What to verify next

A plan has been scored. The commander has a favourite. Now the loop has to close: which beliefs is the decision leaning on, which open questions would most separate the adversary COAs, and which artefacts are stale because a source changed? Three analysis services, three theses — and none of them invents a new engine. They are all the existing scorer and trace graph, used differently.

Thesis E — sensitivity: “what am I betting on?”

Classical sensitivity analysis asks: which input, if wrong, changes the decision? The canonical tool is the tornado diagram — perturb each input to its band edges, measure how much the output moves, rank by movement. ASSAY’s version perturbs each answered knowledge item via the existing knowledge_overrides hook (DEC-10: the scorer called in a loop, never a new engine), counts how many commitment verdicts change, and ranks by that count.

Why tornado and not Monte Carlo or Sobol indices? Because both require a distributional assumption inside each band — exactly the false precision DEC-15 forbids. A band is “somewhere in here, we don’t know where.” Inventing a distribution inside it would be a lie. The tornado approach uses only the two extremes the assessment actually commits to.

K8 tops the ranking

Illustrative widget, fixture data. The sensitivity ranking over Meridian: K8 (Carrick Head battery radar) tops the list because perturbing its band edge flips C4 from robust to violated. The single-source badge is an ICD 203 provenance flag, not a ranking factor. Frozen as shipped on 2026-07-14.

K8 is the assessment that the Carrick Head battery fire-control radar is “non-operational” — based on one intercepted maintenance return. Push its band edge to “operational” and the battery threatens the north approach: C4 verdicts collapse. The sensitivity ranking says the decision depends on this. The single-source badge says and there’s no cross-check. Together they answer the doctrinal question: “what should the J-2 verify next?” (JP 2-01.3 ch. IV, counters to deception).

Thesis D — discrimination: “which question separates the COAs?”

The discrimination value of an open question is how much answering it would clarify which adversary COA is in play. The natural framework is Bayesian experimental design — maximise expected Shannon entropy reduction over the COA set. But that requires a probability distribution over the COA set, and the scenario_weight firewall forbids scenario weights from entering any computation.

What works instead: band separation. The vignette’s miniature event matrix (DEC-18) already defines, for each open question, the expected-answer band under each COA. If two COAs’ bands are disjoint, one observation discriminates. If they overlap, the question is uninformative for that pair. The separation is a geometric property of the data the analyst actually has — no distributional assumption, no scenario weights, no invented information metric.

K11 beats K13

Illustrative widget, fixture data. The discrimination ranking over Meridian: K11 (mines at Ledger quay) discriminates strongly between R1 and R2 — its expected-answer bands are disjoint ([0.0, 0.2] vs [0.7, 1.0]). K13 (radio traffic) overlaps on all pairs despite being cheaper. Value and cost are shown alongside, never collapsed (DEC-19). Frozen as shipped on 2026-07-14.

K11 is expensive: 2–4 det-days via KINGFISHER close recon, with extraction deadline consequences (C6). K13 is cheap: 0.2–0.5 det-days via standoff intercept. The ranking places K11 first because it answers the operative question. The cost is shown alongside — the human weighs whether the discrimination value justifies the risk and the resource commitment. The system ranks; it does not task.

Thesis F — staleness: “what did that change invalidate?”

When K9 supersedes K5 (a worse storm forecast arrives), the question is: which downstream artefacts depended on K5 and are now stale? The answer is a transitive forward trace walk from K5’s content hash, following the traceView.ts orientation map coherently across mixed-orientation edges. The walk identifies stale artefacts; it does not recompute them. Flags, then humans decide.

K5 → exactly three stale verdicts

Illustrative widget, fixture data. The staleness walk from K5 (superseded by K9) flags world W1 and exactly the storm-channel-dependent verdicts: P1·C2, P2·C1, P2·C2 — and nothing else. K9-derived artefacts are not flagged (K9 hasn’t been compiled yet). Follows the shipped stalenessFlags component’s rendering. Frozen as shipped on 2026-07-14.

Three deliberate constraints. The walk does not recompute — the planner decides when to recompile, not the system. The walk does not follow the supersedes edge — K9 → K5 is the trigger, not part of the fan-out. And the walk does not flag K9-derived artefacts — K9 is new and has no downstream yet. The precision is the thesis: a changed answer identifies exactly what it invalidates and nothing else.

One loop, three queues

These three analyses close the JIPOE cycle. The J-2’s “Verify next” queue (sorted by sensitivity) answers which answered knowledge item most endangers the current plan. The “Collect next” queue (sorted by discrimination) answers which open question would most separate the live COA set. The staleness flags on S2 answer what is stale right now. All three refresh on recompile or supersession. The commander reads the queues; the J-2 formulates the PIR; the new collection task becomes the next turn’s first move, and the heartbeat repeats.