness condition excludes the vacuous universal test over $W=⌀$, whose intersection would be the whole state space. The full cone is thus the strictest compensatory reading, and a separation exhibited at the full cone persists for every nonempty restricted family; the elicitation of weights, however careful, cannot remove it.

3.3. The Finite-Menu Geometric Characterisation

The mechanism behind the gap is geometric. Call a plan a margin-class plan if its coordinate-wise admissibility is governed by a required-margin vector $d_a\in {\mathbb{R}}_{+}^n$: plan a is admissible at floor margins $s\ge 0$ exactly when $d_a\le s$ componentwise, and it satisfies the destination constraint. A plan whose worst-case tube dips each floor i by at most $d_{a,i}$ and returns is of this class; plans whose admissibility depends on another resource (reserve-financed plans) or that fail the destination are handled separately, as on the witness of Section 4.

A margin vector summarises a path, and the summary must be taken in a declared order. Write $r_{a,i}\left(t\right)\ge 0$ for the deficit of plan a in coordinate i at time $t\in [0,1]$ along its worst-case tube (the amount by which the tube would breach a floor placed at the initial level), so that $d_{a,i}={\max }_t{r}_{a,i}\left(t\right)$.

Lemma 3.

(path-to-margin synchronisation). For continuous deficit paths and any fixed $w\ge 0$, the scalarized path requirement $m_a\left(w\right)={\max }_{t\in [0,1]}{\sum }_i{w}_i{r}_{a,i}\left(t\right)$ satisfies $m_a\left(w\right)\le w·d_a$, with equality if and only if a single time attains $d_{a,i}$ simultaneously for every coordinate with $w_i>0$.

Proof. 

Each summand is at most its own maximum, so ${\sum }_i{w}_i{r}_{a,i}\left(t\right)\le {\sum }_i{w}_i{d}_{a,i}$ for every t, which gives the inequality. At a maximiser $t^{*}$ of the continuous scalarized path, equality of the nonnegative weighted sum of these termwise inequalities forces equality in every positive-weight coordinate, i.e. $r_{a,i}\left(t^{*}\right)=d_{a,i}$ whenever $w_i>0$; conversely a common maximising time gives equality directly. □

The lemma fixes the scope of the geometry that follows. Theorem 1 describes the protocol whose scalarized requirement is $w·d_a$ – within-path maxima taken first, then weighted – exactly; for a protocol that scalarizes first and takes the within-path maximum afterwards it is conservative, the two coinciding precisely when the coordinate dips are synchronised. Neither reading may be substituted for the other without the synchronisation hypothesis. On the witness datum of Section 4 each principal plan dips a single coordinate, so the hypothesis holds trivially and the two protocols agree.

Theorem 1.

(finite-menu geometric characterisation). Let $\mathcal{A}$ be a finite menu of margin-class plans with required-margin vectors $\mathcal{D}=\{d_a:a\in \mathcal{A}\}\subset {\mathbb{R}}_{+}^n$. Assume explicitly that the scalarized requirement for each plan and weight is margin-first, $m_a\left(w\right)=w·d_a$; in an exact-tube model this holds, for example, when the coordinate deficits with positive weight attain their maxima at a common time. Then

(i)

 coordinate-wise acceptance is $\{s:\exists a,d_a\le s\}={\bigcup }_{a\in \mathcal{A}}(d_a+{\mathbb{R}}_{+}^n)$;

(ii)

 scalarized (weight-adaptive) acceptance is $\{s:\forall w\in W_{+}\exists a,w·d_a\le w·s\}=\mathrm{conv}\left(\mathcal{D}\right)+{\mathbb{R}}_{+}^n$.

 Hence the acceptance gap is $\left[\mathrm{conv}\left(\mathcal{D}\right)+{\mathbb{R}}_{+}^n\right]\setminus {\bigcup }_a(d_a+{\mathbb{R}}_{+}^n)$. Replacing the margin menu by $\mathrm{conv}\left(\mathcal{D}\right)$ makes the two abstract acceptance sets coincide. This is a convexification in required-margin space; a physical blend of controls is licensed only if the model separately shows that an admissible control realizes the corresponding margin vector.

The proof (Appendix A) is a separating-hyperplane argument; its content is displayed in Figure 1. Weight-adaptive acceptance of s means that s is not strictly separable from the up-closed convex hull of the required margins – for every weighting some plan’s margin is cheaper than s in that weighting – while coordinate-wise acceptance means that s dominates some margin outright. The two coincide exactly when the up-closure of $\mathcal{D}$ is already convex, in particular whenever one plan dominates all others or the margin menu is convexified. This convex-hull form is shared with scalarization results in multi-objective optimization, but the decision object here is state acceptance under a finite menu. In the witness, each principal plan dips a single coordinate, so the synchronization condition holds trivially and the exact-tube protocol agrees with the margin-first formula. In another tube, scalarizing before taking the path maximum can give a smaller requirement than $w·d_a$, so the convex-hull formula need not be exact. The physical blend in Theorem 3 is justified by the witness’s linear-flow assumption, not by the abstract theorem alone.

 Remark 1 (fixed-weight countermechanism).

The quantifier gap is sufficient for false acceptance but not necessary. On the witness datum at $s_1=s_2=6/5$ with reserve $x=1/2$, the single fixed weight $w=(1,1)$ already accepts a primitive plan, because its scalar margin meets $s_1+s_2=12/5\ge 2$, while no primitive plan meets both typed floors. Enlarging the weight family to the full cone makes the scalarized protocol stricter than any one nonempty subfamily (Proposition 2), but does not turn this point into a typed-safe one. The assertion concerns the stated action-indexed path/margin protocol of Lemma 3; it is not an identity between a scalarized and a componentwise minimum taken at different times.

4. An Explicit Witness: The Separation on a Rational Datum

4.1. The Witness Datum

Two architectures – extraction ($q=0$) and regeneration ($q=1$) – share one review interval $[0,1]$. The phase state is $(q,x,s_1,s_2)$: a physical reserve stock x (a bridge stock, for instance an adjustment fund) and two typed floors $s_1$ and $s_2$ normalised at zero (on the benchmark of Section 5: a biomass margin above a limit reference point and a fleet income margin). The transition-safe set is $S_0=\{x\ge 0,s_1\ge 0,s_2\ge 0\}$ and the destination set is $G=\left\{\right(1,x,s):x\ge 0,s\ge 0\}$, with destination maintainability witnessed by a hold policy. The reset adds the strictly positive gain $e=(\frac{1}{4},\frac{1}{4})$, placing successors in the interior of G. The rescue cost is $c=1$. Initial states are $X_0=\{(0,x,s):x\ge 0,s\ge 0\}$.

Four plans are available (Table 4), written as piecewise-linear maps on the breakpoints $\{0,\frac{1}{2},1\}$ and monotone on each piece, so that every tube is the exact visited set. The disturbance class is action-indexed: the adverse disturbance triggers the worst-case dip, of fixed depth 2, in the active plan’s characteristic coordinate ($s_1$ for fast, $s_2$ for slow); on the benchmark the depth 2 is a quota pulse of $3/2$ plus an environmental shock of $1/2$. The worst-case tube of fast is therefore $[s_1-2,s_1]$ in $s_1$ with $s_2$ and x constant, that of slow is symmetric, and that of staged is $[x-1,x]$ in x with both floors nondecreasing. A shared-shock class, in which the environmental component strikes every plan, is treated in Section 4.6.

 Role ofno-switch.no-switch is the status-quo, non-transition baseline: its successor keeps $q=0$ and therefore misses the destination set G. It remains in the four-action menu so that this failure is explicit; fast, slow and staged are the candidate transition plans.

The datum is deliberately spare. Its margin-class plans are fast and slow, with $\mathcal{D}=\left\{\right(2,0),(0,2\left)\right\}$, so Theorem 1 predicts the gap $\{s_1+s_2\ge 2\}\setminus (\{s_1\ge 2\}\cup \{s_2\ge 2\})$ among them; staged lies outside the margin class, because its admissibility is governed by the reserve rather than by the floors, and it is what splits the predicted gap into a rescuable and an impossible part.

4.2. The Witnessed Separation

Theorem 2.

(witnessed separation). On the witness datum, over $X_0$:

(i)

 ${\mathcal{V}}_{\mathrm{typ}}=\{x\ge 1\}\cup \{s_1\ge 2\}\cup \{s_2\ge 2\}$.

(ii)

 ${\mathcal{V}}_{\mathrm{weak}}={\bigcap }_{w\in W_{+}}{\mathcal{V}}_w=\{x\ge 1\}\cup \{s_1+s_2\ge 2\}$.

(iii)

 ${\mathcal{V}}_{\mathrm{phys}}={\mathcal{V}}_{\mathrm{end}}=X_0$.

 Define thediscrepancy region $\mathcal{Q}=\{s_1<2,s_2<2,s_1+s_2\ge 2\}$ (x unrestricted), therescue set $R=\mathcal{Q}\cap \{x\ge 1\}$ and theimpossibility region $I=\mathcal{Q}\cap \{x<1\}$. Then:

(i)

 ${\mathrm{FP}}_{\mathrm{agg}}={\mathcal{V}}_{\mathrm{weak}}\setminus {\mathcal{V}}_{\mathrm{typ}}=I$. The acceptance gap is exactly the impossibility region; it is nonempty, with relative interior $\{0<x<1,0<s_1<2,0<s_2<2,s_1+s_2>2\}$ in the $q=0$ slice. The rescue set R lies in ${\mathcal{V}}_{\mathrm{typ}}$, not in the gap.

(ii)

 Both hierarchy inclusions are strict: every point of I lies in ${\mathcal{V}}_{\mathrm{weak}}\setminus {\mathcal{V}}_{\mathrm{typ}}$, and $(x,s_1,s_2)=(\frac{1}{2},\frac{1}{10},\frac{1}{10})$ lies in ${\mathcal{V}}_{\mathrm{phys}}\setminus {\mathcal{V}}_{\mathrm{weak}}$.

(iii)

(Per-weight plan disagreement.) On the relative interior of $\mathcal{Q}$ ($0<s_2<2$), for weights with $w_1>0$ put $r=w_2/w_1$. Thenfast is licensed exactly for $r\ge {\rho }_1$ andslow exactly for $r\le {\rho }_2$, where

$${\rho }_1={\displaystyle \frac{2-s_1}{s_2}},{\rho }_2={\displaystyle \frac{s_1}{2-s_2}},{\rho }_2\ge {\rho }_1\iff s_1+s_2\ge 2.$$

 Among the two principal plans, $r>{\rho }_2$ licensesfast  but notslow  , $r<{\rho }_1$ licensesslow  but notfast  , and both are licensed for ${\rho }_1\le r\le {\rho }_2$. The axis weights are covered separately: $(1,0)$ licensesslow  but notfast  , while $(0,1)$ licensesfast  but notslow  , among those two plans. On I no single plan serves every weight: ${\bigcap }_w{E}_w\left(z\right)=E_{\mathrm{typ}}\left(z\right)=⌀$. On R,staged  is typed-admissible and serves every weight.

(iv)

(The rescue split.) R is typed-transformable, witnessed bystaged : bridging at cost $c=1$ keeps both floors intact and lands in G. I is aggregate-feasible for every cone weight yet admits no typed-admissible plan, with four exhibited violations:fast breaches the $s_1$ floor under its adverse disturbance,slow the $s_2$ floor,staged drives x negative, andno-switch misses G.

The proof is in Appendix B; the formulas for ${\rho }_1,{\rho }_2$ require $0<s_2<2$, and the ratio is used for $w_1>0$; the two coordinate-axis weights are classified directly in part (6). On boundary faces in the state coordinates, the classification follows from the closed-set identities (1)–(2). Table 5 records the two verdicts region by region, and Figure 2 and Figure 3 display them.

 The witness point. At $(x,s_1,s_2)=(\frac{1}{2},\frac{6}{5},\frac{6}{5})$, the aggregate passes ($\frac{12}{5}\ge 2$) but no menu plan is typed-admissible. The thresholds $({\rho }_1,{\rho }_2)=(\frac{2}{3},\frac{3}{2})$ give slow-only, both, and fast-only licensing at $r=\frac{1}{2},1,2$, respectively. At $x=1$, staged rescues the same floors.

 Reading. The compensatory assessment’s binding condition is a total budget, $s_1+s_2\ge 2$; the noncompensatory assessment requires either one floor to survive its own worst-case dip ($s_i\ge 2$) or the reserve to cover the rescue cost ($x\ge 1$). Between the two conditions the compensatory doctrine certifies – per weight, with weight-dependent plans – transitions the noncompensatory doctrine rejects, and the aggregate reading cannot tell I from R: the two differ only in x, which the index does not see. Part (7) is a negative certificate in the sense of a rejection with an exhibited violated constraint for each plan, exhausting the menu; it is a complete verdict relative to the menu, not an inconclusive one.

4.3. Persistence Under Horizon Extension, and Its Limit

Is the one-interval separation an artefact of the one-interval framing? Two results delimit the answer.

Proposition 3.

(persistence and erasure). (i) Extend the witness datum to $m\ge 2$ review intervals by prepending hold intervals, with sole prefix actionhold (tube $\left\{z\right\}$, successor $\left\{z\right\}$, safe set $S_0$) available at every prefix state, unchanged terminal and successor architecture, and no additional reset or disturbance branches. Then for every stage j, ${\mathcal{V}}_j^{\mathrm{typ}}\subseteq {\bigcap }_w{\mathcal{V}}_j^w\subseteq {\mathcal{V}}_j^{\mathrm{phys}}$, the stage-0 accepted regions are the witness regions pulled back through the holds, and both strictness witnesses of Theorem 2(5) persist.(ii) Persistence is architecture-conditional: there is a two-interval datum whose single-interval truncation exhibits an acceptance gap and whose two-stage extension erases it. The same final typed and scalarized terminal rules are used in both versions; in the extension, a repair stage enlarges the stage-1 successor accepted sets to the whole state space, while the stage-1 tubes themselves remain safe.

The erasure datum of (ii) (SI S2.2) has two floors, no reserve, and a first stage with two actions that transfer one unit from one floor to the other. At $(2/5,2/5)$, the one-stage version is weak-accepted for every weight (the actions are licensed for $r\ge 3/7$ and $r\le 7/3$) but typed-rejected. In the two-stage version the first-stage tubes stay in the nonnegative orthant, and a second-stage repair sends every successor to $(1,1)$, so both stage-1 accepted sets are all of ${\mathbb{R}}^2$; the original final typed and scalarized terminal rules are unchanged. The witness datum itself is not erased this way: on I its plans violate the stage-local path constraint, which a later action cannot undo. The example shows one sufficient repair-stage mechanism, not a general erasure rule: safe continuation cannot repair an earlier tube breach, and equality of terminal sets or action coupling alone does not imply alignment of the pathwise constraints.

4.4. What Closes the Gap and What Does Not

Under the witness’s declared linear-flow extension, the physical convexification instrument is the closed blend family: for $\delta \in [0,1]$, $blen{d}_{\delta }$ uses the fractional control $u_{\delta }=\delta u_{fast}+(1-\delta )u_{slow}$. Its endpoints are the primitive plans, and its worst-case tube and successor are the corresponding convex combinations under the stated linearity assumption. This physical blend is stronger than abstract convexification of required-margin vectors; an application must demonstrate it from model equations or declare it as a management assumption (for example, fractional effort or quota allocation with monitoring and enforcement).

Theorem 3.

(blend collapse). On the witness datum, over $X_0$:

(i)

 $blen{d}_{\delta }$ is typed-admissible at z exactly when $\delta \in \left[1-\frac{s_2}{2},\frac{s_1}{2}\right]\cap [0,1]$, an interval nonempty exactly when $s_1+s_2\ge 2$ (a singleton at equality), independent of $x\ge 0$ and of the weight;

(ii)

 the typed accepted set of the menu augmented by the blend family is exactly the compensatory region, ${\mathcal{V}}_{\mathrm{typ}}^{\mathrm{blend}}=\{x\ge 1\}\cup \{s_1+s_2\ge 2\}={\mathcal{V}}_{\mathrm{weak}}$: the gap vanishes, and the blend family reaches nothing beyond ${\mathcal{V}}_{\mathrm{weak}}$;

(iii)

 the admissible window depends on the state through $(s_1,s_2)$ alone, so a single δ serves every weight: on I the blend is the common plan that no member of the finite menu supplies.

Proposition 4.

(complete-excursion concatenation preserves primitive floor violations). Consider the control extension in which a sequential policy is required to execute each selected primitive at full strength for its complete unit-interval excursion, with visited set exactly the union of the corresponding primitive worst-case tubes. Within this specified class, a policy that uses bothfast andslow is typed-admissible if and only if $s_1\ge 2$ and $s_2\ge 2$. Thus no such complete-excursion concatenation is typed-admissible on I.

This proposition is conditional on the stipulated union-of-complete-tubes semantics; it is not a theorem about ordinary finite-rate switching. For example, in the no-shock branch of a natural full-rate derivative extension ${\dot{s}}_1=-4$ before $t=1/2$ and $+4$ after for fast, with the analogous rates on $s_2$ for slow, the schedule fast on $[0,1/4]$, slow on $[1/4,1/2]$, fast on $[1/2,3/4]$, and slow on $[3/4,1]$ takes $(6/5,6/5)$ through $(1/5,6/5)$, $(1/5,1/5)$, $(6/5,1/5)$, and back to $(6/5,6/5)$. Both floors remain positive with three switches. This is a different admissible-control extension, not a counterexample to the conditional proposition.

The two results compare distinct declared control extensions. Under action-indexed disturbances and linear fractional flows, the blend family closes the typed gap exactly on $s_1+s_2\ge 2$. Under the shared-shock class of Section 4.6, the blend window instead requires $s_1+s_2\ge 5/2$, so it is empty at the canonical point $s_1+s_2=12/5$ (Proposition 6). The complete-excursion result concerns only a policy whose visited set is the union of both full primitive tubes; the three-switch example above demonstrates a different implementation. Neither statement identifies physical blending with a lottery over plans or ranks all admissible switching policies.

The remaining instrument acts on the reserve. Define the augmentation map ${\mathsf{Aug}}_{\kappa }:(x,s,\mathcal{A})\mapsto (x+\kappa ,s,\mathcal{A}\cup \left\{stage{d}_{\kappa }\right\})$, where $stage{d}_{\kappa }$ is staged run from the augmented reserve, and the rescue threshold${\kappa }^{*}\left(z\right)=\inf \{\kappa \ge 0:\exists a\in {\mathcal{A}}_{\kappa },a\in E_{\mathrm{typ}}\left(z\right)\}$. The augmented state is $(x+\kappa ,s_1,s_2)$, so increasing $\kappa$ changes only the available reserve.

Proposition 5.

(rescue threshold). On the witness datum, for every $z\in X_0$,

$${\kappa }^{*}\left(z\right)={(1-x)}_{+}·\mathbf{1}[x<1,s_1<2,s_2<2]=(1-x)·\mathbf{1}[z\notin {\mathcal{V}}_{\mathrm{typ}}].$$

On I the threshold is $1-x>0$; on R and on all of ${\mathcal{V}}_{\mathrm{typ}}$ it is 0. Because $stage{d}_{\kappa }$ is admissible exactly when $x+\kappa \ge 1$, independently of the floors, the reserve route admits every state of the failure set $\{x<1,s_1<2,s_2<2\}$ at cost $1-x$ – including states such as $(\frac{1}{2},\frac{1}{10},\frac{1}{10})$ that even the aggregate rejects; I is the part of the failure set on which the aggregate still certifies. Along this route the distance to the feasible slice $\{x\ge 1\}$ equals the violation ${(1-x)}_{+}$ itself, so the error-bound modulus (Fabian et al., 2010) of the relation is identically 1: the route is perfectly conditioned. Table 6 summarises how the instruments act on the gap.

4.5. Beyond Linear Aggregation: The Substitutability Ladder

The results so far concern the linear index. We evaluate Protocol 2 on the witness under a normalized-margin CES family. Set ${\lambda }_i=1+s_i$ and, for normalized weights $w_i\ge 0$, ${\sum }_i{w}_i=1$, define

$$\begin{array}{c}{M}_{\theta }(\lambda ;w)={\left(\sum _i{w}_i{\lambda }_i^{\theta }\right)}^{1/\theta },\sigma ={\displaystyle \frac{1}{1-\theta }},\\ -\infty <\theta <1(0\le \sigma <\infty ),\theta =1\mathrm{corresponds}\mathrm{to}\sigma =\infty .\end{array}$$

with the usual limits: $\theta =1$ is the linear aggregate, $\theta =0$ the geometric mean, $\theta =-1$ the harmonic mean, and $\theta \to -\infty$ the weighted support minimum. The inputs ${\lambda }_i$ are constructed normalized-margin indices; they are not automatically physical abundance ratios. A state is accepted at rung $\theta$ when every weight has some menu plan satisfying $M_{\theta }\ge 1$ along its worst-case tube, subject to the same physical and destination constraints. We impose an additional floor-safety convention: for every $\theta <1$, a plan is rejected if any tube coordinate has ${\lambda }_i\le 0$, regardless of the weight. This is not an inherent property of every CES mean: for $0<\theta <1$, a zero input can still yield a positive mean, while negative inputs are outside the standard geometric-mean domain. The convention makes any collapsed floor coordinate independently disqualifying; the linear member alone is allowed to compensate across it. At $\theta =1$, $M_1\ge 1$ is exactly $w·s\ge 0$, so the original compensatory protocol and its licensing thresholds are recovered. At the Leontief limit, $M_{-\infty }$ is the minimum over the positive-weight support. A strictly positive full-support weight therefore requires every coordinate to meet its floor along the tube, while typed safety passes every support minimum; hence the all-weight acceptance set is exactly the typed set.

On the gap-region diagonal $z=(x<1,s,s)$, $s\in (1,2)$, the per-weight cover condition reduces, by the symmetry of the two principal plans, to a single comparison at the equal weight: accept iff ${(s-1)}^{\theta }+{(s+1)}^{\theta }\ge 2$ for $\theta >0$, iff $s^2\ge 2$ for $\theta =0$, and iff ${(s-1)}^{\theta }+{(s+1)}^{\theta }\le 2$ for $\theta <0$. Each rung therefore has an exact critical floor $s^{*}\left(\theta \right)$, and the critical floors form a ladder (Table 7, Figure 4).

Theorem 4.

(the substitutability ladder). On the witness datum:

(i)

(Nesting.) For rungs $\theta >{\theta }^{\prime }$ and every state, acceptance at ${\theta }^{\prime }$ implies acceptance at θ. The accepted rungs at each state form a prefix of the ladder, so thecritical elasticity ${\sigma }^{*}\left(z\right)=\inf \{\sigma :z\mathrm{accepted}\mathrm{at}\sigma \}$ is well defined; it is strictly positive and finite on every gap state in the deep interior ($1<s_1<2$ and $1<s_2<2$), where the finite primitive menu has positive tube ratios and the scalarized margin is strict at every normalised weight; it is equal to ∞ on gap states with $\min (s_1,s_2)\le 1$, for which only the linear member certifies. Boundary equalities are not covered by the strictness assertion.

(ii)

(Pointwise.) For every gap state in the strict interior of the floor-margin region ($0<s_1<2$, $0<s_2<2$, $s_1+s_2>2$), some strictly positive elasticity rejects it, so the Leontief limit is not needed to reject a fixed interior gap state. On the deep-interior subset ($1<s_1<2$ and $1<s_2<2$), a finite rung below the linear member still accepts the state. Gap states with $\min (s_1,s_2)\le 1$ are accepted at the linear member only.

(iii)

(Uniform on the diagonal slice.) For every $\theta <1$ the rung falsely certifies an exact interval $[s^{*}\left(\theta \right),2)$ of the witness-defined diagonal gap states, with $s^{*}\left(\theta \right)<2$ strictly; for the displayed rungs the critical floors increase as elasticity falls: $1<\sqrt{6\sqrt{3}-9}<5/4<\sqrt{2}<\phi <\sqrt{3}<\dots \to 2$ (Table 7), approaching the typed boundary. Thus no positive elasticity is uniformly safe even over the full gap (the diagonal intervals alone witness failure), ${\inf }_{z\in \mathcal{Q}}{\sigma }^{*}\left(z\right)=0$, and the only uniformly safe member is $\sigma =0$ – the Leontief member, which is exactly the typed operator (${\mathcal{V}}^0={\mathcal{V}}_{\mathrm{typ}}$).

The theorem settles the objection in two scopes. Pointwise, the separation is not a Leontief phenomenon: at the witness point every aggregator with $\sigma \le 2$ already rejects, and the floor-referenced dashboard value $({\lambda }_1+{\lambda }_2)/2=(1/5+11/5)/2=6/5\ge 1$ at the trough is contradicted by the geometric index $\sqrt{11/25}<1$. Here ${\lambda }_i=1+s_i$, so $({\lambda }_1+{\lambda }_2)/2=1+(s_1+s_2)/2$ is tested against 1. Section 5 reports the same verdict in floor-margin coordinates as the unnormalised sum $s_1+s_2$ at threshold 0: for normalized equal weights $w=(1/2,1/2)$, this sum is twice $w·s$, so the rescaling does not change acceptance. Uniformly on the witness-defined diagonal gap slice, for every positive elasticity there are gap states arbitrarily close to the typed boundary that the aggregator certifies and no plan completes safely. The appearance of $\sqrt{2}$, $\phi$ and $\sqrt{3}$ as the exact critical floors of the geometric, harmonic and $\sigma =1/3$ members is, to our knowledge, a new exact witness for the substitutability debate. Off the diagonal, the geometric-member comparison has the exact criterion in SI S3.2, with boundary $s_2=\rho \left(s_1\right)$. The off-diagonal criterion gives pointwise acceptance only; no global fixed-sum slice-minimum or stationary-point theorem is asserted or used here. The identification of the $\theta =0$ member with the Living Planet Index is at the level of functional form only: published LPI inputs and weighting are not Protocol 2, and the constructed inputs ${\lambda }_i=1+s_i$ depend on the chosen positive normalization of each margin. Under the optional biomass scale map in Section 5, $B_m/B_{\lim }=1+s_1/2$, not $1+s_1$; the index is therefore not a physical abundance ratio. The all-weights protocol is also more restrictive than acceptance at one specified published weight, so its false-acceptance exposure can be smaller.

4.6. Beyond Action-Indexed Disturbances: The Common Shock

A second objection is that the gap depends on the action-indexed disturbance convention, under which the adverse event strikes only the coordinate the active plan moves. Decompose the datum as on the benchmark: each principal plan’s announced schedule is a mid-interval tent of depth $3/2$ in its characteristic coordinate, and each environmental event is a transient tent dip of depth $\delta$ in one floor coordinate (the datum’s depth $2=3/2+1/2$ fixes $\delta =1/2$); staged’s floors grow linearly, so an event of depth $\delta$ dips a growing floor by $\max (0,\delta -1/8)$. Under the common-shock class the two coordinate events are separate disturbances each of which strikes every plan – a marine heatwave striking the same biomass coordinate regardless of which harvest plan is running.

Proposition 6.

(the common-shock verdict). Under the common-shock class at $\delta =1/2$:

(i)

 ${\mathcal{V}}_{\mathrm{typ}}^{\mathrm{cs}}=\{s_1\ge 2,s_2\ge \frac{1}{2}\}\cup \{s_2\ge 2,s_1\ge \frac{1}{2}\}\cup \{x\ge 1,s_1\ge \frac{3}{8},s_2\ge \frac{3}{8}\}$ and ${\mathcal{V}}_{\mathrm{weak}}^{\mathrm{cs}}=\{x<1,s_1\ge \frac{1}{2},s_2\ge \frac{1}{2},s_1+s_2\ge 2\}\cup \{x\ge 1,s_1\ge \frac{3}{8},s_2\ge \frac{3}{8}\}$, so the gap ${\mathrm{FP}}_{\mathrm{cs}}=\{x<1,\frac{1}{2}\le s_1<2,\frac{1}{2}\le s_2<2,s_1+s_2\ge 2\}$ survives: it is the action-indexed gap I reduced by the exact $1/2$-cut, nonempty with interior, and the witness point is a member. On the surviving region the licensing thresholds are unshifted.

(ii)

 The rescue threshold becomes a trichotomy: ${\kappa }_{\mathrm{cs}}^{*}=0$ on ${\mathcal{V}}_{\mathrm{typ}}^{\mathrm{cs}}$; ${(1-x)}_{+}$ on failure states with $\min (s_1,s_2)\ge \frac{3}{8}$; and $+\infty$ on failure states with $\min (s_1,s_2)<\frac{3}{8}$, which no reserve increment rescues (witness $(\frac{1}{2},\frac{1}{4},3)$).

(iii)

 The blend window is nonempty exactly on $\{s_1\ge \frac{1}{2},s_2\ge \frac{1}{2},s_1+s_2\ge \frac{5}{2}\}$, so the common-shock gap is not blend-closed on the band $s_1+s_2\in [2,\frac{5}{2})$ (witness $(\frac{1}{2},1,1)$).

The separation is not an artefact of the action-indexed convention: under the common-shock model the gap persists, reduced by the exact $1/2$-cut. The model’s rescue set also changes: on failure states with $\min \left(s\right)<3/8$, no finite reserve increment certifies, while the staged route has the stated coordinate-floor requirement. These are conditional feasibility results for the specified menu and disturbance class, not operational prescriptions. The coupled class (one disturbance carrying both events), its depth dependence with exact boundary $\delta =5/4$, the relocation of the gap to larger floors at full magnitude, and the collapse of the separation under a replace reading in which every plan faces the same plan- and weight-independent dip are stated and proved in SI S4; the mechanism of that replace-reading collapse is that a common plan- and weight-independent dip removes the weak test’s advantage of weight-wise plan choice, so the per-weight cover reduces to the typed condition.

4.7. Verification

The analytic results are proved in Appendix A, Appendix B, and SI S2–S4. Exact-integer and rational checks cover only their enumerated cases; they do not establish continuum claims. The cited Lean module formalizes selected algebraic witness identities and CES rungs, but not the general real-exponent nesting, continuity/IVT transfer, or relative-interior argument. Those steps are supported by the written proofs and are not claimed as machine-checked. SI S7 summarizes the scope of the finite checks and formalization.

5. A Resource-Transition Reading of the Datum

The witness is abstract by design. This section gives it a Schaefer-style biomass reading using synthetic model biomass units (MBU), not a calibrated fishery model. Biomass dynamics are specified, but the income-margin and reserve coordinates are normalized illustrative states whose paths are stipulated by the witness; they are not calculated from prices, costs, or fleet accounts. Northern-cod data enter only through a separately declared historical scale comparison (full detail in SI S5). No model parameter is estimated from those data, and no fit, forecast, validation, or empirical performance claim is made.

 State variables and scales. Let $B_m\left(t\right)$ be biomass in MBU over one annual review interval $t\in [0,1]$, with Schaefer surplus production $\varsigma \left(B_m\right)=r{B}_m(1-B_m/K)$, $r=4{\mathrm{yr}}^{-1}$, $K=10$ MBU, and model floor $B_{\lim }=2$ MBU. The first assessment coordinate is the normalized biomass margin $s_1=(B_m-B_{\lim })/\left(1\mathrm{MBU}\right)$. The second is a separate normalized income-margin coordinate $s_2=\mathsf{\Delta }\mathsf{\Pi }/{\mathsf{\Pi }}_0$, for a declared positive reference scale ${\mathsf{\Pi }}_0$; no revenue or cost law is supplied, so its paths are illustrative rather than empirically generated. The reserve x is likewise in normalized fund units, with staged-plan cost $c=1$ fund unit. The heatwave is a one-time biomass shock of ${\delta }_0=1/2$ MBU at $t=1/2$; it does not directly disturb $s_2$. The dashboard weights act on these dimensionless normalized margins, not on raw tonnes and currency.

 The schedule and its status. At the witness point $(x,s_1,s_2)=(1/2,6/5,6/5)$, the opening biomass is $B_m\left(0\right)=16/5$ MBU. The fast schedule follows the benign biomass line $B_{\mathrm{line}}\left(t\right)=16/5-3t$ for $0\le t\le 1/2$ under

$${\dot{B}}_m=\varsigma \left(B_m\right)-H_m\left(t\right),H_m\left(t\right)=3+\varsigma \left(B_{\mathrm{line}}\left(t\right)\right),$$

then closes the fishery ($H_m=0$). The quota falls from $1463/125\approx 11.704$ to $2161/250\approx 8.644$ MBU/yr, below the stipulated capacity $H_{\max }=13$ MBU/yr. At the midpoint, the benign biomass is $17/10$ MBU; the heatwave branch is reduced by $1/2$ MBU to $6/5$ MBU. The corresponding certified floor-margin tubes are $s_1:6/5\to -3/10\to 6/5$ without the strike and $s_1:6/5\to -4/5\to 6/5$ with it. The slow plan applies the analogous prescribed excursion to the normalized income margin, while holding the biomass coordinate fixed. staged spends one fund unit and increases each normalized margin by $e=1/4$. These income and reserve paths are stipulated parts of the datum; they are not derived from an economic submodel.

The zero-harvest recovery is logistic, not the straight line used as the certified tube envelope. From a midpoint biomass b, the nonlinear endpoint is

$$B_m\left(1\right)={\displaystyle \frac{10}{1+(10/b-1)e^{-2}}},$$

which is about $6.02136$ MBU from $b=1.7$ and $5.01892$ MBU from $b=1.2$; neither returns to the abstract successor $16/5$ MBU. The piecewise-linear recovery envelope is conservative: up to $B_m=5$, surplus is at least $\varsigma (6/5)=528/125>4$ MBU/yr, exceeding the envelope’s recovery rate, and after the actual stock reaches 5 it remains above the envelope, which never exceeds $16/5$. Thus the nonlinear trajectory remains above the stated lower envelope, but matching the witness’s endpoint requires a separately specified post-interval control or reset. The exact-tube theorem applies to the abstract datum; this biomass calculation alone does not establish the full two-coordinate transition or its terminal condition.

 The dashboard reading. On the heatwave branch of fast, the normalized margin sum takes the values $(12/5,2/5,12/5)$, so the equal-weight dashboard remains above its zero threshold even though the biomass margin is negative at mid-interval. The licensing thresholds at the witness point are ${\rho }_1=2/3$ and ${\rho }_2=3/2$: each weight has at least one licensed plan, and the ranges overlap; they do not assign a unique or necessarily different plan to every weight. A biomass-focused weight rejects the fast trajectory, but may license slow, which protects biomass in this datum. The conclusion is therefore state-level, weight-adaptive acceptance, not acceptance of one fixed trajectory under every weight. The mid-interval event is a biomass-limit breach in the model, not a claim of biological extinction or collapse. A reserve top-up is a separate remedy: for a typed-failure state with $x<1$, the witness threshold is ${\kappa }^{*}=1-x$.

Table 8. The witness coordinates read as quantities in the illustrative benchmark.

Object	Illustrative reading
Typed margins $s_i\ge 0$	normalized biomass margin $s_1$ and separately normalized income-margin coordinate $s_2$
Scalarized operator $E_w$	the declared dashboard $w·(s_1,s_2)$; weights do not multiply raw tonnes and currency
Licensing thresholds ${\rho }_1,{\rho }_2$	weight-ratio ranges over which the pulse (fast) or gradual (slow) plan is licensed
Acceptance gap ${\mathrm{FP}}_{\mathrm{agg}}$	dashboard-certified yet typed-inadmissible transitions under the stated plan and disturbance class
Rescue set R; threshold ${\kappa }^{*}$	states served by the staged plan and the normalized fund increment needed to reach its cost
Exact-tube semantics	checking every state in the stated tube, including the midpoint disturbance
Critical elasticity ${\sigma }^{*}$	threshold in the constructed normalized-margin CES family; not a fitted biological parameter

Table 8. The witness coordinates read as quantities in the illustrative benchmark.

Object	Illustrative reading
Typed margins $s_i\ge 0$	normalized biomass margin $s_1$ and separately normalized income-margin coordinate $s_2$
Scalarized operator $E_w$	the declared dashboard $w·(s_1,s_2)$; weights do not multiply raw tonnes and currency
Licensing thresholds ${\rho }_1,{\rho }_2$	weight-ratio ranges over which the pulse (fast) or gradual (slow) plan is licensed
Acceptance gap ${\mathrm{FP}}_{\mathrm{agg}}$	dashboard-certified yet typed-inadmissible transitions under the stated plan and disturbance class
Rescue set R; threshold ${\kappa }^{*}$	states served by the staged plan and the normalized fund increment needed to reach its cost
Exact-tube semantics	checking every state in the stated tube, including the midpoint disturbance
Critical elasticity ${\sigma }^{*}$	threshold in the constructed normalized-margin CES family; not a fitted biological parameter

 Historical scale comparison, not calibration. DFO Science Advisory Report 2016/026 reports a Northern-cod LRP of $884.6$ kt for the cited assessment vintage; it is the rounded 1983–1989 mean in that series (Table A2, PDF p. 16), not an asserted current-2026 threshold. If, solely for a dimensional comparison, 2 MBU is mapped to $884.6$ kt, then 1 MBU is $442.3$ kt. This would map the witness opening biomass $3.2$ MBU to $1415.36$ kt, the adverse trough $1.2$ MBU to $530.76$ kt, $K=10$ MBU to 4423 kt, the $0.5$-MBU heatwave to $221.15$ kt, and the capacity 13 MBU/yr to $5749.9$ kt/yr. These large implied capacities underscore that the mapping is a unit anchor, not a plausible or fitted Northern-cod production model. DFO’s assessed 2015 level was about $298.65$ kt, or $33.8\%$ of that historical LRP. The CES input ${\lambda }_1=1+s_1$ is a constructed normalized-margin index, not $B_m/B_{\lim }$: under this mapping, $B_m/B_{\lim }=1+s_1/2$, whereas ${\lambda }_1=1+s_1$. The income coordinate has its own normalization, and neither it nor the reserve has a physical currency scale here. The comparison makes no claim that the benchmark parameters or management schedules describe a real fishery.

Figure 5. The witness datum read as an illustrative resource transition. (a) The constructed normalized index $s_1+s_2$ remains positive while the biomass margin breaches its floor. (b) The quota schedule is plotted in model biomass units per year (MBU/yr); the fund coordinate is normalized and carries no currency unit. The piecewise-linear tube and the nonlinear logistic recovery have different endpoint semantics, as detailed above and in SI S5. All curves are schematic summaries of the declared datum, not empirical trajectories.

Figure 5. The witness datum read as an illustrative resource transition. (a) The constructed normalized index $s_1+s_2$ remains positive while the biomass margin breaches its floor. (b) The quota schedule is plotted in model biomass units per year (MBU/yr); the fund coordinate is normalized and carries no currency unit. The piecewise-linear tube and the nonlinear logistic recovery have different endpoint semantics, as detailed above and in SI S5. All curves are schematic summaries of the declared datum, not empirical trajectories.

6. Related Work, and What Is Claimed as New

The result combines familiar ingredients, so its scope matters. The full-cone identity and the elementary quantifier inclusion are not claimed as new. The contribution is a finite-menu transition-certification construction, with explicit assumptions on the tube and scalarization, and a bounded account of how its verdict changes under selected control and disturbance extensions.

6.1. Scalarization and Finite-Menu Geometry

Weighted-sum scalarization recovers supported outcomes of multi-objective problems and can miss unsupported points on a nonconvex frontier; alternative scalarizations address that limitation (Athan and Papalambros, 1996; Das and Dennis, 1997; Ehrgott, 2005; Koski, 1985; Messac and Mattson, 2002; Miettinen, 1999). Theorem 1 has related convex geometry, but its exact statement is a margin-first acceptance result: the required-margin vector is formed first and the scalarized requirement is assumed to be $w·d_a$. It compares the up-closed convex hull of a finite menu with the union of the menu’s orthants. This is not a new scalarization theorem, nor does it establish that every exact-tube scalarization has that form; Lemma 3 states when the two path orders agree.

The quantifier gap itself can be static. For example, the two alternative margin vectors $(-4/5,6/5)$ and $(6/5,-4/5)$ are not componentwise nonnegative, yet every nonzero nonnegative weight has at least one nonnegative alternative. In this paper, paths and disturbances specify how such margins arise and add transition-specific questions about transient breaches, terminal conditions, and implementable controls. They are an application setting, not a premise that makes the quantifier mechanism inherently dynamic. The relevant distinction from Pareto-front analysis is the decision object: acceptance of a state under a menu and a rule, rather than recovery of a particular outcome by a weighted-sum optimizer. The convex geometry is shared; the questions are not identical.

6.2. Adjustable Robustness, Randomization, and Physical Blending

The order $\exists a\forall w$ versus $\forall w\exists a_w$ resembles the here-and-now/wait-and-see distinction in adjustable robust optimization (Ben-Tal et al., 2004, 2009). The analogy is limited: here w is an assessment weighting, not a realized uncertainty, and the result is a feasibility comparison, not a theorem that reverses the usual ordering of static and adjustable policy classes. On a common model and admissible-policy class, allowing adaptation includes the static policies; comparing a fractional physical control with a compulsory sequence of complete excursions compares different control extensions.

Fractional blending in Theorem 3 changes the physical control by allocating the primitive flows fractionally; it is not a lottery over primitive plans. In the shared-shock example at the canonical point, the best primitive worst margin is $-4/5$, while the balanced blend has worst margin $-1/20$: blending strictly improves this maximin margin but does not restore feasibility. We therefore describe the result as failure of feasibility restoration at that point, not as randomization-proofness. Randomized decisions and their worst-case values are studied separately in robust optimization (Delage et al., 2019; Krause et al., 2011; Sessa et al., 2020; Sinha et al., 2018; Vorobeychik and Li, 2014).

Nor is the blend-versus-sequencing comparison a counterexample to Kuhn’s realization-equivalence theorem. Under its hypotheses, mixed and behavioral strategies induce the same distribution over paths; equal path laws preserve probabilities of measurable safety events and distributional worst-case criteria. A deterministic fractional control instead produces a different physical path. The complete-excursion proposition below is conditional on its specified union-of-tubes control class. Under a distinct natural derivative implementation, a three-switch schedule can keep both canonical margins positive; this is not a counterexample to that conditional proposition, but it rules out a broad claim that all finite-rate switching fails. Any literal mixed-strategy interpretation would require a separate payoff, information structure, and disturbance model. Main and Randour study finite-memory strategy restrictions, but this manuscript does not establish that its control problem is an instance of their automaton model (Kuhn, 1953; Main and Randour, 2024).

6.3. Weak and Strong Sustainability

The distinction formalized here is related to the weak-sustainability treatment of substitution among forms of capital and the strong-sustainability treatment of selected critical stocks as separately binding (Ayres et al., 2001; Beckerman, 1994; Daly, 1995; Dietz and Neumayer, 2007; Neumayer, 2013; Pearce and Atkinson, 1993). Both literatures include formal and empirical work; we do not characterize the wider debate as merely verbal, and we do not rank the doctrines. The operators idealize one transition-certification rule under each reading. The result establishes that these particular rules can disagree on a declared menu and disturbance class, not that any boundary or criterion ought normatively to be noncompensatory.

6.4. Bounded Contribution

The paper contributes four related results. First, the full-cone identity locates the gap in plan selection rather than loss of information at a fixed trajectory. Second, the finite-menu theorem gives the convex-margin description under its explicit margin-first hypothesis, and a rational witness realizes a nonempty transition-certification gap with an exact reserve threshold. Third, the paper analyzes a closed fractional-flow extension and several separately declared disturbance classes; these results are conditional on their respective control and shock models, not on a general equivalence between blending and randomization. Fourth, the CES ladder gives exact diagonal comparisons under the stated collapse convention and normalization; it does not identify a calibrated fishery index. The Northern-cod comparison is a historical dimensional anchor only.

We therefore claim neither priority for the quantifier-order observation, the standard convex-hull separation, nor the general usefulness of randomization. The contribution is the set of results for this transition-assessment construction, together with the assumptions and limits that delimit their conclusions.

7. Discussion

7.1. What the Separation Is, and What It Is Not

The scalarized operators ${\left\{E_w\right\}}_{w\in W_{+}}$ formalise one compensatory certification rule: a plan is assessed through a weighted aggregate of the declared normalized margins, with the stated disturbances respected. The weak-sustainability literature is broader than this operator, encompassing aggregate wealth, nondeclining comprehensive consumption, shadow prices and intertemporal investment conditions (Asheim, 1994; Dasgupta and Mäler, 2000; Neumayer, 2013; Solow, 1974). Strong-sustainability frameworks are also broader than the rule that every coordinate remain nonnegative at every instant; critical-natural-capital and safe-operating-space approaches include thresholds, irreversibility and resilience (Doyen and Gajardo, 2020; Ekins et al., 2003; Raworth, 2012; Rockström et al., 2009). The two operators are therefore idealized certification protocols, not definitions of the full doctrines.

The established gap is one of plan selection: every weighting may license some plan even though no single plan satisfies all typed floors. The quantifier order has an information interpretation only if the plan can actually be chosen after the assessment weight is known; the mathematical result itself does not assume such information or describe auditor behavior. The same mechanism can occur for static alternative vectors. In the present application, paths and disturbances add questions about transient breaches, terminal conditions, and which control extensions are implementable. The finite-menu theorem’s convex geometry is a menu-selection result under margin-first scalarization; it is not evidence that the mechanism is inherently dynamic.

The rational witness is relative to its four-plan menu and declared disturbance class. A larger or differently implemented menu can shrink the gap. The reserve is deliberately excluded from the aggregate, so adding it to a real indicator could change the result. The action-indexed blend closes the gap only under the stated linear-flow assumption; the shared-shock blend improves the worst margin at the canonical point from $-4/5$ to $-1/20$ but remains infeasible. The complete-excursion result is conditional on a union-of-full-tubes policy class, while a distinct three-switch no-shock schedule is safe at the canonical margins. No general claim about finite-rate switching follows. The coupled-shock results are reading- and depth-conditional (SI S4). Finally, all formal results concern finite-horizon exact-tube data; infinite horizons, stochastic constraints, partial observation and endogenous event times are outside the main model.

7.2. Acceptance Semantics in Multi-Criteria Decision Aiding

The protocols in Table 1 are sorting rules: they specify when a transition is classified as accepted or rejected, the sorting problem of decision aiding (Roy, 1996; Vincke, 1992). The licensing thresholds of Theorem 2 are weight-sensitivity intervals, analogous to sensitivity analyses for composite-indicator rankings (Becker et al., 2017; Nardo et al., 2008), but the object is which plan is licensed rather than a rank. Existing MCDA work analyzes compensability and outranking at fixed profiles (Cinelli et al., 2014; Schär et al., 2025); here the fixed-profile full-cone result is lossless (Lemma 2), and the additional gap arises when acceptance is quantified over a finite menu.

The here-and-now/wait-and-see distinction in adjustable robust optimization is a useful analogy for common-plan versus weight-adaptive acceptance (Ben-Tal et al., 2004). It is not a literal uncertainty model: the weight is an assessment parameter, and the result does not reverse the usual set inclusion between static and adaptive policy classes on a common model. The companion biocapacity study and obstruction-calculus paper address related applications and substitution certificates (Abaee, 2026a, 2026b); they are not premises of the present proofs.

7.3. Design Tests for Composite Indicators

For indicator developers, the results suggest four checks. Each follows from a stated theorem and applies only within its declared model.

1.

Fixed-profile losslessness. Does the declared weight family detect every component violation on a fixed trajectory? The full nonnegative cone does (Lemma 2); a restricted nonempty family requires its own characterization (Proposition 2).

2.

Protocol quantifiers. Does certification require one plan to work for every weighting, or permit plan reselection by weight? If the latter, report the plan ranges and the menu-relative gap.

3.

Path and endpoint checks. Is the assessment evaluated on the full tube or only at sampled endpoints? The witness’s fast plan is typed-endpoint-admissible even where its tube breaches a floor, so endpoint-only review can miss a transient violation.

4.

Menu and control implementation. Is the menu exhaustive, and can fractional controls actually be implemented? The convex-hull theorem is margin-first; the physical blend requires a separately verified control law. Declare the disturbance class and do not infer feasibility from an abstract convex combination alone.

Where floors are separately binding, reporting per-floor path minima, the reserve and the acceptance protocol allows this class of discrepancy to be reconstructed. Floors alone do not determine whether a reserve-financed rescue is available, and an aggregate without path and reserve data does not recover the typed verdict on the witness family. This is a conditional design recommendation, not a universal prescription for sustainability assessment. A ten-point checklist, a minimum report and empirical-data requirements appear in SI S6.

7.4. Limitations

(i)

The separation is an existence result on one declared finite menu; it does not estimate the size or frequency of a gap in applications.

(ii)

The finite-menu convex-hull theorem assumes margin-first requirements $m_a\left(w\right)=w·d_a$. The synchronization lemma states when that formula agrees with an exact-tube scalarization.

(iii)

A physically implemented convexified control is an additional model and institutional assumption. Without it, convexification in required-margin space is only geometric.

(iv)

The hold-prefix persistence result is proved for its specified extension. A separate repair-stage example shows one erasure mechanism; it does not imply that arbitrary continuations, coincident endpoint sets, or action coupling erase pathwise gaps.

(v)

The biomass illustration is synthetic. Its optional mapping to the historical DFO limit implies very large model capacities, and its nonlinear recovery does not return to the abstract successor without additional terminal control. The income-margin paths are stipulated rather than generated from an economic model.

(vi)

CES results use the explicit collapse convention and the normalization ${\lambda }_i=1+s_i$. The diagonal thresholds are analytic; the off-diagonal formula is stated separately, while no global fixed-sum stationary-point or phase theorem is claimed. The common-shock statements apply only to the specified decomposition.

(vii)

The finite rational verifiers check enumerated instances, not continua. The Lean source formalizes selected components and does not cover the full real-exponent, continuity, or topological steps; the scope of the finite checks and formalization is detailed in SI S7.

(viii)

Novelty statements are bounded by the literature comparisons in Section 6; no claim is made that composite-index or sustainability scholarship lacks formal analysis.

8. Conclusions

At a fixed trajectory, aggregation over the full nonnegative cone is lossless. A separation can nevertheless arise when the assessment rule permits each weight to select a different plan. For finite menus under the explicit margin-first hypothesis, the accepted-set gap is the part of the up-closed convex hull of required margins not covered by any single plan’s orthant. A rational transition witness realizes a nonempty gap and an exact reserve threshold. This is a menu-selection result that can be static; pathwise tubes and disturbances specify its application to transition certification.

Under the witness’s linear-flow assumption, a fractional physical blend closes the action-indexed gap. A complete-excursion concatenation preserves primitive floor violations only under its stipulated union-of-tubes semantics, and another finite-switch extension can be safe. Under the specified shared-shock class, the gap survives an exact $1/2$-cut and the balanced blend improves but does not restore feasibility at the canonical point. On the witness-defined diagonal, every positive-elasticity CES member falsely certifies an exact interval under the stated collapse convention, whereas the Leontief limit reproduces typed acceptance over the full weight family. These are model-specific statements, not general claims about randomization, all switching policies, or real fishery dynamics.

For transition reporting, the practical conclusion is to declare the menu, the disturbance class, the normalized margin scales, the plan-selection rule, the path minima, the terminal treatment, and any resource needed for rescue. An aggregate can remain positive while a typed floor is breached, but the example does not show that every composite index is unsound or that a particular policy doctrine is normatively required. The benchmark is a transparent dimensional illustration anchored to a historical DFO value, not a fitted or predictive cod model.

GLM (Z.ai), Qwen (Alibaba Cloud) and DeepSeek AI assisted with drafting and iterative review; all results, proofs and verifications were checked by the author.