Phase 48: public refutes cert-first (+43.19, ghost force-swaps at ~111 early-days each); default off

EXPERIMENTS.md

@@ -2587,3 +2587,47 @@ k-sweep (k=1 +291, k=2 +200), cert-first works ONLY at the label process's
 exact parameters (2.40 V, 3 consecutive gated readings). The mechanism is
 label-rule replay on past data, not prediction; any deviation reverts to
 guessing at sub-break-even precision. Direction closed.
+
+## Phase 48 - PUBLIC REFUTES cert-first (1704.64); the third and sharpest CV failure
+
+Submission 9438aac (cert-first isolated, pooling default off): **1704.64 vs
+champion 1661.45, +43.19.** Inversion (all integers - settings unchanged):
+
+| | swaps | late-days | early-days | total |
+|---|---|---|---|---|
+| champion 3c7b883 | 580 | 5819 | 13197 | 1661.45 |
+| cert-first 9438aac | 598 | 5894 | 15203 | 1704.64 |
+| delta | **+18** | +75 | **+2006** | +43.19 |
+
+**+18 swaps at ~111 early-days each.** The diagnosis writes itself: on train,
+every device that sustains <2.40 V dies within 90 days (54/54, phase 46), so
+the boost was loss-free locally. The public fleet contains devices that
+sustain-cross and NEVER receive an EOL label - the ghost population phase 15
+found 26 of in train (at 2.45-2.48; train has none at 2.40, public evidently
+does). A ghost is force-swapped in every scenario it survives, and with no
+EOL on file the evaluator prices each swap against end_time+30: ~111
+early-days apiece. The count rule could not protect us - a boosted device
+displaces a marginal pick, and when the displaced pick sits in the break-even
+top-up set it re-enters, so the union grows.
+
+The premise that failed is not the label rule (81/82 exact) but its
+CONVERSE on an unseen fleet: "crossed implies labeled-dead-soon" is a
+train-fleet fact, not a label-process fact.
+
+### What this makes three of
+
+Locally-validated interventions refuted by public: ALPHA_STATIC=1.5 (holdout
+-240 -> public +527), cliff boost (adjudicated -55 -> refuted stacked), and
+now cert-first (**-37.9 at 3W/0L/45T -> public +43.2**). Cert-first is the
+sharpest of the three: mechanistically derived, past-only, loss-free on every
+local instrument, refuted anyway - by a fleet-composition fact no local
+protocol can exhibit because train contains zero counterexamples. When the
+local evidence for a class of intervention is this good and it still fails,
+the class is uninsurable, not under-validated.
+
+Action: CERT_FIRST default off (code retained behind the env var); champion
+remains 3c7b883 at 1661.45 on the board (best-per-account row unaffected).
+A recency-guarded variant (trust the crossing only while fresh) is measured
+locally in this phase's sweep, but shipping it would repeat the same bet with
+a smaller stake and no way to price it - the ghost rate at 2.40 on the scored
+fleets is unobservable from here.

batteryswap_example/submit.py

@@ -165,7 +165,14 @@ CLIFF_MIN_N = 20
 # confirmation depth is load-bearing: k=1 (+291) and k=2 (+200) admit
 # recoveries; k=3 - the label rule's own sustain - is the unique safe point.
 # Past-only by construction: the flag requires all 3 readings <= T.
-CERT_FIRST = os.environ.get('BATTERYSWAP_CERT_FIRST', '1') != '0'
+# PUBLIC REFUTED (2026-08-22, submission 9438aac: 1704.64 vs 1661.45, +43.19).
+# Inversion: +18 swaps at ~111 early-days each, late +15.6. On train every
+# sustained-crossing device dies by +90d (54/54), so the boost was loss-free
+# locally; the public fleet contains crossed-but-NEVER-LABELED devices
+# (ghosts), each force-swapped repeatedly and priced against end_time+30.
+# Third consecutive locally-validated intervention refuted by public
+# (ALPHA_STATIC=1.5, cliff boost, cert-first). Default OFF.
+CERT_FIRST = os.environ.get('BATTERYSWAP_CERT_FIRST', '0') != '0'
 CERT_V = 2.40
 CERT_SUS = 3