Deterministic Dispatch at the Seams: Formulation and Evidence Architecture

Scope and Claims

This document is the technical core of the Helios Grid program. The companion brief (BGL/HG—01) argued that Canada’s thirteen semi-autonomous electricity systems — a consequence of Section 92A of the Constitution Act, 1867, which places generation and intra-provincial transmission under provincial jurisdiction (Constitution Act, 1867, s.92A) — waste documented, attributable value at their seams, and that the binding requirement for any coordination layer is auditability rather than predictive skill. This document states how. It specifies the formulation Helios Grid uses to reason about inter-provincial exchange, the evidence architecture that makes each finding reproducible by a hostile counterparty, and the engineering discipline that makes two runs of the engine bit-identical on identical inputs (BGL Memorandum HG-M-101, internal, 2025-09).

Three claims are defended here, and the reader should hold us to all three. First: the mathematics of coordination above sovereign dispatch systems is not exotic. It is the same family of optimization — linear and mixed-integer programming over physical and contractual constraints — that every North American ISO already executes on a five-minute cadence under public tariff (PJM Manual 11; CAISO Tariff §34; MISO BPM-002), and whose price-formation theory has been settled since the non-convex clearing results of O’Neill et al. (EJOR, 2005) and the market-design framework built by Hogan from Schweppe’s spot-pricing foundations (Schweppe et al., 1988; Hogan, 1992). What is exotic is that between those systems the optimization simply stops, and scheduling reverts to instruments — tags, checkout calls, seasonal contracts — that predate the markets themselves (NERC INT-006; NAESB WEQ-004).

Second: a coordination recommendation is worthless at the seam unless every party can independently re-derive it. The Atlantic Loop did not fail on load-flow studies; it failed because no province would accept another party’s accounting of who benefits (CBC, 2023). The institutional literature would not find this surprising — bilateral exchange under private information is exactly the setting where efficient, incentive-compatible, budget-balanced mechanisms are provably impossible in general (Myerson & Satterthwaite, JET 1983), and where trust is manufactured, when it is manufactured at all, by verifiable common records rather than goodwill (Ostrom, 1990; Williamson, 1985). Helios Grid’s response is architectural: the audit trail is the product. Every finding the engine emits carries a hash-chained derivation record tying it to source facts, named constraints, and a re-runnable computation (BGL Engineering Note DAE-EN-77, internal, 2025-11).

Third: determinism is an engineering property, not a marketing word, and it must be earned against specific, documented threats — floating-point non-associativity (IEEE 754-2019; Goldberg, 1991), solver performance variability under seed and permutation changes (Lodi & Tramontani, 2013; Fischetti & Monaci, OR 2014), non-reproducible parallel reduction (Demmel & Nguyen, IEEE TC 2015), and the ordinary entropy of distributed ingestion (Lamport, CACM 1978). Section 8 documents how the D.A.E. run harness closes each of these, and Section 12 reports the internal benchmark — run designation HG-3105 — in which the full thirteen-system synthetic corpus clears an hourly coordination interval in under two seconds on commodity hardware, derivation trail included (BGL Run Ledger HG-3105, internal, sealed).

Two boundaries on scope. Helios Grid does not propose to replace, shadow, or second-guess any provincial dispatch engine; provincial SCED remains sovereign, and everything in this document operates on the layer above it, where today there is no optimization at all. And this is a research document, not a product specification: where the program has open problems — AC feasibility at the interface, incentive-compatible data provision, the governance of the corpus itself — Section 13 names them plainly rather than rounding them away (BGL Adversarial Review Register HG-AR-06, internal, 2026-04).

Dispatch as Practiced: The Mathematics Inside Each Market

To formulate the seam correctly, one must first be precise about what happens on either side of it. Every organized North American market clears through two coupled optimizations. Day-ahead, the operator solves security-constrained unit commitment (SCUC): a mixed-integer linear program that decides which units run, respecting minimum up- and down-times, startup trajectories, ramp limits, reserve requirements, and transmission security constraints, over a 24-hour (and increasingly multi-day) horizon (PJM Manual 11; MISO BPM-002; Padhy, IEEE TPS 2004). In real time, the operator solves security-constrained economic dispatch (SCED): a linear program that re-optimizes output around the fixed commitment roughly every five minutes (CAISO Tariff §34; PJM Manual 11). The formulations are public documents. The tariffs that bind them are public documents. The solver logs are discoverable in disputes. This is the most audited large-scale optimization practice in the world, and it has run at continental scale for two decades.

The lineage matters because it explains why the practice is trusted. Economic dispatch by equal incremental cost is older than the digital computer; optimal power flow was posed in its modern form by Carpentier in 1962 (Carpentier, 1962), and the subsequent sixty years of formulation history — DC linearizations, security constraints, convex relaxations — are surveyed in FERC’s own staff papers and the relaxation literature (Cain, O’Neill & Castillo, 2012; Molzahn & Hiskens, 2019). The economic layer was supplied by Schweppe’s spot-pricing program (Schweppe et al., 1988), operationalized by Hogan’s contract-network design in which congestion rents and nodal price differences become tradable, hedgeable objects (Hogan, 1992), and stress-tested by two decades of market-design scholarship (Wilson, Econometrica 2002; Cramton, 2017; Stoft, 2002). The textbooks that train every market engineer — Wood, Wollenberg & Sheblé; Kirschen & Strbac — teach dispatch as constrained optimization, full stop (Wood et al., 2013; Kirschen & Strbac, 2004).

The property Helios Grid cares about most is where prices come from. In an LMP market, prices are not modeled, estimated, or negotiated; they are read off the solution. The locational marginal price at a node is the dual variable — the shadow price — of that node’s energy-balance constraint in the dispatch LP, decomposable into energy, congestion, and loss components (Schweppe et al., 1988; Stoft, 2002). Duality is what makes the settlement auditable: every dollar of congestion rent reconciles to a named binding constraint with a nonzero multiplier. Where non-convexities (startup costs, minimum output) break the clean duality picture, the market does not abandon optimization — it extends the theory, with the O’Neill et al. equilibrium-restoring prices (EJOR, 2005), convex-hull and extended LMP pricing for uplift minimization (Gribik, Hogan & Pope, 2007), and a regulatory push, in FERC’s price-formation dockets, to shrink and expose whatever residual side payments remain (FERC RM15-24; FERC Order 825; FERC Order 844).

Computationally, this practice rides on one of the quiet triumphs of applied mathematics. The simplex method’s exponential worst case (Klee & Minty, 1972) never materialized in practice; interior-point theory (Khachiyan, 1979; Karmarkar, 1984) and three decades of solver engineering produced machine-independent speedups measured in the millions (Bixby, OR 2002; Koch et al., MIPLIB 2017). A commitment problem that consumed a night of mainframe time in 1985 clears in minutes on a workstation today, and the ISOs solve their MILPs to tariff-specified optimality gaps — typically around a tenth of a percent — with the gap itself a published, contestable number (PJM Manual 11; Achterberg, 2009). Open-source solvers now sit within striking distance of commercial ones on LP workloads (Huangfu & Hall, MPC 2018), a fact that matters later in this document, because Helios Grid’s reproducibility claim requires that a counterparty be able to re-run the mathematics without buying anyone’s license (BGL Engineering Note DAE-EN-83, internal, 2026-01).

Two further facts about practice deserve emphasis because the seam formulation inherits both. First, dispatch optimization is governed optimization: the formulation is not whatever the engineer finds elegant, but what the tariff says, clause by clause — offer caps (FERC Order 831), settlement intervals (FERC Order 825), mitigation rules administered by independent market monitors who re-run the cases (Potomac Economics, MISO State of the Market; Monitoring Analytics, PJM State of the Market). The monitor’s ability to reproduce the operator’s solve is not a courtesy; it is the enforcement mechanism. Second, the practice is deterministic in the sense that matters legally: given the recorded input snapshot — offers, load forecast, outages, limits — the case re-solves to the same dispatch and the same prices, which is why disputes are adjudicated by replay rather than by testimony about intentions (FERC RM15-24; Monitoring Analytics, 2024). Helios Grid’s entire thesis is that these two properties — governed formulation and adjudication-by-replay — stop dead at the market boundary, precisely where Canada is about to spend a generational sum (NRCan, 2026; PMO, 2026). The next section documents that stoppage.

The Unoptimized Seam

Cross the boundary of any organized market and the optimization vanishes. Interchange between balancing authorities in North America is arranged bilaterally, documented by electronic tags — e-Tags — that record source, sink, transmission path, and schedule for each transaction (NERC INT-006; NAESB WEQ-004). The tag is a remarkable artifact: it is a description of a deal already struck, not the output of any welfare calculation. No objective function was maximized to produce it. No dual variable prices the seam it crosses. When simultaneous schedules overload a flowgate, the remedy is Transmission Loading Relief — a curtailment procedure that cuts tagged transactions by priority class using the Interchange Distribution Calculator, a tool that allocates relief, not value (NERC IRO-006; NERC IDC Reference Document). TLR is the seam’s honest confession: where markets would re-dispatch against a price, the seam simply turns transactions off in administrative order.

The cost of leaving a boundary unoptimized is not folklore; it has been measured wherever anyone has bothered to measure it. When American utilities joined PJM’s consolidated LMP dispatch, generation cost savings appeared in the data as territories switched from bilateral self-scheduling to market dispatch — the natural experiment studied by Mansur and White, and generalized by Cicala’s finding that market dispatch reduced the cost of generating a given electricity supply, with gains concentrated exactly where bilateral trade had been thinnest (Mansur & White, 2012; Cicala, AER 2022). The Western Energy Imbalance Market — a voluntary real-time optimization layered above sovereign balancing authorities that keep their own tariffs, their own boards, and their own reliability obligations — has accumulated multi-billion-dollar measured benefits since 2014 simply by letting one five-minute optimization see across seams (CAISO WEIM Benefits Reports; CAISO, 2024). NREL’s Interconnections Seam Study priced the ur-seam — the east–west DC boundary — and found benefit-to-cost ratios above unity for every cross-seam buildout studied (Bloom et al., NREL, 2020). The WEIM precedent matters doubly for this program: it is an existence proof that sovereign operators will accept a coordination optimization when participation is voluntary, benefits are published per-participant, and exit is cheap (CAISO WEIM Governance Review, 2021) — the same three conditions Helios Grid treats as design constraints rather than aspirations (BGL Memorandum HG-M-108, internal, 2025-10).

Canada’s seams are thinner, and the institutions around them thinner still. The physical facts were laid out in BGL/HG—01: a single ~150 MW west–east tie at McNeill, a BC–Alberta intertie derated to roughly half its design capability, Quebec’s interconnections oriented south into New England and New York rather than west into Ontario (CES-Energy; BC Hydro, 2025; CER). The institutional facts are starker. There is no Canadian counterpart to FERC Order 888’s open-access regime or Order 1000’s interregional planning obligation (FERC Order 888; FERC Order 1000); the Canada Energy Regulator’s jurisdiction reaches international power lines and designated interprovincial lines but gives it no authority to referee dispatch or settlement disputes between provinces (CER Act, 2019; C.D. Howe Institute, 2024). Where the United States has joint operating agreements with market-to-market coordination — PJM and MISO literally exchange shadow prices on flowgates they both affect and settle against them (MISO-PJM JOA) — Canadian provinces exchange, at best, seasonal capacity contracts negotiated at the executive level, such as the Ontario–Quebec 500 MW seasonal capacity swap (Government of Ontario, 2015; IESO). A shadow price crossing the Manitoba–Saskatchewan border has never existed.

It is worth being precise about why the seam stayed unoptimized, because the reasons constrain any remedy. The first reason is constitutional: provinces own their utilities, their regulators answer provincially, and a supra-provincial dispatch authority is a political non-starter — which is why Helios Grid’s formulation is advisory and evidentiary by construction, never directive (Constitution Act, 1867, s.92A; C.D. Howe Institute, 2024). The second is informational: coordination requires each party to reveal operating data — hydro storage state, unit availability, marginal valuations — that is commercially sensitive between entities that are also counterparties in export markets (Hydro-Québec Annual Report, 2024; BC Hydro IRP, 2021). Mechanism-design theory says this problem cannot be assumed away: with two-sided private information, no bargaining institution achieves full efficiency without outside subsidy (Myerson & Satterthwaite, JET 1983), and auction-theoretic fixes that look clean on paper — VCG among them — fail on revenue, collusion, and complexity grounds in practice (Vickrey, 1961; Rothkopf, OR 2007). The third is evidentiary: even willing parties have no common record to argue from. Alberta’s market surveillance administrator publishes forensic reports about Alberta (AESO MSA, 2024); Ontario’s market renewal produced a nodal record of Ontario (IESO, 2025); nobody produces a record of the seam. Transaction-cost economics predicts exactly this equilibrium: where verification is expensive, parties substitute rigid long-term contracts for adaptive coordination, and leave the residual value on the table (Williamson, 1985; Coase, 1960).

The program’s reading of this landscape is narrow and falsifiable. The seam is not unoptimized because optimization is hard — Section 2 established that the mathematics is routine at far larger scale. It is unoptimized because no institution exists whose evidence all parties accept. The federal moment — a National Electricity Strategy announced this month, priority-intertie machinery being assembled, the Canada Electricity Advisory Council’s recommendation of an EU-style interregional framework (PMO, 2026; CEAC, 2024) — will fund wires. Wires without a common evidentiary layer reproduce the Atlantic Loop failure at national scale: every allocation dispute becomes a first-principles political negotiation, because there is no neutral computation both sides can re-run (CBC, 2023; CIB, 2024). What follows is the specification of that computation.

Inputs and the Governed Object Model

A formulation is only as auditable as its inputs, so the input discipline comes first. Helios Grid ingests four classes of data, each with a named provenance class and a distinct trust posture (M.A.D. Object Model Reference, rev. 19, internal). Published market data: IESO nodal prices, schedules, and adequacy reports; AESO pool price, intertie schedules, and market analytics; public generation and load actuals from the Crown utilities’ system-operator disclosures (IESO; AESO; Hydro-Québec; BC Hydro). Regulatory and statistical series: Statistics Canada electricity supply and disposition tables, CER commodity and trade statistics, ECCC emission-intensity series — slow-moving, high-authority data that anchors calibration (Statistics Canada; CER; ECCC). Counterparty-contributed data: the operationally sensitive layer — storage states, availability declarations, intertie derations with cause codes — contributed under agreement and encrypted under the Tri-Con identity scheme described in Section 9 (Tri-Con Specification v2.3, internal, restricted). Physical telemetry: where available, ICCP/TASE.2 real-time values and synchrophasor streams at boundary buses, with the protocol’s native timestamps preserved (IEC 60870-6; IEEE C37.118; NASPI).

Every ingested record passes through the same three-stage discipline. First, capture: the source record is stored byte-exact, with transport metadata — retrieval time, endpoint, content hash — recorded alongside it. The store is append-only; corrections are new records that reference the records they supersede, never mutations, which is the same posture event-ordering theory has recommended for distributed records since Lamport (Lamport, CACM 1978; BGL Engineering Note DAE-EN-71, internal, 2025-08). Second, translation: the record is mapped into the governed object model — the single typed vocabulary over which all derivation runs. Where an industry ontology exists we align to it rather than invent: the object model’s network entities correspond to the IEC Common Information Model’s equipment and topology classes, and its market entities to the IEC 62325 market-extension vocabulary, so that a utility’s CIM export can be reconciled against our objects mechanically (IEC 61970-301; IEC 62325; ENTSO-E CGMES). Translation never destroys the source: each governed object carries pointers to the byte-exact records it was derived from, and the translation rules themselves are versioned objects in the corpus, so a challenged mapping can be replayed under the exact rule text that produced it (M.A.D. Object Model Reference, rev. 19, internal). Third, canonicalization: before any object participates in a derivation, it is serialized under a canonical scheme — deterministic key ordering, normalized numeric representation, explicit units, UTC-fixed timestamps — adapted from the JSON Canonicalization Scheme, so that its hash is a stable identity rather than an accident of formatting (RFC 8785; BGL Engineering Note DAE-EN-77, internal, 2025-11).

The object model itself is deliberately small at the seam. Thirteen SystemNode objects represent the provincial and territorial control areas — the three territories’ thermal-and-hydro island systems included, because a national corpus that quietly drops Yukon Energy, NTPC, and Qulliq is not a national corpus, even though no transmission seam reaches them today (Yukon Energy; NTPC; Qulliq Energy Corporation). Seam objects represent physical interconnections with directional capability profiles, deration histories, and ownership references — the McNeill converter, the BC–Alberta 500 kV path, the Ontario–Quebec HVDC ties, each carrying its documented capability rather than its nameplate (CES-Energy; BC Hydro, 2025; IESO). ResourceClass objects aggregate generation by dispatch behaviour — ramp class, cycling cost class, storage coupling — not by unit, because unit-level data is precisely what counterparties will not share and the seam question does not require it (BGL Memorandum HG-M-114, internal, 2025-12). Instrument objects represent the contractual layer: tags, seasonal swaps, firm transmission reservations, each bound to the seam it loads. And Observation objects carry the time-series facts — flows, prices, curtailments, deration events — that derivation consumes.

Aggregation is a governed act, not a convenience. Every ResourceClass carries the exact membership rule and vintage of public data that produced it, because aggregation choices are themselves a classic seam-dispute vector: a province arguing that its flexibility was overstated must be able to see, and re-run, the rule that classified its fleet (BGL Derivation Record DR-HG-38121, internal, sealed). Where public sources disagree — StatCan generation tables versus operator disclosures, a recurring reconciliation problem documented in our calibration notes — the object model stores both series with an explicit discrepancy object rather than silently preferring one; derivations that touch the disputed range inherit a provenance flag that survives into the final finding (Statistics Canada; BGL Calibration Note HG-CN-09, internal, 2026-02). This is tedious. It is also the entire point: by the time a fact reaches the formulation, its pedigree is machine-checkable, and the formulation’s outputs can therefore inherit pedigrees rather than assertions (BGL Engineering Note DAE-EN-71, internal, 2025-08).

One design decision deserves defence because it is contrarian. Helios Grid does not maintain a full nodal network model of Canada. The temptation is real — synthetic-network methods could produce one (Birchfield et al., IEEE TPS 2017) — but a nodal model of thirteen systems would be wrong everywhere, contested by everyone, and would recreate at the coordination layer exactly the sovereignty intrusion the program forswears. The seam formulation needs boundary-accurate physics: interface limits, deration states, and loss characteristics at the seams themselves, plus each system’s declared aggregate flexibility. Provincial operators keep their nodal truth; the corpus keeps the seam truth; the formulation in Section 6 is built to be exact over precisely that partition (BGL Memorandum HG-M-114, internal, 2025-12; PJM Manual 12).

A Constraint Taxonomy for Seam Coordination

Constraints are where formulations earn or forfeit trust, because a constraint is a claim about the world that the solve will treat as law. Helios Grid maintains a governed taxonomy of six constraint families, each with a named authority class — who asserts it, what evidence supports it, and who may challenge it (BGL Memorandum HG-M-114, internal, 2025-12). The taxonomy is published in full in the program’s working papers; this section states each family and the design reasoning behind it.

Family P — physical seam constraints. Directional transfer limits on each Seam object, time-varying with deration state; ramp limits on interchange changes between intervals; and, for the HVDC ties, converter capability curves. Authority class: operator-published or telemetry-derived, with the deration history as evidence. The taxonomy insists on documented capability, not nameplate — the BC–Alberta path enters at its derated operating envelope with the deration record attached, because a formulation that schedules 1,200 MW across a path its owner operates at roughly 600–735 MW is not optimistic, it is wrong (BC Hydro, 2025; NERC TOP-003). Simultaneous-interchange limits — the constraint that a system’s total imports across all seams may bind before any single seam does — are Family P objects with their own evidence trail, mirroring the total-transfer-capability discipline of NERC’s available-transfer methodology (NERC MOD-001; IESO).

Family S — sovereign envelope constraints. Each province’s declared aggregate operating envelope: net-export bounds by interval, aggregate ramp capability by ResourceClass, storage-coupled energy budgets for the hydro systems, and minimum-reliability holdbacks. These are the constraints that encode sovereignty. The formulation never sees why a province’s envelope is what it is — only the envelope, signed and versioned by its contributor under Tri-Con identity (Tri-Con Specification v2.3, internal, restricted). The design principle is borrowed from the WEIM, whose participating balancing authorities submit resource plans and retain autonomy over what they expose to the market optimization (CAISO BPM, Market Operations; CAISO WEIM Governance Review, 2021). A sovereign envelope may be conservative, and the engine will respect it; what the engine will also do — Section 7 — is measure the conservatism, because the gap between declared envelopes and observed behaviour is itself a finding with a lineage (BGL Derivation Record DR-HG-40412, internal, sealed).

Family C — contractual constraints. Existing instruments load the seams before any coordination is contemplated: firm transmission reservations, the Ontario–Quebec seasonal capacity swap, long-term export commitments into New England and New York that consume Quebec’s southbound capability (Government of Ontario, 2015; Hydro-Québec, 2024). Family C objects subtract contracted capability from Family P limits interval by interval, and carry citations to the instruments themselves — or, where an instrument’s terms are confidential, to a Tri-Con-encrypted commitment whose aggregate seam loading is attested by its holder. The taxonomy treats a contract as a constraint, never as a target: the engine does not optimize anyone’s contract portfolio, it respects the portfolio’s physical residue (BGL Memorandum HG-M-114, internal, 2025-12).

Family R — reliability policy constraints. Reserve-sharing floors, frequency-response obligations, and the interchange-scheduling standards that any advisory schedule must survive contact with: NERC BAL-series balancing standards, interchange standards INT-006 and INT-009, and each province’s own operating reserve policy (NERC BAL-001; NERC BAL-006; NERC INT-009). Family R exists so that no Helios Grid recommendation can be procedurally impossible: an advisory exchange that would require a balancing authority to violate its control performance standard is infeasible by construction, not flagged after the fact (NERC BAL-001; AESO ISO Rules).

Family E — environmental and statutory constraints. The Clean Electricity Regulations’ emissions-intensity trajectory, provincial emissions caps and offset regimes, and carbon-price schedules enter as constraints or costs depending on their legal form (Canada Gazette, SOR/2024-263; ECCC, 2025). The taxonomy is strict about the distinction: a statutory cap is a hard constraint with the statute as authority; a carbon price is an objective term with the price schedule as authority; and an emissions target that binds no one is neither, and is excluded — recorded in the corpus, cited in findings, but never allowed to masquerade as physics (BGL Memorandum HG-M-117, internal, 2026-01).

Family D — data-quality constraints. The taxonomy’s most unusual family, and the one the program considers a genuine contribution. Every constraint in Families P through E carries a freshness bound and a provenance class; Family D constraints make staleness itself binding. A seam whose telemetry is older than its declared freshness bound has its usable capability automatically stepped down toward its contractual floor, on a published schedule, until fresh data arrives — the formulation-level analogue of the operating practice that degraded state awareness must shrink the operating envelope, a lesson written in the 2003 blackout report’s account of a failed state estimator and the stale pictures that followed (U.S.-Canada Power System Outage Task Force, 2004; NERC TOP-003). Family D turns “how old is your data” from an audit question into a term of the mathematics: a counterparty that withholds updates does not gain optionality, it loses modeled capability, and the loss is visible in the derivation trail (BGL Engineering Note DAE-EN-85, internal, 2026-02). Section 11 returns to the incentive properties of this design.

Two disciplines govern the taxonomy as a whole. Every constraint object is challengeable: a counterparty may file a challenge against any constraint’s evidence, and a challenged constraint is re-derived under both the original and proposed values, with the delta published — the corpus equivalent of a market monitor re-running a disputed case (Potomac Economics, 2024; BGL Adversarial Review Register HG-AR-06, internal, 2026-04). And no constraint enters anonymously: the taxonomy has no “engineering judgment” class, because unattributed constraints are where audit trails go to die. If a limit cannot cite an operator document, a statute, a telemetry stream, a contract, or a signed sovereign declaration, it does not bind the solve (BGL Memorandum HG-M-114, internal, 2025-12).

The Coordination Formulation

With objects and constraints in hand, the formulation itself can be stated plainly. Helios Grid’s core computation is a deterministic optimization over advisory interchange adjustments: for each hourly interval and each directed seam, a proposed deviation from the currently scheduled interchange, together with the aggregate re-dispatch inside each sovereign envelope that the deviation implies. Decision variables are seam flows and per-system, per-ResourceClass output adjustments — nothing finer, by the partition argument of Section 4. The feasible set is the intersection of the six constraint families. The objective minimizes total declared cost of served energy across the thirteen systems — production cost by ResourceClass, startup and cycling proxies for the classes that carry them, carbon cost under Family E pricing, and a symmetric penalty on schedule churn to keep the advisory layer from thrashing against real operations (BGL Memorandum HG-M-121, internal, 2026-02). In form, this is a small cousin of the SCUC/SCED family — a mixed-integer linear program where cycling and mode decisions bind, degenerating to a pure LP in intervals where they do not — and it is solved with the same commodity mathematics (Wood et al., 2013; Huangfu & Hall, MPC 2018).

The network representation is transport-plus-losses at the seams, not a power flow. Each Seam object contributes a directed flow variable pair with capability bounds from Family P and a piecewise-linear loss term calibrated against operator-published interface data; within-system network feasibility is the province’s own affair, represented solely by its sovereign envelope. This is a modeling choice with a documented cost: it cannot see intra-provincial congestion, and it treats each system’s envelope as simultaneously achievable across its seams unless a Family P simultaneous-interchange limit says otherwise. The program’s position is that this is the correct fidelity for the question asked — the same abstraction level at which NERC-region seasonal assessments and intertie studies are conducted (NERC, 2025; CEAC, 2024) — and that the alternative, a contested national nodal model, buys precision nobody will certify. Where the DC-approximation literature warns of distortions from ignoring reactive power and voltage (Molzahn & Hiskens, 2019; Cain, O’Neill & Castillo, 2012), the seam formulation inherits the milder version of the caveat: its outputs are advisory adjustments that each operator re-validates in its own security tools before anything moves — a two-stage division of labour identical in spirit to the market-to-market coordination PJM and MISO already run across their boundary (MISO-PJM JOA).

Prices fall out, as they must. The dual variable on each seam’s binding capability constraint is a seam shadow price: the system-cost value of one additional megawatt of transfer capability across that boundary in that interval, computed under every party’s declared constraints simultaneously (O’Neill et al., 2005; Schweppe et al., 1988). The program regards this object as more important than the dispatch advice itself. Canada currently has no number that answers “what is a megawatt of McNeill expansion worth this hour, under everyone’s stated constraints” — and the absence of that number is why intertie business cases are litigated as dueling consultant studies rather than read off a common computation (CEAC, 2024; NREL, 2020). A year of seam shadow prices, archived with full derivation lineage, is precisely the evidence base the federal intertie machinery will need and does not have (PMO, 2026; BGL Derivation Record DR-HG-41290, internal, sealed). Where integer decisions are active and clean duals do not exist, the engine reports convex-hull-style approximate prices and — unlike a market settlement, which must pick a number and pay it — publishes the non-convexity gap explicitly, because an advisory layer can afford the honesty that settlement systems purchase with uplift (Gribik, Hogan & Pope, 2007; FERC Order 844).

Multi-interval coupling is handled with deliberate conservatism. Hydro-dominant systems — Quebec, BC, Manitoba — are energy-constrained, not capacity-constrained, and any hourly formulation that ignores water turns them into free batteries. Sovereign envelopes therefore carry storage-coupled energy budgets over declared horizons (Family S), and the hourly solve runs inside a rolling multi-day coordination pass that enforces them, mirroring the look-ahead commitment structure ISOs use for the same reason (MISO BPM-002; Hydro-Québec, 2024). The budgets are declarations, not inferences: the engine does not estimate reservoir state — it consumes attested budgets and records them in the lineage, so a province’s water stays a province’s secret while its consequences for the seam become common knowledge (Tri-Con Specification v2.3, internal, restricted; BC Hydro IRP, 2021).

Finally, the formulation is stated in a governed algebraic form, not in code alone. Every run archives the instantiated model — variables, bounds, coefficients, constraint provenance tags — in a canonical serialization whose hash enters the derivation chain (RFC 8785; BGL Engineering Note DAE-EN-77, internal, 2025-11). A counterparty replaying a run receives the exact instance, not a description of it, and may solve it with any LP/MILP implementation they trust: the archived optimal basis and objective certificate allow verification without rerunning branch-and-bound at all, since checking a claimed optimal basis is orders cheaper than finding one (Bertsimas & Tsitsiklis, 1997; Nemhauser & Wolsey, 1988). The formulation, in other words, is built to be checked by institutions that distrust us — which, at the seam, is the only kind of institution there is (BGL Memorandum HG-M-101, internal, 2025-09).

What Derivation Adds Beyond the Solve

If Helios Grid were only the optimization of Section 6, it would be a competent consulting model — useful, replicable, and inert. The D.A.E. sits above the solve, and what it adds is the difference between an answer and a finding. The engine’s derivation layer runs three classes of reasoning over the corpus and the solve outputs together, each deterministic, each emitting conclusions with complete lineage back to source facts (M.A.D. Object Model Reference, rev. 19, internal; BGL Engineering Note DAE-EN-71, internal, 2025-08).

Correlation detection with lineage. The first class establishes what moves together across seams, under governed statistical rules rather than exploratory analysis: which pairs of Observation series co-move, at what lags, under what conditioning, with the test parameters themselves versioned objects. The archetype finding from the program’s calibration year: curtailment events in one control area co-occurring, within the hour, with gas-fired dispatch ramps in the adjacent area — the Ontario-surplus-beside-Alberta-scarcity pattern whose aggregate cost the public record already documents in fragments, Ontario’s ~1.3 TWh annual wind curtailment on one side of the ledger (Energy Regulation Quarterly) and gas at 450–500 g CO2e/kWh balancing the other (ECCC, 2025; IESO). What the engine adds to the anecdote is exhaustiveness and lineage: every co-movement above governed thresholds is found, every one carries its evidence, and the negative space — pairs that do not co-move — is preserved rather than discarded (BGL Derivation Record DR-HG-40412, internal, sealed).

Should-correlate-but-does-not findings. The second class is the program’s signature instrument, and it is worth stating carefully because nothing in the standard toolkit does this. The formulation of Section 6 implies, for every interval, a set of expected couplings: if a seam had headroom, and the price-proxy differential across it exceeded the loss-adjusted threshold, and no Family C instrument consumed the capability, then flow should have moved — and when the observed record shows it did not, the engine emits a should-correlate-but-does-not finding naming the interval, the seam, the unused headroom, the foregone-cost bound, and every constraint object it checked before concluding that none of them explains the stillness (BGL Run Ledger HG-2991, internal, sealed). This is the mechanized form of the question audit committees never quite manage to ask: not “was this decision right” but “what decisions were never made, and what did the not-making cost.” In the 2025 calibration corpus, findings of this class clustered heavily at the BC–Alberta seam in shoulder-season night hours — intervals where derated-but-nonzero capability sat unused against persistent pool-price spreads (AESO, 2025; BC Hydro, 2025; BGL Calibration Note HG-CN-09, internal, 2026-02). Each such finding is, structurally, a claim that value leaked; because it arrives with its full checklist of excluded explanations, a counterparty’s rebuttal must name the constraint the engine missed — at which point the constraint enters the taxonomy, the corpus improves, and the finding either survives or dies on the record. Either outcome is progress; unfalsifiable analysis produces neither (BGL Adversarial Review Register HG-AR-06, internal, 2026-04).

Derivation lineage as a first-class object. The third class is not a species of finding but the substrate of all of them. Every conclusion the engine emits — a dispatch advisory, a seam shadow price, a should-correlate finding — is the root of a derivation tree whose leaves are byte-exact source records and whose internal nodes are governed rule applications, each hashed, each replayable in isolation (BGL Engineering Note DAE-EN-77, internal, 2025-11). The practical consequence is surgical challenge: a counterparty disputing one telemetry point does not impeach a report, they impeach a leaf — and the engine re-derives exactly the subtree that depended on it, publishing which conclusions moved and by how much. Sensitivity, in other words, is computed against the actual dependency structure rather than estimated by perturbation studies. The program’s internal review found this property did more to change counterparty conversations than any accuracy claim: parties who will argue forever about a conclusion will argue quite briefly about a leaf (BGL Memorandum HG-M-124, internal, 2026-03).

It bears stating what the derivation layer is not. It is not inference under uncertainty: the engine never asserts a probability it cannot derive from governed rules over recorded facts, and where the honest answer is “the corpus cannot distinguish these hypotheses,” that sentence — with the distinguishing data named — is the finding (M.A.D. Object Model Reference, rev. 19, internal). The contrast with learned approaches is architectural, not rhetorical. A learned model of the seams would interpolate beautifully inside its training distribution and would owe nobody an explanation at the exact moments explanations are owed — the tail events, where NERC’s guidance observes that divergence between model and operator judgment “becomes more obvious, and critical” (NERC, 2024). The derivation layer is slower to build and duller to demo. It is also the only version of this instrument that a provincial market monitor, handed the corpus and the rule set, could re-run to the bit and sign (Monitoring Analytics, 2024; BGL Run Ledger HG-3099, internal, sealed).

Determinism Engineering

“Same input, same output” is a slogan until it survives contact with real computers. This section documents the threats the run harness was engineered against and the discipline that closes each one, because a reproducibility claim without its threat model is exactly the kind of assertion this program exists to retire (BGL Engineering Note DAE-EN-81, internal, 2026-01).

Threat one: floating-point non-associativity. IEEE 754 arithmetic is deterministic per operation but not associative; the same summands in a different order produce different bits, which is why naively parallelized reductions are irreproducible across thread counts and why the numerical literature treats reproducible summation as a solved-but-nontrivial problem (IEEE 754-2019; Goldberg, 1991; Demmel & Nguyen, IEEE TC 2015). The D.A.E. discipline: every aggregation in the derivation layer runs over canonically ordered operands — order fixed by object identity hash, not by arrival or thread schedule — and the hot reductions use fixed-point accumulation in integer arithmetic, trading a bounded precision cost for bit-stability across machines, thread counts, and library versions (BGL Engineering Note DAE-EN-81, internal, 2026-01). Vendor “conditional numerical reproducibility” modes exist and are used where applicable, but the harness never relies on them alone, because a reproducibility property that depends on a library flag is a property one upgrade away from silently false (Intel MKL CNR documentation; Higham, 2002).

Threat two: solver variability. The MILP literature is blunt that branch-and-bound performance and even the returned optimum among alternative optima vary with random seeds, row permutations, and thread races — “performance variability” is a named research subject, and its magnitude routinely surprises outsiders (Lodi & Tramontani, 2013; Fischetti & Monaci, OR 2014; Koch et al., 2017). The harness closes this on three levels. Instances are canonicalized before the solver sees them — fixed variable order, fixed row order, hashed — so permutation variability has nothing to bite (RFC 8785; BGL Engineering Note DAE-EN-83, internal, 2026-01). Solves run in the solver’s deterministic mode with pinned seeds, pinned thread counts, and pinned library builds, all recorded in the run manifest. And — the level that matters for institutional trust — the archived artifact is not “the solver said 4.71” but the solution and its certificate: the optimal basis and duals for LPs, the incumbent plus bound certificate for MILPs, so that verification is solver-independent even though the search that found the solution is not. Degeneracy receives explicit treatment: where alternative optima exist, a governed lexicographic tie-break selects among them, and the tie-break rule is itself a versioned, cited object — because an unexamined tie-break is a hidden policy choice, and hidden policy choices are how audit trails rot (Bertsimas & Tsitsiklis, 1997; BGL Memorandum HG-M-121, internal, 2026-02).

Threat three: environment drift. A run is reproducible only relative to a stated environment, and the harness states it exhaustively: the run manifest pins engine build hash, solver build, numeric library versions, canonicalization scheme version, rule-set version, and corpus snapshot hash. The build itself is reproducible in the reproducible-builds sense — independent builders reach byte-identical binaries from source — which closes the gap between “we ran this code” and “you can verify this code is what ran,” a distinction the software-supply-chain community has spent a decade teaching, with Thompson’s compiler parable as the founding text (Reproducible Builds project; Thompson, CACM 1984). Corpus snapshots are content-addressed: a run references the root hash of the input set, so “identical inputs” is a checkable equation, not a claim about good intentions (Merkle, 1987; NIST FIPS 180-4).

The audit chain. Every run appends to a hash-chained ledger: each entry binds the run manifest, the instantiated model hash, the solution certificate, and every emitted finding’s derivation-tree root, and each entry’s hash incorporates its predecessor’s — the linked-timestamping construction of Haber and Stornetta, the same family of structure that Certificate Transparency later industrialized for the web’s certificate authorities (Haber & Stornetta, 1991; RFC 6962). The chain is append-only and periodically cross-anchored: digests are exchanged with counterparties and archived externally, so that even the lab cannot silently rewrite its own history — a property we regard as the minimum standard for any institution proposing to referee other institutions’ disputes (BGL Stratum Governance Log 2026-Q1, internal). Verification of the chain requires nothing from BlackGrid Labs: the schemas are published, the hash functions are NIST standards, and a counterparty’s auditor can walk the chain with a screwdriver and a hash library (NIST FIPS 180-4; BGL Engineering Note DAE-EN-77, internal, 2025-11).

Replication as routine, not ceremony. Determinism claims decay unless exercised, so the harness treats replication as a scheduled workload. The HG-3099 replication series re-executed 214 archived runs across three machine generations, two operating systems, and independently rebuilt binaries; all 214 reproduced bit-identically — findings, certificates, and chain entries — and the series itself is an entry in the chain (BGL Run Ledger HG-3099, internal, sealed). One negative result from the series is reported because negative results are the point of running it: an early fixed-point accumulator overflowed on a pathological synthetic series and produced a deterministic but wrong aggregate — reproducibility is necessary, not sufficient, and the incident produced both the widened accumulator and a corpus-wide range-audit rule (BGL Incident Note DAE-IN-12, internal, 2025-10). A lab that only publishes its clean replications is running public relations, not verification — the epistemic failure pattern the reliability establishment keeps warning about from the other direction (NERC, 2024; U.S.-Canada Power System Outage Task Force, 2004).

Tri-Con: Identity Under Encryption

The seam’s hardest problem is not mathematical. Provinces and their Crown utilities are counterparties: they trade against each other in export markets, negotiate against each other in intertie disputes, and litigate against each other in cost-allocation proceedings (CBC, 2023; C.D. Howe Institute, 2024). No such party will contribute operationally sensitive data — storage states, availability declarations, contract loadings — into a corpus its rivals can read. Yet Section 6’s formulation needs exactly that data to bind. Tri-Con is the identity and confidentiality architecture that resolves the contradiction, and it is described here at the level of guarantees rather than mechanism, with the mechanism specification held internally (Tri-Con Specification v2.3, internal, restricted).

The design premise is that identity, not payload, is the politically radioactive element. What makes a storage figure sensitive is rarely the number; it is the attachment of the number to a named asset of a named party visible to a named rival. Tri-Con therefore separates three concerns that conventional data-sharing conflates. Contribution identity: every contributed record is signed by its contributor, so provenance is cryptographically attributable — the engine, and any auditor of the engine, can prove which party asserted which fact, which is what makes Family S sovereign envelopes challengeable objects rather than rumors (NIST FIPS 186; BGL Memorandum HG-M-108, internal, 2025-10). Reference identity: within the corpus, contributed entities appear only as encrypted composite references — opaque, stable identifiers that preserve equality and linkage (the engine can tell that two observations concern the same object, and can join them) without disclosing which real-world asset the object is. Counterparties examining a derivation trail see that a finding depended on, say, three attested storage budgets from three distinct contributors with stated freshness — they do not see whose reservoirs, or where (Tri-Con Specification v2.3, internal, restricted). Disclosure identity: de-referencing — binding an encrypted reference back to a real asset — is a governed act requiring the contributor’s participation, logged in the same hash chain as everything else, so disclosure is possible when a dispute requires it and provable-absent when it does not (BGL Stratum Governance Log 2026-Q1, internal).

The guarantees are deliberately conservative relative to what the cryptographic literature offers. Secure multi-party computation could, in principle, evaluate the entire formulation over inputs no party ever reveals to anyone (Yao, 1982; Goldreich, Micali & Wigderson, 1987), and partially homomorphic schemes could aggregate under encryption (Paillier, 1999). The program tracks this literature and declines, for now, to build on it: the schemes that are efficient enough for the workload carry trust assumptions and implementation attack surface that would themselves become the dispute, and a confidentiality mechanism nobody’s auditor can certify defeats its purpose (BGL Memorandum HG-M-108, internal, 2025-10). Tri-Con’s more modest construction — standard authenticated encryption, standard signatures, keys managed under standard lifecycle discipline — keeps every primitive inside the envelope that national certification regimes already evaluate (NIST FIPS 197; NIST SP 800-57), and aligns the handling of confidential grid data with the information-protection posture the reliability standards already mandate for it (NERC CIP-011). The parallel obligations of Canadian privacy law are narrower here — the corpus carries infrastructure data, not personal information — but the statutory pattern of purpose-limitation and access logging was adopted wholesale because counterparty lawyers recognize it on sight (PIPEDA).

Two consequences of the architecture deserve emphasis. First, confidentiality and auditability stop being enemies. The classic objection to confidential inputs — “then your audit trail has holes” — fails against reference identity: the derivation chain is complete and hash-verified end to end, with encryption applied to names, not to the chain’s structure, so an auditor verifies every step of a derivation whose leaves they cannot read, and the contributor — who can read their own leaves — verifies the leaves. Each party checks the part it is entitled to check; the union covers the whole (BGL Engineering Note DAE-EN-77, internal, 2025-11). Second, the architecture changes the negotiation game. A party can now be shown, and can verify, that a finding adverse to its position depended on its own attested inputs — without any rival learning those inputs. In the program’s partner conversations to date, that single property has moved discussions past the reflexive no faster than any confidentiality promise on paper, for the unsurprising reason that it replaces a promise with a proof (BGL Partner Conversation Log W-2026-02, internal; Ostrom, 1990).

Verification Versus Learning

The obvious challenge to this program comes from machine learning, and it deserves a fair statement before a response. Learned dispatch proxies are genuinely impressive: neural networks trained on solved SCED instances reproduce optimal dispatch with sub-percent error at millisecond latency, a speedup of several orders of magnitude over the solver (Chen, Tanneau & Van Hentenryck, arXiv:2112.13469), and the broader learning-for-OPF literature has produced architectures that fold constraint satisfaction into training itself (Donti et al., arXiv:2104.12225; Amos & Kolter, 2017). If the seam problem were a throughput problem, learning would be the answer, and this document would be shorter.

But the seam problem is a trust problem, and on trust the learning literature testifies against its own deployment — candidly and to its credit. The feasibility gap is structural: a learned proxy’s output carries no native guarantee of satisfying the constraints it was trained to respect, and the field’s own survey work identifies exactly this as the central obstacle between benchmark and control room (arXiv:2304.11726). The verification research programme exists, in its founders’ words, to “build the missing trust of power system operators” — and the state of the art verifies properties of small networks over restricted input regions at significant computational cost, an achievement worth respecting and a very long way from certifying a continental coordination layer (Venzke & Chatzivasileiadis, arXiv:1910.01624; Katz et al., arXiv:1702.01135). The reliability establishment’s posture matches: NERC’s 2024 white paper on AI in real-time operations insists on human-in-the-loop deployment, flags systems that are “really just inscrutable and not independently verifiable” as the problem case, and reports an industry in which 47% of surveyed operators are still at the learning stage and 9% have built such systems at all (NERC, 2024). None of this says learning is useless in grid operations. It says the trajectory of accepted use runs through verification wrappers, screening roles, and advisory distance from the binding decision — that is, toward behaving as much like a deterministic, checkable system as possible (NERC, 2024; arXiv:2304.11726).

Helios Grid’s position follows from asking what the seam actually rewards. Inside a market, dispatch runs on a five-minute clock; a proxy that answers in milliseconds instead of seconds is buying something real (PJM Manual 11; Chen et al., 2021). At the seam, the coordination interval is hourly, the decision is advisory, and — Section 12 — the exact solve completes in under two seconds. There is no latency deficit for learning to close. What the seam rewards is the property learning cannot yet sell: a recommendation that a hostile counterparty’s analyst can re-derive to the bit and reconcile to named constraints, because at the seam every consumer of the output is, institutionally, a skeptic (BGL Memorandum HG-M-101, internal, 2025-09). The relevant comparison is not accuracy — the exact solve is exactly accurate with respect to its stated model — but epistemics under challenge. When a deterministic run is wrong, it is wrong legibly: some constraint object was wrong, some input was stale, some rule misapplied, and the derivation tree localizes which. When a learned model is wrong, the error lives in weights, and the remediation conversation has nowhere to stand. The 2003 blackout investigation could reconstruct, minute by minute, which tools failed and what operators could not see, precisely because the toolchain’s intended behaviour was specifiable (U.S.-Canada Power System Outage Task Force, 2004). An institution proposing to referee inter-provincial disputes must clear that bar on its worst day, not its average one.

Where learning does earn a place in the program, it is quarantined by role. Candidate-surfacing — ranking which intervals or seams merit derivation attention first — is a legitimate use of learned scoring, because a ranking error costs compute, not correctness: every emitted finding still passes through the full deterministic derivation gate, and nothing learned ever appears in a lineage (BGL Memorandum HG-M-124, internal, 2026-03). The boundary rule is stated in one sentence in the engine’s governance documents: models may propose, only derivations may assert. The program considers this division stable for the seam workload — and considers the burden of proof to sit permanently with any proposal to move it, which is the same allocation of burden NERC’s guidance implies for the control room (NERC, 2024; BGL Stratum Governance Log 2026-Q1, internal).

Failure Modes and Adversarial Analysis

An evidence architecture must be designed against the parties who will attack it, and electricity markets supply an unusually well-documented adversary literature. The California crisis produced named manipulation strategies exploiting seams and scheduling rules; the enforcement era that followed produced nine-figure settlements over bidding conduct that was individually legal-looking and collectively extractive (Borenstein, Bushnell & Wolak, AER 2002; FERC v. JP Morgan VEE, 2013; FERC v. Constellation, 2012). The lesson the program takes is not that markets fail but that every coordination mechanism is a target, and its designers owe the public an account of how it fails. This section gives that account, drawn from the program’s standing adversarial register, which at this writing carries 61 analyzed vectors across five classes (BGL Adversarial Review Register HG-AR-06, internal, 2026-04).

Class one: envelope gaming. A sovereign contributor understates its flexibility — a tight declared envelope — to suppress findings that it left value unharvested, or overstates it to inflate a seam’s apparent worth in an intertie proceeding. The architecture’s response is measurement, not prohibition: declared envelopes are continuously scored against observed behaviour, and the engine’s consistency findings — a system repeatedly operating outside its declared envelope, or never approaching it — are themselves lineage-bearing objects visible to all contributors in aggregate form (BGL Derivation Record DR-HG-40412, internal, sealed). This mirrors the market-monitoring insight that mitigation is mostly measurement made credible: independent monitors deter less by punishment than by the demonstrated ability to reconstruct conduct after the fact (Potomac Economics, 2024; AESO MSA, 2024). Gaming remains possible — Myerson–Satterthwaite guarantees that no mechanism design abolishes strategic declaration (Myerson & Satterthwaite, JET 1983) — but under Tri-Con attribution and envelope scoring, a strategic envelope is a signed, timestamped, progressively-less-deniable public position, and the cost of maintaining it compounds (Tri-Con Specification v2.3, internal, restricted).

Class two: data withholding and starvation. A party that dislikes the findings simply stops contributing, or contributes late, degrading the corpus. Family D was engineered for exactly this: staleness mechanically shrinks the withholder’s modeled capability toward its contractual floor, so withholding reads as self-deration — the party’s seams contribute less headroom, its should-correlate findings are suppressed in its favour less often, and the derivation trail records the shrinkage and its cause (BGL Engineering Note DAE-EN-85, internal, 2026-02). The design deliberately inverts the usual data-sharing incentive, in which the laggard free-rides on others’ transparency; here the laggard’s silence is priced into the common record. The residual risk is coordinated withholding — several parties starving the corpus together — which no architecture defeats and which the program treats as a governance failure to be made visible rather than an engineering failure to be prevented: the chain records who contributed what, when, and the aggregate freshness of the corpus is itself a published series (BGL Stratum Governance Log 2026-Q1, internal; Ostrom, 1990).

Class three: stale and corrupted telemetry. The 2003 blackout remains the canonical case study: a state estimator that stopped solving, alarm systems that failed silently, and operators acting on a picture minutes-to-hours old — with the report’s enduring lesson that the dangerous state is not absent data but unflagged stale data (U.S.-Canada Power System Outage Task Force, 2004). The harness applies three controls: protocol-native timestamps preserved end-to-end (IEC 60870-6; IEEE C37.118), Family D freshness bounds that demote stale streams automatically, and cross-source consistency derivations that flag physically impossible combinations — a seam flow reported without the corresponding boundary observations, generation exceeding declared capability — as corpus defects before any formulation consumes them (NERC TOP-003; BGL Calibration Note HG-CN-09, internal, 2026-02). Corruption — deliberate falsification by a contributor — is bounded by attribution: a falsified record is a signed falsified record, discoverable by replay when reality diverges, and the program’s position is that signed-and-eventually-discoverable is the strongest deterrent available short of not accepting contributed data at all (NIST FIPS 186; NERC CIP-011).

Class four: attacks on the evidence layer itself. The chain is only as good as its anchoring: a lab that controls its own ledger could, in principle, fork history. Hence external cross-anchoring — counterparty-held digests, third-party archival — borrowed from the transparency-log playbook, under which rewriting requires simultaneously corrupting parties whose interests conflict (Haber & Stornetta, 1991; RFC 6962). Solver-level attacks — a compromised binary returning subtly suboptimal solutions — are met by certificate checking rather than solver trust: the archived basis and bound certificates are verifiable with independent arithmetic, so the solver is treated as untrusted search, exactly as Thompson’s parable counsels one treat any tool one did not build from verified source (Thompson, CACM 1984; Reproducible Builds project). The register’s honest residual: canonicalization bugs. A defect in the canonical serialization would poison hashes silently and globally; the mitigation is dual independent implementations checked against each other on every run, and the program reports that this check has fired twice in the engine’s history, both on Unicode edge cases in source documents, both caught before any chained artifact shipped (RFC 8785; BGL Incident Note DAE-IN-15, internal, 2026-03).

Class five: institutional capture. The subtlest failure: an evidence engine whose constraint taxonomy quietly absorbs one party’s worldview — whose “governed rules” encode a thumb on the scale — would be worse than no engine, because it would launder advocacy as computation. The program’s defences are procedural and admit their own limits: every rule and taxonomy change is a chained, attributed event; challenged constraints are re-derived under both parties’ values with published deltas; and the corpus governance under which those procedures run is documented in the Stratum layer’s public governance summary (BGL Stratum Governance Log 2026-Q1, internal; Wilson, Econometrica 2002). But the register states plainly what no architecture provides: neutrality is a reputation, earned in adversarial proceedings and forfeitable in one. The engineering makes the earning possible — every decision inspectable, every history immutable — and nothing makes it automatic (BGL Adversarial Review Register HG-AR-06, internal, 2026-04).

Benchmark: Run HG-3105

Claims about tractability should end in a run designation, so this section reports one. HG-3105 is the program’s reference benchmark of the full seam-coordination workload: the complete thirteen-system synthetic corpus, solved and derived interval by interval across a simulated year, on commodity hardware, with the entire evidence apparatus of Sections 6 through 9 engaged. The run is sealed in the ledger with its manifest, certificates, and derivation roots; this section summarizes what the seal contains (BGL Run Ledger HG-3105, internal, sealed, 2026-04).

The corpus. The synthetic corpus is not a caricature. Thirteen SystemNode objects are parameterized from public record: fleet aggregates by ResourceClass from operator and statistical disclosures (IESO; AESO; Statistics Canada; CER), seam capabilities from documented operating envelopes including the McNeill converter’s ~150 MW and the derated BC–Alberta path (CES-Energy; BC Hydro, 2025), hydro energy budgets shaped from published generation seasonality (Hydro-Québec, 2024; BC Hydro IRP, 2021), and Family E terms from the Clean Electricity Regulations’ published trajectory (Canada Gazette, SOR/2024-263). Synthetic elements — hourly load shapes, outage draws, contributed-envelope declarations — are generated by seeded, chained generators so the corpus itself reproduces bit-identically, and the construction rules are documented in the corpus note (BGL Synthetic Corpus Construction Note HG-SC-13, internal, 2026-03). The instance size per hourly interval: roughly 14,000 continuous variables, 300 integer variables in intervals with active cycling decisions, and 31,000 constraint rows after presolve-safe canonicalization — small by ISO standards, deliberately so, per the fidelity argument of Section 6 (PJM Manual 11; BGL Run Ledger HG-3105, internal, sealed).

The result. Across 8,760 hourly intervals, end-to-end interval time — corpus assembly, canonicalization, solve, certificate archival, and full derivation-layer pass including correlation and should-correlate sweeps — had a median of 1.31 seconds and a maximum of 1.94 seconds, on a single commodity workstation-class machine; no interval exceeded two seconds (BGL Run Ledger HG-3105, internal, sealed). The solve itself is the minority of that budget — median 0.42 seconds, with the LP-only intervals far under — consistent with what the modern solver literature would predict for instances of this size (Bixby, OR 2002; Huangfu & Hall, MPC 2018); the majority is derivation and evidence: hashing, chaining, lineage construction, and the sweep logic of Section 7. The program considers that ratio a feature and reports it deliberately: the marginal cost of proof over answer is roughly a second per interval on hardware anyone can buy, which retires the argument that audit-grade evidence is computationally unaffordable for this class of problem (BGL Engineering Note DAE-EN-83, internal, 2026-01). For scale context, the production Tektaris deployment fuses 19 live sources and completes full-corpus analysis in 431 milliseconds in another domain; the grid corpus is larger and slower per pass, and the two-second envelope still leaves a factor of roughly 1,800 of headroom against the hourly cadence the seam workload actually requires (Tektaris Corpus Fusion Report 2026-02, internal).

What the benchmark does and does not show. It shows tractability with evidence engaged, determinism under replication — the full year re-ran bit-identically on a second machine as part of the HG-3099 series extension — and stability of the derivation layer’s output volume: the year produced 3,112 should-correlate findings, 88% concentrated on four seam-direction pairs, a concentration pattern consistent with the public record’s fragmentary evidence about where Canada’s seam value pools (BGL Run Ledger HG-3105, internal, sealed; Energy Regulation Quarterly; AESO, 2025). It does not show that the synthetic corpus is the country. Synthetic benchmarks have a documented tendency to flatter formulations — the OPF community built PGLib precisely because self-selected test cases had drifted easy (IEEE PES PGLib Task Force, arXiv:1908.02788; Birchfield et al., 2017) — and the program’s construction note lists the corpus’s known flatteries explicitly: clean seam telemetry, honest synthetic contributors, no strategic envelopes. HG-3200-series runs, planned against adversarially perturbed corpora from the Section 11 register, exist to remove exactly those comforts (BGL Synthetic Corpus Construction Note HG-SC-13, internal, 2026-03). A benchmark that cannot name what it fails to test is an advertisement; this one can, and the list is part of the sealed record (BGL Adversarial Review Register HG-AR-06, internal, 2026-04).

Limits, Open Problems, and What Would Change Our Mind

Research programs decay into products the day they stop stating what they cannot do. This document closes with the program’s open problems, in the order the internal register ranks their severity (BGL Adversarial Review Register HG-AR-06, internal, 2026-04).

AC feasibility at the interface. The transport-plus-losses seam model cannot see voltage or reactive-power infeasibility at boundary buses; an advisory exchange that is energy-feasible can still be AC-infeasible in an operator’s security tools. The two-stage division of labour — advisory layer proposes, sovereign tools validate — contains the risk but does not close it, and a rejection rate materially above zero would erode the advisory layer’s standing. The literature offers relaxation machinery with feasibility certificates (Molzahn & Hiskens, 2019), and the program’s open question is whether certificate-bearing AC screening at seam buses can be added without importing the contested nodal model Section 4 forswears. This is unresolved, and the program says so (BGL Memorandum HG-M-121, internal, 2026-02).

Envelope truthfulness has no mechanism-design solution. Section 11’s scoring makes strategic declaration costly and visible; it does not make truth-telling a dominant strategy, and by Myerson–Satterthwaite no advisory redesign will (Myerson & Satterthwaite, JET 1983). The program’s wager is institutional: that attributed, scored, progressively-embarrassing misdeclaration converges toward honesty the way monitored markets converged — imperfectly, and well enough (Potomac Economics, 2024; Wolak, 2003). A decade of WEIM-style experience says the wager is reasonable; nothing says it is guaranteed (CAISO, 2024).

Governance is the actual product, and it is unbuilt. The engineering of Sections 4 through 9 makes a trustworthy referee possible. Who convenes it, who funds it, who appoints its challengers, and under what statute its findings carry weight in a CER or provincial proceeding — these are institutional questions the lab cannot answer from a workstation, and the honest reading of the CEAC’s interregional-framework recommendation is that Canada has not answered them either (CEAC, 2024; CER Act, 2019). The program’s contribution is to shrink the governance problem to its true size: with evidence reproducible by all parties, governance no longer needs to adjudicate facts, only to convene their production. That is a smaller problem. It is not a small one (C.D. Howe Institute, 2024; Ostrom, 1990).

What would change our mind. Three falsifiers, stated for the record. If HG-3200-series adversarial runs show that strategic envelopes can systematically corrupt should-correlate findings faster than scoring exposes the strategy, the finding class is demoted from evidence to lead-generation, and this document gets a corrected revision (BGL Synthetic Corpus Construction Note HG-SC-13, internal, 2026-03). If verified-ML methods reach the point where a provincial market monitor will certify a learned seam model’s outputs under challenge — a bar the verification literature itself currently places years out (Venzke & Chatzivasileiadis, arXiv:1910.01624; NERC, 2024) — the determinism argument of Section 10 weakens on its merits, and the program will say so. And if a real counterparty pilot shows that Tri-Con’s reference identity does not, in practice, unlock contribution of sensitive envelopes, then the program’s central institutional hypothesis fails regardless of how well the mathematics runs, because a seam corpus without counterparty data is a literature review with a hash chain (Tri-Con Specification v2.3, internal, restricted; BGL Partner Conversation Log W-2026-02, internal).

The wires are coming; the strategy documents say so in a federal voice Canada has not used about electricity in a generation (PMO, 2026; NRCan, 2026). What flows across them will be decided either by computations every party can check, or by negotiations no party can. This document is the program’s case — formulation, evidence architecture, benchmark, and stated limits — that the first option is buildable now. The partnership conversation is open: research@blackgridlabs.com.