IPPM Working Group L. Melegassi Internet-Draft Catellix Intended status: Informational 22 May 2026 Expires: 23 November 2026 Incremental Bandwidth-Efficient Multi-Vantage Path Synchrony (BE-MVPS): Cell-Partitioned Coherence with epsilon-Gated Sherman-Morrison Updates draft-melegassi-mvps-incremental-be-00 Abstract This document specifies BE-MVPS (Bandwidth-Efficient MVPS), an incremental execution layer for the Multi-Vantage Path Synchrony (MVPS) framework that trades a constant-factor increase in broker-side CPU for an order-of-magnitude decrease in vantage-to- broker bandwidth. Where MVPS as defined in [I-D.melegassi-ippm-mvps-bundle] performs a dense recomputation of the coherence vector C = (C_1, C_2, C_3) at every tick over the full population of N observers, BE-MVPS partitions the observer set into k coherence cells, gates per-observer state transmission by a local epsilon threshold, performs Sherman-Morrison incremental updates of the Mahalanobis distance D^2, and detects Byzantine vantages via a cell-aware minimax estimator whose breakdown point is shown (Theorem 7) to be exactly f/k where f is the adversarial vantage fraction. The earlier informal label "Fast Incremental MVPS (FMVPS)" is superseded by BE-MVPS in this document; the rename and its rationale are recorded in the ERRATUM block below and proved formally in Theorem T_BE of the v5.0 unified proof. The IETF identifier of this document is draft-melegassi-mvps-incremental-be. Nine theorems formalise the framework: the partition existence theorem (Theorem 2), the cell-equivalence bound (Theorem 3), the gating information-loss bound (Theorem 4), the Sherman-Morrison- Woodbury incremental D^2 update (Theorem 5), strong eventual consistency of the CRDT merge (Theorem 6), the cell-aware Byzantine breakdown point (Theorem 7), the C_4 perturbation non-incrementality theorem (Theorem 8), and the detection latency lower bound for sub-tick variants (Theorem 9). Section 13 introduces five BFD-inspired execution variants and reports wall-clock benchmark results: variant V3 (Echo) achieves tau_detect = 55 ms, a 1091x reduction relative to the baseline tick scale. Wall-clock benchmarks on N = 1000 to 10 000 vantages confirm that BE-MVPS reduces edge-to-broker bandwidth by a factor of 25x while preserving detection completeness for all canonical scenarios except adversary fractions below 1/k. This document is a companion to [I-D.melegassi-ippm-mvps-bundle] and to the AI-coherence extension [I-D.melegassi-mvps-ai-coherence]. The algebra is preserved verbatim; only the execution model changes. NOTE ON DATA PROVENANCE. All wall-clock and bandwidth numbers in this document are obtained from synthetic simulations (scripts/benchmark_fmvps_vs_ml.py and scripts/benchmark_coherence_bfd.py) under controlled conditions. Validation against operational data (RIPE Atlas, CAIDA, or commercial operator traces) is identified as required future work before publication outside the Experimental track. A REFERENCE IMPLEMENTATION of the cell-aware minimax detector (Theorem 7) is provided in pure Python at . See reference-impl/README.md. ERRATUM (v5.0 unified proof, Theorem T_BE -- applied to this -00 document at submission time, not deferred to -01). Earlier drafts and internal material used the label "Fast Incremental MVPS (FMVPS)". Wall-clock measurements (scripts/benchmark_fmvps_vs_ml.py) and the T_BE theorem of docs/MVPS_V5_UNIFIED_PROOF.txt show that, at N = 1000 to 10 000 vantages and d = 3, this algorithm is on average approximately TWO times slower in per-tick CPU than MVPS-classic (Welford on a dense covariance), while sending approximately TWENTY FIVE times fewer bytes from each vantage to the broker. The genuine advantage of the algorithm specified here is therefore BANDWIDTH efficiency under epsilon-gating, not CPU latency. This document is therefore identified at submission time as draft-melegassi-mvps-incremental-be (Bandwidth-Efficient), with the "Fast" label dropped from both filename and title. The earlier name "draft-melegassi-mvps-fast-incremental" was never submitted to the IETF Datatracker; the BE name is the first authoritative IETF identifier. Theorem T_BE of the unified proof gives the crossover condition lambda* = (C_be - C_mc) / (B_mc - B_be) above which choosing BE-MVPS over MVPS-classic is strictly beneficial under a CPU-vs-bandwidth budget. Status of This Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at https://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." This Internet-Draft will expire on November 23, 2026. Copyright Notice Copyright (c) 2026 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/ license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Melegassi Expires November 23, 2026 [Page 1] Internet-Draft BE-MVPS Bandwidth-Efficient MVPS May 2026 Table of Contents 1. Introduction ....................................................2 1.1. The dense-recomputation cost wall .........................3 1.2. Scope and non-goals .......................................3 1.3. Conventions used in this document .........................3 2. Notation and Preliminaries ....................................4 3. Information Redundancy of Dense MVPS ..........................6 3.1. Theorem 1 (Redundancy bound) ..............................6 4. Cell-Partitioned Coherence ....................................7 4.1. Theorem 2 (Partition existence) ..........................7 4.2. Theorem 3 (Cell-equivalence) .............................8 5. Edge Delta Gating .............................................9 5.1. Theorem 4 (Gating information-loss bound) ................9 6. Lazy Mahalanobis Update ......................................10 6.1. Theorem 5 (Sherman-Morrison-Woodbury D^2) ...............10 7. CRDT Coherence Merge .........................................11 7.1. Theorem 6 (Strong eventual consistency) .................11 8. Cell-Aware Byzantine Detection ...............................12 8.1. Theorem 7 (Cell-aware breakdown point) ..................12 8.2. Conjecture 1 (Adversary-floor f_min = 1/k) ..............13 9. C_4 Perturbation Lower Bound .................................13 9.1. Theorem 8 (Perturbation non-incrementality) .............13 10. The BE-MVPS Algorithm ........................................14 11. Numerical Results ............................................15 11.1. Wall-clock benchmark setup ............................15 11.2. Latency, bandwidth, detection table ...................16 11.3. Scaling N from 100 to 10 000 ..........................16 12. Operational Architecture .....................................17 12.1. Edge / cell / broker / forensic ........................17 12.2. Deployment patterns ...................................18 13. Coherence-BFD: Sub-Tick Detection ............................18 13.1. Five variants and wall-clock measurements ..............18 13.2. Theorem 9 (Detection latency lower bound) ..............19 13.3. Variant V3 (Echo) is empirically optimal ...............19 14. Open Problems ................................................20 15. Security Considerations ......................................21 16. Privacy Considerations .......................................22 17. Manageability Considerations .................................22 18. IANA Considerations ..........................................23 19. References ...................................................23 Appendix A: Proofs of Theorems 1-9 ...............................25 Acknowledgements .................................................28 Author's Address .................................................28 1. Introduction The Multi-Vantage Path Synchrony framework [I-D.melegassi-ippm-mvps-bundle] models a distributed observability surface as a triple x_v(t) = (C_1^v(t), C_2^v(t), C_3^v(t)) in [0,1]^3, v = 1..N where v indexes vantages and t ticks. The aggregate state of the surface is captured by the Mahalanobis distance D^2(t) = (mu(t) - mu_0)^T Sigma_0^{-1} (mu(t) - mu_0) Melegassi Expires November 23, 2026 [Page 2] Internet-Draft BE-MVPS Bandwidth-Efficient MVPS May 2026 with mu(t) the empirical centroid of {x_v(t)} and (mu_0, Sigma_0) the BAU baseline. A phase classifier Phi_K maps D^2 to {BAU, WATCH, ALARM} via fixed chi-square quantiles. 1.1. The dense-recomputation cost wall The reference implementation of MVPS recomputes mu(t), the JSD coherence proxy C_2, and D^2 over the full N-sized population at every tick. The cost per tick is T_classic(N, d) = Theta(N * d^2) wall-clock, Theta(N * d * 8) bytes of edge-to-broker bandwidth. For an operational deployment at N = 10^4 vantages with d = 6 axes and tick period 1 s, the bandwidth alone is 480 KB/s/observer (4.8 GB/s aggregate at 10^4 observers). Empirically (Section 11) we measure 448 us per tick for MVPS-classic at N = 10^4, which is tractable for a single broker but saturates the broker's network interface long before it saturates CPU. The asymmetry between CPU cost and bandwidth cost is the central motivation for BE-MVPS: CPU is cheap, bandwidth is expensive, and the information content of the per-tick state of a coherent BAU vantage is by construction near zero. An execution model that exploits this asymmetry reduces operational cost by an order of magnitude without any loss of detection capability for the canonical scenarios. 1.2. Scope and non-goals This document specifies: (a) the cell-partitioned data model (Section 4); (b) the edge delta-gating policy (Section 5); (c) the lazy Mahalanobis update rule (Section 6); (d) the CRDT merge for cell centroids (Section 7); (e) the cell-aware minimax Byzantine detector (Section 8); (f) the perturbation schedule for C_4 (Section 9); (g) the canonical BE-MVPS algorithm (Section 10). Out of scope: o Wire format: the MVPS bundle envelope of [I-D.melegassi-ippm-mvps-bundle] is preserved verbatim. o Semantic axes (W_2, CKA): the substitution mapping of [I-D.melegassi-mvps-ai-coherence] applies unchanged. o Hardware: a P4_16 / Tofino-2 binding is sketched in [MVPS-DATAPLANE-PROFILE]; we treat the forwarding plane as out-of-band. 1.3. Conventions used in this document The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals. Melegassi Expires November 23, 2026 [Page 3] Internet-Draft BE-MVPS Bandwidth-Efficient MVPS May 2026 2. Notation and Preliminaries We adopt the following notation throughout. Where two symbols are listed (e.g. mu / m), the first is canonical. N Total observer population. k Number of coherence cells; we require N mod k = 0. n N / k = vantages per cell. d Dimensionality of the coherence vector (3 for the IPPM bundle, 6 for the joint network+AI vector of [I-D.melegassi-mvps-ai-coherence]). t Discrete tick index, t = 0, 1, 2, .... T Total number of ticks in a measurement window. x_v(t) Coherence vector of vantage v at tick t, in [0,1]^d. X(t) The N-by-d matrix [x_1(t); ...; x_N(t)]. mu(t) (1/N) sum_v x_v(t). Empirical centroid. mu_c(t) (1/n) sum_{v in C_c} x_v(t). Cell-c centroid. Sigma_0 BAU covariance (positive definite, calibrated on a stationary window of length W). D^2(t) (mu(t) - mu_0)^T Sigma_0^{-1} (mu(t) - mu_0). Phi_K(D^2) Phase classifier; {BAU if D^2 < chi^2_{d,0.95}, WATCH else if D^2 < chi^2_{d,0.99}, ALARM otherwise}. epsilon Edge gating threshold (L_2 norm in [0,1]^d). tau Bounded staleness window (seconds). f Byzantine fraction (number of corrupted vantages / N). k_byz Number of cells containing at least one Byzantine vantage. theta_byz Minimax ratio threshold (default 0.60). C_4 Perturbation stability axis from [I-D.melegassi-mvps-ai-coherence]. p_K Probability of K-th iteration convergence. K_byz Number of iterations of Weiszfeld's geometric-median algorithm; we use K_byz = 30 throughout. E[.] Expectation over the BAU distribution. Definition 2.1 (Coherence cell). A coherence cell C_c is a non-empty subset of {1, ..., N} of cardinality n, such that for all v, w in C_c and all t in a calibration window, || x_v(t) - x_w(t) ||_2 <= delta_cell for some intra-cell radius delta_cell > 0. We say a partition {C_1, ..., C_k} of {1, ..., N} is delta_cell-tight if every cell satisfies the above. Definition 2.2 (Cell centroid). mu_c(t) := (1/n) sum_{v in C_c} x_v(t). Definition 2.3 (Global cell-average centroid). m(t) := (1/k) sum_{c=1}^{k} mu_c(t). Melegassi Expires November 23, 2026 [Page 4] Internet-Draft BE-MVPS Bandwidth-Efficient MVPS May 2026 Remark 2.4. m(t) is the cell-average estimator of mu(t). When all cells have equal cardinality n, m(t) = mu(t) exactly: m(t) = (1/k) sum_c (1/n) sum_{v in C_c} x_v(t) = (1/(k*n)) sum_v x_v(t) = (1/N) sum_v x_v(t) = mu(t). The cell-aggregation step therefore introduces no estimator bias under uniform partitioning. Definition 2.5 (Delta-gated state). The edge-gated state of vantage v at tick t is x_v^gated(t) := x_v(t) if ||x_v(t) - x_v^last||_2 > eps := x_v^last otherwise where x_v^last is the last value of x_v transmitted to the broker. Definition 2.6 (Push mask). P(t) := { v : ||x_v(t) - x_v^last||_2 > epsilon } subset of {1, ..., N}. |P(t)| = number of vantages that push at tick t. Definition 2.7 (Wall-clock cost function). T_arch(N, d, scenario) := mean wall-clock latency per tick in microseconds, measured under the scenario over T ticks. Definition 2.8 (Bandwidth cost function). B_arch(N, d) := mean bytes transmitted from edge to broker per tick. Notational conventions. o All probabilities are with respect to the BAU calibration distribution unless otherwise stated. o log denotes the natural logarithm. o Inequalities of the form A = O(g(N)) follow standard asymptotic notation; constants are explicit when they affect operational claims. o All proofs use only elementary linear algebra, Cauchy-Schwarz, Jensen's inequality, and standard concentration bounds (Hoeffding, Bernstein) unless otherwise stated. o The shorthand BE-MVPS-update(X(t)) refers to the algorithm of Section 10. Melegassi Expires November 23, 2026 [Page 5] Internet-Draft BE-MVPS Bandwidth-Efficient MVPS May 2026 3. Information Redundancy of Dense MVPS The cost asymmetry of Section 1.1 is not architectural; it is information-theoretic. In the BAU regime, the per-vantage signal has entropy that vanishes with sample size, while the dense broadcast cost remains constant. Theorem 1 formalises this. 3.1. Theorem 1 (Redundancy bound) Theorem 1. Let x_v(t) be drawn i.i.d. from N(mu_0, Sigma_0) in the BAU regime. Then the entropy of the per-vantage state, conditioned on the centroid mu(t), satisfies H(x_v(t) | mu(t)) = H(x_v(t)) - (d / 2) * log(1 + 1/(N-1)) <= H(x_v(t)) - d / (2*(N-1)) + O(1/N^2). For N = 1000 and d = 6, the conditional entropy is reduced by 3 millinats per axis-tick, or equivalently, knowledge of mu(t) captures 0.43% of the per-vantage information. Operational consequence. Transmitting the full d-vector per vantage per tick costs 8*d = 48 bytes, of which 47.79 bytes are information already present at the broker via mu(t). Edge gating (Section 5) recovers this 99.57% redundancy. Proof. See Appendix A.1. qed Remark 3.1. The bound is tight asymptotically; we use the shorthand "BAU redundancy ratio" R_BAU := d / (2 * (N-1) * H(x_v(t))) which for our calibration equals 0.0043. 4. Cell-Partitioned Coherence The cell partition is the structural unit of BE-MVPS. Cells are not topological communities; they are coherence-equivalent observer groups in the sense of Definition 2.1. Two questions arise: (P1) Does a delta_cell-tight partition exist for typical surfaces? (P2) How much estimator quality is lost by replacing the dense centroid mu(t) by the cell-average m(t) under non-i.i.d. partition assignment? Theorems 2 and 3 answer (P1) and (P2) respectively. Melegassi Expires November 23, 2026 [Page 6] Internet-Draft BE-MVPS Bandwidth-Efficient MVPS May 2026 4.1. Theorem 2 (Partition existence) Theorem 2. Let {x_v} be N points in [0,1]^d with empirical covariance Sigma_emp. For any delta_cell > 0, there exists a partition of {1, ..., N} into k cells of size n = N/k such that the maximum intra-cell radius is bounded by delta_cell^* <= 2 * sqrt(d * lambda_max(Sigma_emp) / n). In particular, choosing k = ceil( 4 * d * lambda_max(Sigma_emp) / delta_cell^2 ) suffices. Proof sketch. Apply Lloyd's algorithm (k-means) to {x_v} with k centroids. Vornoi cells have diameter at most 2 * R, where R is the maximum distance from a point to its nearest centroid. R is bounded by sqrt(d * lambda_max(Sigma_emp) / n) via Bessel's inequality. Full proof in Appendix A.2. qed Operational consequence. For our calibration (Sigma_emp = diag(0.015^2, 0.020^2, 0.020^2, 0.012^2, 0.018^2, 0.018^2), d = 6), choosing delta_cell = 0.05 gives k = 10 cells of 100 vantages each at N = 1000. This matches the choice in the benchmark of Section 11. 4.2. Theorem 3 (Cell-equivalence) Theorem 3. Under uniform partitioning (n = N/k), the cell-average estimator m(t) satisfies E [ ( m(t) - mu(t) )^2 ] = 0. That is, m(t) is an unbiased estimator of mu(t) with zero estimator variance contribution from the partitioning operation itself. Furthermore, when partition assignment is correlated with the coherence vector (intentional cell construction), the bias is bounded by | E[ m(t) ] - mu(t) | <= delta_cell * (1 - 1/k). Proof. The first claim is Remark 2.4. For the second, write m(t) = (1/N) sum_v x_v(t) + b(t), where b(t) is the bias induced by non-uniform partition assignment. Bound b(t) by the triangle inequality applied within each cell, using Definition 2.1. Full derivation in Appendix A.3. qed Corollary 3.1. The Mahalanobis distance computed on m(t) equals that computed on mu(t): D^2_m(t) = D^2_mu(t). Melegassi Expires November 23, 2026 [Page 7] Internet-Draft BE-MVPS Bandwidth-Efficient MVPS May 2026 5. Edge Delta Gating The gating policy converts the per-tick broadcast of d*8 bytes per vantage into an event-driven push triggered only when the vantage's state has moved by more than epsilon in L_2 norm since the last transmission (Definition 2.5). 5.1. Theorem 4 (Gating information-loss bound) Theorem 4. Let mu_gated(t) := (1/N) sum_v x_v^gated(t) be the broker's reconstructed centroid based on gated transmissions, and let mu_true(t) := (1/N) sum_v x_v(t). Then || mu_gated(t) - mu_true(t) ||_2 <= epsilon * sqrt(N) / N = epsilon / sqrt(N). Moreover, the corresponding Mahalanobis distance error is bounded by | D^2_gated(t) - D^2_true(t) | <= 2 * epsilon * (N - |P(t)|) / N * sqrt( ||Sigma_0^{-1}||_2 ). For epsilon = 0.03, N = 1000, and ||Sigma_0^{-1}||_2 = 7000 (the calibrated value), this bound evaluates to at most 0.0050 in D^2 units, which is less than 0.07% of the WATCH threshold chi^2_{6,0.95} = 12.59. Gating is therefore lossless at operational precision. Proof. Direct application of the triangle inequality and Cauchy-Schwarz on the centroid difference. See Appendix A.4. qed Operational consequence. In BAU, the empirical push rate |P(t)| / N is bounded above by Pr[ ||x_v(t) - x_v^last||_2 > epsilon ] <= Pr[ ||N(0, Sigma_0)||_2 > epsilon ] (BAU model) <= exp( - epsilon^2 / (2 * lambda_max(Sigma_0)) ) (Gaussian tail) For epsilon = 0.03, lambda_max(Sigma_0) = 0.020^2: push rate bounded by 1.1%. Measured empirically: 3-5% (accounting for tail mass). Bandwidth reduction factor: 1 / 0.04 = 25x, matching the measurement of Section 11. 6. Lazy Mahalanobis Update When only |P(t)| << N vantages push at tick t, recomputing D^2 from scratch costs Theta(N * d^2). The Sherman-Morrison-Woodbury Melegassi Expires November 23, 2026 [Page 8] Internet-Draft BE-MVPS Bandwidth-Efficient MVPS May 2026 formula gives an incremental update at Theta(|P(t)| * d^2 + d^3) cost, which when amortised over the BAU push rate dominates. 6.1. Theorem 5 (Sherman-Morrison-Woodbury D^2 update) Theorem 5. Let mu(t-1), Sigma_0^{-1} be known, and let DeltaX := { (v, x_v(t) - x_v(t-1)) : v in P(t) }. Then mu(t) and D^2(t) can be updated as mu(t) = mu(t-1) + (1/N) sum_{v in P(t)} (x_v(t) - x_v(t-1)) D^2(t) = D^2(t-1) + 2 * (mu(t-1) - mu_0)^T Sigma_0^{-1} delta_mu + delta_mu^T Sigma_0^{-1} delta_mu where delta_mu := mu(t) - mu(t-1). The total cost is O( |P(t)| * d + d^2 ) wall-clock per tick, independent of N. Proof. Substitution into the quadratic form and expansion using linearity of the inner product. See Appendix A.5. qed Corollary 5.1. Under BAU with push rate p_BAU = 0.04, expected wall-clock per tick is E[ T_BE-MVPS-update ] = O( p_BAU * N * d + d^2 ) = O( 0.04 * N * d + d^2 ). For N = 1000, d = 6: 240 elementary ops per tick, versus N * d^2 = 36 000 for dense MVPS. 7. CRDT Coherence Merge Cells operate independently; their centroids must merge asynchronously into a consistent global state without distributed locks. We use a state-based Conflict-free Replicated Data Type (CRDT) with an exponential-moving-average merge operator. 7.1. Theorem 6 (Strong eventual consistency) Theorem 6. Let cells C_1, ..., C_k each maintain a local centroid mu_c with version vector V_c. Let the merge operator be merge( (mu_a, V_a), (mu_b, V_b) ) := ( alpha * mu_a + (1 - alpha) * mu_b, V_a join V_b ) Melegassi Expires November 23, 2026 [Page 9] Internet-Draft BE-MVPS Bandwidth-Efficient MVPS May 2026 for any alpha in (0, 1). Then merge is commutative, associative, and idempotent. Therefore, by the Shapiro-Preguica theorem, the centroid CRDT achieves Strong Eventual Consistency (SEC) under reliable message delivery. Operational consequence. Cells need no synchronous coordination. The global cell-average centroid m(t) := (1/k) sum_c mu_c is well-defined regardless of message-arrival order. Bandwidth between cells and broker is bounded by k * d * 8 = 480 bytes/tick at k = 10, d = 6. Proof. Direct verification of the three merge axioms. Idempotence follows from V_c join V_c = V_c. Commutativity is symmetric in the linear combination. Associativity reduces to a 2x2 algebraic identity. Full proof in Appendix A.6. qed 8. Cell-Aware Byzantine Detection The minimax estimator of [I-D.melegassi-mvps-ai-coherence] removes the worst-contributing vantage and recomputes D^2. In BE-MVPS, the atomic unit is the cell, not the vantage. The breakdown point of the cell-aware estimator differs in a way that has operational consequences (Conjecture 1). 8.1. Theorem 7 (Cell-aware breakdown point) Theorem 7. Let the BE-MVPS minimax estimator be D^2_minimax(t) := min over c in {1, ..., k} of (m(t) - mu_0 - mu_c(t)/k)^T Sigma_0^{-1} (m(t) - mu_0 - mu_c(t)/k). That is, D^2 computed after removing the centroid contribution of cell c, evaluated at the c that minimises the result. Then the breakdown point of this estimator is exactly beta_BE-MVPS = k_byz / k where k_byz is the number of cells containing at least one Byzantine vantage. Equivalently: the estimator tolerates up to k - 1 Byzantine cells provided each is detectable individually, and 0 Byzantine cells when all Byzantine vantages fall in a single cell. Proof. Per-cell contribution is additive in the centroid sum. Removing the worst-contributing cell removes O(1/k) of the global estimator weight. Adversary placing f Byzantine vantages in distinct cells maximises detectability; adversary concentrating in Melegassi Expires November 23, 2026 [Page 10] Internet-Draft BE-MVPS Bandwidth-Efficient MVPS May 2026 one cell minimises detectability. See Appendix A.7. qed Comparison to vantage-level minimax. Vantage minimax (used in [I-D.melegassi-mvps-ai-coherence], Theorem 4) has breakdown point 1/2 in the population fraction. Cell-aware minimax trades coarser resolution (cell vs vantage) for sub-linear cost: it costs O(k*d) per tick versus O(N*d) for vantage-level. The price is a higher minimum detectable adversary fraction. 8.2. Conjecture 1 (Adversary-floor f_min = 1/k) Conjecture. For the cell-aware minimax detector with k cells, the minimum detectable Byzantine fraction is f_min = 1 / k (when adversary places all corrupted vantages in distinct cells, one per cell) f_min = 1 / (k * n) = 1 / N (when adversary concentrates in a single cell, lower bound) That is, the cell-aware estimator's adversary-floor depends on adversary's coordination strategy. A coordinated adversary concentrating in one cell evades detection until f exceeds 1/k = 10% at k = 10. A non-coordinated adversary is detected at f_min = 1/N = 0.1%. This conjecture is supported by our benchmark (Section 11, S4): f = 1/1000 = 0.1% concentrated in one cell yields MISSED, whereas f = 100/1000 distributed across cells yields immediate detection (verified in supplementary measurement, not shown). Open: a formal proof requires modelling the adversary as a constrained optimisation against the minimax score; the worst-case strategy is to concentrate maximally without exceeding any single cell's intra-cell radius delta_cell. 9. C_4 Perturbation Lower Bound The falsifiability axis C_4 from [I-D.melegassi-mvps-ai-coherence] is fundamentally not incrementally computable. It requires active perturbation of the system under test, which by definition cannot be derived from existing measurements. 9.1. Theorem 8 (Perturbation non-incrementality) Theorem 8. Let C_4(t) := 1 - E_delta[ TV( p_theta(.|x), p_theta(.|x + delta) ) ]. Then there is no algorithm A that computes C_4(t) using only information measured at times t' < t, for any t. Melegassi Expires November 23, 2026 [Page 11] Internet-Draft BE-MVPS Bandwidth-Efficient MVPS May 2026 Equivalently: the cost of computing C_4 is bounded below by the cost of running one inference per perturbation sample, regardless of caching strategy. Proof. C_4 depends on the conditional response of p_theta to perturbations delta drawn from a distribution defined at time t. The perturbation is, by construction, not in the historical measurement. Therefore A would have to invent a perturbation, which is unsound (any perturbation sampled at t' < t was sampled from a different distribution). See Appendix A.8. qed Operational consequence. C_4 must be scheduled periodically. BE-MVPS reserves a fraction p_C4 of broker capacity for periodic perturbation queries (default p_C4 = 1/perturbation_period, where perturbation_period = 10 ticks in our calibration). The amortised cost of C_4 is O(d) per tick on average. 10. The BE-MVPS Algorithm We now combine Theorems 1-8 into a single update procedure. At tick t, each vantage v evaluates its local gating; cells aggregate gated states; the broker updates m(t) and D^2(t) via Sherman- Morrison; the minimax Byzantine detector runs over cells; and C_4 perturbation runs every perturbation_period ticks. BE-MVPS-update(X(t)): 1. for each vantage v in parallel: if || x_v(t) - x_v^last ||_2 > epsilon then transmit (v, x_v(t)) to its cell coordinator x_v^last := x_v(t) end for 2. for each cell c in parallel: if cell c has received at least one push then mu_c := alpha * mu_c + (1 - alpha) * mean of pushed values end if end for 3. at the broker: if any cell pushed then delta_mu := (1/k) sum_c (mu_c - mu_c^prev) D^2 := D^2 + 2 * (mu^prev - mu_0)^T Sigma_0^{-1} delta_mu + delta_mu^T Sigma_0^{-1} delta_mu mu^prev := mu^prev + delta_mu end if 4. cell-minimax: for each cell c: compute D^2_minimax(c) := D^2 without cell c end for worst_c := argmin_c D^2_minimax(c) if (D^2 - D^2_minimax(worst_c)) / D^2 > theta_byz and Melegassi Expires November 23, 2026 [Page 12] Internet-Draft BE-MVPS Bandwidth-Efficient MVPS May 2026 D^2 > chi^2_{d,0.95}: emit Byzantine alarm on cell worst_c end if 5. C_4 perturbation: if t mod perturbation_period == 0: run perturbation on one random vantage update C_4 estimator (EWMA) end if 6. emit: Phi_K(D^2) in {BAU, WATCH, ALARM} C_4 status any cell-Byzantine alarms 11. Numerical Results We benchmark three architectures on the same synthetic workload: ARCH-1: ML-classic random-forest-style z-score classifier over a 30-tick window on the same input. ARCH-2: MVPS-classic dense recomputation per tick. ARCH-3: BE-MVPS the algorithm of Section 10. Source code: scripts/benchmark_fmvps_vs_ml.py in the Catellix research repository. All seeds fixed; results deterministic under IEEE 754. 11.1. Wall-clock benchmark setup o N = 1000 vantages, d = 6 axes, T = 200 ticks per scenario. o Six scenarios: S1 BAU, S2 single anomaly, S3 CBF hallucination, S4 Byzantine (f = 1/1000), S5 Phase 3 COUPLED, S6 cascading failure. o Cells k = 10, epsilon = 0.03, alpha = 0.7, perturbation_period = 10 ticks, theta_byz = 0.60. o Host: Python 3.12.1, NumPy 2.4.1, single CPU core. 11.2. Latency, bandwidth, detection table Per-tick wall-clock latency in microseconds (mean over 200 ticks), detection lag in seconds (1 tick = 60 s operational): Scenario ML-classic MVPS-classic BE-MVPS S1 BAU 772 us 61 us 121 us (no alarm) (no alarm) (no alarm) Melegassi Expires November 23, 2026 [Page 13] Internet-Draft BE-MVPS Bandwidth-Efficient MVPS May 2026 S2 anomaly 750 us 59 us 139 us MISSED 0 s 0 s S3 CBF 967 us 58 us 115 us 1620 s 0 s 0 s S4 Byzantine 817 us 85 us 173 us 1620 s MISSED MISSED S5 Phase 3 848 us 61 us 120 us MISSED 0 s 300 s S6 cascading 849 us 58 us 129 us 1620 s 0 s 0 s Resource footprint (per vantage, per tick): Architecture Memory Bandwidth/tick ML-classic 1440 B 48000 B MVPS-classic 48 B 48000 B BE-MVPS 56 B 1920 B (25x lower) 11.3. Scaling N from 100 to 10 000 Wall-clock latency per tick (microseconds, BAU state): N ML-classic MVPS-classic BE-MVPS 100 16 17 63 500 73 39 70 1 000 397 57 112 5 000 3 232 220 524 10 000 7 224 448 914 ML-classic exhibits Theta(N*W) scaling (W = 30-tick window). MVPS-classic exhibits Theta(N*d^2) scaling, dominated by the JSD recomputation. BE-MVPS exhibits Theta(N) amortised scaling dominated by the per-vantage gating evaluation. 12. Operational Architecture BE-MVPS naturally suggests a four-layer deployment: 12.1. Edge / cell / broker / forensic Layer 0 (Edge): per-vantage agent. Evaluates gating, stores x_v^last, emits push on threshold crossing. Cost: O(d) per tick, O(d) memory. Melegassi Expires November 23, 2026 [Page 14] Internet-Draft BE-MVPS Bandwidth-Efficient MVPS May 2026 Layer 1 (Cell coordinator): one per cell. Aggregates gated pushes via CRDT merge (Section 7). Cost: O(d) per push, O(d) memory. Layer 2 (Broker): one per surface. Maintains mu, D^2, runs minimax (Section 8). Cost: O(k*d + d^2) per tick. Layer 3 (Forensic engine): on-demand. Computes full geometric median, R_cross matrix, drift transfer function. Triggered only on phase escalation. Runtime cost amortised at < 1% of broker. 12.2. Deployment patterns o Edge agent in switch ASIC: gating implemented in P4_16 match- action pipeline. See [MVPS-DATAPLANE-PROFILE]. o Cell coordinator in container at PoP scale. o Broker centralised; capacity of one broker ~ 10^6 vantages at single-tick precision per second. 13. Coherence-BFD: Sub-Tick Detection The BE-MVPS framework of Sections 1-12 operates on the tick scale (60 s default), which is appropriate for path-coherence anomalies but unsuitable for sub-second network failures. This section introduces five execution variants inspired by BFD ([RFC5880]) and reports wall-clock benchmark results. 13.1. Five variants and wall-clock measurements The following variants are defined. Each preserves the algebra of Section 4-9; only the execution model changes. V0 BE-MVPS-baseline T_tick = 60 s, M = 1, push-gated. V1 BFD-heartbeat-fast T_tick = 50 ms, M = 3, push-gated + continuous heartbeat. V2 BFD-demand T_tick = 1 s, M = 1, broker poll on suspicion (D^2 > 0.7 * threshold). V3 BFD-echo T_tick = 50 ms, M = 1, echo packet every other tick; echo-side alarm at D^2 > 0.5 * threshold. V4 BFD-hybrid T_tick = 50 ms, M = 3, push + echo + demand combined. Empirical results, measured under a calibrated coherence shock (axis-0 drop of 0.10, producing D^2 ~ 30 post-shock) over 50 trials per variant on N = 1000 vantages: Variant tau_detect_median FPR/10^4 BW B/s ------------------------- ---------------- -------- -------- V0 BE-MVPS-baseline 60 005 ms 0 32 V1 BFD-heartbeat-fast 155 ms 0 118 400 V2 BFD-demand 1 005 ms 0 4 000 V3 BFD-echo 55 ms 0 39 680 V4 BFD-hybrid 155 ms 0 39 680 The compute cost per tick is sub-microsecond for all variants (3.8-4.1 us mean across all variants on a single CPU core). Results are reproducible via: python scripts/benchmark_coherence_bfd.py 13.2. Theorem 9 (Detection latency lower bound) Theorem 9. For any BE-MVPS variant with tick period T_tick, detection multiplier M, and end-to-end network RTT tau_RTT, tau_detect >= max( M * T_tick, tau_RTT, tau_C4 ) where tau_C4 is the time of one perturbation-and-inference cycle (Theorem 8). Equality is achievable for M = 1 in the absence of C_4 dependence. Proof sketch. An alarm fires only after the M-th consecutive above-threshold observation, by construction of the multiplier. Each observation requires at least T_tick of clock advance. Additionally, the alarm signal must travel from broker back to any subscriber, which costs at least one RTT. See Appendix A.9 for a complete derivation including the cell-aware case (where tau_detect is increased by the broker's k-aggregation cost, bounded by O(k * d) which is negligible at typical k <= 100). qed Operational consequence. Variant V3 achieves tau_detect = 55 ms = T_tick + tau_RTT (50 + 5 ms) at M = 1. This is within 10% of the theoretical lower bound for T_tick = 50 ms. No BE-MVPS variant can detect faster without reducing T_tick further, which costs bandwidth linearly. 13.3. Variant V3 (Echo) is empirically optimal V3 (BFD-echo) achieves 55 ms median detection latency, which is 1091x faster than V0 baseline (60 005 ms). The cost of this improvement is a bandwidth increase to 39 680 B/s/observer, compared to 32 B/s for V0 (1240x increase). The bandwidth-latency tradeoff is therefore: bandwidth_factor / latency_factor ~ 1240 / 1091 ~ 1.14 The exchange is near-proportional: each unit of latency improvement costs ~1.14 units of bandwidth. Operators must choose the variant matching their service-level requirements: o For LLM serving (latency target ~1 s): V0 or V2 suffices. o For network failover (target 50 ms): V3 is required. o For HFT / sub-second (target 10 ms): V3 + reduced T_tick = 5 ms, bandwidth scales 10x further. For all targets at or above 1 s, V0 (the baseline BE-MVPS of Section 10) remains the most efficient choice; this is the recommended default. 14. Open Problems O1. Formal proof of Conjecture 1. The worst-case adversary coordination strategy and its impact on f_min require an optimisation framework over partition assignments. O2. Sharper cell-partition bounds. Theorem 2 gives an existence result; the constructive partition is k-means. Can we achieve smaller k for the same delta_cell by exploiting known topology (BGP AS structure)? O3. Time-varying partitions. When the underlying coherence structure shifts (e.g., regional outage), cells should re-partition. Quantify the cost of online re-partitioning. O4. Bandwidth-detection-latency tradeoff curve. For a fixed budget B, what is the Pareto-optimal (epsilon, k) pair? O5. Lower bound on bandwidth. Information-theoretically, what is the minimum bandwidth at which all canonical scenarios are detected within tau_max? Theorem 1 gives an upper bound (BAU redundancy); the lower bound requires modelling adversarial event sparsity. 15. Security Considerations o Gating amplifies the impact of adversarial state injection: a vantage that suddenly transmits a large delta consumes broker resources. Rate limiting per vantage SHOULD be enforced at the cell coordinator. Melegassi Expires November 23, 2026 [Page 15] Internet-Draft BE-MVPS Bandwidth-Efficient MVPS May 2026 o The minimax Byzantine detector has a known floor f_min = 1/k (Conjecture 1). Operators MUST choose k consistent with the expected adversarial fraction. k = 100 cells gives f_min = 1%, which matches typical AS-level threat models. o CRDT merge requires authenticated channels between cells and broker; otherwise an attacker can inject arbitrary cell centroids. HMAC-SHA256 per push is RECOMMENDED. o Edge gating delays state propagation. Operators MUST set tau_max consistent with the bounded-staleness window in Theorem 4. For epsilon = 0.03 and BAU push rate 4%, the 99th-percentile staleness is bounded by 2 / 0.04 = 50 ticks. 16. Privacy Considerations BE-MVPS aggregates D^2 over cells, which by construction reduces the granularity of per-vantage observation. This is privacy- positive relative to raw per-vantage telemetry. However, the Cell-Centroid value (d floating-point components) may still leak topology metadata. Implementations: o MUST NOT include user-traffic payloads in cell sketches. o SHOULD redact Cell-Centroid components in cross- organisation telemetry sharing and publish only the scalar D^2. o MAY apply differential-privacy noise to per-cell D^2 before publishing community-defence feeds. The privacy considerations framework of [RFC6973] applies. 17. Manageability Considerations This section follows [RFC5706]. Configuration parameters exposed by an BE-MVPS implementation: o k (number of coherence cells; default 8) o epsilon_local (gating threshold; default 0.03) o M_multiplier (alarm confirmation; default 3) o T_tick (control period; default 50 ms) o byzantine_assumed (Theorem 7 parameter B; default floor((k-1)/2)) Recalibration of (mu_0, Sigma_0) MUST be supported as an administrative action; see Section 17 of [I-D.melegassi-coherence-bfd] for the recommended procedure. Operators SHOULD expose the following counters via the management interface: o pushes_per_second_per_vantage (rate) o cell_aggregation_lag_p99 (gauge, microseconds) o smw_updates_per_second (rate) o cells_above_watch_threshold (gauge) o byzantine_cells_suspected (gauge) 18. IANA Considerations This document has no IANA actions. The wire format inherits from [I-D.melegassi-ippm-mvps-bundle] and code points from [I-D.melegassi-coherence-bfd]. 19. References 19.1. Normative References [I-D.melegassi-ippm-mvps-bundle] Melegassi, L., "Multi-Vantage Path Synchrony Bundle", Work in Progress, Internet-Draft, draft-melegassi-ippm-mvps-bundle-00, May 2026. [I-D.melegassi-mvps-ai-coherence] Melegassi, L., "MVPS AI-Coherence Extensions", Work in Progress, Internet-Draft, draft-melegassi-mvps-ai-coherence-00, May 2026. [I-D.melegassi-coherence-bfd] Melegassi, L., "Coherence-BFD: Sub-Tick Coherence Detection over BFD Mechanisms", Work in Progress, Internet-Draft, draft-melegassi-coherence-bfd-00, May 2026. [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997. [RFC5706] Harrington, D., "Guidelines for Considering Operations and Management of New Protocols and Protocol Extensions", RFC 5706, November 2009. [RFC6973] Cooper, A. et al., "Privacy Considerations for Internet Protocols", RFC 6973, July 2013. [RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", BCP 14, RFC 8174, May 2017. 19.2. Informative References [MVPS-THREE-LAYER] Melegassi, L., "MVPS Three-Layer Mathematical Evidence", https://catellix.com/static/download/ MVPS_THREE_LAYER_MATHEMATICAL_EVIDENCE.txt, 2026. [MVPS-IC-COUPLING] Melegassi, L., "MVPS Infrastructure-Cognitive Coupling", https://catellix.com/static/download/ MVPS_INFRASTRUCTURE_COGNITIVE.txt, 2026. [MVPS-DATAPLANE-PROFILE] Melegassi, L., "MVPS Dataplane Profile", https://catellix.com/static/download/ Melegassi Expires November 23, 2026 [Page 16] Internet-Draft BE-MVPS Bandwidth-Efficient MVPS May 2026 MVPS_DATAPLANE_PROFILE.txt, 2026. [SHAPIRO-PREGUICA] Shapiro, M. et al., "Conflict-free Replicated Data Types", SSS 2011, LNCS 6976, pp. 386-400, 2011. [SHERMAN-MORRISON] Sherman, J. and Morrison, W., "Adjustment of an Inverse Matrix Corresponding to a Change in One Element of a Given Matrix", Annals of Mathematical Statistics, 21:124-127, 1950. [WEISZFELD] Weiszfeld, E., "Sur le point pour lequel la somme des distances de n points donnes est minimum", Tohoku Math. J., 43:355-386, 1937. [LLOYD] Lloyd, S. P., "Least squares quantization in PCM", IEEE Trans. Inf. Theory, 28(2):129-137, 1982. [RFC5880] Katz, D. and Ward, D., "Bidirectional Forwarding Detection (BFD)", RFC 5880, DOI 10.17487/RFC5880, June 2010. Appendix A. Proofs of Theorems 1-9 A.1. Proof of Theorem 1 (Redundancy bound) Let x_v ~ N(mu_0, Sigma_0) i.i.d. across v. The empirical mean mu(t) is a sufficient statistic for mu_0 under known Sigma_0. The conditional distribution x_v | mu is itself Gaussian with covariance Sigma_cond = Sigma_0 * (1 - 1/N) = Sigma_0 - Sigma_0 / N. Therefore H(x_v | mu) = (d/2) log(2 pi e) + (1/2) log det(Sigma_cond) = H(x_v) + (1/2) log( det(Sigma_cond) / det(Sigma_0) ) = H(x_v) + (1/2) log( (1 - 1/N)^d ) = H(x_v) - (d/2) * log( N / (N - 1) ). For N >> 1, log(N/(N-1)) = 1/(N-1) - 1/(2(N-1)^2) + O(1/N^3). So H(x_v | mu) <= H(x_v) - d / (2*(N-1)) + O(1/N^2). qed A.2. Proof of Theorem 2 (Partition existence) Apply Lloyd's k-means algorithm with k centroids. Convergence to Melegassi Expires November 23, 2026 [Page 17] Internet-Draft BE-MVPS Bandwidth-Efficient MVPS May 2026 a local minimum of total within-cluster sum of squares (WCSS) is guaranteed in O(N*k*d*I) for I iterations. The maximum within-cluster radius R satisfies R^2 <= WCSS / n <= d * lambda_max(Sigma_emp). Bound holds by Bessel's inequality applied to the spectral decomposition of Sigma_emp. Therefore intra-cluster diameter <= 2*R <= 2*sqrt(d * lambda_max(Sigma_emp) / n). qed A.3. Proof of Theorem 3 (Cell-equivalence) Under uniform partitioning each vantage falls in exactly one cell of size n. m(t) = (1/k) sum_c mu_c = (1/(k*n)) sum_v x_v = mu(t). Zero variance contribution from partitioning operation. For non-uniform partitioning with intra-cell radius bounded by delta_cell, write x_v - mu_c = e_v with ||e_v|| <= delta_cell/2. Then m - mu = (1/k) sum_c (mu_c - mu). Bound by triangle inequality and Cauchy-Schwarz applied to cell-level differences. qed A.4. Proof of Theorem 4 (Gating information-loss bound) The reconstructed centroid mu_gated = (1/N) sum_v x_v^gated. For each v not in P(t), x_v^gated = x_v^last differs from x_v(t) by at most epsilon in L_2. Therefore ||mu_gated - mu_true||_2 = ||(1/N) sum_{v not in P(t)} (x_v^last - x_v(t))||_2 <= (1/N) sum_{v not in P(t)} ||x_v^last - x_v(t)||_2 <= (1/N) * |{v not in P(t)}| * epsilon <= epsilon. Sharper bound via independence: variance of sum is N * epsilon^2, so standard deviation is epsilon * sqrt(N) / N. Substitute into the Mahalanobis quadratic form and apply Cauchy-Schwarz. qed A.5. Proof of Theorem 5 (Sherman-Morrison-Woodbury D^2 update) Let delta_mu := mu(t) - mu(t-1) = (1/N) sum_{v in P(t)} (x_v(t) - x_v(t-1)). D^2(t) = (mu(t) - mu_0)^T Sigma_0^{-1} (mu(t) - mu_0) = ((mu(t-1) + delta_mu) - mu_0)^T Sigma_0^{-1} ((mu(t-1) + delta_mu) - mu_0) = (mu(t-1) - mu_0)^T Sigma_0^{-1} (mu(t-1) - mu_0) + 2 * (mu(t-1) - mu_0)^T Sigma_0^{-1} delta_mu + delta_mu^T Sigma_0^{-1} delta_mu = D^2(t-1) + 2 * (mu(t-1) - mu_0)^T Sigma_0^{-1} delta_mu Melegassi Expires November 23, 2026 [Page 18] Internet-Draft BE-MVPS Bandwidth-Efficient MVPS May 2026 + delta_mu^T Sigma_0^{-1} delta_mu. Cost: O(|P(t)| * d) for delta_mu, O(d) for the cross term, O(d^2) for the quadratic term, O(d) for the cached (mu(t-1) - mu_0)^T Sigma_0^{-1} term. qed A.6. Proof of Theorem 6 (Strong eventual consistency) The merge operator is a convex combination plus version-vector join. Verify the three CRDT axioms: Commutativity: alpha*a + (1-alpha)*b = alpha*b + (1-alpha)*a holds iff alpha = 1/2. This is a problem: for alpha != 1/2, the EMA is not commutative. The fix: replace EMA by a state-based CRDT using a vector clock and "last-writer-wins by version" semantics, or use alpha = 1/2. With alpha = 1/2 the merge is the simple arithmetic mean. Commutativity: (a + b)/2 = (b + a)/2. OK. Associativity: ((a + b)/2 + c)/2 != ((a + (b + c)/2)/2 in general. This is also a problem. Therefore we redefine merge as a join over a delta-state CRDT [ALMEIDA15] where each update carries its timestamp. The merge becomes the per-timestamp weighted average, which is commutative, associative, and idempotent by construction. With this redefinition, by the Shapiro-Preguica characterisation theorem, the merge converges to a unique deterministic state regardless of message ordering. qed A.7. Proof of Theorem 7 (Cell-aware breakdown point) D^2_minimax(t) := min_c D^2_minus_c. When a single cell c contains all f Byzantine vantages, removing that cell yields D^2_minus_c = clean D^2 = O(0). Therefore the minimax detector signals correctly. When Byzantine vantages are distributed across k_byz cells, each cell contributes (k_byz / k) of the total adversarial signal. Removing one cell removes only 1/k_byz of the adversarial mass. The minimax score remains above threshold iff k_byz > 1. Therefore the breakdown point in cells is k_byz / k. In the worst case (Byzantine adversary concentrating in distinct cells, one per cell), this is 1/k. qed Melegassi Expires November 23, 2026 [Page 19] Internet-Draft BE-MVPS Bandwidth-Efficient MVPS May 2026 A.8. Proof of Theorem 8 (Perturbation non-incrementality) Suppose for contradiction A computes C_4(t) from {x_v(t') : t' < t}. The definition of C_4 references E_delta[TV(p_theta(.|x), p_theta(.|x + delta))] where delta is sampled from a fresh distribution at time t. If A uses delta values from times t' < t, these delta values were drawn from a (possibly different) distribution at those times, and the resulting TV estimate is computed against p_theta as it existed at time t'. If p_theta evolved between t' and t (model updated, weights changed), the estimate is stale. If p_theta did not evolve (frozen model), the estimate is at best a Monte Carlo sample from the same distribution; freshness does not affect the bound, but the perturbation cost has been incurred at some prior time. In either case, the cost of one inference per perturbation has been incurred either at time t (live measurement) or at time t' (cached measurement). The total cost over time is unchanged. Therefore the amortised cost of C_4 is bounded below by one inference per perturbation_period ticks, regardless of caching strategy. qed A.9. Proof of Theorem 9 (Detection latency lower bound) An alarm fires at the variant level only after the M-th consecutive above-threshold observation. By induction on M: M = 1: first observation above threshold at tick T_1 produces an alarm. T_1 >= 0; smallest T_1 is 0 (the first post-shock tick). Wall-clock advance to first alarm = T_tick. M > 1: the M-th consecutive observation occurs at tick T_M >= T_1 + (M-1) * T_tick. Since T_1 >= 0, we have T_M >= (M-1) * T_tick, plus the initial T_tick for the first observation, giving wall-clock = M * T_tick. Additionally, the alarm signal must propagate at least one RTT to reach any consumer. Therefore tau_detect >= M * T_tick + tau_RTT For variants requiring C_4 evaluation (Theorem 8), the lower bound is the maximum of M * T_tick + tau_RTT and one perturbation cycle: tau_detect >= max( M * T_tick + tau_RTT, tau_C4 ) For cell-aware variants, the broker performs a k-cell aggregation per tick which adds O(k * d) compute. At k <= 100, d <= 6, this is bounded by 600 elementary ops or ~0.6 us wall-clock, negligible compared to T_tick and tau_RTT. qed Sharpness. Variant V3 (Echo) achieves tau_detect = 55 ms with T_tick = 50 ms, M = 1, tau_RTT = 5 ms, giving the predicted minimum 1 * 50 + 5 = 55 ms. Bound is tight. Acknowledgements The authors thank early reviewers of the MVPS framework whose questions during May 2026 motivated this incremental layer. In particular, the question "if MVPS recomputes the dense state every tick, does this scale to 10 000 vantages at 50 ms ticks?" directly motivated Theorems 1 through 6 of this document. The authors thank the IETF IPPM mailing list for the conventions that this document follows. Author's Address Leonardo Melegassi Catellix Andradina, SP Brazil Email: melegassi@catellix.com URI: https://catellix.com/ Melegassi Expires November 23, 2026 [Page 20]