LISA ILE driver: MC-error replicas and replica pooling (pass 3)

[oshaughnessy-junior]

Pass 3 of the LISA catch-up, on top of #106. Closes 7 of the 92 gap items (gap 92 → 85): --mc-error-{replicas,sigma-trigger,ess-trigger,khat-trigger}, _pool_replica_rvs (+._block_resampled), _extract_mc_diag.

--mc-error-replicas re-runs the extrinsic integration as independent cold replicas when the reported error is untrustworthy, then pools every replica's samples rather than picking one — lnZ is the linear mean over K replicas, so the exported posterior must represent that same mixture. (n_eff is the wrong selector anyway: it measures weight concentration, not coverage, so a mode-collapsed replica scores highest.)

The three constraints recorded when pass 2 landed — all real traps

(a) Both collapse-gate call sites. Main gates on the first run and on the pooled verdict, because replication can turn a healthy first run into a collapsed pool. The new helper owns both, so the standalone _report_and_gate_collapse calls that pass 5a added to each analyze_event are removed — keeping them would have double-gated the first run. A test asserts analyze_event does not gate directly and the helper does it twice.

(b) _rvs_is_pooled reset on entry, in both variants. Only the reader was ported before; nothing set the marker, so this had no live effect until now. On entry rather than in a finally: the pooled gate raises, the caller's except swallows it, and a marker cleared only on the happy path survives into the next event (audit Finding 7).

(c) Per-replica already_resampled sequence, not a global boolean. Each pass decides independently whether to fair-draw, so near the n_extr boundary a run produces a mixture, which one boolean cannot describe (Finding 6).

How it was ported

_pool_replica_rvs (164 lines) and the replica block (~206 lines) were extracted from the main driver verbatim by line range rather than retyped, then the block was wrapped as _maybe_replicate_for_mc_error (module level — this driver has two analyze_event variants).

Ordering: the helper needs log_res/sqrt_var_over_res, so it runs after they are computed. _maybe_save_av_state stays before it — after the replica loop the sampler holds the last replica's adapted grid, not the run being reported. Main saves at the same point; a test pins load < aniso < integrate < guard < save < replicate.

Three existing tests changed, all deliberately

test_the_second_gate_call_site_is_recorded_as_missing existed to fail exactly when someone ported --mc-error-replicas without adding the second gate. That port has happened, so it is replaced by its successor asserting both gates exist. The hook-ordering/presence tests move from the standalone gate to the helper. And the L0 rescue's lnL_offset test now counts per helper — two helpers take that argument now, and a global count would absorb a call site that dropped it.

Tests

test_lisa_mc_error_replicas.py (27), wired into lisa-check. Behavioural where possible: _pool_replica_rvs is a pure function, so the pooling maths is driven directly — block weights summing to Z_k/K, the mixed flattened/raw case, and (so that test has teeth) that the sequence form differs from both global booleans.

Revert-checked with 8 mutations, each caught by its named test, file restored byte-identical. One is worth calling out: "save AV state after replication" — the ordering it protects wasn't something I reasoned out in advance; building the mutation list is what made me go check where main saves, and why.

lisa-check: 242 passed. Both audits green.

Still open after this

31 PORT (the 7 --internal-gmm-*, extrinsic-proposal handoff, sequential warm start, interpolate-time stencil names, misc) and 11 PHYSICS questions listed in LISA_DRIVER_DRIFT.md — the latter now with Aasim.

🤖 Generated with Claude Code

[interhost-cross-review-canary-v2]

Independent automated review completed at the recorded exact commit. Detailed findings were withheld from public output by the private-context egress policy and require private human declassification.